thinkwork-cli 0.13.0 → 0.13.1

package/dist/terraform/modules/app/agentcore-harness/variables.tf

@@ -0,0 +1,25 @@
+variable "enabled" {
+  description = "Create the AgentCore Harness trial IAM surface (THINK-311 U4). Pure-IAM and inert — nothing invokes Harness until U5 — so it defaults on; flip off to remove the role without touching root variables."
+  type        = bool
+  default     = true
+}
+
+variable "stage" {
+  description = "Deployment stage (dev, prod, etc.)"
+  type        = string
+}
+
+variable "region" {
+  description = "AWS region"
+  type        = string
+}
+
+variable "account_id" {
+  description = "AWS account ID"
+  type        = string
+}
+
+variable "bucket_name" {
+  description = "Stage workspace S3 bucket name — Harness microVMs read tenant skill sources under tenants/*"
+  type        = string
+}

package/dist/terraform/modules/app/agentcore-pi/main.tf

@@ -26,6 +26,11 @@ locals {
   chat_agent_activity_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_activity_fn_name}"
   manifest_log_fn_name        = "thinkwork-${var.stage}-api-manifest-log"
   manifest_log_fn_arn         = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.manifest_log_fn_name}"
+  # THINK-280 U2 — capability control plane service (capability_search /
+  # connection_research Pi tools). Direct InvokeCommand, RequestResponse;
+  # no HTTP route exists for this Lambda.
+  capability_control_fn_name = "thinkwork-${var.stage}-api-capability-control-service"
+  capability_control_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.capability_control_fn_name}"
   # Release-backed deployments use an immutable, source-derived target tag so
   # changing the release image also changes aws_lambda_function.image_uri.
   # Reusing pi-latest lets Terraform miss the update even after ECR is retagged.
@@ -259,6 +264,7 @@ resource "aws_iam_role_policy" "agentcore_pi" {
           local.chat_agent_finalize_fn_arn,
           local.chat_agent_activity_fn_arn,
           local.manifest_log_fn_arn,
+          local.capability_control_fn_arn,
         ]
       },
       {
@@ -384,6 +390,7 @@ resource "aws_lambda_function" "agentcore_pi" {
       CHAT_AGENT_FINALIZE_FN_NAME            = local.chat_agent_finalize_fn_name
       CHAT_AGENT_ACTIVITY_FN_NAME            = local.chat_agent_activity_fn_name
       MANIFEST_LOG_FUNCTION_NAME             = local.manifest_log_fn_name
+      CAPABILITY_CONTROL_FN_NAME             = local.capability_control_fn_name
       HINDSIGHT_ENDPOINT                     = var.hindsight_endpoint
       # THINK-220 cutover flag — see the variable description.
       HINDSIGHT_DATABASE_NAME = var.hindsight_database_name

package/dist/terraform/modules/app/capability-broker/main.tf

@@ -0,0 +1,393 @@
+# Capability Broker (THINK-280 U3) — action-time policy, replay-safe PoP
+# sessions, and evidence for the governed capability runtime.
+#
+# SHIP-INERT: gated by var.enabled (default false). Nothing here is created
+# until U4 flips it on after the live negative-egress proof. The Lambda code
+# itself also fails closed — its default authorization loader denies every
+# call — so even an accidental enable dispatches no provider operation.
+#
+# THINK-144: this module owns a DEDICATED execute-api interface VPC endpoint
+# with private DNS DISABLED. It is never added to the app VPC's shared
+# okf_wiki_interface_endpoint_services list — that list's private DNS would
+# capture every *.execute-api call in the VPC and 403 the stack's public HTTP
+# APIs. The session bootstrap targets this endpoint's own DNS name instead.
+
+locals {
+  enabled       = var.enabled
+  count_enabled = var.enabled ? 1 : 0
+
+  name_prefix           = "thinkwork-${var.stage}-capability-broker"
+  session_table_name    = "thinkwork-${var.stage}-capability-broker-sessions"
+  broker_audience       = "thinkwork-${var.stage}-capability-broker"
+  use_local_zips        = var.lambda_zips_dir != ""
+  use_remote_artifacts  = trimspace(var.lambda_artifact_bucket) != ""
+  broker_zip_local      = "${var.lambda_zips_dir}/capability-broker.zip"
+  broker_artifact_s3key = "${var.lambda_artifact_prefix}/capability-broker.zip"
+}
+
+# --- Replay-safe session state (DynamoDB, conditional writes + TTL) ----------
+
+resource "aws_dynamodb_table" "sessions" {
+  count = local.count_enabled
+
+  name         = local.session_table_name
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "pk"
+  range_key    = "sk"
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+  attribute {
+    name = "sk"
+    type = "S"
+  }
+
+  # Session + nonce records self-expire at session TTL (≤15 min). Epoch seconds.
+  ttl {
+    attribute_name = "ttl"
+    enabled        = true
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  tags = {
+    Name    = local.session_table_name
+    Purpose = "capability-broker-sessions"
+  }
+}
+
+# --- Broker Lambda execution role -------------------------------------------
+
+data "aws_iam_policy_document" "broker_assume" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["lambda.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "broker" {
+  count              = local.count_enabled
+  name               = "${local.name_prefix}-role"
+  assume_role_policy = data.aws_iam_policy_document.broker_assume.json
+}
+
+data "aws_iam_policy_document" "broker_policy" {
+  count = local.count_enabled
+
+  # Session state: conditional reads/writes only, scoped to the one table.
+  statement {
+    sid = "SessionState"
+    actions = [
+      "dynamodb:GetItem",
+      "dynamodb:PutItem",
+      "dynamodb:UpdateItem",
+      "dynamodb:DeleteItem",
+      "dynamodb:Query",
+    ]
+    resources = [aws_dynamodb_table.sessions[0].arn]
+  }
+
+  # Evidence: append capability_broker_calls rows via the RDS Data API on the
+  # existing Aurora cluster (same credential-rotation surface as graphql-http).
+  dynamic "statement" {
+    for_each = var.db_cluster_arn != "" ? [1] : []
+    content {
+      sid       = "EvidenceDataApi"
+      actions   = ["rds-data:ExecuteStatement", "rds-data:BatchExecuteStatement"]
+      resources = [var.db_cluster_arn]
+    }
+  }
+
+  dynamic "statement" {
+    for_each = var.db_secret_arn != "" ? [1] : []
+    content {
+      sid       = "EvidenceDbSecret"
+      actions   = ["secretsmanager:GetSecretValue"]
+      resources = [var.db_secret_arn]
+    }
+  }
+
+  # VPC ENI management for the in-VPC Lambda.
+  statement {
+    sid = "VpcEni"
+    actions = [
+      "ec2:CreateNetworkInterface",
+      "ec2:DescribeNetworkInterfaces",
+      "ec2:DeleteNetworkInterface",
+      "ec2:AssignPrivateIpAddresses",
+      "ec2:UnassignPrivateIpAddresses",
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    sid       = "Logs"
+    actions   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
+    resources = ["arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws/lambda/${local.name_prefix}*"]
+  }
+
+  statement {
+    sid       = "Xray"
+    actions   = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "broker" {
+  count  = local.count_enabled
+  name   = "${local.name_prefix}-policy"
+  role   = aws_iam_role.broker[0].id
+  policy = data.aws_iam_policy_document.broker_policy[0].json
+}
+
+# --- Broker Lambda security group (egress only) ------------------------------
+
+resource "aws_security_group" "broker_lambda" {
+  count       = local.count_enabled
+  name        = "${local.name_prefix}-lambda"
+  description = "Capability broker Lambda egress"
+  vpc_id      = var.vpc_id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Egress to Aurora Data API, DynamoDB, Secrets Manager, provider endpoints"
+  }
+
+  tags = { Name = "${local.name_prefix}-lambda" }
+}
+
+resource "aws_cloudwatch_log_group" "broker" {
+  count             = local.count_enabled
+  name              = "/aws/lambda/${local.name_prefix}"
+  retention_in_days = var.log_retention_days
+}
+
+resource "aws_lambda_function" "broker" {
+  count         = local.count_enabled
+  function_name = local.name_prefix
+  role          = aws_iam_role.broker[0].arn
+  runtime       = var.lambda_runtime
+  handler       = "index.handler"
+  timeout       = 30
+  memory_size   = 512
+
+  filename         = local.use_local_zips ? local.broker_zip_local : null
+  source_code_hash = local.use_local_zips ? filebase64sha256(local.broker_zip_local) : null
+  s3_bucket        = local.use_remote_artifacts ? var.lambda_artifact_bucket : null
+  s3_key           = local.use_remote_artifacts ? local.broker_artifact_s3key : null
+
+  vpc_config {
+    subnet_ids         = var.subnet_ids
+    security_group_ids = [aws_security_group.broker_lambda[0].id]
+  }
+
+  environment {
+    variables = {
+      CAPABILITY_BROKER_SESSION_TABLE = aws_dynamodb_table.sessions[0].name
+      CAPABILITY_BROKER_AUDIENCE      = local.broker_audience
+      # getDb() (@thinkwork/database-pg) MUST get DATABASE_URL, not just
+      # DATABASE_SECRET_ARN: the secret-only path returns an async Proxy whose
+      # `db.select()` resolves to a Promise, which breaks Drizzle's fluent
+      # `.select().from().where()` chaining (`.from is not a function`) — the
+      # cause of the loader's `authorization reload failed`. DATABASE_URL takes
+      # the synchronous pool path, matching every api handler's common_env.
+      DATABASE_URL        = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
+      DATABASE_SECRET_ARN = var.db_secret_arn
+      DATABASE_HOST       = var.db_cluster_endpoint
+    }
+  }
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  depends_on = [aws_cloudwatch_log_group.broker]
+}
+
+# --- Private REST API Gateway fronting the broker ----------------------------
+#
+# PRIVATE endpoint: reachable ONLY through the dedicated execute-api VPCE below.
+# The resource policy denies anything not arriving via that endpoint.
+
+resource "aws_api_gateway_rest_api" "broker" {
+  count = local.count_enabled
+  name  = local.name_prefix
+
+  endpoint_configuration {
+    types            = ["PRIVATE"]
+    vpc_endpoint_ids = [aws_vpc_endpoint.broker_execute_api[0].id]
+  }
+
+  # Only traffic arriving through our own VPCE is allowed; everything else 403s.
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "execute-api:Invoke"
+        Resource  = "arn:aws:execute-api:${var.region}:${var.account_id}:*/*/*/*"
+        Condition = {
+          StringNotEquals = { "aws:SourceVpce" = aws_vpc_endpoint.broker_execute_api[0].id }
+        }
+      },
+      {
+        Effect    = "Allow"
+        Principal = "*"
+        Action    = "execute-api:Invoke"
+        Resource  = "arn:aws:execute-api:${var.region}:${var.account_id}:*/*/*/*"
+      },
+    ]
+  })
+}
+
+resource "aws_api_gateway_resource" "broker_proxy" {
+  count       = local.count_enabled
+  rest_api_id = aws_api_gateway_rest_api.broker[0].id
+  parent_id   = aws_api_gateway_rest_api.broker[0].root_resource_id
+  path_part   = "{proxy+}"
+}
+
+resource "aws_api_gateway_method" "broker_any" {
+  count         = local.count_enabled
+  rest_api_id   = aws_api_gateway_rest_api.broker[0].id
+  resource_id   = aws_api_gateway_resource.broker_proxy[0].id
+  http_method   = "ANY"
+  authorization = "NONE"
+}
+
+resource "aws_api_gateway_integration" "broker" {
+  count                   = local.count_enabled
+  rest_api_id             = aws_api_gateway_rest_api.broker[0].id
+  resource_id             = aws_api_gateway_resource.broker_proxy[0].id
+  http_method             = aws_api_gateway_method.broker_any[0].http_method
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  uri                     = aws_lambda_function.broker[0].invoke_arn
+}
+
+resource "aws_lambda_permission" "broker_apigw" {
+  count         = local.count_enabled
+  statement_id  = "AllowBrokerPrivateApiInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.broker[0].function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${aws_api_gateway_rest_api.broker[0].execution_arn}/*/*/*"
+}
+
+resource "aws_api_gateway_deployment" "broker" {
+  count       = local.count_enabled
+  rest_api_id = aws_api_gateway_rest_api.broker[0].id
+
+  triggers = {
+    redeploy = sha1(jsonencode([
+      aws_api_gateway_resource.broker_proxy[0].id,
+      aws_api_gateway_method.broker_any[0].id,
+      aws_api_gateway_integration.broker[0].id,
+      aws_api_gateway_rest_api.broker[0].policy,
+    ]))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+  depends_on = [aws_api_gateway_integration.broker]
+}
+
+resource "aws_api_gateway_stage" "broker" {
+  count         = local.count_enabled
+  rest_api_id   = aws_api_gateway_rest_api.broker[0].id
+  deployment_id = aws_api_gateway_deployment.broker[0].id
+  stage_name    = var.stage
+}
+
+# --- Dedicated execute-api VPC endpoint (PRIVATE DNS DISABLED — THINK-144) ----
+
+resource "aws_security_group" "broker_vpce" {
+  count       = local.count_enabled
+  name        = "${local.name_prefix}-vpce"
+  description = "Capability broker execute-api VPCE (broker Lambda + capability-private interpreter subnet only)"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = [var.vpc_cidr_block]
+    description = "HTTPS from in-VPC PoP callers (broker Lambda self-calls + U4 capability-private interpreter)"
+  }
+
+  tags = { Name = "${local.name_prefix}-vpce" }
+}
+
+resource "aws_vpc_endpoint" "broker_execute_api" {
+  count = local.count_enabled
+
+  vpc_id             = var.vpc_id
+  service_name       = "com.amazonaws.${var.region}.execute-api"
+  vpc_endpoint_type  = "Interface"
+  subnet_ids         = var.subnet_ids
+  security_group_ids = [aws_security_group.broker_vpce[0].id]
+
+  # CRITICAL (THINK-144): private DNS OFF. Callers target the endpoint-specific
+  # DNS name (surfaced as an output), never the regional execute-api domain, so
+  # this endpoint cannot capture the stack's public HTTP API traffic.
+  private_dns_enabled = false
+
+  tags = {
+    Name    = "${local.name_prefix}-execute-api-vpce"
+    Purpose = "capability-broker-private-ingress"
+  }
+}
+
+# --- Capability-private interpreter SG (no NAT; broker VPCE only) — U4 --------
+#
+# The U4 capability-private VPC-mode Code Interpreter attaches to var.subnet_ids
+# (the no-NAT private egress subnets) under THIS security group. Its ONLY egress
+# is 443 to the broker execute-api VPCE SG plus DNS to the VPC resolver — there
+# is no NAT and no 0.0.0.0/0 route, so direct GitHub / Secrets Manager / internet
+# access does not exist (AE5 negative-egress boundary). The broker_vpce ingress
+# above already admits 443 from the VPC CIDR, which covers these subnets.
+resource "aws_security_group" "capability_private_interpreter" {
+  count       = local.count_enabled
+  name        = "${local.name_prefix}-cappriv-interpreter"
+  description = "Capability-private Code Interpreter egress: broker execute-api VPCE + DNS only"
+  vpc_id      = var.vpc_id
+
+  # execute-api VPCE only (reach the private broker API).
+  egress {
+    from_port       = 443
+    to_port         = 443
+    protocol        = "tcp"
+    security_groups = [aws_security_group.broker_vpce[0].id]
+    description     = "HTTPS to the broker execute-api VPCE"
+  }
+
+  # DNS to the in-VPC resolver so the endpoint-specific VPCE hostname resolves.
+  egress {
+    from_port   = 53
+    to_port     = 53
+    protocol    = "udp"
+    cidr_blocks = [var.vpc_cidr_block]
+    description = "DNS (UDP) to the VPC resolver"
+  }
+  egress {
+    from_port   = 53
+    to_port     = 53
+    protocol    = "tcp"
+    cidr_blocks = [var.vpc_cidr_block]
+    description = "DNS (TCP) to the VPC resolver"
+  }
+
+  tags = { Name = "${local.name_prefix}-cappriv-interpreter" }
+}

package/dist/terraform/modules/app/capability-broker/outputs.tf

@@ -0,0 +1,54 @@
+# Consumed by the API-side broker-session opener to build the sandbox
+# SessionBootstrap. All null when the module is disabled (ship-inert).
+
+output "enabled" {
+  value = local.enabled
+}
+
+output "session_table_name" {
+  description = "DynamoDB session table (CAPABILITY_BROKER_SESSION_TABLE)."
+  value       = local.enabled ? aws_dynamodb_table.sessions[0].name : ""
+}
+
+output "session_table_arn" {
+  description = "ARN of the broker session table — granted to the lambda-api role so routine-exec-git can mint/advance PoP sessions. Empty when disabled."
+  value       = local.enabled ? aws_dynamodb_table.sessions[0].arn : ""
+}
+
+output "broker_audience" {
+  description = "Audience the PoP session signatures are bound to (CAPABILITY_BROKER_AUDIENCE)."
+  value       = local.enabled ? local.broker_audience : ""
+}
+
+output "private_api_id" {
+  description = "Private REST API id the sandbox targets through the VPCE (CAPABILITY_BROKER_API_ID)."
+  value       = local.enabled ? aws_api_gateway_rest_api.broker[0].id : ""
+}
+
+output "execute_api_vpce_id" {
+  value = local.enabled ? aws_vpc_endpoint.broker_execute_api[0].id : ""
+}
+
+output "execute_api_vpce_dns_name" {
+  description = "Endpoint-specific execute-api DNS name (private DNS is OFF). The session bootstrap uses this exact host — CAPABILITY_BROKER_VPCE_DNS."
+  value       = local.enabled ? tolist(aws_vpc_endpoint.broker_execute_api[0].dns_entry)[0].dns_name : ""
+}
+
+output "broker_function_name" {
+  value = local.enabled ? aws_lambda_function.broker[0].function_name : ""
+}
+
+# --- U4: capability-private interpreter VPC placement ------------------------
+# Consumed by the agentcore-admin Lambda (CAPABILITY_PRIVATE_SUBNET_IDS /
+# CAPABILITY_PRIVATE_SECURITY_GROUP_IDS). Empty lists when disabled so the
+# Lambda skips capability-private provisioning entirely.
+
+output "capability_private_interpreter_subnet_ids" {
+  description = "No-NAT subnets the capability-private interpreter attaches to (same egress subnets as the broker)."
+  value       = local.enabled ? var.subnet_ids : []
+}
+
+output "capability_private_interpreter_security_group_id" {
+  description = "Egress-only SG (broker execute-api VPCE + DNS only) for the capability-private interpreter. Empty when disabled."
+  value       = local.enabled ? aws_security_group.capability_private_interpreter[0].id : ""
+}

package/dist/terraform/modules/app/capability-broker/variables.tf

@@ -0,0 +1,98 @@
+variable "enabled" {
+  description = "Master switch. When false the module creates nothing (ship-inert: U3 lands the broker code + this module gated off; U4 flips it on after the negative-egress proof)."
+  type        = bool
+  default     = false
+}
+
+variable "stage" {
+  type = string
+}
+
+variable "account_id" {
+  type = string
+}
+
+variable "region" {
+  type = string
+}
+
+# --- VPC placement (broker Lambda egress subnets + the dedicated VPCE) -------
+
+variable "vpc_id" {
+  type = string
+}
+
+variable "vpc_cidr_block" {
+  type = string
+}
+
+variable "subnet_ids" {
+  description = "Private egress subnets the broker Lambda and its dedicated execute-api VPC endpoint attach to."
+  type        = list(string)
+  default     = []
+}
+
+# --- Evidence datastore (Aurora, RDS Data API — same cluster as graphql-http)-
+
+variable "db_cluster_arn" {
+  type    = string
+  default = ""
+}
+
+variable "db_secret_arn" {
+  type    = string
+  default = ""
+}
+
+variable "db_cluster_endpoint" {
+  description = "Aurora writer endpoint hostname — DATABASE_HOST for getDb() (evidence store + authorization loader)."
+  type        = string
+  default     = ""
+}
+
+variable "db_username" {
+  description = "Aurora master username for the broker's DATABASE_URL."
+  type        = string
+  default     = "thinkwork_admin"
+}
+
+variable "db_password" {
+  description = "Aurora master password for the broker's DATABASE_URL (synchronous getDb() path)."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "database_name" {
+  description = "Aurora database name for the broker's DATABASE_URL."
+  type        = string
+  default     = "thinkwork"
+}
+
+# --- Lambda artifact source (mirrors lambda-api's dual local/remote pattern) -
+
+variable "lambda_zips_dir" {
+  description = "Local path holding dist/lambdas/*.zip for local deploys. Empty when using remote S3 artifacts."
+  type        = string
+  default     = ""
+}
+
+variable "lambda_artifact_bucket" {
+  type    = string
+  default = ""
+}
+
+variable "lambda_artifact_prefix" {
+  type    = string
+  default = ""
+}
+
+variable "lambda_runtime" {
+  type    = string
+  default = "nodejs22.x"
+}
+
+variable "log_retention_days" {
+  type    = number
+  default = 30
+}

package/dist/terraform/modules/app/deployment-control-plane/runner.py

@@ -2075,6 +2075,35 @@ def release_runtime_image(name):
     return ""
 
 
+def resolve_agentcore_pi_source_image_uri(payload):
+    operation = payload.get("operation") if isinstance(payload.get("operation"), dict) else {}
+    action = str(
+        safe_get(operation, "action", default=safe_get(payload, "action", "phase", default=""))
+    ).lower()
+    kind = str(safe_get(operation, "kind", default="")).lower()
+    is_customer_update = action == "update" or kind == "foundation"
+    explicit = safe_get(payload, "agentcorePiSourceImageUri", default="")
+    if explicit:
+        if is_customer_update:
+            account_id = safe_get(payload, "awsAccountId", default="")
+            region = safe_get(payload, "awsRegion", default=os.environ.get("AWS_REGION", ""))
+            customer_registry = f"{account_id}.dkr.ecr.{region}.amazonaws.com/"
+            if not account_id or not region or not explicit.startswith(customer_registry):
+                raise RuntimeError(
+                    "Customer foundation updates require agentcorePiSourceImageUri "
+                    "to reference the customer-owned ECR registry."
+                )
+        return explicit
+
+    if is_customer_update:
+        raise RuntimeError(
+            "Customer foundation updates require an explicit customer-ECR "
+            "agentcorePiSourceImageUri; refusing to fall back to the release registry."
+        )
+
+    return release_runtime_image("agentcore-pi-amd64")
+
+
 def release_git_sha():
     if not MANIFEST.exists():
         return ""
@@ -3053,6 +3082,16 @@ def write_runner_files(payload, runner_secrets):
             "enableHindsight",
             default=False,
         ),
+        # Analyst data-path Lambda VPC egress (stable NAT EIP for external
+        # database IP allowlists). Per-environment infra posture, so the
+        # durable home is the runner-secrets document; a payload boolean
+        # can override per-deploy.
+        "analyst_lambda_vpc_egress": safe_get_bool(
+            runner_secrets,
+            reviewed_payload,
+            "analystLambdaVpcEgress",
+            default=False,
+        ),
         # THINK-220: dedicated Hindsight database on the stage cluster.
         # Empty keeps the legacy hindsight-schema layout; set (e.g.
         # "thinkwork_hindsight") points the Hindsight service and platform
@@ -3161,11 +3200,7 @@ def write_runner_files(payload, runner_secrets):
         "deployment_evidence_bucket": os.environ.get("THINKWORK_EVIDENCE_BUCKET", ""),
         "deployment_terraform_module_source": terraform_module_source,
         "deployment_terraform_module_version": terraform_module_version,
-        "agentcore_pi_source_image_uri": safe_get(
-            payload,
-            "agentcorePiSourceImageUri",
-            default=release_runtime_image("agentcore-pi-amd64"),
-        ),
+        "agentcore_pi_source_image_uri": resolve_agentcore_pi_source_image_uri(payload),
     }
     enforce_customer_domain_preservation(
         current_outputs,
@@ -3262,6 +3297,11 @@ variable "enable_hindsight" {{
   type = bool
 }}
 
+variable "analyst_lambda_vpc_egress" {{
+  type    = bool
+  default = false
+}}
+
 variable "hindsight_database_name" {{
   type    = string
   default = ""
@@ -3655,6 +3695,7 @@ module "thinkwork" {{
   agentcore_pi_source_image_uri = var.agentcore_pi_source_image_uri
 
   enable_hindsight               = var.enable_hindsight
+  analyst_lambda_vpc_egress      = var.analyst_lambda_vpc_egress
   hindsight_database_name        = var.hindsight_database_name
   enable_workspace_orchestration = true