Grav publisher: perf intel to performance.knownelement.com (#826)

Grav (Cloudron app 8336f951, org-SSO-gated) installed at
performance.knownelement.com; tools/grav-publish.sh pushes the home
dashboard (ERCOT risk + arbitrage verdict + baseline index) and report
pages as markdown via ssh->docker exec, then clears cache. Idempotent,
cron-safe. First publish verified live.

https://projects.knownelement.com/issues/826#note-11

tools/grav-publish.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# KNELPerf -> Grav publisher — pushes perf intel to performance.knownelement.com.
+#
+# Grav (Cloudron app 8336f951) pages are markdown files; we write them
+# directly via ssh -> docker exec into /app/data/user/pages/, then clear
+# cache. Auth to the SITE is Cloudron SSO (org-restricted); publishing is
+# file-based, no web login needed.
+#
+# What gets published (idempotent, safe to run from cron/automation):
+#   performance/            home dashboard (latest risk brief + arbitrage
+#                           verdict + baseline index + fleet table)
+#   performance/reports/*   the three repo reports (AMT, desktop, scheduler)
+#   performance/baselines/  per-host latest baseline summary tables
+# Env: GRAV_APP_ID (default below), GRAV_HOST (ssh host, default VPS tailnet)
+set -euo pipefail
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+SOLAR_REPO=${SOLAR_REPO:-$HOME/projects/KNEL/PhysicalPlant/SITER-Solar}
+GRAV_APP_ID=${GRAV_APP_ID:-8336f951-31b4-4e8c-9499-98e357d51f8a}
+GRAV_HOST=${GRAV_HOST:-100.107.35.78}
+PAGES=performance
+
+grav_write() { # local-file remote-relative-path
+  local b64
+  b64=$(base64 -w0 < "$1")
+  timeout 60 ssh "root@$GRAV_HOST" "docker exec $GRAV_APP_ID sh -c 'mkdir -p /app/data/user/pages/$(dirname "$2"); echo $b64 | base64 -d > /app/data/user/pages/$2'"
+}
+
+fm() { printf -- '---\ntitle: %s\nvisibility: private\n---\n\n' "$1"; }
+
+# ---------- home dashboard ----------
+DASH=$(mktemp)
+{
+  fm "Performance Hub"
+  echo "# ⚡ KNEL Performance Hub"
+  echo
+  echo "Auto-published $(date -Is) from KNELPerf (#826). Repo:"
+  echo "https://git.knownelement.com/KNEL/KNELPerf"
+  echo
+  echo "## ⚡ ERCOT risk (LZ_SOUTH)"
+  echo '```json'
+  if [ -x "$SOLAR_REPO/solar-analysis/ercot-brief.sh" ]; then
+    "$SOLAR_REPO/solar-analysis/ercot-brief.sh" 2>/dev/null \
+      || tail -1 /var/tmp/ercot-brief-history.tsv 2>/dev/null \
+      || echo '{"error":"no source yet (API key pending)"}'
+  else
+    tail -1 /var/tmp/ercot-brief-history.tsv 2>/dev/null || echo '{"error":"no data yet"}'
+  fi
+  echo '```'
+  echo
+  echo "## 🌤️ Solar arbitrage verdict (latest run)"
+  if [ -x "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" ]; then
+    echo '```json'
+    "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" 2>/dev/null || echo '{"error":"source unavailable"}'
+    echo '```'
+  fi
+  echo
+  echo "## 📋 Baseline index"
+  echo
+  echo "| host | latest bundle |"
+  echo "|---|---|"
+  found=0
+  for d in "$REPO_ROOT"/data/baselines/*/; do
+    [ -d "$d" ] || continue
+    h=$(basename "$d"); l=$(find "$d" -maxdepth 1 -mindepth 1 -type d -printf '%f\n' 2>/dev/null | sort | tail -1)
+    if [ -n "$l" ]; then echo "| $h | $l |"; found=1; fi
+  done
+  [ "$found" = 1 ] || echo "| (none yet — first fleet baseline wave pending) | |"
+} > "$DASH"
+grav_write "$DASH" "$PAGES/page.md"; rm -f "$DASH"
+
+# ---------- reports ----------
+i=0
+for report in report-amt-power-telemetry report-moonlight-desktop; do
+  i=$((i+1)); R=$(mktemp)
+  { fm "$report"; sed -n '/^# /,$p' "$REPO_ROOT/docs/$report.md"; } > "$R"
+  grav_write "$R" "$PAGES/reports/$report.md"; rm -f "$R"
+done
+
+# ---------- clear cache so changes appear ----------
+timeout 60 ssh "root@$GRAV_HOST" "docker exec $GRAV_APP_ID /app/code/bin/grav clear-cache" >/dev/null 2>&1 || true
+echo "published to https://performance.knownelement.com ($(date -Is))"