ci(framework): mechanically enforce cross-plugin orthogonality on PRs #250

Mechanically enforce the architecture rules a PR can silently break. Today they are self-attested at best, and #406 is the proof: aidd-orchestrator hardcodes aidd-dev, violating cross-plugin orthogonality, and nothing caught it.

Relationship to #406

• fix(aidd-orchestrator): hardcodes aidd-dev, violates cross-plugin orthogonality #406 fixes the violation that exists today.
• This issue stops the next one from landing.

One does not replace the other. Without this check, #406 recurs.

What to enforce

• Cross-plugin orthogonality. No plugin references another by name. docs/ARCHITECTURE.md states the rule; nothing verifies it. A grep for aidd-<plugin>: outside its own plugin is a first approximation, but skill descriptions and routing regexes need a real check.
• Docs match behavior. A change to a skill's actions that leaves its description and SKILL.md router table stale.

Note on the original scope

This issue was written when .github/PULL_REQUEST_TEMPLATE.md carried a checklist with "Docs updated" and "No cross-plugin references introduced". That checklist is gone: the template now certifies one thing only, that a human read every line. The rules survive in docs/ARCHITECTURE.md, unenforced — which is exactly the gap this issue fills.

Acceptance criteria

• A PR introducing a hardcoded aidd-<plugin>: address outside its own plugin fails a check.
• The check names the file and line, not just the rule.
• The existing violations in fix(aidd-orchestrator): hardcodes aidd-dev, violates cross-plugin orthogonality #406 are the fixture: the check must catch them.

Guardrail local et CI

Un unique vérificateur d’orthogonalité est exécuté à deux niveaux :

• Pré-commit local : Lefthook l’exécute sur les fichiers modifiés et bloque le commit avec le fichier, la ligne et le plugin propriétaire.
• CI : validate.yml exécute les mêmes hooks sur toute l’arborescence. Elle reste l’autorité finale et bloque toute contribution ayant contourné le hook local.

Le garde-fou est un hook Git, pas un hook IA : il doit être déterministe, valable pour tous les outils et ne jamais dépendre d’un événement ou d’une configuration d’hôte IA.

Les deux niveaux vérifient les adresses inter-plugins et la cohérence entre actions, description et routeur d’un skill.