thinkwork-cli 0.12.12 → 0.12.16

package/dist/terraform/modules/app/agentcore-memory/scripts/create_or_find_memory.sh

@@ -191,15 +191,46 @@ if [[ -n "$execution_role_arn" ]]; then
   role_arg="--memory-execution-role-arn $execution_role_arn"
 fi
 
-create_output="$(
-  aws bedrock-agentcore-control create-memory \
-    --region "$region" \
-    --name "$name" \
-    --memory-strategies "$strategies_json" \
-    --event-expiry-duration 365 \
-    $role_arg \
-    --output json
-)"
+# CreateMemory validates the execution role's trust policy at call time. When
+# Terraform created that role moments earlier in the same apply, IAM has not
+# propagated yet and the API rejects it with ValidationException "Please
+# provide a role with a valid trust policy" — empirically for ~20s after role
+# creation (harness cycle-5 ledger entry). Retry that specific error with a
+# bounded backoff; every other error fails immediately.
+create_output=""
+create_status=1
+err_file="$(mktemp)"
+trap 'rm -f "$err_file"' EXIT
+for attempt in $(seq 1 12); do
+  set +e
+  create_output="$(
+    aws bedrock-agentcore-control create-memory \
+      --region "$region" \
+      --name "$name" \
+      --memory-strategies "$strategies_json" \
+      --event-expiry-duration 365 \
+      $role_arg \
+      --output json 2>"$err_file"
+  )"
+  create_status=$?
+  set -e
+  if [[ $create_status -eq 0 ]]; then
+    break
+  fi
+  if grep -qi "valid trust policy" "$err_file"; then
+    echo "[create_or_find_memory] attempt $attempt: execution role not yet visible to AgentCore (IAM propagation); retrying in 15s" >&2
+    sleep 15
+    continue
+  fi
+  cat "$err_file" >&2
+  exit "$create_status"
+done
+
+if [[ $create_status -ne 0 ]]; then
+  echo "[create_or_find_memory] create-memory still failing after $attempt attempts:" >&2
+  cat "$err_file" >&2
+  exit "$create_status"
+fi
 
 new_id="$(echo "$create_output" | jq -r '.memory.id // .id')"
 

package/dist/terraform/modules/app/agentcore-pi/README.md

@@ -0,0 +1,61 @@
+# `agentcore-pi` — Pi agent runtime
+
+Provisions the **Pi** agent runtime as a Lambda+LWA function (Plan §005 U2).
+
+This module owns the dedicated Pi Lambda + log group + IAM role + event-invoke config. Shared AgentCore platform resources live in `../agentcore-platform`.
+
+## Resources owned
+
+- `aws_iam_role.agentcore_pi` (`thinkwork-${stage}-agentcore-pi-role`) — assumed by Lambda + Bedrock AgentCore Runtime principals.
+- `aws_iam_role_policy.agentcore_pi` — baseline permissions (S3 skill catalog, Bedrock model invoke, AgentCore Memory + Code Interpreter, CloudWatch Logs, X-Ray ingestion, ECR pull, SSM parameter access, memory-retain Lambda invoke). Forward-compat additions for U4-U8: Aurora Data API + Secrets Manager scoped to `thinkwork-${stage}-*`.
+- `aws_iam_role_policy_attachment.agentcore_pi_vpc_access` — attached when Pi needs private-network access for Company Brain/Cognee direct MCP or the OKF EFS mount.
+- `aws_iam_role_policy.agentcore_pi_dlq_send` — `sqs:SendMessage` against the shared async DLQ (injected via `var.async_dlq_arn`).
+- `aws_cloudwatch_log_group.agentcore_pi` (`/thinkwork/${stage}/agentcore-pi`).
+- `aws_lambda_function.agentcore_pi` (`thinkwork-${stage}-agentcore-pi`) — `package_type = "Image"`, pulls `${ecr_repository_url}:pi-latest`.
+- `aws_lambda_function_event_invoke_config.agentcore_pi` — `MaximumRetryAttempts=0`, on-failure → shared DLQ.
+
+## Resources NOT owned (injected via inputs)
+
+- **ECR repository** — shared AgentCore image repository (`thinkwork-${stage}-agentcore`). Pi pulls the `pi-latest` / `${sha}-pi` image tags from this repo. Owned by `../agentcore-platform`; URL injected via `var.ecr_repository_url`.
+- **Async DLQ** — shared AgentCore async failure queue. Owned by `../agentcore-platform`; ARN injected via `var.async_dlq_arn`.
+
+## State migration
+
+The dedicated runtime previously shipped as Flue. The migration renamed that module and runtime identity back to Pi via `moved {}` blocks declared in the parent composition (`terraform/modules/thinkwork/main.tf`):
+
+```hcl
+moved {
+  from = module.agentcore_flue.aws_lambda_function.agentcore_flue
+  to   = module.agentcore_pi.aws_lambda_function.agentcore_pi
+}
+# (and the analogous moves for the log group + event-invoke config + IAM role)
+```
+
+The Lambda function name changes from `thinkwork-${stage}-agentcore-flue` to `thinkwork-${stage}-agentcore-pi`, so apply the runtime/data migration as part of the same release window.
+
+## Inputs
+
+| Variable              | Required | Purpose                                                                        |
+| --------------------- | -------- | ------------------------------------------------------------------------------ |
+| `stage`               | yes      | Deployment stage (e.g., `dev`, `prod`).                                        |
+| `account_id`          | yes      | AWS account ID (used in IAM resource ARNs).                                    |
+| `region`              | yes      | AWS region.                                                                    |
+| `bucket_name`         | yes      | Primary S3 bucket for skills + workspace files.                                |
+| `ecr_repository_url`  | yes      | Shared ECR repo URL from `module.agentcore_platform.ecr_repository_url`.       |
+| `async_dlq_arn`       | yes      | Shared async DLQ ARN from `module.agentcore_platform.agentcore_async_dlq_arn`. |
+| `hindsight_endpoint`  | no       | Hindsight API endpoint when enabled; empty disables Hindsight tools.           |
+| `agentcore_memory_id` | no       | AgentCore Memory resource ID for auto-retention.                               |
+| `api_endpoint`        | no       | API Gateway base URL for the `/api/skills/complete` callback.                  |
+| `api_auth_secret`     | no       | Service-auth bearer for the same callback.                                     |
+| `memory_engine`       | no       | `hindsight` or `agentcore`; surfaced as `MEMORY_ENGINE` env var.               |
+| `cognee_subnet_ids`   | no       | Private subnets for direct Company Brain/Cognee MCP access.                    |
+| `cognee_security_group_ids` | no | Security groups allowed to reach the internal Company Brain/Cognee endpoint.    |
+
+## Outputs
+
+| Output                | Purpose                                                                                    |
+| --------------------- | ------------------------------------------------------------------------------------------ |
+| `pi_function_name`    | Direct SDK invoke target (passed to `chat-agent-invoke` as `AGENTCORE_PI_FUNCTION_NAME`).  |
+| `pi_function_arn`     | Granted to `chat-agent-invoke`'s `lambda:InvokeFunction` policy.                           |
+| `pi_runtime_role_arn` | Assumed by the Bedrock AgentCore Runtime when Pi is invoked via the Bedrock control plane. |
+| `pi_log_group_name`   | Scrubber + operator inspection target.                                                     |

package/dist/terraform/modules/app/agentcore-pi/main.tf

@@ -0,0 +1,466 @@
+################################################################################
+# AgentCore Pi — App Module
+#
+# Plan §005 U2 — provisions the Pi agent runtime as a Lambda+LWA function.
+#
+# Layout note: this module owns the IAM role, log group, Lambda function, and
+# event-invoke config that are unique to Pi. Shared AgentCore platform
+# resources are injected via input variables; the IAM policy here grants
+# `sqs:SendMessage` against the shared DLQ ARN.
+#
+# State migration: the resources here previously lived inside `module.agentcore`
+# (the legacy runtime module) under the address `aws_*.agentcore_pi`. The
+# parent module's `moved {}` blocks realign state across modules without
+# destroy+create on the underlying AWS resources.
+################################################################################
+
+# memory-retain Lambda name + ARN are constructed locally rather than
+# taken as inputs to avoid a circular dependency: the lambda-api module
+# already consumes this module's output (agentcore_pi_function_name/arn).
+locals {
+  memory_retain_fn_name       = "thinkwork-${var.stage}-api-memory-retain"
+  memory_retain_fn_arn        = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.memory_retain_fn_name}"
+  chat_agent_finalize_fn_name = "thinkwork-${var.stage}-api-chat-agent-finalize"
+  chat_agent_finalize_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_finalize_fn_name}"
+  chat_agent_activity_fn_name = "thinkwork-${var.stage}-api-chat-agent-activity"
+  chat_agent_activity_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_activity_fn_name}"
+  manifest_log_fn_name        = "thinkwork-${var.stage}-api-manifest-log"
+  manifest_log_fn_arn         = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.manifest_log_fn_name}"
+  pi_image_uri                = "${var.ecr_repository_url}:pi-latest"
+  cognee_vpc_enabled          = length(var.cognee_subnet_ids) > 0 && length(var.cognee_security_group_ids) > 0
+  okf_efs_vpc_enabled         = var.okf_efs_enabled && length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
+  private_vpc_enabled         = local.cognee_vpc_enabled || local.okf_efs_vpc_enabled
+  private_subnet_ids          = distinct(concat(var.cognee_subnet_ids, var.okf_efs_subnet_ids))
+  private_security_group_ids = distinct(concat(
+    var.cognee_security_group_ids,
+    var.okf_efs_security_group_ids,
+  ))
+  okf_efs_mount_enabled = local.okf_efs_vpc_enabled && var.okf_efs_file_system_arn != "" && var.okf_efs_read_access_point_arn != ""
+  okf_efs_iam_statements = local.okf_efs_mount_enabled ? [
+    {
+      Sid      = "OkfWikiEfsReadOnlyMount"
+      Effect   = "Allow"
+      Action   = ["elasticfilesystem:ClientMount"]
+      Resource = var.okf_efs_file_system_arn
+      Condition = {
+        StringEquals = {
+          "elasticfilesystem:AccessPointArn" = var.okf_efs_read_access_point_arn
+        }
+      }
+    },
+  ] : []
+}
+
+################################################################################
+# Execution Role
+################################################################################
+
+resource "aws_iam_role" "agentcore_pi" {
+  name = "thinkwork-${var.stage}-agentcore-pi-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = ["ecs-tasks.amazonaws.com", "lambda.amazonaws.com", "bedrock-agentcore.amazonaws.com"] }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = {
+    Name = "thinkwork-${var.stage}-agentcore-pi-role"
+  }
+}
+
+resource "aws_iam_role_policy" "agentcore_pi" {
+  name = "agentcore-pi-permissions"
+  role = aws_iam_role.agentcore_pi.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat([
+      {
+        Sid    = "S3Access"
+        Effect = "Allow"
+        Action = ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
+        Resource = [
+          "arn:aws:s3:::${var.bucket_name}",
+          "arn:aws:s3:::${var.bucket_name}/*",
+        ]
+      },
+      {
+        # Eval datasets hold red-team answer keys and flagged-thread
+        # snapshots (PII) — never agent-readable. The grant above is
+        # bucket-wide, so application-level path resolution alone is one
+        # bug away from exposing them to the agent under test; this Deny
+        # is the enforcement layer (Evaluations Trust Core U4 KTD). Run
+        # snapshots live under the same prefix
+        # (tenants/<slug>/eval-datasets/.runs/<run-id>/) so they are
+        # covered by construction.
+        Sid    = "DenyEvalDatasetPrefix"
+        Effect = "Deny"
+        Action = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
+        Resource = [
+          "arn:aws:s3:::${var.bucket_name}/tenants/*/eval-datasets/*",
+        ]
+      },
+      {
+        # Bedrock invoke spans foundation models, inference profiles, and
+        # cross-region routing. The original
+        # `arn:aws:bedrock:${region}::foundation-model/*` only covered
+        # foundation models in the primary region — but a
+        # `us.anthropic.claude-sonnet-...` inference profile (the default
+        # routing path used by chat-agent-invoke) lives at
+        # `arn:aws:bedrock:${region}:${account}:inference-profile/*` AND
+        # dispatches the actual InvokeModel call to the foundation model
+        # in whatever region the profile resolves to (us-east-1,
+        # us-east-2, us-west-2). The narrow ARN caused every agent turn
+        # to fail with AccessDenied silently inside pi-ai's Bedrock
+        # provider, surfacing as an empty assistant message with zero
+        # token usage. Inference profiles and their routed foundation-model
+        # calls require broad model resource scope.
+        Sid      = "BedrockInvoke"
+        Effect   = "Allow"
+        Action   = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:InvokeAgent"]
+        Resource = "*"
+      },
+      {
+        # Some Bedrock Marketplace-backed models require the invoking role to
+        # view/accept the model subscription before Converse can stream. Without
+        # these actions Bedrock returns an assistant error with zero token usage.
+        Sid      = "MarketplaceModelAccess"
+        Effect   = "Allow"
+        Action   = ["aws-marketplace:ViewSubscriptions", "aws-marketplace:Subscribe"]
+        Resource = "*"
+      },
+      {
+        # Automatic memory retention — every agent turn calls CreateEvent
+        # to feed AgentCore's background strategies. Also needs read access
+        # so the recall() tool can fetch previously extracted records and
+        # so forget() can soft-archive old records.
+        Sid    = "AgentCoreMemoryReadWrite"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:CreateEvent",
+          "bedrock-agentcore:ListEvents",
+          "bedrock-agentcore:GetEvent",
+          "bedrock-agentcore:ListMemoryRecords",
+          "bedrock-agentcore:RetrieveMemoryRecords",
+          "bedrock-agentcore:GetMemoryRecord",
+          "bedrock-agentcore:BatchCreateMemoryRecords",
+          "bedrock-agentcore:BatchUpdateMemoryRecords",
+        ]
+        Resource = "*"
+      },
+      {
+        # Browser Automation (browser_automation tool). Pi can open managed
+        # AgentCore Browser sessions when the built-in browser capability is
+        # enabled for an agent.
+        Sid    = "AgentCoreBrowser"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:StartBrowserSession",
+          "bedrock-agentcore:StopBrowserSession",
+          "bedrock-agentcore:GetBrowserSession",
+          "bedrock-agentcore:ListBrowserSessions",
+          "bedrock-agentcore:InvokeBrowser",
+          "bedrock-agentcore:UpdateBrowserStream",
+        ]
+        Resource = [
+          "arn:aws:bedrock-agentcore:${var.region}:aws:browser/aws.browser.v1",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:browser/*",
+        ]
+      },
+      {
+        # AgentCore Code Interpreter — Pi's primary sandbox per the FR-9a
+        # integration spike (`packages/pi-aws/connectors/agentcore-
+        # codeinterpreter.ts`). Per-tenant interpreters live under
+        # `code-interpreter-custom/*`; sessions are started, exec'd against,
+        # and stopped per Pi invocation.
+        Sid    = "AgentCoreCodeInterpreter"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:StartCodeInterpreterSession",
+          "bedrock-agentcore:StopCodeInterpreterSession",
+          "bedrock-agentcore:InvokeCodeInterpreter",
+          "bedrock-agentcore:GetCodeInterpreterSession",
+          "bedrock-agentcore:ListCodeInterpreterSessions",
+          "bedrock-agentcore:GetCodeInterpreter",
+        ]
+        Resource = "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:code-interpreter-custom/*"
+      },
+      {
+        Sid    = "CloudWatchLogs"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:DescribeLogGroups",
+          "logs:DescribeLogStreams",
+          "logs:PutLogEvents",
+        ]
+        # Lambda log group + AgentCore Runtime container log groups + the
+        # account-wide aws/spans log group (CloudWatch Transaction Search
+        # destination — required for AgentCore Evaluations to read spans).
+        Resource = [
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/lambda/thinkwork-${var.stage}-*",
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/lambda/thinkwork-${var.stage}-*:*",
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*",
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:*",
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:aws/spans",
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:aws/spans:*",
+        ]
+      },
+      {
+        # X-Ray ingestion — ADOT exporters publish spans here, which then
+        # flow to aws/spans via the Transaction Search policy. AgentCore
+        # Evaluations queries those spans by session.id when scoring runs.
+        Sid    = "XRayIngest"
+        Effect = "Allow"
+        Action = [
+          "xray:PutTraceSegments",
+          "xray:PutTelemetryRecords",
+          "xray:GetSamplingRules",
+          "xray:GetSamplingTargets",
+        ]
+        Resource = [
+          "arn:aws:xray:${var.region}:${var.account_id}:*",
+          "*",
+        ]
+      },
+      {
+        Sid      = "ECRPull"
+        Effect   = "Allow"
+        Action   = ["ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage"]
+        Resource = "arn:aws:ecr:${var.region}:${var.account_id}:repository/thinkwork-${var.stage}-*"
+      },
+      {
+        Sid      = "ECRAuth"
+        Effect   = "Allow"
+        Action   = ["ecr:GetAuthorizationToken"]
+        Resource = "*"
+      },
+      {
+        Sid      = "SSMParameterAccess"
+        Effect   = "Allow"
+        Action   = ["ssm:GetParameter", "ssm:PutParameter"]
+        Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/agentcore/*"
+      },
+      {
+        # Invoke API Lambdas from Pi's private VPC. Memory retain is queued
+        # async; chat activity/finalize and the per-turn capability-manifest
+        # POST are RequestResponse callbacks because public API Gateway
+        # endpoints are not reachable reliably from this VPC.
+        Sid    = "ApiLambdaInvoke"
+        Effect = "Allow"
+        Action = ["lambda:InvokeFunction"]
+        Resource = [
+          local.memory_retain_fn_arn,
+          local.chat_agent_finalize_fn_arn,
+          local.chat_agent_activity_fn_arn,
+          local.manifest_log_fn_arn,
+        ]
+      },
+      {
+        # Aurora Data API — U4 SessionStore and Hindsight exact-memory recall
+        # read/write via the RDS Data API rather than long-lived Postgres
+        # connections. Cover both the canonical cluster name and suffixed
+        # replacement names.
+        Sid    = "AuroraDataAPI"
+        Effect = "Allow"
+        Action = [
+          "rds-data:ExecuteStatement",
+          "rds-data:BatchExecuteStatement",
+          "rds-data:BeginTransaction",
+          "rds-data:CommitTransaction",
+          "rds-data:RollbackTransaction",
+        ]
+        Resource = [
+          "arn:aws:rds:${var.region}:${var.account_id}:cluster:thinkwork-${var.stage}-db",
+          "arn:aws:rds:${var.region}:${var.account_id}:cluster:thinkwork-${var.stage}-db-*",
+        ]
+      },
+      {
+        # Secrets Manager — Pi resolves db credentials and other runtime
+        # secrets at invocation time per `feedback_completion_callback_
+        # snapshot_pattern`. Scoped to `/thinkwork/${stage}/*` per the
+        # existing convention.
+        Sid    = "SecretsManagerRead"
+        Effect = "Allow"
+        Action = [
+          "secretsmanager:GetSecretValue",
+          "secretsmanager:DescribeSecret",
+        ]
+        Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork-${var.stage}-*"
+      },
+    ], local.okf_efs_iam_statements)
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "agentcore_pi_vpc_access" {
+  count = local.private_vpc_enabled ? 1 : 0
+
+  role       = aws_iam_role.agentcore_pi.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+resource "aws_iam_role_policy" "agentcore_pi_dlq_send" {
+  name = "agentcore-pi-dlq-send"
+  role = aws_iam_role.agentcore_pi.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["sqs:SendMessage"]
+      Resource = var.async_dlq_arn
+    }]
+  })
+}
+
+################################################################################
+# CloudWatch Log Group
+################################################################################
+
+resource "aws_cloudwatch_log_group" "agentcore_pi" {
+  name              = "/thinkwork/${var.stage}/agentcore-pi"
+  retention_in_days = 30
+
+  tags = {
+    Name = "thinkwork-${var.stage}-agentcore-pi-logs"
+  }
+}
+
+################################################################################
+# Lambda Container Image
+################################################################################
+
+resource "terraform_data" "seed_pi_image" {
+  count = var.source_image_uri != "" ? 1 : 0
+
+  triggers_replace = {
+    source_image_uri = var.source_image_uri
+    target_image_uri = local.pi_image_uri
+  }
+
+  provisioner "local-exec" {
+    interpreter = ["/bin/bash", "-c"]
+    command     = <<-EOT
+      set -euo pipefail
+      repo_root="${abspath("${path.module}/../../../..")}"
+      aws ecr get-login-password --region ${var.region} | docker login --username AWS --password-stdin ${var.account_id}.dkr.ecr.${var.region}.amazonaws.com
+      if docker pull "${var.source_image_uri}"; then
+        source_id="$(docker image inspect --format '{{.Id}}' "${var.source_image_uri}")"
+        docker tag "$source_id" "${local.pi_image_uri}"
+      else
+        # Unreachable source must not fail a stack whose target tag is already
+        # seeded (rerun after a partial deploy, or a registry that went
+        # private) — the Lambda only consumes the target ECR tag.
+        repo_name="$(basename "${var.ecr_repository_url}")"
+        if aws ecr describe-images --repository-name "$repo_name" --image-ids imageTag=pi-latest --region ${var.region} >/dev/null 2>&1; then
+          echo "WARN: could not pull ${var.source_image_uri}; ${local.pi_image_uri} is already seeded — keeping the existing image."
+          exit 0
+        fi
+        dockerfile="$repo_root/packages/agentcore-pi/agent-container/Dockerfile"
+        if [[ ! -f "$dockerfile" ]]; then
+          echo "ERROR: could not pull ${var.source_image_uri} and there is no repo checkout at $repo_root to build from." >&2
+          echo "The pinned release image must be pullable by this machine (public registry, or docker login to its registry)." >&2
+          echo "Alternatively set agentcore_pi_source_image_uri in terraform.tfvars to an image this AWS account can pull." >&2
+          exit 1
+        fi
+        echo "Unable to pull release image ${var.source_image_uri}; building Pi image from $repo_root"
+        docker build \
+          --platform linux/amd64 \
+          -f "$dockerfile" \
+          -t "${local.pi_image_uri}" \
+          "$repo_root"
+      fi
+      docker push "${local.pi_image_uri}"
+    EOT
+  }
+}
+
+resource "aws_lambda_function" "agentcore_pi" {
+  function_name = "thinkwork-${var.stage}-agentcore-pi"
+  role          = aws_iam_role.agentcore_pi.arn
+  package_type  = "Image"
+  image_uri     = local.pi_image_uri
+  timeout       = 900
+  memory_size   = 2048
+
+  depends_on = [terraform_data.seed_pi_image]
+
+  environment {
+    variables = {
+      PORT                                   = "8080"
+      AWS_LWA_PORT                           = "8080"
+      AGENTCORE_MEMORY_ID                    = var.agentcore_memory_id
+      AGENTCORE_FILES_BUCKET                 = var.bucket_name
+      MEMORY_ENGINE                          = var.memory_engine
+      REQUESTER_IDLE_MEMORY_LEARNING_ENABLED = tostring(var.requester_idle_memory_learning_enabled)
+      MEMORY_RETAIN_FN_NAME                  = local.memory_retain_fn_name
+      CHAT_AGENT_FINALIZE_FN_NAME            = local.chat_agent_finalize_fn_name
+      CHAT_AGENT_ACTIVITY_FN_NAME            = local.chat_agent_activity_fn_name
+      MANIFEST_LOG_FUNCTION_NAME             = local.manifest_log_fn_name
+      HINDSIGHT_ENDPOINT                     = var.hindsight_endpoint
+      THINKWORK_API_URL                      = var.api_endpoint
+      API_AUTH_SECRET                        = var.api_auth_secret
+      # Plan §005 U4 — AuroraSessionStore uses the RDS Data API to persist
+      # Pi's SessionData blobs against threads.session_data. Empty during
+      # the first greenfield apply (DB cluster doesn't exist yet); the
+      # constructor fail-closes if either is missing at runtime.
+      DB_CLUSTER_ARN             = var.db_cluster_arn
+      DB_SECRET_ARN              = var.db_secret_arn
+      OKF_WIKI_NAVIGATOR_ENABLED = tostring(local.okf_efs_mount_enabled)
+      OKF_WIKI_ROOT              = var.okf_efs_mount_path
+    }
+  }
+
+  dynamic "vpc_config" {
+    for_each = local.private_vpc_enabled ? [1] : []
+
+    content {
+      subnet_ids         = local.private_subnet_ids
+      security_group_ids = local.private_security_group_ids
+    }
+  }
+
+  dynamic "file_system_config" {
+    for_each = local.okf_efs_vpc_enabled ? [1] : []
+
+    content {
+      arn              = var.okf_efs_read_access_point_arn
+      local_mount_path = var.okf_efs_mount_path
+    }
+  }
+
+  logging_config {
+    log_group  = aws_cloudwatch_log_group.agentcore_pi.name
+    log_format = "Text"
+  }
+
+  tags = {
+    Name = "thinkwork-${var.stage}-agentcore-pi"
+  }
+}
+
+################################################################################
+# Async-invoke hardening — MaximumRetryAttempts=0 + DLQ
+#
+# AWS Lambda async-invoke defaults to 2 retries; the agent loop is not
+# idempotent (Bedrock tokens get re-burned, partial deliverables can
+# overwrite the first), so retries are disabled and failed invokes land in
+# the shared DLQ for operator visibility.
+################################################################################
+
+resource "aws_lambda_function_event_invoke_config" "agentcore_pi" {
+  function_name                = aws_lambda_function.agentcore_pi.function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+
+  destination_config {
+    on_failure {
+      destination = var.async_dlq_arn
+    }
+  }
+}

package/dist/terraform/modules/app/agentcore-pi/outputs.tf

@@ -0,0 +1,38 @@
+################################################################################
+# AgentCore Pi — App Module (outputs)
+################################################################################
+
+output "agentcore_pi_function_name" {
+  description = "Pi AgentCore Lambda function name (for direct SDK invoke from chat-agent-invoke)"
+  value       = aws_lambda_function.agentcore_pi.function_name
+}
+
+output "agentcore_pi_function_arn" {
+  description = "Pi AgentCore Lambda function ARN (for IAM policy on callers; used to grant lambda:InvokeFunction)"
+  value       = aws_lambda_function.agentcore_pi.arn
+}
+
+output "agentcore_pi_runtime_role_arn" {
+  description = "IAM role ARN for the Pi agent runtime (assumed by Lambda + Bedrock AgentCore Runtime principals)"
+  value       = aws_iam_role.agentcore_pi.arn
+}
+
+output "agentcore_pi_log_group_name" {
+  description = "CloudWatch log group name for the Pi Lambda. Useful for log scrubbing and operator inspection."
+  value       = aws_cloudwatch_log_group.agentcore_pi.name
+}
+
+output "okf_wiki_mount_enabled" {
+  description = "Whether the OKF wiki EFS view is mounted into the Pi Lambda."
+  value       = local.okf_efs_mount_enabled
+}
+
+output "okf_wiki_mount_path" {
+  description = "Pi local mount path for the OKF wiki EFS view."
+  value       = var.okf_efs_mount_path
+}
+
+output "okf_wiki_read_access_point_arn" {
+  description = "EFS access point ARN mounted by Pi for read-only OKF wiki traversal."
+  value       = var.okf_efs_read_access_point_arn
+}