fix(validate-architecture): add stale-citation filter + issue dedupe guard

[AndriiPasternak31]

Problem

The scheduled /validate-architecture job at .claude/skills/validate-architecture/SKILL.md has two correctness bugs that produced the false-positive issue #479.

Bug 1 — No file-existence filter on cited paths

When the job runs against a snapshot taken before a deletion PR (e.g., #430 deleted the entire Process Engine), it produces an issue body that cites file paths which no longer exist in main. The reader has to manually verify every citation against the current tree.

Evidence (#479): cites processes.py, triggers.py, executions.py, approvals.py, services/process_engine/repositories/audit.py, services/process_engine/services/alerts.py, services/process_engine/services/templates.py, ProcessList.vue, ProcessWizard.vue, ProcessEditor.vue, plus voice.py:176-306 (already refactored). All 11 P1-citation paths either don't exist or have been refactored. Net P1 violations after filtering: zero.

Bug 2 — No dedupe guard before gh issue create

SKILL.md:165-204 (Step 4) goes directly to gh issue create whenever any P0-P1 invariant fails. It does not query open automated,priority-p1 issues for fingerprint match. Two consecutive runs on the same broken state produce two duplicate issues.

Concrete sequencing risk discovered today: the current tree triggers invariant #8 (inline auth sprawl) at 85 matches > 5 threshold. Re-running the unmodified skill would create a new automated issue today, even though #479 is already open and tracking the same invariant set.

Fix

Two targeted edits to .claude/skills/validate-architecture/SKILL.md:

1. New Step 2c (between 2b and 3) — "Filter Stale Citations": for every `file:line` citation produced in Step 2a/2b, run `git ls-files ` to confirm the file exists at HEAD. Drop citations whose paths don't exist. If after filtering an invariant has zero remaining citations, downgrade FAIL → PASS-after-filter and note the dropped count in the report.

2. Modified Step 4 — "Create Issue if Critical (with dedupe)": before `gh issue create`, query `gh issue list --repo abilityai/trinity --label "automated,priority-p1" --state open --json number,title,body`. Compute a fingerprint over `(sorted(invariant_numbers), commit_sha)`. If an open issue's body contains the same invariant set, comment on it with the fresh report (`gh issue comment `) instead of creating a new issue. Always include the current `HEAD` commit SHA in the issue body for evidence binding.

Acceptance Criteria

• SKILL.md Step 2c added; cites validated against git ls-files
• SKILL.md Step 4 dedupe guard implemented; fingerprint = sorted invariant numbers
• SKILL.md Step 4 issue body includes `Commit: $(git rev-parse --short HEAD)` line
• Re-running the patched skill against today's tree does NOT create a new issue (dedupe blocks it; Architecture Validation: 4 violations found (2 critical) #479 already open)
• Issue Architecture Validation: 4 violations found (2 critical) #479 closed in the same sweep with evidence comment

References

• Architecture Validation: 4 violations found (2 critical) #479 — false-positive automated issue this fix targets
• decision: fold process engine agent_task through TaskExecutionService, or delete the engine #430 — Process Engine deletion that made Architecture Validation: 4 violations found (2 critical) #479 stale
• Sprint discussion: autoplan dual-voice consensus (Codex + Claude subagent, both phases) recommended this fix

[vybe]

Closed by merged PR.