thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/app/lambda-api/agentcore-harness-alarms.tf

@@ -0,0 +1,88 @@
+################################################################################
+# AgentCore Harness retirement-soak operational gates.
+#
+# These use native AWS/Lambda metrics so they work on a fresh stage without
+# pre-creating or importing implicit log groups. alarm_actions remain empty,
+# consistent with the other non-cost operational alarms in this module.
+################################################################################
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_errors" {
+  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-errors"
+  alarm_description   = "The AgentCore Harness runner crashed. The turn fails closed and must be reconciled before the retirement soak can pass."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 60
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
+  }
+}
+resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_throttles" {
+  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-throttles"
+  alarm_description   = "AgentCore Harness turns are being throttled before execution; capacity admission or account concurrency is insufficient."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Throttles"
+  statistic           = "Sum"
+  period              = 60
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_p95" {
+  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-p95"
+  alarm_description   = "AgentCore Harness runner p95 exceeded the 120-second retirement-certification threshold."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Duration"
+  extended_statistic  = "p95"
+  period              = 300
+  evaluation_periods  = 5
+  datapoints_to_alarm = 3
+  threshold           = 120000
+  comparison_operator = "GreaterThanThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_async_age" {
+  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-async-age"
+  alarm_description   = "AgentCore Harness Event invocations waited more than 60 seconds before execution; the runtime path is backlogged."
+  namespace           = "AWS/Lambda"
+  metric_name         = "AsyncEventAge"
+  extended_statistic  = "p95"
+  period              = 60
+  evaluation_periods  = 3
+  datapoints_to_alarm = 2
+  threshold           = 60000
+  comparison_operator = "GreaterThanThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
+  }
+}

package/dist/terraform/modules/app/lambda-api/agentcore-identity-alarms.tf

@@ -0,0 +1,91 @@
+################################################################################
+# THINK-316 U9 — assertion mint operational gates
+#
+# The mint emits redacted EMF metrics around only the KMS Sign call. These
+# alarms encode the frozen U9 latency and failure thresholds; no assertion,
+# subject, tenant, key id, or other caller material is emitted as a dimension.
+################################################################################
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_kms_p95" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-kms-p95"
+  alarm_description   = "AgentCore turn assertion KMS signing p95 exceeded the frozen 100 ms U9 gate."
+  namespace           = "ThinkWork/AgentCore"
+  metric_name         = "TurnAssertionKmsSignLatency"
+  extended_statistic  = "p95"
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = 100
+  period              = 60
+  evaluation_periods  = 5
+  datapoints_to_alarm = 3
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    Stage = var.stage
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_kms_p99" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-kms-p99"
+  alarm_description   = "AgentCore turn assertion KMS signing p99 exceeded the frozen 250 ms U9 gate."
+  namespace           = "ThinkWork/AgentCore"
+  metric_name         = "TurnAssertionKmsSignLatency"
+  extended_statistic  = "p99"
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = 250
+  period              = 60
+  evaluation_periods  = 5
+  datapoints_to_alarm = 3
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    Stage = var.stage
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_kms_failures" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-kms-failures"
+  alarm_description   = "AgentCore turn assertion KMS signing failed; new Harness/Gateway assertions fail closed."
+  namespace           = "ThinkWork/AgentCore"
+  metric_name         = "TurnAssertionKmsSignFailures"
+  statistic           = "Sum"
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = 0
+  period              = 60
+  evaluation_periods  = 1
+  datapoints_to_alarm = 1
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    Stage = var.stage
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_lambda_errors" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-errors"
+  alarm_description   = "The internal AgentCore assertion mint Lambda failed. No fallback assertion is issued."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = 0
+  period              = 60
+  evaluation_periods  = 1
+  datapoints_to_alarm = 1
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["turn-assertion-mint"].function_name
+  }
+}

package/dist/terraform/modules/app/lambda-api/capability-search-alarms.tf

@@ -0,0 +1,60 @@
+# THINK-280 U8 — governed capability runtime external-search observability.
+#
+# The external MCP search facade (/mcp/capabilities) and the confidential
+# client_credentials token leg are the LAST rollout stage. These alarms fire
+# from AWS/Lambda Errors metrics that EXIST without any log-group management
+# (handler crashes, including ones that never reach a log line) — the same
+# constraint memory-alarms.tf documents. Log-metric filters over the broker's
+# structured replay/policy/readiness/adapter/provider failure codes require the
+# /aws/lambda/<function> groups (created only after first invocation) and are a
+# coordinated follow-up; until then those failure classes are observable through
+# the structured logs + the capability_broker_calls evidence table.
+#
+# DISABLE PATH: flip `enable_capability_broker = false` (or the tenant/env gate
+# CAPABILITY_EXTERNAL_SEARCH_ENABLED). The handler + route stay deployed but
+# return an empty, no-data projection, so no new external access is granted —
+# while all historical capability_broker_calls / compliance evidence remains
+# queryable. These alarms only exist while the broker is enabled.
+#
+# alarm_actions are intentionally empty (see memory-alarms.tf): operators wire
+# an SNS topic when the rollout needs paging.
+
+resource "aws_cloudwatch_metric_alarm" "capability_search_lambda_errors" {
+  count = local.deploy_lambda_handlers && var.enable_capability_broker ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-mcp-capability-search-lambda-errors"
+  alarm_description   = "mcp-capability-search (external capability search facade) crashed. External hosts see a failed search; no capability data is exposed on error (fail closed). Investigate before continuing the external-search rollout."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["mcp-capability-search"].function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "capability_oauth_token_errors" {
+  count = local.deploy_lambda_handlers && var.enable_capability_broker ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-mcp-oauth-lambda-errors"
+  alarm_description   = "mcp-oauth crashed — includes the confidential client_credentials token leg for external capability clients. Token minting failing hard (never issuing on a bad secret is expected + returns 401, not an Error). Investigate credential/DB reachability."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 3
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["mcp-oauth"].function_name
+  }
+}