#!/usr/bin/env bash
# Exact silent owner command for the CCR-2026-0031 attended bootstrap.
# Run only after CCR-2026-0031 is approved and its binding confirmed:
#   warden access openbao-platform-admin-login --exec -- scripts/openbao-bootstrap-core-hub-source.sh
# Both steps are idempotent; on failure read /tmp/core-hub-source-bootstrap-diagnostic.json.
set -euo pipefail

REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${REPO_DIR}"

python3 scripts/credential-change.py applier-apply CCR-2026-0031 \
  --actor "attended operator via governed platform-admin lane" \
  --confirm "DELEGATED APPLY CCR-2026-0031" \
  --record-state-hub \
  >/dev/null 2>&1
python3 scripts/provision-core-hub-forgejo-source.py >/dev/null 2>&1