thinkwork-cli 0.13.0 → 0.13.1

package/dist/terraform/modules/app/lambda-api/iam-grouped.tf

@@ -146,6 +146,31 @@ locals {
         Action   = ["s3:ListBucket"]
         Resource = aws_s3_bucket.brain_artifacts.arn
       },
+      # THINK-193 U2 (Codex S2 + round-6 P1): bulk/prefix destruction of
+      # evidence snapshots lives EXCLUSIVELY on the memory-retraction-drainer's
+      # dedicated role (handlers.tf). The SHARED role gets only the narrow
+      # erase-fence COMPENSATION capability: a stage worker that loses the
+      # fence mid-PutObject must delete the EXACT object version it just
+      # wrote (VersionId from its own PutObject response) and verify the key
+      # is gone. Without ListBucketVersions-driven enumeration + bulk delete
+      # this cannot destroy anything the caller did not itself write —
+      # version ids are unguessable. ListBucketVersions is granted read-only
+      # for the verification step, prefix-conditioned.
+      {
+        Effect   = "Allow"
+        Action   = ["s3:DeleteObjectVersion"]
+        Resource = "${aws_s3_bucket.brain_artifacts.arn}/evidence-snapshots/*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["s3:ListBucketVersions"]
+        Resource = aws_s3_bucket.brain_artifacts.arn
+        Condition = {
+          StringLike = {
+            "s3:prefix" = "evidence-snapshots/*"
+          }
+        }
+      },
       # (was inline policy "cognito-access")
       {
         Effect = "Allow"
@@ -394,6 +419,22 @@ locals {
         }
       },
     ] : [],
+    # THINK-280 — the headless capability executor (routine-exec-git) mints and
+    # advances the broker PoP session by conditional reads/writes on the broker's
+    # DynamoDB session table. Empty (→ no grant) when the broker is disabled.
+    var.capability_broker_session_table_arn != "" ? [
+      {
+        Effect = "Allow"
+        Action = [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:DeleteItem",
+          "dynamodb:Query",
+        ]
+        Resource = var.capability_broker_session_table_arn
+      },
+    ] : [],
   )
 
   # ---------------------------------------------------------------------------
@@ -472,9 +513,13 @@ locals {
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-compile",
           # knowledge-graph-observations-ingest: graphql-http's
           # startKnowledgeGraphObservationsIngest mutation invokes this with
-          # RequestResponse. (The worker's self-invoke drain is retired —
-          # AWS recursive-loop detection terminated those chains; backlog
-          # drains in-process now.)
+          # RequestResponse, and memory-stage-worker's graph stage (THINK-193
+          # U4 stitch) RequestResponse-invokes it with a targeted bankIds
+          # payload — the Bedrock classifier/extraction model config lives on
+          # the ingest Lambda's own env, so the worker never runs the ingest
+          # in-process. (The worker's self-invoke drain is retired — AWS
+          # recursive-loop detection terminated those chains; backlog drains
+          # in-process now.)
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-graph-observations-ingest",
           # wiki-bootstrap-import: bootstrapJournalImport admin mutation
           # Event-invokes this for the long-running ingest path.
@@ -518,6 +563,11 @@ locals {
           # step RequestResponse-invokes its workflow-delivery mode to email
           # the maintained report to the operator-configured recipient list.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-artifact-deliver",
+          # memory-stage-worker (external-memory-compounding U1):
+          # workflow-step-dispatch's memory_stage step Event-invokes it after
+          # parking on the task token; the worker resumes the token via
+          # SendTaskSuccess when the pipeline stage ends.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-memory-stage-worker",
           # job-trigger self-target (plan 2026-07-03-004 U5, KTD-3): the
           # manual GraphQL trigger Event-invokes job-trigger with the
           # agent_loop_continue_dispatch event so routine actions never run
@@ -528,6 +578,12 @@ locals {
           # triggers), and job-trigger's canvas_refresh branch RequestResponse-
           # invokes it (scheduled trigger). Both run on this shared role.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-canvas-refresh",
+          # agentcore-admin (THINK-280): graphql-http's createTenant
+          # RequestResponse-invokes it to provision per-tenant sandbox
+          # resources; routine-exec-git (same shared role) reaches it for the
+          # capability-private provisioning path. Deployed by the dedicated
+          # agentcore-admin module with its own least-privilege role.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-agentcore-admin",
         ]
       },
       # (was standalone managed policy "workspace_renderer_invoke")
@@ -709,7 +765,7 @@ locals {
   # Group 3: AI — Bedrock model invocation, Knowledge Bases, AgentCore
   # memory / evaluations / code interpreter.
   # ---------------------------------------------------------------------------
-  api_ai_statements = [
+  api_ai_statements = concat([
     # (was inline policy "bedrock-invoke")
     # Cross-region inference profiles (us.anthropic.claude-*) require
     # `bedrock:InvokeModel` on the *inference-profile* ARN AND on the
@@ -750,6 +806,18 @@ locals {
         "bedrock:GetIngestionJob",
         "bedrock:ListIngestionJobs",
         "bedrock:Retrieve",
+        # THINK-193 U7: knowledge-base-manager reconciles the per-document
+        # manifest after successful syncs (List/Get) and gates deletion
+        # settlement on Get + the scoped Retrieve above. Ingest/Delete cover
+        # the explicit direct-delete path for S3 RETAIN'd documents — the
+        # manager never races them with StartIngestionJob. The workspace-
+        # bucket S3 read the memory-stage-worker needs for document text is
+        # already granted by the shared role's workspace "s3-access"
+        # statement (data-plane group).
+        "bedrock:ListKnowledgeBaseDocuments",
+        "bedrock:GetKnowledgeBaseDocuments",
+        "bedrock:IngestKnowledgeBaseDocuments",
+        "bedrock:DeleteKnowledgeBaseDocuments",
       ]
       # CreateKnowledgeBase/CreateDataSource have no resource ARN at create
       # time and don't support resource-level scoping, so a knowledge-base/*
@@ -818,7 +886,65 @@ locals {
       ]
       Resource = "*"
     },
-  ]
+    ],
+    # THINK-311 U4 — AgentCore Harness trial invoker grants, present only when
+    # the agentcore-harness module is enabled (empty role ARN = module off).
+    # Ship-inert: no handler calls Harness until U5's harness-runner lands.
+    #
+    # CRITICAL: never grant `bedrock-agentcore:InvokeAgentRuntimeCommand`
+    # anywhere — it bypasses Harness allowedTools enforcement. Invocation goes
+    # through InvokeHarness / InvokeAgentRuntime only.
+    var.agentcore_harness_execution_role_arn != "" ? [
+      {
+        # Data plane — invoke a Harness (and its runtime endpoints) directly.
+        Sid    = "AgentCoreHarnessInvoke"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:InvokeHarness",
+          "bedrock-agentcore:InvokeAgentRuntime",
+        ]
+        Resource = "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:harness/*"
+      },
+      {
+        # Control plane — CreateHarness has no resource ARN at create time
+        # (same non-scopable shape as bedrock:CreateKnowledgeBase above), so
+        # this statement is "*"; PassRole below stays scoped to the single
+        # Harness execution role.
+        Sid    = "AgentCoreHarnessControl"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:CreateHarness",
+          "bedrock-agentcore:GetHarness",
+          "bedrock-agentcore:UpdateHarness",
+          "bedrock-agentcore:DeleteHarness",
+          "bedrock-agentcore:CreateHarnessEndpoint",
+          "bedrock-agentcore:GetHarnessEndpoint",
+          "bedrock-agentcore:ListHarnessEndpoints",
+          "bedrock-agentcore:ListHarnesses",
+          "bedrock-agentcore:ListHarnessVersions",
+        ]
+        Resource = "*"
+      },
+    ] : [],
+    # (Separate conditional from the two statements above only because the
+    # Condition attribute gives this object a different Terraform type —
+    # same gate, same feature.)
+    var.agentcore_harness_execution_role_arn != "" ? [
+      {
+        # CreateHarness takes executionRoleArn; the caller must be able to
+        # pass exactly that role, and only to the bedrock-agentcore service.
+        Sid      = "AgentCoreHarnessPassExecutionRole"
+        Effect   = "Allow"
+        Action   = ["iam:PassRole"]
+        Resource = var.agentcore_harness_execution_role_arn
+        Condition = {
+          StringEquals = {
+            "iam:PassedToService" = "bedrock-agentcore.amazonaws.com"
+          }
+        }
+      },
+    ] : [],
+  )
 
   # ---------------------------------------------------------------------------
   # Group 4: observability — CloudWatch Logs reads, ECS/ALB health reads.

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -20,6 +20,17 @@ data "aws_caller_identity" "current" {}
 
 locals {
   okf_efs_vpc_enabled = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
+  # Handlers that open direct Postgres connections to registered analyst data
+  # sources. VPC-attaching them (analyst_egress_subnet_ids) gives their egress
+  # the NAT gateway's stable EIP, which external databases behind an IP
+  # allowlist can admit — a non-VPC Lambda egresses from the shared AWS pool
+  # and can never satisfy such an allowlist.
+  analyst_vpc_enabled = length(var.analyst_egress_subnet_ids) > 0 && length(var.analyst_egress_security_group_ids) > 0
+  analyst_vpc_handlers = toset([
+    "graphql-http",
+    "analyst-query-broker",
+    "analyst-connection-reconciler",
+  ])
   # Constructed rather than read from aws_apigatewayv2_stage.default.invoke_url
   # (the two are identical for an HTTP API's $default stage). Reading it off
   # the stage made every Lambda's env depend on the stage, which forbids the

package/dist/terraform/modules/app/lambda-api/memory-alarms.tf

@@ -0,0 +1,92 @@
+# THINK-193 U8 — external-memory compounding observability.
+#
+# Alarms here fire from metrics that EXIST without any log-group management:
+#   - AWS/Lambda Errors for the memory-stage worker and the retraction drainer
+#     (handler crashes, including ones that never reach a log line);
+#   - the wiki-compile DLQ depth (the only memory-path Lambda with an
+#     on_failure destination).
+#
+# DELIBERATELY NOT HERE — log-metric filters over the drainer's structured
+# summary line and the worker's "status=failed" line. They require the
+# /aws/lambda/<function> log groups, which only exist after a function's first
+# invocation: PutMetricFilter failed with ResourceNotFoundException on customer
+# stages taking a fresh release (dev passed only because its groups already
+# existed). Managing the groups in Terraform instead needs a coordinated state
+# import on every stage that already has the implicit group, so it is a
+# follow-up. Until then, drainer errors / dead-letters and stage failures are
+# observable through the structured logs and
+# packages/api/scripts/external-memory-readiness.ts (which reports due,
+# failed, and dead-lettered attempts directly from the ledger).
+#
+# Also runbook-only (no metric exists): source checkpoint age, graph-to-wiki
+# lag, evidence lag, deferred identity count/age.
+#
+# alarm_actions are empty: the only SNS topic in this module
+# (aws_sns_topic.cost_alerts) is the cost-alert channel — wiring memory alarms
+# into it would misroute pages. Operators subscribe a topic when the rollout
+# needs paging.
+
+
+resource "aws_cloudwatch_metric_alarm" "memory_stage_worker_lambda_errors" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-memory-stage-worker-lambda-errors"
+  alarm_description   = "memory-stage-worker Lambda crashed (unhandled error, retries pinned to 0, no failure destination) — the parked workflow run will need a redrive."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["memory-stage-worker"].function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "memory_retraction_drainer_lambda_errors" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-memory-retraction-drainer-lambda-errors"
+  alarm_description   = "memory-retraction-drainer Lambda crashed before emitting its summary line — due retraction work is stalled until the next scheduled tick succeeds."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["memory-retraction-drainer"].function_name
+  }
+}
+
+# ---------------------------------------------------------------------------
+# wiki-compile DLQ depth (graph → wiki handoff failures)
+# ---------------------------------------------------------------------------
+
+resource "aws_cloudwatch_metric_alarm" "wiki_compile_dlq_depth" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-wiki-compile-dlq-depth"
+  alarm_description   = "wiki-compile DLQ has messages — a compile invocation crashed before the job ledger recorded an outcome; canonical pages are stale until replayed."
+  namespace           = "AWS/SQS"
+  metric_name         = "ApproximateNumberOfMessagesVisible"
+  statistic           = "Maximum"
+  period              = 60
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    QueueName = aws_sqs_queue.wiki_compile_dlq[0].name
+  }
+}

package/dist/terraform/modules/app/lambda-api/msteams-app-secrets.tf

@@ -0,0 +1,46 @@
+################################################################################
+# Microsoft Teams app credentials
+#
+# Stored in Secrets Manager as a JSON blob with two fields:
+#
+#   {
+#     "app_id":        "Teams (Entra) app registration / bot app id",
+#     "client_secret": "Entra app client secret"
+#   }
+#
+# The Teams install + account-link handlers receive only this secret ARN in
+# Lambda configuration. The client_secret doubles as the HMAC signing key for
+# install state and account-link tokens — transport-only material that must
+# never appear in logs or responses. The shared Lambda role already has
+# access to the `thinkwork/*` prefix, so no additional IAM attachment is
+# needed (same as the Slack app credentials secret).
+#
+# Operators populate the real value out-of-band. Terraform creates an initial
+# empty version so Lambdas fail with a clear missing-field error before setup,
+# and lifecycle.ignore_changes prevents later applies from overwriting rotated
+# credentials.
+################################################################################
+
+resource "aws_secretsmanager_secret" "msteams_app_credentials" {
+  count       = var.enable_msteams_app ? 1 : 0
+  name        = "thinkwork/${var.stage}/msteams/app"
+  description = "Microsoft Teams app credentials (app_id, client_secret). Populate via Secrets Manager; never via tfvars."
+  tags = {
+    Name     = "thinkwork-${var.stage}-msteams-app"
+    Stage    = var.stage
+    Provider = "msteams"
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "msteams_app_credentials_initial" {
+  count     = var.enable_msteams_app ? 1 : 0
+  secret_id = aws_secretsmanager_secret.msteams_app_credentials[0].id
+  secret_string = jsonencode({
+    app_id        = ""
+    client_secret = ""
+  })
+
+  lifecycle {
+    ignore_changes = [secret_string]
+  }
+}

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -146,6 +146,12 @@ variable "kb_service_role_arn" {
   type        = string
 }
 
+variable "agentcore_harness_execution_role_arn" {
+  description = "AgentCore Harness execution role ARN (THINK-311 U4). Empty string (harness module disabled) omits the Harness invoker grants from the grouped ai policy."
+  type        = string
+  default     = ""
+}
+
 variable "certificate_arn" {
   description = "ACM certificate ARN for custom API domain"
   type        = string
@@ -238,6 +244,18 @@ variable "brain_dream_state_schedule_expression" {
   default     = "cron(0 5 * * ? *)"
 }
 
+variable "retry_dispatcher_enabled" {
+  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there (parent plan deploy ordering); manual invokes work regardless."
+  type        = bool
+  default     = false
+}
+
+variable "stall_threshold_minutes" {
+  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307 — one knob, two consumers)."
+  type        = number
+  default     = 5
+}
+
 variable "extension_proxy_signing_secret" {
   description = "Shared HMAC secret used by the generic Admin extension proxy to sign actor context for extension backends."
   type        = string
@@ -273,6 +291,18 @@ variable "memory_engine" {
   }
 }
 
+variable "analyst_egress_subnet_ids" {
+  description = "Private (NAT-routed) subnet IDs for VPC-attaching the analyst data-path handlers (graphql-http, analyst-query-broker, analyst-connection-reconciler) so external Postgres sources can allowlist the stack's stable NAT egress IP. Leave empty to keep the handlers outside any VPC."
+  type        = list(string)
+  default     = []
+}
+
+variable "analyst_egress_security_group_ids" {
+  description = "Security group IDs for the VPC-attached analyst data-path handlers. Leave empty to keep the handlers outside any VPC."
+  type        = list(string)
+  default     = []
+}
+
 variable "okf_efs_subnet_ids" {
   description = "Subnet IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
   type        = list(string)
@@ -435,6 +465,12 @@ variable "enable_slack_workspace_app" {
   default     = true
 }
 
+variable "enable_msteams_app" {
+  description = "Provision Microsoft Teams app Lambdas, API routes, and credentials placeholder secret."
+  type        = bool
+  default     = false
+}
+
 variable "appsync_realtime_url" {
   description = "AppSync realtime/WebSocket endpoint URL"
   type        = string
@@ -790,6 +826,12 @@ variable "analyst_policy_source" {
   }
 }
 
+variable "capability_self_extension_tenants" {
+  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed. Read via getConfig() in capability-control-service."
+  type        = string
+  default     = ""
+}
+
 variable "analyst_db_cluster_resource_id" {
   description = "Immutable RDS cluster resource ID (cluster-XXXX / db-XXXX) for the stage database (THINK-229 U1). Wired from `module.database.cluster_resource_id`. Keys the broker's `rds-db:connect` IAM grant — the rds-db ARN format requires the resource ID, not the cluster ARN — and gates the IAM connect env on the broker Lambda: when empty, the broker stays on the password path."
   type        = string
@@ -801,3 +843,53 @@ variable "artifact_delivery_from_email" {
   type        = string
   default     = ""
 }
+
+variable "enable_capability_broker" {
+  description = "THINK-280 U8 rollout gate (default off). When true, the governed capability runtime's external MCP search facade (/mcp/capabilities) and the Inspector governed-runtime operation layer are enabled for the stage. The external-search leg is the LAST rollout stage (shadow → internal search → private broker dogfood → promotion/tracer → external search): keep this false until the earlier stages are proven for the stage. When false every U8 surface is inert and returns no data — the handler and route still deploy, but read nothing."
+  type        = bool
+  default     = false
+}
+
+# THINK-280 — sandbox provisioning + capability broker wiring. -----------------
+variable "agentcore_admin_lambda_arn" {
+  description = "ARN of the agentcore-admin Lambda (AGENTCORE_ADMIN_LAMBDA_ARN on graphql-http). createTenant RequestResponse-invokes it. Empty when the Lambda is not deployed."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_admin_token" {
+  description = "Bearer token graphql-http presents when invoking agentcore-admin (AGENTCORE_ADMIN_TOKEN). Must match the token the admin Lambda validates. Empty when not deployed."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "capability_broker_session_table" {
+  description = "DynamoDB broker session table name (CAPABILITY_BROKER_SESSION_TABLE). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_session_table_arn" {
+  description = "ARN of the broker session table — grants routine-exec-git DynamoDB access to mint/advance PoP sessions. Empty when the broker is disabled (no grant)."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_audience" {
+  description = "Capability broker PoP audience (CAPABILITY_BROKER_AUDIENCE). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_api_id" {
+  description = "Capability broker private REST API id (CAPABILITY_BROKER_API_ID). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_vpce_dns" {
+  description = "Capability broker execute-api VPCE DNS name (CAPABILITY_BROKER_VPCE_DNS). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}

package/dist/terraform/modules/app/workflow-interpreter-stepfunctions/alarms.tf

@@ -0,0 +1,47 @@
+# THINK-193 U8 — workflow-interpreter execution failure alarms.
+#
+# Terminal FAILED/TIMED_OUT/ABORTED executions are projected onto the run
+# row by workflow-execution-callback (DB, not a parseable log line), so the
+# reliable infrastructure signal is the Step Functions service metrics on
+# the interpreter state machine itself. Memory workflows (personal +
+# shared) execute through this machine — an execution failure here is the
+# "workflow-interpreter execution failures" rollout gate signal.
+#
+# alarm_actions are empty: no paging SNS topic exists in this module.
+# Operators subscribe one when the rollout needs paging.
+
+resource "aws_cloudwatch_metric_alarm" "interpreter_executions_failed" {
+  alarm_name          = "thinkwork-${var.stage}-workflow-interpreter-executions-failed"
+  alarm_description   = "Workflow-interpreter Step Functions executions FAILED — check the run's timeline (workflow_step_failed events) and the execution history."
+  namespace           = "AWS/States"
+  metric_name         = "ExecutionsFailed"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    StateMachineArn = aws_sfn_state_machine.interpreter.arn
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "interpreter_executions_timed_out" {
+  alarm_name          = "thinkwork-${var.stage}-workflow-interpreter-executions-timed-out"
+  alarm_description   = "Workflow-interpreter Step Functions executions TIMED_OUT — a parked task token (approval / memory stage) was never resolved within the execution timeout."
+  namespace           = "AWS/States"
+  metric_name         = "ExecutionsTimedOut"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    StateMachineArn = aws_sfn_state_machine.interpreter.arn
+  }
+}

package/dist/terraform/modules/app/workflow-interpreter-stepfunctions/main.tf

@@ -211,8 +211,8 @@ resource "aws_iam_role_policy" "execution_states" {
 #
 # See KTD1 for the loop shape. Directives are the FROZEN protocol the
 # step-dispatch Lambda emits: dispatch_agent, wait_until, execute_step,
-# await_approval, continue, rollover, terminal_success, terminal_failure,
-# terminal_canceled.
+# await_approval, await_memory_stage, continue, rollover, terminal_success,
+# terminal_failure, terminal_canceled.
 ################################################################################
 
 resource "aws_sfn_state_machine" "interpreter" {
@@ -254,6 +254,7 @@ resource "aws_sfn_state_machine" "interpreter" {
           { Variable = "$.directive", StringEquals = "wait_until", Next = "WaitState" },
           { Variable = "$.directive", StringEquals = "execute_step", Next = "ExecuteStep" },
           { Variable = "$.directive", StringEquals = "await_approval", Next = "ApprovalStep" },
+          { Variable = "$.directive", StringEquals = "await_memory_stage", Next = "MemoryStageStep" },
           { Variable = "$.directive", StringEquals = "continue", Next = "LoadNextStep" },
           { Variable = "$.directive", StringEquals = "rollover", Next = "RolloverStart" },
           { Variable = "$.directive", StringEquals = "terminal_success", Next = "SucceedState" },
@@ -369,6 +370,46 @@ resource "aws_sfn_state_machine" "interpreter" {
         Next       = "DirectiveChoice"
       }
 
+      # ---- Memory-stage step: park on a task token while the async memory-
+      # stage worker runs one pipeline stage; the await phase Event-invokes the
+      # worker, which resumes the token via SendTaskSuccess with a result JSON.
+      MemoryStageStep = {
+        Type     = "Task"
+        Resource = "arn:aws:states:::lambda:invoke.waitForTaskToken"
+        Parameters = {
+          FunctionName = local.step_dispatch_lambda_arn
+          Payload = {
+            phase         = "await_memory_stage"
+            "cursor.$"    = "$.cursor"
+            "taskToken.$" = "$$.Task.Token"
+          }
+        }
+        ResultPath       = "$.result"
+        TimeoutSeconds   = 7200
+        HeartbeatSeconds = 3600
+        Catch = [{
+          ErrorEquals = ["States.Timeout"]
+          Next        = "FailState"
+        }]
+        Next = "RecordMemoryStage"
+      }
+
+      RecordMemoryStage = {
+        Type     = "Task"
+        Resource = "arn:aws:states:::lambda:invoke"
+        Parameters = {
+          FunctionName = local.step_dispatch_lambda_arn
+          Payload = {
+            phase      = "record_memory_stage"
+            "cursor.$" = "$.cursor"
+            "result.$" = "$.result"
+          }
+        }
+        OutputPath = "$.Payload"
+        Retry      = local.lambda_invoke_retry
+        Next       = "DirectiveChoice"
+      }
+
       # ---- Record the step outcome, evaluate policy, emit the next directive -
       RecordAdvance = {
         Type     = "Task"

package/dist/terraform/modules/foundation/cognito/main.tf

@@ -7,9 +7,12 @@
 ################################################################################
 
 locals {
-  create             = var.create_cognito
-  create_pre_signup  = local.create && var.pre_signup_lambda_zip != ""
-  create_custom_auth = local.create && var.custom_auth_lambda_zip != ""
+  create                          = var.create_cognito
+  create_pre_signup               = local.create && var.pre_signup_lambda_zip != ""
+  use_local_custom_auth_artifact  = trimspace(var.custom_auth_lambda_zip) != ""
+  use_remote_custom_auth_artifact = trimspace(var.custom_auth_lambda_s3_bucket) != ""
+  custom_auth_artifact_count      = (local.use_local_custom_auth_artifact ? 1 : 0) + (local.use_remote_custom_auth_artifact ? 1 : 0)
+  create_custom_auth              = local.create && local.custom_auth_artifact_count == 1
 
   user_pool_id     = local.create ? aws_cognito_user_pool.main[0].id : var.existing_user_pool_id
   user_pool_arn    = local.create ? aws_cognito_user_pool.main[0].arn : var.existing_user_pool_arn
@@ -24,6 +27,22 @@ locals {
   }
 }
 
+resource "terraform_data" "custom_auth_artifact_validation" {
+  input = local.custom_auth_artifact_count
+
+  lifecycle {
+    precondition {
+      condition     = local.custom_auth_artifact_count <= 1
+      error_message = "Set only one Cognito custom-auth Lambda artifact source: custom_auth_lambda_zip or custom_auth_lambda_s3_bucket/custom_auth_lambda_s3_key."
+    }
+
+    precondition {
+      condition     = !local.use_remote_custom_auth_artifact || trimspace(var.custom_auth_lambda_s3_key) != ""
+      error_message = "custom_auth_lambda_s3_key must be set when custom_auth_lambda_s3_bucket is set."
+    }
+  }
+}
+
 data "aws_caller_identity" "current" {}
 
 ################################################################################
@@ -97,7 +116,10 @@ resource "aws_lambda_permission" "cognito_pre_signup" {
 
 resource "aws_iam_role" "custom_auth" {
   count = local.create_custom_auth ? 1 : 0
-  name  = "thinkwork-${var.stage}-cognito-custom-auth-role"
+  # Release deployments use a distinct managed name so the first convergent
+  # apply does not collide with custom-auth Lambdas created during the legacy
+  # manual rollout. Local source deployments retain the original name.
+  name = local.use_remote_custom_auth_artifact ? "thinkwork-${var.stage}-cognito-custom-auth-release-role" : "thinkwork-${var.stage}-cognito-custom-auth-role"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -117,8 +139,10 @@ resource "aws_iam_role_policy_attachment" "custom_auth_basic" {
 
 resource "aws_lambda_function" "custom_auth" {
   count         = local.create_custom_auth ? 1 : 0
-  function_name = "thinkwork-${var.stage}-cognito-custom-auth"
-  filename      = var.custom_auth_lambda_zip
+  function_name = local.use_remote_custom_auth_artifact ? "thinkwork-${var.stage}-cognito-custom-auth-release" : "thinkwork-${var.stage}-cognito-custom-auth"
+  filename      = local.use_local_custom_auth_artifact ? var.custom_auth_lambda_zip : null
+  s3_bucket     = local.use_remote_custom_auth_artifact ? var.custom_auth_lambda_s3_bucket : null
+  s3_key        = local.use_remote_custom_auth_artifact ? var.custom_auth_lambda_s3_key : null
   handler       = "index.handler"
   runtime       = "nodejs20.x"
   timeout       = 10
@@ -130,12 +154,12 @@ resource "aws_lambda_function" "custom_auth" {
     }
   }
 
-  source_code_hash = filebase64sha256(var.custom_auth_lambda_zip)
+  source_code_hash = local.use_local_custom_auth_artifact ? filebase64sha256(var.custom_auth_lambda_zip) : null
 
   lifecycle {
     precondition {
       condition     = var.api_auth_secret != ""
-      error_message = "custom_auth_lambda_zip requires api_auth_secret so Cognito custom-auth challenges can be verified."
+      error_message = "A Cognito custom-auth Lambda artifact requires api_auth_secret so custom-auth challenges can be verified."
     }
   }
 }