#!/usr/bin/env bash
# KNELPerf -> KNELPerfHub publisher.
#
# Architecture ruling (founder, 2026-09-06): NO server-side tooling runs in
# the Grav container. This script renders pages as markdown into the
# KNELPerfHub git repo and PUSHES; the Cloudron VPS's ukrrs-hub-pull.timer
# git-pulls that repo into the Grav pages dir every 5 min (Grav
# cache.check=file picks changes up).
#
# TRANSPARENCY RULE (mechanical): revenue/expense detail is LLC-private.
# redact() strips financial literals from every public render — the
# public/private line is enforced by script, not by authoring discipline.
# The reports/ and content/ lists below are explicit whitelists.
set -euo pipefail
REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
HUB_REPO=${HUB_REPO:-$HOME/projects/KNEL/KNELPerfHub}
SOLAR_REPO=${SOLAR_REPO:-$HOME/projects/KNEL/PhysicalPlant/SITER-Solar}
PAGES=$HUB_REPO/performance

fm() { printf -- "---\ntitle: %s\nvisible: true\n---\n\n" "$1"; }

# Strip LLC-private financial literals (contract rates, project costs, bill
# amounts). Keep methodology public; keep numbers private.
# shellcheck disable=SC2016  # single-quoted sed programs intentionally contain $ literals
redact() {
  sed -e 's/\$0\.085[^ )]*/$[redacted — LLC-private]/g' \
      -e 's/\$0\.040\|\$0\.04[ )/]/$[redacted — LLC-private]/g' \
      -e 's/8\.5¢/[redacted]/g; s/4¢/[redacted]/g' \
      -e 's/\$4,100/[redacted — LLC-private]/g' \
      -e 's/\$301\.08\|\$264\.47\|\$3,967\.[0-9]*/[redacted — LLC-private]/g' \
      -e 's/23,?95[0-9]\|22,?614[0-9]*/[redacted]/g'
}

# ---------- 01 Home ----------
DASH=$(mktemp)
{
  fm "Performance Hub"
  echo "# ⚡ KNEL Performance Hub"
  echo
  echo "Live operational-performance intelligence for the Turnsys PFV fleet —"
  echo "published openly, updated automatically. Ultra-transparent by"
  echo "default; [revenue and expense detail stays LLC-private]"
  echo "(/performance/transparency)."
  echo
  echo "- **What we do**: [the program](/performance/program) — a continuous"
  echo "  baseline → audit → tweak → re-baseline loop across a 9-node"
  echo "  Proxmox fleet, scheduled around solar surplus and grid risk."
  echo "- **The metal**: [fleet inventory](/performance/fleet)."
  echo "- **Deep dives**: [reports](/performance/reports)."
  echo "- **Methodology**: [grid-risk intel](/performance/intel/ercot-risk) ·"
  echo "  [solar arbitrage](/performance/intel/solar-arbitrage)."
  echo "- **Right now**: [status dashboard](/performance/status)."
  echo
  echo "## ⚡ ERCOT risk right now (LZ_SOUTH)"
  echo '```json'
  if [ -x "$SOLAR_REPO/solar-analysis/ercot-brief.sh" ]; then
    "$SOLAR_REPO/solar-analysis/ercot-brief.sh" 2>/dev/null \
      || tail -1 /var/tmp/ercot-brief-history.tsv 2>/dev/null \
      || echo '{"error":"price feed pending API key registration"}'
  else
    tail -1 /var/tmp/ercot-brief-history.tsv 2>/dev/null || echo '{"error":"no data yet"}'
  fi
  echo '```'
} > "$DASH"
mkdir -p "$PAGES"; mv "$DASH" "$PAGES/page.md"

# ---------- 02 Program (architecture, redacted) ----------
mkdir -p "$PAGES/program"
fm "The Program" > "$PAGES/program/page.md"
redact < "$REPO_ROOT/docs/ARCHITECTURE.md" >> "$PAGES/program/page.md"

# ---------- 03 Fleet ----------
mkdir -p "$PAGES/fleet"
F=$(mktemp)
{
  fm "Fleet"
  echo "# 🖥️ Fleet inventory"
  echo
  echo "Hardware transparency: every node serving this program, verified by"
  echo "live dmidecode survey (2026-09-06). Capacity planning and margin"
  echo "accounting run against this table."
  echo
  sed -n '/^| node |/,/^$/p' "$REPO_ROOT/docs/ARCHITECTURE.md" | head -n -1
  echo
  echo "Power telemetry per node: RAPL (tsys1/3/4/7/9) · iDRAC (tsys6/7) ·"
  echo "metered PDU (tsys5) — methodology in the"
  echo "[AMT report](/performance/reports/report-amt-power-telemetry)."
} > "$F"; mv "$F" "$PAGES/fleet/page.md"

# ---------- 04 Reports (whitelist) ----------
mkdir -p "$PAGES/reports"
for report in report-amt-power-telemetry report-moonlight-desktop; do
  R=$(mktemp); { fm "$report"; redact < "$REPO_ROOT/docs/$report.md"; } > "$R"
  mkdir -p "$PAGES/reports/$report"; mv "$R" "$PAGES/reports/$report/page.md"
done

# ---------- 05 Intel ----------
mkdir -p "$PAGES/intel/ercot-risk" "$PAGES/intel/solar-arbitrage"
fm "ERCOT Risk Intelligence" > "$PAGES/intel/ercot-risk/page.md"
redact < "$SOLAR_REPO/docs/oncor-realtime-arbitrage.md" | sed -n '/^## Day-to-day/,$p' >> "$PAGES/intel/ercot-risk/page.md"
fm "Solar Arbitrage" > "$PAGES/intel/solar-arbitrage/page.md"
redact < "$SOLAR_REPO/docs/oncor-realtime-arbitrage.md" | sed -n '1,/^## Day-to-day/p' | head -n -1 >> "$PAGES/intel/solar-arbitrage/page.md"

# ---------- 06 Status (auto dashboard) ----------
mkdir -p "$PAGES/status"
S=$(mktemp)
{
  fm "Status"
  echo "# 📈 Status dashboard"
  echo
  echo "Auto-published $(date -Is) from KNELPerf. Source:"
  echo "https://git.knownelement.com/KNEL/KNELPerf"
  echo
  echo "## 🌤️ Solar arbitrage verdict (latest run)"
  echo '```json'
  [ -x "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" ] \
    && "$SOLAR_REPO/solar-analysis/oncor-arbitrage.sh" 2>/dev/null \
    || echo '{"error":"source unavailable"}'
  echo '```'
  echo
  echo "## 📋 Baseline index"
  echo
  echo "| host | latest bundle |"
  echo "|---|---|"
  found=0
  for d in "$REPO_ROOT"/data/baselines/*/; do
    [ -d "$d" ] || continue
    h=$(basename "$d"); l=$(find "$d" -maxdepth 1 -mindepth 1 -type d -printf '%f\n' 2>/dev/null | sort | tail -1)
    if [ -n "$l" ]; then echo "| $h | $l |"; found=1; fi
  done
  [ "$found" = 1 ] || echo "| (none yet — first fleet baseline wave pending) | |"
} > "$S"; mv "$S" "$PAGES/status/page.md"

# ---------- 07 Transparency ----------
mkdir -p "$PAGES/transparency"
fm "Transparency" > "$PAGES/transparency/page.md"
cat >> "$PAGES/transparency/page.md" <<'EOF'
# 🔓 Transparency policy

We run an ultra-open and transparent organization. This site and its
[content repo](https://git.knownelement.com/KNEL/KNELPerfHub) are **public
read-only** — performance data, benchmarks, risk intelligence,
architecture and decision reports are all in the open.

**The principle**: our code, formulas, and methodology are open; the
inputs to them are not. Revenue and expense detail (contract rates,
system costs, billing history, per-tenant margins, customer data) is
private to LLC members and is never published here. This line is enforced
mechanically: the publishing script redacts private literals from every
public page at render time — see
[`grav-publish.sh`](https://git.knownelement.com/KNEL/KNELPerf/src/branch/main/tools/grav-publish.sh).
Public market signals (e.g. ERCOT prices) are open data and stay open.

Publishing is exclusively git-based: content lands via pull from the
public repo; the site runs no foreign tooling. The Grav admin exists only
to prevent first-run setup mode; content never flows through it.
EOF

# ---------- 08 About ----------
mkdir -p "$PAGES/about"
fm "About" > "$PAGES/about/page.md"
cat >> "$PAGES/about/page.md" <<'EOF'
# 👥 About the performance organization

The KNEL Performance organization runs fleet performance optimization for
Turnsys: the baseline → audit → tweak → re-baseline loop, capacity
planning, and power-aware scheduling across two sites (main PFV datacenter
+ SiTES fabrication shop). It reports to the VP of Technical Operations
with a dotted line to the VP of Facilities.

- Work tracking: [Redmine #826](https://projects.knownelement.com/issues/826)
  (program anchor ticket)
- Code: [KNELPerf](https://git.knownelement.com/KNEL/KNELPerf) ·
  [KNELSiterSolar](https://git.knownelement.com/KNEL/KNELSiterSolar) ·
  [this site's content](https://git.knownelement.com/KNEL/KNELPerfHub)
- License: AGPLv3 across the program
EOF

# ---------- push ----------
cd "$HUB_REPO"
if [ -n "$(git status --porcelain)" ]; then
  git add -A performance
  git commit -q -m "Auto-publish $(date +%F_%H:%M) (#826)

https://projects.knownelement.com/issues/826"
  git push -q origin main
  echo "pushed to KNEL/KNELPerfHub ($(date -Is)); site refreshes within 5 min"
else
  echo "no changes to publish ($(date -Is))"
fi