refactor: extract kb_framework package, build graph in memory

Scripts become thin CLIs over kb_framework (graph, query, query_tools,
vault, instructions) so the hosted read-only connector shares one
implementation with the stdio server. The MCP server builds the graph
from Markdown on demand and invalidates it on writes; refresh_graph
rebuilds in memory and reports validation problems. Pre-commit hook
validates only; index/graph.json is no longer read, written or staged
(generate-graph.py --write remains for operators). Golden fixtures pin
graph and tool payloads to the previous output. Agent and skill docs
updated to match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

agents/the-knowing-one.md

@@ -21,7 +21,7 @@ external URLs that notes cite — never to reach the vault itself.
 
 The vault is a personal docs-as-code knowledge database,
 organized with the PARA method. Markdown notes are the source of
-truth; a generated graph index navigates them. You access both exclusively
+truth; a graph built from them in memory navigates them. You access both exclusively
 through MCP.
 
 ## MCP tools
@@ -35,7 +35,7 @@ through MCP.
 - `graph_neighbors` — outbound + inbound links for a node id, each with its edge
   `type` + `annotation` (traverse the graph).
 - `read_note` — the actual Markdown of a note; the ANSWER lives here, not in the index.
-- `refresh_graph` — regenerate the graph index if it looks stale (read-only; changes no Markdown).
+- `refresh_graph` — rebuild the in-memory graph if it looks stale (read-only; changes no Markdown).
 
 ## Mandate
 

agents/the-scribe.md

@@ -1,6 +1,6 @@
 ---
 name: the-scribe
-description: MCP-only resource ingestor for the knowledge-base vault (PARA-organized). Hand it a URL, a local file path, or a PDF and it runs the `knowledge-base-ingest-resource` pipeline entirely through the `knowledge-database` MCP server — captures the original bytes (text or binary) into `raw/`, writes the resource note and one note per topic, wires typed markdown links, regenerates + validates the graph, then commits the named paths and pushes. Has no shell. Use when the user says "ingest", "add this resource", or "save this link/paper" and wants the result written and published.
+description: MCP-only resource ingestor for the knowledge-base vault (PARA-organized). Hand it a URL, a local file path, or a PDF and it runs the `knowledge-base-ingest-resource` pipeline entirely through the `knowledge-database` MCP server — captures the original bytes (text or binary) into `raw/`, writes the resource note and one note per topic, wires typed markdown links, rebuilds + validates the graph, then commits the named paths and pushes. Has no shell. Use when the user says "ingest", "add this resource", or "save this link/paper" and wants the result written and published.
 tools: Read, WebFetch, Skill, mcp__knowledge-database__*
 mcpServers:
   - knowledge-database
@@ -44,7 +44,7 @@ Write:
 - `edit_note(path, old_string, new_string, replace_all?)` — exact-string edit,
   for backlinks into notes that already exist.
 
-- `refresh_graph(validate=true)` — regenerate and validate `index/graph.json`.
+- `refresh_graph(validate=true)` — rebuild the in-memory graph and validate it; `problems` lists what to fix.
 
 Publish only when the caller explicitly authorizes it:
 - `git_commit(message, paths[])` — stage the named paths and commit.
@@ -90,12 +90,12 @@ do not translate missing operations into shell commands.
   `type` is from the controlled vocabulary — `related, supersedes,
   superseded-by, depends-on, part-of, parent, derived-from, see-also, source`.
   Legacy `[[wiki links]]` fail validation.
-- **Never write the graph.** `index/graph.json` is derived; `write_note` refuses
-  it. Use `refresh_graph`. Fix every unresolved link until validation is clean —
-  the pre-commit hook rejects a stale or invalid graph.
+- **Never write a graph file.** The graph is derived in memory; `write_note`
+  refuses `index/graph.json`. Use `refresh_graph`. Fix every unresolved link until
+  validation is clean — the pre-commit hook rejects an invalid graph.
 - **Name every path you commit.** `git_commit` takes an explicit list; wildcard
-  staging is rejected by the server. Include the resource folder, every
-  backlinked note, and `index/graph.json`.
+  staging is rejected by the server. Include the resource folder and every
+  backlinked note; there is no graph file to commit.
 - **Follow the caller's publishing instructions.** Do not commit or push unless
   explicitly authorized. Use the selected vault's branch and review policy;
   do not assume a branch name or a direct-push workflow. Without publishing