thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -14,6 +14,12 @@ locals {
   # deployment jobs — plan 2026-06-12-001 U10); the TWENTY config key is
   # retired.
   optional_integration_handler_names = concat(
+    var.auth_retirement_phase == "retired" ? [
+      # The native login UI never publishes this handler. It remains reachable
+      # only as an operator-controlled rollback seam through coexistence and
+      # cutover/soak, then Terraform removes the Lambda and routes atomically.
+      "workos-auth",
+    ] : [],
     var.deployment_control_plane_enabled ? [] : [
       # Host-only onboarding/deployment API. Customer foundations disable the
       # deployment control plane, so release-based customer installs must not
@@ -30,10 +36,22 @@ locals {
       "oauth-authorize",
       "oauth-callback",
       "slack-events",
-      "slack-slash-command",
-      "slack-interactivity",
       "slack-oauth-install",
     ],
+    var.enable_msteams_app ? [] : [
+      "msteams-install-start",
+      "msteams-install-complete",
+      "msteams-account-link-complete",
+    ],
+    var.enable_agentcore_multiplayer_proof ? [] : [
+      "turn-assertion-mint",
+      "agentcore-proof-oauth-provider",
+      "agentcore-identity-boundary-target",
+      "harness-capability-mcp",
+      "harness-code-interpreter-target",
+      "harness-builtin-tools-target",
+      "harness-platform-tools-target",
+    ],
   )
 
   # Config-class configuration shared by all API handlers. As of plan
@@ -44,20 +62,30 @@ locals {
   # The reader-coverage fixture test in apps/cli fails CI if a key in this
   # map still has a direct process.env reader. Identity values (STAGE,
   # AWS_ACCOUNT_ID, NODE_OPTIONS) and secrets (DATABASE_URL,
-  # API_AUTH_SECRET, APPSYNC_API_KEY) stay out of this map — identity stays
+  # API_AUTH_SECRET) stay out of this map — identity stays
   # env forever, secrets live in Secrets Manager (R4), never in the String
   # document.
   config_env = merge({
     # THINK-173: PUBLIC verification key (not a secret) + the NAME of the
     # private-key secret (resolved via runtime-config's secret loader —
     # the PEM itself never enters the env or the String document).
-    CAPABILITY_SIGNING_PUBLIC_KEY         = var.capability_signing_public_key
-    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET = var.capability_signing_private_key_secret
+    CAPABILITY_SIGNING_PUBLIC_KEY          = var.capability_signing_public_key
+    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET  = var.capability_signing_private_key_secret
+    SUBSCRIPTION_TICKET_SIGNING_KEY_ID     = var.subscription_ticket_signing_key_id
+    SUBSCRIPTION_TICKET_PUBLIC_KEYS        = var.subscription_ticket_public_keys
+    SUBSCRIPTION_TICKET_PRIVATE_KEY_SECRET = var.subscription_ticket_private_key_secret
+    APPSYNC_API_ID                         = var.appsync_api_id
     # THINK-229 U3/KTD5 — the analyst policy-source enforcement flip.
     # "row" (default) keeps sidecar policy shadow-only; "sidecar" makes the
     # signed sidecar block authoritative (budgets/policyClaims flow). Flip
     # ONLY after clean shadow parity on live traffic.
     ANALYST_POLICY_SOURCE = var.analyst_policy_source
+    # Governed autonomy — per-tenant opt-in allowlist for autonomous capability
+    # self-extension (the two self_admit_connection / self_approve_routine
+    # actions on capability-control-service). Comma/space-separated tenant ids;
+    # empty (default) = NO tenant enabled, so self-extension ships inert and
+    # fail-closed. Read via getConfig() (env-wins) in isSelfExtensionEnabled.
+    CAPABILITY_SELF_EXTENSION_TENANTS = var.capability_self_extension_tenants
     # THINK-230 — the operator-facing provisionAnalystConnector mutation runs
     # the analyst connector provisioning ceremony inside graphql-http, so the
     # shared api handlers read the same broker-secret ARN + rds_iam connect
@@ -74,8 +102,13 @@ locals {
     DATABASE_SECRET_ARN            = var.graphql_db_secret_arn
     DATABASE_HOST                  = var.db_cluster_endpoint
     DATABASE_NAME                  = var.database_name
+    # THINK-280 U8: the LAST rollout gate. External capability search + the
+    # Inspector governed-runtime operation layer stay inert until the broker is
+    # enabled for the stage. Off by default — read via getConfig() (env-wins).
+    CAPABILITY_EXTERNAL_SEARCH_ENABLED = var.enable_capability_broker ? "true" : "false"
+    ENABLE_CAPABILITY_BROKER           = var.enable_capability_broker ? "true" : "false"
     # BUCKET_NAME and USER_POOL_ID were duplicate aliases of WORKSPACE_BUCKET
-    # and COGNITO_USER_POOL_ID; GRAPHQL_API_KEY duplicated APPSYNC_API_KEY;
+    # and COGNITO_USER_POOL_ID; the legacy GRAPHQL_API_KEY alias is retired;
     # THINKWORK_API_SECRET and EMAIL_HMAC_SECRET duplicated API_AUTH_SECRET
     # (~310 serialized bytes total). graphql-http sits at Lambda's hard 4KB
     # env ceiling (#2375) — every reader falls back to the canonical name.
@@ -217,18 +250,35 @@ locals {
   # window (R8). Config-class keys live ONLY in the SSM runtime-config
   # document now — adding a key here is guarded by the identity-allowlist
   # fixture test in apps/cli (R10). Follow-up release: DATABASE_URL,
-  # APPSYNC_API_KEY, and API_AUTH_SECRET drop too (readers already resolve
+  # API_AUTH_SECRET drops too (readers already resolve
   # via Secrets Manager prefetch when the env copies are absent), bringing
   # every handler under the ≤1KB R1 target.
   common_env = {
     STAGE           = var.stage
     DATABASE_URL    = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
-    APPSYNC_API_KEY = var.appsync_api_key
     API_AUTH_SECRET = var.api_auth_secret
     AWS_ACCOUNT_ID  = var.account_id
     NODE_OPTIONS    = "--enable-source-maps"
   }
 
+  # THINK-316 U1: the assertion mint runs on a sibling role and receives only
+  # the database connection plus immutable stage identity. In particular it
+  # does not inherit API_AUTH_SECRET or APPSYNC_API_KEY from common_env.
+  turn_assertion_mint_env = {
+    STAGE          = var.stage
+    DATABASE_URL   = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
+    AWS_ACCOUNT_ID = var.account_id
+    NODE_OPTIONS   = "--enable-source-maps"
+  }
+
+  # THINK-316 U1: the synthetic provider/target are proof-only public
+  # boundaries. They receive no database URL, platform bearer, or AppSync key.
+  agentcore_proof_boundary_env = {
+    STAGE          = var.stage
+    AWS_ACCOUNT_ID = var.account_id
+    NODE_OPTIONS   = "--enable-source-maps"
+  }
+
   # Per-handler env-var overrides. ARNs are constructed from the naming
   # pattern (same trick as the api-cross-function-invoke statement in
   # iam-grouped.tf) so we don't introduce a self-referential dependency
@@ -237,7 +287,90 @@ locals {
     SLACK_APP_CREDENTIALS_SECRET_ARN = var.enable_slack_workspace_app ? aws_secretsmanager_secret.slack_app_credentials[0].arn : ""
   }
 
+  msteams_handler_env = {
+    MSTEAMS_APP_CREDENTIALS_SECRET_ARN = var.enable_msteams_app ? aws_secretsmanager_secret.msteams_app_credentials[0].arn : ""
+  }
+
   handler_extra_env = {
+    # THINK-316 U1: short-lived, server-minted identity assertions for
+    # AgentCore Harness and Gateway. The public mcp-oauth handler receives the
+    # key id only to publish GetPublicKey-derived JWKS; its role cannot Sign.
+    "mcp-oauth" = {
+      AGENTCORE_TURN_ASSERTION_ISSUER = local.agentcore_turn_assertion_issuer
+      AGENTCORE_TURN_ASSERTION_JWKS_KEYS = jsonencode([
+        for key in values(local.agentcore_turn_assertion_keys) : {
+          keyId = key.key_id
+          kid   = key.kid
+        }
+      ])
+    }
+    "skills" = {
+      AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
+      AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
+      AGENTCORE_USER_OAUTH_RETURN_URL           = "${local.mcp_oauth_api_base_url}/api/skills/mcp-oauth/agentcore/complete"
+      AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
+    }
+    "turn-assertion-mint" = {
+      AGENTCORE_TURN_ASSERTION_ISSUER     = local.agentcore_turn_assertion_issuer
+      AGENTCORE_HARNESS_AUDIENCE          = local.agentcore_harness_audience
+      AGENTCORE_GATEWAY_AUDIENCE          = local.agentcore_gateway_audience
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.agentcore_turn_assertion_active_key.key_id
+      AGENTCORE_TURN_ASSERTION_KID        = local.agentcore_turn_assertion_active_key.kid
+    }
+    "agentcore-proof-oauth-provider" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_ID     = var.agentcore_proof_oauth_client_id
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_ASSERTION_ISSUER          = local.agentcore_turn_assertion_issuer
+      AGENTCORE_HARNESS_AUDIENCE          = local.agentcore_harness_audience
+      AGENTCORE_GATEWAY_AUDIENCE          = local.agentcore_gateway_audience
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.agentcore_turn_assertion_active_key.key_id
+      AGENTCORE_TURN_ASSERTION_KID        = local.agentcore_turn_assertion_active_key.kid
+      AGENTCORE_PROOF_OWNER_ALLOWLIST     = var.agentcore_proof_owner_allowlist
+    }
+    "agentcore-identity-boundary-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_PROOF_OWNER_ALLOWLIST     = var.agentcore_proof_owner_allowlist
+    }
+    "harness-capability-mcp" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER              = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET       = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION         = "mcp-list-call-v2-tenant-admission"
+      AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
+      AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
+      AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
+    }
+    "harness-code-interpreter-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION   = "sandbox-execute-v1-tenant-admission"
+    }
+    "harness-builtin-tools-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION   = "builtin-web-v1-tenant-admission"
+    }
+    "harness-platform-tools-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION   = "platform-tools-v4-user-questions"
+    }
+    "workos-auth" = {
+      # During cutover/soak the callback, bridge, and logout paths remain for
+      # already-issued state, but the handler independently refuses every new
+      # WorkOS authorize start. Terraform removes the handler in retired.
+      AUTH_RETIREMENT_PHASE = var.auth_retirement_phase
+    }
+    "public-auth-options" = {
+      AUTH_RETIREMENT_PHASE = var.auth_retirement_phase
+    }
+    "auth-me" = {
+      AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
+    }
+    "auth-enrollment" = {
+      AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
+    }
     # Analyst query broker (THINK-228 U3). Reader role + caller credential
     # secrets, and the workspace bucket's analyst-staging/ prefix for
     # large-result CSVs (lifecycle TTL lives on the bucket module). The
@@ -302,6 +435,17 @@ locals {
       THINKWORK_RELEASE_VERSION         = var.deployment_release_version
       THINKWORK_RELEASE_MANIFEST_URL    = var.deployment_release_manifest_url
       THINKWORK_RELEASE_MANIFEST_SHA256 = var.deployment_release_manifest_sha256
+      # THINK-280 — createTenant RequestResponse-invokes agentcore-admin to
+      # provision the per-tenant sandbox. sandbox-provisioning.ts reads both
+      # from process.env directly (the token is a secret → env, never the SSM
+      # String doc). Broker-session build reads the three broker values below
+      # (broker-session.ts); all EMPTY when the broker is disabled → inert.
+      AGENTCORE_ADMIN_LAMBDA_ARN      = var.agentcore_admin_lambda_arn
+      AGENTCORE_ADMIN_TOKEN           = var.agentcore_admin_token
+      CAPABILITY_BROKER_AUDIENCE      = var.capability_broker_audience
+      CAPABILITY_BROKER_API_ID        = var.capability_broker_api_id
+      CAPABILITY_BROKER_VPCE_DNS      = var.capability_broker_vpce_dns
+      CAPABILITY_BROKER_SESSION_TABLE = var.capability_broker_session_table
     }
     # Compounding Memory compile Lambda. Any Converse-compatible Bedrock
     # model works; the planner + section-writer cap themselves at ~500
@@ -343,12 +487,25 @@ locals {
       BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
       OKF_EFS_ROOT           = var.okf_efs_mount_path
     }
-    "oauth-authorize"     = local.slack_handler_env
-    "oauth-callback"      = local.slack_handler_env
-    "slack-events"        = local.slack_handler_env
-    "slack-slash-command" = local.slack_handler_env
-    "slack-interactivity" = local.slack_handler_env
-    "slack-oauth-install" = local.slack_handler_env
+    # THINK-193 U1 (Codex F6): normalized evidence snapshots live in the
+    # encrypted brain-artifacts bucket under evidence-snapshots/ — Postgres
+    # keeps only the s3:// ref + hash. 30-day lifecycle expiration below.
+    "memory-stage-worker" = {
+      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+    }
+    # THINK-193 U2 (Codex S1/S2): the retraction drainer performs the
+    # versioned evidence-snapshot deletion for source erases under its
+    # DEDICATED role (below) — the only place bulk destructive S3 runs.
+    "memory-retraction-drainer" = {
+      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+    }
+    "oauth-authorize"               = local.slack_handler_env
+    "oauth-callback"                = local.slack_handler_env
+    "slack-events"                  = local.slack_handler_env
+    "slack-oauth-install"           = local.slack_handler_env
+    "msteams-install-start"         = local.msteams_handler_env
+    "msteams-install-complete"      = local.msteams_handler_env
+    "msteams-account-link-complete" = local.msteams_handler_env
     "thread-attachments-finalize" = {
       REQUESTER_IDLE_MEMORY_LEARNING_ENABLED = tostring(var.requester_idle_memory_learning_enabled)
     }
@@ -364,7 +521,15 @@ locals {
     # knowledge_graph_search tool; the per-agent tool policy gates on top.
     "chat-agent-invoke" = {
       KNOWLEDGE_GRAPH_TOOL_ENABLED = tostring(var.knowledge_graph_tool_enabled)
-    }
+      # THINK-311 U5: no HARNESS_RUNNER_FUNCTION_NAME env — derivable
+      # thinkwork-<stage>-api-* names never ride env (R1/R10 identity-only
+      # rule); resolveRuntimeFunctionName derives it from STAGE at call
+      # time, exactly like workspace-renderer.
+    }
+    # THINK-316 U5: the runner reads the server-only attested profile and
+    # invokes its named endpoint with a purpose-bound CUSTOM_JWT. It receives
+    # no Harness control-plane inputs or permissions.
+    "harness-runner" = {}
     # 240s: sync Hindsight retain (LLM extraction + auto-consolidation) can
     # exceed 60s; the client timeout must stay below the Lambda timeout (300s)
     # and below the Hindsight ALB idle_timeout (300s) so failures classify as
@@ -395,6 +560,15 @@ locals {
       # invocation (never Lambda self-invoke — AWS recursive-loop
       # detection terminates worker-to-self Event chains).
       KG_OBS_MAX_CANDIDATES_PER_RUN = var.kg_obs_max_candidates_per_run
+      # THINK-193 U4 dead-handoff fix: a successful observations ingest
+      # enqueues the tenant graph wiki-compile job inside its own commit
+      # and Event-invokes wiki-compile post-commit. WIKI_SOURCE must match
+      # the wiki-compile handler's dispatch flag (stage-global); the
+      # per-tenant kill switch stays tenants.wiki_compile_enabled. The
+      # invoke rides the shared lambda role's existing wiki-compile
+      # lambda:InvokeFunction grant (iam-grouped.tf); the function name is
+      # derived from STAGE (common_env) at call time.
+      WIKI_SOURCE = var.wiki_source
     }
     # routine-task-python (Phase B U6) needs the AgentCore code-interpreter
     # id + the per-stage S3 routine-output bucket. The interpreter id is
@@ -414,6 +588,14 @@ locals {
     "routine-exec-git" = {
       SANDBOX_INTERPRETER_ID = var.agentcore_code_interpreter_id
       ROUTINE_OUTPUT_BUCKET  = "thinkwork-${var.stage}-routine-output"
+      # THINK-280 U7 — the headless capability executor runs inside
+      # routine-exec-git and mints broker sessions. routine-exec-git.ts +
+      # capability-headless-executor.ts read all four from process.env; all
+      # EMPTY when the broker is disabled → the executor stays inert.
+      CAPABILITY_BROKER_SESSION_TABLE = var.capability_broker_session_table
+      CAPABILITY_BROKER_AUDIENCE      = var.capability_broker_audience
+      CAPABILITY_BROKER_API_ID        = var.capability_broker_api_id
+      CAPABILITY_BROKER_VPCE_DNS      = var.capability_broker_vpce_dns
     }
     # graphql-http hosts the createRoutine / publishRoutineVersion / etc.
     # resolvers (Phase B U7) AND the routine-approval-bridge (Phase B
@@ -561,6 +743,23 @@ resource "aws_lambda_function" "handler" {
     # Bearer API_AUTH_SECRET. Idempotent on thread_turns.finalized_at
     # (migration 0123). Plan: 2026-05-22-006.
     "chat-agent-finalize",
+    # harness-runner — THINK-311 U5: Event-mode target for harness-flagged
+    # agents. The chat dispatch selector (resolveRuntimeFunctionName) routes
+    # a trial agent's turn here instead of the Pi container Lambda; the
+    # runner projects the payload into an AWS AgentCore Harness config,
+    # drives InvokeHarness, fulfills emit_document, and finalizes the turn
+    # via processFinalize. No API route — direct Event invoke only.
+    "harness-runner",
+    # THINK-316 U1: direct-invoke-only assertion mint. It derives all identity
+    # claims from the persisted turn tuple and signs with a dedicated KMS key;
+    # there is intentionally no public API Gateway route.
+    "turn-assertion-mint",
+    "agentcore-proof-oauth-provider",
+    "agentcore-identity-boundary-target",
+    "harness-capability-mcp",
+    "harness-code-interpreter-target",
+    "harness-builtin-tools-target",
+    "harness-platform-tools-target",
     # canvas-refresh — headless Living Artifacts data-refresh (THINK-145 U6).
     # Invoked RequestResponse by the refreshCanvasData mutation (graphql-http)
     # and by job-trigger's canvas_refresh branch (U7). Re-runs the saved
@@ -594,7 +793,13 @@ resource "aws_lambda_function" "handler" {
     "stripe-subscription",
     "deployment-sessions",
     "auth-me",
+    "auth-revoke",
+    "auth-enrollment",
+    "auth-subscription-ticket",
+    "appsync-subscription-authorizer",
+    "subscription-invalidation",
     "public-auth-options",
+    "auth-provider-reconcile",
     "workos-auth",
     # Public artifact share links (THINK-208): GET /share/{token}, token
     # verified in handler code (no gateway auth, uniform 404 on any miss).
@@ -608,6 +813,8 @@ resource "aws_lambda_function" "handler" {
     "mcp-user-memory",
     "mcp-context-engine",
     "mcp-open-engine",
+    # THINK-280 U8: scoped external capability search MCP facade.
+    "mcp-capability-search",
     "activity",
     "routines",
     "budgets",
@@ -642,13 +849,28 @@ resource "aws_lambda_function" "handler" {
     "email-provider-webhook",
     "email-readiness-probe",
     "slack-events",
-    "slack-slash-command",
-    "slack-interactivity",
     "slack-oauth-install",
+    "msteams-install-start",
+    "msteams-install-complete",
+    "msteams-account-link-complete",
     "github-app",
     "memory",
     "memory-retain",
     "brain-dream-state",
+    "memory-stage-worker",
+    # THINK-193 U2 (Codex P1 #3): scheduled retry drainer for the retraction
+    # saga ledger. Claims due/stale memory_retraction_attempts rows with the
+    # locked_by + lock_generation fence, processes each via the saga, sweeps
+    # exhausted rows to dead_lettered, and emits structured-log metrics.
+    # rate(5 minutes) EventBridge Scheduler + MaxRetryAttempts=0 (dedicated
+    # resources below) — the next tick IS the retry.
+    "memory-retraction-drainer",
+    # THINK-193 U3: stalled memory_stage token sweeper — re-invokes the
+    # memory-stage-worker for pending/executing tokens past their lease and
+    # redrives consumed-but-unsent results; unrecoverable parks get a
+    # terminal step event + SendTaskFailure. rate(15 minutes) schedule
+    # (dedicated resource below).
+    "memory-stage-sweeper",
     "wiki-compile",
     "knowledge-graph-observations-ingest",
     "ontology-scan",
@@ -791,6 +1013,14 @@ resource "aws_lambda_function" "handler" {
     # POSTs one row per agent-session-start. Shared
     # API_AUTH_SECRET bearer (runtime→API; no tenant OAuth).
     "manifest-log",
+    # Governed capability runtime control-plane service (THINK-280 U2).
+    # NO HTTP route: the Pi container invokes it directly (RequestResponse)
+    # via lambda:InvokeFunction over the approved in-account path — public
+    # execute-api is not reliable from Pi's private VPC. Identity comes
+    # exclusively from the Ed25519-signed capability caller context (the
+    # CAPABILITY_SIGNING_PUBLIC_KEY in the shared runtime-config document
+    # verifies it); plaintext payload fields are never trusted.
+    "capability-control-service",
     # SI-7 catalog-list read endpoint (plan §U15 pt 3/3). The runtime
     # fetches the allowed builtin-tool slug set once per
     # session-start + feature-flag-gated enforcement filter drops
@@ -831,9 +1061,13 @@ resource "aws_lambda_function" "handler" {
   ]), toset(local.optional_integration_handler_names)) : toset([])
 
   function_name = "thinkwork-${var.stage}-api-${each.key}"
-  role          = aws_iam_role.lambda.arn
-  handler       = "index.handler"
-  runtime       = local.runtime
+  # S2 (THINK-193 U2): memory-retraction-drainer runs under a DEDICATED role
+  # so its destructive evidence-snapshot S3 capability (version enumeration +
+  # bulk version deletion) never leaks into the 90+ handlers on the shared
+  # role. Everything else keeps the shared role.
+  role    = each.key == "memory-retraction-drainer" ? aws_iam_role.memory_retraction_drainer.arn : each.key == "turn-assertion-mint" ? aws_iam_role.turn_assertion_mint[0].arn : each.key == "agentcore-proof-oauth-provider" ? aws_iam_role.agentcore_proof_provider[0].arn : each.key == "agentcore-identity-boundary-target" ? aws_iam_role.agentcore_proof_boundary[0].arn : aws_iam_role.lambda.arn
+  handler = "index.handler"
+  runtime = local.runtime
   # Parameters and Secrets extension: container-local cache for the SSM
   # runtime-config document + Secrets Manager reads (runtime-config.tf).
   layers = local.api_handler_layers
@@ -844,7 +1078,6 @@ resource "aws_lambda_function" "handler" {
   depends_on = [
     aws_ssm_parameter.runtime_config,
     aws_secretsmanager_secret_version.api_auth,
-    aws_secretsmanager_secret_version.appsync_api_key,
   ]
   # eval-runner walks every test case sequentially, invoking an agent +
   # waiting up to 2 min for spans to propagate per test, so a 10-test run
@@ -859,8 +1092,11 @@ resource "aws_lambda_function" "handler" {
   # validates the agent, builds the AgentCore invoke payload, dispatches
   # Event-mode, and returns. Setup is ~5s in practice; 60s gives 12×
   # headroom for transient slowness.
-  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
-  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
+  # harness-runner holds the Lambda open for the full Harness turn (the
+  # reference QBR run was ~2 min; 900s is the ceiling — a longer run is a
+  # legitimate trial limitation, recorded, not engineered around).
+  timeout     = each.key == "harness-runner" ? 900 : each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
+  memory_size = each.key == "harness-runner" ? 512 : each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
 
   filename         = local.use_local_zips ? "${var.lambda_zips_dir}/${each.key}.zip" : null
   source_code_hash = local.use_local_zips ? filebase64sha256("${var.lambda_zips_dir}/${each.key}.zip") : null
@@ -889,7 +1125,10 @@ resource "aws_lambda_function" "handler" {
 
   environment {
     variables = merge(
-      local.common_env,
+      each.key == "turn-assertion-mint" ? local.turn_assertion_mint_env : contains([
+        "agentcore-proof-oauth-provider",
+        "agentcore-identity-boundary-target",
+      ], each.key) ? local.agentcore_proof_boundary_env : local.common_env,
       { FUNCTION_NAME = each.key },
       lookup(local.handler_extra_env, each.key, {}),
     )
@@ -904,6 +1143,19 @@ resource "aws_lambda_function" "handler" {
     }
   }
 
+  # Analyst data-path handlers get a stable NAT egress IP when
+  # analyst_egress_subnet_ids is set — external Postgres sources behind an IP
+  # allowlist admit that one EIP. Disjoint from the okf-efs-refresh block
+  # above (a function takes at most one vpc_config).
+  dynamic "vpc_config" {
+    for_each = contains(local.analyst_vpc_handlers, each.key) && local.analyst_vpc_enabled ? [1] : []
+
+    content {
+      subnet_ids         = var.analyst_egress_subnet_ids
+      security_group_ids = var.analyst_egress_security_group_ids
+    }
+  }
+
   dynamic "file_system_config" {
     for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
 
@@ -973,6 +1225,20 @@ resource "aws_lambda_function_event_invoke_config" "chat_agent_invoke" {
   maximum_event_age_in_seconds = 3600
 }
 
+# harness-runner retry-0 (THINK-311 U5, async-retry idempotency): an AWS
+# async retry would re-execute a whole agent turn. Failures finalize the
+# turn in-process (finalize-through-failure); a hard crash is reconciled
+# by the stall monitor (timed_out + checkout release, no retry enqueue
+# for harness turns). No DLQ destination for the same reason as
+# chat-agent-invoke above: the shared role's inline policy budget is at
+# the AWS cap, and the stall monitor is the operational surface.
+resource "aws_lambda_function_event_invoke_config" "harness_runner" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["harness-runner"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
 resource "aws_lambda_function_event_invoke_config" "wiki_compile" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
   function_name                = aws_lambda_function.handler["wiki-compile"].function_name
@@ -1061,6 +1327,21 @@ resource "aws_lambda_function_event_invoke_config" "routine_approval_callback" {
 # retain-cost path (Bedrock tokens charged in adapter.retainConversation)
 # is NOT idempotent — retries multiply LLM cost. Per
 # project_async_retry_idempotency_lessons.
+# memory-stage-worker (THINK-193 U1): Event-invoked by workflow-step-dispatch
+# AFTER the memory_stage task token is stored. Lambda async retries are
+# disabled like its memory siblings — the worker's stages are idempotent, but
+# an automatic re-execution would race the original's token CAS and turn a
+# completed stage into a spurious failure. A worker that dies without
+# resuming the token is bounded by the state machine's HeartbeatSeconds
+# (3600s): the parked step times out and the run fails visibly, and a
+# re-triggered run self-heals from the durable checkpoint/evidence ledger.
+resource "aws_lambda_function_event_invoke_config" "memory_stage_worker" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["memory-stage-worker"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
 resource "aws_lambda_function_event_invoke_config" "memory_retain" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
   function_name                = aws_lambda_function.handler["memory-retain"].function_name
@@ -1068,6 +1349,132 @@ resource "aws_lambda_function_event_invoke_config" "memory_retain" {
   maximum_event_age_in_seconds = 3600
 }
 
+# ---------------------------------------------------------------------------
+# THINK-193 U2 (Codex S2): dedicated IAM role for memory-retraction-drainer.
+#
+# The drainer is the ONLY principal allowed to enumerate and bulk-delete
+# evidence-snapshot object VERSIONS (S1: the brain-artifacts bucket is
+# versioned; erase completeness requires deleting every noncurrent version
+# and delete marker under the source prefix). Granting that on the shared
+# api-lambda role would let every unrelated handler destroy any tenant's
+# evidence — hence the sibling-role pattern (same as
+# compliance-anchor-watchdog). The role otherwise carries only what the
+# drainer actually uses: logs (managed basic policy), Secrets Manager +
+# SSM runtime-config reads, and conditional KMS for the encrypted bucket.
+# ---------------------------------------------------------------------------
+
+resource "aws_iam_role" "memory_retraction_drainer" {
+  name = "thinkwork-${var.stage}-memory-retraction-drainer-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "memory_retraction_drainer_basic" {
+  role       = aws_iam_role.memory_retraction_drainer.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy" "memory_retraction_drainer" {
+  name = "memory-retraction-drainer"
+  role = aws_iam_role.memory_retraction_drainer.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        # Versioned evidence-snapshot destruction, evidence-snapshots/ only.
+        {
+          Effect = "Allow"
+          Action = [
+            "s3:DeleteObject",
+            "s3:DeleteObjectVersion",
+          ]
+          Resource = "${aws_s3_bucket.brain_artifacts.arn}/evidence-snapshots/*"
+        },
+        {
+          Effect = "Allow"
+          Action = [
+            "s3:ListBucket",
+            "s3:ListBucketVersions",
+          ]
+          Resource = aws_s3_bucket.brain_artifacts.arn
+          Condition = {
+            StringLike = {
+              "s3:prefix" = "evidence-snapshots/*"
+            }
+          }
+        },
+        # Runtime-config document + platform secrets (DATABASE_URL rides the
+        # env during the R8 transition window; the loader prefetches the
+        # api-auth/appsync secrets at cold start).
+        {
+          Effect   = "Allow"
+          Action   = ["ssm:GetParameter", "ssm:GetParameters"]
+          Resource = "arn:aws:ssm:${var.region}:${var.account_id}:parameter/thinkwork/${var.stage}/*"
+        },
+        {
+          Effect   = "Allow"
+          Action   = ["secretsmanager:GetSecretValue"]
+          Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork/*"
+        },
+      ],
+      var.brain_artifacts_kms_key_arn != "" ? [
+        {
+          Effect = "Allow"
+          Action = [
+            "kms:Decrypt",
+            "kms:GenerateDataKey",
+          ]
+          Resource = var.brain_artifacts_kms_key_arn
+        },
+      ] : [],
+    )
+  })
+}
+
+# memory-retraction-drainer (THINK-193 U2, Codex P1 #3): the retraction
+# saga's product-owned retry path. Lambda async retries are disabled — every
+# transition on memory_retraction_attempts is a fenced CAS, so a duplicate
+# invocation is harmless but pointless; the rate(5 minutes) schedule below
+# is the retry. Attempts exceeding max_attempts are swept to dead_lettered
+# by the drainer itself instead of retrying forever.
+resource "aws_lambda_function_event_invoke_config" "memory_retraction_drainer" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["memory-retraction-drainer"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
+resource "aws_scheduler_schedule" "memory_retraction_drainer" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-memory-retraction-drainer"
+  group_name          = "default"
+  schedule_expression = "rate(5 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["memory-retraction-drainer"].arn
+    role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ limit = 25 })
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 # Product-owned retry path for memory-retain. Lambda async retries remain
 # disabled above; this scheduled drain claims due rows from
 # memory_retain_attempts and replays bounded retry payloads idempotently.
@@ -1202,8 +1609,13 @@ locals {
       # Public login capabilities. Unauthenticated by design; the handler
       # resolves tenant-scoped OAuth options only from trusted API Gateway
       # domain metadata and fails closed for unknown/shared hosts.
-      "GET /api/auth/options"              = "public-auth-options"
-      "OPTIONS /api/auth/options"          = "public-auth-options"
+      "GET /api/auth/options"     = "public-auth-options"
+      "OPTIONS /api/auth/options" = "public-auth-options"
+      # Operator/deployment-only metadata seam. The Lambda independently
+      # verifies API_AUTH_SECRET and rejects raw secret values.
+      "POST /api/auth/providers/reconcile" = "auth-provider-reconcile"
+      # Rollback-only routes. No native client links to these, and the entire
+      # handler is filtered from Lambda/API Gateway in the retired phase.
       "GET /api/auth/workos/authorize"     = "workos-auth"
       "OPTIONS /api/auth/workos/authorize" = "workos-auth"
       "GET /api/auth/workos/callback"      = "workos-auth"
@@ -1303,14 +1715,43 @@ locals {
       "GET /.well-known/oauth-authorization-server"        = "mcp-oauth"
       "GET /.well-known/openid-configuration"              = "mcp-oauth"
       "GET /mcp/oauth/jwks"                                = "mcp-oauth"
-      "POST /mcp/oauth/register"                           = "mcp-oauth"
-      "GET /mcp/oauth/authorize"                           = "mcp-oauth"
-      "GET /mcp/oauth/callback"                            = "mcp-oauth"
-      "POST /mcp/oauth/token"                              = "mcp-oauth"
-      "POST /mcp/oauth/revoke"                             = "mcp-oauth"
-      "ANY /mcp/user-memory"                               = "mcp-user-memory"
-      "ANY /mcp/context-engine"                            = "mcp-context-engine"
-      "ANY /mcp/open-engine"                               = "mcp-open-engine"
+      # THINK-316 U1: AgentCore CUSTOM_JWT discovery is deliberately isolated
+      # under /agentcore so the existing user-memory OAuth issuer is unchanged.
+      "GET /agentcore/.well-known/openid-configuration" = "mcp-oauth"
+      "GET /agentcore/oauth/jwks"                       = "mcp-oauth"
+      # THINK-316 U1 proof-only provider and downstream HTTPS target. Both
+      # handlers validate their own credentials; the route filter removes all
+      # five when enable_agentcore_multiplayer_proof is false.
+      "GET /agentcore-proof/oauth/.well-known/openid-configuration" = "agentcore-proof-oauth-provider"
+      "GET /agentcore-proof/oauth/authorize"                        = "agentcore-proof-oauth-provider"
+      "POST /agentcore-proof/oauth/token"                           = "agentcore-proof-oauth-provider"
+      "GET /agentcore-proof/target/owner"                           = "agentcore-identity-boundary-target"
+      "GET /agentcore-proof/target/mixed"                           = "agentcore-identity-boundary-target"
+      "POST /agentcore/capabilities/mcp/tools/list"                 = "harness-capability-mcp"
+      "POST /agentcore/capabilities/mcp/tools/call"                 = "harness-capability-mcp"
+      "POST /agentcore/capabilities/sandbox/execute"                = "harness-code-interpreter-target"
+      "POST /agentcore/capabilities/web/search"                     = "harness-builtin-tools-target"
+      "POST /agentcore/capabilities/web/extract"                    = "harness-builtin-tools-target"
+      "POST /agentcore/capabilities/brain/query"                    = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/workspace/skills/list"          = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/workspace/skills/load"          = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/message/attachments/list"       = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/message/attachments/read"       = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/user/questions/ask"             = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/email/send"                     = "harness-platform-tools-target"
+      "POST /mcp/oauth/register"                                    = "mcp-oauth"
+      "GET /mcp/oauth/authorize"                                    = "mcp-oauth"
+      "GET /mcp/oauth/callback"                                     = "mcp-oauth"
+      "POST /mcp/oauth/token"                                       = "mcp-oauth"
+      "POST /mcp/oauth/revoke"                                      = "mcp-oauth"
+      "ANY /mcp/user-memory"                                        = "mcp-user-memory"
+      "ANY /mcp/context-engine"                                     = "mcp-context-engine"
+      "ANY /mcp/open-engine"                                        = "mcp-open-engine"
+      # THINK-280 U8: scoped external capability search facade. The handler is
+      # inert unless CAPABILITY_EXTERNAL_SEARCH_ENABLED (gated on
+      # enable_capability_broker) is on — routing it while disabled returns an
+      # empty, no-data projection.
+      "ANY /mcp/capabilities" = "mcp-capability-search"
 
       # Brain v0 service-auth writeback.
       "POST /api/brain/agent-write"    = "brain-agent-write"
@@ -1350,6 +1791,18 @@ locals {
       "OPTIONS /api/deployment-sessions/{sessionId}/teardown"                   = "deployment-sessions"
       "GET /api/auth/me"                                                        = "auth-me"
       "OPTIONS /api/auth/me"                                                    = "auth-me"
+      "POST /api/auth/revoke"                                                   = "auth-revoke"
+      "OPTIONS /api/auth/revoke"                                                = "auth-revoke"
+      "POST /api/auth/subscription-ticket"                                      = "auth-subscription-ticket"
+      "OPTIONS /api/auth/subscription-ticket"                                   = "auth-subscription-ticket"
+      "POST /api/auth/enrollment/consume"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/consume"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/recover"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/recover"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/migrate"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/migrate"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/auto-link"                                     = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/auto-link"                                  = "auth-enrollment"
       "ANY /api/extensions/{extensionId}"                                       = "extension-proxy"
       "ANY /api/extensions/{extensionId}/{proxy+}"                              = "extension-proxy"
 
@@ -1419,11 +1872,18 @@ locals {
       # Slack workspace app ingress. These unauthenticated public endpoints
       # verify Slack signatures in handler code before any tenant work happens.
       "POST /slack/events"        = "slack-events"
-      "POST /slack/slash-command" = "slack-slash-command"
-      "POST /slack/interactivity" = "slack-interactivity"
       "GET /slack/oauth/install"  = "slack-oauth-install"
       "POST /slack/oauth/install" = "slack-oauth-install"
 
+      # Microsoft Teams install + account-link ingress. Like the Slack block
+      # above, these routes have no gateway authorizer: install/start and
+      # account-link/complete verify the Cognito JWT in-handler, and
+      # install/complete (the Microsoft admin-consent redirect) verifies the
+      # HMAC-signed install state in-handler before any tenant work happens.
+      "POST /msteams/install/start"         = "msteams-install-start"
+      "GET /msteams/install/complete"       = "msteams-install-complete"
+      "POST /msteams/account-link/complete" = "msteams-account-link-complete"
+
       # Memory
       "ANY /api/memory/{proxy+}" = "memory"
 
@@ -1557,7 +2017,9 @@ locals {
       "GET /api/runtime/capability-catalog"     = "capability-catalog-list"
       "OPTIONS /api/runtime/capability-catalog" = "capability-catalog-list"
     } : route_key => handler_name
-    if !contains(local.optional_integration_handler_names, handler_name)
+    if !contains(local.optional_integration_handler_names, handler_name) && (
+      var.enable_agentcore_multiplayer_proof || !startswith(route_key, "GET /agentcore/")
+    )
   } : {}
 }
 
@@ -1578,6 +2040,16 @@ resource "aws_apigatewayv2_route" "handler" {
   target    = "integrations/${aws_apigatewayv2_integration.handler[each.key].id}"
 }
 
+resource "aws_lambda_permission" "appsync_subscription_authorizer" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  statement_id  = "AllowAppSyncSubscriptionAuthorization"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.handler["appsync-subscription-authorizer"].function_name
+  principal     = "appsync.amazonaws.com"
+  source_arn    = "arn:aws:appsync:${var.region}:${var.account_id}:apis/${var.appsync_api_id}"
+}
+
 resource "aws_lambda_permission" "handler_apigw" {
   for_each = local.deploy_lambda_handlers ? toset(distinct(values(local.api_routes))) : toset([])
 
@@ -1653,6 +2125,32 @@ resource "aws_scheduler_schedule" "wakeup_processor" {
   }
 }
 
+# Replays durable authorization-revocation invalidations. The worker owns its
+# retry state in Aurora and suppresses tenant realtime fan-out until AppSync
+# confirms every sensitive subscription class has been invalidated.
+resource "aws_scheduler_schedule" "subscription_invalidation" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-subscription-invalidation"
+  group_name          = "default"
+  schedule_expression = "rate(1 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["subscription-invalidation"].arn
+    role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ limit = 25 })
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 # ---------------------------------------------------------------------------
 # webhook_deliveries retention cron — daily delete of rows older than 90 days
 # ---------------------------------------------------------------------------
@@ -1740,6 +2238,25 @@ resource "aws_scheduler_schedule" "requester_memory_dreaming" {
 # the audit log.
 # ---------------------------------------------------------------------------
 
+# THINK-193 U3: memory_stage stall recovery — every 15 minutes, bounded batch.
+resource "aws_scheduler_schedule" "memory_stage_sweeper" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-memory-stage-sweeper"
+  group_name          = "default"
+  schedule_expression = "rate(15 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["memory-stage-sweeper"].arn
+    role_arn = aws_iam_role.scheduler.arn
+  }
+}
+
 resource "aws_scheduler_schedule" "mcp_approval_sweeper" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
@@ -2256,6 +2773,37 @@ resource "aws_scheduler_schedule" "knowledge_graph_observations_ingest" {
   }
 }
 
+# Ontology suggestion scan sweep (THINK-320 U4/KTD-3). Enumerates tenants and
+# starts a suggestion scan job per tenant; tenants with a pending/running scan
+# are skipped in the handler, and the scan-job dedupe key drops same-bucket
+# duplicate starts. Ships DISABLED — enabled per stage via
+# ontology_scan_sweep_enabled after the Living Map review surfaces land.
+resource "aws_scheduler_schedule" "ontology_scan_sweep" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-ontology-scan-sweep"
+  group_name          = "default"
+  schedule_expression = "rate(1 days)"
+  state               = var.ontology_scan_sweep_enabled ? "ENABLED" : "DISABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["ontology-scan"].arn
+    role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ sweep = true, trigger = "scheduled" })
+
+    # Periodic idempotent worker: the next daily tick IS the retry (mirrors
+    # the knowledge_graph_observations_ingest precedent — scheduler retries
+    # only stack invocations onto a self-correcting cadence).
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 resource "aws_scheduler_schedule" "wiki_lint" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
@@ -2447,6 +2995,27 @@ resource "aws_s3_bucket_lifecycle_configuration" "brain_artifacts" {
     }
   }
 
+  # THINK-193 U1 (Codex F6): normalized evidence snapshots are short-lived
+  # working copies — the durable record is the evidence row (hash + ref) and
+  # the Hindsight projection. Expire content after 30 days; the app mirrors
+  # this via memory_evidence_items.snapshot_expires_at.
+  rule {
+    id     = "expire-evidence-snapshots"
+    status = "Enabled"
+
+    filter {
+      prefix = "evidence-snapshots/"
+    }
+
+    expiration {
+      days = 30
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 30
+    }
+  }
+
   rule {
     id     = "exports-expiration"
     status = "Enabled"