[StepenkoAnatoli]

Step 5. The Actions collector, implementing ADR-0031 against ADR-0032's contract. Based on
main; both prerequisites are merged.

Scope, item by item

Asked for	Done
Runs on Actions incl. windows-latest	runs-on input, shell: bash pinned so one script serves both
Require the protected environment + FIRECRAWL_API_KEY	environment: research-collection, secret required non-empty
Fail before spending if the secret is unavailable	credential and environment checks both precede research.mjs
Never fall back to repository secrets	see the honest limit below
Collect into a temporary project	$RUNNER_TEMP, with git status --porcelain checked after
Run artifact.mjs create	yes — and it derives authorization; the workflow cannot assert it
Upload the honestly labelled ZIP	if-no-files-found: error, validated before upload
Pin X-GitHub-Api-Version: 2026-03-10	recorded in the manifest as source.apiVersion
Use the returned workflow_run_id	github.run_id → source.workflowRunId
Topics out of public run and artifact names	neither carries it; names decided before collection
Offline tests, no paid collection in CI	25 tests; workflow_dispatch only, asserted
Windows UI out of scope	not touched

The environment is checked for existence

E-06, verbatim: a workflow referencing an environment that does not exist doesn't fail —
GitHub creates one, with no protection rules and no secrets. A typo in the name would
remove the approval gate and nothing would say so.

So the environment must prove it exists: an environment variable
(RESEARCH_KIT_COLLECTION_ENV) that an auto-created environment cannot have.

The honest limit, written into the workflow rather than implied. GitHub exposes no
scope information to a job — secrets.X resolves environment-first and falls back, and no
syntax or API available to the job distinguishes them. The marker proves the environment
was configured; it cannot prove a repository-level value didn't serve the secret.
Defeating it requires deliberately setting a repository variable of that name. The
enforcement that matters stays where GitHub actually enforces it: the protection rules.

I'd rather state that than claim a guarantee the platform doesn't offer.

A live defect this found in already-merged code

The injection test scans every workflow, and live-collection.yml had been
interpolating four dispatch inputs straight into shell bodies since it was written:

pages='${{ inputs.max_pages }}'

max_pages is free text, so '; curl … | sh; ' would have executed on the runner.
Dispatching needs write access, which bounds severity — it doesn't make it correct. Fixed
here: four env: blocks, zero interpolations left in any shell body.

A defect outside workflows entirely

Feeding the collector a hostile topic found a lib/scaffold.mjs bug:
template/research/plan.json holds "topic": "{{TOPIC}}" and substitution is textual, so
a topic with a double quote wrote a plan.json that does not parse. research.mjs then
reads an empty plan, collects nothing, and blames a file the operator never edited.

Any operator typing Why "agentic" search costs more hit this. Tokens are now JSON-escaped
for .json and verbatim for markdown. Two regression tests — both confirmed red against
the unfixed module first, then green after restoring it.

Verified without spending a credit

Scaffold → plan → map → package → validate, run locally against a topic containing
backticks, $(…), & and quotes:

• topic survived byte-identical into the manifest
• appeared nowhere in the filename
• nothing executed
• package validated PASS / buildAuthorized: false, state COLLECTION_FAILED (correct — the paid step was skipped)

753 passed, 0 failed. Repository preflight PASS. No gate override.

Setup the owner must do, and the gap that remains

Settings → Environments → research-collection: required reviewers, the
FIRECRAWL_API_KEY secret, and RESEARCH_KIT_COLLECTION_ENV=research-collection as a
variable. Deliberately not automated — adding a credential location is yours.

Still unproven, and now the only gap: the runner-side
npm install -g firecrawl@<version> path has never executed. Closing it needs that
environment and one real dispatch.

🤖 Generated with Claude Code