[andife]

Summary: Replace deprecated naive datetime.utcnow calls with timezone-aware UTC timestamps and add a UTC-awareness regression test. Testing: the schema test passes and no utcnow calls remain under src.

[drk-ram]

Reviewed all three changed files at 675b204da98f2cd40e94b1f095ae86f5a54f3a2f. Approved.

Both changed emission paths now create an aware UTC datetime before serialization. ExtractionResult.timestamp remains a per-instance factory rather than a timestamp evaluated at import time. Importing datetime.UTC is compatible with the project's declared requires-python = ">=3.11".

Validation:

• python -m pytest tests\test_schemas.py -q --no-cov passed.
• I separately exercised log_sbom_generation() with a synchronous executor and mocked dataset load/push boundary, capturing the actual analytics payload. Its timestamp parsed with an explicit zero UTC offset and the push path completed without contacting the external sink.

The emitted +00:00 is valid RFC 3339 UTC; changing it to Z is not necessary for this fix. Non-blocking follow-up: retain coverage of the analytics emission as well as the schema default.

For any future signed provenance profile, distinguish time-zone correctness from byte-level canonicalization: equivalent timestamp spellings or precisions are different JSON strings. Specify the accepted UTC spelling/precision before constructing a signed preimage. RFC 3339 §5.6 defines the timestamp syntax; draft-durga-agenttrust-trace-verification-00 §§3,5 (work in progress) and TR-2026-03, DOI: 10.5281/zenodo.23775009 provide related canonicalization and temporal-verification context. This PR correctly addresses UTC awareness without claiming to establish that broader signed-record profile.