14:50:30 <RRSAgent> RRSAgent has joined #webmachinelearning
14:50:34 <RRSAgent> logging to https://www.w3.org/2026/04/16-webmachinelearning-irc
14:50:34 <Zakim> RRSAgent, make logs Public
14:50:35 <Zakim> please title this meeting ("meeting: ..."), anssik
14:50:47 <anssik> Meeting: WebML CG Teleconference – 16 April 2026
14:50:47 <anssik> Chair: Anssi
14:50:47 <anssik> Agenda: https://github.com/webmachinelearning/meetings/blob/main/telcons/2026-04-16-cg-agenda.md
14:50:47 <anssik> Scribe: Anssi
14:50:48 <anssik> ScribeNick: anssik
14:50:57 <anssik> Present+ Anssi_Kostiainen
14:51:07 <anssik> RRSAgent, draft minutes
14:51:08 <RRSAgent> I have made the request to generate https://www.w3.org/2026/04/16-webmachinelearning-minutes.html anssik
14:54:02 <rupert> rupert has joined #webmachinelearning
14:58:41 <Mark_Foltz> Present+
14:59:19 <brwalder> brwalder has joined #webmachinelearning
15:00:06 <jaeone> jaeone has joined #webmachinelearning
15:00:55 <johannhof> johannhof has joined #webmachinelearning
15:01:19 <domfarolino> domfarolino has joined #webmachinelearning
15:01:25 <anssik> ... as a reminder, we'll use IRC-based queue management in this meeting:
15:01:29 <anssik> -> https://www.w3.org/guide/meetings/zakim.html#speakerqueue
15:01:47 <anssik> Anssi: to suggest agenda topics, use Agenda+ label, e.g.:
15:01:53 <anssik> -> Agenda+ https://github.com/webmachinelearning/webmcp/labels/Agenda+
15:01:55 <kush> kush has joined #webmachinelearning
15:01:57 <benvds> benvds has joined #webmachinelearning
15:02:05 <christianliebel> Present
15:02:05 <anssik> Anssi: welcome to the new participants to the group:
15:02:05 <Julia> Julia has joined #webmachinelearning
15:02:05 <christianliebel> Presnet+
15:02:05 <kush> present+
15:02:05 <Winstonc> Winstonc has joined #webmachinelearning
15:02:06 <JeffWhelpley> JeffWhelpley has joined #webmachinelearning
15:02:08 <anssik> ... Fidel Tian and Brendan Ittelson from Zoom
15:02:08 <christianliebel> Present+
15:02:12 <anssik> ... Andrew Nolan from Microsoft
15:02:16 <benvds> present+
15:02:16 <anssik> ... Ali Spivak from Google
15:02:24 <anssik> ... Mike Ozburn from Opn.li
15:02:26 <anssik> ... Jiwoong Yoo and Geunhyung Kim from SEAK
15:02:31 <anssik> ... Ryan Roemer from Nearform
15:02:31 <Iris> Iris has joined #webmachinelearning
15:02:35 <anssik> ... Andrew Comminos from Meta
15:02:36 <Winstonc> Present +
15:02:39 <anssik> ... welcome all to the WebML Community Group!
15:03:00 <anssik> Topic: WebMCP
15:03:04 <anssik> gb, this is webmachinelearning/webmcp
15:03:05 <gb> anssik, OK.
15:03:18 <anssik> Subtopic: Protecting tools from 3P scripts in the top-level context
15:03:22 <Ehsan> Ehsan has joined #webmachinelearning
15:03:24 <anssik> Anssi: issue #159
15:03:24 <BenGreenstein> BenGreenstein has joined #webmachinelearning
15:03:30 <gb> https://github.com/webmachinelearning/webmcp/issues/159 -> Issue 159 Protecting tools from 3P scripts in the top-level context (by yoavweiss) [Agenda+]
15:03:39 <anssik> ... I added this issue in an agenda update to discuss WebMCP iframe design before we go to the next issue about WebExtensions API
15:03:46 <anssik> ... Dominic and the Google team have spend some time exploring this
15:04:06 <anssik> ... problem statement: "an iframe may have access to information that the top-level document is not privy to"
15:04:18 <anssik> ... Dominic proposed a postMessage() style safety primitive as a solution
15:04:29 <anssik> ... Yoav seems to agree a postMessage() like model can work
15:04:41 <anssik> ... Johann suggests exposing tools to the user via iframe should not expose them to the embedding site automatically
15:04:47 <anssik> Anssi: I believe the group agrees this issue is important
15:05:34 <anssik> [ Dominic sharing slides iframe design ]
15:06:20 <anssik> s/spend/spent
15:06:38 <anssik> s/slides/slides about
15:10:12 <benvds> q+
15:10:15 <anssik> q?
15:11:12 <johannhof> q+
15:11:52 <kush> q+
15:11:52 <Alexn> Alexn has joined #webmachinelearning
15:12:06 <Mark_Foltz> q+
15:13:36 <anssik> Dominic: open questions from the slides: 1) default exposedTo behavior? 2) Should a parent be able to constrain a child's exposedTo[] list?
15:14:07 <Alexa> Alexa has joined #webmachinelearning
15:14:07 <anssik> ack benvds
15:14:36 <yoav> yoav has joined #webmachinelearning
15:14:38 <anssik> Benjamin: this matches closely my thinking in one of the previous issues, I like the shape of this, a few open questions on how to make it work exactly
15:14:39 <anssik> q?
15:14:42 <anssik> ack johannhof
15:14:51 <yoav> q+
15:15:08 <kush> q-
15:15:10 <anssik> Johann: I think the two open questions are the biggest ones to look into, not exposed should be the default
15:15:27 <anssik> ... not exposed to the 1P page and not the agent
15:15:46 <anssik> ... worried about bank.com offering tools to make transactions, these could be attack vectors
15:16:03 <anssik> ... you don't need to call the tool yourself, just make it convincing for prompt injection attack
15:16:15 <anssik> ... close enough to the SOP violation
15:16:30 <anssik> ... that would lead to less adoption of this technology
15:16:55 <anssik> Dominic: I hope the site with the tools can take more care in who to embed, maybe too much to ask?
15:17:05 <anssik> Johann: why not go with safe defaults?
15:17:30 <anssik> Dominic: agents as an extension to a user, the same attack is available if you can trick the user to actuate the same things
15:17:54 <anssik> q?
15:18:23 <benvds> q+
15:18:28 <anssik> Johann: if you expose a tool, should it be also callable to be embedder?
15:18:37 <anssik> q?
15:18:59 <kush> q+
15:19:09 <anssik> ack benvds
15:19:31 <anssik> Benjamin: the code examples online will frequently include unsafe defaults, this woul not be too helpful
15:19:32 <anssik> q?
15:19:35 <benvds> q-
15:19:37 <anssik> ack Mark_Foltz
15:20:05 <Alex> Alex has joined #webmachinelearning
15:20:07 <anssik> Johann: on the 2nd open question, there could be rug pull attacks, you're a helpful too and then overtime poison the context of the parent
15:20:29 <anssik> ... so the agent would need safery mechanisms that prevent this
15:20:34 <anssik> q?
15:20:47 <anssik> Dominic: constrains on exposedTo to fix that?
15:21:06 <anssik> Johann: I want 1P to be in control
15:21:55 <anssik> MarkF:  different from postMessage, define this at registration time vs. tool calling time
15:22:29 <anssik> Dominic: in the prototype I expose tool caller origin so during the execution you see whose calling
15:22:55 <anssik> Johann: unless you use * wildcard
15:23:05 <anssik> Dominic: more ergonomics for allow update would be good
15:23:06 <anssik> q?
15:23:09 <anssik> ack yoav
15:23:33 <anssik> Yoav: this is great in terms of the model, and how to control different frames in the frame tree
15:23:46 <anssik> ... agree on the open question with Johann, use safe defaults always
15:23:57 <anssik> ... expected same origin exposure part of defaults
15:24:01 <chris> chris has joined #webmachinelearning
15:24:13 <anssik> ... constraining childs for expose list, no immediate use case for this
15:24:30 <anssik> ... we should make sure we have affordances to build it in the future
15:24:55 <anssik> ... Johann's use cases are about restricting the tools, not disallow childA's tools from childB
15:25:07 <anssik> q?
15:25:34 <anssik> Yoav: default should be do nothing?
15:25:42 <anssik> ... exposed to agents but not other origins
15:25:43 <kush> +1
15:26:24 <anssik> Johann: from security point of view, wildcard considerations different for a new API
15:26:53 <anssik> Yoav: for impersonation the parent constraints the child, the exposeTo is opt-in, if I impersonate I opt-in to do that?
15:27:04 <anssik> Johann: the child needs to opt-in to parent
15:27:11 <anssik> q?
15:28:44 <anssik> Dominic: the child should do due diligence to check who is embedding it
15:28:56 <anssik> q?
15:29:00 <anssik> ack kush
15:29:46 <anssik> Kushal: the behavour Johann wants, is there's no value set in array
15:30:03 <anssik> ... what if someone copies code found online and puts it into an iframe
15:30:22 <benvds> q?
15:30:23 <anssik> ... all the agents will mix tools, iframe or embedder has no control over thoe
15:30:24 <benvds> q+
15:30:35 <anssik> ack benvds
15:31:15 <anssik> Johann: I'm worries about intentional attack, embed site to cause confusion
15:32:48 <anssik> Benjamin: ancestor to be considered
15:33:46 <domfarolino> +1
15:34:05 <Iris> Iris has joined #webmachinelearning
15:34:29 <domfarolino> +1
15:34:36 <kush> +1
15:34:49 <brwalder> +1
15:34:54 <anssik> RESOLUTION: Spec a registration-time origin exposure via registerTool() exposedTo with Permission Policy.
15:34:59 <anssik> Subtopic: WebExtensions API to enumerate and invoke tools
15:35:04 <anssik> Anssi: issue #74
15:35:05 <gb> https://github.com/webmachinelearning/webmcp/issues/74 -> Issue 74 WebExtensions API to enumerate and invoke tools (by reillyeon) [Agenda+]
15:35:49 <anssik> Anssi: skipping this given no participation from WECG
15:36:07 <anssik> Subtopic: Cross-document tool response mechanism
15:36:14 <anssik> Anssi: issue #135
15:36:15 <gb> https://github.com/webmachinelearning/webmcp/issues/135 -> Issue 135 Cross-document tool response mechanism (by domfarolino) [Agenda+] [declarative]
15:36:26 <anssik> ... this declarative API related issue was spun off from the mothership declarative PR #76, now merged
15:36:27 <gb> https://github.com/webmachinelearning/webmcp/pull/76 -> MERGED Pull Request 76 Declarative API Explainer (by domfarolino)
15:36:41 <anssik> Anssi: the key question posed in this issue:
15:36:45 <anssik> ... "Should the agent receive a response from the next page, after a declarative <form> tool navigates?"
15:37:50 <anssik> Dominic: considering a more general approach for this, we have looked into what BrandonW proposed, <context> element style mechanism
15:38:08 <Alex> +q
15:38:12 <anssik> q?
15:38:42 <anssik> ack Alex
15:40:03 <anssik> Alex: would love to see the details on the <context> element
15:40:31 <anssik> ... would it be better to tag this "HTML list" with this <context> tag, rather than create a separate way to display this information?
15:40:51 <anssik> ... this model context, declarative read, would condense information
15:41:08 <anssik> Dominic: this is sound, the downside is we push more work on the developer
15:41:36 <anssik> ... we want to be token efficient, could introduce a few attributes
15:42:04 <anssik> ... this may be annoying to the developers, they need an extra step with JSON on the page, maybe many pages already have JSON-LD for this?
15:42:11 <kush> q+
15:42:16 <anssik> ... we need to talk to real sites and see how they feel about this
15:43:07 <anssik> Alex: agree, declarative read API has a way for the model to read from the page, subset of information for the model to read, need to hear from practitioners and sites how this would work, iterate on the design
15:43:07 <anssik> q?
15:43:10 <anssik> ack kush
15:43:41 <anssik> Kushal: avoiding developers to need duplicate data, we'd just take what is put in the DOM, hard to standardize how to extract data from the DOM
15:43:45 <brwalder> +q
15:44:15 <anssik> Kushal: if there's information that goes in there, it is additional context, we learn from implementation experience,  when to do DOM scraping and not
15:44:17 <anssik> q?
15:44:23 <anssik> ack brwalder
15:44:54 <Mark_Foltz> q+
15:44:57 <anssik> Brandon: to Kushal's point, for in-page agents or iframe agents, they are not going to have access to the DOM, using the mechanism we're proposing, we expose through iframes, that's how they get any context from other iframes
15:45:10 <anssik> ... it is important to have a mechanism for read operations that does not rely on the DOM
15:45:19 <anssik> ... even if that means duplicating some information on the DOM
15:45:40 <anssik> ... in our testing, sometimes the most efficient workflow is not easily derived from human-readable DOM
15:45:46 <anssik> ... example, ordering from a restaurant
15:45:53 <anssik> ... a menu fits into LLM's context window
15:46:15 <anssik> ... better to consume the entire menu rather that the DOM that may have multiple pages
15:46:25 <anssik> ... human readable is not the same as LLM readable
15:46:28 <anssik> q?
15:46:31 <anssik> ack Mark_Foltz
15:47:01 <anssik> MarkF: I was thinking if we want to provide signal to developer when to populate <context>
15:47:37 <anssik> ... form submitted via tool calling, we might target navigation via extra navigation, something in HTTP or document itself that signals this page load is consumer by agent
15:47:48 <anssik> Dominic: header could be good for this
15:47:59 <anssik> q?
15:49:01 <anssik> q?
15:49:23 <anssik> q?
15:50:19 <anssik> Alex: I haven't personally found benefit in form submission information, other than error messages
15:50:35 <anssik> ... does not need to be tied to tool call, these are multi-step processes
15:51:21 <brwalder> +q
15:51:23 <anssik> ... I like the idea of <context> element, curious to see if we should add this level of complexity
15:51:26 <anssik> ack brwalder
15:51:45 <anssik> Brandon: it sounds like we're not all aligned on whether a response to form submission is useful
15:52:16 <anssik> ... <context> has use beyond that, used in declarative read operation, could be used in form submission results if right attributes added
15:52:52 <anssik> ... propose we response to look into <context> element without committing to form submission response with it
15:52:58 <Alexn> Alexn has joined #webmachinelearning
15:53:38 <Alexn> +1
15:53:40 <brwalder> +1
15:54:18 <domfarolino> +1
15:54:27 <brwalder> +q
15:54:44 <anssik> RESOLUTION: Explore <context> element without committing to form submission response with it. (issue #135)
15:54:56 <brwalder> -q
15:55:00 <anssik> q?
15:55:54 <jaeone> +q
15:56:10 <anssik> Subtopic: WebExtensions API to enumerate and invoke tools
15:56:14 <anssik> Anssi: issue #74
15:56:15 <gb> https://github.com/webmachinelearning/webmcp/issues/74 -> Issue 74 WebExtensions API to enumerate and invoke tools (by reillyeon) [Agenda+]
15:56:35 <anssik> Anssi: Simeon from WECG asked in the issue:
15:56:40 <anssik> ... - Should extensions also be able to expose their own WebMCP capabilities to the browser?
15:56:44 <anssik> ... - Should extensions also be able to expose their own WebMCP capabilities to websites?
15:56:49 <anssik> Anssi: WebExtensions Community Group (WECG) F2F took place in London last week
15:56:53 <anssik> -> WECG F2F agenda https://github.com/w3c/webextensions/wiki/2026-London-F2F-Coordination#-mlai-1-45-min-
15:57:02 <anssik> -> WECG F2F meeting notes https://docs.google.com/document/d/1LLa1rXT00ESnY26-XskmIAaBPxxAmsqLg_E6ynZec8Q/edit?tab=t.sdxnwqgtx9m6#heading=h.hsaydc4umylt
15:57:18 <anssik> Anssi: a lot of discussion about WebMCP <-> WebExtensions interaction took place at the F2F
15:57:24 <anssik> Anssi: I don't want to speak on behalf of WECG
15:57:45 <anssik> ... I will also look into scheduling a joint discussion with the interested WECG folks
15:58:28 <anssik> Dominic: we will also meet with Extensions people at Google today
15:59:12 <anssik> Topic: Writing Assistance APIs
15:59:16 <anssik> gb, this is webmachinelearning/writing-assistance-apis
15:59:16 <gb> anssik, OK.
15:59:21 <anssik> Subtopic: Summarizer preference parameter
15:59:25 <anssik> Anssi: PR #102 to address issue #96
15:59:29 <gb> https://github.com/webmachinelearning/writing-assistance-apis/issues/96 -> Issue 96 New parameter to support model tiering in Summarizer (by jingyun19)
15:59:29 <gb> https://github.com/webmachinelearning/writing-assistance-apis/pull/102 -> Pull Request 102 Add clarifications to Summarizer preference parameter (by jaewon078) [Agenda+]
15:59:31 <anssik> ... Jaewon Lee from Google shared the PR for review with the group (thanks!)
15:59:47 <anssik> ... this PR adds the following note to the spec for conflicting constraints and routing fallbacks:
15:59:51 <anssik> ... "When resolving the underlying model, the implementation should prioritize hard functional constraints over the "preference" hint. For example, if the requested options require specific capabilities (such as a requested language in "expectedInputLanguages") that are only supported by a model that does not align with the requested "preference", the implementation should select the model capable of completing the task."
15:59:56 <anssik> ... I see no concerns raised in the PR review, and adequate review time has been provided
16:00:00 <anssik> ... any additional comments from the group?
16:00:06 <anssik> ... we're good to merge this PR after addressing the few review comments, thank you for this contribution, Jaewon!
16:00:49 <anssik> Jaewon: thank you for explaining the change, we addressed the group's feedback with this PR
16:01:06 <jaeone> -q
16:01:17 <anssik> RESOLUTION: Add clarifications to Summarizer preference parameter per PR #102.
16:01:23 <anssik> RRSAgent, draft minutes
16:01:24 <RRSAgent> I have made the request to generate https://www.w3.org/2026/04/16-webmachinelearning-minutes.html anssik
16:03:34 <anssik> Present+ Alex_Nahas
16:03:44 <anssik> Present+ Ben_Greenstein
16:03:58 <anssik> Present+ Ben_VanderSloot
16:04:07 <anssik> Present+ Brandon_Walderman
16:04:19 <anssik> Present+ Christian_Liebel
16:04:38 <anssik> Present+ Dominic_Farolino
16:04:45 <anssik> Present+ Ehsan_Toreini
16:04:53 <anssik> Present+ Iris_Johnson
16:04:59 <anssik> Present+ Jaewon_Lee
16:05:12 <anssik> Present+ Jean_Vanderdonckt
16:05:26 <anssik> Present+ Jeff_Whelpley
16:05:34 <anssik> Present+ Julia_Pagnucco
16:06:38 <anssik> Present+ Khushal_Sagar
16:06:45 <anssik> Present- kush
16:06:56 <anssik> Present+ Rupert_Manfredi
16:07:23 <anssik> Present+ Saron_Yitbarek
16:07:33 <anssik> Present+ Tania_Millan
16:07:46 <anssik> Present+ Winston_Chen
16:08:06 <anssik> Present+ Yoav_Weiss
16:08:10 <anssik> RRSAgent, draft minutes
16:08:12 <RRSAgent> I have made the request to generate https://www.w3.org/2026/04/16-webmachinelearning-minutes.html anssik
16:13:35 <anssik> s/Presnet+//
16:14:53 <anssik> s/not the agent/not to the agent
16:16:10 <anssik> s/to be embedder/to the embedder
16:16:21 <anssik> s/woul not/would not
16:16:54 <anssik> s/helpful too/helpful tool
16:17:14 <anssik> s/overtime/over time
16:17:24 <anssik> s/safery/safety
16:17:51 <anssik> s/whose calling/who is calling
16:18:24 <anssik> s/exposure part/exposure to be part
16:19:48 <anssik> s/is there's/what if there's
16:20:02 <anssik> s/over thoe/over those
16:23:40 <anssik> s/skipping this given no participation from WECG/[ reorder the agenda to discuss this issue later today ]
16:26:30 <anssik> s/we response/we resolve
16:27:33 <anssik> RRSAgent, draft minutes
16:27:34 <RRSAgent> I have made the request to generate https://www.w3.org/2026/04/16-webmachinelearning-minutes.html anssik
19:31:28 <Zakim> Zakim has left #webmachinelearning