@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/operator-bootstrap/template.sh

@@ -0,0 +1,439 @@
+#!/usr/bin/env bash
+# SOLEUR-GENERATED-OPERATOR-SCRIPT v2
+#
+# Generated by `soleur:operator-bootstrap` from
+# plugins/soleur/skills/operator-bootstrap/template.sh.
+#
+# This header marker identifies the file as a generated operator script. It does
+# NOT pin a byte-identical library region: there is one distribution mode and the
+# script SOURCES the library, so there is no copy to drift from.
+#
+# <!-- Inspired by mattpocock/skills/skills/engineering/wizard/ (MIT, Copyright (c) 2026 Matt Pocock). -->
+#
+# THE CONTRACT (ADR-264): an AGENT runs this script, one stage at a time, with no
+# terminal. A human acknowledges every production write, but at the harness
+# approval prompt on the exact command, not at a typed `yes` (this guards against an
+# agent acting on a mistaken instruction, not a compromised one; headless, bypass-mode
+# and no-hook surfaces defer or refuse and never auto-approve — ADR-264):
+#   bash bootstrap.sh --list                                        the stages (static; no credentials)
+#   bash bootstrap.sh --stage <name>                                read stage: runs; write stage: prints the PLAN
+#   bash bootstrap.sh --stage <name> --apply --plan-digest <d>      write stage: the approved write
+# There is no run-all mode and no `--yes`. Every stage is idempotent: a re-run
+# of a satisfied stage changes nothing and needs no approval.
+#
+# WHAT TO EDIT: the `# SOLEUR-STAGE` lines and the `read_*` / `plan_*` / `apply_*`
+# functions below them, plus the ONE generation-time substitution of
+# SOLEUR_OP_LIB_BAKED. Everything above the STAGES banner is the contract the
+# library expects. NEVER hand-edit plugins/soleur/scripts/lib/operator-script.sh
+# — the library is one file and every generated script shares it.
+#
+# Exit codes and stdout markers: the library header ("EXIT CODES" and "STDOUT
+# MARKERS" in plugins/soleur/scripts/lib/operator-script.sh) is the single
+# source. Do not restate the table here.
+set -euo pipefail
+
+# --- PROLOGUE (must stay ABOVE the `source` line) ----------------------------
+# Duplicated here, never moved into the library — see "SOURCING PRECONDITIONS"
+# §2 in the library header for why. Stdout, not stderr: agent runtimes surface
+# stdout and swallow stderr.
+case "$-" in
+  *x*)
+    printf '[FATAL] refusing to run under xtrace: this script handles a live credential and -x would print it (see #7797)\n'
+    exit 78
+    ;;
+esac
+
+# SSLKEYLOGFILE writes TLS session keys to disk; nothing a stage runs should
+# inherit it. The CA-pool variables (SSL_CERT_FILE, SSL_CERT_DIR,
+# CURL_CA_BUNDLE) are deliberately NOT stripped: `gh` and `hcloud` are Go
+# clients that read them for their root pool, and a founder behind a
+# TLS-inspecting proxy needs them (the credential linter requires only the
+# xtrace refusal above — measured).
+unset SSLKEYLOGFILE
+
+# No pathname expansion anywhere below: stage code loops over vendor-supplied names
+# (`for s in $SLUGS`), and a name such as `*` must stay a name, never a file glob.
+set -f
+
+# --- the stage table ---------------------------------------------------------
+# ONE source of truth: --list prints it, the dispatcher validates `--stage`
+# against it, and the approval hook reads these same lines (statically; it never
+# executes this script) to show the human the impact and rollback they are
+# approving. Format:  name|class|impact|rollback   (class: read | write).
+# A write stage's impact and rollback are one plain sentence each, written for a
+# founder, with no `|` in them. Replace the two examples.
+#
+# SOLEUR-STAGE account|read|Nothing changes: this only reads the vendor account.|None needed.
+# SOLEUR-STAGE provision|write|A billable resource is created in the vendor account.|Delete the resource in the vendor console; nothing else depends on it yet.
+
+# `--list` is a STATIC read of the table above: no library, no credentials, no
+# network, so an agent can probe it first. It sits BELOW the xtrace refusal and
+# ABOVE library resolution (the linter allows no command above the refusal).
+if [[ "${1:-}" == "--list" ]]; then
+  grep -a '^# SOLEUR-STAGE ' "${BASH_SOURCE[0]}" | sed 's/^# SOLEUR-STAGE //' | awk -F'|' '{ printf "SOLEUR_BOOTSTRAP_STAGE_DECL stage=%s class=%s\n", $1, $2 }'
+  exit 0
+fi
+
+# --- library resolution ------------------------------------------------------
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# GENERATION-TIME SUBSTITUTION. The generator (operator-bootstrap/SKILL.md §3)
+# replaces the placeholder below with the ABSOLUTE path of the library resolved
+# at generation time — `realpath "${CLAUDE_PLUGIN_ROOT}/scripts/lib/operator-
+# script.sh"`. A generated script lives at
+# knowledge-base/project/specs/feat-<name>/bootstrap.sh in the FOUNDER's repo,
+# where no relative path to the plugin exists and CLAUDE_PLUGIN_ROOT may be unset;
+# without the bake the only reachable outcome from that location was LIB_MISSING
+# (measured, review F1). An unsubstituted placeholder is not an absolute path, so
+# the loop below treats it as "not baked", never as a path — and the loop
+# deliberately does not spell the placeholder, so a global substitution cannot
+# rewrite the guard along with the value.
+SOLEUR_OP_LIB_BAKED="__SOLEUR_OP_LIB_BAKED__"
+
+# Resolution order, most explicit first:
+#   1. SOLEUR_OP_LIB      — explicit env override (a moved plugin, a test). Must
+#                           be ABSOLUTE: `-r` tests a relative name against cwd
+#                           while `source` searches PATH for it, two different
+#                           files.
+#   2. CLAUDE_PLUGIN_ROOT — a script run from inside a Claude Code session: the
+#                           LIVE plugin, which beats a bake that may point at a
+#                           stale marketplace cache hash.
+#   3. the baked path     — what a generated script runs on where 2 is unset.
+#   4. hard exit 64, naming the LAST candidate that was rejected.
+# A candidate that does not define the staged gate (a stale cached library) is
+# skipped BEFORE it is sourced, so it can never shadow a newer baked one.
+SOLEUR_OP_LIB="${SOLEUR_OP_LIB:-}"
+last_rejected="<no candidate was absolute>"
+if [[ -n "$SOLEUR_OP_LIB" && "$SOLEUR_OP_LIB" != /* ]]; then
+  last_rejected="$SOLEUR_OP_LIB (SOLEUR_OP_LIB must be an absolute path)"
+  SOLEUR_OP_LIB=""
+fi
+# An override is held to the same test as every other candidate (a readable regular
+# file named operator-script.sh that defines the gate): a stray value cannot make this
+# script source an arbitrary file. HONEST LIMIT: a process that can write such a file
+# and set this variable can also edit this script; that is the hijacked-agent case the
+# approval receipt does not claim to resist (ADR-264).
+if [[ -n "$SOLEUR_OP_LIB" ]] && ! { [[ -f "$SOLEUR_OP_LIB" && ! -L "$SOLEUR_OP_LIB" && -r "$SOLEUR_OP_LIB" && "${SOLEUR_OP_LIB##*/}" == "operator-script.sh" ]] && grep -aq '^soleur_op_stage_gate()' "$SOLEUR_OP_LIB"; }; then
+  last_rejected="$SOLEUR_OP_LIB (SOLEUR_OP_LIB must name a regular readable operator-script.sh that defines the staged gate)"
+  SOLEUR_OP_LIB=""
+fi
+if [[ -z "$SOLEUR_OP_LIB" ]]; then
+  for candidate in \
+    "${CLAUDE_PLUGIN_ROOT:-/nonexistent}/scripts/lib/operator-script.sh" \
+    "$SOLEUR_OP_LIB_BAKED"
+  do
+    [[ "$candidate" == /* ]] || continue
+    if [[ -r "$candidate" ]] && grep -aq '^soleur_op_stage_gate()' "$candidate"; then SOLEUR_OP_LIB="$candidate"; break; fi
+    last_rejected="$candidate"
+  done
+fi
+
+# HARD EXIT, never a stub. ADR-178 Context §1 records what fail-closed stubs did
+# to `cleanup-merged`: it refused to reap forever while reporting success.
+if [[ -z "$SOLEUR_OP_LIB" || ! -r "$SOLEUR_OP_LIB" ]]; then
+  printf 'SOLEUR_BOOTSTRAP_LIB_MISSING path=%s\n' "${SOLEUR_OP_LIB:-$last_rejected}"
+  printf 'Install or update the Soleur plugin, or set SOLEUR_OP_LIB to the absolute path of the library.\n'
+  exit 64
+fi
+unset last_rejected
+
+# shellcheck source=../../scripts/lib/operator-script.sh disable=SC1091
+source "$SOLEUR_OP_LIB"
+
+# API contract (library header §API). EQUALITY: the library auto-updates with
+# the plugin while this script is frozen in the founder's repository, so
+# "library newer than script" is the only incompatibility that can occur, and
+# `-ge` admitted exactly that. Refused BEFORE any ledger write.
+[[ ${SOLEUR_OP_LIB_API:-0} -eq 1 ]] || {
+  printf 'SOLEUR_BOOTSTRAP_LIB_INCOMPATIBLE need=1 got=%s\n' "${SOLEUR_OP_LIB_API:-0}"
+  exit 64
+}
+# The staged-contract capability is detected by the function itself, never by a
+# second API number (the frozen legacy scripts assert API equality).
+declare -F soleur_op_stage_gate >/dev/null 2>&1 || {
+  printf 'SOLEUR_BOOTSTRAP_LIB_INCOMPATIBLE need=stage-1 got=%s\n' "${SOLEUR_OP_LIB_API:-0}"
+  exit 64
+}
+
+# --- configuration -----------------------------------------------------------
+SLUG="${SLUG:-example}"
+ENV_FILE="${ENV_FILE:-${SCRIPT_DIR}/.env}"
+: "${SOLEUR_BOOTSTRAP_LEDGER:=${SCRIPT_DIR}/bootstrap-runs.jsonl}"
+export SOLEUR_BOOTSTRAP_LEDGER
+
+usage() {
+  cat <<USAGE
+Usage: bootstrap.sh --list
+       bootstrap.sh --stage <name>
+       bootstrap.sh --stage <name> --apply --plan-digest <digest> [--rotate-token]
+       bootstrap.sh --reset <KEY> | --help
+
+  --list          The stages and their class (read or write). Static; needs nothing.
+  --stage <name>  A READ stage runs. A WRITE stage prints its PLAN (what it would
+                  change, in plain words, and the exact apply command) and changes nothing.
+  --apply         With --stage <name> --plan-digest <digest>: perform the write. The
+                  person approves the exact command at the harness prompt first.
+  --plan-digest   The digest the plan printed. The script recomputes the plan; a
+                  mismatch (the state moved) exits 75 and writes nothing.
+  --reset <KEY>   Forget a persisted .env value so the next run re-asks for it.
+  --help          This text.
+
+There is no run-all mode and no flag that approves a write by itself.
+
+Environment:
+  SOLEUR_BOOTSTRAP_LEDGER=<path>     Run ledger (default: beside this script).
+  SOLEUR_OP_LIB=<abs-path>           Override the library path baked at generation.
+
+Skip variables — one per class-1/class-3 prompt in THIS script, derived from
+its source so the list cannot drift (naming convention: SOLEUR_BOOTSTRAP_<WHAT>
+for a value, SOLEUR_BOOTSTRAP_SKIP_<WHAT>_BARRIER for a barrier):
+$(grep -oE '^[[:space:]]*soleur_op_(barrier|value) SOLEUR_BOOTSTRAP_[A-Z0-9_]+' "${BASH_SOURCE[0]}" | awk '{print "  " $2}' | sort -u | grep . || echo '  (none: this script has no class-1 or class-3 prompt)')
+USAGE
+}
+
+# --- argument validation -----------------------------------------------------
+# Deliberately ABOVE the EXIT trap installed below: a usage error must print no
+# "Stopped during stage" banner, and `--reset` is not a stage. ORIG_ARGV keeps the
+# invocation exactly as the shell handed it over: the approval receipt is bound to
+# it (so `"a b"` and `"a" "b"` differ).
+ORIG_ARGV=("$@")
+STAGE=""
+APPLY=0
+PLAN_DIGEST=""
+ROTATE_TOKEN=0
+RESET_KEY=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --stage) STAGE="${2:-}"; [[ -n "$STAGE" ]] || { echo "Error: --stage needs a stage name (--list shows them)" >&2; usage >&2; exit 1; }; shift 2 ;;
+    --apply) APPLY=1; shift ;;
+    --plan-digest) PLAN_DIGEST="${2:-}"; [[ -n "$PLAN_DIGEST" ]] || { echo "Error: --plan-digest needs the digest the plan printed" >&2; usage >&2; exit 1; }; shift 2 ;;
+    --rotate-token) ROTATE_TOKEN=1; shift ;;
+    --reset) RESET_KEY="${2:-}"; [[ -n "$RESET_KEY" ]] || { echo "Error: --reset needs a KEY" >&2; usage >&2; exit 1; }; shift 2 ;;
+    --list) soleur_op_list "${BASH_SOURCE[0]}"; exit 0 ;;
+    --help|-h) usage; exit 0 ;;
+    *) echo "Unknown argument: $1" >&2; usage >&2; exit 1 ;;
+  esac
+done
+
+# --- the credentials file must be ignored by git ------------------------------
+# This script lives in a TRACKED directory (SKILL.md §Where), and its .env holds
+# recorded values. A .gitignore that does not cover it turns the founder's next
+# `git add .` into a pushed token (review P1-1). Checked BEFORE the first write —
+# `--reset` writes too — on the .env AND on the `.tmp.XXXXXX` sibling the upsert
+# creates beside it, which a bare `.env` pattern does not cover. Outside a git
+# work tree (or without git) there is nothing to commit, so the check passes.
+#
+# PROBE THE RESOLVED PATH — the writer does. `soleur_op_env_upsert` and
+# `soleur_op_env_reset` both `readlink -f` before writing, so probing the link
+# NAME asks git about a file the write never touches: a founder who symlinks
+# .env at a shared credentials file gets an ignored name, a passing probe, and
+# the value written to a target git reports as untracked-and-not-ignored. The
+# `.tmp.XXXXXX` sibling is created beside the RESOLVED file too, so it is
+# derived from the resolved path rather than from $ENV_FILE. Confirmed against
+# a fixture; Guard 7's symlink rows pin it.
+env_not_ignored() {
+  local dir; dir="$(dirname "$1")"
+  git -C "$dir" rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 1
+  ! git -C "$dir" check-ignore -q "$1"
+}
+ENV_FILE_RESOLVED="$(readlink -f -- "$ENV_FILE" 2>/dev/null || printf '%s' "$ENV_FILE")"
+for probe in "$ENV_FILE_RESOLVED" "${ENV_FILE_RESOLVED}.tmp.XXXXXX"; do
+  if env_not_ignored "$probe"; then
+    printf 'SOLEUR_BOOTSTRAP_ENV_NOT_IGNORED path=%s\n' "$probe"
+    printf 'The credentials file would be committed. Add it to .gitignore first (a pattern such as .env* covers both the file and its temp sibling).\n'
+    exit 64
+  fi
+done
+unset probe
+
+if [[ -n "$RESET_KEY" ]]; then
+  soleur_op_env_reset "$ENV_FILE" "$RESET_KEY"
+  soleur_op_green "Forgot ${RESET_KEY}. Re-run the stage to be asked for it again."
+  exit 0
+fi
+
+if [[ -z "$STAGE" ]]; then
+  printf 'SOLEUR_BOOTSTRAP_STAGE_REQUIRED\n'
+  printf 'Pick one stage with --stage <name>; this script has no run-all mode. The stages are:\n'
+  soleur_op_list "${BASH_SOURCE[0]}"
+  exit 64
+fi
+
+# --- terminal outcome --------------------------------------------------------
+# ONE trap. On a non-zero exit inside a stage it prints the STAGE_FAILED marker,
+# tells the founder which stage stopped and the one command that resumes, and
+# settles the stage in the ledger as `failed`. A refusal that already printed its
+# own marker and sentence (approval required / invalid / plan drift, a precondition,
+# a missing digest) raised the library's SOLEUR_OP_REFUSED flag and settles as
+# `refused`, adding nothing. The flag, not the exit code, decides: a vendor CLI that
+# exits 75 mid-write is a failure.
+SCRIPT_PATH="${SCRIPT_DIR}/$(basename "${BASH_SOURCE[0]}")"
+SCRIPT_REAL="$(soleur_approval_realpath "${BASH_SOURCE[0]}")"
+CURRENT_STAGE_INDEX=0
+CURRENT_STAGE_NAME=""
+STAGE_CHANGED=""
+mark_changed() { STAGE_CHANGED="${STAGE_CHANGED:+${STAGE_CHANGED}; }$1"; }
+on_exit() {
+  local rc=$?
+  [[ "$rc" -ne 0 && "$CURRENT_STAGE_INDEX" -gt 0 ]] || return 0
+  if [[ -n "${SOLEUR_OP_REFUSED:-}" ]]; then
+    soleur_op_stage_end "$CURRENT_STAGE_INDEX" "$CURRENT_STAGE_NAME" refused "$rc"
+    return 0
+  fi
+  printf 'SOLEUR_BOOTSTRAP_STAGE_FAILED stage=%s rc=%s\n' "$CURRENT_STAGE_NAME" "$rc"
+  # "Nothing else was changed" is FALSE on one path the library documents: a
+  # secret whose write returned 0 and whose read-back did not confirm it may be
+  # live (SOLEUR_BOOTSTRAP_SECRET_VERIFY_FAILED). The library raises a flag and
+  # this sentence defers to it.
+  if [[ -n "${SOLEUR_OP_WRITE_MAY_HAVE_LANDED:-}" ]]; then
+    printf 'Stopped during stage %s. A credential may already have been written — check it and revoke it if you did not mean to. Run the stage again to see where it stands: bash %s --stage %s\n' \
+      "$CURRENT_STAGE_NAME" "$SCRIPT_PATH" "$CURRENT_STAGE_NAME"
+  elif [[ -n "$STAGE_CHANGED" ]]; then
+    printf 'Stopped during stage %s AFTER it may have changed production: %s. Read the lines above before re-running. Run the stage again to see where it stands: bash %s --stage %s\n' \
+      "$CURRENT_STAGE_NAME" "$STAGE_CHANGED" "$SCRIPT_PATH" "$CURRENT_STAGE_NAME"
+  else
+    printf 'Stopped during stage %s. Nothing else was changed. Run the stage again: bash %s --stage %s\n' \
+      "$CURRENT_STAGE_NAME" "$SCRIPT_PATH" "$CURRENT_STAGE_NAME"
+  fi
+  soleur_op_stage_end "$CURRENT_STAGE_INDEX" "$CURRENT_STAGE_NAME" failed "$rc"
+}
+trap on_exit EXIT
+
+# =============================================================================
+# STAGES — everything below this line is yours. Replace the examples.
+# =============================================================================
+#
+# For each stage declared in the table above:
+#   read stage   read_<name>()   precondition-free: it only READS and reports.
+#   write stage  plan_<name>()   READ-ONLY. Calls `soleur_op_plan_op <op> <target>`
+#                                once per change it WOULD make, naming operations
+#                                and targets only (never a value). A stage that is
+#                                already satisfied declares NO operation: it then
+#                                needs no approval and `--apply` changes nothing.
+#                                If a precondition (an earlier stage's work) does
+#                                not hold, call `soleur_op_precondition_failed
+#                                <stage> <need-stage> "<sentence>"`: stages are
+#                                separately addressable, so each re-proves what it
+#                                depends on instead of trusting that another ran.
+#                apply_<name>()  the writes. It runs ONLY after the gate returned,
+#                                i.e. after the human approved the exact command.
+# Function names replace `-` in the stage name with `_`.
+#
+# NEVER call `soleur_op_ack_or_die` here: it needs a typed `yes` at a terminal and
+# makes the stage unrunnable by an agent. The gate is `soleur_op_stage_gate`, called
+# by the dispatcher below, not by your stage.
+#
+# The library sets `umask 077`, and every child a stage starts INHERITS it: a
+# file a stage writes for someone else (a public key, a config the vendor CLI
+# reads) lands 0600. Escape per command, never globally:
+#   (umask 022; printf '%s\n' "$pubkey" > "$HOME/.ssh/id.pub")
+
+# EXAMPLE read stage with a class-1 (non-secret) value: set the named skip variable
+# and run again. Credential ENTRY never goes through this helper.
+read_account() {
+  local account_id=""
+  if [[ -f "$ENV_FILE" ]] && grep -aq '^EXAMPLE_ACCOUNT_ID=' "$ENV_FILE"; then
+    soleur_op_yellow "  already recorded: EXAMPLE_ACCOUNT_ID"
+    return 0
+  fi
+  soleur_op_value SOLEUR_BOOTSTRAP_ACCOUNT_ID "  Account id: " account_id
+  [[ -n "$account_id" ]] || { soleur_op_red "no account id"; return 1; }
+  soleur_op_env_upsert "$ENV_FILE" EXAMPLE_ACCOUNT_ID "$account_id"
+}
+
+# EXAMPLE write stage. The precondition asks the VENDOR, never only a local marker
+# written after the create: between "create succeeded" and "marker written" an
+# interruption leaves a resource the next run cannot see, and it creates a second.
+# Two controls close that window — REPLACE the vendor read, KEEP the shape:
+#   1. `example_resource_exists` is the vendor-side read (hcloud server list,
+#      gh api, doppler projects get). It is what makes re-run safe.
+#   2. an ATTEMPTED marker is written BEFORE the create. A re-run that finds it
+#      without the PROVISIONED marker stops and sends the person to the vendor
+#      console instead of creating again; `--reset EXAMPLE_PROVISION_ATTEMPTED`
+#      clears it once they have looked.
+example_resource_exists() {
+  # REPLACE with the vendor read. The stand-in consults the local record only
+  # because this template has no vendor to ask.
+  [[ -f "$ENV_FILE" ]] && grep -aq '^EXAMPLE_PROVISIONED=' "$ENV_FILE"
+}
+
+plan_provision() {
+  if example_resource_exists "$SLUG"; then
+    return 0   # already satisfied: no operation, so no approval is asked
+  fi
+  if [[ -f "$ENV_FILE" ]] && grep -aq '^EXAMPLE_PROVISION_ATTEMPTED=' "$ENV_FILE"; then
+    soleur_op_precondition_failed provision account "A previous run started this create and was interrupted before it could record the result. Check the vendor console for '${SLUG}'. If nothing exists there, run: bash ${SCRIPT_PATH} --reset EXAMPLE_PROVISION_ATTEMPTED"
+  fi
+  soleur_op_plan_op create-resource "$SLUG"
+}
+
+apply_provision() {
+  mark_changed "the resource '${SLUG}' may have been created"
+  soleur_op_env_upsert "$ENV_FILE" EXAMPLE_PROVISION_ATTEMPTED "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+  # ... the write goes here (stdin for a secret, never argv) ...
+  soleur_op_env_upsert "$ENV_FILE" EXAMPLE_PROVISIONED "yes"
+  soleur_op_env_reset "$ENV_FILE" EXAMPLE_PROVISION_ATTEMPTED
+}
+
+# --- the dispatcher: one stage per invocation --------------------------------
+# Not a stage: the one place that applies the staged contract. A stage function
+# never gates itself and never prints a stage marker (a marker printed inside a
+# `$(...)` capture becomes the captured value).
+dispatch_stage() {
+  local stage="$1" class fn impact rollback flags="" n
+  if ! class="$(soleur_op_stage_field "${BASH_SOURCE[0]}" "$stage" 2)"; then
+    printf 'SOLEUR_BOOTSTRAP_UNKNOWN_STAGE stage=%s\n' "$stage"
+    printf 'That stage is not declared by this script. The stages are:\n'
+    soleur_op_list "${BASH_SOURCE[0]}"
+    exit 64
+  fi
+  fn="${stage//-/_}"
+  CURRENT_STAGE_INDEX=1; CURRENT_STAGE_NAME="$stage"; STAGE_CHANGED=""
+  soleur_op_stage_begin 1 "$stage"
+  case "$class" in
+    read)
+      "read_${fn}"
+      soleur_op_stage_ok "$stage" 0
+      ;;
+    write)
+      impact="$(soleur_op_stage_field "${BASH_SOURCE[0]}" "$stage" 3)"
+      rollback="$(soleur_op_stage_field "${BASH_SOURCE[0]}" "$stage" 4)"
+      [[ "$ROTATE_TOKEN" == "1" ]] && flags="rotate-token"
+      soleur_op_plan_begin
+      "plan_${fn}"
+      n="$(soleur_op_plan_count)"
+      if [[ "$APPLY" -ne 1 ]]; then
+        soleur_op_plan_emit "$SCRIPT_REAL" "$stage" "$ROTATE_TOKEN"
+        if [[ "$n" -eq 0 ]]; then soleur_op_stage_ok "$stage" 0; fi
+      elif [[ "$n" -eq 0 ]]; then
+        soleur_op_stage_ok "$stage" 0
+      else
+        if [[ -z "$PLAN_DIGEST" ]]; then
+          printf 'SOLEUR_BOOTSTRAP_PLAN_DIGEST_REQUIRED stage=%s\n' "$stage"
+          printf 'Run the stage without --apply first, then run the apply command exactly as the plan printed it.\n'
+          SOLEUR_OP_REFUSED=1
+          exit 64
+        fi
+        local computed
+        computed="$(soleur_op_plan_digest "$SCRIPT_REAL" "$stage" "$flags" "$impact" "$rollback")"
+        soleur_op_stage_gate "$SCRIPT_REAL" "$stage" "$computed" "$PLAN_DIGEST" "$impact" "$rollback" "${ORIG_ARGV[@]}"
+        "apply_${fn}"
+        soleur_op_stage_ok "$stage" 1 "$SOLEUR_OP_APPROVAL"
+      fi
+      ;;
+    *)
+      printf 'SOLEUR_BOOTSTRAP_UNKNOWN_STAGE stage=%s\n' "$stage"
+      exit 64
+      ;;
+  esac
+  soleur_op_stage_end 1 "$stage" ok 0
+  CURRENT_STAGE_INDEX=0; CURRENT_STAGE_NAME=""; STAGE_CHANGED=""
+}
+
+main() {
+  soleur_op_require_bins grep mktemp printenv sed date od id stat cut tr awk find
+  soleur_op_ledger_init 1 "bootstrap.sh"
+  dispatch_stage "$STAGE"
+}
+
+main "$@"