tegwick
5649ef90c4
One cluster route (NK_KUBECONFIG, default ~/.kube/config-railiance01) and server-side apply throughout. Fixes the Makefile dry-run defaulting to the coulombcore kubeconfig. Lane-run scripts take no default and fail closed when NK_KUBECONFIG is unset. net-kingdom convention lint: 14 findings -> 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 73091@bnt-lap001 Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a
16 lines
942 B
Bash
Executable file
16 lines
942 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Silent child for the attended nk-bounded-executor sender seed (AUDIT-WP-0018-T04,
|
|
# NK-WP-0056-T15, CCR-2026-0063). Founder-run under
|
|
# warden access openbao-platform-admin-login --exec -- <this script> <receipt>
|
|
# Results go to the receipt only; any output would fail the warden envelope closed.
|
|
# Inside the lane HOME is the warden envelope, so there is no kubeconfig default:
|
|
# the caller passes the one cluster route (NK-WP-0058-T07), expanded outside the lane:
|
|
# warden access ... --exec -- env NK_KUBECONFIG="$HOME/.kube/config-railiance01" <this script> <receipt>
|
|
# Unset, it exits 64 silently before anything runs.
|
|
set -euo pipefail
|
|
receipt="${1:?receipt path required}"
|
|
[[ -n "${NK_KUBECONFIG:-}" ]] || exit 64
|
|
exec python3 "$(dirname "$0")/seed-nk-bounded-executor-sender.py" \
|
|
--kubeconfig "$NK_KUBECONFIG" \
|
|
--confirm 'SEED nk-bounded-executor CCR-2026-0063' \
|
|
--receipt "$receipt" >/dev/null 2>&1
|