Added

• Grant-checked ask() on the knowledge plane: retrieves as the principal, grounds a host-supplied generate callback, returns citations (#5)
• Public createKnowledgePlane export for out-of-band capture and search without mounting HTTP routes (#8)

Fixed

• Fail-closed document ACL: withhold hits whose acl_block is unreadable or non-string (#9)
• Timeline titles use the same document ACL post-filter as search (#12)
• Return 401 (not 500) when the host has not resolved a principal (#7)
• ACL wiring tests mock sql.unsafe for FTS verification so the suite stays green under the search path