From f342f9605ef8b32924a15832a278b9946ef58051 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 31 Aug 2026 23:12:16 +0200
Subject: [PATCH] Add contained Policy Nexus CCR apply wrapper

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
---
 scripts/openbao-apply-policy-nexus-source-ccr.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100755 scripts/openbao-apply-policy-nexus-source-ccr.sh

diff --git a/scripts/openbao-apply-policy-nexus-source-ccr.sh b/scripts/openbao-apply-policy-nexus-source-ccr.sh
new file mode 100755
index 0000000..47dd8ab
--- /dev/null
+++ b/scripts/openbao-apply-policy-nexus-source-ccr.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Silent, exact owner command for the governed openbao-platform-admin-login lane.
+# The surrounding Warden session captures both streams and rejects any child output.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+cd "${REPO_DIR}"
+python3 scripts/credential-change.py applier-apply CCR-2026-0014 \
+  --actor "attended operator via governed platform-admin lane" \
+  --confirm "DELEGATED APPLY CCR-2026-0014" \
+  --record-state-hub \
+  >/dev/null 2>&1