thinkwork-cli 0.12.16 → 0.13.0

package/dist/terraform/examples/greenfield/main.tf

@@ -93,264 +93,23 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
-variable "enable_hindsight" {
-  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
-  type        = bool
-  default     = true
-}
-
-variable "memory_engine" {
-  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments; 'cognee' is legacy diagnostic compatibility, not the supported user/Space memory path."
-  type        = string
-  default     = ""
-}
-
-variable "enable_cognee" {
-  description = "Enable Cognee as optional ThinkWork Brain ontology/knowledge-graph infrastructure. Disabled by default."
-  type        = bool
-  default     = false
-}
-
-variable "cognee_image_uri" {
-  description = "Cognee container image URI pinned to an immutable sha256 digest. Required when enable_cognee = true."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_db_username" {
-  description = "Dedicated PostgreSQL username for Cognee metadata storage."
-  type        = string
-  default     = "thinkwork_cognee"
-}
-
-variable "cognee_db_name" {
-  description = "Dedicated PostgreSQL database name for Cognee metadata storage."
-  type        = string
-  default     = "thinkwork_cognee"
-}
-
-variable "cognee_db_password_secret_arn" {
-  description = "Secrets Manager ARN containing a JSON password field for the dedicated Cognee PostgreSQL user. Required when enable_cognee = true."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_allowed_internal_cidr_blocks" {
-  description = "CIDR blocks allowed to reach the internal Cognee ALB."
-  type        = list(string)
-  default     = []
-}
-
-variable "cognee_allowed_internal_security_group_ids" {
-  description = "Security group IDs allowed to reach the internal Cognee ALB."
-  type        = list(string)
-  default     = []
-}
-
-variable "cognee_backend_mode" {
-  description = "Cognee backend mode. dogfood uses EFS-backed local stores; remote requires graph/vector URLs."
-  type        = string
-  default     = "dogfood"
-}
-
-variable "cognee_desired_count" {
-  description = "Desired Cognee task count. Dogfood mode must stay at 1."
-  type        = number
-  default     = 1
-}
-
-variable "cognee_brain_tenant_id" {
-  description = "Tenant ID for a tenant-scoped Company Brain substrate instance. Empty preserves legacy stage-wide Cognee names."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_brain_instance_key" {
-  description = "Stable tenant-scoped Brain instance key used to derive resource names."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_brain_storage_tier" {
-  description = "Company Brain storage tier: default or production."
-  type        = string
-  default     = "default"
-}
-
-variable "cognee_brain_s3_artifact_root" {
-  description = "Canonical Company Brain S3 root URI for source artifacts."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_brain_s3_manifest_root" {
-  description = "Canonical Company Brain S3 root URI for ingestion manifests."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_brain_s3_vault_projection_root" {
-  description = "Canonical Company Brain S3 root URI for vault/materialized projections."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_brain_artifacts_bucket_arn" {
-  description = "Optional canonical Company Brain artifacts bucket ARN for scoped task-role access."
+variable "hindsight_database_name" {
+  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty keeps Hindsight in the hindsight schema of the primary database."
   type        = string
   default     = ""
 }
 
-variable "cognee_brain_artifacts_prefixes" {
-  description = "Tenant/stage prefixes inside cognee_brain_artifacts_bucket_arn the Brain task may access."
-  type        = list(string)
-  default     = []
-}
-
-variable "cognee_private_substrate_mode" {
-  description = "Whether the Company Brain substrate is private/internal-only."
+variable "enable_hindsight" {
+  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
   type        = bool
   default     = true
 }
 
-variable "cognee_require_authentication" {
-  description = "Passed to Cognee REQUIRE_AUTHENTICATION."
-  type        = bool
-  default     = false
-}
-
-variable "cognee_enable_backend_access_control" {
-  description = "Passed to Cognee ENABLE_BACKEND_ACCESS_CONTROL."
-  type        = bool
-  default     = false
-}
-
-variable "cognee_cors_allowed_origins" {
-  description = "Passed to Cognee CORS_ALLOWED_ORIGINS."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_llm_provider" {
-  description = "Cognee LLM provider."
-  type        = string
-  default     = "bedrock"
-}
-
-variable "cognee_llm_model" {
-  description = "Cognee LLM model. Must handle tool-use structured extraction reliably — nova-lite repeatedly produced invalid ToolUse sequences on observation documents, and Haiku is rate-limited on this account. Kimi K2.5 is ON_DEMAND (no inference profile needed)."
-  type        = string
-  default     = "bedrock/moonshotai.kimi-k2.5"
-}
-
-variable "cognee_llm_api_key_secret_arn" {
-  description = "Optional Secrets Manager ARN for non-Bedrock Cognee LLM provider API key."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_embedding_provider" {
-  description = "Cognee embedding provider."
-  type        = string
-  default     = "bedrock"
-}
-
-variable "cognee_embedding_model" {
-  description = "Cognee embedding model."
-  type        = string
-  default     = "amazon.titan-embed-text-v2:0"
-}
-
-variable "cognee_embedding_dimensions" {
-  description = "Cognee embedding dimensions."
-  type        = number
-  default     = 1024
-}
-
-variable "cognee_embedding_api_key_secret_arn" {
-  description = "Optional Secrets Manager ARN for non-Bedrock Cognee embedding provider API key."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_vector_db_provider" {
-  description = "Cognee vector store provider."
-  type        = string
-  default     = "lancedb"
-}
-
-variable "cognee_vector_db_url" {
-  description = "Cognee vector store URL. Empty uses the dogfood local default."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_vector_db_key_secret_arn" {
-  description = "Optional Secrets Manager ARN for remote Cognee vector store credentials."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_graph_database_provider" {
-  description = "Cognee graph store provider."
-  type        = string
-  default     = "kuzu"
-}
-
-variable "cognee_graph_database_url" {
-  description = "Cognee graph store URL. Empty uses the dogfood local default."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_graph_database_username" {
-  description = "Optional Cognee graph store username."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_graph_database_password_secret_arn" {
-  description = "Optional Secrets Manager ARN for remote Cognee graph store password."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_neptune_graph_id" {
-  description = "Neptune Analytics graph ID used by the production Brain tier."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_neptune_graph_arn" {
-  description = "Optional Neptune Analytics graph ARN for scoped task-role access."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_neptune_endpoint" {
-  description = "Neptune Analytics endpoint used by the production Brain tier."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_production_posture" {
-  description = "Operator evidence string for production-tier approval/readiness posture."
+variable "memory_engine" {
+  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments."
   type        = string
   default     = ""
 }
-
-variable "cognee_bedrock_model_resource_arns" {
-  description = "Explicit Bedrock model ARNs Cognee may invoke when a Bedrock provider is selected."
-  type        = list(string)
-  default     = []
-}
-
-variable "cognee_kms_key_arns" {
-  description = "Optional KMS key ARNs needed to decrypt Cognee-injected secrets."
-  type        = list(string)
-  default     = []
-}
-
 variable "twenty_provisioned" {
   description = "Provision the retained Twenty CRM managed-app substrate. Runtime can be parked independently with twenty_runtime_enabled."
   type        = bool
@@ -477,11 +236,6 @@ variable "n8n_service_credential_secret_arn" {
   default     = ""
 }
 
-variable "n8n_agent_step_bridge_credential_secret_arn" {
-  description = "Secrets Manager ARN containing the inbound credential used by n8n workflows to call the ThinkWork agent-step bridge."
-  type        = string
-  default     = ""
-}
 
 variable "n8n_storage_bucket_name" {
   description = "S3 bucket name used for n8n managed artifacts and optional storage mode objects."
@@ -656,15 +410,21 @@ variable "requester_memory_dreaming_schedule_expression" {
   default     = "cron(30 4 * * ? *)"
 }
 
+variable "brain_dream_state_enabled" {
+  description = "Enable the recurring Brain dream-state consolidation schedule (THINK-261 #5). Manual invokes work regardless via event.manual."
+  type        = bool
+  default     = false
+}
+
 variable "requester_memory_dreaming_model_id" {
   description = "Bedrock Converse model id for requester memory REM reflection."
   type        = string
   default     = "openai.gpt-oss-120b-1:0"
 }
 
-variable "company_brain_source_agent_model_id" {
+variable "brain_source_agent_model_id" {
   description = <<-EOT
-    Bedrock model id the GraphQL Company Brain source-agent runtime uses
+    Bedrock model id the GraphQL Brain source-agent runtime uses
     for JSON tool/action turns. Defaults to Claude Haiku 4.5 for reliable
     action JSON while wiki compile can stay on gpt-oss for throughput.
   EOT
@@ -672,6 +432,34 @@ variable "company_brain_source_agent_model_id" {
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
+variable "knowledge_graph_observations_ingest_enabled" {
+  description = "Enable the Brain distillation schedule (observations -> knowledge graph). Ships disabled; flip on dev after a validated manual run (plan 2026-07-03-005 U4)."
+  type        = bool
+  default     = false
+}
+
+variable "wiki_source" {
+  description = "Wiki compile pipeline source: 'planner' (LLM compile) or 'graph' (deterministic graph->wiki materializer). Dev flips first per THINK-133 U8/KTD-4; the default flips for all stages only after dev comparison evidence holds."
+  type        = string
+  default     = "planner"
+
+  validation {
+    condition     = contains(["planner", "graph"], var.wiki_source)
+    error_message = "wiki_source must be 'planner' or 'graph'."
+  }
+}
+
+variable "analyst_policy_source" {
+  description = "THINK-229 KTD5 enforcement flip for the analyst connection policy source: 'row' (default — signed sidecar policy is shadow-only) or 'sidecar' (the sidecar block is authoritative). Flip only after clean shadow parity on live traffic."
+  type        = string
+  default     = "row"
+
+  validation {
+    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
+    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
+  }
+}
+
 variable "wiki_aggregation_pass_enabled" {
   description = <<-EOT
     Feature flag for the wiki aggregation pass — the second LLM call
@@ -958,90 +746,49 @@ module "thinkwork" {
 
   plugin_catalog_github_token_secret_arn = var.plugin_catalog_github_token_secret_arn
 
-  db_password                                 = var.db_password
-  database_engine                             = var.database_engine
-  enable_hindsight                            = var.enable_hindsight
-  memory_engine                               = var.memory_engine
-  enable_cognee                               = var.enable_cognee
-  cognee_image_uri                            = var.cognee_image_uri
-  cognee_db_username                          = var.cognee_db_username
-  cognee_db_name                              = var.cognee_db_name
-  cognee_db_password_secret_arn               = var.cognee_db_password_secret_arn
-  cognee_allowed_internal_cidr_blocks         = var.cognee_allowed_internal_cidr_blocks
-  cognee_allowed_internal_security_group_ids  = var.cognee_allowed_internal_security_group_ids
-  cognee_backend_mode                         = var.cognee_backend_mode
-  cognee_desired_count                        = var.cognee_desired_count
-  cognee_brain_tenant_id                      = var.cognee_brain_tenant_id
-  cognee_brain_instance_key                   = var.cognee_brain_instance_key
-  cognee_brain_storage_tier                   = var.cognee_brain_storage_tier
-  cognee_brain_s3_artifact_root               = var.cognee_brain_s3_artifact_root
-  cognee_brain_s3_manifest_root               = var.cognee_brain_s3_manifest_root
-  cognee_brain_s3_vault_projection_root       = var.cognee_brain_s3_vault_projection_root
-  cognee_brain_artifacts_bucket_arn           = var.cognee_brain_artifacts_bucket_arn
-  cognee_brain_artifacts_prefixes             = var.cognee_brain_artifacts_prefixes
-  cognee_private_substrate_mode               = var.cognee_private_substrate_mode
-  cognee_require_authentication               = var.cognee_require_authentication
-  cognee_enable_backend_access_control        = var.cognee_enable_backend_access_control
-  cognee_cors_allowed_origins                 = var.cognee_cors_allowed_origins
-  cognee_llm_provider                         = var.cognee_llm_provider
-  cognee_llm_model                            = var.cognee_llm_model
-  cognee_llm_api_key_secret_arn               = var.cognee_llm_api_key_secret_arn
-  cognee_embedding_provider                   = var.cognee_embedding_provider
-  cognee_embedding_model                      = var.cognee_embedding_model
-  cognee_embedding_dimensions                 = var.cognee_embedding_dimensions
-  cognee_embedding_api_key_secret_arn         = var.cognee_embedding_api_key_secret_arn
-  cognee_vector_db_provider                   = var.cognee_vector_db_provider
-  cognee_vector_db_url                        = var.cognee_vector_db_url
-  cognee_vector_db_key_secret_arn             = var.cognee_vector_db_key_secret_arn
-  cognee_graph_database_provider              = var.cognee_graph_database_provider
-  cognee_graph_database_url                   = var.cognee_graph_database_url
-  cognee_graph_database_username              = var.cognee_graph_database_username
-  cognee_graph_database_password_secret_arn   = var.cognee_graph_database_password_secret_arn
-  cognee_neptune_graph_id                     = var.cognee_neptune_graph_id
-  cognee_neptune_graph_arn                    = var.cognee_neptune_graph_arn
-  cognee_neptune_endpoint                     = var.cognee_neptune_endpoint
-  cognee_production_posture                   = var.cognee_production_posture
-  cognee_bedrock_model_resource_arns          = var.cognee_bedrock_model_resource_arns
-  cognee_kms_key_arns                         = var.cognee_kms_key_arns
-  twenty_provisioned                          = var.twenty_provisioned
-  twenty_runtime_enabled                      = var.twenty_runtime_enabled
-  twenty_image_uri                            = var.twenty_image_uri
-  twenty_db_username                          = var.twenty_db_username
-  twenty_db_name                              = var.twenty_db_name
-  twenty_db_url_secret_arn                    = var.twenty_db_url_secret_arn
-  twenty_encryption_key_secret_arn            = var.twenty_encryption_key_secret_arn
-  twenty_email_from_address                   = var.twenty_email_from_address
-  twenty_email_from_name                      = var.twenty_email_from_name
-  twenty_public_url                           = local.twenty_url
-  twenty_certificate_arn                      = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
-  n8n_provisioned                             = var.n8n_provisioned
-  n8n_runtime_enabled                         = var.n8n_runtime_enabled
-  n8n_image_uri                               = var.n8n_image_uri
-  n8n_database_admin_secret_arn               = var.n8n_database_admin_secret_arn
-  n8n_database_url_secret_arn                 = var.n8n_database_url_secret_arn
-  n8n_database_username                       = var.n8n_database_username
-  n8n_database_name                           = var.n8n_database_name
-  n8n_encryption_key_secret_arn               = var.n8n_encryption_key_secret_arn
-  n8n_operator_secret_arn                     = var.n8n_operator_secret_arn
-  n8n_service_credential_secret_arn           = var.n8n_service_credential_secret_arn
-  n8n_agent_step_bridge_credential_secret_arn = var.n8n_agent_step_bridge_credential_secret_arn
-  n8n_storage_bucket_name                     = var.n8n_storage_bucket_name
-  n8n_container_port                          = var.n8n_container_port
-  n8n_cache_engine                            = var.n8n_cache_engine
-  n8n_domain                                  = local.n8n_domain
-  n8n_public_url                              = local.n8n_url
-  n8n_certificate_arn                         = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
-  google_oauth_client_id                      = var.google_oauth_client_id
-  google_oauth_client_secret                  = var.google_oauth_client_secret
-  pre_signup_lambda_zip                       = var.pre_signup_lambda_zip
-  cognito_custom_auth_lambda_zip              = var.cognito_custom_auth_lambda_zip
-  lambda_zips_dir                             = var.lambda_zips_dir
-  lambda_artifact_bucket                      = var.lambda_artifact_bucket
-  lambda_artifact_prefix                      = var.lambda_artifact_prefix
-  require_lambda_artifacts                    = var.require_lambda_artifacts
-  enable_workspace_orchestration              = var.enable_workspace_orchestration
-  api_auth_secret                             = var.api_auth_secret
-  platform_operator_emails                    = var.platform_operator_emails
+  db_password                       = var.db_password
+  database_engine                   = var.database_engine
+  enable_hindsight                  = var.enable_hindsight
+  hindsight_database_name           = var.hindsight_database_name
+  memory_engine                     = var.memory_engine
+  twenty_provisioned                = var.twenty_provisioned
+  twenty_runtime_enabled            = var.twenty_runtime_enabled
+  twenty_image_uri                  = var.twenty_image_uri
+  twenty_db_username                = var.twenty_db_username
+  twenty_db_name                    = var.twenty_db_name
+  twenty_db_url_secret_arn          = var.twenty_db_url_secret_arn
+  twenty_encryption_key_secret_arn  = var.twenty_encryption_key_secret_arn
+  twenty_email_from_address         = var.twenty_email_from_address
+  twenty_email_from_name            = var.twenty_email_from_name
+  twenty_public_url                 = local.twenty_url
+  twenty_certificate_arn            = var.twenty_certificate_arn != "" ? var.twenty_certificate_arn : (local.twenty_managed_certificate_enabled ? aws_acm_certificate_validation.twenty[0].certificate_arn : "")
+  n8n_provisioned                   = var.n8n_provisioned
+  n8n_runtime_enabled               = var.n8n_runtime_enabled
+  n8n_image_uri                     = var.n8n_image_uri
+  n8n_database_admin_secret_arn     = var.n8n_database_admin_secret_arn
+  n8n_database_url_secret_arn       = var.n8n_database_url_secret_arn
+  n8n_database_username             = var.n8n_database_username
+  n8n_database_name                 = var.n8n_database_name
+  n8n_encryption_key_secret_arn     = var.n8n_encryption_key_secret_arn
+  n8n_operator_secret_arn           = var.n8n_operator_secret_arn
+  n8n_service_credential_secret_arn = var.n8n_service_credential_secret_arn
+  n8n_storage_bucket_name           = var.n8n_storage_bucket_name
+  n8n_container_port                = var.n8n_container_port
+  n8n_cache_engine                  = var.n8n_cache_engine
+  n8n_domain                        = local.n8n_domain
+  n8n_public_url                    = local.n8n_url
+  n8n_certificate_arn               = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : (local.n8n_managed_certificate_enabled ? aws_acm_certificate_validation.n8n[0].certificate_arn : "")
+  google_oauth_client_id            = var.google_oauth_client_id
+  google_oauth_client_secret        = var.google_oauth_client_secret
+  pre_signup_lambda_zip             = var.pre_signup_lambda_zip
+  cognito_custom_auth_lambda_zip    = var.cognito_custom_auth_lambda_zip
+  lambda_zips_dir                   = var.lambda_zips_dir
+  lambda_artifact_bucket            = var.lambda_artifact_bucket
+  lambda_artifact_prefix            = var.lambda_artifact_prefix
+  require_lambda_artifacts          = var.require_lambda_artifacts
+  enable_workspace_orchestration    = var.enable_workspace_orchestration
+  api_auth_secret                   = var.api_auth_secret
+  platform_operator_emails          = var.platform_operator_emails
 
   # Public website custom domain (optional — wired only when www_domain is set)
   www_domain          = var.www_domain
@@ -1080,13 +827,17 @@ module "thinkwork" {
   # don't wipe the Bedrock model or the aggregation flag back to
   # whatever the Lambda env defaults to.
   wiki_compile_model_id                         = var.wiki_compile_model_id
-  company_brain_source_agent_model_id           = var.company_brain_source_agent_model_id
+  brain_source_agent_model_id                   = var.brain_source_agent_model_id
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
+  wiki_source                                   = var.wiki_source
+  analyst_policy_source                         = var.analyst_policy_source
+  knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
   google_places_api_key                         = var.google_places_api_key
   requester_idle_memory_learning_enabled        = var.requester_idle_memory_learning_enabled
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
+  brain_dream_state_enabled                     = var.brain_dream_state_enabled
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
   agentcore_memory_id                           = var.agentcore_memory_id
@@ -1305,42 +1056,6 @@ output "hindsight_endpoint" {
   description = "Hindsight API endpoint (null when enable_hindsight = false)"
   value       = module.thinkwork.hindsight_endpoint
 }
-
-output "cognee_enabled" {
-  description = "Whether the Cognee ontology/KG add-on is enabled"
-  value       = module.thinkwork.cognee_enabled
-}
-
-output "cognee_endpoint" {
-  description = "Internal Cognee API endpoint (null when enable_cognee = false)"
-  value       = module.thinkwork.cognee_endpoint
-}
-
-output "cognee_log_group_name" {
-  description = "CloudWatch log group for Cognee (null when enable_cognee = false)"
-  value       = module.thinkwork.cognee_log_group_name
-}
-
-output "cognee_brain_storage_tier" {
-  description = "Company Brain storage tier (null when enable_cognee = false)"
-  value       = module.thinkwork.cognee_brain_storage_tier
-}
-
-output "cognee_brain_instance_key" {
-  description = "Tenant-scoped Company Brain instance key (null for legacy stage-wide instances)"
-  value       = module.thinkwork.cognee_brain_instance_key
-}
-
-output "cognee_s3_artifact_root" {
-  description = "Canonical Company Brain S3 source artifact root"
-  value       = module.thinkwork.cognee_s3_artifact_root
-}
-
-output "cognee_neptune_graph_id" {
-  description = "Neptune Analytics graph ID for production Company Brain"
-  value       = module.thinkwork.cognee_neptune_graph_id
-}
-
 output "twenty_provisioned" {
   description = "Whether the Twenty CRM retained managed-app substrate is provisioned"
   value       = module.thinkwork.twenty_provisioned
@@ -1431,11 +1146,6 @@ output "n8n_service_credential_secret_arn" {
   value       = module.thinkwork.n8n_service_credential_secret_arn
 }
 
-output "n8n_agent_step_bridge_credential_secret_arn" {
-  description = "Secrets Manager ARN used for the inbound n8n agent-step bridge credential (null when n8n_provisioned = false)"
-  value       = module.thinkwork.n8n_agent_step_bridge_credential_secret_arn
-}
-
 output "agentcore_memory_id" {
   description = "AgentCore Memory resource ID used for automatic retention"
   value       = module.thinkwork.agentcore_memory_id

package/dist/terraform/examples/greenfield/terraform.tfvars.example

@@ -59,7 +59,6 @@ database_engine = "rds-postgres"
 # n8n_encryption_key_secret_arn         = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/encryption-key-..."
 # n8n_operator_secret_arn               = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/operator-..."
 # n8n_service_credential_secret_arn     = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/service-credential-..."
-# n8n_agent_step_bridge_credential_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/agent-step-bridge-credential-..."
 # n8n_storage_bucket_name               = "thinkwork-dev-n8n"
 # n8n_container_port                    = 5678
 # n8n_cache_engine                      = "valkey"

package/dist/terraform/modules/app/agentcore-pi/README.md

@@ -8,7 +8,7 @@ This module owns the dedicated Pi Lambda + log group + IAM role + event-invoke c
 
 - `aws_iam_role.agentcore_pi` (`thinkwork-${stage}-agentcore-pi-role`) — assumed by Lambda + Bedrock AgentCore Runtime principals.
 - `aws_iam_role_policy.agentcore_pi` — baseline permissions (S3 skill catalog, Bedrock model invoke, AgentCore Memory + Code Interpreter, CloudWatch Logs, X-Ray ingestion, ECR pull, SSM parameter access, memory-retain Lambda invoke). Forward-compat additions for U4-U8: Aurora Data API + Secrets Manager scoped to `thinkwork-${stage}-*`.
-- `aws_iam_role_policy_attachment.agentcore_pi_vpc_access` — attached when Pi needs private-network access for Company Brain/Cognee direct MCP or the OKF EFS mount.
+- `aws_iam_role_policy_attachment.agentcore_pi_vpc_access` — attached when Pi needs private-network access for the OKF EFS mount.
 - `aws_iam_role_policy.agentcore_pi_dlq_send` — `sqs:SendMessage` against the shared async DLQ (injected via `var.async_dlq_arn`).
 - `aws_cloudwatch_log_group.agentcore_pi` (`/thinkwork/${stage}/agentcore-pi`).
 - `aws_lambda_function.agentcore_pi` (`thinkwork-${stage}-agentcore-pi`) — `package_type = "Image"`, pulls `${ecr_repository_url}:pi-latest`.
@@ -48,8 +48,6 @@ The Lambda function name changes from `thinkwork-${stage}-agentcore-flue` to `th
 | `api_endpoint`        | no       | API Gateway base URL for the `/api/skills/complete` callback.                  |
 | `api_auth_secret`     | no       | Service-auth bearer for the same callback.                                     |
 | `memory_engine`       | no       | `hindsight` or `agentcore`; surfaced as `MEMORY_ENGINE` env var.               |
-| `cognee_subnet_ids`   | no       | Private subnets for direct Company Brain/Cognee MCP access.                    |
-| `cognee_security_group_ids` | no | Security groups allowed to reach the internal Company Brain/Cognee endpoint.    |
 
 ## Outputs