thinkwork-cli 0.12.16 → 0.13.0

package/dist/terraform/modules/app/lambda-api/iam-grouped.tf

@@ -25,7 +25,7 @@
 # standalone managed-policy attachment. (Managed-policy attachments have a
 # default quota of 10 per role; the steady state here is
 # AWSLambdaBasicExecutionRole + these four, plus the conditional AWS-managed
-# VPC-access policy when Cognee workers are enabled.)
+# VPC-access policy when OKF EFS wiring is enabled.)
 #
 # Each managed policy document caps at 6,144 characters (JSON minus
 # whitespace) — check rendered size before adding large statements, and
@@ -59,13 +59,32 @@ locals {
         Action   = ["secretsmanager:GetSecretValue"]
         Resource = var.graphql_db_secret_arn
       },
+      # THINK-239 — analystInternalClusters enumerates the environment's own
+      # RDS clusters (filtered to thinkwork-<stage>-* in code) so operators can
+      # register a database with zero credential entry. Describe-only; the
+      # admin credential read is covered by graphql_db_secret_arn above.
+      {
+        Sid      = "AnalystInternalClustersDescribe"
+        Effect   = "Allow"
+        Action   = ["rds:DescribeDBClusters"]
+        Resource = "*"
+      },
       {
         Effect = "Allow"
         Action = [
           "secretsmanager:CreateSecret",
           "secretsmanager:UpdateSecret",
           "secretsmanager:DeleteSecret",
-          "secretsmanager:GetSecretValue"
+          "secretsmanager:GetSecretValue",
+          # THINK-230 — provisionAnalystConnector writes the broker credential
+          # secret value (thinkwork/<stage>/analyst/broker-credential, under
+          # this thinkwork/* prefix) via ensureAnalystBrokerSecret's
+          # PutSecretValue. GetSecretValue above already covers the read; this
+          # role already holds Create/Update/Delete on the same prefix, so
+          # PutSecretValue grants no capability beyond the existing delete +
+          # recreate. Kept on the existing statement to stay under the 6,144
+          # rendered-char managed-policy cap.
+          "secretsmanager:PutSecretValue"
         ]
         Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork/*"
       },
@@ -107,7 +126,7 @@ locals {
         Action   = ["s3:PutObject", "s3:AbortMultipartUpload"]
         Resource = "${aws_s3_bucket.wiki_exports.arn}/*"
       },
-      # Canonical Company Brain artifacts: durable source artifacts,
+      # Canonical ThinkWork Brain artifacts: durable source artifacts,
       # ingestion manifests, migration snapshots, vault projections, and
       # exports, and OKF Wiki Navigator bundles/current manifests.
       # Tenant-visible APIs redact object keys; Lambdas need object read/write
@@ -217,6 +236,31 @@ locals {
         ]
         Resource = "arn:aws:s3:::thinkwork-${var.stage}-routine-output/*"
       },
+      # routine-exec-git SHA code cache (plan 2026-07-03-004 U3, KTD-7):
+      # read-through cache under routine-code-cache/<tenant>/<routine>/<sha>/.
+      # GetObject for cache reads; ListBucket so a cache miss surfaces as
+      # NoSuchKey (404) instead of AccessDenied — without it the executor
+      # cannot distinguish "not cached yet" from a real permission error
+      # and the fixture gate fails closed (caught live in the U9 sweep).
+      {
+        Sid    = "RoutineExecGitCodeCacheRead"
+        Effect = "Allow"
+        Action = [
+          "s3:GetObject",
+        ]
+        Resource = "arn:aws:s3:::thinkwork-${var.stage}-routine-output/routine-code-cache/*"
+      },
+      {
+        Sid      = "RoutineExecGitCodeCacheList"
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = "arn:aws:s3:::thinkwork-${var.stage}-routine-output"
+        Condition = {
+          StringLike = {
+            "s3:prefix" = "routine-code-cache/*"
+          }
+        }
+      },
       # (was standalone managed policy "lambda_model_catalog_import_read")
       # Settings -> Model Catalog imports call Bedrock's foundation-model
       # catalog and AWS Price List APIs from graphql-http. These read/list
@@ -237,6 +281,14 @@ locals {
         ]
         Resource = "*"
       },
+      # THINK-245 U10 — cost-drift-check compares recorded per-model spend
+      # against Cost Explorer. ce:GetCostAndUsage supports no resource-level
+      # scoping (must be "*").
+      {
+        Effect   = "Allow"
+        Action   = ["ce:GetCostAndUsage"]
+        Resource = "*"
+      },
     ],
     var.plugin_catalog_github_token_secret_arn != "" ? [
       {
@@ -245,6 +297,19 @@ locals {
         Resource = var.plugin_catalog_github_token_secret_arn
       },
     ] : [],
+    # THINK-229 U1 — analyst-query-broker mints RDS IAM auth tokens for the
+    # analyst_reader role. The rds-db ARN keys on the immutable cluster
+    # RESOURCE ID (cluster-XXXX), never the cluster ARN, and the dbuser
+    # segment is the exact-case Postgres role name. aws:SourceIp /
+    # aws:SourceVpc conditions are unsupported on rds-db:connect, so the
+    # narrow Resource IS the control surface.
+    var.analyst_db_cluster_resource_id != "" ? [
+      {
+        Effect   = "Allow"
+        Action   = ["rds-db:connect"]
+        Resource = "arn:aws:rds-db:${var.region}:${var.account_id}:dbuser:${var.analyst_db_cluster_resource_id}/analyst_reader"
+      },
+    ] : [],
     # (was standalone managed policy "lambda_deployment_evidence_read")
     # Access to the deployment evidence bucket: graphql-http's deployments
     # resolvers read deployment/status/current.json (deployed-release pointer
@@ -281,81 +346,6 @@ locals {
         ]
       },
     ] : [],
-    # SQS grants live here rather than in the orchestration group purely for
-    # size balance: with every conditional on, orchestration's rendered JSON
-    # would exceed IAM's 6,144-char per-managed-policy cap (R9 rebalance).
-    # Handler-gated SQS grants. Each statement was a count-gated inline
-    # policy whose queue exists only when local.deploy_lambda_handlers.
-    local.deploy_lambda_handlers ? [
-      # (was inline policy "thinkwork-${stage}-wiki-compile-dlq-send")
-      {
-        Sid      = "WikiCompileDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.wiki_compile_dlq[0].arn
-      },
-      # (was inline policy "thinkwork-${stage}-ontology-scan-dlq-send")
-      {
-        Sid      = "OntologyScanDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.ontology_scan_dlq[0].arn
-      },
-      # (was inline policy "thinkwork-${stage}-ontology-reprocess-dlq-send")
-      {
-        Sid      = "OntologyReprocessDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.ontology_reprocess_dlq[0].arn
-      },
-      # (was inline policy "compliance-drainer-dlq-send")
-      {
-        Sid      = "ComplianceDrainerDlqSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.compliance_drainer_dlq[0].arn
-      },
-      # (was inline policy "compliance-exports-send")
-      # graphql-http needs sqs:SendMessage on the exports queue to dispatch
-      # jobIds from the createComplianceExport mutation. Attached to the
-      # shared lambda role (which graphql-http assumes); scope is
-      # queue-specific. (The runner's receive grants stay on the dedicated
-      # runner role — see compliance_exports_runner_sqs in handlers.tf.)
-      {
-        Sid      = "ComplianceExportsSend"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.compliance_exports[0].arn
-      },
-      # (was inline policy "eval-fanout-send")
-      {
-        Sid    = "EvalRunnerSendFanoutMessages"
-        Effect = "Allow"
-        Action = [
-          "sqs:SendMessage",
-          "sqs:SendMessageBatch",
-        ]
-        Resource = aws_sqs_queue.eval_fanout[0].arn
-      },
-      # (was inline policy "eval-worker-sqs")
-      {
-        Sid    = "EvalWorkerReceiveFanoutMessages"
-        Effect = "Allow"
-        Action = [
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes",
-          "sqs:ChangeMessageVisibility",
-        ]
-        Resource = aws_sqs_queue.eval_fanout[0].arn
-      },
-      {
-        Sid      = "EvalWorkerSendDlqMessages"
-        Effect   = "Allow"
-        Action   = ["sqs:SendMessage"]
-        Resource = aws_sqs_queue.eval_fanout_dlq[0].arn
-      },
-    ] : [],
     # (was inline policy "thinkwork-${stage}-lambda-workspace-events-sqs",
     # count-gated on the same flag)
     local.workspace_event_enabled ? [
@@ -480,14 +470,11 @@ locals {
           # retainTurn when the tenant's wiki_compile_enabled flag is on.
           # compileWikiNow admin mutation also Event-invokes.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-compile",
-          # knowledge-graph-thread-ingest: graphql-http's
-          # startKnowledgeGraphThreadIngest mutation invokes this with
-          # RequestResponse after inserting the durable ingest run.
-          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-graph-thread-ingest",
           # knowledge-graph-observations-ingest: graphql-http's
           # startKnowledgeGraphObservationsIngest mutation invokes this with
-          # RequestResponse; the worker also Event-invokes ITSELF to drain a
-          # truncated candidate backlog across successive runs.
+          # RequestResponse. (The worker's self-invoke drain is retired —
+          # AWS recursive-loop detection terminated those chains; backlog
+          # drains in-process now.)
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-graph-observations-ingest",
           # wiki-bootstrap-import: bootstrapJournalImport admin mutation
           # Event-invokes this for the long-running ingest path.
@@ -498,6 +485,13 @@ locals {
           # ontology-reprocess: approveOntologyChangeSet Event-invokes this
           # after inserting a durable reprocess job row.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-reprocess",
+          # okf-materialize / okf-efs-refresh: the OKF distribution chain
+          # (THINK-200). wiki-compile Event-invokes okf-materialize after a
+          # successful compile; okf-materialize Event-invokes okf-efs-refresh
+          # after publishing bundles, keeping the Pi wiki navigator's EFS
+          # view current without manual invocation.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-okf-materialize",
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-okf-efs-refresh",
           # routine-resume: routine-approval-bridge (Phase B U8) invokes
           # this with RequestResponse after a HITL decideInboxItem
           # decision. Calls SendTaskSuccess/SendTaskFailure on the SFN
@@ -515,6 +509,25 @@ locals {
           # invokes this with RequestResponse so SkillSpector completion is a
           # server-side publish gate, not just an operator UI affordance.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-skill-trust-runner",
+          # routine-exec-git (plan 2026-07-03-004 U5/U6): job-trigger
+          # RequestResponse-invokes it for Automation routine actions, and
+          # admin-ops-mcp invokes it for agent fixture runs + the
+          # synchronous repair gate. Caught live in the U9 sweep.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-routine-exec-git",
+          # artifact-deliver (THINK-227 U5): workflow-step-dispatch's deliver
+          # step RequestResponse-invokes its workflow-delivery mode to email
+          # the maintained report to the operator-configured recipient list.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-artifact-deliver",
+          # job-trigger self-target (plan 2026-07-03-004 U5, KTD-3): the
+          # manual GraphQL trigger Event-invokes job-trigger with the
+          # agent_loop_continue_dispatch event so routine actions never run
+          # inline in graphql-http.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-job-trigger",
+          # canvas-refresh (Living Artifacts THINK-145 U6/U7): graphql-http's
+          # refreshCanvasData mutation RequestResponse-invokes it (user + agent
+          # triggers), and job-trigger's canvas_refresh branch RequestResponse-
+          # invokes it (scheduled trigger). Both run on this shared role.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-canvas-refresh",
         ]
       },
       # (was standalone managed policy "workspace_renderer_invoke")
@@ -613,6 +626,29 @@ locals {
           }
         }
       },
+      # Workflow Interpreter (THINK-219): job-trigger (workflow_schedule
+      # branch) and graphql-http (manual triggerWorkflowRun / resolveWorkflow
+      # Approval) both run under this shared role and StartExecution the ONE
+      # static interpreter machine per stage. Name is fixed
+      # (`thinkwork-${stage}-workflow-interpreter`); the machine ARN itself is
+      # resolved from SSM at runtime (already readable via the stage-wide
+      # ssm:GetParameter grant in api_data_plane). SendTaskSuccess/Failure for
+      # workflow-resume rides the wildcard RoutineTaskTokens statement above.
+      {
+        Sid    = "WorkflowInterpreterExecution"
+        Effect = "Allow"
+        Action = [
+          "states:StartExecution",
+          "states:StopExecution",
+          "states:DescribeExecution",
+          "states:ListExecutions",
+          "states:GetExecutionHistory",
+        ]
+        Resource = [
+          "arn:aws:states:${var.region}:${var.account_id}:stateMachine:thinkwork-${var.stage}-workflow-interpreter",
+          "arn:aws:states:${var.region}:${var.account_id}:execution:thinkwork-${var.stage}-workflow-interpreter:*",
+        ]
+      },
       # (was standalone managed policy "lambda_deployment_stepfunctions")
       # Allow API Lambdas to start and inspect the deployment orchestrator.
       {
@@ -787,7 +823,97 @@ locals {
   # ---------------------------------------------------------------------------
   # Group 4: observability — CloudWatch Logs reads, ECS/ALB health reads.
   # ---------------------------------------------------------------------------
-  api_observability_statements = [
+  # Handler-gated SQS grants moved HERE from the data-plane group
+  # (THINK-229 U5 follow-up): data-plane hit IAM's 6,144-char rendered cap
+  # when the analyst-connection-reconciler DLQ grant landed (live size was
+  # 6,018 before it). Queue plumbing is operational surface; observability
+  # has ~5k headroom. Same statements, different envelope.
+  api_observability_sqs_statements = concat(
+    # SQS grants live here rather than in the orchestration group purely for
+    # size balance: with every conditional on, orchestration's rendered JSON
+    # would exceed IAM's 6,144-char per-managed-policy cap (R9 rebalance).
+    # Handler-gated SQS grants. Each statement was a count-gated inline
+    # policy whose queue exists only when local.deploy_lambda_handlers.
+    local.deploy_lambda_handlers ? [
+      # (was inline policy "thinkwork-${stage}-wiki-compile-dlq-send")
+      {
+        Sid      = "WikiCompileDlqSend"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.wiki_compile_dlq[0].arn
+      },
+      # (was inline policy "thinkwork-${stage}-ontology-scan-dlq-send")
+      {
+        Sid      = "OntologyScanDlqSend"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.ontology_scan_dlq[0].arn
+      },
+      # (was inline policy "thinkwork-${stage}-ontology-reprocess-dlq-send")
+      {
+        Sid      = "OntologyReprocessDlqSend"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.ontology_reprocess_dlq[0].arn
+      },
+      # (was inline policy "compliance-drainer-dlq-send")
+      {
+        Sid      = "ComplianceDrainerDlqSend"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.compliance_drainer_dlq[0].arn
+      },
+      # THINK-229 U5 — analyst-connection-reconciler async on_failure DLQ.
+      {
+        Sid      = "AnalystConnectionReconcilerDlqSend"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.analyst_connection_reconciler_dlq[0].arn
+      },
+      # (was inline policy "compliance-exports-send")
+      # graphql-http needs sqs:SendMessage on the exports queue to dispatch
+      # jobIds from the createComplianceExport mutation. Attached to the
+      # shared lambda role (which graphql-http assumes); scope is
+      # queue-specific. (The runner's receive grants stay on the dedicated
+      # runner role — see compliance_exports_runner_sqs in handlers.tf.)
+      {
+        Sid      = "ComplianceExportsSend"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.compliance_exports[0].arn
+      },
+      # (was inline policy "eval-fanout-send")
+      {
+        Sid    = "EvalRunnerSendFanoutMessages"
+        Effect = "Allow"
+        Action = [
+          "sqs:SendMessage",
+          "sqs:SendMessageBatch",
+        ]
+        Resource = aws_sqs_queue.eval_fanout[0].arn
+      },
+      # (was inline policy "eval-worker-sqs")
+      {
+        Sid    = "EvalWorkerReceiveFanoutMessages"
+        Effect = "Allow"
+        Action = [
+          "sqs:ReceiveMessage",
+          "sqs:DeleteMessage",
+          "sqs:GetQueueAttributes",
+          "sqs:ChangeMessageVisibility",
+        ]
+        Resource = aws_sqs_queue.eval_fanout[0].arn
+      },
+      {
+        Sid      = "EvalWorkerSendDlqMessages"
+        Effect   = "Allow"
+        Action   = ["sqs:SendMessage"]
+        Resource = aws_sqs_queue.eval_fanout_dlq[0].arn
+      },
+    ] : [],
+  )
+
+  api_observability_statements = concat(local.api_observability_sqs_statements, [
     # (was inline policy "cloudwatch-logs-read")
     {
       Effect = "Allow"
@@ -818,11 +944,9 @@ locals {
         "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:*",
       ]
     },
-    # (was standalone managed policy "lambda_cognee_health_read")
-    # graphql-http's Knowledge Graph health check validates the private
-    # Cognee service from outside the VPC by reading ECS service steadiness
-    # and ALB target health. ELBv2 Describe* actions do not support useful
-    # resource scoping.
+    # Managed-application and runtime health checks read ECS service
+    # steadiness and ALB target health. ELBv2 Describe* actions do not
+    # support useful resource scoping.
     {
       Effect = "Allow"
       Action = [
@@ -832,7 +956,7 @@ locals {
       ]
       Resource = "*"
     },
-  ]
+  ])
 }
 
 resource "aws_iam_policy" "api_data_plane" {
@@ -926,8 +1050,3 @@ moved {
   from = aws_iam_role_policy_attachment.lambda_bedrock_knowledge_base
   to   = aws_iam_role_policy_attachment.api_ai
 }
-
-moved {
-  from = aws_iam_role_policy_attachment.lambda_cognee_health_read
-  to   = aws_iam_role_policy_attachment.api_observability
-}

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -19,9 +19,13 @@
 data "aws_caller_identity" "current" {}
 
 locals {
-  cognee_worker_vpc_enabled = var.cognee_enabled && length(var.cognee_worker_subnet_ids) > 0 && length(var.cognee_worker_security_group_ids) > 0
-  okf_efs_vpc_enabled       = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
-  api_base_url              = var.custom_domain != "" ? "https://${var.custom_domain}" : trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")
+  okf_efs_vpc_enabled = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
+  # Constructed rather than read from aws_apigatewayv2_stage.default.invoke_url
+  # (the two are identical for an HTTP API's $default stage). Reading it off
+  # the stage made every Lambda's env depend on the stage, which forbids the
+  # stage's route_settings depending on the routes (THINK-208 throttle) —
+  # UpdateStage would race route creation and 404 on fresh applies.
+  api_base_url = var.custom_domain != "" ? "https://${var.custom_domain}" : "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
 }
 
 ################################################################################
@@ -49,6 +53,21 @@ resource "aws_apigatewayv2_stage" "default" {
   name        = "$default"
   auto_deploy = true
 
+  # Public artifact share route (THINK-208 KTD-6): route-level throttle for
+  # enumeration resistance on the unauthenticated token lookup. The HMAC
+  # signature makes forgery impractical regardless; this bounds probe volume.
+  route_settings {
+    route_key              = "GET /share/{token}"
+    throttling_rate_limit  = 10
+    throttling_burst_limit = 20
+  }
+
+  # UpdateStage 404s ("Unable to find Route by key … within the provided
+  # RouteSettings") if the stage update races the route creation — Terraform
+  # sees no reference edge between route_settings.route_key and the route
+  # resource, so make the ordering explicit.
+  depends_on = [aws_apigatewayv2_route.handler]
+
   tags = {
     Name = "thinkwork-${var.stage}-api-default"
   }
@@ -156,8 +175,8 @@ resource "aws_iam_role_policy_attachment" "lambda_basic" {
 # aggregate hit IAM's 10,240-byte cap on 2026-06-11 (#2378/#2379). New grants
 # go into the grouped managed policies, never inline.
 
-resource "aws_iam_role_policy_attachment" "lambda_cognee_worker_vpc_access" {
-  count = local.cognee_worker_vpc_enabled || local.okf_efs_vpc_enabled ? 1 : 0
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count = local.okf_efs_vpc_enabled ? 1 : 0
 
   role       = aws_iam_role.lambda.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"

package/dist/terraform/modules/app/lambda-api/outputs.tf

@@ -43,14 +43,9 @@ output "memory_retain_fn_arn" {
   value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["memory-retain"].arn : ""
 }
 
-output "knowledge_graph_thread_ingest_fn_name" {
-  description = "Knowledge Graph thread ingest worker Lambda function name."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["knowledge-graph-thread-ingest"].function_name : ""
-}
-
-output "knowledge_graph_thread_ingest_fn_arn" {
-  description = "Knowledge Graph thread ingest worker Lambda ARN."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["knowledge-graph-thread-ingest"].arn : ""
+output "workflow_execution_callback_fn_arn" {
+  description = "workflow-execution-callback Lambda ARN (THINK-219). Wired into the workflow-interpreter-stepfunctions module so its EventBridge SFN-state-change rule can target it."
+  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["workflow-execution-callback"].arn : ""
 }
 
 output "okf_efs_refresh_fn_name" {
@@ -64,12 +59,12 @@ output "okf_efs_refresh_fn_arn" {
 }
 
 output "brain_artifacts_bucket_name" {
-  description = "Canonical Company Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
+  description = "Canonical ThinkWork Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
   value       = aws_s3_bucket.brain_artifacts.bucket
 }
 
 output "brain_artifacts_bucket_arn" {
-  description = "ARN of the canonical Company Brain artifact bucket."
+  description = "ARN of the canonical ThinkWork Brain artifact bucket."
   value       = aws_s3_bucket.brain_artifacts.arn
 }
 
@@ -94,7 +89,20 @@ output "email_inbound_fn_arn" {
 output "email_inbound_fn_name" {
   description = "email-inbound Lambda function name. Used by the SES module for lambda:InvokeFunction permissions."
   # Static for the same fresh-account plan-time reason as email_inbound_fn_arn.
-  value       = local.deploy_lambda_handlers ? "thinkwork-${var.stage}-api-email-inbound" : ""
+  value = local.deploy_lambda_handlers ? "thinkwork-${var.stage}-api-email-inbound" : ""
+}
+
+# Attribute-based twins: same values, but carrying the dependency edge. The
+# static outputs above removed it, so a fresh-account apply raced the SES
+# invoke permission ahead of the function's creation ("Function not found" —
+# THINK-118 HCI test). Consumers use these ONLY in resource attributes; the
+# static twins stay authoritative for count/for_each gating.
+output "email_inbound_fn_name_attr" {
+  value = local.deploy_lambda_handlers ? try(aws_lambda_function.handler["email-inbound"].function_name, "") : ""
+}
+
+output "email_inbound_fn_arn_attr" {
+  value = local.deploy_lambda_handlers ? try(aws_lambda_function.handler["email-inbound"].arn, "") : ""
 }
 
 # ---------------------------------------------------------------------------