Integrate KnowKat sources with governed identity and attributed export

[witbrock]

Outcome

Von can consult operator-configured public KnowKat ontology packages and adopt selected concepts through its governed services without losing source identity or licence attribution. Adds five thin standard-MCP reads and a read-only adoption proposal; source RDF stays quoted evidence, while local interpretation and relations remain separately labelled. This completes the Von side of KKAT-6 and KKAT-25 alongside https://github.com/Strong-AI-Lab/knowkat/pull/4.

Canonical probing exposed two blocking gaps: the governed create wrapper rejected the external identity supported by its underlying service, and normal concept export omitted canonical text. A single external identity is now resolved and bound into exact create intent/delegation, checked on canonical postcondition and read-only reuse. Existing complex-effect restrictions remain. Export includes complete actor-visible canonical text relations, so identity markers, source notices and transformation records survive.

Evidence and release decision

Ready for merge after required CI. The bounded implementation is supported by the exact source/adoption path and authority controls; no live deployment is included.

• Actual full OpenCyc MCP calls through Von: inventory, bicycle/maintenance/action searches, both source concepts, pagination and neighbourhood retrieval.
• Isolated canonical persistence: adopted bicycle and changing a bicycle tyre, repeated both with identity reuse, created a separately labelled local bicycle-maintenance concept and relation, then verified canonical receipts/read-back and attribution-preserving normal export.
• Exact same-turn agent delegation issuance and use; changed-identity rejection; no-delegation/global-scope denial; unverified ID collision denial; missing identity markers prevent a successful postcondition; homonyms remain distinct; another actor cannot export private adoption records.
• Final targeted regression run includes 193 passing tests, including the configured real-source acceptance. Python minimum syntax and PDM lock checks pass. No model call or live Vontology write is used in this deterministic integration acceptance.

The persistence fixture uses Mongo-compatible storage and real production authority/create/text/relation/export services. Only unsupported MongoDB $text candidate acquisition is emulated with exact substring matching. This does not claim a live Atlas adoption or live runtime activation.

Scope and configuration

Set VON_KNOWKAT_COMMAND_JSON to an operator-selected executable argument vector and VON_KNOWKAT_PUBLIC=true only for deliberately public packages. No model-supplied commands, package paths, policy overrides or private-owner identity ceremony. Missing configuration/upstream failure is explicit. The adapter reuses MCPStdIOClient and carries provenance, bounds and cursors unchanged.

Existing represented KR materialisation guidance is referenced, not duplicated or activated. No automatic taxonomy import, global truth promotion, reasoner, native KB decoding, private collection sharing or whole-ontology export activation. Legacy bulk export remains disabled; import round-trip support for exported text rows is not claimed. See docs/engineering/knowkat_ontology_sources.md for setup and the exact acceptance boundaries.