Verify normalized task approval facts and preserve signed source types

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

verifier/testsupport/signer/main.go

@@ -6,7 +6,7 @@ import (
 	"crypto/ed25519"
 	"encoding/json"
 	"github.com/netkingdom/access-engine/internal/sign"
-	"github.com/netkingdom/access-engine/pkg/api"
+	"io"
 	"os"
 )
 
@@ -17,8 +17,12 @@ func main() {
 		seed = 0x43
 		kid = "next-admitted"
 	}
-	var env api.DecisionEnvelope
-	if json.NewDecoder(os.Stdin).Decode(&env) != nil {
+	raw, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		os.Exit(1)
+	}
+	env, err := sign.DecodeEnvelope(raw)
+	if err != nil {
 		os.Exit(1)
 	}
 	if sign.Sign(&env, ed25519.NewKeyFromSeed(bytes.Repeat([]byte{seed}, 32)), kid) != nil {