[togofishicorn]

Python's default JSON decoder accepts NaN/Infinity, so envelope wrapping can make invalid JSON look like normal collected evidence. Reject those constants before wrapping, and serialize new envelopes with allow_nan=False so metadata or numeric overflow cannot introduce non-finite output.

Preserve the original file and log the failure through the existing per-file skip behavior. Valid payloads and YAML date metadata retain their existing behavior. Includes regression coverage, a changelog entry and operator troubleshooting guidance.

Adapted from JSON qualification hardening by Cody Mitchell (@cmitchell-du) at Defense Unicorns. This contribution reuses the native envelope path. Timestamp ordering needs a separate shared contract and is proposed in #259.

Validation:

• Before the fix: 10 negative cases failed against unchanged upstream; 16 cases passed.
• After the fix: all 26 envelope cases pass.
• ruff check framework/: pass.
• mypy framework/: pass, 47 source files.
• Full local pytest: 6223 passed, 3 failed, 59 skipped, 11 subtests passed. All three failures also reproduce on unchanged base 5dac90a in the same environment: the CertificateClient SDK test lacks azure.keyvault.certificates, and two CLI color tests fail their ANSI assertions. This is not a claim that the full suite is green.

Scope: envelope wrapping only. This does not replace consumer qualification or add a universal timestamp/freshness rule, and it does not harden every separate uploader or legacy-artifact read path. Originals remain preserved rather than silently repaired.

[bruceweygandt]

Thank you for this fix. I merged main into the branch to resolve the CHANGELOG conflict and kept both entries. The envelope tests (26), ruff and mypy on framework/, and the full suite all pass on the merge, and CI is green. Approved.