Add DKG arXiv

[TomazOT]

What this PR does

Adds dkg-arxiv as a new community integration. Source-side integration that ingests arXiv papers into a Project's Working Memory as Knowledge Assets, with full provenance, status tags, and preserved upstream licence.

Integration links

• Repo: https://github.com/TomazOT/arxiv-dkg-integration
• Commit pinned: f3db3beb755c590a0ad63568de578fff72e990e4
• Published package: dkg-arxiv@0.1.0 (publish pending; see committee notes)
• Design brief: https://github.com/TomazOT/arxiv-dkg-integration/blob/f3db3beb755c590a0ad63568de578fff72e990e4/docs/DESIGN.md
• Demo: https://github.com/TomazOT/arxiv-dkg-integration#first-run-5-minutes-via-ui

Scope & faithfulness

• Integration uses only the supported public interfaces (HTTP API, dkg CLI, MCP). It does not import internal DKG packages, patch node source, or write to SPARQL directly (bypassing the assertion lifecycle / Curator).
• memoryLayers correctly reflects which layer(s) the integration touches.
• v10PrimitivesUsed correctly reflects which primitives are exercised.
• Terminology matches the v10 vocabulary (Context Graph, Sub-graph, Assertion, Knowledge Asset, Knowledge Collection, Curator, Entity, WM/SWM/VM).

Security declarations (Section 8a)

• security.networkEgress lists every external host the integration contacts beyond the local DKG node.
• security.writeAuthority lists every DKG write operation the integration performs. Curator-authority ops (PUBLISH, SHARE, endorse, verify) are called out explicitly if used.
• security.credentialsHandled lists every third-party credential the installer will prompt for.
• The published package has no preinstall / install / postinstall scripts, or the exceptions are explained in security.notes.
• The package is published with build provenance (npm publish --provenance) when applicable.
• The pinned git SHA is the exact commit the published package was built from.

Contributor attestation

• This integration is my own work or properly licensed.
• It contains no intentional backdoors, malicious logic, or data-exfiltration paths beyond what is declared in security.networkEgress.
• I understand that the integration may be delisted for any material misrepresentation in the registry entry.
• I commit to a minimum 6-month maintenance window post-acceptance (bounty submissions).

Notes for the committee

Publish status. The dkg-arxiv package on npm has not been published at the time of this PR. The plan is to publish dkg-arxiv@0.1.0 from the pinned commit f3db3beb755c590a0ad63568de578fff72e990e4 immediately after this PR opens, using the repo's .github/workflows/publish.yml GitHub Actions workflow (npm publish --provenance under id-token: write). Once the publish lands, the two unchecked Security-declaration items above become true and CI's security-checks.mjs step will go from red to green on the next run.

Round 1 scope. Working Memory only; no PUBLISH to Verified Memory. SHARE is performed by the user's existing agent through its own adapter (e.g. adapter-openclaw), not by this integration. The integration deliberately ships no agent-side wiring.

Demo. Reproducible end-to-end against any local v10 daemon. The integration's README walks through the "First run (5 minutes via UI)" flow via dkg-arxiv ui serve (search → select → ingest), and the same flow is exercisable from the CLI directly. No recorded video at submission time.

Bounty round tag. cfi-dkgv10-r1.

Maintenance commitment. 5-business-day issue-triage SLA, 6-month minimum support window. Issue tracker: the integration's own GitHub repo.

[TomazOT]

Publish confirmation. dkg-arxiv@0.1.0 is live on npm: https://www.npmjs.com/package/dkg-arxiv (tarball: https://registry.npmjs.org/dkg-arxiv/-/dkg-arxiv-0.1.0.tgz).

Published from the pinned commit f3db3beb755c590a0ad63568de578fff72e990e4, so the "pinned SHA is the exact commit the published package was built from" attestation in the original PR description now holds. Provenance was not enabled for v0.1.0; the publish workflow at .github/workflows/publish.yml is configured to use npm publish --provenance (with id-token: write) for subsequent releases once an NPM_TOKEN repo secret is added.

scripts/security-checks.mjs already passed in the initial CI run; happy to push an empty commit to re-trigger it now that the package is live, if helpful.