thinkwork-cli 0.12.17 → 0.13.1

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -30,10 +30,13 @@ locals {
       "oauth-authorize",
       "oauth-callback",
       "slack-events",
-      "slack-slash-command",
-      "slack-interactivity",
       "slack-oauth-install",
     ],
+    var.enable_msteams_app ? [] : [
+      "msteams-install-start",
+      "msteams-install-complete",
+      "msteams-account-link-complete",
+    ],
   )
 
   # Config-class configuration shared by all API handlers. As of plan
@@ -58,6 +61,12 @@ locals {
     # signed sidecar block authoritative (budgets/policyClaims flow). Flip
     # ONLY after clean shadow parity on live traffic.
     ANALYST_POLICY_SOURCE = var.analyst_policy_source
+    # Governed autonomy — per-tenant opt-in allowlist for autonomous capability
+    # self-extension (the two self_admit_connection / self_approve_routine
+    # actions on capability-control-service). Comma/space-separated tenant ids;
+    # empty (default) = NO tenant enabled, so self-extension ships inert and
+    # fail-closed. Read via getConfig() (env-wins) in isSelfExtensionEnabled.
+    CAPABILITY_SELF_EXTENSION_TENANTS = var.capability_self_extension_tenants
     # THINK-230 — the operator-facing provisionAnalystConnector mutation runs
     # the analyst connector provisioning ceremony inside graphql-http, so the
     # shared api handlers read the same broker-secret ARN + rds_iam connect
@@ -74,6 +83,11 @@ locals {
     DATABASE_SECRET_ARN            = var.graphql_db_secret_arn
     DATABASE_HOST                  = var.db_cluster_endpoint
     DATABASE_NAME                  = var.database_name
+    # THINK-280 U8: the LAST rollout gate. External capability search + the
+    # Inspector governed-runtime operation layer stay inert until the broker is
+    # enabled for the stage. Off by default — read via getConfig() (env-wins).
+    CAPABILITY_EXTERNAL_SEARCH_ENABLED = var.enable_capability_broker ? "true" : "false"
+    ENABLE_CAPABILITY_BROKER           = var.enable_capability_broker ? "true" : "false"
     # BUCKET_NAME and USER_POOL_ID were duplicate aliases of WORKSPACE_BUCKET
     # and COGNITO_USER_POOL_ID; GRAPHQL_API_KEY duplicated APPSYNC_API_KEY;
     # THINKWORK_API_SECRET and EMAIL_HMAC_SECRET duplicated API_AUTH_SECRET
@@ -237,6 +251,10 @@ locals {
     SLACK_APP_CREDENTIALS_SECRET_ARN = var.enable_slack_workspace_app ? aws_secretsmanager_secret.slack_app_credentials[0].arn : ""
   }
 
+  msteams_handler_env = {
+    MSTEAMS_APP_CREDENTIALS_SECRET_ARN = var.enable_msteams_app ? aws_secretsmanager_secret.msteams_app_credentials[0].arn : ""
+  }
+
   handler_extra_env = {
     # Analyst query broker (THINK-228 U3). Reader role + caller credential
     # secrets, and the workspace bucket's analyst-staging/ prefix for
@@ -302,6 +320,17 @@ locals {
       THINKWORK_RELEASE_VERSION         = var.deployment_release_version
       THINKWORK_RELEASE_MANIFEST_URL    = var.deployment_release_manifest_url
       THINKWORK_RELEASE_MANIFEST_SHA256 = var.deployment_release_manifest_sha256
+      # THINK-280 — createTenant RequestResponse-invokes agentcore-admin to
+      # provision the per-tenant sandbox. sandbox-provisioning.ts reads both
+      # from process.env directly (the token is a secret → env, never the SSM
+      # String doc). Broker-session build reads the three broker values below
+      # (broker-session.ts); all EMPTY when the broker is disabled → inert.
+      AGENTCORE_ADMIN_LAMBDA_ARN      = var.agentcore_admin_lambda_arn
+      AGENTCORE_ADMIN_TOKEN           = var.agentcore_admin_token
+      CAPABILITY_BROKER_AUDIENCE      = var.capability_broker_audience
+      CAPABILITY_BROKER_API_ID        = var.capability_broker_api_id
+      CAPABILITY_BROKER_VPCE_DNS      = var.capability_broker_vpce_dns
+      CAPABILITY_BROKER_SESSION_TABLE = var.capability_broker_session_table
     }
     # Compounding Memory compile Lambda. Any Converse-compatible Bedrock
     # model works; the planner + section-writer cap themselves at ~500
@@ -343,12 +372,25 @@ locals {
       BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
       OKF_EFS_ROOT           = var.okf_efs_mount_path
     }
-    "oauth-authorize"     = local.slack_handler_env
-    "oauth-callback"      = local.slack_handler_env
-    "slack-events"        = local.slack_handler_env
-    "slack-slash-command" = local.slack_handler_env
-    "slack-interactivity" = local.slack_handler_env
-    "slack-oauth-install" = local.slack_handler_env
+    # THINK-193 U1 (Codex F6): normalized evidence snapshots live in the
+    # encrypted brain-artifacts bucket under evidence-snapshots/ — Postgres
+    # keeps only the s3:// ref + hash. 30-day lifecycle expiration below.
+    "memory-stage-worker" = {
+      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+    }
+    # THINK-193 U2 (Codex S1/S2): the retraction drainer performs the
+    # versioned evidence-snapshot deletion for source erases under its
+    # DEDICATED role (below) — the only place bulk destructive S3 runs.
+    "memory-retraction-drainer" = {
+      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+    }
+    "oauth-authorize"               = local.slack_handler_env
+    "oauth-callback"                = local.slack_handler_env
+    "slack-events"                  = local.slack_handler_env
+    "slack-oauth-install"           = local.slack_handler_env
+    "msteams-install-start"         = local.msteams_handler_env
+    "msteams-install-complete"      = local.msteams_handler_env
+    "msteams-account-link-complete" = local.msteams_handler_env
     "thread-attachments-finalize" = {
       REQUESTER_IDLE_MEMORY_LEARNING_ENABLED = tostring(var.requester_idle_memory_learning_enabled)
     }
@@ -375,6 +417,12 @@ locals {
     "brain-dream-state" = {
       BRAIN_DREAM_STATE_ENABLED = tostring(var.brain_dream_state_enabled)
     }
+    # THINK-307 KTD2: the origin-freshness guard reads the same stall
+    # threshold as the stall monitor — one operational knob, two consumers,
+    # no drift between "stalled" and "recovered".
+    "cron-retry-dispatcher" = {
+      STALL_THRESHOLD_MINUTES = tostring(var.stall_threshold_minutes)
+    }
     # Bedrock KB provisioning. Per-handler (not common_env) so these don't bloat
     # the already-near-4KB graphql-http env. Bedrock's RDS-backed KB needs the
     # cluster ARN + the KB service role (passed at CreateKnowledgeBase time).
@@ -395,6 +443,15 @@ locals {
       # invocation (never Lambda self-invoke — AWS recursive-loop
       # detection terminates worker-to-self Event chains).
       KG_OBS_MAX_CANDIDATES_PER_RUN = var.kg_obs_max_candidates_per_run
+      # THINK-193 U4 dead-handoff fix: a successful observations ingest
+      # enqueues the tenant graph wiki-compile job inside its own commit
+      # and Event-invokes wiki-compile post-commit. WIKI_SOURCE must match
+      # the wiki-compile handler's dispatch flag (stage-global); the
+      # per-tenant kill switch stays tenants.wiki_compile_enabled. The
+      # invoke rides the shared lambda role's existing wiki-compile
+      # lambda:InvokeFunction grant (iam-grouped.tf); the function name is
+      # derived from STAGE (common_env) at call time.
+      WIKI_SOURCE = var.wiki_source
     }
     # routine-task-python (Phase B U6) needs the AgentCore code-interpreter
     # id + the per-stage S3 routine-output bucket. The interpreter id is
@@ -414,6 +471,14 @@ locals {
     "routine-exec-git" = {
       SANDBOX_INTERPRETER_ID = var.agentcore_code_interpreter_id
       ROUTINE_OUTPUT_BUCKET  = "thinkwork-${var.stage}-routine-output"
+      # THINK-280 U7 — the headless capability executor runs inside
+      # routine-exec-git and mints broker sessions. routine-exec-git.ts +
+      # capability-headless-executor.ts read all four from process.env; all
+      # EMPTY when the broker is disabled → the executor stays inert.
+      CAPABILITY_BROKER_SESSION_TABLE = var.capability_broker_session_table
+      CAPABILITY_BROKER_AUDIENCE      = var.capability_broker_audience
+      CAPABILITY_BROKER_API_ID        = var.capability_broker_api_id
+      CAPABILITY_BROKER_VPCE_DNS      = var.capability_broker_vpce_dns
     }
     # graphql-http hosts the createRoutine / publishRoutineVersion / etc.
     # resolvers (Phase B U7) AND the routine-approval-bridge (Phase B
@@ -608,6 +673,8 @@ resource "aws_lambda_function" "handler" {
     "mcp-user-memory",
     "mcp-context-engine",
     "mcp-open-engine",
+    # THINK-280 U8: scoped external capability search MCP facade.
+    "mcp-capability-search",
     "activity",
     "routines",
     "budgets",
@@ -628,6 +695,10 @@ resource "aws_lambda_function" "handler" {
     # dispatch can withhold a failing/stale connection loudly.
     "analyst-connection-reconciler",
     "cron-stall-monitor",
+    # THINK-307: drains retry_queue rows the stall monitor enqueues. Built by
+    # scripts/build-lambdas.sh since PRD-09 but first registered here; its
+    # schedule ships DISABLED (var.retry_dispatcher_enabled default false).
+    "cron-retry-dispatcher",
     "webhook-crm-opportunity",
     "webhook-task-event",
     "workspace-files",
@@ -642,13 +713,28 @@ resource "aws_lambda_function" "handler" {
     "email-provider-webhook",
     "email-readiness-probe",
     "slack-events",
-    "slack-slash-command",
-    "slack-interactivity",
     "slack-oauth-install",
+    "msteams-install-start",
+    "msteams-install-complete",
+    "msteams-account-link-complete",
     "github-app",
     "memory",
     "memory-retain",
     "brain-dream-state",
+    "memory-stage-worker",
+    # THINK-193 U2 (Codex P1 #3): scheduled retry drainer for the retraction
+    # saga ledger. Claims due/stale memory_retraction_attempts rows with the
+    # locked_by + lock_generation fence, processes each via the saga, sweeps
+    # exhausted rows to dead_lettered, and emits structured-log metrics.
+    # rate(5 minutes) EventBridge Scheduler + MaxRetryAttempts=0 (dedicated
+    # resources below) — the next tick IS the retry.
+    "memory-retraction-drainer",
+    # THINK-193 U3: stalled memory_stage token sweeper — re-invokes the
+    # memory-stage-worker for pending/executing tokens past their lease and
+    # redrives consumed-but-unsent results; unrecoverable parks get a
+    # terminal step event + SendTaskFailure. rate(15 minutes) schedule
+    # (dedicated resource below).
+    "memory-stage-sweeper",
     "wiki-compile",
     "knowledge-graph-observations-ingest",
     "ontology-scan",
@@ -791,6 +877,14 @@ resource "aws_lambda_function" "handler" {
     # POSTs one row per agent-session-start. Shared
     # API_AUTH_SECRET bearer (runtime→API; no tenant OAuth).
     "manifest-log",
+    # Governed capability runtime control-plane service (THINK-280 U2).
+    # NO HTTP route: the Pi container invokes it directly (RequestResponse)
+    # via lambda:InvokeFunction over the approved in-account path — public
+    # execute-api is not reliable from Pi's private VPC. Identity comes
+    # exclusively from the Ed25519-signed capability caller context (the
+    # CAPABILITY_SIGNING_PUBLIC_KEY in the shared runtime-config document
+    # verifies it); plaintext payload fields are never trusted.
+    "capability-control-service",
     # SI-7 catalog-list read endpoint (plan §U15 pt 3/3). The runtime
     # fetches the allowed builtin-tool slug set once per
     # session-start + feature-flag-gated enforcement filter drops
@@ -831,9 +925,13 @@ resource "aws_lambda_function" "handler" {
   ]), toset(local.optional_integration_handler_names)) : toset([])
 
   function_name = "thinkwork-${var.stage}-api-${each.key}"
-  role          = aws_iam_role.lambda.arn
-  handler       = "index.handler"
-  runtime       = local.runtime
+  # S2 (THINK-193 U2): memory-retraction-drainer runs under a DEDICATED role
+  # so its destructive evidence-snapshot S3 capability (version enumeration +
+  # bulk version deletion) never leaks into the 90+ handlers on the shared
+  # role. Everything else keeps the shared role.
+  role    = each.key == "memory-retraction-drainer" ? aws_iam_role.memory_retraction_drainer.arn : aws_iam_role.lambda.arn
+  handler = "index.handler"
+  runtime = local.runtime
   # Parameters and Secrets extension: container-local cache for the SSM
   # runtime-config document + Secrets Manager reads (runtime-config.tf).
   layers = local.api_handler_layers
@@ -859,7 +957,7 @@ resource "aws_lambda_function" "handler" {
   # validates the agent, builds the AgentCore invoke payload, dispatches
   # Event-mode, and returns. Setup is ~5s in practice; 60s gives 12×
   # headroom for transient slowness.
-  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
+  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
   memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
 
   filename         = local.use_local_zips ? "${var.lambda_zips_dir}/${each.key}.zip" : null
@@ -904,6 +1002,19 @@ resource "aws_lambda_function" "handler" {
     }
   }
 
+  # Analyst data-path handlers get a stable NAT egress IP when
+  # analyst_egress_subnet_ids is set — external Postgres sources behind an IP
+  # allowlist admit that one EIP. Disjoint from the okf-efs-refresh block
+  # above (a function takes at most one vpc_config).
+  dynamic "vpc_config" {
+    for_each = contains(local.analyst_vpc_handlers, each.key) && local.analyst_vpc_enabled ? [1] : []
+
+    content {
+      subnet_ids         = var.analyst_egress_subnet_ids
+      security_group_ids = var.analyst_egress_security_group_ids
+    }
+  }
+
   dynamic "file_system_config" {
     for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
 
@@ -1061,6 +1172,21 @@ resource "aws_lambda_function_event_invoke_config" "routine_approval_callback" {
 # retain-cost path (Bedrock tokens charged in adapter.retainConversation)
 # is NOT idempotent — retries multiply LLM cost. Per
 # project_async_retry_idempotency_lessons.
+# memory-stage-worker (THINK-193 U1): Event-invoked by workflow-step-dispatch
+# AFTER the memory_stage task token is stored. Lambda async retries are
+# disabled like its memory siblings — the worker's stages are idempotent, but
+# an automatic re-execution would race the original's token CAS and turn a
+# completed stage into a spurious failure. A worker that dies without
+# resuming the token is bounded by the state machine's HeartbeatSeconds
+# (3600s): the parked step times out and the run fails visibly, and a
+# re-triggered run self-heals from the durable checkpoint/evidence ledger.
+resource "aws_lambda_function_event_invoke_config" "memory_stage_worker" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["memory-stage-worker"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
 resource "aws_lambda_function_event_invoke_config" "memory_retain" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
   function_name                = aws_lambda_function.handler["memory-retain"].function_name
@@ -1068,6 +1194,132 @@ resource "aws_lambda_function_event_invoke_config" "memory_retain" {
   maximum_event_age_in_seconds = 3600
 }
 
+# ---------------------------------------------------------------------------
+# THINK-193 U2 (Codex S2): dedicated IAM role for memory-retraction-drainer.
+#
+# The drainer is the ONLY principal allowed to enumerate and bulk-delete
+# evidence-snapshot object VERSIONS (S1: the brain-artifacts bucket is
+# versioned; erase completeness requires deleting every noncurrent version
+# and delete marker under the source prefix). Granting that on the shared
+# api-lambda role would let every unrelated handler destroy any tenant's
+# evidence — hence the sibling-role pattern (same as
+# compliance-anchor-watchdog). The role otherwise carries only what the
+# drainer actually uses: logs (managed basic policy), Secrets Manager +
+# SSM runtime-config reads, and conditional KMS for the encrypted bucket.
+# ---------------------------------------------------------------------------
+
+resource "aws_iam_role" "memory_retraction_drainer" {
+  name = "thinkwork-${var.stage}-memory-retraction-drainer-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "memory_retraction_drainer_basic" {
+  role       = aws_iam_role.memory_retraction_drainer.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy" "memory_retraction_drainer" {
+  name = "memory-retraction-drainer"
+  role = aws_iam_role.memory_retraction_drainer.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        # Versioned evidence-snapshot destruction, evidence-snapshots/ only.
+        {
+          Effect = "Allow"
+          Action = [
+            "s3:DeleteObject",
+            "s3:DeleteObjectVersion",
+          ]
+          Resource = "${aws_s3_bucket.brain_artifacts.arn}/evidence-snapshots/*"
+        },
+        {
+          Effect = "Allow"
+          Action = [
+            "s3:ListBucket",
+            "s3:ListBucketVersions",
+          ]
+          Resource = aws_s3_bucket.brain_artifacts.arn
+          Condition = {
+            StringLike = {
+              "s3:prefix" = "evidence-snapshots/*"
+            }
+          }
+        },
+        # Runtime-config document + platform secrets (DATABASE_URL rides the
+        # env during the R8 transition window; the loader prefetches the
+        # api-auth/appsync secrets at cold start).
+        {
+          Effect   = "Allow"
+          Action   = ["ssm:GetParameter", "ssm:GetParameters"]
+          Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/*"
+        },
+        {
+          Effect   = "Allow"
+          Action   = ["secretsmanager:GetSecretValue"]
+          Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork/*"
+        },
+      ],
+      var.brain_artifacts_kms_key_arn != "" ? [
+        {
+          Effect = "Allow"
+          Action = [
+            "kms:Decrypt",
+            "kms:GenerateDataKey",
+          ]
+          Resource = var.brain_artifacts_kms_key_arn
+        },
+      ] : [],
+    )
+  })
+}
+
+# memory-retraction-drainer (THINK-193 U2, Codex P1 #3): the retraction
+# saga's product-owned retry path. Lambda async retries are disabled — every
+# transition on memory_retraction_attempts is a fenced CAS, so a duplicate
+# invocation is harmless but pointless; the rate(5 minutes) schedule below
+# is the retry. Attempts exceeding max_attempts are swept to dead_lettered
+# by the drainer itself instead of retrying forever.
+resource "aws_lambda_function_event_invoke_config" "memory_retraction_drainer" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["memory-retraction-drainer"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
+resource "aws_scheduler_schedule" "memory_retraction_drainer" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-memory-retraction-drainer"
+  group_name          = "default"
+  schedule_expression = "rate(5 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["memory-retraction-drainer"].arn
+    role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ limit = 25 })
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 # Product-owned retry path for memory-retain. Lambda async retries remain
 # disabled above; this scheduled drain claims due rows from
 # memory_retain_attempts and replays bounded retry payloads idempotently.
@@ -1311,6 +1563,11 @@ locals {
       "ANY /mcp/user-memory"                               = "mcp-user-memory"
       "ANY /mcp/context-engine"                            = "mcp-context-engine"
       "ANY /mcp/open-engine"                               = "mcp-open-engine"
+      # THINK-280 U8: scoped external capability search facade. The handler is
+      # inert unless CAPABILITY_EXTERNAL_SEARCH_ENABLED (gated on
+      # enable_capability_broker) is on — routing it while disabled returns an
+      # empty, no-data projection.
+      "ANY /mcp/capabilities" = "mcp-capability-search"
 
       # Brain v0 service-auth writeback.
       "POST /api/brain/agent-write"    = "brain-agent-write"
@@ -1419,11 +1676,18 @@ locals {
       # Slack workspace app ingress. These unauthenticated public endpoints
       # verify Slack signatures in handler code before any tenant work happens.
       "POST /slack/events"        = "slack-events"
-      "POST /slack/slash-command" = "slack-slash-command"
-      "POST /slack/interactivity" = "slack-interactivity"
       "GET /slack/oauth/install"  = "slack-oauth-install"
       "POST /slack/oauth/install" = "slack-oauth-install"
 
+      # Microsoft Teams install + account-link ingress. Like the Slack block
+      # above, these routes have no gateway authorizer: install/start and
+      # account-link/complete verify the Cognito JWT in-handler, and
+      # install/complete (the Microsoft admin-consent redirect) verifies the
+      # HMAC-signed install state in-handler before any tenant work happens.
+      "POST /msteams/install/start"         = "msteams-install-start"
+      "GET /msteams/install/complete"       = "msteams-install-complete"
+      "POST /msteams/account-link/complete" = "msteams-account-link-complete"
+
       # Memory
       "ANY /api/memory/{proxy+}" = "memory"
 
@@ -1740,6 +2004,25 @@ resource "aws_scheduler_schedule" "requester_memory_dreaming" {
 # the audit log.
 # ---------------------------------------------------------------------------
 
+# THINK-193 U3: memory_stage stall recovery — every 15 minutes, bounded batch.
+resource "aws_scheduler_schedule" "memory_stage_sweeper" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-memory-stage-sweeper"
+  group_name          = "default"
+  schedule_expression = "rate(15 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["memory-stage-sweeper"].arn
+    role_arn = aws_iam_role.scheduler.arn
+  }
+}
+
 resource "aws_scheduler_schedule" "mcp_approval_sweeper" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
@@ -2199,6 +2482,47 @@ resource "aws_scheduler_schedule" "stall_monitor" {
   }
 }
 
+# ---------------------------------------------------------------------------
+# Retry dispatcher — drains retry_queue rows the stall monitor enqueues and
+# re-runs genuinely stalled turns (THINK-307). First-ever scheduling of this
+# handler; state is var-driven and defaults DISABLED — never enable on a
+# stage before THINK-305/308/309 are live there (parent plan deploy ordering).
+# The 1-minute rate is fixed by design: the queue's own scheduled_at does the
+# pacing. Scheduler retries stay at 0 — the next 1-minute tick IS the retry.
+# ---------------------------------------------------------------------------
+
+# Lambda async retries are disabled (mirrors memory-retraction-drainer): the
+# claim is a CAS UPDATE so a duplicate invocation only picks up new rows, and
+# the next 1-minute tick is the retry.
+resource "aws_lambda_function_event_invoke_config" "retry_dispatcher" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["cron-retry-dispatcher"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
+resource "aws_scheduler_schedule" "retry_dispatcher" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-retry-dispatcher"
+  group_name          = "default"
+  schedule_expression = "rate(1 minutes)"
+  state               = var.retry_dispatcher_enabled ? "ENABLED" : "DISABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["cron-retry-dispatcher"].arn
+    role_arn = aws_iam_role.scheduler.arn
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 
 # ---------------------------------------------------------------------------
 # Compounding Memory — nightly hygiene + export
@@ -2447,6 +2771,27 @@ resource "aws_s3_bucket_lifecycle_configuration" "brain_artifacts" {
     }
   }
 
+  # THINK-193 U1 (Codex F6): normalized evidence snapshots are short-lived
+  # working copies — the durable record is the evidence row (hash + ref) and
+  # the Hindsight projection. Expire content after 30 days; the app mirrors
+  # this via memory_evidence_items.snapshot_expires_at.
+  rule {
+    id     = "expire-evidence-snapshots"
+    status = "Enabled"
+
+    filter {
+      prefix = "evidence-snapshots/"
+    }
+
+    expiration {
+      days = 30
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 30
+    }
+  }
+
   rule {
     id     = "exports-expiration"
     status = "Enabled"