fix: agents skip formal modeling in --full mode (#47) (#49)

* fix(quick-375): revise plan based on quorum BLOCK feedback

* feat(quick-375): add formal-skip prevention guardrails to quick.md workflow

* docs(quick-375): issue-47-agents-skip-formal-modeling

* docs(quick-375): update verification status

* req(quick-375): add GUARD-01

* test(quick-375): add structural tests for GUARD-01 workflow guardrails

* fix(quick-375): add MUST_NOT_SKIP to orchestrator steps 2.7, 5, 5.5, 5.7, 5.8

* docs(quick-375): add scope contract and quorum debate logs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: authenticate gitleaks API call to avoid rate-limit 404s

The 'Install gitleaks' step fetches the latest release tag from
the GitHub API without authentication.  In CI, unauthenticated
requests hit the 60-req/hr rate limit, returning empty JSON.
This produces a malformed download URL that 404s.

Fix: pass GITHUB_TOKEN as Bearer auth (5 000 req/hr) and add a
guard that fails early with a clear error if the version lookup
returns empty.

* chore: gitignore ephemeral formal verification artifacts

Untrack files regenerated every formal-verify cycle:
- diff-report.md, gates/, promotion-changelog.json, suspects.md
- .planning/memory/ (agent error logs)

These cause persistent dirty working tree state without
carrying meaningful tracked content.

* chore(deps): bump @hpcc-js/wasm-graphviz 1.21.0 -> 1.21.2

---------

Co-authored-by: jobordu <jonathan@jonathanborduas.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/secret-scan.yml

@@ -36,8 +36,15 @@ jobs:
           fetch-depth: 0
 
       - name: Install gitleaks
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep '"tag_name"' | sed 's/.*"v\(.*\)".*/\1/')
+          GITLEAKS_VERSION=$(curl -sH "Authorization: Bearer $GH_TOKEN" https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep '"tag_name"' | sed 's/.*"v\(.*\)".*/\1/')
+          if [ -z "$GITLEAKS_VERSION" ]; then
+            echo "::error::Failed to fetch latest gitleaks version from GitHub API"
+            exit 1
+          fi
+          echo "Installing gitleaks v${GITLEAKS_VERSION}"
           curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz
           chmod +x gitleaks
 

.gitignore

@@ -98,6 +98,15 @@ states/
 .planning/formal/coverage-gaps.md
 .planning/formal/assumption-gaps.md
 
+# Formal verification run artifacts (regenerated every verify cycle)
+.planning/formal/diff-report.md
+.planning/formal/gates/
+.planning/formal/promotion-changelog.json
+.planning/formal/suspects.md
+
+# Agent memory logs (runtime artifacts)
+.planning/memory/
+
 # Nested planning artifacts in .formal
 .planning/formal/alloy/.planning/
 

.planning/STATE.md

@@ -16,9 +16,11 @@ See: .planning/PROJECT.md
 |---|---|---|---|---|---|
 | 374 | Make API slots backup-only | 2026-04-04 | 99b79b4f | Verified | [374-make-api-slots-backup-only-dispatch-to-a](./quick/374-make-api-slots-backup-only-dispatch-to-a/) |
 | 379 | Issue #46: Add formal model staleness detection via content hashing | 2026-04-05 | 7ae0fe01 | Needs Review | [379-issue-46-add-formal-model-staleness-dete](./quick/379-issue-46-add-formal-model-staleness-dete/) |
+| 375 | issue-47-agents-skip-formal-modeling | 2026-04-05 | d174cae7 | Verified | [375-issue-47-agents-skip-formal-modeling](./quick/375-issue-47-agents-skip-formal-modeling/) |
 
 ## Session Log
 
+- 2026-04-05 - Completed quick task 375: issue-47-agents-skip-formal-modeling
 - 2026-04-04: Completed quick task 374 - Make API slots backup-only
 - 2026-04-04: STATE.md regenerated by /gsd:health --repair
 - 2026-04-05: Completed quick task 379 - Issue #46: Add formal model staleness detection via content hashing