Changeset 0.28.2.1 (#184)

docs/ROADMAP.md

@@ -84,6 +84,25 @@ Known ICD report failures to investigate (likely envelope shape mismatches):
 - [x] Remove dead `NotifTypeProjectInvite` constant
 - [ ] Notification handler + store tests (PG + SQLite)
 
+**Knowledge ICD audit (cs1–cs4):**
+- [x] `knowledge.md` corrected: KB object shape (6 field mismatches), search envelope
+      (`data` not `results`), search result fields, status progression (`extracting`
+      step), file type support (text-only, not binary), auth annotations
+- [x] Test harness: add `RequirePermission` on `POST /knowledge-bases` and
+      `POST /:id/documents`, add missing `GET /:id/documents/:docId/status` and
+      `DELETE /:id/documents/:docId` routes
+- [x] New tests: document status polling, document delete, update-empty-body 400,
+      permission denial for non-privileged user
+- [x] P0 fix: `SetDiscoverable` authorization — `loadAndAuthorize` + owner/admin
+      check, audit log, cross-user security tests (cs2)
+- [x] `ListDiscoverableKBs` response normalization — use `toKBResponse()`,
+      shape assertion test (cs3)
+- [x] Dead code removal: `ListGlobal`/`ListForTeam` on KnowledgeBaseStore —
+      interface + PG + SQLite (cs4)
+- [x] Move `CreateKB` team role check from raw `database.DB.QueryRow` to
+      `stores.Teams.IsTeamAdmin`; remove `database` import (cs4)
+- [x] Team-scoped KB creation test: member denied, team admin succeeds (cs4)
+
 ### v0.28.3 — Security Tier (ICD Runner Red Team)
 New `security` tier in ICD test runner. Multi-user fixtures already exist.