enforce lifecycle evidence contracts

cmd/orchestra/main.go

@@ -221,27 +221,21 @@ func main() {
 			}
 			types := map[string]string{"release": "TaskReleased", "complete": "TaskCompleted", "block": "TaskBlocked"}
 			var p map[string]any
-			if r.Body != nil {
-				if json.NewDecoder(r.Body).Decode(&p) != nil {
-					p = map[string]any{}
-				}
-			}
-			if p == nil {
-				p = map[string]any{}
+			if r.Body == nil || json.NewDecoder(r.Body).Decode(&p) != nil || p == nil {
+				http.Error(w, "invalid lifecycle payload", http.StatusBadRequest)
+				return
 			}
 			if action == "release" && p["reason"] == nil && p["handoff_ref"] == nil {
-				p["reason"] = "released_by_api"
+				http.Error(w, "reason or handoff_ref required", http.StatusBadRequest)
+				return
 			}
 			if action == "block" && p["blocker"] == nil {
-				p["blocker"] = "blocked_by_api"
+				http.Error(w, "blocker required", http.StatusBadRequest)
+				return
 			}
 			if action == "complete" && p["report_ref"] == nil {
-				ref, putErr := s.PutArtifact([]byte("completed without an attached report\n"))
-				if putErr != nil {
-					http.Error(w, putErr.Error(), 500)
-					return
-				}
-				p["report_ref"] = ref
+				http.Error(w, "report_ref required", http.StatusBadRequest)
+				return
 			}
 			ePayload, _ := json.Marshal(p)
 			e = domain.Event{ID: id(), Type: types[action], TaskID: taskID, Version: t.Version + 1, Payload: ePayload}