Privacy-safe cross-meeting graph rebuild (graph tools deferred from the trust landing)

[silverstein]

Context

The conversation-trust privacy landing (Slice A + B) ships restricted-meeting policy, egress controls, audit, and PARA. The cross-meeting relationship graph (minutes-graph skill + the entity/knowledge graph) is deferred and ships fail-closed / temporarily unavailable in that landing, pending a privacy-safe rebuild tracked here.

Why deferred

The pre-trust graph used a durable on-disk index (graph.db / search JSON) that, under review, had real privacy and robustness problems that made shipping it as-is a violation of the trust promise, and rebuilding it privacy-safe generated finding after finding (it's the graph analog of the recovery/watcher tar-pit deferred in #510):

• The minutes-graph skill scanned all markdown with no sensitivity parsing and wrote restricted names/topics/dates to a world-readable (0644) durable index.
• "In-memory" SQLite could still spill restricted content to disk (temp_store not enforced everywhere).
• Unbounded corpus-derived names → quadratic Levenshtein DoS past the request deadline.
• Legacy search.db/graph.db/WAL/SHM not retired on upgrade; blocking cross-process retirement locks.
• Quadratic attendee-cardinality normalization, cross-process graph heap/admission, correction hard-link/owner isolation.

Rather than block the whole privacy landing on this or ship the leaky index, the graph tools are made honestly unavailable until a dedicated rebuild.

Rebuild requirements (the follow-up)

• True in-memory only — temp_store=memory enforced + asserted on every connection; no disk spill.
• Sensitivity-aware — restricted meetings excluded/redacted; no restricted content in any durable artifact; missing/malformed frontmatter treated as restricted (fail-closed).
• Bounded — one absolute request deadline + cumulative corpus/path/item/entity/correction/SQL/clustering budgets across retries and re-attestation; field caps; threshold-bounded banded edit distance (no unbounded Levenshtein).
• Nonblocking legacy-cache retirement — capability-bound, zeroed for open holders, best-effort at startup + fail-closed at answer time; no indefinite cross-process lock.
• Process-global heap/admission accounting for the in-memory projection.
• Correction/alias machinery rebuilt under the same bounds and policy.

Until then

minutes-graph and the graph/entity tools return a clear "temporarily unavailable — being rebuilt privacy-safe" response (fail-closed), not stale/leaky results. Cross-meeting entity queries are unavailable in the trust landing; single-meeting and ordinary restricted-aware search/egress are unaffected.