thinkwork-cli 0.12.16 → 0.12.17

package/dist/terraform/modules/app/agentcore-pi/main.tf

@@ -26,16 +26,16 @@ locals {
   chat_agent_activity_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_activity_fn_name}"
   manifest_log_fn_name        = "thinkwork-${var.stage}-api-manifest-log"
   manifest_log_fn_arn         = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.manifest_log_fn_name}"
-  pi_image_uri                = "${var.ecr_repository_url}:pi-latest"
-  cognee_vpc_enabled          = length(var.cognee_subnet_ids) > 0 && length(var.cognee_security_group_ids) > 0
-  okf_efs_vpc_enabled         = var.okf_efs_enabled && length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
-  private_vpc_enabled         = local.cognee_vpc_enabled || local.okf_efs_vpc_enabled
-  private_subnet_ids          = distinct(concat(var.cognee_subnet_ids, var.okf_efs_subnet_ids))
-  private_security_group_ids = distinct(concat(
-    var.cognee_security_group_ids,
-    var.okf_efs_security_group_ids,
-  ))
-  okf_efs_mount_enabled = local.okf_efs_vpc_enabled && var.okf_efs_file_system_arn != "" && var.okf_efs_read_access_point_arn != ""
+  # Release-backed deployments use an immutable, source-derived target tag so
+  # changing the release image also changes aws_lambda_function.image_uri.
+  # Reusing pi-latest lets Terraform miss the update even after ECR is retagged.
+  pi_image_tag               = var.source_image_uri != "" ? "pi-${substr(sha256(var.source_image_uri), 0, 16)}" : "pi-latest"
+  pi_image_uri               = "${var.ecr_repository_url}:${local.pi_image_tag}"
+  okf_efs_vpc_enabled        = var.okf_efs_enabled && length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
+  private_vpc_enabled        = local.okf_efs_vpc_enabled
+  private_subnet_ids         = var.okf_efs_subnet_ids
+  private_security_group_ids = var.okf_efs_security_group_ids
+  okf_efs_mount_enabled      = local.okf_efs_vpc_enabled && var.okf_efs_file_system_arn != "" && var.okf_efs_read_access_point_arn != ""
   okf_efs_iam_statements = local.okf_efs_mount_enabled ? [
     {
       Sid      = "OkfWikiEfsReadOnlyMount"
@@ -349,32 +349,14 @@ resource "terraform_data" "seed_pi_image" {
       set -euo pipefail
       repo_root="${abspath("${path.module}/../../../..")}"
       aws ecr get-login-password --region ${var.region} | docker login --username AWS --password-stdin ${var.account_id}.dkr.ecr.${var.region}.amazonaws.com
-      if docker pull "${var.source_image_uri}"; then
-        source_id="$(docker image inspect --format '{{.Id}}' "${var.source_image_uri}")"
-        docker tag "$source_id" "${local.pi_image_uri}"
-      else
-        # Unreachable source must not fail a stack whose target tag is already
-        # seeded (rerun after a partial deploy, or a registry that went
-        # private) — the Lambda only consumes the target ECR tag.
-        repo_name="$(basename "${var.ecr_repository_url}")"
-        if aws ecr describe-images --repository-name "$repo_name" --image-ids imageTag=pi-latest --region ${var.region} >/dev/null 2>&1; then
-          echo "WARN: could not pull ${var.source_image_uri}; ${local.pi_image_uri} is already seeded — keeping the existing image."
-          exit 0
-        fi
-        dockerfile="$repo_root/packages/agentcore-pi/agent-container/Dockerfile"
-        if [[ ! -f "$dockerfile" ]]; then
-          echo "ERROR: could not pull ${var.source_image_uri} and there is no repo checkout at $repo_root to build from." >&2
-          echo "The pinned release image must be pullable by this machine (public registry, or docker login to its registry)." >&2
-          echo "Alternatively set agentcore_pi_source_image_uri in terraform.tfvars to an image this AWS account can pull." >&2
-          exit 1
-        fi
-        echo "Unable to pull release image ${var.source_image_uri}; building Pi image from $repo_root"
-        docker build \
-          --platform linux/amd64 \
-          -f "$dockerfile" \
-          -t "${local.pi_image_uri}" \
-          "$repo_root"
+      if ! docker pull "${var.source_image_uri}"; then
+        echo "ERROR: could not pull pinned Pi release image ${var.source_image_uri}." >&2
+        echo "Refusing to retain an older runtime while reporting this release as deployed." >&2
+        echo "Authenticate the deploy runner to the source registry or provide a pullable agentcore_pi_source_image_uri." >&2
+        exit 1
       fi
+      source_id="$(docker image inspect --format '{{.Id}}' "${var.source_image_uri}")"
+      docker tag "$source_id" "${local.pi_image_uri}"
       docker push "${local.pi_image_uri}"
     EOT
   }
@@ -403,8 +385,10 @@ resource "aws_lambda_function" "agentcore_pi" {
       CHAT_AGENT_ACTIVITY_FN_NAME            = local.chat_agent_activity_fn_name
       MANIFEST_LOG_FUNCTION_NAME             = local.manifest_log_fn_name
       HINDSIGHT_ENDPOINT                     = var.hindsight_endpoint
-      THINKWORK_API_URL                      = var.api_endpoint
-      API_AUTH_SECRET                        = var.api_auth_secret
+      # THINK-220 cutover flag — see the variable description.
+      HINDSIGHT_DATABASE_NAME = var.hindsight_database_name
+      THINKWORK_API_URL       = var.api_endpoint
+      API_AUTH_SECRET         = var.api_auth_secret
       # Plan §005 U4 — AuroraSessionStore uses the RDS Data API to persist
       # Pi's SessionData blobs against threads.session_data. Empty during
       # the first greenfield apply (DB cluster doesn't exist yet); the
@@ -412,7 +396,14 @@ resource "aws_lambda_function" "agentcore_pi" {
       DB_CLUSTER_ARN             = var.db_cluster_arn
       DB_SECRET_ARN              = var.db_secret_arn
       OKF_WIKI_NAVIGATOR_ENABLED = tostring(local.okf_efs_mount_enabled)
-      OKF_WIKI_ROOT              = var.okf_efs_mount_path
+      # THINK-173 U6: PUBLIC key only — the container verifies capability
+      # manifests and must never hold signing material (KTD-3).
+      CAPABILITY_SIGNING_PUBLIC_KEY = var.capability_signing_public_key
+      OKF_WIKI_ROOT                 = var.okf_efs_mount_path
+      # Per-model Bedrock region overrides, honored by the patched pi-ai
+      # provider (patches/@earendil-works__pi-ai). SigV4 signing and endpoint
+      # selection both follow the override.
+      PI_BEDROCK_MODEL_REGIONS = jsonencode(var.pi_bedrock_model_regions)
     }
   }
 

package/dist/terraform/modules/app/agentcore-pi/variables.tf

@@ -49,6 +49,12 @@ variable "hindsight_endpoint" {
   default     = ""
 }
 
+variable "hindsight_database_name" {
+  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty = the provider's direct SQL (high-confidence-fact recall, access-count writes) targets the `hindsight` schema of the primary database; set = that database's `public` schema."
+  type        = string
+  default     = ""
+}
+
 variable "agentcore_memory_id" {
   description = "AgentCore Memory resource ID. Populated automatically by the agentcore-memory module; injected into the container as AGENTCORE_MEMORY_ID for auto-retention."
   type        = string
@@ -69,12 +75,12 @@ variable "api_auth_secret" {
 }
 
 variable "memory_engine" {
-  description = "Active long-term memory engine ('hindsight', 'agentcore', or 'cognee'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
+  description = "Active long-term memory engine ('hindsight' or 'agentcore'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
   type        = string
   default     = "hindsight"
   validation {
-    condition     = contains(["hindsight", "agentcore", "cognee"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight', 'agentcore', or 'cognee'."
+    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
+    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
   }
 }
 
@@ -96,18 +102,6 @@ variable "db_secret_arn" {
   default     = ""
 }
 
-variable "cognee_subnet_ids" {
-  description = "Subnet IDs for Pi's private-network attachment when Company Brain/Cognee direct MCP access is enabled."
-  type        = list(string)
-  default     = []
-}
-
-variable "cognee_security_group_ids" {
-  description = "Security group IDs for Pi's private-network attachment when Company Brain/Cognee direct MCP access is enabled."
-  type        = list(string)
-  default     = []
-}
-
 variable "okf_efs_enabled" {
   description = "When true, mount the generated OKF wiki EFS view into Pi. Requires subnet/security-group inputs and an access point ARN."
   type        = bool
@@ -143,3 +137,17 @@ variable "okf_efs_mount_path" {
   type        = string
   default     = "/mnt/thinkwork-okf"
 }
+
+variable "pi_bedrock_model_regions" {
+  description = "Per-model Bedrock region overrides for the Pi runtime (PI_BEDROCK_MODEL_REGIONS). Routes individual model ids to another region when a regional marketplace endpoint degrades (e.g. the 2026-07-06 moonshotai.kimi-k2.5 us-east-1 throughput collapse). Empty map = no overrides; revert by setting {}."
+  type        = map(string)
+  default = {
+    "moonshotai.kimi-k2.5" = "us-west-2"
+  }
+}
+
+variable "capability_signing_public_key" {
+  description = "Ed25519 public key (SPKI PEM) the runtime verifies capability manifests with (THINK-173). Empty = manifest-mode invocations fail closed."
+  type        = string
+  default     = ""
+}

package/dist/terraform/modules/app/agentcore-runtime/main.tf

@@ -59,12 +59,12 @@ variable "nova_act_api_key" {
 }
 
 variable "memory_engine" {
-  description = "Active long-term memory engine ('hindsight', 'agentcore', or 'cognee'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
+  description = "Active long-term memory engine ('hindsight' or 'agentcore'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
   type        = string
   default     = "hindsight"
   validation {
-    condition     = contains(["hindsight", "agentcore", "cognee"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight', 'agentcore', or 'cognee'."
+    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
+    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
   }
 }
 

package/dist/terraform/modules/app/customer-domain/main.tf

@@ -132,6 +132,18 @@ variable "email_inbound_fn_name" {
   default     = ""
 }
 
+variable "email_inbound_fn_name_attr" {
+  description = "Attribute-based twin of email_inbound_fn_name (dependency ordering; attributes only, never count)."
+  type        = string
+  default     = ""
+}
+
+variable "email_inbound_fn_arn_attr" {
+  description = "Attribute-based twin of email_inbound_fn_arn (dependency ordering; attributes only, never count)."
+  type        = string
+  default     = ""
+}
+
 variable "enable_email_inbound_lambda_action" {
   description = "Attach the email-inbound Lambda action and invoke permission to the customer-domain receipt rule."
   type        = bool
@@ -416,7 +428,9 @@ resource "aws_lambda_permission" "ses_invoke_email_inbound" {
   count          = local.has_lambda ? 1 : 0
   statement_id   = "AllowSESInvokeEmailInboundCustomerDomain"
   action         = "lambda:InvokeFunction"
-  function_name  = var.email_inbound_fn_name
+  # Prefer the attribute-based twin: it orders this permission after the
+  # function's creation (the static name carries no dependency edge).
+  function_name  = var.email_inbound_fn_name_attr != "" ? var.email_inbound_fn_name_attr : var.email_inbound_fn_name
   principal      = "ses.amazonaws.com"
   source_account = var.account_id
 }
@@ -444,7 +458,7 @@ resource "aws_ses_receipt_rule" "inbound" {
   dynamic "lambda_action" {
     for_each = local.has_lambda ? [1] : []
     content {
-      function_arn    = var.email_inbound_fn_arn
+      function_arn    = var.email_inbound_fn_arn_attr != "" ? var.email_inbound_fn_arn_attr : var.email_inbound_fn_arn
       invocation_type = "Event"
       position        = local.has_bucket ? 2 : 1
     }

package/dist/terraform/modules/app/deployment-control-plane/main.tf

@@ -329,6 +329,11 @@ resource "aws_iam_role_policy" "codebuild" {
           "scheduler:*",
           "secretsmanager:*",
           "ses:*",
+          # THINK-245 shipped SNS-backed cost alerting (aws_sns_topic
+          # cost_alerts) — without this, customer runner applies fail on
+          # SNS:CreateTopic. Live TEI/McPherson roles were hand-patched
+          # 2026-07-09; this keeps future installs correct.
+          "sns:*",
           "sqs:*",
           "ssm:*",
           "states:*",

package/dist/terraform/modules/app/deployment-control-plane/runner.py

@@ -543,7 +543,6 @@ def controller_input_summary(payload):
         "features": payload.get("features")
         or {
             "baseInstall": {
-                "cognee": False,
                 "slack": False,
                 "stripe": False,
                 "twenty": False,
@@ -1147,6 +1146,19 @@ def state_terraform_data_input(state, name):
     return {}
 
 
+def state_root_resource_attributes(state, rtype, name):
+    for resource in state.get("resources", []) or []:
+        if resource.get("module"):
+            continue
+        if resource.get("type") != rtype or resource.get("name") != name:
+            continue
+        for instance in resource.get("instances", []) or []:
+            attributes = instance.get("attributes")
+            if isinstance(attributes, dict):
+                return attributes
+    return {}
+
+
 def state_cloudflare_zone_id(state):
     for resource in state.get("resources", []) or []:
         if resource.get("type") != "cloudflare_record":
@@ -1829,10 +1841,6 @@ def managed_app_terraform_overrides(payload, stage, account_id, current_outputs,
     if not isinstance(manifest_images, dict):
         manifest_images = {}
     validate_managed_app_desired_state(payload, desired_config, manifest_images)
-    cognee_guardrails = state_terraform_data_input(
-        current_state,
-        "cognee_configuration_guardrails",
-    )
     twenty_guardrails = state_terraform_data_input(
         current_state,
         "twenty_configuration_guardrails",
@@ -1843,81 +1851,6 @@ def managed_app_terraform_overrides(payload, stage, account_id, current_outputs,
     )
 
     overrides = {
-        "enable_cognee": bool(state_output(current_outputs, "cognee_enabled", False)),
-        "cognee_image_uri": cognee_guardrails.get("cognee_image_uri", ""),
-        "cognee_db_username": cognee_guardrails.get("cognee_db_username", "thinkwork_cognee"),
-        "cognee_db_name": cognee_guardrails.get("cognee_db_name", "thinkwork_cognee"),
-        "cognee_db_password_secret_arn": cognee_guardrails.get(
-            "cognee_db_password_secret_arn",
-            "",
-        ),
-        "cognee_backend_mode": cognee_guardrails.get("cognee_backend_mode", "dogfood"),
-        "cognee_desired_count": cognee_guardrails.get("cognee_desired_count", 1),
-        "cognee_brain_tenant_id": state_output(current_outputs, "cognee_brain_tenant_id", ""),
-        "cognee_brain_instance_key": state_output(
-            current_outputs,
-            "cognee_brain_instance_key",
-            "",
-        ),
-        "cognee_brain_storage_tier": cognee_guardrails.get(
-            "cognee_brain_storage_tier",
-            state_output(current_outputs, "cognee_brain_storage_tier", "default"),
-        ),
-        "cognee_brain_s3_artifact_root": state_output(
-            current_outputs,
-            "cognee_s3_artifact_root",
-            "",
-        ),
-        "cognee_brain_s3_manifest_root": state_output(
-            current_outputs,
-            "cognee_s3_manifest_root",
-            "",
-        ),
-        "cognee_brain_s3_vault_projection_root": state_output(
-            current_outputs,
-            "cognee_s3_vault_projection_root",
-            "",
-        ),
-        "cognee_private_substrate_mode": bool(
-            state_output(current_outputs, "cognee_private_substrate_mode", True)
-        ),
-        "cognee_llm_provider": cognee_guardrails.get("cognee_llm_provider", "bedrock"),
-        "cognee_llm_model": "bedrock/moonshotai.kimi-k2.5",
-        "cognee_embedding_provider": cognee_guardrails.get(
-            "cognee_embedding_provider",
-            "bedrock",
-        ),
-        "cognee_embedding_model": state_output(
-            current_outputs,
-            "cognee_embedding_model",
-            "amazon.titan-embed-text-v2:0",
-        ),
-        "cognee_embedding_dimensions": state_output(
-            current_outputs,
-            "cognee_embedding_dimensions",
-            1024,
-        ),
-        "cognee_vector_db_provider": state_output(
-            current_outputs,
-            "cognee_vector_db_provider",
-            "lancedb",
-        ),
-        "cognee_graph_database_provider": state_output(
-            current_outputs,
-            "cognee_graph_database_provider",
-            "kuzu",
-        ),
-        "cognee_neptune_graph_id": state_output(current_outputs, "cognee_neptune_graph_id", ""),
-        "cognee_neptune_endpoint": state_output(current_outputs, "cognee_neptune_endpoint", ""),
-        "cognee_production_posture": state_output(
-            current_outputs,
-            "cognee_production_posture",
-            "",
-        ),
-        "cognee_bedrock_model_resource_arns": cognee_guardrails.get(
-            "cognee_bedrock_model_resources",
-            [],
-        ),
         "twenty_provisioned": bool(state_output(current_outputs, "twenty_provisioned", False)),
         "twenty_runtime_enabled": bool(
             state_output(current_outputs, "twenty_runtime_enabled", False)
@@ -2012,6 +1945,35 @@ def managed_app_terraform_overrides(payload, stage, account_id, current_outputs,
         "n8n_dns_name": "",
     }
 
+    # Foundation updates must not tear down n8n's managed certificate/DNS:
+    # the guardrail records the managed cert's own ARN, which (combined with
+    # a blank n8n_domain) flips n8n_managed_certificate_enabled off and
+    # plans a destroy of a cert still attached to the n8n ALB (observed:
+    # McPherson update to v0.1.0-canary.314). When state shows the root
+    # managed cert, reproduce the install-time inputs instead.
+    managed_n8n_cert = state_root_resource_attributes(
+        current_state, "aws_acm_certificate", "n8n"
+    )
+    if managed_n8n_cert:
+        overrides["n8n_domain"] = (
+            managed_n8n_cert.get("domain_name")
+            or url_hostname(overrides["n8n_public_url"])
+            or ""
+        )
+        overrides["n8n_certificate_arn"] = ""
+    foundation_n8n_dns_name = overrides["n8n_domain"] or url_hostname(
+        overrides["n8n_public_url"]
+    )
+    if overrides["n8n_provisioned"] and foundation_n8n_dns_name:
+        # State-derived zone lookup goes blank once the cloudflare_record
+        # resources are absent (e.g. a prior partial destroy) — fall back
+        # to the Cloudflare API resolver the n8n install path uses.
+        overrides["cloudflare_zone_id"] = overrides[
+            "cloudflare_zone_id"
+        ] or cloudflare_zone_id_for_hostname(stage, foundation_n8n_dns_name)
+        overrides["n8n_dns_name"] = foundation_n8n_dns_name
+        overrides["n8n_dns_enabled"] = bool(overrides["cloudflare_zone_id"])
+
     if app_key == "n8n":
         provisioned = operation != "DESTROY"
         overrides.update(
@@ -2932,6 +2894,31 @@ def pg_literal(value):
     return "'" + value.replace("'", "''") + "'"
 
 
+def ensure_hindsight_database(database_url, vars_json):
+    """THINK-220: the dedicated Hindsight database is bootstrap SQL — Terraform
+    cannot CREATE DATABASE inside the cluster. Runs post-apply; the Hindsight
+    service may crash-loop briefly on a first enablement until this creates
+    the database, then ECS stabilizes on its own. Vanilla boot migrations
+    (RUN_MIGRATIONS_ON_STARTUP) build the schema, including the maintenance
+    discovery functions the repair migration installs on base-schema runs."""
+    db_name = (vars_json.get("hindsight_database_name") or "").strip()
+    if not db_name:
+        return
+    if not re.fullmatch(r"[a-z][a-z0-9_]*", db_name):
+        raise RuntimeError(f"invalid hindsight_database_name: {db_name!r}")
+    admin_url = re.sub(r"/[^/?]+(\?|$)", r"/postgres\1", database_url, count=1)
+    exists = psql_output(
+        admin_url,
+        f"SELECT 1 FROM pg_database WHERE datname = '{db_name}'",
+    ).strip()
+    if not exists:
+        print(f"[hindsight] creating database {db_name}")
+        psql(admin_url, sql=f'CREATE DATABASE "{db_name}"')
+    hindsight_url = re.sub(r"/[^/?]+(\?|$)", f"/{db_name}\\1", database_url, count=1)
+    psql(hindsight_url, sql="CREATE EXTENSION IF NOT EXISTS vector;")
+    print(f"[hindsight] database {db_name} ready (pgvector ensured)")
+
+
 def push_database_schema(outputs_path, vars_json):
     outputs = json.loads(outputs_path.read_text(encoding="utf-8"))
     checkout_source(
@@ -2940,6 +2927,7 @@ def push_database_schema(outputs_path, vars_json):
         os.environ.get("THINKWORK_RELEASE_VERSION", "main"),
     )
     database_url = database_url_from_outputs(outputs)
+    ensure_hindsight_database(database_url, vars_json)
     fresh = not psql_output(database_url, "SELECT to_regclass('public.tenants')").strip()
     ledger_present = bool(
         psql_output(database_url, "SELECT to_regclass('public.platform_schema_migrations')").strip()
@@ -3065,6 +3053,16 @@ def write_runner_files(payload, runner_secrets):
             "enableHindsight",
             default=False,
         ),
+        # THINK-220: dedicated Hindsight database on the stage cluster.
+        # Empty keeps the legacy hindsight-schema layout; set (e.g.
+        # "thinkwork_hindsight") points the Hindsight service and platform
+        # readers at that database's public schema, where upstream's
+        # maintenance discovery actually runs.
+        "hindsight_database_name": safe_get(
+            reviewed_payload,
+            "hindsightDatabaseName",
+            default="",
+        ),
         "platform_operator_emails": safe_get(
             runner_secrets,
             "adminEmail",
@@ -3264,6 +3262,11 @@ variable "enable_hindsight" {{
   type = bool
 }}
 
+variable "hindsight_database_name" {{
+  type    = string
+  default = ""
+}}
+
 variable "platform_operator_emails" {{
   type = string
 }}
@@ -3365,106 +3368,6 @@ variable "deployment_control_plane_create_secret_placeholders" {{
   type = bool
 }}
 
-variable "enable_cognee" {{
-  type = bool
-}}
-
-variable "cognee_image_uri" {{
-  type = string
-}}
-
-variable "cognee_db_username" {{
-  type = string
-}}
-
-variable "cognee_db_name" {{
-  type = string
-}}
-
-variable "cognee_db_password_secret_arn" {{
-  type = string
-}}
-
-variable "cognee_backend_mode" {{
-  type = string
-}}
-
-variable "cognee_desired_count" {{
-  type = number
-}}
-
-variable "cognee_brain_tenant_id" {{
-  type = string
-}}
-
-variable "cognee_brain_instance_key" {{
-  type = string
-}}
-
-variable "cognee_brain_storage_tier" {{
-  type = string
-}}
-
-variable "cognee_brain_s3_artifact_root" {{
-  type = string
-}}
-
-variable "cognee_brain_s3_manifest_root" {{
-  type = string
-}}
-
-variable "cognee_brain_s3_vault_projection_root" {{
-  type = string
-}}
-
-variable "cognee_private_substrate_mode" {{
-  type = bool
-}}
-
-variable "cognee_llm_provider" {{
-  type = string
-}}
-
-variable "cognee_llm_model" {{
-  type = string
-}}
-
-variable "cognee_embedding_provider" {{
-  type = string
-}}
-
-variable "cognee_embedding_model" {{
-  type = string
-}}
-
-variable "cognee_embedding_dimensions" {{
-  type = number
-}}
-
-variable "cognee_vector_db_provider" {{
-  type = string
-}}
-
-variable "cognee_graph_database_provider" {{
-  type = string
-}}
-
-variable "cognee_neptune_graph_id" {{
-  type = string
-}}
-
-variable "cognee_neptune_endpoint" {{
-  type = string
-}}
-
-variable "cognee_production_posture" {{
-  type = string
-}}
-
-variable "cognee_bedrock_model_resource_arns" {{
-  type = list(string)
-}}
-
 variable "enable_deployment_control_plane" {{
   type = bool
 }}
@@ -3752,33 +3655,9 @@ module "thinkwork" {{
   agentcore_pi_source_image_uri = var.agentcore_pi_source_image_uri
 
   enable_hindsight               = var.enable_hindsight
+  hindsight_database_name        = var.hindsight_database_name
   enable_workspace_orchestration = true
 
-  enable_cognee          = var.enable_cognee
-  cognee_image_uri       = var.cognee_image_uri
-  cognee_db_username     = var.cognee_db_username
-  cognee_db_name         = var.cognee_db_name
-  cognee_db_password_secret_arn = var.cognee_db_password_secret_arn
-  cognee_backend_mode    = var.cognee_backend_mode
-  cognee_desired_count   = var.cognee_desired_count
-  cognee_brain_tenant_id                = var.cognee_brain_tenant_id
-  cognee_brain_instance_key             = var.cognee_brain_instance_key
-  cognee_brain_storage_tier             = var.cognee_brain_storage_tier
-  cognee_brain_s3_artifact_root         = var.cognee_brain_s3_artifact_root
-  cognee_brain_s3_manifest_root         = var.cognee_brain_s3_manifest_root
-  cognee_brain_s3_vault_projection_root = var.cognee_brain_s3_vault_projection_root
-  cognee_private_substrate_mode         = var.cognee_private_substrate_mode
-  cognee_llm_provider                   = var.cognee_llm_provider
-  cognee_llm_model                      = var.cognee_llm_model
-  cognee_embedding_provider             = var.cognee_embedding_provider
-  cognee_embedding_model                = var.cognee_embedding_model
-  cognee_embedding_dimensions           = var.cognee_embedding_dimensions
-  cognee_vector_db_provider             = var.cognee_vector_db_provider
-  cognee_graph_database_provider        = var.cognee_graph_database_provider
-  cognee_neptune_graph_id               = var.cognee_neptune_graph_id
-  cognee_neptune_endpoint               = var.cognee_neptune_endpoint
-  cognee_production_posture             = var.cognee_production_posture
-  cognee_bedrock_model_resource_arns    = var.cognee_bedrock_model_resource_arns
   twenty_provisioned     = var.twenty_provisioned
   twenty_runtime_enabled = var.twenty_runtime_enabled
   twenty_image_uri       = var.twenty_image_uri
@@ -3873,7 +3752,6 @@ output "admin_client_id" {{ value = module.thinkwork.admin_client_id }}
   output "docs_bucket_name" {{ value = module.thinkwork.docs_bucket_name }}
   output "docs_distribution_id" {{ value = module.thinkwork.docs_distribution_id }}
   output "docs_distribution_domain" {{ value = module.thinkwork.docs_distribution_domain }}
-output "cognee_enabled" {{ value = module.thinkwork.cognee_enabled }}
 output "twenty_provisioned" {{ value = module.thinkwork.twenty_provisioned }}
 output "twenty_runtime_enabled" {{ value = module.thinkwork.twenty_runtime_enabled }}
 output "twenty_url" {{ value = module.thinkwork.twenty_url }}
@@ -4508,7 +4386,7 @@ def write_evidence(status, vars_json=None, terraform_exit_code=None, error=None)
         "environmentName": vars_json.get("stage"),
         "awsAccountId": vars_json.get("account_id"),
         "awsRegion": vars_json.get("region"),
-        "managedApps": {"cognee": False, "twenty": False},
+        "managedApps": {"twenty": False},
         "codebuildBuildId": os.environ.get("CODEBUILD_BUILD_ID"),
         "terraformExitCode": terraform_exit_code,
         "startedAt": STARTED_AT,