refactor: extract kb_framework package, build graph in memory

Scripts become thin CLIs over kb_framework (graph, query, query_tools,
vault, instructions) so the hosted read-only connector shares one
implementation with the stdio server. The MCP server builds the graph
from Markdown on demand and invalidates it on writes; refresh_graph
rebuilds in memory and reports validation problems. Pre-commit hook
validates only; index/graph.json is no longer read, written or staged
(generate-graph.py --write remains for operators). Golden fixtures pin
graph and tool payloads to the previous output. Agent and skill docs
updated to match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -24,7 +24,7 @@ writing notes.
 02_areas/       ongoing responsibilities & standards (policies, value streams, decisions)
 03_resources/   reference material (repo info, ingested externals)
 04_archives/    inactive items moved out of the three live categories
-index/          generated graph (index/graph.json)
+kb_framework/   importable core: in-memory graph build, queries, note access policy
 scripts/        graph generator, link inventory, MCP server, git hook
 agents/         subagent definitions, symlinked into .claude/agents/
 skills/         skill definitions, symlinked into .claude/skills/
@@ -37,10 +37,10 @@ folder with an `index.md`.
 ## Bootstrap
 
 ```sh
-make install-hooks           # pre-commit hook: regenerate + validate the graph
+make install-hooks           # pre-commit hook: validate the graph (nothing written)
 make install-global-claude   # link skills & agents into ~/.claude so any repo can use them
 make install-mcp-claude      # register scripts/mcp-server.py as the knowledge-database MCP server
-make graph                   # generate index/graph.json and validate it
+make graph                   # validate the graph (built in memory); `make generate-graph` writes index/graph.json
 make test                    # run the tooling tests
 ```
 
@@ -66,13 +66,15 @@ make -C /path/to/framework install-mcp-claude VAULT_ROOT=/path/to/vault
 The hook installer honors Git's hooks directory (including worktrees and
 `core.hooksPath`), preserves unmanaged hooks, and writes a wrapper pointing at
 framework tooling. Reinstall after moving the framework or vault. The hook
-regenerates and validates the selected vault, then rejects unstaged graph changes.
+validates the selected vault's graph in memory; it writes nothing and never
+requires a staged `index/graph.json`.
 
 Configure each stdio MCP client with command `python3` and arguments
 `["/path/to/framework/scripts/mcp-server.py", "--vault-root", "/path/to/vault"]`.
-MCP reads, writes and Git operations use that vault; `refresh_graph` invokes
-the framework generator by absolute path and writes the selected graph even
-when validation is requested. A README resource is advertised only if present.
+MCP reads, writes and Git operations use that vault. The graph is built in
+memory on first use and rebuilt after every write; `refresh_graph` rebuilds it
+on demand and, with `validate=true`, applies the commit gate. No graph file is
+read or written. A README resource is advertised only if present.
 
 Global skill and agent symlinks must point into this framework. MCP is their
 only interface for vault access; unavailable operations are reported without
@@ -87,18 +89,18 @@ tools/list, graph_summary, search, read and refresh. Only remove old tool copies
 after this passes. On failure restore the configs and symlinks and retain the
 old copies. Restart existing clients to load the new server command.
 
-A minimal data repository contains `01_projects/` through `04_archives/`,
-`index/graph.json` and repository hygiene. Before removing a root hub, replace
+A minimal data repository contains `01_projects/` through `04_archives/`
+and repository hygiene; `index/` is not committed. Before removing a root hub, replace
 its inbound links with links between PARA hubs and validate the graph. Preserve
 untracked files separately from the tracked-file cleanup.
 
 ## Generation
-- Run `make graph`
-- Output is written to `index/graph.json`
+- The graph is derived in memory by `kb_framework.graph.build_graph`; run `make graph` to validate it
+- `make generate-graph` writes `index/graph.json` for operators who want a file; keep `index/` out of git
 
 ## Rules
 - Markdown is the source of truth
-- `index/graph.json` is derived and generated
+- The graph is derived; never hand-edit or commit a graph dump
 - Keep notes linked using typed markdown links: `[text](note-id){"type":"…"}` (legacy `[[wiki links]]` are rejected by `make validate-graph`)
 - Organize by PARA actionability; move notes between buckets as that changes
 - Fix broken links — find them with `make graph` or `make validate-graph`