ROADMAP-07 — P0 — web_search registered even without SEARCH_API_KEY; runs burn a step on a guaranteed error #99

Series: ROADMAP — filed from the 2026-10-27 whole-project assessment · Backlog task: M14-T07 · Priority: P0 · Effort: extra small

Problem

web_search is registered into the tool registry unconditionally. Without SEARCH_API_KEY every run pays for the registration, and the agent discovers the guaranteed ValueError at call time — burning one max_steps step and a tool-result turn per run. The tool should be absent from the registry (and from GET /tools) when it cannot work.

Secondary nit: the Tavily response shape is trusted (data.get("results", [])) with no validation.

Evidence

• agentkit/api/deps.py:126 — unconditional registration
• agentkit/tools/builtin/web_search.py:63 — unvalidated response shape; missing-key ValueError path

Suggested fix / acceptance criteria

• web_search registered only when SEARCH_API_KEY is configured (or behind a documented opt-in flag that keeps current behaviour)
• GET /tools and the runtime registry agree; .env.example documents the relationship
• Unit test: registry contents with and without the key
• (Optional, follow-up) validate Tavily response shape

Suggested branch / commit

fix/web-search-registration-guard · fix(api): register web_search only when SEARCH_API_KEY is configured