feat(autonomous-release): strengthen release plan binding

services/aios-autonomous-release-candidate/aios_autonomous_release_candidate/models.py

@@ -329,6 +329,9 @@ class ResultEnvelope:
 
 @dataclass(frozen=True, slots=True)
 class ReleasePlan:
+    task_id: str
+    repository: str
+    branch: str
     version: str
     target_oid: str
     tree_oid: str
@@ -336,6 +339,7 @@ class ReleasePlan:
     manifest_sha256: str
     evidence_closure_oid: str
     approval_plan_id: str
+    rollback_approval_plan_id: str
     rollback_artifact_sha256: str
     expected_tag_oid: str
     expected_target_oid: str
@@ -353,5 +357,18 @@ class ReleasePlan:
         ):
             if not is_sha256(getattr(self, name)):
                 raise ValueError(f"{name} must be a SHA-256 hex digest")
-        if not self.version or not self.approval_plan_id or not self.expected_tag_oid:
+        if not is_git_oid(self.expected_tag_oid):
+            raise ValueError("expected_tag_oid must be a full lowercase 40-character Git OID")
+        if (
+            not self.task_id
+            or "/" not in self.repository
+            or not self.branch.startswith("integration/")
+            or not self.version
+            or not self.approval_plan_id
+            or not self.rollback_approval_plan_id
+        ):
             raise ValueError("release identifiers are required")
+        if self.approval_plan_id == self.rollback_approval_plan_id:
+            raise ValueError("deployment and rollback approvals must be distinct")
+        if self.target_oid != self.expected_target_oid:
+            raise ValueError("target_oid must equal expected_target_oid")