thinkwork-cli 0.12.15 → 0.12.17

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -10,14 +10,9 @@ locals {
   use_local_zips        = var.lambda_zips_dir != ""
   eval_fanout_queue_url = local.deploy_lambda_handlers ? aws_sqs_queue.eval_fanout[0].url : ""
   runtime               = "nodejs20.x"
-  cognee_env = var.cognee_enabled ? {
-    # graphql-http is close to Lambda's 4 KB environment ceiling. Keep Cognee
-    # status in one compact value; stable names are derived in the resolver.
-    COGNEE = "${var.cognee_backend_mode}|${var.cognee_endpoint}"
-  } : {}
   # Twenty managed-app status is DB-served (managed_applications +
   # deployment jobs — plan 2026-06-12-001 U10); the TWENTY config key is
-  # retired. Cognee's env-var status projection above is unchanged.
+  # retired.
   optional_integration_handler_names = concat(
     var.deployment_control_plane_enabled ? [] : [
       # Host-only onboarding/deployment API. Customer foundations disable the
@@ -53,9 +48,32 @@ locals {
   # env forever, secrets live in Secrets Manager (R4), never in the String
   # document.
   config_env = merge({
-    DATABASE_SECRET_ARN = var.graphql_db_secret_arn
-    DATABASE_HOST       = var.db_cluster_endpoint
-    DATABASE_NAME       = var.database_name
+    # THINK-173: PUBLIC verification key (not a secret) + the NAME of the
+    # private-key secret (resolved via runtime-config's secret loader —
+    # the PEM itself never enters the env or the String document).
+    CAPABILITY_SIGNING_PUBLIC_KEY         = var.capability_signing_public_key
+    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET = var.capability_signing_private_key_secret
+    # THINK-229 U3/KTD5 — the analyst policy-source enforcement flip.
+    # "row" (default) keeps sidecar policy shadow-only; "sidecar" makes the
+    # signed sidecar block authoritative (budgets/policyClaims flow). Flip
+    # ONLY after clean shadow parity on live traffic.
+    ANALYST_POLICY_SOURCE = var.analyst_policy_source
+    # THINK-230 — the operator-facing provisionAnalystConnector mutation runs
+    # the analyst connector provisioning ceremony inside graphql-http, so the
+    # shared api handlers read the same broker-secret ARN + rds_iam connect
+    # config the analyst-query-broker handler carries per-handler. Read via
+    # getConfig() (env-wins), never process.env (runtime-config fixture gate).
+    # ANALYST_DB_CLUSTER_ENDPOINT gates on the resource id so a stage without
+    # the IAM grant leaves rds_iam provisioning off (resolveAnalystRdsIamConfig
+    # returns null) instead of half-seeding a credential row.
+    ANALYST_BROKER_SECRET_ARN      = var.analyst_broker_secret_arn
+    ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
+    ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
+    ANALYST_DB_NAME                = var.database_name
+    ANALYST_DB_USER                = "analyst_reader"
+    DATABASE_SECRET_ARN            = var.graphql_db_secret_arn
+    DATABASE_HOST                  = var.db_cluster_endpoint
+    DATABASE_NAME                  = var.database_name
     # BUCKET_NAME and USER_POOL_ID were duplicate aliases of WORKSPACE_BUCKET
     # and COGNITO_USER_POOL_ID; GRAPHQL_API_KEY duplicated APPSYNC_API_KEY;
     # THINKWORK_API_SECRET and EMAIL_HMAC_SECRET duplicated API_AUTH_SECRET
@@ -72,6 +90,27 @@ locals {
     COGNITO_APP_CLIENT_IDS      = "${var.admin_client_id},${var.mobile_client_id}"
     APPSYNC_ENDPOINT            = var.appsync_api_url
     THINKWORK_API_URL           = local.api_base_url
+    # Deterministic routines v1 (plan 2026-07-03-004 U6): activates the
+    # git-backed routine lifecycle tool suite on the admin-ops MCP server
+    # (routine_repo_list/read/commit, routine_run_fixtures, routine_runs).
+    # Read via getConfig() in admin-ops-mcp.ts; without this the tools are
+    # listed but every call returns not_yet_enabled.
+    ROUTINES_AGENT_TOOLS_ENABLED = "true"
+    # THINK-137 Automations U9 (R15): activates the read-only Automation
+    # agent tools on the admin-ops MCP server (automations_list,
+    # automation_get). Read via getConfig() in admin-ops-mcp.ts; without
+    # this the tools are listed but every call returns not_yet_enabled.
+    AUTOMATIONS_AGENT_TOOLS_ENABLED = "true"
+    # THINK-227 U10 (KTD11): DEDICATED inert gate for the automation WRITE
+    # tools (automation_save, automation_delete). Deliberately "false" at
+    # merge — the read flag above has been live stage-wide since THINK-137,
+    # so reusing it would pre-activate writes on every already-assigned
+    # tenant. Flipped per-stage as the U12 rollout step (dev dogfood first,
+    # then TEI) after the pre-deploy assignment enumeration. Flipped for dev
+    # 2026-07-09: enumeration found admin-ops assigned to two internal
+    # tenants only (sleek-squirrel-230, academic-bobcat-897); AE1-AE4 smokes
+    # green on the deployed U1-U11 stack.
+    AUTOMATIONS_AGENT_WRITE_TOOLS_ENABLED = "true"
     # Comma-separated allowlist of caller emails permitted to invoke
     # operator-gated mutations (updateTenantPolicy, sandbox fixture
     # setup, etc.). Resolved against ctx.auth.email, which is pulled
@@ -84,10 +123,13 @@ locals {
     # WORKSPACE_RENDERER_FUNCTION_NAME is derived from the per-stage naming
     # convention by deriveFunctionName("workspace-renderer") — stored
     # nowhere (R7).
-    WORKSPACE_BUCKET    = var.bucket_name
-    HINDSIGHT_ENDPOINT  = var.hindsight_endpoint
-    AGENTCORE_MEMORY_ID = var.agentcore_memory_id
-    MEMORY_ENGINE       = var.memory_engine
+    WORKSPACE_BUCKET   = var.bucket_name
+    HINDSIGHT_ENDPOINT = var.hindsight_endpoint
+    # THINK-220 cutover flag: empty = hindsight schema on the primary DB;
+    # set = that database's public schema via the database-pg seam.
+    HINDSIGHT_DATABASE_NAME = var.hindsight_database_name
+    AGENTCORE_MEMORY_ID     = var.agentcore_memory_id
+    MEMORY_ENGINE           = var.memory_engine
     # CHAT_AGENT_INVOKE_FN_ARN (~112 serialized bytes) was dropped for the
     # 4KB env ceiling (#2375): getChatAgentInvokeFnArn and managed-dispatch
     # now derive the ARN from the deterministic naming pattern
@@ -113,13 +155,11 @@ locals {
     # OAUTH_CALLBACK_URL is the URL registered with Google/Azure OAuth apps.
     # REDIRECT_SUCCESS_URL is the fallback post-OAuth redirect when the
     # caller doesn't pass a per-request returnUrl (mobile passes thinkwork://).
-    GOOGLE_PRODUCTIVITY_OAUTH_SECRET_ARN          = aws_secretsmanager_secret.oauth_google_productivity.arn
-    OAUTH_CALLBACK_URL                            = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com/api/oauth/callback"
-    REDIRECT_SUCCESS_URL                          = var.redirect_success_url
-    COMPANY_BRAIN_SOURCE_AGENT_MODEL_ID           = var.company_brain_source_agent_model_id
-    COMPANY_BRAIN_BACKDOOR_INSTALL_KEY_SECRET_ARN = var.company_brain_backdoor_install_key_secret_arn
-    COMPANY_BRAIN_BACKDOOR_INSTALL_KEY_STAGES     = var.company_brain_backdoor_install_key_stages
-    WWW_URL                                       = var.www_url
+    GOOGLE_PRODUCTIVITY_OAUTH_SECRET_ARN = aws_secretsmanager_secret.oauth_google_productivity.arn
+    OAUTH_CALLBACK_URL                   = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com/api/oauth/callback"
+    REDIRECT_SUCCESS_URL                 = var.redirect_success_url
+    BRAIN_SOURCE_AGENT_MODEL_ID          = var.brain_source_agent_model_id
+    WWW_URL                              = var.www_url
     },
     # Stripe billing — see stripe-secrets.tf. The ARN is the indirection;
     # the actual keys live in Secrets Manager and are fetched by
@@ -139,7 +179,6 @@ locals {
       # set to hello@thinkwork.ai once the bare-apex identity is verified in SES.
       STRIPE_WELCOME_FROM_EMAIL = var.stripe_welcome_from_email
     } : {},
-    local.cognee_env,
   )
 
   # graphql-http-only config that also belongs in the runtime-config
@@ -152,13 +191,6 @@ locals {
     # Settings > General starts release updates from the GraphQL API.
     DEPLOYMENT_STATE_MACHINE_ARN = var.deployment_state_machine_arn
     DEPLOYMENT_EVIDENCE_BUCKET   = var.deployment_evidence_bucket
-    # Cognee user + Space memory captures use explicit add+cognify so accepted
-    # documents enter the scoped graph. GraphQL has a 30s Lambda ceiling, so
-    # indexing wait is intentionally short/best-effort; callers poll search for
-    # eventual retrieval instead of pinning the capture request.
-    COGNEE_INGEST_MODE      = "add_cognify"
-    COGNEE_INDEX_TIMEOUT_MS = "8000"
-    COGNEE_INDEX_POLL_MS    = "2000"
     # THNK-37 — the GraphQL API is the runtime trust boundary for the
     # GitHub-hosted signed plugin catalog. Browsers keep reading through
     # GraphQL; API verifies the release asset with the trusted public key
@@ -206,6 +238,46 @@ locals {
   }
 
   handler_extra_env = {
+    # Analyst query broker (THINK-228 U3). Reader role + caller credential
+    # secrets, and the workspace bucket's analyst-staging/ prefix for
+    # large-result CSVs (lifecycle TTL lives on the bucket module). The
+    # shared writer DATABASE_SECRET_ARN also lands in this handler's env
+    # via common_env, but the broker code never uses it — SQL runs only as
+    # analyst_reader.
+    "analyst-query-broker" = {
+      ANALYST_READER_SECRET_ARN = var.analyst_reader_secret_arn
+      ANALYST_BROKER_SECRET_ARN = var.analyst_broker_secret_arn
+      ANALYST_STAGING_BUCKET    = var.bucket_name
+      ANALYST_STAGING_PREFIX    = "analyst-staging"
+      # THINK-229 U1: RDS IAM connect config. Endpoint presence switches
+      # analyst-reader-db.ts to the IAM-token path (password secret above
+      # is the pre-GRANT-rds_iam fallback, retired once IAM is proven).
+      # Gated on the resource ID so a stage without the IAM grant keeps
+      # the password path instead of failing into the fallback every cold
+      # start.
+      ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
+      ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
+      ANALYST_DB_NAME                = var.database_name
+      ANALYST_DB_USER                = "analyst_reader"
+    }
+    # THINK-229 U5 — the connection reconciler probes the analyst_reader
+    # connection EXACTLY as the broker does (getAnalystReaderClient), so it
+    # needs the same IAM-connect config + the password-fallback secret. The
+    # shared lambda execution role already holds rds-db:connect on the
+    # analyst_reader dbuser (iam-grouped.tf, granted in U1), so no extra IAM.
+    "analyst-connection-reconciler" = {
+      ANALYST_READER_SECRET_ARN      = var.analyst_reader_secret_arn
+      ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
+      ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
+      ANALYST_DB_NAME                = var.database_name
+      ANALYST_DB_USER                = "analyst_reader"
+    }
+    # THINK-246: customer stages cannot send as the dev fallback domain
+    # (noreply@agents.thinkwork.ai is only verified in the dev account) —
+    # observed live on TEI as ses_send_failed on the deliver step.
+    "artifact-deliver" = {
+      ARTIFACT_DELIVERY_FROM_EMAIL = var.artifact_delivery_from_email
+    }
     "extension-proxy" = {
       EXTENSION_PROXY_BACKENDS_JSON  = var.extension_proxy_backends_json
       EXTENSION_PROXY_SIGNING_SECRET = var.extension_proxy_signing_secret
@@ -250,6 +322,10 @@ locals {
       # The parameter may contain a placeholder value at apply time — the
       # Lambda logs and degrades gracefully if decryption returns empty.
       GOOGLE_PLACES_SSM_PARAM_NAME = "/thinkwork/${var.stage}/google-places/api-key"
+      # THINK-200 chain: a successful compile Event-invokes okf-materialize
+      # so the OKF projection (and, chained, the Pi navigator's EFS view)
+      # stays current without manual invocation.
+      OKF_MATERIALIZE_FN_NAME = "thinkwork-${var.stage}-api-okf-materialize"
     }
     "ontology-scan" = {
       BEDROCK_MODEL_ID = var.wiki_compile_model_id
@@ -260,6 +336,8 @@ locals {
     }
     "okf-materialize" = {
       BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+      # THINK-200 chain: fresh bundles fan out to the EFS current view.
+      OKF_EFS_REFRESH_FN_NAME = "thinkwork-${var.stage}-api-okf-efs-refresh"
     }
     "okf-efs-refresh" = {
       BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
@@ -287,8 +365,15 @@ locals {
     "chat-agent-invoke" = {
       KNOWLEDGE_GRAPH_TOOL_ENABLED = tostring(var.knowledge_graph_tool_enabled)
     }
+    # 240s: sync Hindsight retain (LLM extraction + auto-consolidation) can
+    # exceed 60s; the client timeout must stay below the Lambda timeout (300s)
+    # and below the Hindsight ALB idle_timeout (300s) so failures classify as
+    # client timeouts, never ALB 504s.
     "memory-retain" = {
-      HINDSIGHT_TIMEOUT_MS = "75000"
+      HINDSIGHT_TIMEOUT_MS = "240000"
+    }
+    "brain-dream-state" = {
+      BRAIN_DREAM_STATE_ENABLED = tostring(var.brain_dream_state_enabled)
     }
     # Bedrock KB provisioning. Per-handler (not common_env) so these don't bloat
     # the already-near-4KB graphql-http env. Bedrock's RDS-backed KB needs the
@@ -297,32 +382,19 @@ locals {
       KB_SERVICE_ROLE_ARN  = var.kb_service_role_arn
       DATABASE_CLUSTER_ARN = var.db_cluster_arn
     }
-    "knowledge-graph-thread-ingest" = {
-      COGNEE_ENDPOINT        = var.cognee_endpoint
-      COGNEE_BACKEND_MODE    = var.cognee_backend_mode
-      COGNEE_INGEST_MODE     = "remember"
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-    }
-    # Observations → Knowledge Graph worker (plan 2026-06-09-004 U5).
-    # add_cognify pins the incremental ingest path into the stable
-    # per-tenant dataset; the promotion-gate classifier reads
-    # OBSERVATION_CLASSIFIER_MODEL_ID (Bedrock IAM via the shared
-    # lambda_bedrock invoke policy).
+    # Observations → Knowledge Graph worker. Extraction is now a Bedrock
+    # structured-output call inside this Lambda. KG_EXTRACTION_MODEL_ID pins
+    # the gpt-oss extraction model (Bedrock IAM via the shared lambda_bedrock
+    # invoke policy, same as the promotion-gate classifier).
     "knowledge-graph-observations-ingest" = {
-      COGNEE_ENDPOINT                 = var.cognee_endpoint
-      COGNEE_BACKEND_MODE             = var.cognee_backend_mode
-      COGNEE_INGEST_MODE              = "add_cognify"
       BRAIN_ARTIFACTS_BUCKET          = aws_s3_bucket.brain_artifacts.bucket
       OBSERVATION_CLASSIFIER_MODEL_ID = var.observation_classifier_model_id
-      # Per-run candidate cap: bounds classifier cost AND keeps each Cognee
-      # cognify small enough to index within budget on the single dogfood
-      # task; truncated runs self-invoke (Event) to drain the backlog across
-      # successive runs. COGNEE_INDEX_TIMEOUT_MS raised well above the default
-      # 240s (dogfood indexing of a fresh dataset is slow) but under the 900s
-      # Lambda ceiling, leaving room for graph fetch + normalize + snapshot.
+      KG_EXTRACTION_MODEL_ID          = var.kg_extraction_model_id
+      # Per-run candidate cap bounds classifier + extraction cost; a
+      # truncated backlog drains via an in-process loop inside one
+      # invocation (never Lambda self-invoke — AWS recursive-loop
+      # detection terminates worker-to-self Event chains).
       KG_OBS_MAX_CANDIDATES_PER_RUN = var.kg_obs_max_candidates_per_run
-      COGNEE_INDEX_TIMEOUT_MS       = "700000"
-      COGNEE_INDEX_POLL_MS          = "7000"
     }
     # routine-task-python (Phase B U6) needs the AgentCore code-interpreter
     # id + the per-stage S3 routine-output bucket. The interpreter id is
@@ -335,6 +407,14 @@ locals {
       ROUTINE_OUTPUT_BUCKET        = "thinkwork-${var.stage}-routine-output"
       ROUTINE_PYTHON_ENV_ALLOWLIST = "TENANT_ID,ROUTINE_ID,EXECUTION_ID"
     }
+    # routine-exec-git (plan 2026-07-03-004 U3, KTD-10): configuration on
+    # the executor's own env, never new graphql-http env vars (4KB ceiling).
+    # The S3 SHA code cache rides the existing routine-output bucket under
+    # the routine-code-cache/ prefix.
+    "routine-exec-git" = {
+      SANDBOX_INTERPRETER_ID = var.agentcore_code_interpreter_id
+      ROUTINE_OUTPUT_BUCKET  = "thinkwork-${var.stage}-routine-output"
+    }
     # graphql-http hosts the createRoutine / publishRoutineVersion / etc.
     # resolvers (Phase B U7) AND the routine-approval-bridge (Phase B
     # U8) which invokes routine-resume via the AWS SDK.
@@ -349,8 +429,15 @@ locals {
     # queue until U3; eval-worker is a throwing inert stub that redrives
     # accidental traffic to the DLQ.
     "eval-runner" = {
-      EVAL_FANOUT_QUEUE_URL                = local.eval_fanout_queue_url
-      EVAL_DIRECT_AGENTCORE_MESSAGE_SHARDS = "20"
+      EVAL_FANOUT_QUEUE_URL = local.eval_fanout_queue_url
+      # 40 lanes to match the fan-out event source mapping's
+      # maximum_concurrency (eval-fanout.tf) — FIFO delivers at most one
+      # in-flight message per group, so lanes < concurrency wastes workers.
+      EVAL_DIRECT_AGENTCORE_MESSAGE_SHARDS = "40"
+      # Anthropic models run under a 10 RPM Bedrock quota in this account
+      # (quota increase PENDING) — pace their runs onto few lanes so they
+      # finish cleanly instead of throttling out. See evalLaneCountForModel.
+      EVAL_ANTHROPIC_MESSAGE_SHARDS = "2"
       # SSM parameter name for the Pi Bedrock AgentCore Runtime ID. deploy.yml's
       # runtime update job writes this in `update-agentcore-runtime-image.sh`;
       # eval-runner reads it via `loadRuntimeId(runtimeType)`.
@@ -393,6 +480,14 @@ locals {
     "compliance-outbox-drainer" = {
       COMPLIANCE_DRAINER_SECRET_ARN = var.compliance_drainer_secret_arn
     }
+    # THINK-189 U5: the conformance judge model pin lives on the sweeper
+    # ONLY (KTD7 — graphql-http's 4KB env ceiling is a known deploy
+    # blocker; the deterministic layer needs no configuration). The shared
+    # api_ai_statements grant already authorizes Converse with this
+    # inference-profile ID.
+    "document-conformance-judge" = {
+      CONFORMANCE_JUDGE_MODEL_ID = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
+    }
   }
 }
 
@@ -466,6 +561,17 @@ resource "aws_lambda_function" "handler" {
     # Bearer API_AUTH_SECRET. Idempotent on thread_turns.finalized_at
     # (migration 0123). Plan: 2026-05-22-006.
     "chat-agent-finalize",
+    # canvas-refresh — headless Living Artifacts data-refresh (THINK-145 U6).
+    # Invoked RequestResponse by the refreshCanvasData mutation (graphql-http)
+    # and by job-trigger's canvas_refresh branch (U7). Re-runs the saved
+    # tenant-scoped MCP tool call behind each bound widget and writes the fresh
+    # payload into the canvas head. Runs on the SHARED lambda role, which already
+    # grants secretsmanager:GetSecretValue on thinkwork/* (all tenants) and
+    # lambda:InvokeFunction — there is no per-Lambda role in this pool. Per-
+    # invocation TENANT scoping is enforced IN CODE: the artifact, its bindings,
+    # and the tenant_mcp_servers row are all filtered by the event's tenantId,
+    # and the only secret read is that server row's own auth_config.secretRef.
+    "canvas-refresh",
     # chat-agent-activity — POST /api/threads/{threadId}/activity. The Pi
     # runtime POSTs here mid-turn so live agent activity (tool/skill/phase
     # steps, coalesced text deltas) streams to the Spaces thread via
@@ -490,6 +596,9 @@ resource "aws_lambda_function" "handler" {
     "auth-me",
     "public-auth-options",
     "workos-auth",
+    # Public artifact share links (THINK-208): GET /share/{token}, token
+    # verified in handler code (no gateway auth, uniform 404 on any miss).
+    "artifact-share",
     "extension-proxy",
     "tenants",
     "users",
@@ -510,11 +619,14 @@ resource "aws_lambda_function" "handler" {
     "job-trigger",
     "routine-task-weather-email",
     "webhooks",
-    "n8n-agent-step-bridge",
-    "n8n-agent-step-expirer",
     "webhooks-admin",
     "webhook-deliveries-cleanup",
     "skill-runs-reconciler",
+    # THINK-229 U5 — probes the analyst_reader connection (reachability, IAM
+    # auth, SELECT-grant introspection, schema drift; all read-only) every 30
+    # min and stamps the verdict onto runtime_metadata.analyst_probe so
+    # dispatch can withhold a failing/stale connection loudly.
+    "analyst-connection-reconciler",
     "cron-stall-monitor",
     "webhook-crm-opportunity",
     "webhook-task-event",
@@ -536,8 +648,8 @@ resource "aws_lambda_function" "handler" {
     "github-app",
     "memory",
     "memory-retain",
+    "brain-dream-state",
     "wiki-compile",
-    "knowledge-graph-thread-ingest",
     "knowledge-graph-observations-ingest",
     "ontology-scan",
     "ontology-reprocess",
@@ -559,6 +671,8 @@ resource "aws_lambda_function" "handler" {
     # THNK-74 U3 — reconciles runtime-reported model usage against Bedrock
     # model invocation logs and appends invocation-scope trace ledger facts.
     "trace-invocation-reconciler",
+    # THINK-245 U10 — daily per-model drift check against Cost Explorer.
+    "cost-drift-check",
     # AgentCore Code Sandbox narrow REST endpoints (plan Unit 10 + Unit 11).
     # Both are service-endpoint shape: the runtime POSTs with
     # Bearer API_AUTH_SECRET. No GraphQL resolver involvement, no extra IAM.
@@ -578,6 +692,13 @@ resource "aws_lambda_function" "handler" {
     # (Start/Invoke/Stop CodeInterpreterSession) + S3 PutObject IAM —
     # see main.tf.
     "routine-task-python",
+    # routine-exec-git: deterministic git-backed routine executor (plan
+    # 2026-07-03-004 U3). SDK-invoked (job-trigger / dispatcher / manual
+    # async job). Pulls the tenant routine repo at branch HEAD,
+    # fixture-gates new SHAs, executes run(input) in the AgentCore code
+    # interpreter, and writes routine_executions rows directly. Shares the
+    # role-wide bedrock-agentcore + S3 + Secrets Manager grants.
+    "routine-exec-git",
     # routine-resume: SDK-invoked by routine-approval-bridge (Phase B
     # U8) after a HITL decision. Calls SendTaskSuccess/SendTaskFailure;
     # idempotent on already-consumed tokens. Needs states:SendTaskSuccess
@@ -598,6 +719,22 @@ resource "aws_lambda_function" "handler" {
     # for steps + on the conditional UPDATE for executions.
     "routine-step-callback",
     "routine-execution-callback",
+    # Workflow Interpreter Lambdas (THINK-219). One shared static state
+    # machine per stage (workflow-interpreter-stepfunctions module) drives
+    # these. workflow-step-dispatch serves EVERY interpreter ASL phase
+    # (load_next / dispatch_agent / await_approval / record_approval /
+    # record_advance) — the SFN execution role's lambda:InvokeFunction grant
+    # is scoped to this one function. workflow-execution-callback is the
+    # EventBridge SFN-state-change target that projects terminal status onto
+    # workflow_runs. workflow-resume is SDK-invoked by resolveWorkflowApproval
+    # (SendTaskSuccess/SendTaskFailure) — SendTask* is granted stage-wide in
+    # the RoutineTaskTokens statement (iam-grouped.tf), states:StartExecution
+    # on the interpreter machine is granted in api_orchestration. All three
+    # ship inert-throwing until U5/U6 wire them (plan KTD10 — a silent no-op
+    # would strand runs in queued).
+    "workflow-step-dispatch",
+    "workflow-execution-callback",
+    "workflow-resume",
     # Skill-run dispatcher runtime-config fetch (plan
     # docs/plans/2026-04-24-008-feat-skill-run-dispatcher-plan.md §U1). The
     # runtime skill dispatch calls this with Bearer API_AUTH_SECRET to pull
@@ -607,6 +744,12 @@ resource "aws_lambda_function" "handler" {
     # Admin-Ops MCP — JSON-RPC endpoint at POST /mcp/admin, exposes the
     # @thinkwork/admin-ops package as MCP tools for managed agents.
     "admin-ops-mcp",
+    # Analyst query broker — first-party MCP server at POST /mcp/analyst
+    # (THINK-228 U3). One tool, query: EXPLAIN-gated, extended-protocol
+    # single-statement SQL as the analyst_reader role; large results stage
+    # to S3 under analyst-staging/; every query emits a data.query_executed
+    # compliance audit event via POST /api/compliance/events.
+    "analyst-query-broker",
     # MCP admin key management — per-tenant Bearer tokens for admin-ops.
     # Admin-ops-mcp authenticates incoming tokens by sha256-hash lookup
     # against tenant_mcp_admin_keys, populated by this handler's routes.
@@ -665,6 +808,11 @@ resource "aws_lambda_function" "handler" {
     # U2). EventBridge rate(1 minute) schedule + DLQ + MaxRetryAttempts=0
     # (defined in dedicated resources below).
     "compliance-outbox-drainer",
+    # THINK-189 U5: conformance judge sweeper. Scheduled (rate 2 min) +
+    # reserved_concurrent_executions=1 (single-writer makes direct
+    # process-and-complete safe) + MaxRetryAttempts=0 — the sweeper's own
+    # next tick is the retry (dedicated resources below).
+    "document-conformance-judge",
     # Phase 3 U6 of the Compliance audit-event log: runtime REST emit path.
     # Cross-runtime emit endpoint POST /api/compliance/events — Bearer
     # API_AUTH_SECRET, runtime clients post here with a
@@ -711,8 +859,8 @@ resource "aws_lambda_function" "handler" {
   # validates the agent, builds the AgentCore invoke payload, dispatches
   # Event-mode, and returns. Setup is ~5s in practice; 60s gives 12×
   # headroom for transient slowness.
-  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-thread-ingest" ? 300 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 90 : 30
-  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-thread-ingest" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
+  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
+  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
 
   filename         = local.use_local_zips ? "${var.lambda_zips_dir}/${each.key}.zip" : null
   source_code_hash = local.use_local_zips ? filebase64sha256("${var.lambda_zips_dir}/${each.key}.zip") : null
@@ -724,7 +872,20 @@ resource "aws_lambda_function" "handler" {
   # concurrent drainers would race the chain head SELECT and produce
   # orphan prev_hash links). All other handlers run with the default
   # account-level concurrency pool.
-  reserved_concurrent_executions = each.key == "compliance-outbox-drainer" ? 1 : each.key == "eval-worker" ? 20 : -1
+  # eval-worker's cap must be >= the fan-out event source mapping's
+  # maximum_concurrency (eval-fanout.tf) or UpdateEventSourceMapping
+  # rejects the apply.
+  # document-conformance-judge is also a single-writer: direct
+  # process-and-complete with no in-flight claim status depends on never
+  # having two sweepers race the same pending rows (THINK-189 KTD4).
+  # analyst-query-broker is capped low: each concurrent execution holds a
+  # dedicated analyst_reader Postgres connection and runs model-authored
+  # SQL — the cap bounds both connection pressure and the blast radius of
+  # a runaway delegation (THINK-228 U3).
+  # analyst-connection-reconciler is capped at 1: the probe holds one
+  # analyst_reader connection and overlapping probes are pointless (the
+  # cluster-global reader has one grant surface / one live schema).
+  reserved_concurrent_executions = each.key == "compliance-outbox-drainer" ? 1 : each.key == "document-conformance-judge" ? 1 : each.key == "eval-worker" ? 40 : each.key == "analyst-query-broker" ? 4 : each.key == "analyst-connection-reconciler" ? 1 : -1
 
   environment {
     variables = merge(
@@ -735,16 +896,11 @@ resource "aws_lambda_function" "handler" {
   }
 
   dynamic "vpc_config" {
-    for_each = (
-      (
-        contains(["knowledge-graph-thread-ingest", "knowledge-graph-observations-ingest"], each.key) ||
-        (each.key == "graphql-http" && var.memory_engine == "cognee")
-      ) && local.cognee_worker_vpc_enabled
-    ) ? [1] : each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
+    for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
 
     content {
-      subnet_ids         = each.key == "okf-efs-refresh" ? var.okf_efs_subnet_ids : var.cognee_worker_subnet_ids
-      security_group_ids = each.key == "okf-efs-refresh" ? var.okf_efs_security_group_ids : var.cognee_worker_security_group_ids
+      subnet_ids         = var.okf_efs_subnet_ids
+      security_group_ids = var.okf_efs_security_group_ids
     }
   }
 
@@ -993,6 +1149,41 @@ resource "aws_scheduler_schedule" "compliance_outbox_drainer" {
   }
 }
 
+# ---------------------------------------------------------------------------
+# THINK-189 U5: document-conformance-judge schedule + retry config
+#
+# The sweeper claims judge_status='pending' conformance reports and scores
+# each with one Bedrock Converse call. MaxRetryAttempts=0: rows stay
+# pending on a crash and the next tick re-claims them — Lambda-level async
+# retries would just race the schedule. Reserved concurrency 1 (set above)
+# is the single-writer guarantee for direct process-and-complete.
+# ---------------------------------------------------------------------------
+
+resource "aws_lambda_function_event_invoke_config" "document_conformance_judge" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["document-conformance-judge"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
+resource "aws_scheduler_schedule" "document_conformance_judge" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-document-conformance-judge"
+  group_name          = "default"
+  schedule_expression = "rate(2 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["document-conformance-judge"].arn
+    role_arn = aws_iam_role.scheduler.arn
+  }
+}
+
 # ---------------------------------------------------------------------------
 # API Gateway routes → Lambda integrations
 # ---------------------------------------------------------------------------
@@ -1197,10 +1388,11 @@ locals {
       # Webhooks (public trigger) — legacy PRD-19 tokenized webhooks.
       "POST /webhooks/{proxy+}" = "webhooks"
 
-      # n8n agent-step bridge — public tenant-scoped credential endpoint for
-      # stock n8n HTTP Request nodes.
-      "POST /api/integrations/n8n/agent-steps"    = "n8n-agent-step-bridge"
-      "OPTIONS /api/integrations/n8n/agent-steps" = "n8n-agent-step-bridge"
+      # Public artifact share links (THINK-208). Unauthenticated by design:
+      # the HMAC-signed token is the access grant, verified in handler code;
+      # every miss returns a uniform 404. GET-only — the page is a top-level
+      # navigation, so no OPTIONS/preflight fires (KTD-9).
+      "GET /share/{token}" = "artifact-share"
 
       # Webhooks admin
       "ANY /api/webhooks/{proxy+}" = "webhooks-admin"
@@ -1299,6 +1491,20 @@ locals {
       # retained as a break-glass superuser path for bootstrap/debug.
       "POST /mcp/admin" = "admin-ops-mcp"
 
+      # Analyst query broker — first-party MCP server exposing query
+      # (THINK-228 U3). Callers present the tenant-wide broker service
+      # credential as Bearer; SQL executes as the hardened analyst_reader
+      # role. The seeded postgres-dev connector row points at this route.
+      "POST /mcp/analyst" = "analyst-query-broker"
+
+      # Sourced analyst broker route (THINK-239) — the same handler serves a
+      # registered EXTERNAL Postgres source at /mcp/analyst/<slug>. The broker
+      # requires a signed caller context whose sourceClaims.slug matches the
+      # path (the legacy bearer is never accepted here) and connects using the
+      # per-source reader credential (thinkwork/<stage>/analyst/*, covered by
+      # the shared secretsmanager:GetSecretValue on thinkwork/*).
+      "POST /mcp/analyst/{sourceSlug}" = "analyst-query-broker"
+
       # MCP admin key management — per-tenant Bearer token CRUD. Tokens
       # are shown ONCE at creation (POST returns raw value); server stores
       # sha256 hash only. These specific routes take precedence over the
@@ -1448,15 +1654,15 @@ resource "aws_scheduler_schedule" "wakeup_processor" {
 }
 
 # ---------------------------------------------------------------------------
-# n8n agent-step expirer — resumes waiting n8n executions on timeout/retry
+# webhook_deliveries retention cron — daily delete of rows older than 90 days
 # ---------------------------------------------------------------------------
 
-resource "aws_scheduler_schedule" "n8n_agent_step_expirer" {
+resource "aws_scheduler_schedule" "webhook_deliveries_cleanup" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-n8n-agent-step-expirer"
+  name                = "thinkwork-${var.stage}-webhook-deliveries-cleanup"
   group_name          = "default"
-  schedule_expression = "rate(1 minutes)"
+  schedule_expression = "cron(0 4 * * ? *)" # daily at 04:00 UTC
   state               = "ENABLED"
 
   flexible_time_window {
@@ -1464,37 +1670,51 @@ resource "aws_scheduler_schedule" "n8n_agent_step_expirer" {
   }
 
   target {
-    arn      = aws_lambda_function.handler["n8n-agent-step-expirer"].arn
+    arn      = aws_lambda_function.handler["webhook-deliveries-cleanup"].arn
     role_arn = aws_iam_role.scheduler.arn
   }
 }
 
 # ---------------------------------------------------------------------------
-# webhook_deliveries retention cron — daily delete of rows older than 90 days
+# Requester memory dreaming — broad per-user memory compaction/reflection sweep
 # ---------------------------------------------------------------------------
 
-resource "aws_scheduler_schedule" "webhook_deliveries_cleanup" {
+# ---------------------------------------------------------------------------
+# Brain dream state — per-bank Hindsight consolidation with audit ledger
+# (THINK-133 U4). Retries are the ledger's job (staged plan -> atomic apply
+# -> applied markers; unfinished runs resume on the next tick), so Lambda
+# async retries stay at 0, mirroring memory-retain.
+# ---------------------------------------------------------------------------
+
+resource "aws_lambda_function_event_invoke_config" "brain_dream_state" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["brain-dream-state"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
+resource "aws_scheduler_schedule" "brain_dream_state" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-webhook-deliveries-cleanup"
+  name                = "thinkwork-${var.stage}-brain-dream-state"
   group_name          = "default"
-  schedule_expression = "cron(0 4 * * ? *)" # daily at 04:00 UTC
-  state               = "ENABLED"
+  schedule_expression = var.brain_dream_state_schedule_expression
+  state               = var.brain_dream_state_enabled ? "ENABLED" : "DISABLED"
 
   flexible_time_window {
     mode = "OFF"
   }
 
   target {
-    arn      = aws_lambda_function.handler["webhook-deliveries-cleanup"].arn
+    arn      = aws_lambda_function.handler["brain-dream-state"].arn
     role_arn = aws_iam_role.scheduler.arn
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
   }
 }
 
-# ---------------------------------------------------------------------------
-# Requester memory dreaming — broad per-user memory compaction/reflection sweep
-# ---------------------------------------------------------------------------
-
 resource "aws_scheduler_schedule" "requester_memory_dreaming" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
@@ -1564,6 +1784,64 @@ resource "aws_scheduler_schedule" "skill_runs_reconciler" {
   }
 }
 
+# ---------------------------------------------------------------------------
+# analyst_connection_reconciler — probes the analyst_reader connection every
+# 30 min (reachability, IAM auth, SELECT-grant introspection, zero-write
+# assertion, schema-drift hash; all read-only) and stamps the verdict onto
+# tenant_mcp_servers.runtime_metadata.analyst_probe. Dispatch withholds a
+# failing/stale connection loudly (THINK-229 U5, R7/R8, KTD8).
+#
+# retry-0 + DLQ (project_async_retry_idempotency_lessons): the probe is
+# cheap and idempotent — the next 30-minute tick IS the retry, so stacking
+# scheduler retries only adds redundant connections. A failure lands in the
+# DLQ for operator visibility instead.
+# ---------------------------------------------------------------------------
+
+resource "aws_sqs_queue" "analyst_connection_reconciler_dlq" {
+  count                     = local.deploy_lambda_handlers ? 1 : 0
+  name                      = "thinkwork-${var.stage}-analyst-connection-reconciler-dlq"
+  message_retention_seconds = 1209600 # 14 days
+
+  tags = {
+    Name = "thinkwork-${var.stage}-analyst-connection-reconciler-dlq"
+  }
+}
+
+resource "aws_lambda_function_event_invoke_config" "analyst_connection_reconciler" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["analyst-connection-reconciler"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+
+  destination_config {
+    on_failure {
+      destination = aws_sqs_queue.analyst_connection_reconciler_dlq[0].arn
+    }
+  }
+}
+
+resource "aws_scheduler_schedule" "analyst_connection_reconciler" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-analyst-connection-reconciler"
+  group_name          = "default"
+  schedule_expression = "rate(30 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["analyst-connection-reconciler"].arn
+    role_arn = aws_iam_role.scheduler.arn
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 # ---------------------------------------------------------------------------
 # eval_runs reconciler — finalizes stuck-running eval runs every 5 min.
 # Guards against worker crashes/timeouts that occur before a per-case result
@@ -1782,6 +2060,121 @@ resource "aws_scheduler_schedule" "cost_bill_reconciler" {
   }
 }
 
+# ---------------------------------------------------------------------------
+# cost_drift_check — THINK-245 U10/R9. Daily comparison of recorded per-model
+# LLM spend against Cost Explorer (day D-2; CE lags ~24h and refreshes by
+# early UTC afternoon). Emits CostDriftPercent / CostDriftCheckFailed EMF
+# metrics; the alarms below page the cost-alerts SNS topic. Drift discovered
+# by a customer instead of an alarm is the incident this exists to prevent.
+# ---------------------------------------------------------------------------
+
+resource "aws_scheduler_schedule" "cost_drift_check" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-cost-drift-check"
+  group_name          = "default"
+  schedule_expression = "cron(0 14 * * ? *)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["cost-drift-check"].arn
+    role_arn = aws_iam_role.scheduler.arn
+  }
+}
+
+# THINK-245 U10 — cost alerting channel. First notification-wired alarms in
+# the stack; endpoints come from var.cost_alert_emails (sensitive).
+resource "aws_sns_topic" "cost_alerts" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+  name  = "thinkwork-${var.stage}-cost-alerts"
+}
+
+resource "aws_sns_topic_subscription" "cost_alert_emails" {
+  for_each = local.deploy_lambda_handlers ? toset(nonsensitive(var.cost_alert_emails)) : toset([])
+
+  topic_arn = aws_sns_topic.cost_alerts[0].arn
+  protocol  = "email"
+  endpoint  = each.value
+}
+
+# Drift > 1% for the daily datapoint, or the drift check stopped emitting
+# entirely (treat_missing_data = breaching — a silent checker is itself the
+# failure mode; see the Jun 25–Jul 9 reconciler incident).
+resource "aws_cloudwatch_metric_alarm" "cost_drift" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-cost-drift"
+  alarm_description   = "Recorded per-model LLM spend diverges >1% from Cost Explorer (THINK-245 R9/AE5), or the drift check stopped emitting."
+  namespace           = "Thinkwork/Costs"
+  metric_name         = "CostDriftPercent"
+  statistic           = "Maximum"
+  period              = 86400
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanThreshold"
+  treat_missing_data  = "breaching"
+  alarm_actions       = [aws_sns_topic.cost_alerts[0].arn]
+  ok_actions          = [aws_sns_topic.cost_alerts[0].arn]
+
+  dimensions = {
+    Stage = var.stage
+  }
+}
+
+# Reconciler health (THINK-245 R8/AE4): sustained matched==0 while
+# unreconciled work exists, or the reconciler stopped emitting metrics at
+# all. Metric math because the condition spans two metrics.
+resource "aws_cloudwatch_metric_alarm" "cost_reconciler_stalled" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-cost-reconciler-stalled"
+  alarm_description   = "trace-invocation-reconciler matched 0 turns across an hour while unreconciled turns exist, or stopped emitting (THINK-245 R8/AE4 — this exact condition ran silently Jun 25–Jul 9)."
+  evaluation_periods  = 12
+  datapoints_to_alarm = 12
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "breaching"
+  alarm_actions       = [aws_sns_topic.cost_alerts[0].arn]
+  ok_actions          = [aws_sns_topic.cost_alerts[0].arn]
+
+  metric_query {
+    id          = "stalled"
+    expression  = "IF(matched == 0 AND unreconciled > 0, 1, 0)"
+    label       = "reconciler stalled"
+    return_data = true
+  }
+
+  metric_query {
+    id = "matched"
+    metric {
+      namespace   = "Thinkwork/Costs"
+      metric_name = "ReconcilerMatched"
+      period      = 300
+      stat        = "Sum"
+      dimensions = {
+        Stage = var.stage
+      }
+    }
+  }
+
+  metric_query {
+    id = "unreconciled"
+    metric {
+      namespace   = "Thinkwork/Costs"
+      metric_name = "ReconcilerUnreconciled"
+      period      = 300
+      stat        = "Sum"
+      dimensions = {
+        Stage = var.stage
+      }
+    }
+  }
+}
+
 # ---------------------------------------------------------------------------
 # Stall monitor — marks stalled thread turns and runbook steps failed every
 # minute. This is the global backstop for agent/runtime crashes; the Computer
@@ -1839,7 +2232,10 @@ resource "aws_scheduler_schedule" "knowledge_graph_observations_ingest" {
   name                = "thinkwork-${var.stage}-knowledge-graph-observations-ingest"
   group_name          = "default"
   schedule_expression = "rate(30 minutes)"
-  state               = "ENABLED"
+  # Ships DISABLED (plan 2026-07-03-005 U4/KTD-6): the schedule enables on dev
+  # only after a manual golden-set-validated run. Driven by the GHA
+  # WIKI_KG_INGEST_ENABLED var.
+  state = var.knowledge_graph_observations_ingest_enabled ? "ENABLED" : "DISABLED"
 
   flexible_time_window {
     mode = "OFF"
@@ -1849,6 +2245,14 @@ resource "aws_scheduler_schedule" "knowledge_graph_observations_ingest" {
     arn      = aws_lambda_function.handler["knowledge-graph-observations-ingest"].arn
     role_arn = aws_iam_role.scheduler.arn
     input    = jsonencode({ sweep = true, trigger = "scheduled" })
+
+    # Periodic idempotent worker: the next 30-minute tick IS the retry.
+    # Scheduler-level retries stack extra invocations onto a cadence that
+    # already self-corrects (cursor-guarded), compounding the invocation
+    # volume that helped trip Lambda recursive-loop detection.
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
   }
 }
 
@@ -1922,7 +2326,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "wiki_exports" {
   }
 }
 
-# Canonical Company Brain artifact store. Unlike wiki_exports, this bucket
+# Canonical ThinkWork Brain artifact store. Unlike wiki_exports, this bucket
 # is the durable replay/projection substrate for Brain source artifacts,
 # ingestion manifests, migration snapshots, vault projections, and exports.
 resource "aws_s3_bucket" "brain_artifacts" {
@@ -1931,7 +2335,7 @@ resource "aws_s3_bucket" "brain_artifacts" {
 
   tags = {
     Name    = "thinkwork-${var.stage}-brain-artifacts"
-    Purpose = "company-brain-artifacts"
+    Purpose = "brain-artifacts"
   }
 }