Let General Chat search the web, and only General Chat

Search is the one capability that fits the profile holding none: every other capability either
reads this installation or changes it, and chat's whole contract is that it can do neither. The
assistant deliberately does not get it — its contract is that answers come from this install's
own documents, and a web result there is an answer that looks sourced and is not. A chat question
about this machine hands off to the assistant before the search would run, so it never reaches
the internet even with the box ticked.

Off by default, and not because it is dangerous: searching sends the operator's question outside
the house, which is theirs to decide. Asked for per turn as well as enabled in conf.

Provider-agnostic, as asked — searxng, brave, tavily. Only whichever is configured here can be
verified; all three read every field by name, so a shape that changes underneath yields no
results rather than wrong ones.

The explain fixtures asserted chat holds no capabilities at all, which is exactly the guarantee
worth keeping. caps=only: now states the set rather than its emptiness, so the check still fails
the day something else is granted there.

Deployment/host.conf.template

@@ -580,6 +580,13 @@
     HOSTN_OLLAMA_URL=""                          # e.g. http://localhost:11434 — empty if no local Ollama
     HOSTN_OLLAMA_GPU_UUID=""                     # pins Ollama to one card on multi-GPU hosts
     HOSTN_OLLAMA_MODEL="hf.co/unsloth/Qwen3-14B-GGUF:IQ4_XS"  # generation — must fully offload; see README-AI.md
+
+# ━━━ Web search ━━━
+# Per-host because one is an address on this network and the other is a credential. Only the
+# General Chat profile can use these — it is the profile that cannot change anything, which is
+# why it is the one allowed to look outside. Off until AI_WEB_SEARCH_ENABLED says otherwise.
+    HOSTN_SEARXNG_URL=""                         # e.g. http://localhost:8888 — needs format: [json] in its settings.yml
+    HOSTN_WEB_SEARCH_API_KEY=""                  # brave or tavily; unused when the provider is searxng
     HOSTN_OLLAMA_EMBED_MODEL="nomic-embed-text"  # embeddings — the generation model cannot embed
 
 # ━━━ Authelia ━━━

Deployment/master.conf.template

@@ -1822,6 +1822,31 @@
 # Both are bounded by time (since the last pass) and by a line cap, so a flood costs one pass.
 # Tools/ai_log_check.sh replays this host's real logs against the patterns — run it after
 # changing any of them.
+# ━━━ AI Web Search ━━━
+# General Chat only. Every other profile either reads this installation or changes it; chat holds
+# no capability at all, and that is exactly why searching is the one thing it may do — a read that
+# leaves the house is safe on the profile that cannot act on what it finds. The Varaverk assistant
+# deliberately does not get it: its contract is that answers come from this installation's own
+# documents, and a web result there is an answer that looks sourced and is not.
+#
+# Off by default, and not because it is dangerous. Searching sends the operator's question to
+# something outside this house, and that is their decision to make rather than a default to
+# inherit. Nothing turns it on.
+#
+# Asked for per turn as well — there is a checkbox on the AI tab, and a question is only searched
+# when it is ticked. A question about this machine hands off to the assistant before the search
+# would run, so it never reaches the internet even with the box ticked.
+#
+# Provider: searxng | brave | tavily
+#   searxng  self-hosted, no key, no third party — set HOST*_SEARXNG_URL, and enable format: [json]
+#            in its own settings.yml, which the default image ships with off
+#   brave    HOST*_WEB_SEARCH_API_KEY, free tier available
+#   tavily   HOST*_WEB_SEARCH_API_KEY
+    AI_WEB_SEARCH_ENABLED=false
+    AI_WEB_SEARCH_PROVIDER=searxng
+    AI_WEB_SEARCH_RESULTS=4
+    AI_WEB_SEARCH_TIMEOUT=6
+
     AI_REPAIR_SYSLOG_ENABLED=true
     AI_REPAIR_SYSLOG_MAX_LINES=4000
     AI_REPAIR_CONTAINER_LOGS_ENABLED=true