#!/bin/bash
# integrity-check.sh — Automatisk integritetskontroll för EP-1.0
# Kör via cron: 0 * * * * /home/bernt/.openclaw/workspace/experiments/integrity-check.sh

BASE="/home/bernt/.openclaw/workspace/experiments"
LOG="/tmp/ep10-integrity.log"
DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

echo "[$DATE] Integritetskontroll startad" >> $LOG

# DS-001 — ska vara oförändrad
DS001_LEDGER=$(sha256sum $BASE/CR-001/ledger.jsonl | awk '{print $1}')
DS001_META=$(sha256sum $BASE/CR-001/metadata.yaml | awk '{print $1}')
DS001_KPI=$(sha256sum $BASE/CR-001/derived-kpis.md | awk '{print $1}')

if [ "$DS001_LEDGER" = "48bbddf9a64e9c02ea32ef39f0169e9a6c33c5be1d4beff5206d60639ac0503f" ]; then
    echo "[$DATE] DS-001 ledger: PASS" >> $LOG
else
    echo "[$DATE] DS-001 ledger: FAIL — hash mismatch!" >> $LOG
    echo "ALERT: DS-001 ledger har ändrats!" | logger -t ep10-integrity
fi

if [ "$DS001_META" = "cda34bf5c8c35294938b4cffee35f9c300c2a0d9d9fcba790de81b678ac68cd1" ]; then
    echo "[$DATE] DS-001 metadata: PASS" >> $LOG
else
    echo "[$DATE] DS-001 metadata: FAIL — hash mismatch!" >> $LOG
fi

if [ "$DS001_KPI" = "16560750b3fb7dc26fdc617e0991d7aba39fce02f87a9e9a9db517eeaa0773d5" ]; then
    echo "[$DATE] DS-001 derived-kpis: PASS" >> $LOG
else
    echo "[$DATE] DS-001 derived-kpis: FAIL — hash mismatch!" >> $LOG
fi

# DS-002 — logga nuvarande hash för spårbarhet
DS002_LEDGER=$(sha256sum $BASE/CR-002/ledger.jsonl | awk '{print $1}')
echo "[$DATE] DS-002 ledger hash: $DS002_LEDGER" >> $LOG

# Kontrollera att DS-002 inte har ändrats om den är fryst
DS002_STATUS=$(grep "^status:" $BASE/CR-002/metadata.yaml | awk '{print $2}')
if [ "$DS002_STATUS" = "FROZEN" ]; then
    # Jämför med senast loggade hash
    LAST_HASH=$(grep "DS-002 ledger hash:" $LOG | tail -1 | awk '{print $NF}')
    if [ "$DS002_LEDGER" = "$LAST_HASH" ]; then
        echo "[$DATE] DS-002 frozen ledger: PASS (oförändrad)" >> $LOG
    else
        echo "[$DATE] DS-002 frozen ledger: FAIL — ändrad efter frysning!" >> $LOG
        echo "ALERT: DS-002 ledger har ändrats efter frysning!" | logger -t ep10-integrity
    fi
fi

echo "[$DATE] Kontroll avslutad" >> $LOG