Activate network-flows OKF claims via a catalog ingest after #38 merges

[Svaag]

Context

knowledge#38 ships the code to project AS215932 network flows into queryable
OKF claims (allows_from/connects_to/allows_port/runs_os/…) plus the
hyrule-knowledge firewall / servers CLI and the four knowledge_* MCP
tools. However, the committed okf/generated host concepts predate the flow
enrichment — they carry no network_flows / host_meta frontmatter (last
regenerated 2026-07-03, before net-ops#430 merged). Because the CLI/MCP query
layer reads only the shipped exports/knowledge.sqlite, the new predicates
have 0 rows in the committed DB, so hyrule-knowledge firewall and the MCP
firewall tools return empty until the generated concepts + exports are
regenerated together (Codex flagged this on #38 as P1, comment 3564255612).

The feature-PR kept code separate from a full catalog refresh on purpose: a
hyrule-knowledge ingest re-clones every source repo and would drag ~8
days of unrelated cross-repo concept drift into what is otherwise a focused
code PR (violates our small/separate-commit discipline). The nightly
ingest.yml bot that would normally own this refresh has never merged to
main (no bot/knowledge-refresh commits; KNOWLEDGE_AUTO_MERGE defaults to
off), so the feature would otherwise sit dormant indefinitely.

Action items

1. After Queryable firewall/flow claims + cross-server query surface (CLI + MCP) #38 merges, run a catalog refresh from a clean checkout of main:
   uv run hyrule-knowledge ingest (clones all sources incl. net-ops#430's
   merged inventory), which regenerates okf/generated + exports/.
2. Review the diff — confirm the generated/infrastructure/hosts/* concepts now
   carry os/role/network_flows frontmatter and the flow sections, and that
   cross-repo drift from other sources is expected/acceptable.
3. Validate: uv run hyrule-knowledge validate okf && … export --check && … pytest, then open a dedicated catalog-refresh PR (isolated from code).
4. Spot-check activation:
   hyrule-knowledge claims --predicate allows_port --object 22 --authority-min A0
   lists SSH hosts; hyrule-knowledge firewall --port 9100 returns rows.
5. Decide whether to enable the ingest.yml schedule + KNOWLEDGE_AUTO_MERGE
   so future refreshes are automated instead of manual.

Related

• knowledge#38 (feature PR); Codex comment 3564255612
• net-ops#430 (merged inventory source: host_meta, network_flows.yml)
• .github/workflows/ingest.yml, .github/workflows/auto-merge.yml
• src/hyrule_knowledge/{extractors/ansible.py,builder.py,claims.py,firewall.py}

[Svaag]

Unblocked — #38 is merged.

knowledge#38 merged to main at 2026-07-11T13:52 (merge commit 51870da). The
feature code, policy gating, and CLI/MCP query surface are now on main, so the
precondition in Action item 1 is satisfied — the catalog refresh can run at any
time.

Status recap so this issue is self-contained:

• On main now: extractors/ansible.py, builder.py, claims.py,
  firewall.py (flow projection), the hyrule-knowledge firewall / servers
  CLI, the four knowledge_* MCP tools + their policy gating, and the
  default_policy() parity fix.
• Still dormant: the committed okf/generated concepts + exports/ predate
  the flow frontmatter, so hyrule-knowledge firewall / the MCP tools return 0
  rows until a refresh regenerates concepts + exports together.
• Deliberately deferred (owner's call): don't bundle the multi-repo
  ingest into the feature PR; run it as a standalone catalog-refresh PR when
  convenient. Action items 1–5 above are unchanged and ready to execute.

No code change outstanding on the feature itself — this issue tracks only the
one-time (or automated) catalog refresh that lights it up.