[BUG][P0][PRIVACY] Stop default task-title egress to DuckDuckGo; make web research explicit and policy-bound

[Joncallim]

Parent programme: #333
Execution mode: implementation
Depends on: none
Primary VNext consumer: #335

Bug Summary

Forge enables public web research by default and sends user task information to DuckDuckGo before any Resource classification/data-egress policy exists.

Current Behaviour

• scripts/install.sh and scripts/setup.sh set FORGE_AGENT_WEB_SEARCH=1 by default.
• buildWebResearchContext() disables research only when the variable is explicitly 0.
• The first query embeds ${task.title} ${profile.type} best practices and sends it to https://api.duckduckgo.com/.
• Agent/provider self-evaluation can also invoke web research by default.

A task title may contain customer names, internal project names, incident details, repository identifiers or other private information. This egress is separate from the configured model-provider path and currently has no per-Resource egress decision.

Expected Behaviour

A fresh/local Forge install performs no public web-search egress unless the operator explicitly enables it. Raw task/project text is not automatically forwarded to a public search provider. Future VNext research is admitted through Resource classification and destination/egress policy before sensitive strings are assembled into a request.

Reproduction Steps

1. Install/setup Forge with the default generated environment.
2. Create a task whose title contains a unique sentinel secret string.
3. Run Architect context construction with a fetch spy/proxy or instrument searchWeb().
4. Observe an outbound request to DuckDuckGo containing the task title/sentinel unless FORGE_AGENT_WEB_SEARCH=0 is manually set.

Impact

Private task metadata can leave a local-first Forge installation for a third party without an explicit operator decision. This becomes more severe as Forge expands to documents, mailboxes and operational Resources.

Severity

Critical - unintended external disclosure of user task metadata.

Implementation Sequence

1. Inventory every public-search call site — Architect context, agent/provider self-evaluation, installer/setup defaults, UI/API/operator settings and tests. Record which strings can enter the query.
2. Secure default migration — make new installs/setup default web research off. Preserve an explicit existing operator choice during upgrades; do not silently flip explicit opt-in/opt-out state.
3. Single explicit setting contract — centralize effective public-web-search setting and make callers require explicit enablement rather than “anything except 0”.
4. Sanitized query builder — remove raw task title/prompt/project/repository interpolation. Build only bounded generic/domain terms; if useful search requires sensitive text, hold/omit until [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 Resource egress policy exists rather than leaking it now.
5. Outbound request boundary — fixed destination/protocol, timeout, response-size/content-type bounds and redacted failure handling; retrieved data labelled untrusted context.
6. Agent-evaluation migration — advisory role/model evaluation follows the same setting/query boundary and cannot bypass it.
7. Operator disclosure/docs — setting copy explains enabling research sends search queries to an external public service distinct from model-provider egress.
8. Sentinel-secret regression suite — default/disabled modes prove zero public-search requests; explicit enabled mode proves only approved sanitized query leaves.
9. Phase-1 handoff — expose a narrow egress/query-construction seam [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 can extend with Resource/destination policy without restoring raw-title leakage or duplicating web-research paths.

Primary Code Seams To Inspect First

• scripts/install.sh
• scripts/setup.sh
• .env.example and repair/CLI env-preservation paths
• web/worker/architect-context.ts
• web/lib/agent-evaluation.ts
• provider/settings/operator UI/API controlling web research
• outbound fetch/redaction helpers/tests
• Architect prompt construction only to verify retrieved text remains untrusted data

Orthogonal Checkpoints

1. Default/upgrade semantics: fresh install, repair/reinstall, explicit old opt-in/opt-out and missing env value.
2. Repository-wide egress trace: no alternate public-search/fetch path leaks task/project strings outside the common setting/boundary.
3. Sentinel privacy: secrets in task title, prompt, project/repo names, answered questions and prior artifacts never reach URL/query/body/header under default/disabled behavior.
4. Query minimization: enabled queries cannot reconstruct raw private task text through concatenation, logs or fallback behavior.
5. Network boundary: redirects, protocol/host changes, timeout, oversized/non-JSON response and error-string leakage.
6. Prompt injection: retrieved public text remains untrusted evidence/context and cannot alter Grant/policy/tool/routing instructions.
7. UX/consent: setting distinguishes public search egress from model-provider egress; no hidden page-load enablement.
8. Phase-1 compatibility: [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 can deny before request construction without undoing safe default or creating duplicate policy state.

Acceptance Criteria

• Fresh/default Forge installs have external public web research disabled.
• Repair/upgrade preserves an explicit operator choice deterministically and never enables public research merely because a value is absent.
• Normal default task execution sends no request to DuckDuckGo or another public search provider.
• Enabling public web research requires an explicit operator setting/configuration with a clear egress warning.
• Raw task title, prompt, project/repository name, answered questions and protected prior context are not automatically embedded in a public query.
• When explicitly enabled, queries are bounded/minimized/sanitized and use one approved request boundary.
• A fetch-spy regression proves sentinel secrets in task metadata never leave the process under default/disabled configuration.
• Agent/provider self-evaluation follows the same explicit setting/query boundary.
• Operator/developer docs distinguish model-provider egress from public web-search egress.
• Redirect/timeout/oversized/error cases do not expose sensitive input or widen destination policy.
• Retrieved web text is untrusted data and cannot widen Grants/policy/routing/tools.
• [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335 can later deny external research based on Resource/destination policy before sensitive request construction without replacing this safe-default behavior.

Out of Scope

• Building Phase [FEATURE] VNext Phase 1 — deterministic budget, routing, and context economics #335's full Resource classification/provider egress policy.
• Adding a new search provider or search marketplace.
• Sending raw user text to public search under a new flag/name.
• General model-provider privacy policy outside the public-search path.
• Redesigning the Architect beyond the minimum deterministic no-search fallback.

Implementation Scope

Medium - installer/config + one outbound research boundary and targeted UI/docs/tests; target 2-3 small PRs.

Environment

• Baseline: current main after ADR 0014.
• Affected surfaces: installer/setup environment, Architect research context and advisory agent/provider evaluation.

Technical Notes

Do not wait for #335 to stop the current unintended default egress. This issue establishes the secure beta baseline; Phase 1 generalizes the policy.

[github-actions]

FORGE issue validation

This Bug issue now matches the required FORGE template structure.
The validator applied ready-for-agent and removed needs-clarification if it was present.