enforce lifecycle contracts and scratch transport

internal/domain/domain.go

@@ -131,20 +131,27 @@ func ValidatePayload(typ string, p map[string]any) error {
 			return fmt.Errorf("%w: expected_version invalid", ErrInvalid)
 		}
 	case "TaskReleased":
-		if v, ok := p["anchor_sha"].(string); ok && (len(v) != 40 || strings.TrimSpace(v) != v) {
-			return fmt.Errorf("%w: anchor_sha invalid", ErrInvalid)
-		}
 		if err := requiredString("handoff_ref"); err != nil && p["reason"] == nil {
 			return err
 		}
+		if _, ok := p["handoff_ref"]; ok {
+			if err := requiredHash(p, "handoff_ref"); err != nil {
+				return err
+			}
+			v, ok := p["anchor_sha"].(string)
+			if !ok || len(v) != 40 || strings.TrimSpace(v) != v {
+				return fmt.Errorf("%w: anchor_sha invalid", ErrInvalid)
+			}
+		}
 	case "TaskCompleted":
 		if err := requiredString("report_ref"); err != nil {
 			return err
 		}
-		if receipt, ok := p["receipt"]; ok {
-			if m, ok := receipt.(map[string]any); !ok || len(m) == 0 {
-				return fmt.Errorf("%w: receipt invalid", ErrInvalid)
-			}
+		if err := requiredHash(p, "report_ref"); err != nil {
+			return err
+		}
+		if receipt, ok := p["receipt"].(map[string]any); !ok || len(receipt) == 0 {
+			return fmt.Errorf("%w: receipt required", ErrInvalid)
 		}
 	case "TaskFailed":
 		if err := requiredString("reason"); err != nil {
@@ -154,6 +161,11 @@ func ValidatePayload(typ string, p map[string]any) error {
 		if err := requiredString("blocker"); err != nil {
 			return err
 		}
+		if _, ok := p["handoff_ref"]; ok {
+			if err := requiredHash(p, "handoff_ref"); err != nil {
+				return err
+			}
+		}
 	case "TaskAmended":
 		if len(p) == 0 {
 			return fmt.Errorf("%w: amendment cannot be empty", ErrInvalid)
@@ -182,3 +194,14 @@ func ValidatePayload(typ string, p map[string]any) error {
 	}
 	return nil
 }
+
+func requiredHash(p map[string]any, key string) error {
+	v, ok := p[key].(string)
+	if !ok || len(v) != 64 {
+		return fmt.Errorf("%w: %s must be sha256", ErrInvalid, key)
+	}
+	if _, err := hex.DecodeString(v); err != nil {
+		return fmt.Errorf("%w: %s must be sha256", ErrInvalid, key)
+	}
+	return nil
+}