thinkwork-cli 0.12.17 → 0.13.1

package/dist/drizzle/0260_scheduled_jobs_run_as_user.sql

@@ -0,0 +1,20 @@
+-- THINK-302 U7 (R28/KTD-14): run-as identity for wakeup/scheduled turns.
+--
+-- The user a scheduled/wakeup turn runs AS, so it composes that user's +
+-- the run-in-space's capability scopes. A job with no run_as_user_id
+-- compiles root + sub-agent only — it NEVER inherits the creator's grants.
+-- Set/cleared only through an authorized surface (KTD-14 save-time authz);
+-- dispatch-time revalidation drops stale grants.
+--
+-- Additive, idempotent nullable-FK column add (ON DELETE SET NULL so a
+-- deactivated user's jobs degrade to root-only rather than break).
+-- Hand-rolled only to carry the drift-gate marker; db:push would also add it.
+--
+-- Apply manually:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f drizzle/0260_scheduled_jobs_run_as_user.sql
+-- creates-column: public.scheduled_jobs.run_as_user_id
+
+\set ON_ERROR_STOP on
+
+ALTER TABLE public.scheduled_jobs
+  ADD COLUMN IF NOT EXISTS run_as_user_id uuid REFERENCES public.users(id) ON DELETE SET NULL;

package/dist/drizzle/0261_thread_turns_origin_turn_index.sql

@@ -0,0 +1,11 @@
+-- THINK-307 KTD4: the retry dispatcher's successor-turn guard, THINK-308's
+-- finalize reconciliation, and THINK-309's recovery resolver all look up
+-- thread_turns by origin_turn_id; no index covers that column today.
+-- Additive — safe to apply ahead of code deploy.
+--
+-- Hand-rolled (drizzle meta journal is not in use for this change);
+-- apply with: psql "$DATABASE_URL" -f drizzle/0261_thread_turns_origin_turn_index.sql
+-- creates: public.idx_thread_turns_origin_turn
+
+CREATE INDEX IF NOT EXISTS idx_thread_turns_origin_turn
+  ON public.thread_turns (origin_turn_id);

package/dist/terraform/examples/greenfield/main.tf

@@ -105,6 +105,18 @@ variable "enable_hindsight" {
   default     = true
 }
 
+variable "enable_capability_broker" {
+  description = "THINK-280 governed capability runtime. When true, brings up the capability broker (PoP session table, private REST API, dedicated execute-api VPCE with private DNS off, no-NAT interpreter SG) and enables capability-private interpreter provisioning. Default false — currently flipped on only for the dev dogfood via deploy.yml."
+  type        = bool
+  default     = false
+}
+
+variable "analyst_lambda_vpc_egress" {
+  description = "VPC-attach the analyst data-path Lambdas so their egress rides the NAT gateway's stable EIP — required when an external analyst data source sits behind an IP allowlist. See the thinkwork module's analyst_egress_ip output for the IP to allowlist."
+  type        = bool
+  default     = false
+}
+
 variable "memory_engine" {
   description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments."
   type        = string
@@ -416,6 +428,18 @@ variable "brain_dream_state_enabled" {
   default     = false
 }
 
+variable "retry_dispatcher_enabled" {
+  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there; manual invokes work regardless."
+  type        = bool
+  default     = false
+}
+
+variable "stall_threshold_minutes" {
+  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307)."
+  type        = number
+  default     = 5
+}
+
 variable "requester_memory_dreaming_model_id" {
   description = "Bedrock Converse model id for requester memory REM reflection."
   type        = string
@@ -460,6 +484,12 @@ variable "analyst_policy_source" {
   }
 }
 
+variable "capability_self_extension_tenants" {
+  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed."
+  type        = string
+  default     = ""
+}
+
 variable "wiki_aggregation_pass_enabled" {
   description = <<-EOT
     Feature flag for the wiki aggregation pass — the second LLM call
@@ -749,6 +779,8 @@ module "thinkwork" {
   db_password                       = var.db_password
   database_engine                   = var.database_engine
   enable_hindsight                  = var.enable_hindsight
+  enable_capability_broker          = var.enable_capability_broker
+  analyst_lambda_vpc_egress         = var.analyst_lambda_vpc_egress
   hindsight_database_name           = var.hindsight_database_name
   memory_engine                     = var.memory_engine
   twenty_provisioned                = var.twenty_provisioned
@@ -831,6 +863,7 @@ module "thinkwork" {
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
   analyst_policy_source                         = var.analyst_policy_source
+  capability_self_extension_tenants             = var.capability_self_extension_tenants
   knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
   google_places_api_key                         = var.google_places_api_key
@@ -838,6 +871,8 @@ module "thinkwork" {
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
   brain_dream_state_enabled                     = var.brain_dream_state_enabled
+  retry_dispatcher_enabled                      = var.retry_dispatcher_enabled
+  stall_threshold_minutes                       = var.stall_threshold_minutes
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
   agentcore_memory_id                           = var.agentcore_memory_id
@@ -1316,3 +1351,8 @@ output "customer_domain_name_servers" {
   description = "The four Route53 name servers for the customer-domain zone — publish these via the claim tool's `claim --set-targets` to delegate (empty when no customer domain is configured)."
   value       = module.thinkwork.customer_domain_name_servers
 }
+
+output "analyst_egress_ip" {
+  description = "Stable NAT egress IP of the VPC-attached analyst data-path Lambdas (null unless analyst_lambda_vpc_egress is set)"
+  value       = module.thinkwork.analyst_egress_ip
+}

package/dist/terraform/modules/app/agentcore-admin/main.tf

@@ -0,0 +1,341 @@
+################################################################################
+# AgentCore Admin — App Module (stage-level)
+#
+# The `agentcore-admin` Lambda is the control-plane worker that regular sandbox
+# provisioning depends on: `createTenant` (packages/api) RequestResponse-invokes
+# it to create per-tenant IAM roles + AgentCore Code Interpreters, and it also
+# serves SSM permission-profile CRUD + CloudWatch audit queries. The handler
+# lives at packages/lambda/agentcore-admin.ts and is bundled by
+# scripts/build-lambdas.sh into dist/lambdas/agentcore-admin.zip.
+#
+# Historically this Lambda was built but instantiated NOWHERE — so sandbox
+# provisioning would fail closed at runtime (AGENTCORE_ADMIN_LAMBDA_ARN unset).
+# This module deploys it. It is intentionally a SEPARATE module with a DEDICATED
+# least-privilege role: the handler holds a dangerous control-plane surface
+# (iam:CreateRole, bedrock-agentcore CreateCodeInterpreter) that must never leak
+# onto the ~90-handler shared lambda-api role.
+#
+# THINK-280 capability-private wiring: CAPABILITY_PRIVATE_SUBNET_IDS /
+# CAPABILITY_PRIVATE_SECURITY_GROUP_IDS come from the capability-broker outputs
+# (via the agentcore-code-interpreter module). Both are EMPTY when the broker is
+# disabled (var.enable_capability_broker=false, the default) — the handler then
+# skips capability-private provisioning entirely (capabilityPrivateProvisioning
+# Enabled() returns false). The module therefore ships INERT for the
+# capability-private path while still fixing the regular-provisioning gap.
+################################################################################
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.0"
+    }
+  }
+}
+
+variable "stage" {
+  description = "Deployment stage (dev, prod, etc.)."
+  type        = string
+}
+
+variable "region" {
+  description = "AWS region."
+  type        = string
+}
+
+variable "account_id" {
+  description = "AWS account ID (used to construct IAM resource ARNs)."
+  type        = string
+}
+
+# ---- Lambda artifact sources (mirror lambda-api/remote-artifacts.tf) ----------
+variable "lambda_zips_dir" {
+  description = "Local directory of built Lambda zips (source-checkout deploys). Mutually exclusive with lambda_artifact_bucket."
+  type        = string
+  default     = ""
+}
+
+variable "lambda_artifact_bucket" {
+  description = "S3 bucket holding release Lambda zips (enterprise deploys). Mutually exclusive with lambda_zips_dir."
+  type        = string
+  default     = ""
+}
+
+variable "lambda_artifact_prefix" {
+  description = "S3 key prefix for release Lambda zips."
+  type        = string
+  default     = ""
+}
+
+# ---- Database (handler reads the tenants table via getDb() → DATABASE_URL) -----
+variable "db_username" {
+  description = "Database username (used to construct DATABASE_URL)."
+  type        = string
+  default     = "thinkwork_admin"
+}
+
+variable "db_password" {
+  description = "Database password (used to construct DATABASE_URL)."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "db_cluster_endpoint" {
+  description = "Aurora cluster writer endpoint."
+  type        = string
+}
+
+variable "database_name" {
+  description = "Database name."
+  type        = string
+}
+
+variable "graphql_db_secret_arn" {
+  description = "ARN of the writer DB credentials secret (granted GetSecretValue so db.ts's secret fallback works)."
+  type        = string
+}
+
+# ---- Capability-private interpreter VPC placement (THINK-280 U4) ---------------
+# Empty when the capability broker is disabled → handler skips capability-private
+# provisioning. Sourced from the broker outputs via the code-interpreter module.
+variable "capability_private_subnet_ids" {
+  description = "No-NAT subnets for the capability-private VPC-mode interpreter. Empty when the broker is disabled."
+  type        = list(string)
+  default     = []
+}
+
+variable "capability_private_security_group_ids" {
+  description = "Egress-only SGs for the capability-private interpreter. Empty when the broker is disabled."
+  type        = list(string)
+  default     = []
+}
+
+################################################################################
+# Artifact-source gating — identical semantics to lambda-api/remote-artifacts.tf.
+# Exactly one source (local zips OR remote S3) must be set, else the Lambda is
+# not deployed (scaffolded installs with no artifacts).
+################################################################################
+
+locals {
+  use_local_zips              = trimspace(var.lambda_zips_dir) != ""
+  use_remote_lambda_artifacts = trimspace(var.lambda_artifact_bucket) != ""
+  lambda_artifact_prefix      = trim(trimspace(var.lambda_artifact_prefix), "/")
+  artifact_source_count       = (local.use_local_zips ? 1 : 0) + (local.use_remote_lambda_artifacts ? 1 : 0)
+  deploy                      = local.artifact_source_count == 1
+
+  function_name = "thinkwork-${var.stage}-api-agentcore-admin"
+
+  # DATABASE_URL built exactly as lambda-api's common_env does so getDb()
+  # resolves identically. sslmode=no-verify matches the shared pool (Aurora is
+  # reachable over TLS without a bundled CA in this stack).
+  database_url = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
+}
+
+################################################################################
+# Admin bearer token — random_password → Secrets Manager. The token value is
+# ALSO injected as the Lambda's AGENTCORE_ADMIN_TOKEN env (the handler compares
+# the Bearer header against process.env directly), and handed to graphql-http so
+# its invoke carries the matching credential. The secret is the durable record
+# of truth for operators / rotation.
+################################################################################
+
+resource "random_password" "admin_token" {
+  count = local.deploy ? 1 : 0
+  # 48 chars, alphanumeric only — safe inside an `Authorization: Bearer` header.
+  length  = 48
+  special = false
+}
+
+resource "aws_secretsmanager_secret" "admin_token" {
+  count       = local.deploy ? 1 : 0
+  name        = "thinkwork/${var.stage}/agentcore-admin-token"
+  description = "Bearer token the agentcore-admin Lambda validates; graphql-http presents it on RequestResponse invokes."
+
+  tags = {
+    Name    = "thinkwork-${var.stage}-agentcore-admin-token"
+    Stage   = var.stage
+    Purpose = "agentcore-admin-bearer-token"
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "admin_token" {
+  count         = local.deploy ? 1 : 0
+  secret_id     = aws_secretsmanager_secret.admin_token[0].id
+  secret_string = random_password.admin_token[0].result
+}
+
+################################################################################
+# IAM role — DEDICATED, least-privilege. Scoped tightly to the handler's actual
+# AWS SDK calls (see packages/lambda/agentcore-admin.ts).
+################################################################################
+
+resource "aws_iam_role" "admin" {
+  count = local.deploy ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-admin"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = {
+    Name    = "thinkwork-${var.stage}-agentcore-admin"
+    Stage   = var.stage
+    Purpose = "agentcore-admin-execution-role"
+  }
+}
+
+resource "aws_iam_role_policy" "admin" {
+  count = local.deploy ? 1 : 0
+  name  = "agentcore-admin"
+  role  = aws_iam_role.admin[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      # --- Lambda's own log group (basic execution) ---
+      {
+        Sid    = "LambdaOwnLogs"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+        ]
+        Resource = "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/lambda/${local.function_name}:*"
+      },
+      # --- CloudWatch audit query (queryAuditLogs) ---
+      {
+        Sid      = "AuditLogQuery"
+        Effect   = "Allow"
+        Action   = ["logs:FilterLogEvents"]
+        Resource = "arn:aws:logs:${var.region}:${var.account_id}:log-group:/thinkwork/${var.stage}/agentcore/agents:*"
+      },
+      # --- SSM permission-profile CRUD (getPermissions / putPermissions) ---
+      {
+        Sid    = "SsmPermissionProfiles"
+        Effect = "Allow"
+        Action = [
+          "ssm:GetParameter",
+          "ssm:PutParameter",
+        ]
+        Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/*"
+      },
+      # --- Per-tenant sandbox IAM roles (provision / deprovision) ---
+      # Two name prefixes: computeRoleName → sandbox-tenant-*, and the U4
+      # capability-private role → cappriv-tenant-*.
+      {
+        Sid    = "SandboxRoleLifecycle"
+        Effect = "Allow"
+        Action = [
+          "iam:CreateRole",
+          "iam:DeleteRole",
+          "iam:GetRole",
+          "iam:PutRolePolicy",
+          "iam:DeleteRolePolicy",
+          "iam:TagRole",
+        ]
+        Resource = [
+          "arn:aws:iam::${var.account_id}:role/thinkwork-${var.stage}-sandbox-*",
+          "arn:aws:iam::${var.account_id}:role/thinkwork-${var.stage}-cappriv-*",
+        ]
+      },
+      # --- PassRole the sandbox roles to AgentCore (CreateCodeInterpreter) ---
+      {
+        Sid    = "PassSandboxRolesToAgentCore"
+        Effect = "Allow"
+        Action = ["iam:PassRole"]
+        Resource = [
+          "arn:aws:iam::${var.account_id}:role/thinkwork-${var.stage}-sandbox-*",
+          "arn:aws:iam::${var.account_id}:role/thinkwork-${var.stage}-cappriv-*",
+        ]
+        Condition = {
+          StringEquals = {
+            "iam:PassedToService" = "bedrock-agentcore.amazonaws.com"
+          }
+        }
+      },
+      # --- AgentCore Code Interpreter control plane ---
+      # List/Create/Delete are account-scoped operations without a stable
+      # per-resource ARN at plan time; the SDK client is the control plane.
+      {
+        Sid    = "CodeInterpreterControlPlane"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:CreateCodeInterpreter",
+          "bedrock-agentcore:DeleteCodeInterpreter",
+          "bedrock-agentcore:ListCodeInterpreters",
+          "bedrock-agentcore:GetCodeInterpreter",
+          # CreateCodeInterpreter passes inline `tags`, which AgentCore
+          # authorizes as a separate bedrock-agentcore:TagResource action on
+          # code-interpreter-custom/* — verified empirically (first provision
+          # returned AccessDenied on TagResource). UntagResource covers teardown.
+          "bedrock-agentcore:TagResource",
+          "bedrock-agentcore:UntagResource",
+        ]
+        Resource = "*"
+      },
+      # --- Secrets: DB credentials (db.ts secret fallback) + own admin token ---
+      {
+        Sid    = "SecretsRead"
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [
+          var.graphql_db_secret_arn,
+          aws_secretsmanager_secret.admin_token[0].arn,
+        ]
+      },
+    ]
+  })
+}
+
+################################################################################
+# Lambda function
+################################################################################
+
+resource "aws_lambda_function" "admin" {
+  count = local.deploy ? 1 : 0
+
+  function_name = local.function_name
+  role          = aws_iam_role.admin[0].arn
+  handler       = "index.handler"
+  runtime       = "nodejs20.x"
+  timeout       = 60
+  memory_size   = 256
+
+  filename         = local.use_local_zips ? "${var.lambda_zips_dir}/agentcore-admin.zip" : null
+  source_code_hash = local.use_local_zips ? filebase64sha256("${var.lambda_zips_dir}/agentcore-admin.zip") : null
+  s3_bucket        = local.use_remote_lambda_artifacts ? var.lambda_artifact_bucket : null
+  s3_key           = local.use_remote_lambda_artifacts ? "${local.lambda_artifact_prefix}/agentcore-admin.zip" : null
+
+  environment {
+    variables = {
+      STAGE          = var.stage
+      AWS_ACCOUNT_ID = var.account_id
+      NODE_OPTIONS   = "--enable-source-maps"
+      DATABASE_URL   = local.database_url
+      # Bearer token the handler validates. Secret env is the sanctioned home
+      # for secrets in this stack (never the SSM runtime-config String doc).
+      AGENTCORE_ADMIN_TOKEN = random_password.admin_token[0].result
+      # THINK-280 U4 — capability-private interpreter VPC placement. EMPTY when
+      # the broker is disabled → the handler skips capability-private entirely.
+      CAPABILITY_PRIVATE_SUBNET_IDS         = join(",", var.capability_private_subnet_ids)
+      CAPABILITY_PRIVATE_SECURITY_GROUP_IDS = join(",", var.capability_private_security_group_ids)
+    }
+  }
+
+  tags = {
+    Name    = local.function_name
+    Stage   = var.stage
+    Purpose = "agentcore-admin"
+  }
+}

package/dist/terraform/modules/app/agentcore-admin/outputs.tf

@@ -0,0 +1,20 @@
+output "lambda_arn" {
+  description = "ARN of the agentcore-admin Lambda (AGENTCORE_ADMIN_LAMBDA_ARN for graphql-http). Empty when not deployed."
+  value       = local.deploy ? aws_lambda_function.admin[0].arn : ""
+}
+
+output "lambda_function_name" {
+  description = "Function name of the agentcore-admin Lambda. Empty when not deployed."
+  value       = local.deploy ? aws_lambda_function.admin[0].function_name : ""
+}
+
+output "admin_token" {
+  description = "Bearer token graphql-http presents on invoke (AGENTCORE_ADMIN_TOKEN). Empty when not deployed."
+  value       = local.deploy ? random_password.admin_token[0].result : ""
+  sensitive   = true
+}
+
+output "admin_token_secret_arn" {
+  description = "ARN of the Secrets Manager secret holding the admin bearer token. Empty when not deployed."
+  value       = local.deploy ? aws_secretsmanager_secret.admin_token[0].arn : ""
+}

package/dist/terraform/modules/app/agentcore-code-interpreter/main.tf

@@ -50,6 +50,23 @@ variable "image_retention_count" {
   default     = 10
 }
 
+# THINK-280 U4 — VPC placement for the capability-private interpreter. Sourced
+# (when the capability broker is enabled) from the broker module's no-NAT
+# interpreter subnets + dedicated egress-only SG. Empty by default: the
+# agentcore-admin Lambda skips capability-private provisioning entirely when
+# either list is empty, so the module stays inert with the broker disabled.
+variable "capability_private_subnet_ids" {
+  description = "No-NAT private subnets the capability-private VPC-mode interpreter attaches to. Empty when the broker is disabled."
+  type        = list(string)
+  default     = []
+}
+
+variable "capability_private_security_group_ids" {
+  description = "Egress-only security groups (reach only the broker execute-api VPCE) for the capability-private interpreter. Empty when the broker is disabled."
+  type        = list(string)
+  default     = []
+}
+
 # Environment catalog. Kept as a locals block (not a variable) because v1
 # semantics are fixed in the plan — extending requires a reviewable PR,
 # not a tfvars tweak.
@@ -63,6 +80,14 @@ locals {
       description  = "S3 + DNS + AWS service endpoints only; no public egress."
       network_mode = "SANDBOX"
     }
+    # THINK-280 U4: VPC-mode interpreter, no NAT. Reaches ONLY the capability
+    # broker's private execute-api VPCE (+ DNS). Runtime-selected per invocation
+    # (not a template-level opt-in), and only provisioned when the broker is
+    # enabled — the agentcore-admin Lambda gates on the VPC subnet/SG env vars.
+    "capability-private" = {
+      description  = "VPC-mode, no NAT; reaches only the capability broker execute-api VPCE."
+      network_mode = "VPC"
+    }
   }
 }
 
@@ -155,6 +180,27 @@ locals {
       },
     ]
   })
+
+  # THINK-280 U4: SEPARATE restricted inline policy for the capability-private
+  # VPC-mode interpreter role. It deliberately LACKS the tenant sandbox Secrets
+  # Manager wildcard (SandboxSecretsRead above), tenant S3, and any database /
+  # provider access — the private interpreter reaches providers only through the
+  # broker's PoP session (AE5). Logs are the only genuine boot requirement.
+  # Consumed by the agentcore-admin Lambda for the capability-private role.
+  capability_private_role_inline_policy_template = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "CapabilityPrivateCloudWatchLogs"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+        ]
+        Resource = "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*"
+      },
+    ]
+  })
 }
 
 ################################################################################
@@ -191,6 +237,21 @@ output "tenant_role_inline_policy_template" {
   value       = local.tenant_role_inline_policy_template
 }
 
+output "capability_private_role_inline_policy_template" {
+  description = "THINK-280 U4: JSON inline-policy for the capability-private interpreter role. Logs-only; NO Secrets Manager / S3 / DB access."
+  value       = local.capability_private_role_inline_policy_template
+}
+
+output "capability_private_subnet_ids" {
+  description = "No-NAT subnets the capability-private interpreter attaches to (CAPABILITY_PRIVATE_SUBNET_IDS). Empty when the broker is disabled."
+  value       = var.capability_private_subnet_ids
+}
+
+output "capability_private_security_group_ids" {
+  description = "Egress-only SGs for the capability-private interpreter (CAPABILITY_PRIVATE_SECURITY_GROUP_IDS). Empty when the broker is disabled."
+  value       = var.capability_private_security_group_ids
+}
+
 output "stage" {
   description = "Echo of the stage variable (convenience for downstream modules)."
   value       = var.stage

package/dist/terraform/modules/app/agentcore-harness/main.tf

@@ -0,0 +1,101 @@
+################################################################################
+# AgentCore Harness — App Module (THINK-311 U4, ship-inert)
+#
+# IAM surface for the AWS Bedrock AgentCore Harness trial: the execution role
+# Harness microVMs assume, plus (via outputs consumed by lambda-api's grouped
+# policies) the invoker grants the shared api Lambda role needs to create and
+# invoke Harness resources. Nothing reads or invokes any of this until the
+# harness-runner handler lands in U5 — this module is pure IAM.
+#
+# Trust-policy note: sibling agentcore roles (agentcore-pi, agentcore-runtime)
+# trust the bare `bedrock-agentcore.amazonaws.com` service principal with no
+# account/source-arn conditions; this role mirrors that repo pattern.
+################################################################################
+
+################################################################################
+# Harness execution role — assumed by Harness microVMs
+################################################################################
+
+resource "aws_iam_role" "harness_execution" {
+  count = var.enabled ? 1 : 0
+
+  name = "thinkwork-${var.stage}-agentcore-harness-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "bedrock-agentcore.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = {
+    Name = "thinkwork-${var.stage}-agentcore-harness-role"
+  }
+}
+
+resource "aws_iam_role_policy" "harness_execution" {
+  count = var.enabled ? 1 : 0
+
+  name = "agentcore-harness-permissions"
+  role = aws_iam_role.harness_execution[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        # Cross-region inference profiles (us.anthropic.claude-*) require
+        # `bedrock:InvokeModel` on the *inference-profile* ARN AND on the
+        # underlying foundation-model ARN in every region the profile can
+        # route to — same resource list the api Lambda's grouped ai policy
+        # uses (see ../lambda-api/iam-grouped.tf "bedrock-invoke").
+        Sid    = "BedrockInvoke"
+        Effect = "Allow"
+        Action = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
+        Resource = [
+          "arn:aws:bedrock:*::foundation-model/*",
+          "arn:aws:bedrock:*:${var.account_id}:inference-profile/*",
+        ]
+      },
+      {
+        # Tenant skill catalog sources + materialized workspace skill folders
+        # live under tenants/* in the stage workspace bucket. Read-only —
+        # Harness microVMs never write back to the workspace bucket.
+        Sid      = "WorkspaceSkillSourcesRead"
+        Effect   = "Allow"
+        Action   = ["s3:GetObject"]
+        Resource = "arn:aws:s3:::${var.bucket_name}/tenants/*"
+      },
+      {
+        Sid      = "WorkspaceSkillSourcesList"
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = "arn:aws:s3:::${var.bucket_name}"
+        Condition = {
+          StringLike = {
+            "s3:prefix" = "tenants/*"
+          }
+        }
+      },
+      {
+        # Harness containers log to the service-managed bedrock-agentcore
+        # log-group namespace, mirroring the agentcore-pi role's runtimes
+        # grant.
+        Sid    = "CloudWatchLogs"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:DescribeLogGroups",
+          "logs:DescribeLogStreams",
+          "logs:PutLogEvents",
+        ]
+        Resource = [
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/*",
+          "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/bedrock-agentcore/*:*",
+        ]
+      },
+    ]
+  })
+}

package/dist/terraform/modules/app/agentcore-harness/outputs.tf

@@ -0,0 +1,9 @@
+output "execution_role_arn" {
+  description = "ARN of the Harness execution role (CreateHarness executionRoleArn). Empty string when the module is disabled."
+  value       = var.enabled ? aws_iam_role.harness_execution[0].arn : ""
+}
+
+output "execution_role_name" {
+  description = "Name of the Harness execution role. Empty string when the module is disabled."
+  value       = var.enabled ? aws_iam_role.harness_execution[0].name : ""
+}