thinkwork-cli 0.12.15 → 0.12.17

package/dist/terraform/modules/app/deployment-control-plane/test_runner_bundle.py

@@ -1569,6 +1569,62 @@ def test_unrelated_managed_app_overrides_preserve_existing_n8n_guardrails() -> N
     assert overrides["n8n_custom_package_specs"] == ["luxon@3.7.2"]
 
 
+def test_managed_app_overrides_ignore_retired_graph_substrate_state() -> None:
+    runner = load_runner()
+    retired_prefix = "co" + "gnee"
+    old_guardrail_name = retired_prefix + "_configuration_guardrails"
+    old_output_name = retired_prefix + "_url"
+    state = {
+        "resources": [
+            {
+                "type": "terraform_data",
+                "name": old_guardrail_name,
+                "instances": [
+                    {
+                        "attributes": {
+                            "input": {
+                                "value": {
+                                    "enabled": True,
+                                    "endpoint": "https://old-graph.example.test",
+                                }
+                            }
+                        }
+                    }
+                ],
+            }
+        ]
+    }
+
+    overrides = runner.managed_app_terraform_overrides(
+        {
+            "appKey": "twenty",
+            "operation": "UPGRADE",
+            "desiredConfig": {
+                "certificateArn": "arn:aws:acm:us-east-1:487219502366:certificate/twenty",
+                "publicUrl": "https://twenty.thinkwork.ai",
+            },
+            "manifestImages": {
+                "twenty": "487219502366.dkr.ecr.us-east-1.amazonaws.com/thinkwork/twenty"
+                "@sha256:"
+                "5555555555555555555555555555555555555555555555555555555555555555"
+            },
+        },
+        "dev",
+        "487219502366",
+        {
+            old_output_name: {"value": "https://old-graph.example.test"},
+            "n8n_provisioned": {"value": True},
+            "n8n_runtime_enabled": {"value": True},
+        },
+        state,
+    )
+
+    assert overrides["n8n_provisioned"] is True
+    assert overrides["n8n_runtime_enabled"] is True
+    assert overrides["twenty_provisioned"] is True
+    assert all(retired_prefix not in key for key in overrides)
+
+
 def test_n8n_destroy_normalizes_legacy_binary_database_guardrail() -> None:
     runner = load_runner()
     state = {
@@ -2574,7 +2630,6 @@ def test_controller_input_summary_redacts_to_deployment_contract() -> None:
             },
             "features": {
                 "baseInstall": {
-                    "cognee": False,
                     "slack": False,
                     "stripe": False,
                     "twenty": False,
@@ -2588,7 +2643,6 @@ def test_controller_input_summary_redacts_to_deployment_contract() -> None:
     assert summary["customer"]["environmentName"] == "tei-e2e"
     assert summary["release"]["manifestSha256"] == "a" * 64
     assert summary["features"]["baseInstall"] == {
-        "cognee": False,
         "slack": False,
         "stripe": False,
         "twenty": False,

package/dist/terraform/modules/app/hindsight-memory/main.tf

@@ -33,10 +33,34 @@ variable "database_url" {
   sensitive = true
 }
 
+variable "database_name" {
+  description = <<-EOT
+    Dedicated Hindsight database name (THINK-220). Empty (default) keeps the
+    legacy layout: Hindsight lives in the `hindsight` schema of the primary
+    database named in database_url. Set (e.g. "thinkwork_hindsight") to point
+    the service at that database on the same cluster with schema `public` —
+    the vanilla upstream configuration, which its maintenance-loop discovery
+    queries require. The database must already exist (bootstrap SQL; Terraform
+    cannot CREATE DATABASE inside the cluster).
+  EOT
+  type        = string
+  default     = ""
+}
+
+locals {
+  # database_url with its path segment swapped for var.database_name.
+  # Matches "...host:port/<db>" with an optional "?query" tail.
+  hindsight_database_url = (
+    var.database_name == ""
+    ? var.database_url
+    : replace(var.database_url, "/(/[^/?]+)([?].*)?$/", "/${var.database_name}$2")
+  )
+}
+
 variable "image_tag" {
   description = "Hindsight Docker image tag (ghcr.io/vectorize-io/hindsight:<tag>)"
   type        = string
-  default     = "0.5.0"
+  default     = "0.8.4"
 }
 
 variable "enable_auto_consolidation" {
@@ -51,6 +75,12 @@ variable "consolidation_dedup_threshold" {
   default     = "0.97"
 }
 
+variable "retain_llm_model" {
+  description = "Bedrock model id for Hindsight's retain/extraction pass. Default = Haiku 4.5, validated on image 0.8.4 (THINK-201, 2026-07-06): 12.9% dangling-referent rate vs ~38% for gpt-oss-20b, best usefulness of any measured config, zero Anthropic tool-schema errors (the 0.5.0 incompatibility that caused the THINK-198 incident is fixed upstream). Evidence: docs/solutions/tooling-decisions/hindsight-084-upgrade-validation-2026-07-06.md. Requires image >= 0.8.x for anthropic.* models."
+  type        = string
+  default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
+}
+
 variable "observations_mission" {
   description = "Service-level default observations mission steering what consolidation synthesizes. Empty string omits the env var so the image default applies. Per-bank overrides apply on top."
   type        = string
@@ -194,6 +224,13 @@ resource "aws_lb" "hindsight" {
   security_groups    = [aws_security_group.alb.id]
   subnets            = var.subnet_ids
 
+  # Synchronous retain runs LLM extraction + auto-consolidation and routinely
+  # exceeds the 60s ALB default, which returned 504s to the retain Lambda
+  # while Hindsight was still working (every dead-lettered retain attempt on
+  # dev showed ~60.1-60.5s backend latency). Must stay above the retain
+  # Lambda's HINDSIGHT_TIMEOUT_MS so the client, not the ALB, owns timeouts.
+  idle_timeout = 300
+
   tags = { Name = "thinkwork-${var.stage}-hindsight-alb" }
 }
 
@@ -253,6 +290,15 @@ resource "aws_ecs_task_definition" "hindsight" {
   execution_role_arn       = aws_iam_role.ecs_execution.arn
   task_role_arn            = aws_iam_role.ecs_task.arn
 
+  lifecycle {
+    precondition {
+      # A dedicated Hindsight database that is actually the primary database
+      # would put Hindsight's `public` schema on top of the thinkwork tables.
+      condition     = var.database_name == "" || !endswith(split("?", var.database_url)[0], "/${var.database_name}")
+      error_message = "database_name must be distinct from the primary database in database_url (THINK-220)."
+    }
+  }
+
   runtime_platform {
     operating_system_family = "LINUX"
     cpu_architecture        = "ARM64"
@@ -269,8 +315,10 @@ resource "aws_ecs_task_definition" "hindsight" {
     }]
 
     environment = concat([
-      { name = "HINDSIGHT_API_DATABASE_URL", value = var.database_url },
-      { name = "HINDSIGHT_API_DATABASE_SCHEMA", value = "hindsight" },
+      { name = "HINDSIGHT_API_DATABASE_URL", value = local.hindsight_database_url },
+      # `public` on a dedicated database is upstream's vanilla layout — the
+      # maintenance-loop discovery queries only work there (THINK-220).
+      { name = "HINDSIGHT_API_DATABASE_SCHEMA", value = var.database_name == "" ? "hindsight" : "public" },
       { name = "HINDSIGHT_API_VECTOR_EXTENSION", value = "pgvector" },
       { name = "HINDSIGHT_API_TEXT_SEARCH_EXTENSION", value = "native" },
       { name = "HINDSIGHT_API_RUN_MIGRATIONS_ON_STARTUP", value = "true" },
@@ -279,7 +327,7 @@ resource "aws_ecs_task_definition" "hindsight" {
       { name = "AWS_REGION_NAME", value = data.aws_region.current.name },
       { name = "AWS_DEFAULT_REGION", value = data.aws_region.current.name },
       { name = "HINDSIGHT_API_RETAIN_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_RETAIN_LLM_MODEL", value = "openai.gpt-oss-20b-1:0" },
+      { name = "HINDSIGHT_API_RETAIN_LLM_MODEL", value = var.retain_llm_model },
       { name = "HINDSIGHT_API_REFLECT_LLM_PROVIDER", value = "bedrock" },
       { name = "HINDSIGHT_API_REFLECT_LLM_MODEL", value = "openai.gpt-oss-120b-1:0" },
       { name = "HINDSIGHT_API_EMBEDDINGS_PROVIDER", value = "local" },

package/dist/terraform/modules/app/lambda-api/eval-fanout.tf

@@ -62,6 +62,13 @@ resource "aws_lambda_event_source_mapping" "eval_fanout" {
   function_response_types = ["ReportBatchItemFailures"]
 
   scaling_config {
+    # Effective concurrency = min(FIFO lanes, maximum_concurrency);
+    # lanes (EVAL_DIRECT_AGENTCORE_MESSAGE_SHARDS, handlers.tf) and the
+    # function's reserved concurrency sit at 40 as headroom. This knob
+    # is the deliberate ceiling: at 40 the agent-tier AgentCore turns
+    # saturate the Bedrock TPM quota and blow the 180s response budget
+    # (benchmark run 62c6de45: 47 timeout errors vs 0 at 20). Raise only
+    # after a Bedrock quota bump, and this knob alone is enough.
     maximum_concurrency = 20
   }
 }