Add operator-subset knowledge base wiring for Netx Ops P1.

Locate and validate MANIFEST under kbRoot, show anti-mixup status in settings, and inject KB_* env plus kb-context so sessions degrade to pure netx when unset.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/INSTALL.md

@@ -42,7 +42,8 @@ One command, three **direct** profile bundles. Do **not** nest IM/cron under net
    Token fallback: `scripts/set-netx-token.ps1` / `.sh`.  
    Optional: enable **关键告警推送** so this DSH dials `ws(s)://<apiUrl>/v1/integrations/dsh-alarm/ws`. Choose **投递到 DSH 会话** and/or **投递到 WhatsApp / IM**. For IM, install `dsh-im-ops`, create a delivery target, then paste `imBotId` / `imTargetId`. The card header shows live WSS status.  
    Optional: **导出全部会话** downloads `dsh-sessions-<host>-<utc>.zip` via `GET /api/netxops.sessions.export` (browser download; works for cloud Hosts).  
-   Capability groups: leave default for **ops**, or enable **topology** / **对其他预设公开** (new sessions after save).
+   Capability groups: leave default for **ops**, or enable **topology** / **对其他预设公开** (new sessions after save).  
+   Optional: **知识库** — set package root (folder with `MANIFEST.json` operator-subset v1.0). Empty = pure netx. See [KNOWLEDGE_BASE.md](KNOWLEDGE_BASE.md).
 2. Restart or open Settings → **Agent presets** → Custom → **Netx Ops** should appear after the host plugin has activated once.
 3. **New session → preset Netx Ops** → ask e.g. Critical Top / single-host alarms / 「能否登录」.
 
@@ -67,8 +68,9 @@ One command, three **direct** profile bundles. Do **not** nest IM/cron under net
 3. Agent presets → Custom → **Netx Ops**.
 4. Tools include `netx__queryNmsAlarms` / `netx__execManagedNe` / `netx__findTopologyPaths` (**ops** → skill `netx-ops`). Canvas / dual_unit need **topology** (`netx-topology`).
 5. Export section shows a session count; **下载 ZIP** starts a browser download.
+6. Optional knowledge-base badge shows operator/country/version when `kbRoot` + MANIFEST are valid.
 
-See [TOOL_MAP.md](TOOL_MAP.md).
+See [TOOL_MAP.md](TOOL_MAP.md) and [KNOWLEDGE_BASE.md](KNOWLEDGE_BASE.md).
 
 ## Path / local checkout (developers)
 

docs/KNOWLEDGE_BASE.md

@@ -0,0 +1,44 @@
+# Knowledge base (P1)
+
+Operator-subset knowledge packages are wired through **netxops settings**, not into the netx API or `netx-ops` skill text.
+
+## Setup
+
+1. Settings → Plugins → **Netx Ops** → **知识库 / Knowledge base**
+2. Set **知识包根目录** to a folder that contains (or uniquely nests ≤3 levels) a `MANIFEST.json`
+3. Save — Host injects env + a `kb-context` skill for new sessions
+
+Browse uses Host `remote.directoryPicker` when available; otherwise paste an absolute path.
+
+## MANIFEST v1.0 (plugin checks)
+
+| Field | Rule |
+|-------|------|
+| `schemaVersion` | must be `"1.0"` |
+| `packageType` | must be `"operator-subset"` |
+| `operator.name` / `operator.country` | required non-empty strings |
+| `version` | required non-empty string |
+| `content.*` | object of booleans; missing keys → `false` (`regions` / `theory` / `packet` / `skills` known) |
+
+Location: `${kbRoot}/MANIFEST.json`, else recurse ≤3 levels and **exactly one** hit. Zero or multiple → error.
+
+Authoritative packaging prose lives in the workspace contract notes (`插件` / `契约`); this doc only describes what the plugin enforces.
+
+## Injected context
+
+| Channel | Fields |
+|---------|--------|
+| `process.env` | `KB_ROOT`, `KB_OPERATOR`, `KB_COUNTRY`, `KB_VERSION`, `KB_CONTENT` (JSON), `KB_STATUS` |
+| Skill `kb-context` | Same identity for the model (markdown table) |
+
+RPC (channel `/netxops`): `kb.status` (saved snapshot), `kb.resolve` with `{ path }` (preview unsaved paths).
+
+## Degradation matrix
+
+| Condition | `KB_STATUS` | Behavior |
+|-----------|-------------|----------|
+| Empty `kbRoot` | `unconfigured` | Pure netx; skill says do not invent an operator |
+| Missing / ambiguous / invalid MANIFEST | `error` | Pure netx; badge shows error detail |
+| Valid MANIFEST | `configured` | Paths + operator identity available |
+
+**Never** invent an operator when status is not `configured`. P2 knowledge-base skill packs (case search, etc.) are out of scope for this release.