knowledge: refresh OKF catalog — activate network-flows claims (#39)

[Svaag]

What

First full hyrule-knowledge ingest since 2026-07-03 — the catalog-refresh step
tracked in #39. Re-projects every source repo so the network-flows enrichment
merged in #38 (net-ops#430's host_meta + network_flows.yml) lands in the
shipped concepts and exports/knowledge.sqlite.

Activation confirmed — previously these returned 0 rows:

$ hyrule-knowledge claims --predicate allows_port --object 22 --authority-min A0   # → api, dns, mon, …
$ hyrule-knowledge firewall --port 9100                                            # → mon → api/… :9100 rows

Host concepts now carry os/role/network_flows frontmatter and resolved
allows_from / connects_to claims; the four knowledge_* MCP tools return
real data.

Scope / review notes

• Cross-repo drift is expected (Activate network-flows OKF claims via a catalog ingest after #38 merges #39 action item 2). 8 days of source
  movement: ~177 hyrule-cloud API-endpoint concepts re-pinned to new
  line-anchored ids, source-docs, GitHub issues, and okf/curated source_ref
  SHAs advanced to HEAD. okf/curated bodies are unchanged — only pinned
  source SHAs.
• A4 enrichment tranche restored unchanged. ingest's reset_generated
  wipes okf/generated/enriched/* (regenerated only by the separate enrich
  workflow), so enriched/{services,infrastructure}.md are checked back out
  from main rather than dropped.
• Golden fixtures retargeted (2nd commit) to the moved concept ids /
  bumped deploy-SHA pins — verified against the refreshed catalog, no
  behavioural change.

Gates (all green locally)

ruff · mypy --strict · pytest (175) · validate okf · quality --check
· export --check · eval --check · ledger --check · ledger lifecycle --check · scan-secrets.

Closes #39.

🤖 Generated with Claude Code

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🏅 Score: 95

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.

[chatgpt-codex-connector]

💡 Codex Review

https://github.com/AS215932/knowledge/blob/bfe7e4e32c5e872e452cf5f84ab418c4c729f3ea/exports/claims.jsonl#L1169
Cite cross-cutting flow ports from network_flows

For A0 flow queries against dns inbound port 22, this claim points at host_vars/dns.yml, but the generated host record shows the port 22 entries are origin: cross-cutting from network_flows.yml while the host-vars firewall section only contains ports 53 and 9100. Consumers of knowledge.firewall_rules/claim exports will be sent to the wrong source of truth for SSH access, which breaks the repo's provenance contract; these cross-cutting-only port/proto claims should cite source ref 3 / ansible/inventory/network_flows.yml instead.

---

knowledge/evals/cases/retrieval/01-retrieval-001-vm-create-endpoint.yml

Line 11 in bfe7e4e

- generated/api/hyrule-cloud/hyrule-cloud-post-v1-vm-create-hyrule-cloud-api-routes-py-763

Regenerate exported eval artifacts with new endpoint id

This eval case now expects the renamed ...routes-py-763 concept, but the checked-in generated eval artifacts still contain ...routes-py-671 in exports/eval-cases.jsonl, reports/eval-cases.jsonl, and the recorded eval results. Consumers that read the exported baselines or reports will see passing results for a concept id that no longer exists in the refreshed catalog, so the eval exports need to be regenerated with the same ref as the source case.

---

knowledge/okf/generated/workflows/network-operations/github-workflows-post-merge-apply-yml.md

Line 48 in bfe7e4e

* `env`

Do not record secrets.env as a GitHub secret

This new workflow summary records a secret named env, but the cited source workflow is sourcing the runner-local file /etc/github-runner/secrets.env, not referencing a GitHub Actions secret ${{ secrets.env }}. That also emits a uses_secret_name=env claim in the exports, creating a false credential dependency for secret inventory and policy consumers; the extractor should avoid matching secrets.env file paths as secret-context references.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".