thinkwork-cli 0.12.16 → 0.13.0

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -67,6 +67,13 @@ variable "billing_export_bucket_name" {
   default     = ""
 }
 
+variable "cost_alert_emails" {
+  description = "Email endpoints subscribed to the cost-alerts SNS topic (drift + reconciler-health alarms, THINK-245). Empty list creates the topic with no subscriptions."
+  type        = list(string)
+  default     = []
+  sensitive   = true
+}
+
 variable "billing_export_manifest_key" {
   description = "Optional S3 key for the latest AWS billing export manifest to import on the scheduled bill reconciler run."
   type        = string
@@ -86,7 +93,7 @@ variable "plugin_catalog_github_token_secret_arn" {
 }
 
 variable "brain_artifacts_kms_key_arn" {
-  description = "Optional KMS key ARN used to encrypt canonical Company Brain artifacts. AES256 encryption is used when unset."
+  description = "Optional KMS key ARN used to encrypt canonical ThinkWork Brain artifacts. AES256 encryption is used when unset."
   type        = string
   default     = ""
 }
@@ -219,6 +226,18 @@ variable "requester_memory_dreaming_model_id" {
   default     = "openai.gpt-oss-120b-1:0"
 }
 
+variable "brain_dream_state_enabled" {
+  description = "Enable the recurring Brain dream-state consolidation schedule (THINK-133 U4). Manual invokes work regardless via event.manual."
+  type        = bool
+  default     = false
+}
+
+variable "brain_dream_state_schedule_expression" {
+  description = "EventBridge Scheduler expression for Brain dream-state runs."
+  type        = string
+  default     = "cron(0 5 * * ? *)"
+}
+
 variable "extension_proxy_signing_secret" {
   description = "Shared HMAC secret used by the generic Admin extension proxy to sign actor context for extension backends."
   type        = string
@@ -232,6 +251,12 @@ variable "hindsight_endpoint" {
   default     = ""
 }
 
+variable "hindsight_database_name" {
+  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty = Hindsight tables live in the `hindsight` schema of the primary database; set = the api reads them from this database's `public` schema. Rides the SSM runtime-config document (getConfig), not Lambda env."
+  type        = string
+  default     = ""
+}
+
 variable "agentcore_memory_id" {
   description = "Bedrock AgentCore Memory resource ID — used by the GraphQL memory resolvers to list records across tenant agents."
   type        = string
@@ -239,63 +264,15 @@ variable "agentcore_memory_id" {
 }
 
 variable "memory_engine" {
-  description = "Active long-term memory engine for this deployment. Exactly one engine is canonical for recall/inspect/export. Hosted ThinkWork may choose 'cognee' when the Company Brain substrate is enabled."
+  description = "Active long-term memory engine for this deployment. Exactly one engine is canonical for recall/inspect/export."
   type        = string
   default     = "hindsight"
   validation {
-    condition     = contains(["hindsight", "agentcore", "cognee"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight', 'agentcore', or 'cognee'."
+    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
+    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
   }
 }
 
-variable "cognee_enabled" {
-  description = "Whether the Cognee knowledge graph add-on is enabled for this deployment."
-  type        = bool
-  default     = false
-}
-
-variable "cognee_endpoint" {
-  description = "Internal Cognee API endpoint (empty when disabled)."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_log_group_name" {
-  description = "CloudWatch log group for Cognee (empty when disabled)."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_backend_mode" {
-  description = "Selected Cognee backend mode (empty when disabled)."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_cluster_arn" {
-  description = "ECS cluster ARN for Cognee (empty when disabled)."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_service_name" {
-  description = "ECS service name for Cognee (empty when disabled)."
-  type        = string
-  default     = ""
-}
-
-variable "cognee_worker_subnet_ids" {
-  description = "Subnet IDs for the Knowledge Graph ingest worker Lambda VPC attachment. Leave empty to deploy the worker without VPC access."
-  type        = list(string)
-  default     = []
-}
-
-variable "cognee_worker_security_group_ids" {
-  description = "Security group IDs for the Knowledge Graph ingest worker Lambda VPC attachment. Leave empty to deploy the worker without VPC access."
-  type        = list(string)
-  default     = []
-}
-
 variable "okf_efs_subnet_ids" {
   description = "Subnet IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
   type        = list(string)
@@ -500,26 +477,14 @@ variable "wiki_compile_model_id" {
   default     = "openai.gpt-oss-120b-1:0"
 }
 
-variable "company_brain_source_agent_model_id" {
-  description = "Bedrock model id the GraphQL context-engine Company Brain source-agent runtime uses for JSON tool/action turns. Kept separate from the high-throughput wiki compiler model so source agents can use a model tuned for reliable action JSON."
+variable "brain_source_agent_model_id" {
+  description = "Bedrock model id the GraphQL context-engine Brain source-agent runtime uses for JSON tool/action turns. Kept separate from the high-throughput wiki compiler model so source agents can use a model tuned for reliable action JSON."
   type        = string
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
-variable "company_brain_backdoor_install_key_secret_arn" {
-  description = "Optional Secrets Manager ARN containing the temporary Company Brain backdoor install key. Empty disables the backdoor. The raw key is never stored in tfvars or the runtime-config document."
-  type        = string
-  default     = ""
-}
-
-variable "company_brain_backdoor_install_key_stages" {
-  description = "Comma-separated stage allowlist for the temporary Company Brain backdoor install key. Both this value and company_brain_backdoor_install_key_secret_arn must be set for deployed backdoor redemption."
-  type        = string
-  default     = ""
-}
-
 variable "kg_obs_max_candidates_per_run" {
-  description = "Per-run candidate cap for the observations → Knowledge Graph ingest worker (KG_OBS_MAX_CANDIDATES_PER_RUN). Bounds the layered-gate classifier cost AND keeps each Cognee cognify small enough to index within budget on the single dogfood task; truncated runs self-invoke to drain the remaining backlog. Stored as a string because the Lambda reads it verbatim from env."
+  description = "Per-run candidate cap for the observations → Knowledge Graph ingest worker (KG_OBS_MAX_CANDIDATES_PER_RUN). Bounds the layered-gate classifier cost and lets truncated runs self-invoke to drain the remaining backlog. Stored as a string because the Lambda reads it verbatim from env."
   type        = string
   default     = "10"
 }
@@ -536,6 +501,18 @@ variable "wiki_deterministic_linking_enabled" {
   default     = "true"
 }
 
+variable "kg_extraction_model_id" {
+  description = "Bedrock model id for knowledge-graph entity/relationship extraction from observations (plan 2026-07-03-005). Defaults to a gpt-oss high-quota model; overridable per stage."
+  type        = string
+  default     = "openai.gpt-oss-120b-1:0"
+}
+
+variable "knowledge_graph_observations_ingest_enabled" {
+  description = "Enable the recurring Brain distillation schedule (Hindsight observations -> knowledge graph). Ships disabled; dev flips on after a golden-set-validated manual run (plan 2026-07-03-005 U4)."
+  type        = bool
+  default     = false
+}
+
 variable "wiki_source" {
   description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer over the knowledge-graph mirror and makes successful observation-ingest runs the compile trigger. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
   type        = string
@@ -774,3 +751,53 @@ variable "parameters_secrets_extension_layer_arn" {
   type        = string
   default     = ""
 }
+
+variable "capability_signing_public_key" {
+  description = "Ed25519 public key (SPKI PEM) verifying capability sidecars/manifests (THINK-173). Empty disables verification (render fails closed: signed entries withhold as unsigned)."
+  type        = string
+  default     = ""
+}
+
+variable "capability_signing_private_key_secret" {
+  description = "Secrets Manager name holding the Ed25519 private signing key. Empty disables signing (grants fail loudly with signing_unavailable)."
+  type        = string
+  default     = ""
+}
+
+# ---------------------------------------------------------------------------
+# THINK-228 U3 — analyst query broker runtime config
+# ---------------------------------------------------------------------------
+
+variable "analyst_reader_secret_arn" {
+  description = "ARN of the Secrets Manager secret holding the `analyst_reader` Aurora role credentials (THINK-228 U2). Wired from `module.database.analyst_reader_secret_arn`. The analyst-query-broker Lambda executes model-authored SQL exclusively under this role."
+  type        = string
+  default     = ""
+}
+
+variable "analyst_broker_secret_arn" {
+  description = "ARN of the Secrets Manager secret holding the analyst query-broker caller credential (JSON {token, tenantId}; THINK-228 U3). Wired from `module.database.analyst_broker_secret_arn`. The broker validates incoming Bearer tokens against it; the seeded connector row references it as auth_config.secretRef."
+  type        = string
+  default     = ""
+}
+
+variable "analyst_policy_source" {
+  description = "THINK-229 KTD5 enforcement flip: 'row' (default — sidecar policy is shadow-only) or 'sidecar' (the signed sidecar policy block is authoritative: budgets + retain_sql flow into dispatch and the broker). Flip only after clean analyst-policy-shadow parity on live traffic AND a provision refresh so every connection sidecar carries a policy block."
+  type        = string
+  default     = "row"
+  validation {
+    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
+    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
+  }
+}
+
+variable "analyst_db_cluster_resource_id" {
+  description = "Immutable RDS cluster resource ID (cluster-XXXX / db-XXXX) for the stage database (THINK-229 U1). Wired from `module.database.cluster_resource_id`. Keys the broker's `rds-db:connect` IAM grant — the rds-db ARN format requires the resource ID, not the cluster ARN — and gates the IAM connect env on the broker Lambda: when empty, the broker stays on the password path."
+  type        = string
+  default     = ""
+}
+
+variable "artifact_delivery_from_email" {
+  description = "Default SES from-address for artifact email delivery. Empty keeps the code fallback (noreply@agents.thinkwork.ai — only verified in the ThinkWork dev account, so customer stages MUST set this)."
+  type        = string
+  default     = ""
+}

package/dist/terraform/modules/app/ses-email/main.tf

@@ -64,6 +64,18 @@ variable "email_inbound_fn_arn" {
   default     = ""
 }
 
+variable "email_inbound_fn_name_attr" {
+  description = "Attribute-based twin of email_inbound_fn_name (dependency ordering; attributes only, never count)."
+  type        = string
+  default     = ""
+}
+
+variable "email_inbound_fn_arn_attr" {
+  description = "Attribute-based twin of email_inbound_fn_arn (dependency ordering; attributes only, never count)."
+  type        = string
+  default     = ""
+}
+
 variable "email_inbound_fn_name" {
   description = "Function name of the email-inbound Lambda (for the Lambda permission)."
   type        = string
@@ -230,7 +242,7 @@ resource "aws_lambda_permission" "ses_invoke_email_inbound" {
   count          = local.enabled && local.has_lambda ? 1 : 0
   statement_id   = "AllowSESInvokeEmailInbound"
   action         = "lambda:InvokeFunction"
-  function_name  = var.email_inbound_fn_name
+  function_name  = var.email_inbound_fn_name_attr != "" ? var.email_inbound_fn_name_attr : var.email_inbound_fn_name
   principal      = "ses.amazonaws.com"
   source_account = var.account_id
 }
@@ -255,7 +267,7 @@ resource "aws_ses_receipt_rule" "inbound" {
   dynamic "lambda_action" {
     for_each = local.has_lambda ? [1] : []
     content {
-      function_arn    = var.email_inbound_fn_arn
+      function_arn    = var.email_inbound_fn_arn_attr != "" ? var.email_inbound_fn_arn_attr : var.email_inbound_fn_arn
       invocation_type = "Event"
       position        = local.has_bucket ? 2 : 1
     }