thinkwork-cli 0.12.11 → 0.12.15

package/dist/terraform/modules/app/lambda-api/runtime-config.tf

@@ -0,0 +1,163 @@
+# ============================================================================
+# SSM runtime-config (plan 2026-06-11-006)
+#
+# All non-identity, non-secret configuration for the api handlers lives in
+# ONE terraform-owned SSM parameter per stage. Handlers read it once per
+# container through the AWS Parameters and Secrets Lambda Extension
+# (@thinkwork/runtime-config; env always wins over the document), so the
+# hard 4KB Lambda env quota (#2375) stops being a deploy-failure class.
+#
+# IAM: the existing ssm-param-read grant in aws_iam_policy.api_data_plane
+# (iam-grouped.tf) already grants ssm:GetParameter on
+# arn:...:parameter/thinkwork/<stage>/*, which covers this parameter,
+# and its secrets-manager grant covers the
+# Secrets Manager reads — no new grants are needed here. R9's inline→managed
+# consolidation happens in U6.
+# ============================================================================
+
+locals {
+  # AWS Parameters and Secrets Lambda Extension — an AWS-managed public
+  # layer whose publisher account id varies per region. Version 18 verified
+  # in each listed region on 2026-06-11 (aws lambda get-layer-version-by-arn).
+  # Regions not listed run without the layer: @thinkwork/runtime-config
+  # falls back to a one-shot SDK GetParameter/GetSecretValue (R5), so this
+  # map is an optimization, not a requirement. Bump the version here when
+  # AWS retires old layer versions.
+  parameters_secrets_extension_arns = {
+    us-east-1 = "arn:aws:lambda:us-east-1:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:18"
+    us-east-2 = "arn:aws:lambda:us-east-2:590474943231:layer:AWS-Parameters-and-Secrets-Lambda-Extension:18"
+    us-west-1 = "arn:aws:lambda:us-west-1:997803712105:layer:AWS-Parameters-and-Secrets-Lambda-Extension:18"
+    us-west-2 = "arn:aws:lambda:us-west-2:345057560386:layer:AWS-Parameters-and-Secrets-Lambda-Extension:18"
+    eu-west-1 = "arn:aws:lambda:eu-west-1:015030872274:layer:AWS-Parameters-and-Secrets-Lambda-Extension:18"
+  }
+
+  parameters_secrets_extension_arn = var.parameters_secrets_extension_layer_arn != "" ? var.parameters_secrets_extension_layer_arn : lookup(local.parameters_secrets_extension_arns, var.region, "")
+
+  api_handler_layers = local.parameters_secrets_extension_arn != "" ? [local.parameters_secrets_extension_arn] : []
+
+  # The document body: config-class common env + graphql-http's config-class
+  # extras. Secrets and identity never enter this map (R4) — it is a plain
+  # String parameter visible to anyone with ssm:GetParameter. Empty values
+  # (disabled features) are stripped: the loader treats "" as unset on both
+  # the env and document layers, so carrying them would only spend bytes.
+  runtime_config_document = {
+    for key, value in merge(
+      local.config_env,
+      local.graphql_http_config_env,
+    ) : key => value if value != ""
+  }
+}
+
+# ----------------------------------------------------------------------------
+# Platform secrets (plan 2026-06-11-006 U5/R4)
+#
+# API_AUTH_SECRET and APPSYNC_API_KEY leave plaintext Lambda env: the
+# runtime-config loader prefetches these at cold start (getApiAuthSecret /
+# getAppsyncApiKey accessors, env-wins during the transition window). Names
+# use the `thinkwork/${stage}/...` prefix so the shared role's existing
+# `secretsmanager:GetSecretValue` grant on `thinkwork/*` covers them.
+# The env copies in common_env are dropped one release AFTER this ships
+# (R8 two-release transition) so mid-apply old-code containers never lose
+# their env copy before the prefetch path exists.
+# ----------------------------------------------------------------------------
+
+resource "aws_secretsmanager_secret" "api_auth" {
+  name        = "thinkwork/${var.stage}/api-auth"
+  description = "Shared service-auth Bearer secret between platform services. Prefetched at Lambda cold start by @thinkwork/runtime-config."
+  tags = {
+    Name  = "thinkwork-${var.stage}-api-auth"
+    Stage = var.stage
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "api_auth" {
+  secret_id     = aws_secretsmanager_secret.api_auth.id
+  secret_string = var.api_auth_secret
+
+  # Track the var (no ignore_changes): var.api_auth_secret is authoritative
+  # — tfvars on dev, the controller runner on customer environments (which
+  # itself reuses this secret's previous value). Pinning the first value
+  # here let a runner-side rotation drift env away from Secrets Manager on
+  # TEI (v174 apply), which becomes a fleet-wide 401 once the env copy
+  # drops (R8). Rotation goes through tfvars / runner secrets, not the
+  # console.
+}
+
+resource "aws_secretsmanager_secret" "appsync_api_key" {
+  name        = "thinkwork/${var.stage}/appsync-api-key"
+  description = "AppSync API key for subscription notify fan-out. Prefetched at Lambda cold start by @thinkwork/runtime-config."
+  tags = {
+    Name  = "thinkwork-${var.stage}-appsync-api-key"
+    Stage = var.stage
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "appsync_api_key" {
+  secret_id     = aws_secretsmanager_secret.appsync_api_key.id
+  secret_string = var.appsync_api_key
+
+  # AppSync keys are terraform-rotated (the appsync module recreates them),
+  # so track the var here — unlike api_auth there is no operator rotation
+  # path outside terraform.
+}
+
+# The standalone compliance Lambdas (anchor, export-runner) bundle the
+# runtime-config loader but run under dedicated roles that lack the shared
+# role's ssm grant. Without these, every cold start auto-prime fails
+# AccessDenied and the loader retries on its 15s negative-cache cadence —
+# env-wins keeps them functional (their keys ride their own env blocks),
+# but the doomed GetParameter churn is noise worth closing.
+resource "aws_iam_role_policy" "compliance_anchor_runtime_config_read" {
+  count = local.deploy_lambda_handlers && var.compliance_anchor_lambda_role_name != "" ? 1 : 0
+  name  = "runtime-config-read"
+  role  = var.compliance_anchor_lambda_role_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["ssm:GetParameter"]
+      Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/runtime-config"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "compliance_exports_runner_runtime_config_read" {
+  count = local.deploy_lambda_handlers && var.compliance_exports_runner_role_name != "" ? 1 : 0
+  name  = "runtime-config-read"
+  role  = var.compliance_exports_runner_role_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["ssm:GetParameter"]
+      Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/runtime-config"
+    }]
+  })
+}
+
+resource "aws_ssm_parameter" "runtime_config" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name = "/thinkwork/${var.stage}/runtime-config"
+  type = "String"
+  # Advanced tier raises the value ceiling from 4KB (which would rebuild the
+  # exact quota we are escaping) to 8KB, at ~$0.05/mo per stage.
+  tier  = "Advanced"
+  value = jsonencode(local.runtime_config_document)
+
+  lifecycle {
+    precondition {
+      # Growth surfaces at plan time in CI, not as a runtime incident in a
+      # customer account. If this ever trips, split the document by concern
+      # — the loader's document-merge seam is the extension point.
+      condition     = length(jsonencode(local.runtime_config_document)) < 7168
+      error_message = "runtime-config document exceeds the 7KB plan-time ceiling (8KB advanced-tier hard limit). Split the document or prune keys — do not raise this limit casually."
+    }
+  }
+
+  tags = {
+    Name = "thinkwork-${var.stage}-runtime-config"
+  }
+}

package/dist/terraform/modules/app/lambda-api/slack-app-secrets.tf

@@ -20,6 +20,7 @@
 ################################################################################
 
 resource "aws_secretsmanager_secret" "slack_app_credentials" {
+  count       = var.enable_slack_workspace_app ? 1 : 0
   name        = "thinkwork/${var.stage}/slack/app"
   description = "Slack workspace app credentials (signing_secret, client_id, client_secret). Populate via Secrets Manager; never via tfvars."
   tags = {
@@ -30,7 +31,8 @@ resource "aws_secretsmanager_secret" "slack_app_credentials" {
 }
 
 resource "aws_secretsmanager_secret_version" "slack_app_credentials_initial" {
-  secret_id = aws_secretsmanager_secret.slack_app_credentials.id
+  count     = var.enable_slack_workspace_app ? 1 : 0
+  secret_id = aws_secretsmanager_secret.slack_app_credentials[0].id
   secret_string = jsonencode({
     signing_secret = ""
     client_id      = ""

package/dist/terraform/modules/app/lambda-api/stripe-secrets.tf

@@ -28,6 +28,7 @@
 ################################################################################
 
 resource "aws_secretsmanager_secret" "stripe_api_credentials" {
+  count       = var.enable_stripe_billing ? 1 : 0
   name        = "thinkwork/${var.stage}/stripe/api-credentials"
   description = "Stripe API credentials (secret_key, publishable_key, webhook_signing_secret). Populate via `aws secretsmanager put-secret-value`; never via tfvars."
   tags = {
@@ -38,7 +39,8 @@ resource "aws_secretsmanager_secret" "stripe_api_credentials" {
 }
 
 resource "aws_secretsmanager_secret_version" "stripe_api_credentials_initial" {
-  secret_id = aws_secretsmanager_secret.stripe_api_credentials.id
+  count     = var.enable_stripe_billing ? 1 : 0
+  secret_id = aws_secretsmanager_secret.stripe_api_credentials[0].id
   secret_string = jsonencode({
     secret_key             = ""
     publishable_key        = ""

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -61,6 +61,36 @@ variable "bucket_arn" {
   type        = string
 }
 
+variable "billing_export_bucket_name" {
+  description = "Optional S3 bucket containing AWS Data Exports/CUR 2.0 manifests for bill reconciliation. Empty leaves the scheduled reconciler in no-op mode; targeted invokes can still pass a manifest bucket."
+  type        = string
+  default     = ""
+}
+
+variable "billing_export_manifest_key" {
+  description = "Optional S3 key for the latest AWS billing export manifest to import on the scheduled bill reconciler run."
+  type        = string
+  default     = ""
+}
+
+variable "billing_reconciliation_tolerance_usd" {
+  description = "Absolute USD tolerance used when comparing ThinkWork projected aggregate spend to AWS billing export spend."
+  type        = number
+  default     = 0.01
+}
+
+variable "plugin_catalog_github_token_secret_arn" {
+  description = "Optional Secrets Manager ARN/name containing a GitHub token for plugin catalog release-asset fetches. Empty uses unauthenticated GitHub requests."
+  type        = string
+  default     = ""
+}
+
+variable "brain_artifacts_kms_key_arn" {
+  description = "Optional KMS key ARN used to encrypt canonical Company Brain artifacts. AES256 encryption is used when unset."
+  type        = string
+  default     = ""
+}
+
 variable "enable_workspace_orchestration" {
   description = "Enable S3 EventBridge/SQS routing for workspace file orchestration."
   type        = bool
@@ -153,6 +183,12 @@ variable "api_auth_secret" {
   default     = ""
 }
 
+variable "bootstrap_credential_lease_kms_key_id" {
+  description = "Optional KMS key ID or ARN used by Secrets Manager for temporary bootstrap credential leases. Empty uses the AWS-managed Secrets Manager key."
+  type        = string
+  default     = ""
+}
+
 variable "extension_proxy_backends_json" {
   description = "JSON map of enabled Admin extension ids to allowlisted backend base URLs. Example: {\"customer-module\":{\"baseUrl\":\"https://extension.example.com\"}}"
   type        = string
@@ -203,135 +239,185 @@ variable "agentcore_memory_id" {
 }
 
 variable "memory_engine" {
-  description = "Active long-term memory engine for this deployment. Exactly one engine is canonical for recall/inspect/export. Defaults to 'hindsight' for hosted ThinkWork; self-hosted/serverless deployments may choose 'agentcore'."
+  description = "Active long-term memory engine for this deployment. Exactly one engine is canonical for recall/inspect/export. Hosted ThinkWork may choose 'cognee' when the Company Brain substrate is enabled."
   type        = string
   default     = "hindsight"
   validation {
-    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
+    condition     = contains(["hindsight", "agentcore", "cognee"], var.memory_engine)
+    error_message = "memory_engine must be 'hindsight', 'agentcore', or 'cognee'."
   }
 }
 
-variable "agentcore_function_name" {
-  description = "AgentCore Lambda function name (for direct SDK invoke)"
+variable "cognee_enabled" {
+  description = "Whether the Cognee knowledge graph add-on is enabled for this deployment."
+  type        = bool
+  default     = false
+}
+
+variable "cognee_endpoint" {
+  description = "Internal Cognee API endpoint (empty when disabled)."
   type        = string
   default     = ""
 }
 
-variable "agentcore_flue_function_name" {
-  description = "Flue AgentCore Lambda function name (for direct SDK invoke); empty until the Flue runtime is provisioned for the stage."
+variable "cognee_log_group_name" {
+  description = "CloudWatch log group for Cognee (empty when disabled)."
   type        = string
   default     = ""
 }
 
-variable "agentcore_function_arn" {
-  description = "AgentCore Lambda function ARN (used to grant lambda:InvokeFunction)"
+variable "cognee_backend_mode" {
+  description = "Selected Cognee backend mode (empty when disabled)."
   type        = string
   default     = ""
 }
 
-variable "agentcore_flue_function_arn" {
-  description = "Flue AgentCore Lambda function ARN (used to grant lambda:InvokeFunction)"
+variable "cognee_cluster_arn" {
+  description = "ECS cluster ARN for Cognee (empty when disabled)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_cluster_name" {
-  description = "ECS cluster name for ThinkWork Computer runtime services"
+variable "cognee_service_name" {
+  description = "ECS service name for Cognee (empty when disabled)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_cluster_arn" {
-  description = "ECS cluster ARN for ThinkWork Computer runtime services"
+variable "cognee_worker_subnet_ids" {
+  description = "Subnet IDs for the Knowledge Graph ingest worker Lambda VPC attachment. Leave empty to deploy the worker without VPC access."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_worker_security_group_ids" {
+  description = "Security group IDs for the Knowledge Graph ingest worker Lambda VPC attachment. Leave empty to deploy the worker without VPC access."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_subnet_ids" {
+  description = "Subnet IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_security_group_ids" {
+  description = "Security group IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_mount_target_ids" {
+  description = "EFS mount target IDs that must exist before creating the OKF EFS hydrator Lambda."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_file_system_arn" {
+  description = "EFS file system ARN for the OKF wiki current view. Empty disables EFS IAM grants."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_efs_file_system_id" {
-  description = "Shared EFS file system ID for Computer live workspaces"
+variable "okf_efs_refresh_access_point_arn" {
+  description = "EFS access point ARN mounted by the okf-efs-refresh Lambda. Empty disables the mount."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_subnet_ids" {
-  description = "Subnets for Computer runtime ECS services"
-  type        = list(string)
-  default     = []
+variable "okf_efs_mount_path" {
+  description = "Local Lambda mount path for the OKF wiki EFS view. Must be under /mnt."
+  type        = string
+  default     = "/mnt/thinkwork-okf"
 }
 
-variable "computer_runtime_assign_public_ip" {
-  description = "ENABLED or DISABLED for Computer runtime ECS task public IP assignment"
+variable "observation_classifier_model_id" {
+  description = "Bedrock model id for the observations promotion-gate classifier. Empty uses the API default (pinned Haiku)."
   type        = string
-  default     = "DISABLED"
-  validation {
-    condition     = contains(["ENABLED", "DISABLED"], var.computer_runtime_assign_public_ip)
-    error_message = "computer_runtime_assign_public_ip must be ENABLED or DISABLED."
-  }
+  default     = ""
+}
+
+variable "twenty_provisioned" {
+  description = "Whether the Twenty CRM retained managed-app substrate is provisioned."
+  type        = bool
+  default     = false
+}
+
+variable "twenty_runtime_enabled" {
+  description = "Whether the Twenty CRM server/worker runtime is enabled."
+  type        = bool
+  default     = false
 }
 
-variable "computer_runtime_task_sg_id" {
-  description = "Security group for Computer runtime ECS tasks"
+variable "twenty_url" {
+  description = "Public Twenty CRM URL (empty when not provisioned)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_execution_role_arn" {
-  description = "ECS execution role ARN for Computer runtime tasks"
+variable "twenty_alb_arn" {
+  description = "Public Twenty ALB ARN (empty when not provisioned)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_task_role_arn" {
-  description = "ECS task role ARN for Computer runtime tasks"
+variable "twenty_target_group_arn" {
+  description = "Twenty server target group ARN (empty when not provisioned)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_log_group_name" {
-  description = "CloudWatch log group for Computer runtime tasks"
+variable "twenty_cluster_arn" {
+  description = "ECS cluster ARN for Twenty (empty when not provisioned)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_repository_url" {
-  description = "ECR repository URL for the Computer runtime image"
+variable "twenty_server_service_name" {
+  description = "ECS service name for the Twenty server (empty when not provisioned)."
   type        = string
   default     = ""
 }
 
-variable "computer_runtime_default_cpu" {
-  description = "Default Fargate CPU units for Computer runtime tasks"
-  type        = number
-  default     = 256
+variable "twenty_worker_service_name" {
+  description = "ECS service name for the Twenty worker (empty when not provisioned)."
+  type        = string
+  default     = ""
 }
 
-variable "computer_runtime_default_memory" {
-  description = "Default Fargate memory MB for Computer runtime tasks"
-  type        = number
-  default     = 512
+variable "twenty_server_log_group_name" {
+  description = "CloudWatch log group for the Twenty server (empty when not provisioned)."
+  type        = string
+  default     = ""
 }
 
-variable "computer_runtime_manager_policy_arn" {
-  description = "IAM policy ARN granting Computer manager access to ECS/EFS runtime resources"
+variable "twenty_worker_log_group_name" {
+  description = "CloudWatch log group for the Twenty worker (empty when not provisioned)."
   type        = string
   default     = ""
 }
 
-variable "workspace_admin_efs_access_point_arn" {
-  description = "Shared EFS access point ARN consumed by the workspace-files-efs Lambda. Rooted at /tenants on the Computer runtime EFS file system so a single Lambda can resolve any (tenantId, computerId) at request time."
+variable "agentcore_pi_function_name" {
+  description = "Pi AgentCore Lambda function name (for direct SDK invoke); empty until the Pi runtime is provisioned for the stage."
   type        = string
   default     = ""
 }
 
-variable "workspace_admin_lambda_sg_id" {
-  description = "Security group ID assigned to the workspace-files-efs Lambda. Allowed NFS into the Computer runtime EFS security group via a sibling ingress rule defined in the computer-runtime module."
+variable "agentcore_pi_function_arn" {
+  description = "Pi AgentCore Lambda function ARN (used to grant lambda:InvokeFunction)"
   type        = string
   default     = ""
 }
 
+variable "enable_agentcore_pi_invoke_policy" {
+  description = "Create the API Lambda IAM policy that permits invoking the Pi AgentCore Lambda."
+  type        = bool
+  default     = false
+}
+
 variable "admin_url" {
-  description = "Admin app URL (e.g. https://d3li9vbqnhv7w.cloudfront.net)"
+  description = "Deprecated compatibility input for the unified web app URL (e.g. https://app.thinkwork.ai)."
   type        = string
   default     = ""
 }
@@ -354,12 +440,24 @@ variable "stripe_price_ids_json" {
   default     = "{}"
 }
 
+variable "enable_stripe_billing" {
+  description = "Provision Stripe billing Lambdas, API routes, and credentials placeholder secret."
+  type        = bool
+  default     = true
+}
+
 variable "stripe_welcome_from_email" {
   description = "Override From: address on the Stripe post-checkout welcome email. Must be an SES-verified identity. Empty string falls back to the in-code default (hello@agents.thinkwork.ai, which uses the already-verified SES inbound domain). Set to hello@thinkwork.ai once the bare-apex sender identity is verified."
   type        = string
   default     = ""
 }
 
+variable "enable_slack_workspace_app" {
+  description = "Provision Slack workspace app Lambdas, API routes, and credentials placeholder secret."
+  type        = bool
+  default     = true
+}
+
 variable "appsync_realtime_url" {
   description = "AppSync realtime/WebSocket endpoint URL"
   type        = string
@@ -372,6 +470,18 @@ variable "ecr_repository_url" {
   default     = ""
 }
 
+variable "ecr_repository_provisioned" {
+  description = "Static flag: an ECR repository exists for image-based handlers AND their image tags are seeded (CI pushes skill-trust-runner-latest for repo-managed stages). count cannot depend on the repository URL attribute (unknown until apply in fresh accounts)."
+  type        = bool
+  default     = false
+}
+
+variable "manage_bedrock_invocation_logging" {
+  description = "Own the account/region-scoped Bedrock model-invocation logging resources (log group, IAM role, account logging configuration). Only one stage per account+region may set this — the log group name is deliberately stage-neutral."
+  type        = bool
+  default     = true
+}
+
 variable "cors_allowed_origins" {
   description = "Allowed CORS origins for the API Gateway. Use [\"*\"] for development."
   type        = list(string)
@@ -396,6 +506,24 @@ variable "company_brain_source_agent_model_id" {
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
+variable "company_brain_backdoor_install_key_secret_arn" {
+  description = "Optional Secrets Manager ARN containing the temporary Company Brain backdoor install key. Empty disables the backdoor. The raw key is never stored in tfvars or the runtime-config document."
+  type        = string
+  default     = ""
+}
+
+variable "company_brain_backdoor_install_key_stages" {
+  description = "Comma-separated stage allowlist for the temporary Company Brain backdoor install key. Both this value and company_brain_backdoor_install_key_secret_arn must be set for deployed backdoor redemption."
+  type        = string
+  default     = ""
+}
+
+variable "kg_obs_max_candidates_per_run" {
+  description = "Per-run candidate cap for the observations → Knowledge Graph ingest worker (KG_OBS_MAX_CANDIDATES_PER_RUN). Bounds the layered-gate classifier cost AND keeps each Cognee cognify small enough to index within budget on the single dogfood task; truncated runs self-invoke to drain the remaining backlog. Stored as a string because the Lambda reads it verbatim from env."
+  type        = string
+  default     = "10"
+}
+
 variable "wiki_aggregation_pass_enabled" {
   description = "Feature flag for the wiki aggregation pass (parent section rollups + section promotion). Pipeline stops after leaf compile when this is off and never populates hub rollups. Stored as a string because the Lambda reads it verbatim from env; must be 'true' / '1' / 'yes' to enable."
   type        = string
@@ -408,6 +536,17 @@ variable "wiki_deterministic_linking_enabled" {
   default     = "true"
 }
 
+variable "wiki_source" {
+  description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer over the knowledge-graph mirror and makes successful observation-ingest runs the compile trigger. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
+  type        = string
+  default     = "planner"
+
+  validation {
+    condition     = contains(["planner", "graph"], var.wiki_source)
+    error_message = "wiki_source must be 'planner' or 'graph'."
+  }
+}
+
 variable "google_places_api_key" {
   description = "Google Places API (New) key used by wiki-compile for POI → city/state/country hierarchy enrichment. Stored as a SecureString SSM parameter at /thinkwork/<stage>/google-places/api-key. Empty default creates the parameter with a placeholder value; operator populates via `aws ssm put-parameter --overwrite`. The parameter's value has lifecycle.ignore_changes set so CLI rotation sticks across terraform applies. Compile gracefully degrades when the key is absent (metadata-only place rows) — never fails compile."
   type        = string
@@ -482,6 +621,42 @@ variable "routines_log_group_arn" {
   default     = ""
 }
 
+variable "deployment_state_machine_arn" {
+  description = "ARN of the GitHub-free deployment orchestration state machine. Passed to deployment-sessions and graphql-http so Settings can start release updates."
+  type        = string
+  default     = ""
+}
+
+variable "deployment_control_plane_enabled" {
+  description = "Whether deployment control-plane routes and handlers should be provisioned. Kept separate from deployment_state_machine_arn because the ARN may be apply-time unknown."
+  type        = bool
+  default     = false
+}
+
+variable "deployment_evidence_bucket" {
+  description = "S3 bucket name that stores deployment runner evidence. Passed to deployment-sessions and graphql-http so Settings can report release update evidence."
+  type        = string
+  default     = ""
+}
+
+variable "deployment_release_version" {
+  description = "Selected ThinkWork release version used for managed application deployment jobs."
+  type        = string
+  default     = "unresolved"
+}
+
+variable "deployment_release_manifest_url" {
+  description = "Selected ThinkWork release manifest URL used for managed application deployment jobs."
+  type        = string
+  default     = ""
+}
+
+variable "deployment_release_manifest_sha256" {
+  description = "Selected ThinkWork release manifest SHA-256 used for managed application deployment jobs."
+  type        = string
+  default     = ""
+}
+
 # ---------------------------------------------------------------------------
 # Phase 3 U4 — compliance-outbox-drainer Aurora credentials
 # ---------------------------------------------------------------------------
@@ -587,3 +762,15 @@ variable "compliance_exports_runner_role_name" {
   type        = string
   default     = ""
 }
+
+variable "knowledge_graph_tool_enabled" {
+  description = "Stage gate for the Pi knowledge_graph_search tool (plan 2026-06-09-004 U8). Per-agent tool policy gates on top."
+  type        = bool
+  default     = true
+}
+
+variable "parameters_secrets_extension_layer_arn" {
+  description = "Override for the AWS Parameters and Secrets Lambda Extension layer ARN. Empty uses the per-region map in runtime-config.tf; regions absent from the map run without the layer (the runtime-config loader falls back to SDK reads)."
+  type        = string
+  default     = ""
+}

package/dist/terraform/modules/app/lambda-api/workspace-events.tf

@@ -98,28 +98,5 @@ resource "aws_lambda_event_source_mapping" "workspace_event_dispatcher" {
   }
 }
 
-resource "aws_iam_role_policy" "lambda_workspace_events_sqs" {
-  count = local.workspace_event_enabled ? 1 : 0
-
-  name = "thinkwork-${var.stage}-lambda-workspace-events-sqs"
-  role = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes",
-          "sqs:ChangeMessageVisibility",
-        ]
-        Resource = concat(
-          [for q in aws_sqs_queue.workspace_event : q.arn],
-          [for q in aws_sqs_queue.workspace_event_dlq : q.arn],
-        )
-      },
-    ]
-  })
-}
+# The shared-role workspace-event SQS receive grants moved to
+# aws_iam_policy.api_data_plane in iam-grouped.tf (R9).