#!/bin/bash
# vault-health.sh — daily probe of the team's vault discipline.
# Counts diary writes per agent for today, checks expected files exist,
# runs vault-verify, and appends a one-screen report to HQ-Vault/_System/HealthLog.md.
#
# Designed to be run as a daily cron on the VPS (via /etc/cron.d/vault-health):
#   0 21 * * * cd /home/ccuser/rateright-growth && bash scripts/vault-health.sh
#
# auto-sync.sh picks the new HealthLog.md entry up on its next 30-min cycle.

set -u
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
VAULT="$ROOT/HQ-Vault"
LOG="$VAULT/_System/HealthLog.md"
TODAY=$(date -u +%Y-%m-%d)
NOW=$(date -u +%H:%M)

cd "$ROOT" || exit 1

# Bootstrap HealthLog.md if missing
if [ ! -f "$LOG" ]; then
  cat > "$LOG" <<HDR
---
title: Vault Health Log
created: 2026-05-01
type: system
---

# Vault Health Log

> Append-only daily probe written by \`scripts/vault-health.sh\`. One entry per cron run. Format: \`## YYYY-MM-DD HH:MM\` heading + bullets. Anomalies (no writes from an active agent, vault-verify failure, missing daily note) are flagged with **WARN**.

HDR
fi

# --- Probes ---
DAILY="$VAULT/01_Daily/${TODAY}.md"
DAILY_PRESENT=no
DAILY_BYTES=0
DAILY_HEADINGS=0
if [ -f "$DAILY" ]; then
  DAILY_PRESENT=yes
  DAILY_BYTES=$(wc -c < "$DAILY")
  DAILY_HEADINGS=$(grep -cE "^## [0-9]{2}:[0-9]{2} — " "$DAILY" 2>/dev/null || echo 0)
fi

# Activity tally for TODAY only — only count headings that follow the
# new-protocol format `## HH:MM — agent — title` (with two em-dashes).
# Older `## HH:MM — title` entries don't have an attributable agent.
declare -A AGENT_COUNT=()
if [ -f "$DAILY" ]; then
  while IFS= read -r line; do
    agent=$(echo "$line" | sed -E "s/^## [0-9]{2}:[0-9]{2} — ([^—]+) — .*/\1/" | sed 's/[[:space:]]*$//;s/^[[:space:]]*//')
    [ -n "$agent" ] && AGENT_COUNT["$agent"]=$(( ${AGENT_COUNT["$agent"]:-0} + 1 ))
  done < <(grep -E "^## [0-9]{2}:[0-9]{2} — .+ — " "$DAILY")
fi

# Project log entry counts (today only). grep -c always emits a count.
declare -A PROJECT_LOG_COUNT=()
for proj in 10_RateRight 11_OpsMan_LFCS 12_SiteOps; do
  log="$VAULT/$proj/_Brain/_Log.md"
  if [ -f "$log" ]; then
    PROJECT_LOG_COUNT["$proj"]=$(grep -cE "^- ${TODAY} " "$log" 2>/dev/null)
  fi
done

AGENT_LOGS_TODAY=$(find "$VAULT" -path "*/_AgentLog/*.md" -newermt "$TODAY 00:00:00" -not -name ".gitkeep" 2>/dev/null | wc -l)

VERIFY_STATUS=skipped
PY=$(command -v python3 || command -v python || echo "")
if [ -n "$PY" ] && [ -f "$ROOT/scripts/vault-verify.py" ]; then
  if "$PY" "$ROOT/scripts/vault-verify.py" > /tmp/vault-verify.log 2>&1; then
    VERIFY_STATUS=PASS
  else
    VERIFY_STATUS=FAIL
  fi
fi

# Hermes symlink check — only meaningful on the VPS where opsman-work lives
HERMES_DAILY=/home/ccuser/opsman-work/daily
HERMES_DAILY_OK=na
if [ -e /home/ccuser/opsman-work ]; then
  if [ -L "$HERMES_DAILY" ]; then
    target=$(readlink "$HERMES_DAILY")
    case "$target" in
      *HQ-Vault/11_OpsMan_LFCS/_AgentLog/hermes-daily*) HERMES_DAILY_OK=yes ;;
      *) HERMES_DAILY_OK=no ;;
    esac
  else
    HERMES_DAILY_OK=no
  fi
fi

# --- Anomaly detection ---
WARNS=()
[ "$DAILY_PRESENT" = "no" ] && WARNS+=("no daily note for ${TODAY}")
[ "$DAILY_HEADINGS" -eq 0 ] && [ "$DAILY_PRESENT" = "yes" ] && WARNS+=("daily note exists but has zero timestamped entries")
[ "$VERIFY_STATUS" = "FAIL" ] && WARNS+=("vault-verify FAIL")
[ "$HERMES_DAILY_OK" = "no" ] && WARNS+=("hermes daily symlink missing or wrong target")
# 'na' (not on VPS) is silently fine

# --- Append entry ---
{
  echo
  echo "## ${TODAY} ${NOW}"
  echo
  echo "**Activity (today):**"
  if [ ${#AGENT_COUNT[@]} -eq 0 ]; then
    echo "- (no daily-note entries from any agent)"
  else
    for a in "${!AGENT_COUNT[@]}"; do
      echo "- ${a}: ${AGENT_COUNT[$a]} daily entry(ies)"
    done | sort
  fi
  echo
  echo "**Project logs (today's entries):**"
  for proj in 10_RateRight 11_OpsMan_LFCS 12_SiteOps; do
    echo "- ${proj}: ${PROJECT_LOG_COUNT[$proj]:-0}"
  done
  echo
  echo "**Other:**"
  echo "- daily note: ${DAILY_PRESENT} (${DAILY_BYTES} bytes, ${DAILY_HEADINGS} timestamped sections)"
  echo "- agent log files touched today: ${AGENT_LOGS_TODAY}"
  echo "- vault-verify: ${VERIFY_STATUS}"
  echo "- hermes daily symlink: ${HERMES_DAILY_OK}"
  echo
  if [ ${#WARNS[@]} -gt 0 ]; then
    echo "**WARN:**"
    for w in "${WARNS[@]}"; do echo "- ${w}"; done
  else
    echo "**No anomalies.**"
  fi
} >> "$LOG"

echo "[$(date)] Wrote vault health entry to $LOG"
[ ${#WARNS[@]} -gt 0 ] && echo "[$(date)] WARN: ${#WARNS[@]} anomalies"
exit 0