[q] Add PDF-aware preliminary investigation sub-agent + allow arXiv URLs in reports

[github-actions]

Q Workflow Optimization Report

Requested via discussion #55048 comment by @pelikhan:

add subagents to do preliminary investigation. Use agentic engine that can read PDFs or use MCP to open PDF. Allow archiv URLS in report

Changes Made

daily-arxiv-researcher (.github/workflows/daily-arxiv-researcher.md)

• Added a new preliminary-investigator sub-agent, invoked in a new Step 1b before the abstract-only paper-screener pass. It fetches each paper's PDF ((arxiv.org/redacted) and extracts full text using the kreuzberg MCP server (extract_file/extract_bytes), returning a short preliminary_note used to enrich screening/ranking/opportunity-extraction. Falls back gracefully (pdf_fetched: false`) if extraction fails, so it never blocks the pipeline.
• Imported shared/mcp/kreuzberg.md (existing, already-vetted document-extraction MCP server; no new container needed — the docker.io/mcp/arxiv-mcp-server alternative remains disabled due to unresolved CVEs per issue [container-image-scan] Container findings for mcp/arxiv-mcp-server #51713).
• Added safe-outputs.allowed-domains: ["arxiv.org", "export.arxiv.org"] so arXiv URLs in the generated research discussion are no longer redacted by the safe-outputs URL sanitizer (which only allows github.com/GitHub domains by default).

shared/mcp/kreuzberg.md

• Moved the usage documentation out of an HTML comment into plain markdown text. The markdown security scanner's hidden-content check flags HTML comments containing code/URLs as suspicious, which caused compilation to fail once this shared file was actually imported. No functional/tool changes.

Expected Improvements

• Papers with actionable techniques buried in methodology/results sections (not summarized in the abstract) are now more likely to be caught before the abstract-only screening step discards them.
• arXiv paper links in the generated discussion report will render as normal, clickable links instead of being redacted.

Validation

Compiled successfully via the compile tool from the gh-aw MCP server:

• ✅ daily-arxiv-researcher
• ✅ pdf-summary (unaffected, verified no regression)

.lock.yml files were regenerated locally to confirm compilation succeeds, then reverted — they will be regenerated automatically after merge.

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• .github/workflows/daily-arxiv-researcher.md

• .github/workflows/shared/mcp/kreuzberg.md

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 32727000343 -n agent -D /tmp/agent-32727000343

# Create a new branch
git checkout -b gh-aw/pre-created/32727000343-1 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-32727000343/aw-q-arxiv-researcher-subagents-pdf-arxiv-urls.patch

# Push the branch and create the pull request
git push origin gh-aw/pre-created/32727000343-1
gh pr create --title '[q] Add PDF-aware preliminary investigation sub-agent + allow arXiv URLs in reports' --base main --head gh-aw/pre-created/32727000343-1 --repo github/gh-aw

🎩 Equipped by Q · copilot · auto · 105.8 AIC · ⌖ 10.3 AIC · ⊞ 12.2K · ◷
_{Comment /q to run again}

• expires on Aug 26, 2026, 4:37 AM UTC-08:00