[ADR-067 epic] Admin-enforced live-query-only KB access (no full local replication) — tracking

[cuttlefisch]

Epic tracker for ADR-067: docs/adr/067-admin-enforced-live-query-only-kb-access.md

Resolves #448. Lets a KB owner restrict an authorized member (Owner/Editor/Viewer,
ADR-018) to ADR-053's live query-only access instead of full local kb_join
replication — a real, currently-uncovered gap: today kb_access
(daemon/src/collab_handler/mod.rs:1183-1189) treats KbOp::Join and KbOp::Read
identically for any role.

Grounded in real industry precedent (Salesforce Run/Export Reports, Confluence Export
Space permission, Google Workspace DLP download/print/copy restriction, Microsoft
Purview Restricted View, NIST SP 800-53 AC-4's formal access-vs-flow-control
distinction) and real codebase investigation (the signed membership op-log,
kb_join's bundled E2E key delivery, the mTLS-vs-OAuth kb/query.* reachability gap
found during design).

Implementation sequencing note (2026-07-27): this epic is being worked as part of a
combined ADR-061/ADR-067 sequencing plan — Phase E is being pulled forward to right
after Phase B (it only depends on B, not C/D, and carries none of C/D's crypto/key-delivery
risk), so it may land before Phase C/D even though it's numbered last.

Phases

• Phase A — signed op-log ReplicationPolicy field — shipped (see [ADR-067 Phase A] Signed op-log ReplicationPolicy field (Full | QueryOnly) #450), 4 adversarial tests
• Phase B — kb_access Join/Read split + kb_join enforcement (next)
• Phase C — kb/query.my_wrapped_key (narrow E2E key delivery)
• Phase D — self-pointing RemoteHub client path + OAuth self-scoped tokens + mTLS kb/query.* wiring
• Phase E — retroactive-restriction limitation + audit signal (resequenced to land right after B)

Every phase's DoD is its adversarial test set as specified in the ADR — see the ADR
document for full detail, real code citations (file:line), and the explicit named
limitations (un-revocable local replica once already joined; legacy/un-anchored KBs
out of scope; mTLS-only deployments need Phase D).

[cuttlefisch]

Phases B, C, and E landed together in #488 (merge commit 6dc51e9): kb_access Join/Read split enforcing QueryOnly replication restriction (#451), kb/query.my_wrapped_key narrow E2E key delivery (#452), and the residual_replica_risk owner-visible signal (#454). Remaining: Phase D (self-pointing RemoteHub + OAuth self-minting + mTLS wiring, #453).