Publisher v3: full site IA (Home/Program/Fleet/Reports/Intel/Status/Transparency/About) + mechanical redaction (#826)

Financial literals redacted at render (LLC-private enforced by script);
reports as routable folder pages (Grav: bare .md in a folder is not
routable; git pathspec glob * crosses dirs - removed the git rm line
that unstaged its own output); sections visible:true; skeleton pages
dropped, home alias -> /performance. Site live public read-only.

https://projects.knownelement.com/issues/826#note-19

tools/grav-publish.sh

@@ -5,44 +5,118 @@
 # the Grav container. This script renders pages as markdown into the
 # KNELPerfHub git repo and PUSHES; the Cloudron VPS's ukrrs-hub-pull.timer
 # git-pulls that repo into the Grav pages dir every 5 min (Grav
-# cache.check=file picks changes up). Scraping/collectors run on the
+# cache.check=file picks changes up).
-# tooling hosts, not in the app container.
 #
-# Env: HUB_REPO (default below), SOLAR_REPO.
+# TRANSPARENCY RULE (mechanical): revenue/expense detail is LLC-private.
+# redact() strips financial literals from every public render — the
+# public/private line is enforced by script, not by authoring discipline.
+# The reports/ and content/ lists below are explicit whitelists.
 set -euo pipefail
 REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
 HUB_REPO=${HUB_REPO:-$HOME/projects/KNEL/KNELPerfHub}
 SOLAR_REPO=${SOLAR_REPO:-$HOME/projects/KNEL/PhysicalPlant/SITER-Solar}
 PAGES=$HUB_REPO/performance
 
-fm() { printf -- '---\ntitle: %s\nvisibility: private\n---\n\n' "$1"; }
+fm() { printf -- "---\ntitle: %s\nvisible: true\n---\n\n" "$1"; }
 
-# ---------- home dashboard ----------
+# Strip LLC-private financial literals (contract rates, project costs, bill
+# amounts). Keep methodology public; keep numbers private.
+# shellcheck disable=SC2016  # single-quoted sed programs intentionally contain $ literals
+redact() {
+  sed -e 's/\$0\.085[^ )]*/$[redacted — LLC-private]/g' \
+      -e 's/\$0\.040\|\$0\.04[ )/]/$[redacted — LLC-private]/g' \
+      -e 's/8\.5¢/[redacted]/g; s/4¢/[redacted]/g' \
+      -e 's/\$4,100/[redacted — LLC-private]/g' \
+      -e 's/\$301\.08\|\$264\.47\|\$3,967\.[0-9]*/[redacted — LLC-private]/g' \
+      -e 's/23,?95[0-9]\|22,?614[0-9]*/[redacted]/g'
+}
+
+# ---------- 01 Home ----------
 DASH=$(mktemp)
 {
   fm "Performance Hub"
   echo "# ⚡ KNEL Performance Hub"
   echo
-  echo "Auto-published $(date -Is) from KNELPerf (#826). Repo:"
+  echo "Live operational-performance intelligence for the Turnsys PFV fleet —"
-  echo "https://git.knownelement.com/KNEL/KNELPerf"
+  echo "published openly, updated automatically. Ultra-transparent by"
+  echo "default; [revenue and expense detail stays LLC-private]"
+  echo "(/performance/transparency)."
   echo
-  echo "## ⚡ ERCOT risk (LZ_SOUTH)"
+  echo "- **What we do**: [the program](/performance/program) — a continuous"
+  echo "  baseline → audit → tweak → re-baseline loop across a 9-node"
+  echo "  Proxmox fleet, scheduled around solar surplus and grid risk."
+  echo "- **The metal**: [fleet inventory](/performance/fleet)."
+  echo "- **Deep dives**: [reports](/performance/reports)."
+  echo "- **Methodology**: [grid-risk intel](/performance/intel/ercot-risk) ·"
+  echo "  [solar arbitrage](/performance/intel/solar-arbitrage)."
+  echo "- **Right now**: [status dashboard](/performance/status)."
+  echo
+  echo "## ⚡ ERCOT risk right now (LZ_SOUTH)"
   echo '```json'
   if [ -x "$SOLAR_REPO/solar-analysis/ercot-brief.sh" ]; then
     "$SOLAR_REPO/solar-analysis/ercot-brief.sh" 2>/dev/null \
       || tail -1 /var/tmp/ercot-brief-history.tsv 2>/dev/null \
-      || echo '{"error":"no source yet (API key pending)"}'
+      || echo '{"error":"price feed pending API key registration"}'
   else
     tail -1 /var/tmp/ercot-brief-history.tsv 2>/dev/null || echo '{"error":"no data yet"}'
   fi
   echo '```'
+} > "$DASH"
+mkdir -p "$PAGES"; mv "$DASH" "$PAGES/page.md"
+
+# ---------- 02 Program (architecture, redacted) ----------
+mkdir -p "$PAGES/program"
+fm "The Program" > "$PAGES/program/page.md"
+redact < "$REPO_ROOT/docs/ARCHITECTURE.md" >> "$PAGES/program/page.md"
+
+# ---------- 03 Fleet ----------
+mkdir -p "$PAGES/fleet"
+F=$(mktemp)
+{
+  fm "Fleet"
+  echo "# 🖥️ Fleet inventory"
+  echo
+  echo "Hardware transparency: every node serving this program, verified by"
+  echo "live dmidecode survey (2026-09-06). Capacity planning and margin"
+  echo "accounting run against this table."
+  echo
+  sed -n '/^| node |/,/^$/p' "$REPO_ROOT/docs/ARCHITECTURE.md" | head -n -1
+  echo
+  echo "Power telemetry per node: RAPL (tsys1/3/4/7/9) · iDRAC (tsys6/7) ·"
+  echo "metered PDU (tsys5) — methodology in the"
+  echo "[AMT report](/performance/reports/report-amt-power-telemetry)."
+} > "$F"; mv "$F" "$PAGES/fleet/page.md"
+
+# ---------- 04 Reports (whitelist) ----------
+mkdir -p "$PAGES/reports"
+for report in report-amt-power-telemetry report-moonlight-desktop; do
+  R=$(mktemp); { fm "$report"; redact < "$REPO_ROOT/docs/$report.md"; } > "$R"
+  mkdir -p "$PAGES/reports/$report"; mv "$R" "$PAGES/reports/$report/page.md"
+done
+
+# ---------- 05 Intel ----------
+mkdir -p "$PAGES/intel/ercot-risk" "$PAGES/intel/solar-arbitrage"
+fm "ERCOT Risk Intelligence" > "$PAGES/intel/ercot-risk/page.md"
+redact < "$SOLAR_REPO/docs/oncor-realtime-arbitrage.md" | sed -n '/^## Day-to-day/,$p' >> "$PAGES/intel/ercot-risk/page.md"
+fm "Solar Arbitrage" > "$PAGES/intel/solar-arbitrage/page.md"
+redact < "$SOLAR_REPO/docs/oncor-realtime-arbitrage.md" | sed -n '1,/^## Day-to-day/p' | head -n -1 >> "$PAGES/intel/solar-arbitrage/page.md"
+
+# ---------- 06 Status (auto dashboard) ----------
+mkdir -p "$PAGES/status"
+S=$(mktemp)
+{
+  fm "Status"
+  echo "# 📈 Status dashboard"
+  echo
+  echo "Auto-published $(date -Is) from KNELPerf. Source:"
+  echo "https://git.knownelement.com/KNEL/KNELPerf"
   echo
   echo "## 🌤️ Solar arbitrage verdict (latest run)"
-  if [ -x "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" ]; then
+  echo '```json'
-    echo '```json'
+  [ -x "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" ] \
-    "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" 2>/dev/null || echo '{"error":"source unavailable"}'
+    && "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" 2>/dev/null \
-    echo '```'
+    || echo '{"error":"source unavailable"}'
-  fi
+  echo '```'
   echo
   echo "## 📋 Baseline index"
   echo
@@ -55,21 +129,55 @@ DASH=$(mktemp)
     if [ -n "$l" ]; then echo "| $h | $l |"; found=1; fi
   done
   [ "$found" = 1 ] || echo "| (none yet — first fleet baseline wave pending) | |"
-} > "$DASH"
+} > "$S"; mv "$S" "$PAGES/status/page.md"
-mkdir -p "$PAGES"
-mv "$DASH" "$PAGES/page.md"
 
-# ---------- reports (WHITELIST: public content only — NEVER revenue/expense detail, see hub README transparency policy)
+# ---------- 07 Transparency ----------
-for report in report-amt-power-telemetry report-moonlight-desktop; do
+mkdir -p "$PAGES/transparency"
-  R=$(mktemp)
+fm "Transparency" > "$PAGES/transparency/page.md"
-  { fm "$report"; sed -n '/^# /,$p' "$REPO_ROOT/docs/$report.md"; } > "$R"
+cat >> "$PAGES/transparency/page.md" <<'EOF'
-  mkdir -p "$PAGES/reports"; mv "$R" "$PAGES/reports/$report.md"
+# 🔓 Transparency policy
-done
+
+We run an ultra-open and transparent organization. This site and its
+[content repo](https://git.knownelement.com/KNEL/KNELPerfHub) are **public
+read-only** — performance data, benchmarks, risk intelligence,
+architecture and decision reports are all in the open.
+
+**The one carve-out**: revenue and expense detail is private to LLC
+members and is never published here (system costs, billing history,
+contract rates, per-tenant margins). This line is enforced mechanically:
+the publishing script redacts financial literals from every public page
+at render time — see
+[`grav-publish.sh`](https://git.knownelement.com/KNEL/KNELPerf/src/branch/main/tools/grav-publish.sh).
+
+Publishing is exclusively git-based: content lands via pull from the
+public repo; the site runs no foreign tooling. The Grav admin exists only
+to prevent first-run setup mode; content never flows through it.
+EOF
+
+# ---------- 08 About ----------
+mkdir -p "$PAGES/about"
+fm "About" > "$PAGES/about/page.md"
+cat >> "$PAGES/about/page.md" <<'EOF'
+# 👥 About the performance organization
+
+The KNEL Performance organization runs fleet performance optimization for
+Turnsys: the baseline → audit → tweak → re-baseline loop, capacity
+planning, and power-aware scheduling across two sites (main PFV datacenter
++ SiTES fabrication shop). It reports to the VP of Technical Operations
+with a dotted line to the VP of Facilities.
+
+- Work tracking: [Redmine #826](https://projects.knownelement.com/issues/826)
+  (program anchor ticket)
+- Code: [KNELPerf](https://git.knownelement.com/KNEL/KNELPerf) ·
+  [KNELSiterSolar](https://git.knownelement.com/KNEL/KNELSiterSolar) ·
+  [this site's content](https://git.knownelement.com/KNEL/KNELPerfHub)
+- License: AGPLv3 across the program
+EOF
 
 # ---------- push ----------
 cd "$HUB_REPO"
 if [ -n "$(git status --porcelain)" ]; then
-  git add performance
+  git add -A performance
   git commit -q -m "Auto-publish $(date +%F_%H:%M) (#826)
 
 https://projects.knownelement.com/issues/826"