Publisher re-architecture: push-to-repo, site pulls (founder ruling) (#826)

grav-publish.sh now renders into KNEL/KNELPerfHub (AGPLv3) and pushes;
the Cloudron VPS ukrrs-hub-pull.timer git-pulls into the Grav pages dir
every 5 min (safe.directory fix); Grav cache.check=file auto-refreshes.
NO server-side tooling runs in the Grav container anymore. Verified
end-to-end live.

https://projects.knownelement.com/issues/826#note-13

tools/grav-publish.sh

@@ -1,29 +1,19 @@
 #!/usr/bin/env bash
-# KNELPerf -> Grav publisher — pushes perf intel to performance.knownelement.com.
+# KNELPerf -> KNELPerfHub publisher.
 #
-# Grav (Cloudron app 8336f951) pages are markdown files; we write them
+# Architecture ruling (founder, 2026-09-06): NO server-side tooling runs in
-# directly via ssh -> docker exec into /app/data/user/pages/, then clear
+# the Grav container. This script renders pages as markdown into the
-# cache. Auth to the SITE is Cloudron SSO (org-restricted); publishing is
+# KNELPerfHub git repo and PUSHES; the Cloudron VPS's ukrrs-hub-pull.timer
-# file-based, no web login needed.
+# git-pulls that repo into the Grav pages dir every 5 min (Grav
+# cache.check=file picks changes up). Scraping/collectors run on the
+# tooling hosts, not in the app container.
 #
-# What gets published (idempotent, safe to run from cron/automation):
+# Env: HUB_REPO (default below), SOLAR_REPO.
-#   performance/            home dashboard (latest risk brief + arbitrage
-#                           verdict + baseline index + fleet table)
-#   performance/reports/*   the three repo reports (AMT, desktop, scheduler)
-#   performance/baselines/  per-host latest baseline summary tables
-# Env: GRAV_APP_ID (default below), GRAV_HOST (ssh host, default VPS tailnet)
 set -euo pipefail
 REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+HUB_REPO=${HUB_REPO:-$HOME/projects/KNEL/KNELPerfHub}
 SOLAR_REPO=${SOLAR_REPO:-$HOME/projects/KNEL/PhysicalPlant/SITER-Solar}
-GRAV_APP_ID=${GRAV_APP_ID:-8336f951-31b4-4e8c-9499-98e357d51f8a}
+PAGES=$HUB_REPO/performance
-GRAV_HOST=${GRAV_HOST:-100.107.35.78}
-PAGES=performance
-
-grav_write() { # local-file remote-relative-path
-  local b64
-  b64=$(base64 -w0 < "$1")
-  timeout 60 ssh "root@$GRAV_HOST" "docker exec $GRAV_APP_ID sh -c 'mkdir -p /app/data/user/pages/$(dirname "$2"); echo $b64 | base64 -d > /app/data/user/pages/$2'"
-}
 
 fm() { printf -- '---\ntitle: %s\nvisibility: private\n---\n\n' "$1"; }
 
@@ -66,16 +56,25 @@ DASH=$(mktemp)
   done
   [ "$found" = 1 ] || echo "| (none yet — first fleet baseline wave pending) | |"
 } > "$DASH"
-grav_write "$DASH" "$PAGES/page.md"; rm -f "$DASH"
+mkdir -p "$PAGES"
+mv "$DASH" "$PAGES/page.md"
 
 # ---------- reports ----------
-i=0
 for report in report-amt-power-telemetry report-moonlight-desktop; do
-  i=$((i+1)); R=$(mktemp)
+  R=$(mktemp)
   { fm "$report"; sed -n '/^# /,$p' "$REPO_ROOT/docs/$report.md"; } > "$R"
-  grav_write "$R" "$PAGES/reports/$report.md"; rm -f "$R"
+  mkdir -p "$PAGES/reports"; mv "$R" "$PAGES/reports/$report.md"
 done
 
-# ---------- clear cache so changes appear ----------
+# ---------- push ----------
-timeout 60 ssh "root@$GRAV_HOST" "docker exec $GRAV_APP_ID /app/code/bin/grav clear-cache" >/dev/null 2>&1 || true
+cd "$HUB_REPO"
-echo "published to https://performance.knownelement.com ($(date -Is))"
+if [ -n "$(git status --porcelain)" ]; then
+  git add performance
+  git commit -q -m "Auto-publish $(date +%F_%H:%M) (#826)
+
+https://projects.knownelement.com/issues/826"
+  git push -q origin main
+  echo "pushed to KNEL/KNELPerfHub ($(date -Is)); site refreshes within 5 min"
+else
+  echo "no changes to publish ($(date -Is))"
+fi