#!/usr/bin/env bash
# Silent, exact owner command for the governed openbao-platform-admin-login lane.
# The surrounding Warden session captures both streams and rejects any child output.
set -euo pipefail

REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

cd "${REPO_DIR}"
python3 scripts/credential-change.py applier-apply CCR-2026-0014 \
  --actor "attended operator via governed platform-admin lane" \
  --confirm "DELEGATED APPLY CCR-2026-0014" \
  --record-state-hub \
  >/dev/null 2>&1