thinkwork-cli 0.12.12 → 0.12.15

package/dist/terraform/modules/app/deployment-control-plane/variables.tf

@@ -0,0 +1,96 @@
+variable "stage" {
+  description = "Deployment stage (for example dev or prod)."
+  type        = string
+}
+
+variable "account_id" {
+  description = "AWS account ID that owns the deployment control plane."
+  type        = string
+}
+
+variable "region" {
+  description = "AWS region for control-plane resources."
+  type        = string
+}
+
+variable "release_version" {
+  description = "Selected ThinkWork release version."
+  type        = string
+}
+
+variable "release_manifest_url" {
+  description = "Selected ThinkWork release manifest URL."
+  type        = string
+}
+
+variable "release_manifest_sha256" {
+  description = "Selected ThinkWork release manifest SHA-256 digest."
+  type        = string
+}
+
+variable "release_manifest_signature_url" {
+  description = "Optional selected ThinkWork release manifest detached signature URL."
+  type        = string
+  default     = ""
+}
+
+variable "release_manifest_trust_policy" {
+  description = "Release manifest trust policy: allow_unsigned_canary for dogfood canaries, or require_signature for customer-safe runs."
+  type        = string
+  default     = "allow_unsigned_canary"
+
+  validation {
+    condition     = contains(["allow_unsigned_canary", "require_signature"], var.release_manifest_trust_policy)
+    error_message = "release_manifest_trust_policy must be allow_unsigned_canary or require_signature."
+  }
+}
+
+variable "release_manifest_trusted_keys_json" {
+  description = "JSON array of trusted release signing keys: [{\"keyId\":\"...\",\"publicKeyPem\":\"...\"}]."
+  type        = string
+  default     = "[]"
+
+  validation {
+    condition     = can(jsondecode(var.release_manifest_trusted_keys_json))
+    error_message = "release_manifest_trusted_keys_json must be valid JSON."
+  }
+}
+
+variable "terraform_state_bucket" {
+  description = "Customer-owned S3 bucket that stores the ThinkWork app Terraform state."
+  type        = string
+}
+
+variable "terraform_lock_table" {
+  description = "Customer-owned DynamoDB table used for Terraform state locking."
+  type        = string
+}
+
+variable "release_artifact_bucket" {
+  description = "Customer-owned S3 bucket where the runner stages release Lambda artifacts for Terraform."
+  type        = string
+}
+
+variable "terraform_module_source" {
+  description = "Terraform Registry source for the ThinkWork composite module."
+  type        = string
+  default     = "thinkwork-ai/thinkwork/aws"
+}
+
+variable "terraform_module_version" {
+  description = "Terraform Registry module version to deploy. Defaults to release_version when empty."
+  type        = string
+  default     = ""
+}
+
+variable "log_retention_days" {
+  description = "CloudWatch log retention for deployment runner logs."
+  type        = number
+  default     = 30
+}
+
+variable "create_secret_placeholders" {
+  description = "Create placeholder Secrets Manager values for bootstrap-managed deployment secrets. Values are ignored after creation."
+  type        = bool
+  default     = true
+}

package/dist/terraform/modules/app/hindsight-memory/README.md

@@ -1,18 +1,18 @@
-# Hindsight Memory Module (optional add-on)
+# Hindsight Memory Module (canonical user and Space memory)
 
-Thinkwork has two long-term memory systems. **AgentCore managed memory is
-always on** — every agent gets automatic per-turn retention out of the box
-with zero configuration. **Hindsight is an optional add-on** you can layer
-on top for advanced semantic + entity-graph retrieval.
+Thinkwork provisions AgentCore managed memory as an AWS platform primitive, but
+full ThinkWork installs use **Hindsight** as the canonical user and Space memory
+provider. AgentCore-only memory remains available as an explicit
+low-cost/development opt-out.
 
 ## Memory layers
 
-| Layer | Backend | Always on | What it stores |
-|-------|---------|-----------|----------------|
-| 1. Workspace files | S3 per-agent | Yes | Scratchpad, working files |
-| 2. Thread history | Aurora `messages` table | Yes | Last 30 turns per thread |
-| 3a. Managed long-term | AgentCore Memory | **Yes** | Semantic facts, preferences, summaries, episodes — extracted automatically from every turn |
-| 3b. Hindsight long-term | Hindsight ECS service | **Optional** | Same purpose as 3a, plus entity graph + BM25 + cross-encoder reranking |
+| Layer                 | Backend                 | Always on                     | What it stores                                                                 |
+| --------------------- | ----------------------- | ----------------------------- | ------------------------------------------------------------------------------ |
+| 1. Workspace files    | S3 per-agent            | Yes                           | Scratchpad, working files                                                      |
+| 2. Thread history     | Aurora `messages` table | Yes                           | Last 30 turns per thread                                                       |
+| 3a. Managed long-term | AgentCore Memory        | **Yes**                       | AWS platform memory primitive and low-cost/development fallback                |
+| 3b. Product long-term | Hindsight ECS service   | **Default for full installs** | Canonical user/Space memory with entity graph + BM25 + cross-encoder reranking |
 
 ## How retention works
 
@@ -37,35 +37,36 @@ so explicit memories land in both systems.
 
 ## Usage
 
-### Default — managed memory only (zero config)
+### Default — Hindsight canonical memory
 
 ```hcl
 module "thinkwork" {
   source = "thinkwork-ai/thinkwork/aws"
 
   stage = "prod"
-  # enable_hindsight defaults to false — nothing else to set
+  # enable_hindsight defaults to true
 }
 ```
 
-The `terraform/modules/app/agentcore-memory` module is always instantiated
-and provisions the AgentCore Memory resource with the four strategies.
+The `terraform/modules/app/agentcore-memory` module is still instantiated, but
+the active user/Space memory engine resolves to Hindsight.
 
-### With the Hindsight add-on
+### Low-cost/development AgentCore-only opt-out
 
 ```hcl
 module "thinkwork" {
   source = "thinkwork-ai/thinkwork/aws"
 
   stage            = "prod"
-  enable_hindsight = true
+  enable_hindsight = false
+  memory_engine    = "agentcore"
 
-  # Optional: pin the Hindsight image version
-  # hindsight_image_tag = "0.5.0"
+  # This is not the full product memory path.
 }
 ```
 
 When `enable_hindsight = true`, Terraform creates:
+
 - ECS Fargate cluster + service (ARM64, 2 vCPU, 4 GB)
 - Application Load Balancer
 - Security groups (ALB → Hindsight → Aurora ingress)
@@ -73,15 +74,16 @@ When `enable_hindsight = true`, Terraform creates:
 
 Cost: ~$75/mo (ARM64 Fargate + ALB hours).
 
-## Turning the add-on on/off
+## Turning Hindsight on/off
 
 Toggling `enable_hindsight` and re-running `thinkwork deploy`:
 
 - **false → true**: creates the ECS + ALB infra. Agents gain the three
-  `hindsight_*` tools on their next invoke. Managed retention continues
-  running unchanged.
+  `hindsight_*` tools on their next invoke. The active memory engine resolves
+  to Hindsight when `memory_engine` is empty.
 - **true → false**: destroys the ECS + ALB infra. Agents lose the
-  `hindsight_*` tools. Managed memory keeps working as before.
+  `hindsight_*` tools. This should be paired with `memory_engine = "agentcore"`
+  for explicit low-cost/development deployments.
 
 Memory data is not migrated between backends. Hindsight records and
 AgentCore records live in separate stores.

package/dist/terraform/modules/app/hindsight-memory/main.tf

@@ -39,6 +39,24 @@ variable "image_tag" {
   default     = "0.5.0"
 }
 
+variable "enable_auto_consolidation" {
+  description = "Run Hindsight's observation consolidation engine automatically after retain. Service-level default; per-bank config overrides apply on top."
+  type        = bool
+  default     = true
+}
+
+variable "consolidation_dedup_threshold" {
+  description = "Cosine-similarity threshold for near-duplicate observation reconciliation (0.0-1.0; 1.0 disables). Hindsight default is 0.97 — set explicitly so deploys don't drift with image defaults."
+  type        = string
+  default     = "0.97"
+}
+
+variable "observations_mission" {
+  description = "Service-level default observations mission steering what consolidation synthesizes. Empty string omits the env var so the image default applies. Per-bank overrides apply on top."
+  type        = string
+  default     = "Synthesize durable, institutional facts about the business: customers, projects, decisions, processes, tools, relationships, and recurring patterns. Filter out ephemeral state, secrets, and personal small talk."
+}
+
 data "aws_region" "current" {}
 
 ################################################################################
@@ -250,7 +268,7 @@ resource "aws_ecs_task_definition" "hindsight" {
       protocol      = "tcp"
     }]
 
-    environment = [
+    environment = concat([
       { name = "HINDSIGHT_API_DATABASE_URL", value = var.database_url },
       { name = "HINDSIGHT_API_DATABASE_SCHEMA", value = "hindsight" },
       { name = "HINDSIGHT_API_VECTOR_EXTENSION", value = "pgvector" },
@@ -273,7 +291,13 @@ resource "aws_ecs_task_definition" "hindsight" {
       { name = "HINDSIGHT_API_RECALL_BUDGET_FUNCTION", value = "adaptive" },
       { name = "HINDSIGHT_API_RECALL_BUDGET_MIN", value = "5" },
       { name = "HINDSIGHT_API_RECALL_BUDGET_MAX", value = "300" },
-    ]
+      { name = "HINDSIGHT_API_ENABLE_AUTO_CONSOLIDATION", value = tostring(var.enable_auto_consolidation) },
+      { name = "HINDSIGHT_API_CONSOLIDATION_DEDUP_THRESHOLD", value = var.consolidation_dedup_threshold },
+      ],
+      var.observations_mission != "" ? [
+        { name = "HINDSIGHT_API_OBSERVATIONS_MISSION", value = var.observations_mission },
+      ] : [],
+    )
 
     logConfiguration = {
       logDriver = "awslogs"

package/dist/terraform/modules/app/lambda-api/eval-fanout.tf

@@ -2,10 +2,22 @@
 # Evals per-case fan-out substrate
 #
 # eval-runner dispatches one message per test case. eval-worker catches
-# application-level case failures and writes eval_results.status='error';
-# infrastructure failures redrive through SQS to the DLQ after maxReceiveCount=3.
+# application-level case failures and writes eval_results.status='error'
+# (with an error_cause); throttling errors redrive through SQS within the
+# redrive budget below. On the final receive the worker records
+# error/throttle instead of rethrowing, so the DLQ only sees messages from
+# crashes that prevented any result write.
 # ---------------------------------------------------------------------------
 
+locals {
+  # Single source of truth for the fan-out retry budget. Feeds BOTH the
+  # queue's redrive policy maxReceiveCount AND the eval-worker's
+  # EVAL_FANOUT_MAX_RECEIVE_COUNT env var (handlers.tf), so the worker's
+  # final-receive detection can never drift from the queue's actual
+  # redrive behavior.
+  eval_fanout_max_receive_count = 5
+}
+
 resource "aws_sqs_queue" "eval_fanout_dlq" {
   count                     = local.deploy_lambda_handlers ? 1 : 0
   name                      = "thinkwork-${var.stage}-eval-fanout-dlq.fifo"
@@ -29,7 +41,7 @@ resource "aws_sqs_queue" "eval_fanout" {
 
   redrive_policy = jsonencode({
     deadLetterTargetArn = aws_sqs_queue.eval_fanout_dlq[0].arn
-    maxReceiveCount     = 5
+    maxReceiveCount     = local.eval_fanout_max_receive_count
   })
 
   tags = {
@@ -37,53 +49,8 @@ resource "aws_sqs_queue" "eval_fanout" {
   }
 }
 
-resource "aws_iam_role_policy" "eval_fanout_send" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-  name  = "eval-fanout-send"
-  role  = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Sid    = "EvalRunnerSendFanoutMessages"
-      Effect = "Allow"
-      Action = [
-        "sqs:SendMessage",
-        "sqs:SendMessageBatch",
-      ]
-      Resource = aws_sqs_queue.eval_fanout[0].arn
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "eval_worker_sqs" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-  name  = "eval-worker-sqs"
-  role  = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "EvalWorkerReceiveFanoutMessages"
-        Effect = "Allow"
-        Action = [
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes",
-          "sqs:ChangeMessageVisibility",
-        ]
-        Resource = aws_sqs_queue.eval_fanout[0].arn
-      },
-      {
-        Sid      = "EvalWorkerSendDlqMessages"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.eval_fanout_dlq[0].arn
-      },
-    ]
-  })
-}
+# The shared-role eval-fanout SQS grants (send + worker receive/DLQ) moved to
+# aws_iam_policy.api_data_plane in iam-grouped.tf (R9).
 
 resource "aws_lambda_event_source_mapping" "eval_fanout" {
   count = local.deploy_lambda_handlers ? 1 : 0