#!/usr/bin/env bash
# Silent child for the attended nk-bounded-executor sender seed (AUDIT-WP-0018-T04,
# NK-WP-0056-T15, CCR-2026-0063). Founder-run under
#   warden access openbao-platform-admin-login --exec -- <this script> <receipt>
# Results go to the receipt only; any output would fail the warden envelope closed.
# Inside the lane HOME is the warden envelope, so the kubeconfig default is absolute.
set -euo pipefail
receipt="${1:?receipt path required}"
exec python3 "$(dirname "$0")/seed-nk-bounded-executor-sender.py" \
  --kubeconfig "${RAILIANCE01_KUBECONFIG:-/home/worsch/.kube/config-railiance01}" \
  --confirm 'SEED nk-bounded-executor CCR-2026-0063' \
  --receipt "$receipt" >/dev/null 2>&1