Converge check onto --context-dir; let request-http read headers.json

[scott-cotton]

Summary

Action manifest changes that match signadot/signadot#6861.

check/ACTION.md

The script body is rewritten to invoke actionbox check with --context-dir ./context instead of --input/--attr. The new binary loads every file in the context directory into a single map and uses it as the expression env, with {name, expression, results_file, attrs} reserved for the action itself. The object input declaration is dropped: plans bring values into the check expression via extra_inputs declared on the step, exactly the way eval already does.

The prose explaining the directory model, reserved names, and extra_inputs wiring pattern is added to the action description so the LLM compiler sees it (and so plan authors reading the source see it too). The expression examples are updated to assume an extra_inputs: [{name: capture}] declaration with refs wiring capture to a previous step's HTTP capture.

check/schemas/attrs.json

Schema changes from array<string> (with a "^[^=]+=.+$" pattern enforcing key=value formatting) to a flat object<string, string>. Failure metadata is now expressed as natural JSON.

request-http/ACTION.md

The dead line-delimited headers loop is replaced with a single line:

[ -f ./context/headers.json ] && set -- "$@" --headers-file ./context/headers.json

The new binary decodes the JSON array of strings and merges them with any explicit --header flags. This was the only path that ever wrote the schema-typed headers param (it lands as .json because of its schemaRef), so the previous shell guard was unreachable in practice.

Companion PR

Requires the binary changes in signadot/signadot#6861. The new ACTION.md scripts call actionbox check --context-dir and actionbox request-http --headers-file, which the pre-PR binary doesn't recognize. The new sandboxes binary must be deployed before actionsync is pointed at this branch, otherwise plans with check or request-http steps will hard-fail at runtime with "unknown flag".

Migration notes

Existing compiled plans that wired check via refs: {object: ...} will fail validation after actionsync updates the check action definition (because object is no longer a declared param). The mitigation is recompilation — the compile API picks up the new shape automatically. See the companion PR for the full migration story.

Test plan

• Verified end-to-end against a minikube deployment with actionsync pointed at this branch and a sandboxes binary built from the companion PR
• Original headers bug reproducer (X-Custom-Auth from a plan param composed via eval, sent through request-http, asserted by check) — header reaches httpbin and check passes. This also exercises the runner-side schema-typed write path that attrs.json would use.
• Plan-level drill-in output (output: {status_code: steps.send_request.outputs.capture.response.statusCode}) — runtime produces the integer 200

Note: a failing-check-with-attrs.json end-to-end isn't included because the schema-typed write path is already covered by the headers test (same WriteContext code path) and the check binary's failure-metadata behavior is covered by unit tests.

🤖 Generated with Claude Code

[daniel-de-vera]

LGTM