[imran-siddique]

What changed

• add the pre-alpha @agentrust/telemetry Node/TypeScript reference package
• implement shared-schema validation, metadata-only privacy enforcement, event construction, caller-owned OTel span/log projection, and W3C plus AgentTrust context propagation
• add shared conformance-fixture and golden-event parity tests across Python and TypeScript
• encode Unix nanosecond timestamps as canonical decimal strings on the JSON wire and convert only at telemetry API boundaries
• add a dedicated TypeScript CI job, npm lockfile, package-content checks, schema-byte drift gate, and cross-ecosystem version gate

Why

JavaScript numbers cannot exactly represent current Unix nanosecond values. Keeping JSON integer timestamps would silently alter event bytes, evidence digests, and approval ordering in a TypeScript implementation. Decimal strings preserve the 64-bit value and make a truthful cross-language SDK possible.

Impact

This is a breaking change to the pre-alpha 0.1.0-dev wire contract: time_unix_nano, requested_at_unix_nano, and expires_at_unix_nano are now canonical decimal strings. Python factories accept integer inputs and normalize them. OTel projection converts the string back to the API-native timestamp type.

The TypeScript package intentionally does not yet claim parity for the Python evidence accumulator, metric emitter, usage rollup helper, source adapters, or TRACE finalizer; those are documented follow-on work.

Validation

• Python: 91 tests and 20 subtests
• TypeScript: 9 tests on shared fixtures and golden output
• independent conformance runner, including numeric-timestamp rejection
• Python and TypeScript schema byte parity
• cross-ecosystem version gate
• Python compilation and package build
• TypeScript strict compilation and npm pack --dry-run
• isolated install/import of the packed npm artifact
• CodeQL/CI pending on this PR