From 689e0b10293bf8d6d061bdc673bc8e715ab69e1c Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 6 Oct 2026 12:40:28 +1100
Subject: [PATCH] feat(search): find skills for a sentence with task search

A sentence in the search box can now ask a language model to run a few
registry searches and keep the Skills that fit. Stage 1 misses tasks
whose words point at the wrong runtime, such as Godot and Tokio Skills
for a Node memory leak. The model runs only on an explicit click, is
capped per visitor and per day, and can only pick Skills its searches
returned.
---
 COPY.md                                       |  18 +
 GLOSSARY.md                                   |   9 +
 app/components/SkillSearchPanel.vue           |  86 +++-
 app/composables/useSkillSearch.ts             |  70 +++-
 app/composables/useSkillSearchBox.ts          |   6 +
 layers/marketing/content/pages/privacy.md     |  15 +-
 .../server/api/skills/task-search.post.ts     |  36 ++
 .../server/presenters/skill-box-search.ts     |   4 +-
 .../registry/server/presenters/task-search.ts |  41 ++
 .../registry/server/schemas/skills-query.ts   |  19 +-
 .../registry/server/utils/skill-box-search.ts |   2 +-
 .../registry/server/utils/task-search-deps.ts | 100 +++++
 .../registry/server/utils/task-search-run.ts  | 137 +++++++
 layers/registry/server/utils/task-search.ts   | 368 ++++++++++++++++++
 nuxt.config.ts                                |  19 +
 test/unit/search-panel-run-command.test.ts    |   1 +
 test/unit/task-search-run.test.ts             | 136 +++++++
 test/unit/task-search.test.ts                 | 222 +++++++++++
 worker-configuration.d.ts                     |   3 +-
 wrangler.jsonc                                |   6 +-
 20 files changed, 1287 insertions(+), 11 deletions(-)
 create mode 100644 layers/registry/server/api/skills/task-search.post.ts
 create mode 100644 layers/registry/server/presenters/task-search.ts
 create mode 100644 layers/registry/server/utils/task-search-deps.ts
 create mode 100644 layers/registry/server/utils/task-search-run.ts
 create mode 100644 layers/registry/server/utils/task-search.ts
 create mode 100644 test/unit/task-search-run.test.ts
 create mode 100644 test/unit/task-search.test.ts

diff --git a/COPY.md b/COPY.md
index 474a9e8f..2baaea8e 100644
--- a/COPY.md
+++ b/COPY.md
@@ -103,6 +103,24 @@ Every ranked section says what orders it. ADR-0004 and ADR-0010 set the rules.
 The 20 in the trending header is `DEMOTED_STARRED_REPOSITORIES` in `shared/trending-range.ts`. The page and the ranking read that one constant.
 Never call a ranked section top, popular, hot, best, or a leaderboard.
 
+### Task search
+
+The search panel offers task search for a sentence, in a row at its foot. GLOSSARY.md defines the term.
+Name the model's part plainly, as a language model. Never call the action AI search or smart search.
+The strings live in `taskRowCopy` in `app/components/SkillSearchPanel.vue`.
+
+Each status shows a title, then a detail line:
+
+- Offer: `Find skills for this task`. `A language model runs a few searches and keeps the skills that fit. Takes about 5 seconds.`
+- Running: `Finding skills for this task…`. `This takes about 5 seconds.`
+- Nothing fits: `No skill fits this task`. `The search results are the closest matches.`
+- Visitor limit: `Too many task searches in a row`. `Try again in a minute.`
+- Daily limit: `Task search reached today's limit`. `Try again tomorrow.`
+- Off: `Task search is off right now`. `The search results still work.`
+- Failed: `Couldn't finish the task search`. `Select to try again.`
+
+Found Skills replace the search results under the heading `Skills for this task`, with the line `A language model picked these from a few searches of the registry.`
+
 ## Discord digest
 
 The weekly card uses `Trending skills this week` as its title and links to the trending page.
diff --git a/GLOSSARY.md b/GLOSSARY.md
index efacd921..0904339b 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -28,6 +28,7 @@ Shared terms match the skilld CLI glossary (`skilld-dev/skilld/GLOSSARY.md`). Th
 | skilld token | `cli_tokens`, `layers/identity` | Author 1—N token | "skilld token" |
 | provenance | Skill detail, cards | Skill 1—1 author and source link | "written by", "source" |
 | behavior | `skilld-protocol/behaviors`, Skill page | Skill 1—N behavior | "Skill behaviors" |
+| task search | search box, `layers/registry` | sentence 1—N Skill | "Find skills for this task" |
 
 Collisions
 
@@ -272,6 +273,14 @@ Existing route paths, table names, and protocol fields keep their identifiers.
 
 **Never:** newsletter, roundup, trending digest.
 
+### task search
+
+**Is:** the search box action for a sentence. A language model runs a few registry searches for the task and keeps the Skills that fit. It only filters and orders search results; it never adds a Skill. It runs only when a visitor selects "Find skills for this task".
+
+**Use for:** that action, its status messages in the search panel, and the privacy page. The route is `POST /api/skills/task-search`.
+
+**Never:** AI search, smart search, deep search, agent search, ask skilld. Those sell the model as the product, and VISION.md says skilld is not AI-powered.
+
 ## Naming new things
 
 - Name a feature descriptively, not cleverly. "Stack selector", never "StackMatch".
diff --git a/app/components/SkillSearchPanel.vue b/app/components/SkillSearchPanel.vue
index 7db46e26..cdbb85ac 100644
--- a/app/components/SkillSearchPanel.vue
+++ b/app/components/SkillSearchPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { SearchRepository, SearchRow, SearchSkill } from '../composables/useSkillSearch'
+import type { SearchRepository, SearchRow, SearchSkill, TaskSearchStatus } from '../composables/useSkillSearch'
 import { githubAvatarProxyUrl } from '#shared/image-proxy'
 import { searchCellId } from '../composables/useSkillSearch'
 import { SEARCH_GRID_ID } from '../composables/useSkillSearchBox'
@@ -15,6 +15,7 @@ const {
   recentSearches,
   retry,
   submitRepository,
+  taskSearch,
 } = useSkillSearch()
 
 /**
@@ -48,9 +49,47 @@ function rowKey(row: SearchRow): string {
     return `skill:${row.skill.owner}/${row.skill.repo}/${row.skill.name}`
   if (row._tag === 'repository' || row._tag === 'index')
     return `${row._tag}:${row.repository.owner}/${row.repository.repo}`
-  return 'all'
+  return row._tag
 }
 
+interface TaskRowCopy {
+  title: string
+  detail: string
+  icon: string
+  /** Only an idle or failed task search starts when its row is selected. */
+  actionable: boolean
+}
+
+/** What the task search row says for each status. COPY.md holds these strings. */
+function taskRowCopy(status: Exclude<TaskSearchStatus, { _tag: 'found' }>): TaskRowCopy {
+  switch (status._tag) {
+    case 'idle':
+      return { title: 'Find skills for this task', detail: 'A language model runs a few searches and keeps the skills that fit. Takes about 5 seconds.', icon: 'i-lucide-search-check', actionable: true }
+    case 'running':
+      return { title: 'Finding skills for this task…', detail: 'This takes about 5 seconds.', icon: 'i-lucide-loader-circle', actionable: false }
+    case 'none':
+      return { title: 'No skill fits this task', detail: 'The search results are the closest matches.', icon: 'i-lucide-circle-slash', actionable: false }
+    case 'limited':
+      return status.scope === 'visitor'
+        ? { title: 'Too many task searches in a row', detail: 'Try again in a minute.', icon: 'i-lucide-clock', actionable: false }
+        : { title: 'Task search reached today\'s limit', detail: 'Try again tomorrow.', icon: 'i-lucide-clock', actionable: false }
+    case 'off':
+      return { title: 'Task search is off right now', detail: 'The search results still work.', icon: 'i-lucide-circle-slash', actionable: false }
+    case 'failed':
+      return { title: 'Couldn\'t finish the task search', detail: 'Select to try again.', icon: 'i-lucide-rotate-ccw', actionable: true }
+  }
+}
+
+/** Task search takes seconds, so its progress and outcome are announced. */
+const taskAnnouncement = computed(() => {
+  const status = taskSearch.value
+  if (status._tag === 'idle')
+    return ''
+  if (status._tag === 'found')
+    return `Found ${status.skills.length} ${status.skills.length === 1 ? 'skill' : 'skills'} for this task.`
+  return taskRowCopy(status).title
+})
+
 function isActive(index: number, column: 0 | 1): boolean {
   return index === activeIndex.value && activeColumn.value === column
 }
@@ -212,6 +251,19 @@ function retryRepositoryIndex(): void {
         </p>
       </div>
 
+      <!-- Task search found Skills: they replace the search results until the query changes. -->
+      <div
+        v-if="state._tag === 'ready' && taskSearch._tag === 'found'"
+        class="border-b border-default px-3 pb-2 pt-3"
+      >
+        <p class="section-label">
+          Skills for this task
+        </p>
+        <p class="mt-1 text-xs text-muted">
+          A language model picked these from a few searches of the registry.
+        </p>
+      </div>
+
       <!--
         A grid, not a listbox: a Skill row holds a second control, its run
         chip, and an option may not contain one. The combobox points at one
@@ -232,11 +284,19 @@ function retryRepositoryIndex(): void {
           :class="{ 'search-row--active': index === activeIndex }"
           @mousemove="hover(index)"
         >
+          <!--
+            The box closes the panel when focus leaves it. Task search answers
+            inside the panel, so a press on its row keeps focus in the box.
+          -->
           <div
             :id="searchCellId(index, 0)"
             role="gridcell"
             :aria-selected="isActive(index, 0)"
+            :aria-disabled="row._tag === 'task' && !taskRowCopy(row.status).actionable ? true : undefined"
+            :aria-busy="row._tag === 'task' && row.status._tag === 'running' ? true : undefined"
             class="search-row__open"
+            :class="{ 'search-row__open--static': row._tag === 'task' && !taskRowCopy(row.status).actionable }"
+            @mousedown="(event) => { if (row._tag === 'task') event.preventDefault() }"
             @click="emit('select', row)"
           >
             <template v-if="row._tag === 'skill'">
@@ -318,6 +378,19 @@ function retryRepositoryIndex(): void {
               <UIcon name="i-lucide-arrow-right" class="size-3.5 shrink-0 text-muted" aria-hidden="true" />
             </template>
 
+            <template v-else-if="row._tag === 'task'">
+              <UIcon
+                :name="taskRowCopy(row.status).icon"
+                class="size-3.5 shrink-0 text-muted"
+                :class="{ 'motion-safe:animate-spin': row.status._tag === 'running' }"
+                aria-hidden="true"
+              />
+              <span class="min-w-0 flex-1">
+                <span class="block truncate font-mono text-sm text-highlighted">{{ taskRowCopy(row.status).title }}</span>
+                <span class="mt-0.5 block text-xs text-muted">{{ taskRowCopy(row.status).detail }}</span>
+              </span>
+            </template>
+
             <template v-else>
               <UIcon name="i-lucide-search" class="size-3.5 shrink-0 text-muted" aria-hidden="true" />
               <span class="min-w-0 flex-1 truncate font-mono text-sm">
@@ -349,6 +422,10 @@ function retryRepositoryIndex(): void {
       </div>
     </div>
 
+    <p class="sr-only" role="status" aria-live="polite">
+      {{ taskAnnouncement }}
+    </p>
+
     <!-- Keyboard affordances, stated rather than assumed. Touch has no keys. -->
     <div class="search-panel__keys flex items-center gap-4 whitespace-nowrap border-t border-default px-3 py-2">
       <span class="data-label flex items-center gap-1.5">
@@ -396,6 +473,11 @@ function retryRepositoryIndex(): void {
   cursor: pointer;
 }
 
+/* A task search row that is only reporting a status has nothing to select. */
+.search-row__open--static {
+  cursor: default;
+}
+
 .search-row__open[aria-selected='true'] {
   box-shadow: inset 2px 0 0 var(--ui-border-inverted);
 }
diff --git a/app/composables/useSkillSearch.ts b/app/composables/useSkillSearch.ts
index e91f0962..04c41090 100644
--- a/app/composables/useSkillSearch.ts
+++ b/app/composables/useSkillSearch.ts
@@ -1,4 +1,5 @@
 import type { SkillBoxSearchAnswer } from '#layers/registry/server/presenters/skill-box-search'
+import type { TaskSearchAnswer } from '#layers/registry/server/presenters/task-search'
 import type { GitHubRepository } from '#shared/github-repository'
 import type {
   IndexedRepositorySkill,
@@ -52,19 +53,34 @@ export interface SearchSkill {
 /** A Repository in the registry. Its row opens the Repository page. */
 export type SearchRepository = TypeaheadRepository
 
+/**
+ * Task search for the sentence in the box. It runs only when the visitor
+ * selects its row, never per keystroke. Every status but `found` leaves the
+ * search results on screen.
+ */
+export type TaskSearchStatus
+  = | { _tag: 'idle' }
+    | { _tag: 'running' }
+    | { _tag: 'found', skills: SearchSkill[] }
+    | { _tag: 'none' }
+    | { _tag: 'limited', scope: 'visitor' | 'daily' }
+    | { _tag: 'off' }
+    | { _tag: 'failed' }
+
 /**
  * A row the user can move focus onto. Keeping the trailing "see everything"
  * action in the same list as the results means one arrow-key model covers the
  * whole panel instead of two.
  *
  * `repository` is a Repository the registry holds. `index` is the action for
- * one it does not hold yet.
+ * one it does not hold yet. `task` runs task search, and then shows how it went.
  */
 export type SearchRow
   = | { _tag: 'skill', skill: SearchSkill, provisional: boolean }
     | { _tag: 'repository', repository: SearchRepository }
     | { _tag: 'index', repository: GitHubRepository }
     | { _tag: 'all', query: string }
+    | { _tag: 'task', status: Exclude<TaskSearchStatus, { _tag: 'found' }> }
 
 /**
  * Which retrieval lanes answered. `semantic` means the lexical lane found
@@ -273,6 +289,43 @@ function useSkillSearchInternal() {
     flush: 'sync',
   })
 
+  const taskSearch = shallowRef<TaskSearchStatus>({ _tag: 'idle' })
+  let taskInFlight: AbortController | null = null
+
+  /**
+   * Run task search for the sentence in the box. It takes about 5 seconds,
+   * so it starts only from its row. Any failure keeps the search results.
+   */
+  async function findForTask(): Promise<void> {
+    const status = taskSearch.value._tag
+    if (classified.value._tag !== 'intent' || (status !== 'idle' && status !== 'failed'))
+      return
+    const controller = new AbortController()
+    taskInFlight = controller
+    taskSearch.value = { _tag: 'running' }
+    try {
+      const answer = await $fetch<TaskSearchAnswer>('/api/skills/task-search', {
+        method: 'POST',
+        body: { q: trimmedQuery.value },
+        signal: controller.signal,
+      })
+      if (controller.signal.aborted)
+        return
+      taskSearch.value = answer._tag === 'found' ? { _tag: 'found', skills: answer.items } : answer
+    }
+    catch (error) {
+      // An edit to the query aborts the request; the new query starts idle.
+      if (controller.signal.aborted)
+        return
+      console.warn('[search] task search unavailable', error)
+      taskSearch.value = { _tag: 'failed' }
+    }
+    finally {
+      if (taskInFlight === controller)
+        taskInFlight = null
+    }
+  }
+
   // Invalidate on input, before debounce. Old results must never remain selectable.
   watch(trimmedQuery, () => {
     activeIndex.value = -1
@@ -282,6 +335,9 @@ function useSkillSearchInternal() {
     serverResults.value = null
     serverError.value = null
     pending.value = false
+    taskInFlight?.abort()
+    taskInFlight = null
+    taskSearch.value = { _tag: 'idle' }
   }, { flush: 'sync' })
 
   const state = computed<SearchState>(() => {
@@ -349,9 +405,19 @@ function useSkillSearchInternal() {
       }
     }
 
+    // A sentence can ask task search for Skills that fit. Found Skills take the
+    // search results' place; every other status leaves them where they are.
+    const task = taskSearch.value
+    if (server.kind === 'intent' && task._tag === 'found') {
+      const taskRows: SearchRow[] = task.skills.map(skill => ({ _tag: 'skill' as const, skill, provisional: false }))
+      return { _tag: 'ready', rows: [...taskRows, { _tag: 'all', query: term }], total: server.total, repository: null }
+    }
+
     const rows: SearchRow[] = [...localRepositoryRows.value, ...skillRows]
     if (skillRows.length)
       rows.push({ _tag: 'all', query: term })
+    if (server.kind === 'intent' && task._tag !== 'found')
+      rows.push({ _tag: 'task', status: task })
     return { _tag: 'ready', rows, total: server.total, mode: server.mode ?? undefined, repository: null }
   })
 
@@ -490,6 +556,8 @@ function useSkillSearchInternal() {
     loadTypeaheadIndex,
     retry: () => runSearch(trimmedQuery.value),
     submitRepository,
+    taskSearch,
+    findForTask,
     skillKey,
   }
 }
diff --git a/app/composables/useSkillSearchBox.ts b/app/composables/useSkillSearchBox.ts
index a8cd99cd..46b71483 100644
--- a/app/composables/useSkillSearchBox.ts
+++ b/app/composables/useSkillSearchBox.ts
@@ -31,6 +31,7 @@ export function useSkillSearchBox(options: { inputs: () => (HTMLInputElement | n
     rememberQuery,
     loadTypeaheadIndex,
     submitRepository,
+    findForTask,
   } = search
 
   const keyboardSelection = ref(false)
@@ -76,6 +77,11 @@ export function useSkillSearchBox(options: { inputs: () => (HTMLInputElement | n
       await goToResults()
       return
     }
+    // Task search answers inside the panel, so the panel stays open.
+    if (row._tag === 'task') {
+      await findForTask()
+      return
+    }
     if (state.value._tag !== 'repository')
       rememberQuery(trimmedQuery.value)
     dismiss()
diff --git a/layers/marketing/content/pages/privacy.md b/layers/marketing/content/pages/privacy.md
index ab7c1dab..14e04fb4 100644
--- a/layers/marketing/content/pages/privacy.md
+++ b/layers/marketing/content/pages/privacy.md
@@ -1,8 +1,8 @@
 ---
 title: Privacy
 description: What skilld.dev stores, why it needs the data, how long it keeps it, and how you delete your account.
-label: Last updated 1 October 2026
-updatedAt: 2026-10-01
+label: Last updated 6 October 2026
+updatedAt: 2026-10-06
 ---
 
 ## In short
@@ -65,6 +65,16 @@ Your browser keeps your color mode and your 5 most recent searches in local stor
 
 Search sends your query to Workers AI on Cloudflare to find matching Skills. skilld stores no copy of the query text. It caches the query's embedding, a list of numbers, for up to one day. The cache entry holds nothing that identifies you.
 
+### Task search
+
+When you search with a sentence, the search panel offers "Find skills for this task". The search box sends nothing more until you select it.
+
+When you select it, skilld sends your search text to the GPT-6 Luna model from [OpenAI](https://openai.com), through Cloudflare. The model writes a few searches, skilld runs them on its own registry, and the model picks Skills from those results. OpenAI receives your search text and those results. It receives no IP address, cookie, or account details.
+
+skilld caches the answer, a list of Skills, for up to 7 days. The cache key is a hash of your search text. skilld logs how long each answer took, how many tokens it used, and what it cost. The log holds no search text.
+
+Each task search costs money, so Cloudflare counts task searches per IP address over one minute. skilld stores no IP address.
+
 ### Images
 
 Every avatar and every image in a Skill loads through skilld.dev. skilld.dev fetches the image from GitHub, X, Bluesky, or the host the Skill names, and sends none of your request details. Those hosts never see your IP address, and your browser never contacts them for an image. skilld.dev also sends a referrer policy that shares only the site origin with other sites you open.
@@ -130,6 +140,7 @@ skilld uses [Sentry](https://sentry.io) to find and fix errors.
 - Cloudflare hosts skilld.dev and runs its database, cache, email delivery, image proxy, Web Analytics, usage counts, Workers AI search, and request logs. It handles requests, account data, email addresses, analytics reports, and search queries.
 - GitHub handles sign-in and holds the source of every Skill. It handles your GitHub profile and tokens.
 - Sentry receives error reports, with the data listed above removed.
+- OpenAI runs the model behind task search. Through Cloudflare, it receives the search text of a task search and the registry results, and nothing that identifies you.
 
 ## How long skilld keeps data
 
diff --git a/layers/registry/server/api/skills/task-search.post.ts b/layers/registry/server/api/skills/task-search.post.ts
new file mode 100644
index 00000000..7df1fda1
--- /dev/null
+++ b/layers/registry/server/api/skills/task-search.post.ts
@@ -0,0 +1,36 @@
+import type { RegistrySkill } from '../../utils/skills-registry'
+import { defineApiHandler } from '#shared/server/handler'
+import { officialRepos } from '../../data/official-repos'
+import { makeTaskSearchPresenter } from '../../presenters/task-search'
+import { TaskSearchBody } from '../../schemas/skills-query'
+import { findSkillsByKeys } from '../../utils/skills-registry'
+import { taskSearchDeps } from '../../utils/task-search-deps'
+import { searchForTask } from '../../utils/task-search-run'
+
+const officialOwners = new Set(officialRepos.map(r => r.owner))
+
+function keyOf(ref: string): { owner: string, repo: string, name: string } {
+  const [owner = '', repo = '', ...name] = ref.split('/')
+  return { owner, repo, name: name.join('/') }
+}
+
+/**
+ * Task search: the search box's opt-in answer for a sentence. A model runs a
+ * few registry searches and keeps the Skills that fit.
+ *
+ * Public, so no policy. POST, because each answer the cache misses spends
+ * model credits, and a crawler or prefetch never sends one. The visitor and
+ * daily limits live in `searchForTask`.
+ */
+export default defineApiHandler({
+  schema: TaskSearchBody,
+  handler: async ({ event, body, platform }) => {
+    const outcome = await searchForTask(taskSearchDeps(event, platform), body.q)
+    if (outcome._tag !== 'found')
+      return { outcome, skills: [] }
+    const rows = await findSkillsByKeys(event, outcome.refs.map(keyOf))
+    const skills = outcome.refs.map(ref => rows.get(ref)).filter((skill): skill is RegistrySkill => skill !== undefined)
+    return { outcome, skills }
+  },
+  presenter: makeTaskSearchPresenter(officialOwners),
+})
diff --git a/layers/registry/server/presenters/skill-box-search.ts b/layers/registry/server/presenters/skill-box-search.ts
index 8ddbf207..7c13979d 100644
--- a/layers/registry/server/presenters/skill-box-search.ts
+++ b/layers/registry/server/presenters/skill-box-search.ts
@@ -39,7 +39,7 @@ export interface SkillBoxSearchAnswer {
   mode: SearchMode | null
 }
 
-function presentItem(skill: RegistrySkill, officialOwners: Set<string>): SkillBoxSearchItem {
+export function presentSkillBoxItem(skill: RegistrySkill, officialOwners: Set<string>): SkillBoxSearchItem {
   return {
     name: skill.name,
     owner: skill.owner,
@@ -65,7 +65,7 @@ export function makeSkillBoxSearchPresenter(officialOwners: Set<string>) {
       : result.repository,
     owner: result.owner,
     understood: result.intent?._tag === 'understood' ? result.intent.understanding : null,
-    items: result.items.map(skill => presentItem(skill, officialOwners)),
+    items: result.items.map(skill => presentSkillBoxItem(skill, officialOwners)),
     total: result.total,
     mode: result.mode ?? null,
   })
diff --git a/layers/registry/server/presenters/task-search.ts b/layers/registry/server/presenters/task-search.ts
new file mode 100644
index 00000000..e103fa9c
--- /dev/null
+++ b/layers/registry/server/presenters/task-search.ts
@@ -0,0 +1,41 @@
+import type { RegistrySkill } from '../utils/skills-registry'
+import type { TaskSearchOutcome } from '../utils/task-search-run'
+import type { SkillBoxSearchItem } from './skill-box-search'
+import { presentSkillBoxItem } from './skill-box-search'
+
+export interface TaskSearchRouteResult {
+  outcome: TaskSearchOutcome
+  /** The found Skills in the model's order. Empty for every other outcome. */
+  skills: RegistrySkill[]
+}
+
+/**
+ * The internal task search answer. Every outcome but `found` tells the panel
+ * to keep the search results it already shows.
+ */
+export type TaskSearchAnswer
+  = | { _tag: 'found', items: SkillBoxSearchItem[] }
+    | { _tag: 'none' }
+    | { _tag: 'limited', scope: 'visitor' | 'daily' }
+    | { _tag: 'off' }
+    | { _tag: 'failed' }
+
+export function makeTaskSearchPresenter(officialOwners: Set<string>) {
+  return ({ outcome, skills }: TaskSearchRouteResult): TaskSearchAnswer => {
+    switch (outcome._tag) {
+      case 'found':
+        // A cached ref whose Skill has since left the registry finds no row.
+        return skills.length
+          ? { _tag: 'found', items: skills.map(skill => presentSkillBoxItem(skill, officialOwners)) }
+          : { _tag: 'none' }
+      case 'none':
+        return { _tag: 'none' }
+      case 'limited':
+        return { _tag: 'limited', scope: outcome.scope }
+      case 'off':
+        return { _tag: 'off' }
+      case 'failed':
+        return { _tag: 'failed' }
+    }
+  }
+}
diff --git a/layers/registry/server/schemas/skills-query.ts b/layers/registry/server/schemas/skills-query.ts
index 0fc2d857..28540c58 100644
--- a/layers/registry/server/schemas/skills-query.ts
+++ b/layers/registry/server/schemas/skills-query.ts
@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import { MAX_SEARCH_QUERY_LENGTH } from '#shared/skill-search-query'
+import { classifySearchQuery, MAX_SEARCH_QUERY_LENGTH } from '#shared/skill-search-query'
 
 const flag = z.string().optional().transform(v => v === 'true' || v === '1')
 
@@ -48,3 +48,20 @@ export const SkillBoxSearchQuery = z.object({
 })
 
 export type SkillBoxSearchQuery = z.infer<typeof SkillBoxSearchQuery>
+
+/**
+ * Task search answers a sentence, the one query kind the search box offers it
+ * for. `q` arrives normalised, so the answer cache key is one spelling.
+ */
+export const TaskSearchBody = z.object({
+  q: z.string().transform((value, ctx) => {
+    const query = classifySearchQuery(value.slice(0, MAX_SEARCH_QUERY_LENGTH))
+    if (query._tag !== 'intent') {
+      ctx.addIssue({ code: 'custom', message: 'Task search answers a sentence of two or more words.' })
+      return z.NEVER
+    }
+    return query.text
+  }),
+})
+
+export type TaskSearchBody = z.infer<typeof TaskSearchBody>
diff --git a/layers/registry/server/utils/skill-box-search.ts b/layers/registry/server/utils/skill-box-search.ts
index 94c62cd2..627891fb 100644
--- a/layers/registry/server/utils/skill-box-search.ts
+++ b/layers/registry/server/utils/skill-box-search.ts
@@ -72,7 +72,7 @@ async function verifiedOwner(db: D1Database, author: string | null): Promise<str
   return null
 }
 
-async function sha256Hex(text: string): Promise<string> {
+export async function sha256Hex(text: string): Promise<string> {
   const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
   return [...new Uint8Array(digest)].map(byte => byte.toString(16).padStart(2, '0')).join('')
 }
diff --git a/layers/registry/server/utils/task-search-deps.ts b/layers/registry/server/utils/task-search-deps.ts
new file mode 100644
index 00000000..ac0625b9
--- /dev/null
+++ b/layers/registry/server/utils/task-search-deps.ts
@@ -0,0 +1,100 @@
+import type { H3Event } from 'h3'
+import type { Platform } from '#shared/server/platform'
+import type { TaskSearchRequest, TaskSearchSkill } from './task-search'
+import type { TaskSearchReport, TaskSearchShellDeps } from './task-search-run'
+import { getHeader } from 'h3'
+import { runAfterResponse } from './after-response'
+import { sha256Hex } from './skill-box-search'
+import { querySkills, registrySkillKey } from './skills-registry'
+import { TASK_SEARCH_MODEL, TASK_SEARCH_RESULTS_PER_QUERY } from './task-search'
+
+/** The Workers AI binding, as it takes an `openai/*` Chat Completions request. */
+interface ModelBinding {
+  run: (model: string, input: TaskSearchRequest) => Promise<unknown>
+}
+
+interface TaskSearchConfig {
+  enabled?: unknown
+  dailyBudgetMicros?: unknown
+}
+
+/**
+ * A model error as the log may hold it: a leading status or
+ * Workers AI code such as `2021` (no AI Gateway credits), else the error
+ * name. Never the message, which may quote the request.
+ */
+export function modelErrorCode(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error)
+  return /^\D{0,40}(\d{3,5})\b/.exec(message)?.[1] ?? (error instanceof Error ? error.name : 'unknown')
+}
+
+function reportLevel(report: TaskSearchReport): 'info' | 'warn' {
+  if (report._tag === 'skipped')
+    return report.reason === 'binding-missing' ? 'warn' : 'info'
+  if (report._tag === 'model')
+    return report.result._tag === 'failed' ? 'warn' : 'info'
+  return 'info'
+}
+
+/** One wide event per request. The field validator needs each event as an object literal. */
+function emitReport(report: TaskSearchReport): void {
+  const level = reportLevel(report)
+  if (report._tag === 'skipped') {
+    emitOperationalEvent(createWideEvent({ operation: 'task-search', outcome: 'skipped', reason: report.reason }), level)
+    return
+  }
+  if (report._tag === 'cache') {
+    emitOperationalEvent(createWideEvent({ operation: 'task-search', outcome: report.result, reason: 'cache' }), level)
+    return
+  }
+  const { result } = report
+  emitOperationalEvent(createWideEvent({
+    'operation': 'task-search',
+    'outcome': result._tag,
+    'reason': result._tag === 'failed' ? result.reason : 'model-call',
+    'model.durationMs': report.durationMs,
+    'model.turns': result.turns,
+    'model.searches': result.searches,
+    'model.inputTokens': result.usage.inputTokens,
+    'model.cachedTokens': result.usage.cachedTokens,
+    'model.outputTokens': result.usage.outputTokens,
+    'model.costMicros': report.costMicros,
+    'model.droppedRefs': result._tag === 'failed' ? 0 : result.dropped,
+    'model.errorCode': result._tag === 'failed' && result.reason === 'model-error' ? modelErrorCode(result.error) : null,
+  }), level)
+}
+
+/**
+ * Bindings for {@link searchForTask}. Search is the registry's own hybrid
+ * search, the same one `skills.search` answers with. The visitor allowance
+ * has its own limiter, keyed by the client IP, which is never stored.
+ */
+export function taskSearchDeps(event: H3Event, platform: Platform): TaskSearchShellDeps {
+  const config = (useRuntimeConfig(event).taskSearch ?? {}) as TaskSearchConfig
+  const limiter = platform.env.TASK_SEARCH_RATE_LIMIT
+  const ai = platform.ai as unknown as ModelBinding | undefined
+  const budget = Number(config.dailyBudgetMicros)
+  return {
+    enabled: config.enabled !== false && config.enabled !== 'false',
+    dailyBudgetMicros: Number.isFinite(budget) && budget >= 0 ? budget : 0,
+    model: ai ? request => ai.run(TASK_SEARCH_MODEL, request) : undefined,
+    search: async (query): Promise<TaskSearchSkill[]> => {
+      const { items } = await querySkills(event, { search: query, limit: TASK_SEARCH_RESULTS_PER_QUERY, page: 1 })
+      return items.map(skill => ({ ref: registrySkillKey(skill), description: skill.description, stars: skill.stars }))
+    },
+    // Global KV, not the per-colo Cache API, so an answer and the day's
+    // spend are the same in every data center.
+    storage: useStorage('cache'),
+    allowVisitor: async () => {
+      if (!limiter)
+        return true
+      const ip = getHeader(event, 'cf-connecting-ip') ?? 'unknown'
+      const { success } = await limiter.limit({ key: `task-search:${ip}` })
+      return success
+    },
+    schedule: promise => runAfterResponse(event, promise),
+    digest: sha256Hex,
+    now: () => Date.now(),
+    report: emitReport,
+  }
+}
diff --git a/layers/registry/server/utils/task-search-run.ts b/layers/registry/server/utils/task-search-run.ts
new file mode 100644
index 00000000..e316625e
--- /dev/null
+++ b/layers/registry/server/utils/task-search-run.ts
@@ -0,0 +1,137 @@
+import type { ReadThroughCache } from '#shared/server/cache'
+import type { TaskSearchDeps, TaskSearchResult } from './task-search'
+import { readCache, writeCache } from '#shared/server/cache'
+import { runTaskSearch, TASK_SEARCH_MODEL, TASK_SEARCH_PROMPT_VERSION, taskSearchCostMicros } from './task-search'
+
+/** A found answer depends on what the registry holds, so it lasts a week. */
+const FOUND_TTL_SECONDS = 60 * 60 * 24 * 7
+/** One model run in 3 missed the memory leak Skill in the eval, so a miss is retried after a day. */
+const NONE_TTL_SECONDS = 60 * 60 * 24
+/** A day's spend counter outlives its UTC day, so a late write still lands on the right key. */
+const SPEND_TTL_SECONDS = 60 * 60 * 48
+
+/** What the search box gets back. Every outcome but `found` keeps the search results on screen. */
+export type TaskSearchOutcome
+  = | { _tag: 'found', refs: string[], source: 'model' | 'cache' }
+    | { _tag: 'none', source: 'model' | 'cache' }
+    | { _tag: 'limited', scope: 'visitor' | 'daily' }
+    | { _tag: 'off' }
+    | { _tag: 'failed' }
+
+/** One record per request for the operations log. It never carries the question. */
+export type TaskSearchReport
+  = | { _tag: 'cache', result: 'found' | 'none' }
+    | { _tag: 'skipped', reason: 'off' | 'binding-missing' | 'visitor-limit' | 'daily-limit' }
+    | { _tag: 'model', result: TaskSearchResult, durationMs: number, costMicros: number }
+
+export interface TaskSearchShellDeps {
+  /** The runtime config kill switch. */
+  enabled: boolean
+  /** The spend ceiling for one UTC day, across every visitor, in micro-dollars. */
+  dailyBudgetMicros: number
+  /** The model call, or undefined when the AI binding is missing. */
+  model: TaskSearchDeps['model'] | undefined
+  search: TaskSearchDeps['search']
+  /** A store every colo reads: the KV-backed `cache` mount. */
+  storage: ReadThroughCache
+  /** One task search against the visitor's allowance. False means over it. */
+  allowVisitor: () => Promise<boolean>
+  /** Keeps a promise alive after the response. */
+  schedule: (promise: Promise<unknown>) => void
+  digest: (text: string) => Promise<string>
+  /** Milliseconds clock. */
+  now: () => number
+  report: (report: TaskSearchReport) => void
+}
+
+type CachedAnswer
+  = | { _tag: 'found', refs: string[] }
+    | { _tag: 'none' }
+
+function parseCachedAnswer(value: unknown): CachedAnswer | null {
+  if (typeof value !== 'object' || value === null)
+    return null
+  const { _tag, refs } = value as { _tag?: unknown, refs?: unknown }
+  if (_tag === 'none')
+    return { _tag: 'none' }
+  if (_tag === 'found' && Array.isArray(refs) && refs.length && refs.every(ref => typeof ref === 'string'))
+    return { _tag: 'found', refs }
+  return null
+}
+
+function answerKey(question: string, digest: (text: string) => Promise<string>): Promise<string> {
+  return digest(JSON.stringify([TASK_SEARCH_MODEL, TASK_SEARCH_PROMPT_VERSION, question]))
+    .then(hash => `task-search:v${TASK_SEARCH_PROMPT_VERSION}:${hash}`)
+}
+
+function spendKey(nowMs: number): string {
+  return `task-search:spend:${new Date(nowMs).toISOString().slice(0, 10)}`
+}
+
+function micros(value: unknown): number {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : 0
+}
+
+/**
+ * Add one run's cost to the day's counter. KV has no atomic increment, so two
+ * runs that finish together can lose one addition. The ceiling is a soft one:
+ * at about $0.0007 a run, a lost write is noise next to a $1 budget.
+ */
+async function addSpend(deps: TaskSearchShellDeps, key: string, costMicros: number): Promise<void> {
+  const spent = micros(await readCache<number>(deps.storage, key))
+  await writeCache(deps.storage, key, spent + costMicros, { ttl: SPEND_TTL_SECONDS })
+}
+
+/**
+ * Answer one normalised sentence, cheapest check first.
+ *
+ * A cached answer is free, so it is served even over a limit. Then the kill
+ * switch, the binding, the day's budget and the visitor's allowance decide
+ * whether the model may run at all. A failed run is reported and never
+ * cached, so the next visitor tries again.
+ */
+export async function searchForTask(deps: TaskSearchShellDeps, question: string): Promise<TaskSearchOutcome> {
+  if (!deps.enabled) {
+    deps.report({ _tag: 'skipped', reason: 'off' })
+    return { _tag: 'off' }
+  }
+
+  const key = await answerKey(question, deps.digest)
+  const cached = parseCachedAnswer(await readCache(deps.storage, key))
+  if (cached) {
+    deps.report({ _tag: 'cache', result: cached._tag })
+    return { ...cached, source: 'cache' }
+  }
+
+  if (!deps.model) {
+    deps.report({ _tag: 'skipped', reason: 'binding-missing' })
+    return { _tag: 'off' }
+  }
+
+  const startedAt = deps.now()
+  const dayKey = spendKey(startedAt)
+  if (micros(await readCache<number>(deps.storage, dayKey)) >= deps.dailyBudgetMicros) {
+    deps.report({ _tag: 'skipped', reason: 'daily-limit' })
+    return { _tag: 'limited', scope: 'daily' }
+  }
+  if (!(await deps.allowVisitor())) {
+    deps.report({ _tag: 'skipped', reason: 'visitor-limit' })
+    return { _tag: 'limited', scope: 'visitor' }
+  }
+
+  const result = await runTaskSearch({ model: deps.model, search: deps.search }, question)
+  const costMicros = taskSearchCostMicros(result.usage)
+  deps.report({ _tag: 'model', result, durationMs: deps.now() - startedAt, costMicros })
+  // A failed run still spent tokens, so it counts before anything returns.
+  if (costMicros > 0)
+    deps.schedule(addSpend(deps, dayKey, costMicros))
+
+  if (result._tag === 'failed')
+    return { _tag: 'failed' }
+  if (result._tag === 'found') {
+    await writeCache(deps.storage, key, { _tag: 'found', refs: result.refs } satisfies CachedAnswer, { ttl: FOUND_TTL_SECONDS })
+    return { _tag: 'found', refs: result.refs, source: 'model' }
+  }
+  await writeCache(deps.storage, key, { _tag: 'none' } satisfies CachedAnswer, { ttl: NONE_TTL_SECONDS })
+  return { _tag: 'none', source: 'model' }
+}
diff --git a/layers/registry/server/utils/task-search.ts b/layers/registry/server/utils/task-search.ts
new file mode 100644
index 00000000..3162ca33
--- /dev/null
+++ b/layers/registry/server/utils/task-search.ts
@@ -0,0 +1,368 @@
+/**
+ * Task search: the search box's opt-in answer for a sentence.
+ *
+ * A model writes a few searches for the task, the registry's own search runs
+ * them, and the model keeps the Skills that fit. Everything in this file is
+ * pure: the model call and the search are injected, so the loop runs in tests
+ * against a scripted model.
+ *
+ * The model only chooses among Skills the searches returned. Every ref it
+ * answers is snapped to one of those results, and the rest are dropped, so it
+ * can reorder and filter the registry but never add to it.
+ *
+ * Measured offline on 2026-10-06 over 20 sentences (~/notes, search stage 2
+ * eval): 2 turns per question, about 6k input and 220 output tokens, $0.0007,
+ * and a median of 5.2s with reasoning off.
+ */
+
+/**
+ * OpenAI GPT-6 Luna, brokered through the Workers AI binding. It bills against
+ * the account's AI Gateway credits, not the Workers AI allowance.
+ */
+export const TASK_SEARCH_MODEL = 'openai/gpt-6-luna'
+
+/** Bump when the prompt, the tool, or the parser changes, so cached answers expire. */
+export const TASK_SEARCH_PROMPT_VERSION = 1
+
+/** Model calls per question, the answer included. The eval needed 2. */
+export const TASK_SEARCH_MAX_TURNS = 3
+
+/**
+ * Results per search. The eval's memory leak question found its Skill at
+ * rank 7 or 8 of 10, and one run in 3 missed it.
+ */
+export const TASK_SEARCH_RESULTS_PER_QUERY = 15
+
+export const TASK_SEARCH_MAX_SKILLS = 6
+
+const MAX_SEARCHES_PER_TURN = 4
+const MAX_QUERY_CHARS = 200
+const MAX_DESCRIPTION_CHARS = 280
+const MAX_COMPLETION_TOKENS = 800
+
+/**
+ * Micro-dollars per token: GPT-6 Luna list prices on 2026-10-06, $0.10 per
+ * million input, $0.01 cached, $0.50 output. AI Gateway adds 5% when credits
+ * are bought, which this does not count.
+ */
+const PRICE_MICROS = { input: 0.1, cachedInput: 0.01, output: 0.5 } as const
+
+/** One search result as the model reads it. `ref` is ready to answer with. */
+export interface TaskSearchSkill {
+  ref: string
+  description: string | null
+  stars: number
+}
+
+export interface ModelToolCall {
+  id: string
+  type: 'function'
+  function: { name: string, arguments: string }
+}
+
+export type TaskSearchMessage
+  = | { role: 'system' | 'user', content: string }
+    | { role: 'assistant', content: string | null, tool_calls: ModelToolCall[] }
+    | { role: 'tool', tool_call_id: string, content: string }
+
+/** One Chat Completions request, as the Workers AI binding takes it for `openai/*`. */
+export interface TaskSearchRequest {
+  messages: TaskSearchMessage[]
+  tools: typeof TOOLS
+  tool_choice: 'auto' | 'none'
+  response_format: typeof ANSWER_FORMAT
+  max_completion_tokens: number
+  /** Chat Completions refuses function tools with reasoning on this model. */
+  reasoning_effort: 'none'
+}
+
+export interface TaskSearchUsage {
+  inputTokens: number
+  cachedTokens: number
+  outputTokens: number
+}
+
+export interface TaskSearchDeps {
+  /** One model call. Resolves with the raw reply, untrusted. */
+  model: (request: TaskSearchRequest) => Promise<unknown>
+  /** The registry's search, at most {@link TASK_SEARCH_RESULTS_PER_QUERY} results. */
+  search: (query: string) => Promise<TaskSearchSkill[]>
+}
+
+interface RunStats {
+  turns: number
+  searches: number
+  usage: TaskSearchUsage
+}
+
+export type TaskSearchResult
+  = | ({ _tag: 'found', refs: string[], dropped: number } & RunStats)
+    | ({ _tag: 'none', dropped: number } & RunStats)
+    | ({ _tag: 'failed', reason: 'model-error' | 'invalid-response', error?: unknown } & RunStats)
+
+const SEARCH_TOOL_NAME = 'search_skills'
+
+const TOOLS = [{
+  type: 'function',
+  function: {
+    name: SEARCH_TOOL_NAME,
+    description: `Search the skilld.dev registry for agent Skills, by meaning and by keyword. Returns up to ${TASK_SEARCH_RESULTS_PER_QUERY} Skills, each with its ref, description, and GitHub stars.`,
+    parameters: {
+      type: 'object',
+      properties: {
+        query: { type: 'string', description: 'What the Skill should help with, such as "nuxt seo" or "database migrations"' },
+      },
+      required: ['query'],
+    },
+  },
+}] as const
+
+const ANSWER_FORMAT = {
+  type: 'json_schema',
+  json_schema: {
+    name: 'task_search_answer',
+    strict: true,
+    schema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: { refs: { type: 'array', items: { type: 'string' } } },
+      required: ['refs'],
+    },
+  },
+} as const
+
+export function taskSearchSystemPrompt(): string {
+  return `You find agent Skills on skilld.dev for a developer's task.
+A Skill is a SKILL.md file of instructions that a coding agent reads. The developer typed a sentence into the search box.
+
+Use ${SEARCH_TOOL_NAME} to find candidates. Rewrite the sentence into short topical queries, and try 2 or 3 different angles in parallel (the technology, the problem, the activity).
+Read descriptions critically. A Skill for another language or runtime is not a match, even if it shares words.
+You have at most ${TASK_SEARCH_MAX_TURNS} model turns, including the final answer.
+
+Final answer: JSON only. Return up to ${TASK_SEARCH_MAX_SKILLS} refs, best first. Each ref must be exactly the "ref" value of a search result.
+Never return a ref you did not see in a search result. If nothing fits the task, return an empty list.`
+}
+
+function request(messages: TaskSearchMessage[], last: boolean): TaskSearchRequest {
+  return {
+    messages: [...messages],
+    tools: TOOLS,
+    tool_choice: last ? 'none' : 'auto',
+    response_format: ANSWER_FORMAT,
+    max_completion_tokens: MAX_COMPLETION_TOKENS,
+    reasoning_effort: 'none',
+  }
+}
+
+const EMPTY_USAGE: TaskSearchUsage = { inputTokens: 0, cachedTokens: 0, outputTokens: 0 }
+
+function count(value: unknown): number {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : 0
+}
+
+function readUsage(reply: unknown): TaskSearchUsage {
+  const usage = (reply as { usage?: Record<string, unknown> } | null)?.usage
+  if (typeof usage !== 'object' || usage === null)
+    return EMPTY_USAGE
+  const details = usage.prompt_tokens_details as Record<string, unknown> | undefined
+  return {
+    inputTokens: count(usage.prompt_tokens),
+    cachedTokens: count(details?.cached_tokens),
+    outputTokens: count(usage.completion_tokens),
+  }
+}
+
+function addUsage(a: TaskSearchUsage, b: TaskSearchUsage): TaskSearchUsage {
+  return {
+    inputTokens: a.inputTokens + b.inputTokens,
+    cachedTokens: a.cachedTokens + b.cachedTokens,
+    outputTokens: a.outputTokens + b.outputTokens,
+  }
+}
+
+/** What one model call might cost, rounded up to a whole micro-dollar. */
+export function taskSearchCostMicros(usage: TaskSearchUsage): number {
+  const fresh = Math.max(0, usage.inputTokens - usage.cachedTokens)
+  return Math.ceil(fresh * PRICE_MICROS.input + usage.cachedTokens * PRICE_MICROS.cachedInput + usage.outputTokens * PRICE_MICROS.output)
+}
+
+type ModelTurn
+  = | { _tag: 'searches', calls: ModelToolCall[] }
+    | { _tag: 'answer', refs: unknown[] }
+    | { _tag: 'invalid' }
+
+function readToolCall(value: unknown): ModelToolCall | null {
+  if (typeof value !== 'object' || value === null)
+    return null
+  const { id, function: fn } = value as { id?: unknown, function?: { name?: unknown, arguments?: unknown } }
+  if (typeof id !== 'string' || typeof fn?.name !== 'string')
+    return null
+  return { id, type: 'function', function: { name: fn.name, arguments: typeof fn.arguments === 'string' ? fn.arguments : '' } }
+}
+
+/** Parse an untrusted Chat Completions reply into searches, an answer, or neither. */
+function readTurn(reply: unknown): ModelTurn {
+  const message = (reply as { choices?: { message?: Record<string, unknown> }[] } | null)?.choices?.[0]?.message
+  if (typeof message !== 'object' || message === null)
+    return { _tag: 'invalid' }
+  if (Array.isArray(message.tool_calls) && message.tool_calls.length) {
+    const calls = message.tool_calls.map(readToolCall)
+    return calls.every(call => call !== null) ? { _tag: 'searches', calls: calls as ModelToolCall[] } : { _tag: 'invalid' }
+  }
+  if (typeof message.content !== 'string')
+    return { _tag: 'invalid' }
+  try {
+    const parsed: unknown = JSON.parse(message.content)
+    const refs = (parsed as { refs?: unknown } | null)?.refs
+    return Array.isArray(refs) ? { _tag: 'answer', refs } : { _tag: 'invalid' }
+  }
+  catch {
+    // Prose instead of the JSON the response format asks for: the caller
+    // reports an invalid response, which is the whole answer to it.
+    return { _tag: 'invalid' }
+  }
+}
+
+function toolText(skills: TaskSearchSkill[]): string {
+  return JSON.stringify({
+    items: skills.map(skill => ({
+      ref: skill.ref,
+      description: skill.description?.slice(0, MAX_DESCRIPTION_CHARS) ?? null,
+      stars: skill.stars,
+    })),
+  })
+}
+
+function searchQuery(call: ModelToolCall): string | null {
+  try {
+    const query = (JSON.parse(call.function.arguments) as { query?: unknown } | null)?.query
+    if (typeof query !== 'string')
+      return null
+    const trimmed = query.trim()
+    return trimmed && trimmed.length <= MAX_QUERY_CHARS ? trimmed : null
+  }
+  catch {
+    // Arguments that are not JSON get the same reply as a missing query.
+    return null
+  }
+}
+
+/**
+ * Run one turn's searches. Every call id gets a reply, because the next
+ * request is refused while any call is left unanswered.
+ */
+async function runSearches(
+  deps: TaskSearchDeps,
+  calls: ModelToolCall[],
+  seen: Set<string>,
+): Promise<{ replies: TaskSearchMessage[], searches: number }> {
+  let budget = MAX_SEARCHES_PER_TURN
+  const replies = await Promise.all(calls.map(async (call): Promise<TaskSearchMessage> => {
+    const reply = (content: string): TaskSearchMessage => ({ role: 'tool', tool_call_id: call.id, content })
+    if (call.function.name !== SEARCH_TOOL_NAME)
+      return reply(`Unknown tool: ${call.function.name}. Use ${SEARCH_TOOL_NAME}.`)
+    const query = searchQuery(call)
+    if (!query)
+      return reply(`Invalid arguments: query must be 1 to ${MAX_QUERY_CHARS} characters.`)
+    if (budget <= 0)
+      return reply(`Search skipped: at most ${MAX_SEARCHES_PER_TURN} searches a turn.`)
+    budget--
+    const skills = await deps.search(query)
+    skills.forEach(skill => seen.add(skill.ref))
+    return reply(toolText(skills))
+  }))
+  return { replies, searches: MAX_SEARCHES_PER_TURN - budget }
+}
+
+function normaliseRef(value: string): string {
+  return value.trim().toLowerCase().replace(/^[@/]+|\/+$/g, '')
+}
+
+/**
+ * Snap the model's refs to refs the searches returned, best first, once each.
+ *
+ * The model assembles a ref by copying it, and it slips when a Skill's name
+ * repeats its Repository's: the eval saw `owner/name` for
+ * `owner/name/name` and `nuxt/ui/nuxt-ui/nuxt-ui` for `nuxt/ui/nuxt-ui`. A
+ * slipped ref is repaired by owner and Skill name when exactly one result
+ * matches. Anything else is dropped.
+ */
+export function snapRefs(returned: readonly unknown[], seen: Iterable<string>, max = TASK_SEARCH_MAX_SKILLS): string[] {
+  const known = new Map<string, string>()
+  for (const ref of seen)
+    known.set(ref.toLowerCase(), ref)
+  const snapped: string[] = []
+  for (const value of returned) {
+    if (snapped.length >= max)
+      break
+    if (typeof value !== 'string')
+      continue
+    const ref = normaliseRef(value)
+    const exact = known.get(ref)
+    const match = exact ?? repairRef(ref, known)
+    if (match && !snapped.includes(match))
+      snapped.push(match)
+  }
+  return snapped
+}
+
+function repairRef(ref: string, known: Map<string, string>): string | null {
+  const segments = ref.split('/').filter(Boolean)
+  if (segments.length < 2)
+    return null
+  const owner = segments[0]
+  const name = segments.at(-1)
+  const candidates = [...known.entries()].filter(([key]) => {
+    const parts = key.split('/')
+    return parts[0] === owner && parts.at(-1) === name
+  })
+  return candidates.length === 1 ? candidates[0]![1] : null
+}
+
+/**
+ * Answer one sentence. Expected failures, a model that errors or replies
+ * with something unusable, come back as values. A failing search is not
+ * expected here and propagates.
+ */
+export async function runTaskSearch(deps: TaskSearchDeps, question: string): Promise<TaskSearchResult> {
+  const messages: TaskSearchMessage[] = [
+    { role: 'system', content: taskSearchSystemPrompt() },
+    { role: 'user', content: question },
+  ]
+  const seen = new Set<string>()
+  let usage = EMPTY_USAGE
+  let searches = 0
+
+  for (let turn = 1; turn <= TASK_SEARCH_MAX_TURNS; turn++) {
+    const stats = () => ({ turns: turn, searches, usage })
+    const last = turn === TASK_SEARCH_MAX_TURNS
+    const reply = await deps.model(request(messages, last)).then(
+      value => ({ _tag: 'ok' as const, value }),
+      (error: unknown) => ({ _tag: 'error' as const, error }),
+    )
+    if (reply._tag === 'error')
+      return { _tag: 'failed', reason: 'model-error', error: reply.error, ...stats() }
+    usage = addUsage(usage, readUsage(reply.value))
+
+    const parsed = readTurn(reply.value)
+    if (parsed._tag === 'invalid' || (parsed._tag === 'searches' && last))
+      return { _tag: 'failed', reason: 'invalid-response', ...stats() }
+
+    if (parsed._tag === 'searches') {
+      messages.push({ role: 'assistant', content: null, tool_calls: parsed.calls })
+      const ran = await runSearches(deps, parsed.calls, seen)
+      searches += ran.searches
+      messages.push(...ran.replies)
+      continue
+    }
+
+    const refs = snapRefs(parsed.refs, seen)
+    const offered = new Set(parsed.refs.filter((ref): ref is string => typeof ref === 'string').map(normaliseRef)).size
+    const dropped = Math.max(0, Math.min(offered, TASK_SEARCH_MAX_SKILLS) - refs.length)
+    return refs.length
+      ? { _tag: 'found', refs, dropped, ...stats() }
+      : { _tag: 'none', dropped, ...stats() }
+  }
+  // The last turn always returns above: tool_choice none forces an answer or an invalid reply.
+  return { _tag: 'failed', reason: 'invalid-response', turns: TASK_SEARCH_MAX_TURNS, searches, usage }
+}
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 1d37c69d..40c6d2af 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -147,6 +147,17 @@ export default defineNuxtConfig({
       // `search-intent`: how long the query model took, so the latency
       // budget can be checked against production instead of guessed.
       'model.durationMs',
+      // `task-search`: what one model answer cost, so the daily budget and
+      // the eval's per-question figures can be checked against production.
+      // The question text is never a field.
+      'model.cachedTokens',
+      'model.costMicros',
+      'model.droppedRefs',
+      'model.errorCode',
+      'model.inputTokens',
+      'model.outputTokens',
+      'model.searches',
+      'model.turns',
       'operation',
       'outcome',
       'processed.count',
@@ -399,6 +410,14 @@ export default defineNuxtConfig({
     tokenKey: '',
     checkinToken: '',
     publicSiteUrl: 'https://skilld.dev',
+    // Task search, the search box's opt-in model answer. Set the Worker
+    // variable NUXT_TASK_SEARCH_ENABLED=false to switch it off without a
+    // deploy. The budget is micro-dollars per UTC day across every visitor:
+    // 1,000,000 is $1, about 1,400 questions at the measured $0.0007.
+    taskSearch: {
+      enabled: true,
+      dailyBudgetMicros: 1_000_000,
+    },
     oauth: {
       github: {
         clientId: '',
diff --git a/test/unit/search-panel-run-command.test.ts b/test/unit/search-panel-run-command.test.ts
index ed211794..b21d89d2 100644
--- a/test/unit/search-panel-run-command.test.ts
+++ b/test/unit/search-panel-run-command.test.ts
@@ -36,6 +36,7 @@ mockNuxtImport('useSkillSearch', () => () => ({
   recentSearches: ref([]),
   retry: vi.fn(),
   submitRepository: vi.fn(),
+  taskSearch: ref({ _tag: 'idle' as const }),
 }))
 
 describe('search panel command grammar', () => {
diff --git a/test/unit/task-search-run.test.ts b/test/unit/task-search-run.test.ts
new file mode 100644
index 00000000..b1cf686a
--- /dev/null
+++ b/test/unit/task-search-run.test.ts
@@ -0,0 +1,136 @@
+import type { TaskSearchRequest } from '../../layers/registry/server/utils/task-search'
+import type { TaskSearchReport, TaskSearchShellDeps } from '../../layers/registry/server/utils/task-search-run'
+import { describe, expect, it } from 'vitest'
+import { searchForTask } from '../../layers/registry/server/utils/task-search-run'
+
+const usage = { prompt_tokens: 6000, completion_tokens: 200, prompt_tokens_details: { cached_tokens: 0 } }
+const searchReply = {
+  choices: [{ message: { role: 'assistant', content: null, tool_calls: [{ id: 'c', type: 'function', function: { name: 'search_skills', arguments: '{"query":"nuxt seo"}' } }] } }],
+  usage,
+}
+const answerReply = (refs: string[]) => ({ choices: [{ message: { role: 'assistant', content: JSON.stringify({ refs }) } }], usage })
+
+function memoryStorage() {
+  const items = new Map<string, unknown>()
+  return {
+    items,
+    getItem: async <T>(key: string) => (items.get(key) ?? null) as T | null,
+    setItem: async (key: string, value: never) => {
+      items.set(key, value)
+    },
+  }
+}
+
+/** A model that answers every question with the given refs after one search. */
+function modelAnswering(refs: string[]) {
+  const calls: TaskSearchRequest[] = []
+  return {
+    calls,
+    model: async (request: TaskSearchRequest) => {
+      calls.push(request)
+      return request.messages.some(message => message.role === 'tool') ? answerReply(refs) : searchReply
+    },
+  }
+}
+
+function harness(overrides: Partial<TaskSearchShellDeps> = {}) {
+  const reports: TaskSearchReport[] = []
+  const scheduled: Promise<unknown>[] = []
+  const storage = memoryStorage()
+  const deps: TaskSearchShellDeps = {
+    enabled: true,
+    dailyBudgetMicros: 1_000_000,
+    model: modelAnswering(['onmax/nuxt-skills/nuxt-seo']).model,
+    search: async () => [{ ref: 'onmax/nuxt-skills/nuxt-seo', description: 'Nuxt SEO', stars: 300 }],
+    storage,
+    allowVisitor: async () => true,
+    schedule: promise => scheduled.push(promise),
+    digest: async text => text,
+    now: () => Date.parse('2026-10-06T12:00:00Z'),
+    report: report => reports.push(report),
+    ...overrides,
+  }
+  return { deps, reports, storage, settle: () => Promise.all(scheduled) }
+}
+
+describe('searchForTask', () => {
+  it('finds Skills, then answers the same question from the cache without the model', async () => {
+    const first = modelAnswering(['onmax/nuxt-skills/nuxt-seo'])
+    const { deps } = harness({ model: first.model })
+
+    expect(await searchForTask(deps, 'set up seo for my nuxt site')).toEqual({ _tag: 'found', refs: ['onmax/nuxt-skills/nuxt-seo'], source: 'model' })
+
+    const second = modelAnswering([])
+    expect(await searchForTask({ ...deps, model: second.model, allowVisitor: async () => false }, 'set up seo for my nuxt site'))
+      .toEqual({ _tag: 'found', refs: ['onmax/nuxt-skills/nuxt-seo'], source: 'cache' })
+    expect(second.calls).toHaveLength(0)
+  })
+
+  it('stays off when the kill switch is off, without calling the model', async () => {
+    const model = modelAnswering([])
+    const { deps, reports } = harness({ enabled: false, model: model.model })
+    expect(await searchForTask(deps, 'set up seo for my nuxt site')).toEqual({ _tag: 'off' })
+    expect(model.calls).toHaveLength(0)
+    expect(reports).toEqual([{ _tag: 'skipped', reason: 'off' }])
+  })
+
+  it('stays off when the AI binding is missing', async () => {
+    const { deps } = harness({ model: undefined })
+    expect(await searchForTask(deps, 'set up seo for my nuxt site')).toEqual({ _tag: 'off' })
+  })
+
+  it('stops for the day once the runs have spent the budget', async () => {
+    const model = modelAnswering(['onmax/nuxt-skills/nuxt-seo'])
+    const { deps, settle } = harness({ model: model.model, dailyBudgetMicros: 1000 })
+
+    await searchForTask(deps, 'set up seo for my nuxt site')
+    await settle()
+    expect(model.calls).toHaveLength(2)
+
+    expect(await searchForTask(deps, 'write playwright tests')).toEqual({ _tag: 'limited', scope: 'daily' })
+    expect(model.calls).toHaveLength(2)
+  })
+
+  it('stops a visitor over their allowance, without calling the model', async () => {
+    const model = modelAnswering([])
+    const { deps } = harness({ model: model.model, allowVisitor: async () => false })
+    expect(await searchForTask(deps, 'set up seo for my nuxt site')).toEqual({ _tag: 'limited', scope: 'visitor' })
+    expect(model.calls).toHaveLength(0)
+  })
+
+  it('reports a run with its turns, tokens and cost, and never the question', async () => {
+    const { deps, reports } = harness()
+    await searchForTask(deps, 'set up seo for my nuxt site')
+    expect(reports).toHaveLength(1)
+    expect(reports[0]).toMatchObject({
+      _tag: 'model',
+      costMicros: 1400,
+      result: { _tag: 'found', turns: 2, searches: 1, usage: { inputTokens: 12000, outputTokens: 400 } },
+    })
+    expect(JSON.stringify(reports)).not.toContain('nuxt site')
+  })
+
+  it('counts a failed run against the budget and does not cache it', async () => {
+    let calls = 0
+    const failing = async () => {
+      calls++
+      if (calls === 1)
+        return searchReply
+      throw new Error('2021: Insufficient AI Gateway credits')
+    }
+    const { deps, storage, settle } = harness({ model: failing })
+
+    expect(await searchForTask(deps, 'set up seo for my nuxt site')).toEqual({ _tag: 'failed' })
+    await settle()
+    expect(storage.items.get('task-search:spend:2026-10-06')).toBe(700)
+
+    const retry = modelAnswering(['onmax/nuxt-skills/nuxt-seo'])
+    expect(await searchForTask({ ...deps, model: retry.model }, 'set up seo for my nuxt site')).toMatchObject({ _tag: 'found', source: 'model' })
+  })
+
+  it('answers none when nothing fits, and caches that', async () => {
+    const { deps } = harness({ model: modelAnswering([]).model })
+    expect(await searchForTask(deps, 'bake sourdough bread')).toEqual({ _tag: 'none', source: 'model' })
+    expect(await searchForTask({ ...deps, model: undefined }, 'bake sourdough bread')).toEqual({ _tag: 'none', source: 'cache' })
+  })
+})
diff --git a/test/unit/task-search.test.ts b/test/unit/task-search.test.ts
new file mode 100644
index 00000000..11fe9234
--- /dev/null
+++ b/test/unit/task-search.test.ts
@@ -0,0 +1,222 @@
+import type { TaskSearchMessage, TaskSearchRequest, TaskSearchSkill } from '../../layers/registry/server/utils/task-search'
+import { describe, expect, it } from 'vitest'
+import {
+  runTaskSearch,
+  snapRefs,
+  TASK_SEARCH_MAX_TURNS,
+  taskSearchCostMicros,
+} from '../../layers/registry/server/utils/task-search'
+
+const usage = { prompt_tokens: 600, completion_tokens: 40, prompt_tokens_details: { cached_tokens: 100 } }
+
+function searches(...queries: string[]) {
+  return {
+    choices: [{
+      message: {
+        role: 'assistant',
+        content: null,
+        tool_calls: queries.map((query, i) => ({
+          id: `call_${i}`,
+          type: 'function',
+          function: { name: 'search_skills', arguments: JSON.stringify({ query }) },
+        })),
+      },
+    }],
+    usage,
+  }
+}
+
+function answer(refs: unknown[]) {
+  return { choices: [{ message: { role: 'assistant', content: JSON.stringify({ refs }) } }], usage }
+}
+
+/** A model that replies from a script and keeps every request it was sent. */
+function scriptedModel(replies: unknown[]) {
+  const requests: TaskSearchRequest[] = []
+  return {
+    requests,
+    model: async (request: TaskSearchRequest) => {
+      requests.push(structuredClone(request))
+      const next = replies.shift()
+      if (next instanceof Error)
+        throw next
+      return next
+    },
+  }
+}
+
+type ToolReply = Extract<TaskSearchMessage, { role: 'tool' }>
+
+function toolReplies(request: TaskSearchRequest): ToolReply[] {
+  return request.messages.filter((message): message is ToolReply => message.role === 'tool')
+}
+
+const skill = (ref: string, description = `About ${ref}`): TaskSearchSkill => ({ ref, description, stars: 10 })
+
+function registry(results: Record<string, TaskSearchSkill[]>) {
+  const queries: string[] = []
+  return {
+    queries,
+    search: async (query: string) => {
+      queries.push(query)
+      return results[query] ?? []
+    },
+  }
+}
+
+describe('snapRefs', () => {
+  const seen = [
+    'chromedevtools/chrome-devtools-mcp/memory-leak-debugging',
+    'jakubkrehel/make-interfaces-feel-better/make-interfaces-feel-better',
+    'nuxt/ui/nuxt-ui',
+    'onmax/nuxt-skills/nuxt-seo',
+  ]
+
+  it('keeps refs the searches returned, in the model order, once each', () => {
+    expect(snapRefs(['onmax/nuxt-skills/nuxt-seo', 'nuxt/ui/nuxt-ui', 'onmax/nuxt-skills/nuxt-seo'], seen))
+      .toEqual(['onmax/nuxt-skills/nuxt-seo', 'nuxt/ui/nuxt-ui'])
+  })
+
+  it('matches a ref whatever its case', () => {
+    expect(snapRefs(['Nuxt/UI/Nuxt-UI'], seen)).toEqual(['nuxt/ui/nuxt-ui'])
+  })
+
+  it('repairs a ref that dropped the repeated repository segment', () => {
+    expect(snapRefs(['jakubkrehel/make-interfaces-feel-better'], seen))
+      .toEqual(['jakubkrehel/make-interfaces-feel-better/make-interfaces-feel-better'])
+  })
+
+  it('repairs a ref that repeated a segment', () => {
+    expect(snapRefs(['nuxt/ui/nuxt-ui/nuxt-ui'], seen)).toEqual(['nuxt/ui/nuxt-ui'])
+  })
+
+  it('drops a ref no search returned, and anything that is not a ref', () => {
+    expect(snapRefs(['vercel-labs/skills/find-skills', 42, null, '', 'nuxt-seo'], seen)).toEqual([])
+  })
+
+  it('drops a repair that two results could satisfy', () => {
+    expect(snapRefs(['onmax/nuxt-ui'], ['onmax/claude-config/nuxt-ui', 'onmax/nuxt-skills/nuxt-ui'])).toEqual([])
+  })
+
+  it('keeps at most six', () => {
+    const many = Array.from({ length: 9 }, (_, i) => `owner/repo/skill-${i}`)
+    expect(snapRefs(many, many)).toEqual(many.slice(0, 6))
+  })
+})
+
+describe('runTaskSearch', () => {
+  it('runs the searches the model asks for and answers only refs those searches returned', async () => {
+    const { model, requests } = scriptedModel([
+      searches('node memory leak', 'heap snapshot debugging'),
+      answer(['chromedevtools/chrome-devtools-mcp/memory-leak-debugging', 'invented/repo/skill']),
+    ])
+    const { search, queries } = registry({
+      'heap snapshot debugging': [skill('chromedevtools/chrome-devtools-mcp/memory-leak-debugging')],
+    })
+
+    const result = await runTaskSearch({ model, search }, 'stop memory leaks in node')
+
+    expect(queries).toEqual(['node memory leak', 'heap snapshot debugging'])
+    expect(result).toMatchObject({
+      _tag: 'found',
+      refs: ['chromedevtools/chrome-devtools-mcp/memory-leak-debugging'],
+      dropped: 1,
+      turns: 2,
+      searches: 2,
+      usage: { inputTokens: 1200, cachedTokens: 200, outputTokens: 80 },
+    })
+    // The model reads each search answer as a ready ref, beside the question it was asked.
+    expect(requests[0]!.messages.at(-1)).toEqual({ role: 'user', content: 'stop memory leaks in node' })
+    const replies = toolReplies(requests[1]!)
+    expect(replies.map(message => message.tool_call_id)).toEqual(['call_0', 'call_1'])
+    expect(JSON.parse(replies[1]!.content)).toEqual({
+      items: [{ ref: 'chromedevtools/chrome-devtools-mcp/memory-leak-debugging', description: 'About chromedevtools/chrome-devtools-mcp/memory-leak-debugging', stars: 10 }],
+    })
+  })
+
+  it('answers none when nothing fits the task', async () => {
+    const { model } = scriptedModel([searches('sourdough bread'), answer([])])
+    const result = await runTaskSearch({ model, search: registry({}).search }, 'teach my agent to bake sourdough bread')
+    expect(result).toMatchObject({ _tag: 'none', dropped: 0, turns: 2, searches: 1 })
+  })
+
+  it('answers none when every ref the model gives is one no search returned', async () => {
+    const { model } = scriptedModel([searches('taxes'), answer(['made/up/skill'])])
+    const result = await runTaskSearch({ model, search: registry({}).search }, 'file my taxes in estonia')
+    expect(result).toMatchObject({ _tag: 'none', dropped: 1 })
+  })
+
+  it('asks for the answer without tools on the last turn', async () => {
+    const { model, requests } = scriptedModel([
+      searches('a'),
+      searches('b'),
+      answer(['owner/repo/b-skill']),
+    ])
+    const result = await runTaskSearch({ model, search: registry({ b: [skill('owner/repo/b-skill')] }).search }, 'some task here')
+    expect(requests.map(request => request.tool_choice)).toEqual(['auto', 'auto', 'none'])
+    expect(result).toMatchObject({ _tag: 'found', refs: ['owner/repo/b-skill'], turns: TASK_SEARCH_MAX_TURNS })
+  })
+
+  it('fails as an invalid response when the model still asks for searches on the last turn', async () => {
+    const { model } = scriptedModel([searches('a'), searches('b'), searches('c')])
+    const { search, queries } = registry({})
+    const result = await runTaskSearch({ model, search }, 'some task here')
+    expect(result).toMatchObject({ _tag: 'failed', reason: 'invalid-response', turns: 3 })
+    expect(queries).toEqual(['a', 'b'])
+  })
+
+  it('fails as a model error and keeps the usage it already spent', async () => {
+    const { model } = scriptedModel([searches('a'), new Error('2021: Insufficient AI Gateway credits')])
+    const result = await runTaskSearch({ model, search: registry({}).search }, 'some task here')
+    expect(result).toMatchObject({ _tag: 'failed', reason: 'model-error', turns: 2, usage: { inputTokens: 600 } })
+  })
+
+  it.each([
+    ['prose', { choices: [{ message: { role: 'assistant', content: 'Here are some skills.' } }], usage }],
+    ['no choices', { error: 'boom' }],
+    ['nothing', null],
+  ])('fails as an invalid response on %s', async (_, reply) => {
+    const { model } = scriptedModel([reply])
+    const result = await runTaskSearch({ model, search: registry({}).search }, 'some task here')
+    expect(result).toMatchObject({ _tag: 'failed', reason: 'invalid-response', turns: 1 })
+  })
+
+  it('runs at most four searches a turn and still replies to every call', async () => {
+    const { model, requests } = scriptedModel([searches('a', 'b', 'c', 'd', 'e', 'f'), answer([])])
+    const { search, queries } = registry({})
+    await runTaskSearch({ model, search }, 'some task here')
+    expect(queries).toEqual(['a', 'b', 'c', 'd'])
+    const replies = toolReplies(requests[1]!)
+    expect(replies).toHaveLength(6)
+    expect(replies.slice(4).map(message => message.content)).toEqual([
+      'Search skipped: at most 4 searches a turn.',
+      'Search skipped: at most 4 searches a turn.',
+    ])
+  })
+
+  it('tells the model when a search has no usable query, without running it', async () => {
+    const bad = {
+      choices: [{ message: { role: 'assistant', content: null, tool_calls: [
+        { id: 'call_0', type: 'function', function: { name: 'search_skills', arguments: '{"query":"  "}' } },
+        { id: 'call_1', type: 'function', function: { name: 'get_skill', arguments: '{}' } },
+      ] } }],
+      usage,
+    }
+    const { model, requests } = scriptedModel([bad, answer([])])
+    const { search, queries } = registry({})
+    await runTaskSearch({ model, search }, 'some task here')
+    expect(queries).toEqual([])
+    expect(toolReplies(requests[1]!).map(message => message.content)).toEqual([
+      'Invalid arguments: query must be 1 to 200 characters.',
+      'Unknown tool: get_skill. Use search_skills.',
+    ])
+  })
+})
+
+describe('taskSearchCostMicros', () => {
+  it('charges cached input at the cached rate and rounds up', () => {
+    // 8000 fresh input at $0.10/M, 2000 cached at $0.01/M, 500 output at $0.50/M.
+    expect(taskSearchCostMicros({ inputTokens: 10_000, cachedTokens: 2_000, outputTokens: 500 })).toBe(1070)
+    expect(taskSearchCostMicros({ inputTokens: 1, cachedTokens: 0, outputTokens: 0 })).toBe(1)
+  })
+})
diff --git a/worker-configuration.d.ts b/worker-configuration.d.ts
index c6803886..051b5bc3 100644
--- a/worker-configuration.d.ts
+++ b/worker-configuration.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types --config=wrangler.jsonc --env-file=.dev.vars.example` (hash: 12ca5f4ca288facb55eef1878a7c0ec3)
+// Generated by Wrangler by running `wrangler types --config=wrangler.jsonc --env-file=.dev.vars.example` (hash: 50fee44c1595f78f46cc0523374267df)
 // Runtime types generated with workerd@1.20260828.1 2026-08-20 nodejs_compat
 interface __BaseEnv_Env {
 	KV_CACHE: KVNamespace;
@@ -17,6 +17,7 @@ interface __BaseEnv_Env {
 	ARTIFACT_BUILD_QUEUE: Queue;
 	API_GUEST_RATE_LIMIT: RateLimit;
 	API_ACCOUNT_RATE_LIMIT: RateLimit;
+	TASK_SEARCH_RATE_LIMIT: RateLimit;
 	AI: Ai;
 	CF_VERSION_METADATA: WorkerVersionMetadata;
 	ARTIFACT_PUBLIC_BASE_URL: "https://artifacts.skilld.dev";
diff --git a/wrangler.jsonc b/wrangler.jsonc
index 1869a108..521662a5 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -12,7 +12,11 @@
   },
   "ratelimits": [
     { "name": "API_GUEST_RATE_LIMIT", "namespace_id": "2401001", "simple": { "limit": 60, "period": 60 } },
-    { "name": "API_ACCOUNT_RATE_LIMIT", "namespace_id": "2401002", "simple": { "limit": 600, "period": 60 } }
+    { "name": "API_ACCOUNT_RATE_LIMIT", "namespace_id": "2401002", "simple": { "limit": 600, "period": 60 } },
+    // Task search runs a paid model. The longest period a rate limit binding
+    // takes is 60 seconds; the daily ceiling is the spend budget in
+    // runtimeConfig.taskSearch, across every visitor.
+    { "name": "TASK_SEARCH_RATE_LIMIT", "namespace_id": "2401003", "simple": { "limit": 3, "period": 60 } }
   ],
   "cache": {
     "enabled": true,