# ═══════════════════════════════════════════════
# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
# 📜 Copyright: 国作登字-2026-A-00037559
# ═══════════════════════════════════════════════
# 🦅 天眼签到审计
# 每日 CST 22:00 (UTC 14:00) 审计所有联邦人格体签到记录
#
# 触发条件: schedule (daily) / workflow_dispatch

name: "🦅 天眼签到审计"

on:
  schedule:
    - cron: "0 14 * * *"  # UTC 14:00 = CST 22:00
  workflow_dispatch:

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: "🔍 审计签到记录"
        run: |
          echo "🦅 天眼签到审计 · $(TZ='Asia/Shanghai' date '+%Y-%m-%d %H:%M:%S CST')"

          TODAY=$(date -u +%Y-%m-%d)
          ALERT_LIST=""

          # 遍历注册表中联邦区所有需要签到的 Agent
          for DEV_ID in $(jq -r '.federation | to_entries[] | select(.value.daily_checkin_required == true) | .key' .github/persona-brain/agent-registry.json); do
            LAST=$(jq -r ".federation.\"$DEV_ID\".last_checkin // \"never\"" .github/persona-brain/agent-registry.json)
            STATUS=$(jq -r ".federation.\"$DEV_ID\".status // \"unknown\"" .github/persona-brain/agent-registry.json)
            PERSONA=$(jq -r ".federation.\"$DEV_ID\".persona // \"unknown\"" .github/persona-brain/agent-registry.json)

            if [ "$LAST" = "never" ] || [ "$LAST" = "null" ]; then
              echo "🟡 $DEV_ID ($PERSONA): 从未签到"
              ALERT_LIST="$ALERT_LIST\n🟡 $DEV_ID ($PERSONA): 从未签到"
            elif [ "$(echo "$LAST" | cut -d'T' -f1)" != "$TODAY" ]; then
              echo "🔴 $DEV_ID ($PERSONA): 今日未签到 (最后: $LAST)"
              ALERT_LIST="$ALERT_LIST\n🔴 $DEV_ID ($PERSONA): 今日未签到"
            elif [ "$STATUS" = "signature_mismatch" ]; then
              echo "🚨 $DEV_ID ($PERSONA): 签名不匹配！可能被篡改"
              ALERT_LIST="$ALERT_LIST\n🚨 $DEV_ID ($PERSONA): 签名异常"
            else
              echo "✅ $DEV_ID ($PERSONA): 正常"
            fi
          done

          # 本体论维度审计：检查每个子仓库的 ontology 部署状态
          echo ""
          echo "🌍 本体论状态审计"
          echo "─────────────────────"
          for DEV_ID in $(jq -r '.federation | to_entries[] | select(.value.daily_checkin_required == true) | .key' .github/persona-brain/agent-registry.json); do
            PERSONA=$(jq -r ".federation.\"$DEV_ID\".persona // \"unknown\"" .github/persona-brain/agent-registry.json)
            # 检查 spoke-deployments 中对应的 ontology.json
            SPOKE_DIR=""
            case "$DEV_ID" in
              DEV-012) SPOKE_DIR="spoke-deployments/guanghu-awen" ;;
              DEV-004) SPOKE_DIR="spoke-deployments/guanghu-zhizhi" ;;
              DEV-002) SPOKE_DIR="spoke-deployments/guanghu-feimao" ;;
              DEV-010) SPOKE_DIR="spoke-deployments/guanghu-juzi" ;;
              DEV-001) SPOKE_DIR="spoke-deployments/guanghu-yeye" ;;
              DEV-003) SPOKE_DIR="spoke-deployments/guanghu-yanfan" ;;
            esac
            if [ -n "$SPOKE_DIR" ] && [ -f "$SPOKE_DIR/.github/persona-brain/ontology.json" ]; then
              AXIOM_COUNT=$(jq '.core_axioms | length' "$SPOKE_DIR/.github/persona-brain/ontology.json")
              ONT_VERSION=$(jq -r '.version // "unknown"' "$SPOKE_DIR/.github/persona-brain/ontology.json")
              if [ "$AXIOM_COUNT" -ge 6 ]; then
                echo "✅ $DEV_ID ($PERSONA): 本体论 v$ONT_VERSION · $AXIOM_COUNT/6 公理"
              else
                echo "🟡 $DEV_ID ($PERSONA): 本体论不完整 · $AXIOM_COUNT/6 公理"
              fi
            elif [ -n "$SPOKE_DIR" ]; then
              echo "🟡 $DEV_ID ($PERSONA): 本体论未部署"
            fi
          done

          if [ -n "$ALERT_LIST" ]; then
            echo ""
            echo "⚠️ 存在异常，生成报警"
            echo -e "$ALERT_LIST" > /tmp/alert.txt
            cat /tmp/alert.txt
          else
            echo ""
            echo "✅ 全员签到正常"
          fi

      - name: "📝 审计摘要"
        if: always()
        run: |
          echo "## 🦅 天眼签到审计结果" >> $GITHUB_STEP_SUMMARY
          echo "- 时间: $(TZ='Asia/Shanghai' date '+%Y-%m-%d %H:%M:%S CST')" >> $GITHUB_STEP_SUMMARY
          echo "- 详情见上方日志" >> $GITHUB_STEP_SUMMARY