thinkwork-cli 0.12.16 → 0.13.0

package/dist/terraform/modules/thinkwork/main.tf

@@ -11,6 +11,10 @@
 
 terraform {
   required_providers {
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "~> 5.0"
@@ -47,11 +51,9 @@ locals {
 
   # Hindsight is the canonical user/Space memory provider for full ThinkWork
   # installs. AgentCore managed memory remains available as an explicit
-  # low-cost/development opt-out; Cognee stays optional Brain infrastructure.
-  # We still honor var.memory_engine == "hindsight" so existing tfvars keep
-  # working even when enable_hindsight was not set.
+  # low-cost/development opt-out. We still honor var.memory_engine == "hindsight"
+  # so existing tfvars keep working even when enable_hindsight was not set.
   hindsight_enabled      = var.enable_hindsight || var.memory_engine == "hindsight"
-  cognee_enabled         = var.enable_cognee
   twenty_provisioned     = var.twenty_provisioned
   twenty_runtime_enabled = var.twenty_provisioned && var.twenty_runtime_enabled
   twenty_domain          = var.twenty_domain != "" ? var.twenty_domain : (var.www_domain != "" ? "crm.${var.www_domain}" : "")
@@ -68,11 +70,6 @@ locals {
   n8n_domain          = var.n8n_domain != "" ? var.n8n_domain : (var.www_domain != "" ? "n8n.${var.www_domain}" : "")
   n8n_public_url      = var.n8n_public_url != "" ? var.n8n_public_url : (local.n8n_domain != "" ? "https://${local.n8n_domain}" : "")
   n8n_certificate_arn = var.n8n_certificate_arn != "" ? var.n8n_certificate_arn : var.www_certificate_arn
-  cognee_worker_subnet_ids = (
-    length(module.vpc.private_subnet_ids) > 0
-    ? module.vpc.private_subnet_ids
-    : module.vpc.public_subnet_ids
-  )
   okf_wiki_subnet_ids = (
     length(module.vpc.private_subnet_ids) > 0
     ? module.vpc.private_subnet_ids
@@ -89,7 +86,12 @@ locals {
       "bedrock-agentcore",
       "bedrock-agentcore-control",
       "bedrock-agentcore.gateway",
-      "execute-api",
+      # NOTE: never add "execute-api" here. Its private DNS captures ALL
+      # *.execute-api.<region>.amazonaws.com traffic from the VPC, but the
+      # endpoint only serves PRIVATE REST APIs — this stack's HTTP APIs (v2)
+      # reject VPC-endpoint traffic with 403 {"message":"Forbidden"}. In-VPC
+      # callers (e.g. the Pi runtime's admin-ops MCP connect) must reach the
+      # regional API publicly via the NAT gateway instead (THINK-144).
       "lambda",
       "logs",
       "rds-data",
@@ -97,32 +99,17 @@ locals {
       "ssm",
       "sts",
       "xray",
+      "bedrock-runtime",
     ],
-    local.cognee_enabled ? [] : ["bedrock-runtime"],
   ))
-  brain_private_interface_endpoint_services = toset([
-    "bedrock",
-    "bedrock-agentcore",
-    "bedrock-agentcore-control",
-    "bedrock-agentcore.gateway",
-    "execute-api",
-    "lambda",
-    "logs",
-    "rds-data",
-    "secretsmanager",
-    "ssm",
-    "sts",
-    "xray",
-  ])
 
   # Canonical long-term memory engine for this deployment. Exactly one engine
   # is active per deployment for recall/inspect/export. Empty selects
   # Hindsight for full installs; callers can explicitly choose AgentCore for
   # low-cost/development deployments. Legacy value "managed" maps to
-  # "agentcore"; "cognee" remains a legacy diagnostic compatibility value, not
-  # the supported user/Space memory path.
+  # "agentcore".
   resolved_memory_engine = (
-    var.memory_engine == "hindsight" || var.memory_engine == "agentcore" || var.memory_engine == "cognee"
+    var.memory_engine == "hindsight" || var.memory_engine == "agentcore"
     ? var.memory_engine
     : var.memory_engine == "managed"
     ? "agentcore"
@@ -218,13 +205,6 @@ locals {
   ) : ""
 }
 
-check "memory_engine_requires_enabled_backend" {
-  assert {
-    condition     = var.memory_engine != "cognee" || var.enable_cognee
-    error_message = "memory_engine = 'cognee' requires enable_cognee = true."
-  }
-}
-
 ################################################################################
 # Workspace Guard
 ################################################################################
@@ -259,121 +239,6 @@ resource "terraform_data" "customer_domain_configuration_guardrails" {
     }
   }
 }
-
-resource "terraform_data" "cognee_configuration_guardrails" {
-  count = var.enable_cognee ? 1 : 0
-
-  input = {
-    cognee_backend_mode            = var.cognee_backend_mode
-    cognee_brain_storage_tier      = var.cognee_brain_storage_tier
-    cognee_desired_count           = var.cognee_desired_count
-    cognee_image_uri               = var.cognee_image_uri
-    cognee_db_name                 = var.cognee_db_name
-    cognee_db_password_secret_arn  = var.cognee_db_password_secret_arn
-    cognee_llm_provider            = var.cognee_llm_provider
-    cognee_embedding_provider      = var.cognee_embedding_provider
-    cognee_bedrock_model_resources = var.cognee_bedrock_model_resource_arns
-    public_subnet_count            = length(module.vpc.public_subnet_ids)
-  }
-
-  lifecycle {
-    precondition {
-      condition     = var.cognee_image_uri != ""
-      error_message = "enable_cognee requires cognee_image_uri pinned to an immutable digest."
-    }
-
-    precondition {
-      condition     = var.cognee_db_password_secret_arn != ""
-      error_message = "enable_cognee requires cognee_db_password_secret_arn for a dedicated Cognee database user."
-    }
-
-    precondition {
-      condition     = var.cognee_db_password_secret_arn != module.database.graphql_db_secret_arn
-      error_message = "enable_cognee requires a dedicated Cognee database secret, not the shared Thinkwork admin database secret."
-    }
-
-    precondition {
-      condition     = var.cognee_db_name != var.database_name
-      error_message = "cognee_db_name must be distinct from the shared Thinkwork database name."
-    }
-
-    precondition {
-      condition     = length(module.vpc.public_subnet_ids) > 0
-      error_message = "enable_cognee requires at least one public subnet for the phase-1 public-subnet task egress pattern."
-    }
-
-    precondition {
-      condition     = var.cognee_backend_mode != "dogfood" || var.cognee_desired_count == 1
-      error_message = "cognee_backend_mode = dogfood requires cognee_desired_count = 1."
-    }
-
-    precondition {
-      condition = (
-        var.cognee_brain_storage_tier != "default" ||
-        (
-          var.cognee_backend_mode == "dogfood" &&
-          var.cognee_vector_db_provider == "lancedb" &&
-          var.cognee_graph_database_provider == "kuzu" &&
-          var.cognee_desired_count == 1
-        )
-      )
-      error_message = "cognee_brain_storage_tier = default requires dogfood backend mode, lancedb vectors, kuzu graph storage, and desired_count = 1."
-    }
-
-    precondition {
-      condition = (
-        var.cognee_brain_storage_tier != "production" ||
-        (
-          var.cognee_backend_mode == "remote" &&
-          var.cognee_vector_db_provider == "neptune_analytics" &&
-          var.cognee_graph_database_provider == "neptune_analytics" &&
-          var.cognee_neptune_graph_id != "" &&
-          var.cognee_neptune_endpoint != ""
-        )
-      )
-      error_message = "cognee_brain_storage_tier = production requires remote mode with Neptune Analytics graph/vector providers, cognee_neptune_graph_id, and cognee_neptune_endpoint."
-    }
-
-    precondition {
-      condition     = !contains(["opensearch", "opensearch_serverless", "aoss"], lower(var.cognee_vector_db_provider))
-      error_message = "Company Brain production must not use direct OpenSearch vector storage; use Neptune Analytics for production graph/vector."
-    }
-
-    precondition {
-      condition = (
-        var.cognee_backend_mode != "remote" ||
-        (
-          (
-            var.cognee_vector_db_url != "" ||
-            (var.cognee_vector_db_provider == "neptune_analytics" && var.cognee_neptune_endpoint != "")
-          ) &&
-          (
-            var.cognee_graph_database_url != "" ||
-            (var.cognee_graph_database_provider == "neptune_analytics" && var.cognee_neptune_endpoint != "")
-          )
-        )
-      )
-      error_message = "cognee_backend_mode = remote requires vector/graph URLs, or Neptune Analytics providers with cognee_neptune_endpoint."
-    }
-
-    precondition {
-      condition = (
-        (var.cognee_llm_provider == "bedrock" || var.cognee_llm_api_key_secret_arn != "") &&
-        (var.cognee_embedding_provider == "bedrock" || var.cognee_embedding_api_key_secret_arn != "")
-      )
-      error_message = "Non-Bedrock Cognee LLM or embedding providers require matching secret ARN inputs."
-    }
-
-    precondition {
-      condition = (
-        (var.cognee_llm_provider != "bedrock" && var.cognee_embedding_provider != "bedrock") ||
-        length(var.cognee_bedrock_model_resource_arns) > 0
-      )
-      error_message = "Bedrock Cognee providers require explicit cognee_bedrock_model_resource_arns."
-    }
-  }
-}
-
 resource "terraform_data" "okf_wiki_efs_guardrails" {
   count = var.okf_wiki_efs_enabled ? 1 : 0
 
@@ -485,40 +350,39 @@ resource "terraform_data" "n8n_configuration_guardrails" {
   count = local.n8n_provisioned ? 1 : 0
 
   input = {
-    n8n_runtime_enabled                         = local.n8n_runtime_enabled
-    n8n_image_uri                               = var.n8n_image_uri
-    n8n_database_name                           = var.n8n_database_name
-    n8n_database_username                       = var.n8n_database_username
-    n8n_database_admin_secret_arn               = var.n8n_database_admin_secret_arn
-    n8n_database_url_secret_arn                 = var.n8n_database_url_secret_arn
-    n8n_encryption_key_secret_arn               = var.n8n_encryption_key_secret_arn
-    n8n_operator_secret_arn                     = var.n8n_operator_secret_arn
-    n8n_service_credential_secret_arn           = var.n8n_service_credential_secret_arn
-    n8n_agent_step_bridge_credential_secret_arn = var.n8n_agent_step_bridge_credential_secret_arn
-    n8n_storage_bucket_name                     = var.n8n_storage_bucket_name
-    n8n_create_storage_bucket                   = var.n8n_create_storage_bucket
-    n8n_storage_prefix                          = var.n8n_storage_prefix
-    n8n_public_url                              = local.n8n_public_url
-    n8n_certificate_arn                         = local.n8n_certificate_arn
-    n8n_main_desired_count                      = var.n8n_main_desired_count
-    n8n_worker_desired_count                    = var.n8n_worker_desired_count
-    n8n_worker_concurrency                      = var.n8n_worker_concurrency
-    n8n_container_port                          = var.n8n_container_port
-    n8n_queue_mode                              = var.n8n_queue_mode
-    n8n_task_runners_enabled                    = var.n8n_task_runners_enabled
-    n8n_package_config_digest                   = var.n8n_package_config_digest
-    n8n_custom_package_specs                    = var.n8n_custom_package_specs
-    n8n_execution_data_storage_mode             = var.n8n_execution_data_storage_mode
-    n8n_binary_data_mode                        = var.n8n_binary_data_mode
-    n8n_cache_engine                            = var.n8n_cache_engine
-    n8n_cache_engine_version                    = var.n8n_cache_engine_version
-    n8n_cache_parameter_group_family            = var.n8n_cache_parameter_group_family
-    n8n_cache_node_type                         = var.n8n_cache_node_type
-    n8n_cache_num_cache_clusters                = var.n8n_cache_num_cache_clusters
-    n8n_allowed_public_cidr_blocks              = var.n8n_allowed_public_cidr_blocks
-    n8n_kms_key_arns                            = var.n8n_kms_key_arns
-    public_subnet_count                         = length(module.vpc.public_subnet_ids)
-    private_subnet_count                        = length(module.vpc.private_subnet_ids)
+    n8n_runtime_enabled               = local.n8n_runtime_enabled
+    n8n_image_uri                     = var.n8n_image_uri
+    n8n_database_name                 = var.n8n_database_name
+    n8n_database_username             = var.n8n_database_username
+    n8n_database_admin_secret_arn     = var.n8n_database_admin_secret_arn
+    n8n_database_url_secret_arn       = var.n8n_database_url_secret_arn
+    n8n_encryption_key_secret_arn     = var.n8n_encryption_key_secret_arn
+    n8n_operator_secret_arn           = var.n8n_operator_secret_arn
+    n8n_service_credential_secret_arn = var.n8n_service_credential_secret_arn
+    n8n_storage_bucket_name           = var.n8n_storage_bucket_name
+    n8n_create_storage_bucket         = var.n8n_create_storage_bucket
+    n8n_storage_prefix                = var.n8n_storage_prefix
+    n8n_public_url                    = local.n8n_public_url
+    n8n_certificate_arn               = local.n8n_certificate_arn
+    n8n_main_desired_count            = var.n8n_main_desired_count
+    n8n_worker_desired_count          = var.n8n_worker_desired_count
+    n8n_worker_concurrency            = var.n8n_worker_concurrency
+    n8n_container_port                = var.n8n_container_port
+    n8n_queue_mode                    = var.n8n_queue_mode
+    n8n_task_runners_enabled          = var.n8n_task_runners_enabled
+    n8n_package_config_digest         = var.n8n_package_config_digest
+    n8n_custom_package_specs          = var.n8n_custom_package_specs
+    n8n_execution_data_storage_mode   = var.n8n_execution_data_storage_mode
+    n8n_binary_data_mode              = var.n8n_binary_data_mode
+    n8n_cache_engine                  = var.n8n_cache_engine
+    n8n_cache_engine_version          = var.n8n_cache_engine_version
+    n8n_cache_parameter_group_family  = var.n8n_cache_parameter_group_family
+    n8n_cache_node_type               = var.n8n_cache_node_type
+    n8n_cache_num_cache_clusters      = var.n8n_cache_num_cache_clusters
+    n8n_allowed_public_cidr_blocks    = var.n8n_allowed_public_cidr_blocks
+    n8n_kms_key_arns                  = var.n8n_kms_key_arns
+    public_subnet_count               = length(module.vpc.public_subnet_ids)
+    private_subnet_count              = length(module.vpc.private_subnet_ids)
   }
 
   lifecycle {
@@ -557,11 +421,6 @@ resource "terraform_data" "n8n_configuration_guardrails" {
       error_message = "n8n_provisioned requires n8n_service_credential_secret_arn or deployment_control_plane_create_secret_placeholders = true."
     }
 
-    precondition {
-      condition     = var.n8n_agent_step_bridge_credential_secret_arn != "" || var.deployment_control_plane_create_secret_placeholders
-      error_message = "n8n_provisioned requires n8n_agent_step_bridge_credential_secret_arn or deployment_control_plane_create_secret_placeholders = true."
-    }
-
     precondition {
       condition     = var.n8n_database_url_secret_arn == "" || var.n8n_database_url_secret_arn != module.database.graphql_db_secret_arn
       error_message = "n8n_provisioned requires a dedicated n8n database URL secret, not the shared Thinkwork admin database secret."
@@ -624,79 +483,6 @@ resource "terraform_data" "n8n_runtime_state_guardrails" {
     }
   }
 }
-
-resource "aws_security_group" "cognee_worker" {
-  count = local.cognee_enabled ? 1 : 0
-
-  name_prefix = "thinkwork-${var.stage}-cognee-worker-"
-  description = "Knowledge Graph ingest Lambda access to Cognee and Aurora"
-  vpc_id      = module.vpc.vpc_id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-cognee-worker-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group_rule" "aurora_from_cognee_worker" {
-  count = local.cognee_enabled ? 1 : 0
-
-  type                     = "ingress"
-  from_port                = 5432
-  to_port                  = 5432
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.cognee_worker[0].id
-  security_group_id        = module.database.db_security_group_id
-}
-
-# VPC-attached Knowledge Graph workers (attached for Cognee's internal ALB)
-# have no public egress — the VPC has no NAT — so the observation promotion
-# classifier's direct Bedrock calls need an interface endpoint inside the VPC.
-# Private DNS keeps the SDK's default bedrock-runtime hostname resolving to
-# the endpoint ENIs — for EVERY resource in the VPC, so the ingress must
-# admit the whole VPC CIDR: the Cognee ECS task (its own SG) and any future
-# in-VPC Bedrock caller resolve to this endpoint the moment it exists.
-data "aws_vpc" "bedrock_endpoint_scope" {
-  count = local.cognee_enabled ? 1 : 0
-  id    = module.vpc.vpc_id
-}
-
-resource "aws_security_group" "bedrock_runtime_endpoint" {
-  count = local.cognee_enabled ? 1 : 0
-
-  name_prefix = "thinkwork-${var.stage}-bedrock-vpce-"
-  description = "HTTPS to the Bedrock runtime interface endpoint"
-  vpc_id      = module.vpc.vpc_id
-
-  ingress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = [data.aws_vpc.bedrock_endpoint_scope[0].cidr_block]
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-bedrock-vpce-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_vpc_endpoint" "bedrock_runtime" {
-  count = local.cognee_enabled ? 1 : 0
-
-  vpc_id              = module.vpc.vpc_id
-  service_name        = "com.amazonaws.${var.region}.bedrock-runtime"
-  vpc_endpoint_type   = "Interface"
-  subnet_ids          = local.cognee_worker_subnet_ids
-  security_group_ids  = [aws_security_group.bedrock_runtime_endpoint[0].id]
-  private_dns_enabled = true
-
-  tags = { Name = "thinkwork-${var.stage}-bedrock-runtime-vpce" }
-}
-
 resource "aws_security_group" "okf_wiki_lambda" {
   count = var.okf_wiki_efs_enabled ? 1 : 0
 
@@ -747,18 +533,6 @@ resource "aws_security_group_rule" "okf_wiki_vpce_from_lambda" {
   source_security_group_id = aws_security_group.okf_wiki_lambda[0].id
   security_group_id        = aws_security_group.okf_wiki_vpc_endpoint[0].id
 }
-
-resource "aws_security_group_rule" "okf_wiki_vpce_from_cognee_worker" {
-  count = local.okf_wiki_private_endpoints_enabled && local.cognee_enabled ? 1 : 0
-
-  type                     = "ingress"
-  from_port                = 443
-  to_port                  = 443
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.cognee_worker[0].id
-  security_group_id        = aws_security_group.okf_wiki_vpc_endpoint[0].id
-}
-
 # Interface endpoints with private DNS capture the WHOLE VPC's traffic to the
 # covered AWS APIs (logs, ssm, sts, bedrock, ...): every workload in the VPC
 # resolves those hostnames to the endpoint's private IP, so per-source-SG
@@ -817,59 +591,6 @@ resource "aws_vpc_endpoint" "okf_wiki_s3" {
     Purpose = "okf-wiki-private-egress"
   }
 }
-
-resource "aws_security_group" "brain_private_vpc_endpoint" {
-  count = local.cognee_enabled && !local.okf_wiki_private_endpoints_enabled ? 1 : 0
-
-  name_prefix = "thinkwork-${var.stage}-brain-vpce-"
-  description = "HTTPS endpoints for private Company Brain/Pi runtime egress"
-  vpc_id      = module.vpc.vpc_id
-
-  tags = { Name = "thinkwork-${var.stage}-brain-vpce-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group_rule" "brain_vpce_from_cognee_worker" {
-  count = local.cognee_enabled && !local.okf_wiki_private_endpoints_enabled ? 1 : 0
-
-  type                     = "ingress"
-  from_port                = 443
-  to_port                  = 443
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.cognee_worker[0].id
-  security_group_id        = aws_security_group.brain_private_vpc_endpoint[0].id
-}
-
-resource "aws_vpc_endpoint" "brain_private_interface" {
-  for_each = local.cognee_enabled && !local.okf_wiki_private_endpoints_enabled ? local.brain_private_interface_endpoint_services : toset([])
-
-  vpc_id              = module.vpc.vpc_id
-  service_name        = "com.amazonaws.${var.region}.${each.key}"
-  vpc_endpoint_type   = "Interface"
-  subnet_ids          = local.cognee_worker_subnet_ids
-  security_group_ids  = [aws_security_group.brain_private_vpc_endpoint[0].id]
-  private_dns_enabled = true
-
-  tags = {
-    Name    = "thinkwork-${var.stage}-brain-${each.key}-vpce"
-    Purpose = "company-brain-private-runtime-egress"
-  }
-}
-
-resource "aws_vpc_endpoint" "brain_private_s3" {
-  count = local.cognee_enabled && !local.okf_wiki_private_endpoints_enabled && length(local.okf_wiki_route_table_ids) > 0 ? 1 : 0
-
-  vpc_id            = module.vpc.vpc_id
-  service_name      = "com.amazonaws.${var.region}.s3"
-  vpc_endpoint_type = "Gateway"
-  route_table_ids   = local.okf_wiki_route_table_ids
-
-  tags = {
-    Name    = "thinkwork-${var.stage}-brain-s3-vpce"
-    Purpose = "company-brain-private-runtime-egress"
-  }
-}
-
 resource "aws_security_group_rule" "okf_wiki_efs_from_lambda" {
   count = var.okf_wiki_efs_enabled ? 1 : 0
 
@@ -1207,9 +928,34 @@ module "deployment_control_plane" {
   create_secret_placeholders = var.deployment_control_plane_create_secret_placeholders
 }
 
+# ── Capability signing keypair (THINK-173 KTD-3) ──────────────────────────
+# Asymmetric by requirement: the multi-tenant Pi container VERIFIES
+# capability sidecars/manifests, so it may only ever hold the public key —
+# a symmetric verify key would be a forge key. The private key lives in
+# Secrets Manager (the api resolves it by name through runtime-config's
+# secret loader; it must never enter the graphql-http env, which sits at
+# the 4KB ceiling). Key material in terraform state is accepted under the
+# same posture as the existing plaintext tfvars (SSM migration pending).
+resource "tls_private_key" "capability_signing" {
+  algorithm = "ED25519"
+}
+
+resource "aws_secretsmanager_secret" "capability_signing_key" {
+  name        = "thinkwork/${var.stage}/capability-signing-key"
+  description = "Ed25519 private key (PKCS8 PEM) signing capability sidecars and manifests (THINK-173)."
+}
+
+resource "aws_secretsmanager_secret_version" "capability_signing_key" {
+  secret_id     = aws_secretsmanager_secret.capability_signing_key.id
+  secret_string = tls_private_key.capability_signing.private_key_pem
+}
+
 module "api" {
   source = "../app/lambda-api"
 
+  capability_signing_public_key         = tls_private_key.capability_signing.public_key_pem
+  capability_signing_private_key_secret = aws_secretsmanager_secret.capability_signing_key.name
+
   stage      = var.stage
   account_id = var.account_id
   region     = var.region
@@ -1226,6 +972,7 @@ module "api" {
   billing_export_bucket_name           = var.billing_export_bucket_name
   billing_export_manifest_key          = var.billing_export_manifest_key
   billing_reconciliation_tolerance_usd = var.billing_reconciliation_tolerance_usd
+  cost_alert_emails                    = var.cost_alert_emails
 
   # Phase 3 U4 — compliance-outbox-drainer connects as `compliance_drainer`
   # via this dedicated secret (provisioned in U2 / PR #887, populated by
@@ -1253,6 +1000,20 @@ module "api" {
   compliance_reader_secret_arn                 = module.database.compliance_reader_secret_arn
   compliance_anchor_object_lock_retention_days = var.compliance_anchor_retention_days
 
+  # THINK-228 — analyst query broker: hardened reader role credentials +
+  # the broker caller credential the seeded connector row references.
+  # THINK-246 — artifact email delivery sender: customer stages send from
+  # their own verified domain (noreply@<customer_domain>); dev keeps the
+  # code fallback via the empty default.
+  artifact_delivery_from_email = var.customer_domain != "" ? "noreply@${var.customer_domain}" : ""
+
+  analyst_reader_secret_arn = module.database.analyst_reader_secret_arn
+  analyst_broker_secret_arn = module.database.analyst_broker_secret_arn
+  # THINK-229 U1 — keys the broker's rds-db:connect grant and switches the
+  # reader connection to per-connect RDS IAM auth tokens.
+  analyst_db_cluster_resource_id = module.database.cluster_resource_id
+  analyst_policy_source          = var.analyst_policy_source
+
   # Phase 3 U8b — KMS key + Object Lock mode forwarded as
   # COMPLIANCE_ANCHOR_KMS_KEY_ARN and COMPLIANCE_ANCHOR_OBJECT_LOCK_MODE
   # env vars on the anchor Lambda. The live `_anchor_fn_live` requires
@@ -1287,45 +1048,38 @@ module "api" {
 
   kb_service_role_arn = module.bedrock_kb.kb_service_role_arn
 
-  lambda_zips_dir                               = var.lambda_zips_dir
-  api_auth_secret                               = var.api_auth_secret
-  db_password                                   = var.db_password
-  bootstrap_credential_lease_kms_key_id         = var.bootstrap_credential_lease_kms_key_id
-  agentcore_pi_function_name                    = module.agentcore_pi.agentcore_pi_function_name
-  agentcore_pi_function_arn                     = module.agentcore_pi.agentcore_pi_function_arn
-  enable_agentcore_pi_invoke_policy             = true
-  hindsight_endpoint                            = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : ""
-  agentcore_memory_id                           = module.agentcore_memory.memory_id
-  memory_engine                                 = local.resolved_memory_engine
-  cognee_enabled                                = local.cognee_enabled
-  cognee_endpoint                               = local.cognee_enabled ? module.cognee[0].cognee_endpoint : ""
-  cognee_log_group_name                         = local.cognee_enabled ? module.cognee[0].cognee_log_group_name : ""
-  cognee_backend_mode                           = local.cognee_enabled ? module.cognee[0].cognee_backend_mode : ""
-  cognee_cluster_arn                            = local.cognee_enabled ? module.cognee[0].cognee_cluster_arn : ""
-  cognee_service_name                           = local.cognee_enabled ? module.cognee[0].cognee_service_name : ""
-  cognee_worker_subnet_ids                      = local.cognee_enabled ? local.cognee_worker_subnet_ids : []
-  cognee_worker_security_group_ids              = local.cognee_enabled ? [aws_security_group.cognee_worker[0].id] : []
-  okf_efs_subnet_ids                            = var.okf_wiki_efs_enabled ? local.okf_wiki_subnet_ids : []
-  okf_efs_security_group_ids                    = var.okf_wiki_efs_enabled ? [aws_security_group.okf_wiki_lambda[0].id] : []
-  okf_efs_mount_target_ids                      = var.okf_wiki_efs_enabled ? aws_efs_mount_target.okf_wiki[*].id : []
-  okf_efs_file_system_arn                       = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].arn : ""
-  okf_efs_refresh_access_point_arn              = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_refresh[0].arn : ""
-  twenty_provisioned                            = local.twenty_provisioned
-  twenty_runtime_enabled                        = local.twenty_runtime_enabled
-  twenty_url                                    = local.twenty_provisioned ? module.twenty[0].twenty_url : ""
-  twenty_alb_arn                                = local.twenty_provisioned ? module.twenty[0].twenty_alb_arn : ""
-  twenty_target_group_arn                       = local.twenty_provisioned ? module.twenty[0].twenty_target_group_arn : ""
-  twenty_cluster_arn                            = local.twenty_provisioned ? module.twenty[0].twenty_cluster_arn : ""
-  twenty_server_service_name                    = local.twenty_provisioned ? module.twenty[0].twenty_server_service_name : ""
-  twenty_worker_service_name                    = local.twenty_provisioned ? module.twenty[0].twenty_worker_service_name : ""
-  twenty_server_log_group_name                  = local.twenty_provisioned ? module.twenty[0].twenty_server_log_group_name : ""
-  twenty_worker_log_group_name                  = local.twenty_provisioned ? module.twenty[0].twenty_worker_log_group_name : ""
-  admin_url                                     = local.end_user_app_url
-  docs_url                                      = "https://${module.docs_site.distribution_domain}"
-  www_url                                       = var.www_domain != "" ? "https://${var.www_domain}" : "https://${module.www_site.distribution_domain}"
-  stripe_price_ids_json                         = var.stripe_price_ids_json
-  appsync_realtime_url                          = module.appsync.graphql_realtime_url
-  ecr_repository_url                            = module.agentcore_platform.ecr_repository_url
+  lambda_zips_dir                       = var.lambda_zips_dir
+  api_auth_secret                       = var.api_auth_secret
+  db_password                           = var.db_password
+  bootstrap_credential_lease_kms_key_id = var.bootstrap_credential_lease_kms_key_id
+  agentcore_pi_function_name            = module.agentcore_pi.agentcore_pi_function_name
+  agentcore_pi_function_arn             = module.agentcore_pi.agentcore_pi_function_arn
+  enable_agentcore_pi_invoke_policy     = true
+  hindsight_endpoint                    = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : ""
+  hindsight_database_name               = var.hindsight_database_name
+  agentcore_memory_id                   = module.agentcore_memory.memory_id
+  memory_engine                         = local.resolved_memory_engine
+  okf_efs_subnet_ids                    = var.okf_wiki_efs_enabled ? local.okf_wiki_subnet_ids : []
+  okf_efs_security_group_ids            = var.okf_wiki_efs_enabled ? [aws_security_group.okf_wiki_lambda[0].id] : []
+  okf_efs_mount_target_ids              = var.okf_wiki_efs_enabled ? aws_efs_mount_target.okf_wiki[*].id : []
+  okf_efs_file_system_arn               = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].arn : ""
+  okf_efs_refresh_access_point_arn      = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_refresh[0].arn : ""
+  twenty_provisioned                    = local.twenty_provisioned
+  twenty_runtime_enabled                = local.twenty_runtime_enabled
+  twenty_url                            = local.twenty_provisioned ? module.twenty[0].twenty_url : ""
+  twenty_alb_arn                        = local.twenty_provisioned ? module.twenty[0].twenty_alb_arn : ""
+  twenty_target_group_arn               = local.twenty_provisioned ? module.twenty[0].twenty_target_group_arn : ""
+  twenty_cluster_arn                    = local.twenty_provisioned ? module.twenty[0].twenty_cluster_arn : ""
+  twenty_server_service_name            = local.twenty_provisioned ? module.twenty[0].twenty_server_service_name : ""
+  twenty_worker_service_name            = local.twenty_provisioned ? module.twenty[0].twenty_worker_service_name : ""
+  twenty_server_log_group_name          = local.twenty_provisioned ? module.twenty[0].twenty_server_log_group_name : ""
+  twenty_worker_log_group_name          = local.twenty_provisioned ? module.twenty[0].twenty_worker_log_group_name : ""
+  admin_url                             = local.end_user_app_url
+  docs_url                              = "https://${module.docs_site.distribution_domain}"
+  www_url                               = var.www_domain != "" ? "https://${var.www_domain}" : "https://${module.www_site.distribution_domain}"
+  stripe_price_ids_json                 = var.stripe_price_ids_json
+  appsync_realtime_url                  = module.appsync.graphql_realtime_url
+  ecr_repository_url                    = module.agentcore_platform.ecr_repository_url
   # Static truth for count gating: agentcore_platform's ECR repo is
   # unconditional, but its URL attribute is unknown until apply. The runner
   # additionally needs its image tag seeded (CI does this for repo-managed
@@ -1345,10 +1099,10 @@ module "api" {
   enable_slack_workspace_app                    = var.enable_slack_workspace_app
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
   wiki_compile_model_id                         = var.wiki_compile_model_id
-  company_brain_source_agent_model_id           = var.company_brain_source_agent_model_id
-  company_brain_backdoor_install_key_secret_arn = var.company_brain_backdoor_install_key_secret_arn
-  company_brain_backdoor_install_key_stages     = var.company_brain_backdoor_install_key_stages
+  brain_source_agent_model_id                   = var.brain_source_agent_model_id
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
+  wiki_source                                   = var.wiki_source
+  knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
   google_places_api_key                         = var.google_places_api_key
   enable_workspace_orchestration                = var.enable_workspace_orchestration
@@ -1356,6 +1110,8 @@ module "api" {
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
+  brain_dream_state_enabled                     = var.brain_dream_state_enabled
+  brain_dream_state_schedule_expression         = var.brain_dream_state_schedule_expression
   # Per-user OAuth client credentials — fed to Secrets Manager in
   # app/lambda-api/oauth-secrets.tf. Reuses the same google_oauth_client_*
   # tfvars that already flow to the Cognito federated-signin module.
@@ -1400,6 +1156,8 @@ module "agentcore_platform" {
 module "agentcore_pi" {
   source = "../app/agentcore-pi"
 
+  capability_signing_public_key = tls_private_key.capability_signing.public_key_pem
+
   stage       = var.stage
   account_id  = var.account_id
   region      = var.region
@@ -1410,6 +1168,7 @@ module "agentcore_pi" {
   async_dlq_arn      = module.agentcore_platform.agentcore_async_dlq_arn
 
   hindsight_endpoint                     = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : ""
+  hindsight_database_name                = var.hindsight_database_name
   agentcore_memory_id                    = module.agentcore_memory.memory_id
   memory_engine                          = local.resolved_memory_engine
   requester_idle_memory_learning_enabled = var.requester_idle_memory_learning_enabled
@@ -1423,9 +1182,6 @@ module "agentcore_pi" {
   db_cluster_arn = module.database.db_cluster_arn
   db_secret_arn  = module.database.graphql_db_secret_arn
 
-  cognee_subnet_ids         = local.cognee_enabled ? local.cognee_worker_subnet_ids : []
-  cognee_security_group_ids = local.cognee_enabled ? [aws_security_group.cognee_worker[0].id] : []
-
   okf_efs_enabled               = var.okf_wiki_efs_enabled
   okf_efs_subnet_ids            = var.okf_wiki_efs_enabled ? local.okf_wiki_subnet_ids : []
   okf_efs_security_group_ids    = var.okf_wiki_efs_enabled ? [aws_security_group.okf_wiki_lambda[0].id] : []
@@ -1530,6 +1286,32 @@ module "routines_stepfunctions" {
   execution_callback_lambda_arn = ""
 }
 
+# Workflow Interpreter substrate (THINK-219): the ONE static Step Functions
+# state machine per stage that interprets every workflow definition, plus its
+# shared execution role, vended log group, machine-ARN SSM parameter, and the
+# EventBridge SFN-state-change rule -> workflow-execution-callback.
+#
+# Unlike routines (rule moved into module.api to break a cycle), there is NO
+# cycle here: module.api does not consume any interpreter output (the machine
+# ARN reaches graphql-http/job-trigger via SSM at runtime, not terraform), so
+# this module can safely depend on module.api for the callback function ARN.
+#
+# enable_execution_callback is a STATIC true (not derived from the ARN): the
+# module gates its EventBridge resources' count on it, and a count that depends
+# on a computed attribute (the Lambda ARN, unknown until the function exists)
+# fails plan with "Invalid count argument". The ARN itself is consumed only
+# inside resource bodies, where computed values are fine.
+module "workflow_interpreter_stepfunctions" {
+  source = "../app/workflow-interpreter-stepfunctions"
+
+  stage      = var.stage
+  account_id = var.account_id
+  region     = var.region
+
+  enable_execution_callback     = true
+  execution_callback_lambda_arn = module.api.workflow_execution_callback_fn_arn
+}
+
 module "hindsight" {
   count  = local.hindsight_enabled ? 1 : 0
   source = "../app/hindsight-memory"
@@ -1539,77 +1321,13 @@ module "hindsight" {
   subnet_ids           = module.vpc.public_subnet_ids
   db_security_group_id = module.database.db_security_group_id
   database_url         = module.database.database_url
+  database_name        = var.hindsight_database_name
   image_tag            = var.hindsight_image_tag
 
   enable_auto_consolidation     = var.hindsight_enable_auto_consolidation
   consolidation_dedup_threshold = var.hindsight_consolidation_dedup_threshold
   observations_mission          = var.hindsight_observations_mission
 }
-
-module "cognee" {
-  count  = local.cognee_enabled ? 1 : 0
-  source = "../../../plugins/company-brain/terraform/cognee"
-
-  stage                  = var.stage
-  vpc_id                 = module.vpc.vpc_id
-  subnet_ids             = module.vpc.public_subnet_ids
-  db_security_group_id   = module.database.db_security_group_id
-  db_host                = module.database.cluster_endpoint
-  db_name                = var.cognee_db_name
-  db_username            = var.cognee_db_username
-  db_password_secret_arn = var.cognee_db_password_secret_arn
-
-  allowed_internal_cidr_blocks = var.cognee_allowed_internal_cidr_blocks
-  allowed_internal_security_group_ids = concat(
-    var.cognee_allowed_internal_security_group_ids,
-    [aws_security_group.cognee_worker[0].id],
-  )
-  image_uri     = var.cognee_image_uri
-  desired_count = var.cognee_desired_count
-  backend_mode  = var.cognee_backend_mode
-
-  brain_tenant_id                = var.cognee_brain_tenant_id
-  brain_instance_key             = var.cognee_brain_instance_key
-  brain_storage_tier             = var.cognee_brain_storage_tier
-  brain_s3_artifact_root         = var.cognee_brain_s3_artifact_root
-  brain_s3_manifest_root         = var.cognee_brain_s3_manifest_root
-  brain_s3_vault_projection_root = var.cognee_brain_s3_vault_projection_root
-  brain_artifacts_bucket_arn     = var.cognee_brain_artifacts_bucket_arn
-  brain_artifacts_prefixes       = var.cognee_brain_artifacts_prefixes
-  private_substrate_mode         = var.cognee_private_substrate_mode
-  require_authentication         = var.cognee_require_authentication
-  enable_backend_access_control  = var.cognee_enable_backend_access_control
-  cors_allowed_origins           = var.cognee_cors_allowed_origins
-
-  llm_provider           = var.cognee_llm_provider
-  llm_model              = var.cognee_llm_model
-  llm_api_key_secret_arn = var.cognee_llm_api_key_secret_arn
-
-  embedding_provider           = var.cognee_embedding_provider
-  embedding_model              = var.cognee_embedding_model
-  embedding_dimensions         = var.cognee_embedding_dimensions
-  embedding_api_key_secret_arn = var.cognee_embedding_api_key_secret_arn
-
-  vector_db_provider       = var.cognee_vector_db_provider
-  vector_db_url            = var.cognee_vector_db_url
-  vector_db_key_secret_arn = var.cognee_vector_db_key_secret_arn
-
-  graph_database_provider            = var.cognee_graph_database_provider
-  graph_database_url                 = var.cognee_graph_database_url
-  graph_database_username            = var.cognee_graph_database_username
-  graph_database_password_secret_arn = var.cognee_graph_database_password_secret_arn
-
-  neptune_graph_id   = var.cognee_neptune_graph_id
-  neptune_graph_arn  = var.cognee_neptune_graph_arn
-  neptune_endpoint   = var.cognee_neptune_endpoint
-  production_posture = var.cognee_production_posture
-
-  bedrock_model_resource_arns = var.cognee_bedrock_model_resource_arns
-  kms_key_arns                = var.cognee_kms_key_arns
-
-  depends_on = [terraform_data.cognee_configuration_guardrails]
-}
-
 module "twenty" {
   count  = local.twenty_provisioned ? 1 : 0
   source = "../../../plugins/twenty/terraform/twenty"
@@ -1668,15 +1386,14 @@ module "n8n" {
   worker_concurrency   = var.n8n_worker_concurrency
   container_port       = var.n8n_container_port
 
-  database_admin_secret_arn               = var.n8n_database_admin_secret_arn
-  database_url_secret_arn                 = var.n8n_database_url_secret_arn
-  database_name                           = var.n8n_database_name
-  database_username                       = var.n8n_database_username
-  encryption_key_secret_arn               = var.n8n_encryption_key_secret_arn
-  operator_secret_arn                     = var.n8n_operator_secret_arn
-  service_credential_secret_arn           = var.n8n_service_credential_secret_arn
-  agent_step_bridge_credential_secret_arn = var.n8n_agent_step_bridge_credential_secret_arn
-  create_secret_placeholders              = var.deployment_control_plane_create_secret_placeholders
+  database_admin_secret_arn     = var.n8n_database_admin_secret_arn
+  database_url_secret_arn       = var.n8n_database_url_secret_arn
+  database_name                 = var.n8n_database_name
+  database_username             = var.n8n_database_username
+  encryption_key_secret_arn     = var.n8n_encryption_key_secret_arn
+  operator_secret_arn           = var.n8n_operator_secret_arn
+  service_credential_secret_arn = var.n8n_service_credential_secret_arn
+  create_secret_placeholders    = var.deployment_control_plane_create_secret_placeholders
 
   storage_bucket_name = var.n8n_storage_bucket_name
   create_storage_bucket = (
@@ -1716,6 +1433,8 @@ module "ses" {
   inbound_bucket_name                = module.s3.bucket_name
   email_inbound_fn_arn               = module.api.email_inbound_fn_arn
   email_inbound_fn_name              = module.api.email_inbound_fn_name
+  email_inbound_fn_arn_attr          = module.api.email_inbound_fn_arn_attr
+  email_inbound_fn_name_attr         = module.api.email_inbound_fn_name_attr
   enable_email_inbound_lambda_action = true
 
   manage_active_rule_set = var.ses_manage_active_rule_set
@@ -1805,6 +1524,8 @@ module "customer_domain" {
   inbound_bucket_name                = module.s3.bucket_name
   email_inbound_fn_arn               = module.api.email_inbound_fn_arn
   email_inbound_fn_name              = module.api.email_inbound_fn_name
+  email_inbound_fn_arn_attr          = module.api.email_inbound_fn_arn_attr
+  email_inbound_fn_name_attr         = module.api.email_inbound_fn_name_attr
   enable_email_inbound_lambda_action = true
 
   # KTD6 — one active receipt rule set per account/region. The customer-domain