Bind trusted task approval to exact producer facts and lifetime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

internal/registry/numeric_source_test.go

@@ -0,0 +1,36 @@
+package registry
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestTaskRegistryNumericSourceAndStrictDecode(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "snapshot.json")
+	raw := []byte(`{"resource_manifests":[{"id":"synthetic","system":"secrets-engine","resources":[{"id":"catalog:synthetic","type":"secret-catalog-lane","attributes":{"float":1.0,"integer":9007199254740993,"negative_zero":-0.0}}]}]}`)
+	os.WriteFile(path, raw, 0600)
+	store, err := LoadFilePreservingNumbers(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !store.NumbersPreserved() {
+		t.Fatal("missing source profile")
+	}
+	resource, ok := store.Resource("secrets-engine", "catalog:synthetic")
+	if !ok {
+		t.Fatal("missing resource")
+	}
+	for k, v := range map[string]string{"float": "1.0", "integer": "9007199254740993", "negative_zero": "-0.0"} {
+		if resource.Attributes[k] != json.Number(v) {
+			t.Fatalf("lost native representation: %s", k)
+		}
+	}
+	for _, raw := range []string{`{} {}`, `{"subjects":[],"subjects":[]}`, `{"unknown":true}`} {
+		os.WriteFile(path, []byte(raw), 0600)
+		if _, err := LoadFilePreservingNumbers(path); err == nil {
+			t.Fatal("invalid authoritative registry accepted")
+		}
+	}
+}