#!/usr/bin/env bash
# Track C (ADR 037) — SMSCode gated-verification workflow-profile reference.
# Enacts the sanitized SMSCode role/trait mapping into a session using ONLY the
# existing `zynk assign` overlay verbs. All overlays are operator-asserted (the
# asserter is structurally `operator`; never assign a trait with --subject
# operator -> no self-grant, ADR 024). Overlay-only => roster-only, zero feed
# rows (the gate/phase sequence is documented descriptively in
# examples/workflow-profiles/, not executed here). See
# examples/workflow-profiles/smscode-gated-verification.md.
set -euo pipefail

: "${ZYNK_BIN:?set ZYNK_BIN}"
: "${DB:?set DB}"
: "${ROOT:?set ROOT}"
: "${SESSION_ID:=s1}"

mkdir -p "$(dirname "$DB")" "$ROOT"
z() { "$ZYNK_BIN" "$@"; }
base=(--root "$ROOT" --db "$DB" --session-id "$SESSION_ID")

# actor-kind: the human operator (rendered distinctly), three agents.
z assign actor-kind "${base[@]}" --subject operator              --kind human
z assign actor-kind "${base[@]}" --subject implementer           --kind agent
z assign actor-kind "${base[@]}" --subject collaborative-reviewer --kind agent
z assign actor-kind "${base[@]}" --subject independent-verifier   --kind agent

# free-form roles (machine never reasons over the name; only labels render).
z assign role "${base[@]}" --subject operator              --role-id operator               --role-label "Operator"
z assign role "${base[@]}" --subject implementer           --role-id implementer            --role-label "Implementer"
z assign role "${base[@]}" --subject collaborative-reviewer --role-id collaborative-reviewer --role-label "Collaborative Reviewer"
z assign role "${base[@]}" --subject independent-verifier   --role-id independent-verifier   --role-label "Independent Verifier"

# integrity traits (operator-asserted, never self-granted). NOTE: the operator
# carries NO traits (asserter == operator, so a trait on operator would be a
# self-grant; and the operator's merge authority is structural, not a trait).
# can_merge_approve is intentionally NOT assigned here (ADR 036 D11): the
# verifier's APPROVE is a required gate, the operator is the merge authority.
z assign trait "${base[@]}" --subject implementer           --trait can_edit_source
z assign trait "${base[@]}" --subject collaborative-reviewer --trait can_verify_gate
z assign trait "${base[@]}" --subject independent-verifier   --trait independent
z assign trait "${base[@]}" --subject independent-verifier   --trait non_iterating
z assign trait "${base[@]}" --subject independent-verifier   --trait can_verify_gate

echo "SMSCode workflow-profile overlays applied to session ${SESSION_ID}."