backends: add noninteractive model workflows to host-owned web execution

Do not start yet: the issue is blocked on #1863 and its workflow roster and input/result schemas are still open. Read docs/plans/host-owned-web-search.md, then packages/ui-backend-pi/src/session-resources.ts, packages/ui-backend-pi/src/worker-protocol.ts and packages/ui-sdk/src/server/web-search.ts to see how the host and worker exchange tool calls. Done means a maintainer-approved design for the model workflows, which the issue does not yet provide.

Current decision handoff — 2026-10-15

All named maintainer questions are resolved: dedicated host-owned workflow/model profiles; explicit requests plus configurable automatic triggers; and configurable per-profile total-call, concurrency and approved-fallback limits. Requested scope remains page answers, automatic summaries and source-supported image/video processing. Preserve host-only credentials, existing authority/routing/budgets/cancellation and #1863's result lifecycle.

All named policy choices are settled. Retain blocked on #1863; the source-qualified roster and implementation/contract boundaries below complete the brief for agent-ready work once that prerequisite is delivered. Earlier dated pending-choice statements below are superseded by this handoff and the later rulings. No implementation, feature-parity, live-provider or passing-runtime claim is implied.

Out of scope

Curator/review UI and arbitrary extension commands; browser-profile/keyring access; arbitrary credential commands; new unrestricted models/providers; restricted autonomous authority; live-provider qualification or deployment. Required subscription/current-model search remains part of #1863 and is not deferred here.

Context

The maintainer selected core web tools only for the first delivery of #1863, with separate follow-ups for model workflows and curator/review UI. The executor is the full upstream extension in an actual trusted Pi session; subscription/current-model search remains required in the initial delivery. This issue extends that foundation rather than moving credentials back into workers.

Read the pinned comparison at docs/plans/host-owned-web-search.md (commit 9274b8a06db43932e17b5d401fcfb900306e97cd), especially Feature and authentication matrix, Full-extension authority map and Common bridge and governance design. Verified local anchors: createSessionResources (packages/ui-backend-pi/src/session-resources.ts:29), piWorkerMessage (packages/ui-backend-pi/src/worker-protocol.ts:64), WEB_SEARCH_PROVIDERS (packages/ui-sdk/src/server/web-search.ts:52), resolveWebSearchConfigPath (packages/ui-sdk/src/server/web-search.ts:188). Read docs/decisions/governed-writable-workers.md and docs/decisions/runtime-requirements.md. The comparison's plain loopback search receipts do not qualify these additional workflows.

Scope

Model selection (maintainer, 2026-10-15): dedicated host-owned workflow/model profiles. Configure admitted answer, summary and media workflows against explicit approved model/provider profiles with host-owned credential resolution. Do not silently substitute the current chat model, broaden routing or accept arbitrary worker-selected model/provider/endpoint identities. Explicit tool requests plus configurable automatic triggers are selected. Total calls, concurrency and approved fallbacks are bounded by host-configurable limits in each workflow profile.

Add the noninteractive model workflows deferred from #1863: fetch_content answer mode, automatic summaries and supported image/video processing. Reuse upstream implementations and the selected trusted Pi session rather than reconstructing a partial ExtensionContext or duplicating provider clients. This is a wanted follow-up; concrete workflow/configuration/authority design and compatibility qualification remain to be completed before implementation readiness.

Acceptance criteria

• Define a source-backed supported workflow roster and exact host/worker inputs/results. Clearly distinguish ordinary extraction/search from additional model calls, unsupported media and unavailable capabilities.
• Use dedicated host-owned workflow/model profiles for admitted answer, summary and media workflows, with explicit approved provider/model identities, capability requirements and credential resolution. Missing/disabled/incompatible profiles refuse honestly; no silent current-chat or alternate-provider fallback outside the configured admitted policy.
• Use real host-owned model/auth context; preserve required subscription/current-model search and credential isolation. Resolve permitted nested model/provider identities through existing host configuration and authorization rather than arbitrary worker parameters.
• Support explicit requests plus host-configurable automatic triggers for the admitted workflows. Define enabled/disabled state and trigger conditions separately from profile existence; a configured model alone does not enable every upstream automatic callback. Snapshot admitted trigger/profile settings, avoid duplicate dispatch, and report actual automatic activity/cost coverage.
• Apply existing data-routing, taint, permissions, budget admission, deadlines and cancellation to every nested provider/model call. Unknown cost remains unknown; document measured accounting coverage and practical limits without claiming complete spend enforcement.
• Bound total nested model/provider calls, concurrency and approved fallback chains through validated host-configurable limits in each workflow profile. Apply them to automatic and explicit execution, including retries, stages and media frames; worker parameters cannot widen them. Preserve finite media/input/output and temporary/cache/background-work bounds under the existing host model. Specify effective limits and truthful refusals before enabling a workflow; do not invent a guarantee from an output cap alone.
• Preserve session-bound result ownership, resume/fork policy and cleanup selected for #1863. No late cross-turn result or command/nested-tool bypass may silently gain authority.
• Retain real offline end-to-end proof for each admitted workflow, failure, cancellation, authority refusal and credential non-disclosure, with explicit live-mode qualification limits.
• Update supported capability/catalog guidance and docs/skills so initial core-only behavior and delivered additions are accurately distinguished. No feature-completeness claim from the plain SearXNG prototype.

Verification

Use fictional Odysseus inputs, real pinned upstream extension/Pi context, real worker-to-host forwarding and loopback-only provider/model fixtures with existing network guards. Record supported versus unavailable/unverified modes and actual child exits/cleanup. Include meaningful guard mutations and restored passes. No live login, provider credentials or paid inference are required by this issue. Run affected local/hosted checks under the repository proof policy when implementing.

Contract impact

Assess supported tool inputs/results, notifications, configuration and SDK/wire/HTTP changes against the existing integration contract. Update authoritative contract docs/API reports and changesets as required. No dependency upgrade, runtime-floor change, public extension seam or production host change is approved by filing this follow-up.

Blocked by #1863

Readiness and authority handoff — 2026-10-15

Priority p2: requested, wanted follow-up work without a release commitment. Retain blocked on the undelivered #1863 foundation. Keep the feature type: the final deliverable is supported model workflows, not merely a research report.

All named policy choices are settled: dedicated workflow/model profiles, explicit requests plus configurable automatic triggers, and configurable per-profile call/concurrency/fallback limits. Remove needs: decision. Complete the source-backed workflow/API mapping, supported/excluded roster and concrete configuration/contracts under those choices; do not silently drop requested workflows or treat routine limit defaults as a new policy prerequisite.

Completion evidence is a dated supported/excluded roster and trigger/model-authority ruling, folded into scope, input/result schemas and per-call routing/budget/cancellation criteria. Inspect the pinned upstream paths and #1863's delivered bridge before proposing the exact matrix. Preserve required subscription/current-model search in #1863, host-only credentials, no arbitrary worker model selection, finite resources, truthful unknown spend and the existing offline proof. No new human-access or live-provider prerequisite is added. Readiness follows the completed brief below; implementation remains blocked on #1863. No implementation or new runtime proof is claimed.

Decision (maintainer, 2026-10-15): B — dedicated workflow/model profiles

Select B from the model-selection interview: use explicit, separately configured host-owned workflow/model profiles for page answers, summaries and supported media processing. Profiles select approved providers/models and the required capabilities through trusted host configuration/settings; credentials remain in the host executor. Reuse existing auth, permission, data-routing, budget and cancellation mechanisms rather than introducing a generic provider seam or credential copy.

Define which workflows use each profile and disclose the effective selection and supported capability. Missing, disabled, unauthorized or incompatible profiles return an honest unavailable/refused result. Do not silently use the current chat model, select arbitrary worker-supplied models/endpoints or introduce an unapproved routing fallback. Exact shared-versus-per-workflow profile representation, defaults and schema belong to the concrete supported-input/contract design; the selected policy does not require a new configuration interview for routine field choices.

Alternatives were reusing existing general model configuration, per-request selection from approved models, or deferral. B gives explicit workflow-specific capability/cost control at the cost of additional configuration/settings. It does not approve an arbitrary nested-model roster, automatic/background triggers, unbounded fan-out, live credential use or deployment.

2026-10-15 decision reconciliation: dedicated workflow/model profiles selected. Supported/excluded roster and trigger/background/fan-out policy remain open; retain needs: decision and blocked on #1863, without agent-ready. No implementation or model-runtime qualification is claimed.

Decision (maintainer, 2026-10-15): B — explicit requests plus configurable automatic triggers

Allow explicitly requested workflow tool calls and automatic execution under host-configured trigger rules. Configure which admitted answer/summary/media workflows may run automatically and under what conditions, using the selected dedicated workflow/model profiles. Merely configuring a profile does not implicitly enable every upstream automatic behavior. A disabled/unavailable trigger or missing/incompatible profile must not silently dispatch another model/provider path.

Use the existing principal/session/turn admission, permissions, data-routing, budgets, deadlines and cancellation for automatically triggered calls as well as explicit requests. Preserve session-bound result ownership and truthful progress/failure/cancellation. Do not start unrestricted model turns or detached work without the applicable existing lifecycle authority. Show what ran automatically and available cost/usage, preserving unknown spend honestly. Define settings/defaults and exact event/input predicates in the source-backed specification, with ordinary implementation judgment under the selected opt-in/configuration policy.

Alternatives were explicit requests only, upstream automatic behavior whenever a profile exists, or user confirmation before each operation. B supports automation with host control, at the cost of explicit trigger configuration, duplicate-event handling and accounting. This selects no new browser/credential-command modes, restricted autonomous authority or unbounded fan-out.

2026-10-15 decision reconciliation: trigger B selected, alongside model-profile B. The requested answer/summary/source-supported media roster remains in scope; fan-out policy remains the named maintainer question. Retain needs: decision and the existing foundation blocker without agent-ready; no implementation or runtime qualification is claimed.

Decision (maintainer, 2026-10-15): B — configurable fan-out limits in workflow profiles

Select B: each host-owned workflow profile has validated finite limits for total model/provider calls, concurrent calls and approved fallback behavior. Apply the same admitted limits to explicit and automatically triggered workflows. Multi-stage answering/summarizing or media processing may make several calls within the admitted profile; a worker cannot widen the roster, fallback chain or limits through tool parameters.

Count retries, fallbacks and frame/stage expansion toward the relevant call/work bounds rather than letting nested callbacks reset them. Coordinate admission with existing session/global resources, routing, permissions, budgets and cancellation. No new blanket per-call confirmation is selected. Report limit exhaustion, partial work and unavailable outputs truthfully, with no success claim for an incomplete result or silent routing to an unapproved model/provider. Unknown cost remains unknown; configurable call bounds are not a complete spend guarantee.

Choose practical defaults and exact counting/configuration semantics during source-qualified implementation design. Validate overrides, keep each admitted operation's settings consistent and test boundary/exhaustion, concurrent admission, fallback/retry accounting and cancellation through real upstream/worker paths. No numeric value, generic extension seam, credential-command/browser mode or unbounded detached execution is authorized by this choice.

Alternatives were fixed pipelines, one model call per request, or confirmation beyond an initial allowance. B fits dedicated profiles and varied workloads, at the cost of additional settings and validation. It does not require a new maintainer interview merely to select routine finite defaults under this policy.

2026-10-15 decision reconciliation: model profiles B, triggers B and fan-out B are settled. Remove needs: decision; retain the existing #1863 foundation blocker and absence of agent-ready until concrete scope/contracts and readiness are reviewed. Source-backed capability mapping, actual implementation and offline qualification remain required; none is claimed by the policy selection.

Source-qualified implementation roster — 2026-10-15

Reviewed the upstream 0.41.0 files at immutable commit d47dc040552505e3b135d0136a0b15eaf4bdba52, alongside the delivered comparison in docs/plans/host-owned-web-search.md and inspected kit main d9ac37b82700d7b45406ba47c0850ae46251fa9b. These are source-supported adapter targets, not runtime-qualified capabilities:

The authoritative source is the pinned upstream tree. Exact public fields/defaults are implementation choices under the three recorded policies: a narrow workflow selector plus validated content/question/media controls, bound to host-owned profile/trigger identities. Do not forward upstream answerModel, model, credential auth, proxy, arbitrary local path or endpoint controls verbatim from a worker. Resolve admitted selections on the host and reject unknown/widening fields. Preserve source identity, typed text/image results, errors, truncation, partial/limit-exhausted state and available model/usage metadata; do not infer success from transport or make a full upstream parity claim.

Implement additive supported tool/configuration/result contracts together with the applicable integration-contract index, wire/API reports, docs and minor changesets for affected packages; use CONTRACT commits. No breaking change, new HTTP surface or generic provider seam is preselected. Curator/review UI stays with #1988, optional credential/browser adapters with #1989, and foundation search/auth/result ownership with #1863.

Verification must execute each admitted branch through the real pinned extension/Pi session and worker-host bridge with fictional loopback inputs. Include exact boundary/byte/frame/call/concurrency/fallback limits, disabled trigger/profile and arbitrary-model denial, missing dependencies, repeated events, cross-session handles, cancellation/revocation/late results, cleanup and truthful model-versus-deterministic metadata. Mutations must fail the intended forwarding, authorization and shared-admission assertions before restored passes; passing extraction alone cannot qualify nested inference. Live authentication and actual provider parity remain explicitly unverified.

2026-10-15 readiness review: all named policy questions are settled, the source-backed requested roster and concrete adapter/contract/proof boundaries are now recorded, and no new design, access or reproduction prerequisite is found. Add agent-ready together with blocked: #1863 remains open and must deliver its executor/bridge before this implementation can be picked up. Routine field/default selection and runtime qualification are implementation work, not another policy interview. No feature implementation or new runtime execution was performed by this triage.