From 926f0f0c639c719bb603eea3e2b82f5e4ab1de30 Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Sat, 15 Aug 2026 23:31:30 +0100
Subject: [PATCH] Fail closed on invalid event timestamps

---
 backend/services/infonet/time_validity.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/backend/services/infonet/time_validity.py b/backend/services/infonet/time_validity.py
index 76f5efb..f556056 100644
--- a/backend/services/infonet/time_validity.py
+++ b/backend/services/infonet/time_validity.py
@@ -110,12 +110,15 @@ def is_event_too_future(
     *,
     chain_time: float | None = None,
 ) -> bool:
-    """Is ``event.timestamp`` more than ``max_future_event_drift_sec``
-    ahead of ``chain_majority_time``?
+    """Is ``event.timestamp`` invalid or beyond allowed future drift?
 
     Pass ``chain_time`` when the caller has already computed it (e.g.
     bulk validation of a batch — avoids recomputing the median per
     event). Otherwise pass ``chain``.
+
+    Invalid/non-finite event timestamps fail closed: they return
+    ``True`` so callers reject or re-queue them rather than allowing
+    malformed events through the drift gate.
     """
     if chain_time is None:
         if chain is None:
@@ -123,9 +126,7 @@ def is_event_too_future(
         chain_time = chain_majority_time(chain)
     ts = _finite_timestamp(event.get("timestamp"))
     if ts is None:
-        # Non-numeric or non-finite timestamps are their own validation
-        # failure. Drift checking cannot meaningfully compare them.
-        return False
+        return True
     drift = float(CONFIG["max_future_event_drift_sec"])
     return ts > chain_time + drift