thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/app/lambda-api/iam-grouped.tf

@@ -146,6 +146,31 @@ locals {
         Action   = ["s3:ListBucket"]
         Resource = aws_s3_bucket.brain_artifacts.arn
       },
+      # THINK-193 U2 (Codex S2 + round-6 P1): bulk/prefix destruction of
+      # evidence snapshots lives EXCLUSIVELY on the memory-retraction-drainer's
+      # dedicated role (handlers.tf). The SHARED role gets only the narrow
+      # erase-fence COMPENSATION capability: a stage worker that loses the
+      # fence mid-PutObject must delete the EXACT object version it just
+      # wrote (VersionId from its own PutObject response) and verify the key
+      # is gone. Without ListBucketVersions-driven enumeration + bulk delete
+      # this cannot destroy anything the caller did not itself write —
+      # version ids are unguessable. ListBucketVersions is granted read-only
+      # for the verification step, prefix-conditioned.
+      {
+        Effect   = "Allow"
+        Action   = ["s3:DeleteObjectVersion"]
+        Resource = "${aws_s3_bucket.brain_artifacts.arn}/evidence-snapshots/*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["s3:ListBucketVersions"]
+        Resource = aws_s3_bucket.brain_artifacts.arn
+        Condition = {
+          StringLike = {
+            "s3:prefix" = "evidence-snapshots/*"
+          }
+        }
+      },
       # (was inline policy "cognito-access")
       {
         Effect = "Allow"
@@ -156,6 +181,8 @@ locals {
           "cognito-idp:AdminRespondToAuthChallenge",
           "cognito-idp:AdminSetUserPassword",
           "cognito-idp:AdminUpdateUserAttributes",
+          "cognito-idp:DescribeIdentityProvider",
+          "cognito-idp:DescribeUserPoolClient",
           "cognito-idp:ListUsers",
         ]
         Resource = var.user_pool_arn
@@ -321,6 +348,7 @@ locals {
     # refresh path cannot replace the old manual AWS CLI step.
     var.deployment_evidence_bucket != "" ? [
       {
+        Sid    = "DeploymentEvidenceBucket"
         Effect = "Allow"
         Action = [
           "s3:GetObject",
@@ -332,6 +360,12 @@ locals {
           "arn:aws:s3:::${var.deployment_evidence_bucket}/*",
         ]
       },
+      {
+        Sid      = "AgentCoreHarnessGatewayOauthSecret"
+        Effect   = "Allow"
+        Action   = ["secretsmanager:GetSecretValue"]
+        Resource = ["arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:bedrock-agentcore-identity!default/oauth2/thinkwork-${var.stage}-proof-oauth-*"]
+      },
     ] : [],
     var.billing_export_bucket_name != "" ? [
       {
@@ -394,6 +428,22 @@ locals {
         }
       },
     ] : [],
+    # THINK-280 — the headless capability executor (routine-exec-git) mints and
+    # advances the broker PoP session by conditional reads/writes on the broker's
+    # DynamoDB session table. Empty (→ no grant) when the broker is disabled.
+    var.capability_broker_session_table_arn != "" ? [
+      {
+        Effect = "Allow"
+        Action = [
+          "dynamodb:GetItem",
+          "dynamodb:PutItem",
+          "dynamodb:UpdateItem",
+          "dynamodb:DeleteItem",
+          "dynamodb:Query",
+        ]
+        Resource = var.capability_broker_session_table_arn
+      },
+    ] : [],
   )
 
   # ---------------------------------------------------------------------------
@@ -472,13 +522,28 @@ locals {
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-compile",
           # knowledge-graph-observations-ingest: graphql-http's
           # startKnowledgeGraphObservationsIngest mutation invokes this with
-          # RequestResponse. (The worker's self-invoke drain is retired —
-          # AWS recursive-loop detection terminated those chains; backlog
-          # drains in-process now.)
+          # RequestResponse, and memory-stage-worker's graph stage (THINK-193
+          # U4 stitch) RequestResponse-invokes it with a targeted bankIds
+          # payload — the Bedrock classifier/extraction model config lives on
+          # the ingest Lambda's own env, so the worker never runs the ingest
+          # in-process. (The worker's self-invoke drain is retired — AWS
+          # recursive-loop detection terminated those chains; backlog drains
+          # in-process now.)
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-knowledge-graph-observations-ingest",
           # wiki-bootstrap-import: bootstrapJournalImport admin mutation
           # Event-invokes this for the long-running ingest path.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-bootstrap-import",
+          # harness-runner: chat-agent-invoke Event-invokes this for chat
+          # turns routed to the AWS AgentCore runtime (THINK-311 trial).
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-harness-runner",
+          # harness-runner queues the same canonical post-turn memory pipeline
+          # as Pi after a completed AgentCore turn. The retain ledger makes the
+          # Event invoke idempotent on the thread-turn source key.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-memory-retain",
+          # harness-runner RequestResponse-invokes this dedicated signer. The
+          # signer re-derives the actor/tenant/thread tuple from the running
+          # turn and alone holds KMS Sign; the shared runner role never does.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-turn-assertion-mint",
           # ontology-scan: startOntologySuggestionScan Event-invokes this
           # after inserting a durable scan job row.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-scan",
@@ -518,6 +583,11 @@ locals {
           # step RequestResponse-invokes its workflow-delivery mode to email
           # the maintained report to the operator-configured recipient list.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-artifact-deliver",
+          # memory-stage-worker (external-memory-compounding U1):
+          # workflow-step-dispatch's memory_stage step Event-invokes it after
+          # parking on the task token; the worker resumes the token via
+          # SendTaskSuccess when the pipeline stage ends.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-memory-stage-worker",
           # job-trigger self-target (plan 2026-07-03-004 U5, KTD-3): the
           # manual GraphQL trigger Event-invokes job-trigger with the
           # agent_loop_continue_dispatch event so routine actions never run
@@ -528,6 +598,12 @@ locals {
           # triggers), and job-trigger's canvas_refresh branch RequestResponse-
           # invokes it (scheduled trigger). Both run on this shared role.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-canvas-refresh",
+          # agentcore-admin (THINK-280): graphql-http's createTenant
+          # RequestResponse-invokes it to provision per-tenant sandbox
+          # resources; routine-exec-git (same shared role) reaches it for the
+          # capability-private provisioning path. Deployed by the dedicated
+          # agentcore-admin module with its own least-privilege role.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-agentcore-admin",
         ]
       },
       # (was standalone managed policy "workspace_renderer_invoke")
@@ -709,7 +785,7 @@ locals {
   # Group 3: AI — Bedrock model invocation, Knowledge Bases, AgentCore
   # memory / evaluations / code interpreter.
   # ---------------------------------------------------------------------------
-  api_ai_statements = [
+  api_ai_statements = concat([
     # (was inline policy "bedrock-invoke")
     # Cross-region inference profiles (us.anthropic.claude-*) require
     # `bedrock:InvokeModel` on the *inference-profile* ARN AND on the
@@ -750,6 +826,18 @@ locals {
         "bedrock:GetIngestionJob",
         "bedrock:ListIngestionJobs",
         "bedrock:Retrieve",
+        # THINK-193 U7: knowledge-base-manager reconciles the per-document
+        # manifest after successful syncs (List/Get) and gates deletion
+        # settlement on Get + the scoped Retrieve above. Ingest/Delete cover
+        # the explicit direct-delete path for S3 RETAIN'd documents — the
+        # manager never races them with StartIngestionJob. The workspace-
+        # bucket S3 read the memory-stage-worker needs for document text is
+        # already granted by the shared role's workspace "s3-access"
+        # statement (data-plane group).
+        "bedrock:ListKnowledgeBaseDocuments",
+        "bedrock:GetKnowledgeBaseDocuments",
+        "bedrock:IngestKnowledgeBaseDocuments",
+        "bedrock:DeleteKnowledgeBaseDocuments",
       ]
       # CreateKnowledgeBase/CreateDataSource have no resource ARN at create
       # time and don't support resource-level scoping, so a knowledge-base/*
@@ -818,7 +906,47 @@ locals {
       ]
       Resource = "*"
     },
-  ]
+    ],
+    # THINK-316 U2 — request path receives data-plane invocation only.
+    # Provisioning/version/endpoint/PassRole rights belong to Terraform's
+    # dedicated Harness lifecycle and never reach a chat Lambda.
+    #
+    # CRITICAL: never grant `bedrock-agentcore:InvokeAgentRuntimeCommand`
+    # anywhere — it bypasses Harness allowedTools enforcement. Invocation goes
+    # through InvokeHarness / InvokeAgentRuntime only.
+    var.enable_agentcore_harness_invocation ? [
+      {
+        # Data plane — invoke a Harness (and its runtime endpoints) directly.
+        Sid    = "AgentCoreHarnessInvoke"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:InvokeHarness",
+          "bedrock-agentcore:InvokeAgentRuntime",
+        ]
+        Resource = ["arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:harness/*"]
+      },
+      {
+        # The deterministic report adapter uses the same AgentCore Identity
+        # chain as Harness Gateway outbound auth: turn JWT -> workload token
+        # -> OBO Gateway token. No provider client secret enters Lambda.
+        Sid    = "AgentCoreHarnessGatewayIdentity"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
+          "bedrock-agentcore:GetWorkloadAccessTokenForUserId",
+          "bedrock-agentcore:GetResourceOauth2Token",
+          "bedrock-agentcore:CompleteResourceTokenAuth",
+        ]
+        Resource = [
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:workload-identity-directory/default",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:workload-identity-directory/default/workload-identity/thinkwork-${var.stage}-multiplayer-proof",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default/oauth2credentialprovider/thinkwork-${var.stage}-proof-oauth",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default/oauth2credentialprovider/thinkwork-${var.stage}-twenty-crm",
+        ]
+      },
+    ] : [],
+  )
 
   # ---------------------------------------------------------------------------
   # Group 4: observability — CloudWatch Logs reads, ECS/ALB health reads.
@@ -914,6 +1042,33 @@ locals {
   )
 
   api_observability_statements = concat(local.api_observability_sqs_statements, [
+    # Backend notification publishing is IAM-only. Scope the shared API
+    # execution role to the NONE-resolver mutation fields; end-user identity-
+    # pool credentials have no AppSync grant. This statement lives in the
+    # observability envelope for size balance: adding subscription invalidation
+    # pushed the data-plane policy over IAM's 6,144-character hard cap.
+    {
+      Sid    = "PublishAppSyncNotifications"
+      Effect = "Allow"
+      Action = ["appsync:GraphQL"]
+      Resource = [
+        for field in [
+          "notifyAgentStatus",
+          "notifyNewMessage",
+          "notifyHeartbeatActivity",
+          "notifyThreadActivity",
+          "notifyThreadUpdate",
+          "notifyInboxItemUpdate",
+          "notifyThreadTurnUpdate",
+          "notifyThreadTurnStep",
+          "notifyOrgUpdate",
+          "notifyCostRecorded",
+          "notifyEvalRunUpdate",
+          "notifyWorkspaceAccessRevoked",
+          "invalidateSubscription",
+        ] : "arn:aws:appsync:${var.region}:${var.account_id}:apis/${var.appsync_api_id}/types/Mutation/fields/${field}"
+      ]
+    },
     # (was inline policy "cloudwatch-logs-read")
     {
       Effect = "Allow"
@@ -957,16 +1112,41 @@ locals {
       Resource = "*"
     },
   ])
+
+  api_grouped_policy_documents = {
+    data_plane = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_data_plane_statements
+    })
+    orchestration = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_orchestration_statements
+    })
+    ai = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_ai_statements
+    })
+    observability = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_observability_statements
+    })
+  }
+}
+
+check "api_grouped_managed_policy_sizes" {
+  assert {
+    condition = alltrue([
+      for document in values(local.api_grouped_policy_documents) : length(document) <= 6144
+    ])
+    error_message = "Each grouped API managed-policy document must remain within AWS IAM's 6,144-character limit."
+  }
 }
 
 resource "aws_iam_policy" "api_data_plane" {
   name        = "thinkwork-${var.stage}-api-data-plane"
   description = "Grouped data-plane grants (RDS Data API, Secrets Manager, S3, DynamoDB, Cognito, SSM, KMS-via-SSM, SQS) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_data_plane_statements
-  })
+  policy = local.api_grouped_policy_documents.data_plane
 }
 
 resource "aws_iam_role_policy_attachment" "api_data_plane" {
@@ -978,10 +1158,7 @@ resource "aws_iam_policy" "api_orchestration" {
   name        = "thinkwork-${var.stage}-api-orchestration"
   description = "Grouped orchestration grants (Lambda invoke, EventBridge Scheduler, Step Functions, SES) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_orchestration_statements
-  })
+  policy = local.api_grouped_policy_documents.orchestration
 }
 
 resource "aws_iam_role_policy_attachment" "api_orchestration" {
@@ -993,10 +1170,7 @@ resource "aws_iam_policy" "api_ai" {
   name        = "thinkwork-${var.stage}-api-ai"
   description = "Grouped AI grants (Bedrock invoke, Knowledge Bases, AgentCore memory/eval/code-interpreter) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_ai_statements
-  })
+  policy = local.api_grouped_policy_documents.ai
 }
 
 resource "aws_iam_role_policy_attachment" "api_ai" {
@@ -1008,10 +1182,7 @@ resource "aws_iam_policy" "api_observability" {
   name        = "thinkwork-${var.stage}-api-observability"
   description = "Grouped observability grants (CloudWatch Logs reads, ECS/ALB health reads) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_observability_statements
-  })
+  policy = local.api_grouped_policy_documents.observability
 }
 
 resource "aws_iam_role_policy_attachment" "api_observability" {

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -20,6 +20,17 @@ data "aws_caller_identity" "current" {}
 
 locals {
   okf_efs_vpc_enabled = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
+  # Handlers that open direct Postgres connections to registered analyst data
+  # sources. VPC-attaching them (analyst_egress_subnet_ids) gives their egress
+  # the NAT gateway's stable EIP, which external databases behind an IP
+  # allowlist can admit — a non-VPC Lambda egresses from the shared AWS pool
+  # and can never satisfy such an allowlist.
+  analyst_vpc_enabled = length(var.analyst_egress_subnet_ids) > 0 && length(var.analyst_egress_security_group_ids) > 0
+  analyst_vpc_handlers = toset([
+    "graphql-http",
+    "analyst-query-broker",
+    "analyst-connection-reconciler",
+  ])
   # Constructed rather than read from aws_apigatewayv2_stage.default.invoke_url
   # (the two are identical for an HTTP API's $default stage). Reading it off
   # the stage made every Lambda's env depend on the stage, which forbids the
@@ -62,6 +73,14 @@ resource "aws_apigatewayv2_stage" "default" {
     throttling_burst_limit = 20
   }
 
+  # Session revocation is authenticated and independently rate-limited in the
+  # handler per principal. This edge throttle also bounds aggregate abuse.
+  route_settings {
+    route_key              = "POST /api/auth/revoke"
+    throttling_rate_limit  = 5
+    throttling_burst_limit = 10
+  }
+
   # UpdateStage 404s ("Unable to find Route by key … within the provided
   # RouteSettings") if the stage update races the route creation — Terraform
   # sees no reference edge between route_settings.route_key and the route
@@ -245,3 +264,19 @@ resource "aws_lambda_permission" "placeholder_apigw" {
   principal     = "apigateway.amazonaws.com"
   source_arn    = "${aws_apigatewayv2_api.main.execution_arn}/*/*"
 }
+resource "terraform_data" "auth_migration_recovery_deadline_guard" {
+  input = {
+    phase    = var.auth_retirement_phase
+    deadline = var.auth_migration_recovery_deadline
+  }
+
+  lifecycle {
+    precondition {
+      condition = var.auth_retirement_phase != "coexistence" || (
+        trimspace(var.auth_migration_recovery_deadline) != "" &&
+        can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+      )
+      error_message = "auth_migration_recovery_deadline must be an RFC3339 timestamp when auth_retirement_phase is coexistence."
+    }
+  }
+}

package/dist/terraform/modules/app/lambda-api/mcp-oauth.tf

@@ -1,8 +1,185 @@
 locals {
-  mcp_oauth_api_base_url       = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
-  mcp_oauth_cognito_base_url   = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
-  mcp_oauth_identity_providers = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
-  mcp_oauth_logo_path          = "${path.module}/../../../../apps/web/public/logo.png"
+  mcp_oauth_api_base_url          = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
+  mcp_oauth_cognito_base_url      = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
+  mcp_oauth_identity_providers    = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
+  mcp_oauth_logo_path             = "${path.module}/../../../../apps/web/public/logo.png"
+  agentcore_turn_assertion_issuer = "${local.mcp_oauth_api_base_url}/agentcore"
+  agentcore_harness_audience      = "urn:thinkwork:${var.stage}:agentcore:harness"
+  agentcore_gateway_audience      = "urn:thinkwork:${var.stage}:agentcore:gateway"
+  agentcore_turn_assertion_keys = {
+    for version, key in aws_kms_key.agentcore_turn_assertion : version => {
+      key_id = key.arn
+      # A version label alone is not globally unique: destroying and
+      # reprovisioning v1 creates different RSA material while downstream JWT
+      # validators may still cache the old public key under the same kid.
+      # Bind the kid to the immutable KMS key id so a reprovision is observed
+      # as a real key rotation instead of an invalid-signature outage.
+      kid = "thinkwork-${var.stage}-agentcore-turn-${version}-${substr(key.key_id, 0, 8)}"
+    }
+  }
+  agentcore_turn_assertion_active_key = try(
+    local.agentcore_turn_assertion_keys[var.agentcore_turn_assertion_active_key_version],
+    { key_id = "", kid = "" },
+  )
+}
+
+# THINK-316 U1: short-lived CUSTOM_JWT assertions are signed by KMS so private
+# key material never enters Lambda configuration or process memory. The key
+# policy is the capability boundary: the dedicated mint role can Sign, while
+# the shared mcp-oauth role can only fetch the public key for JWKS publication.
+resource "aws_iam_role" "turn_assertion_mint" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-turn-assertion-mint-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "turn_assertion_mint_basic" {
+  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  role       = aws_iam_role.turn_assertion_mint[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+# The synthetic OAuth provider and boundary target are public proof surfaces
+# but need no AWS data-plane permissions. A sibling logs-only role prevents a
+# parser defect from inheriting the shared API role or its platform secrets.
+resource "aws_iam_role" "agentcore_proof_boundary" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-proof-boundary-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "agentcore_proof_boundary_basic" {
+  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  role       = aws_iam_role.agentcore_proof_boundary[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+# The token-exchange provider is the only proof boundary allowed to mint the
+# derived Gateway assertion. Keep that capability off the public target role.
+resource "aws_iam_role" "agentcore_proof_provider" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-proof-provider-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "agentcore_proof_provider_basic" {
+  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  role       = aws_iam_role.agentcore_proof_provider[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy" "agentcore_proof_provider_kms" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-proof-provider-key"
+  role  = aws_iam_role.agentcore_proof_provider[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["kms:Sign"]
+      Resource = [local.agentcore_turn_assertion_active_key.key_id]
+      Condition = {
+        StringEquals = {
+          "kms:SigningAlgorithm" = "RSASSA_PKCS1_V1_5_SHA_256"
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_kms_key" "agentcore_turn_assertion" {
+  for_each = var.enable_agentcore_multiplayer_proof ? toset(var.agentcore_turn_assertion_key_versions) : toset([])
+
+  description              = "ThinkWork ${var.stage} AgentCore per-turn assertion signing ${each.key}"
+  key_usage                = "SIGN_VERIFY"
+  customer_master_key_spec = "RSA_2048"
+  deletion_window_in_days  = 7
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AccountAdministration"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${var.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+    ]
+  })
+
+  tags = {
+    Name       = "thinkwork-${var.stage}-agentcore-turn-assertion-${each.key}"
+    KeyVersion = each.key
+  }
+}
+
+resource "aws_kms_alias" "agentcore_turn_assertion" {
+  for_each      = aws_kms_key.agentcore_turn_assertion
+  name          = "alias/thinkwork-${var.stage}-agentcore-turn-assertion-${each.key}"
+  target_key_id = each.value.key_id
+}
+
+# The mint role can sign with exactly the active key. The public discovery
+# handler can read all currently published public keys, but can never sign.
+resource "aws_iam_role_policy" "turn_assertion_mint_kms" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-turn-assertion-active-key"
+  role  = aws_iam_role.turn_assertion_mint[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["kms:Sign"]
+      Resource = [local.agentcore_turn_assertion_active_key.key_id]
+      Condition = {
+        StringEquals = {
+          "kms:SigningAlgorithm" = "RSASSA_PKCS1_V1_5_SHA_256"
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "turn_assertion_jwks_kms" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-turn-assertion-published-keys"
+  role  = aws_iam_role.lambda.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["kms:GetPublicKey"]
+      Resource = [for key in values(local.agentcore_turn_assertion_keys) : key.key_id]
+    }]
+  })
 }
 
 resource "aws_dynamodb_table" "mcp_oauth_revocations" {

package/dist/terraform/modules/app/lambda-api/memory-alarms.tf

@@ -0,0 +1,92 @@
+# THINK-193 U8 — external-memory compounding observability.
+#
+# Alarms here fire from metrics that EXIST without any log-group management:
+#   - AWS/Lambda Errors for the memory-stage worker and the retraction drainer
+#     (handler crashes, including ones that never reach a log line);
+#   - the wiki-compile DLQ depth (the only memory-path Lambda with an
+#     on_failure destination).
+#
+# DELIBERATELY NOT HERE — log-metric filters over the drainer's structured
+# summary line and the worker's "status=failed" line. They require the
+# /aws/lambda/<function> log groups, which only exist after a function's first
+# invocation: PutMetricFilter failed with ResourceNotFoundException on customer
+# stages taking a fresh release (dev passed only because its groups already
+# existed). Managing the groups in Terraform instead needs a coordinated state
+# import on every stage that already has the implicit group, so it is a
+# follow-up. Until then, drainer errors / dead-letters and stage failures are
+# observable through the structured logs and
+# packages/api/scripts/external-memory-readiness.ts (which reports due,
+# failed, and dead-lettered attempts directly from the ledger).
+#
+# Also runbook-only (no metric exists): source checkpoint age, graph-to-wiki
+# lag, evidence lag, deferred identity count/age.
+#
+# alarm_actions are empty: the only SNS topic in this module
+# (aws_sns_topic.cost_alerts) is the cost-alert channel — wiring memory alarms
+# into it would misroute pages. Operators subscribe a topic when the rollout
+# needs paging.
+
+
+resource "aws_cloudwatch_metric_alarm" "memory_stage_worker_lambda_errors" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-memory-stage-worker-lambda-errors"
+  alarm_description   = "memory-stage-worker Lambda crashed (unhandled error, retries pinned to 0, no failure destination) — the parked workflow run will need a redrive."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["memory-stage-worker"].function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "memory_retraction_drainer_lambda_errors" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-memory-retraction-drainer-lambda-errors"
+  alarm_description   = "memory-retraction-drainer Lambda crashed before emitting its summary line — due retraction work is stalled until the next scheduled tick succeeds."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["memory-retraction-drainer"].function_name
+  }
+}
+
+# ---------------------------------------------------------------------------
+# wiki-compile DLQ depth (graph → wiki handoff failures)
+# ---------------------------------------------------------------------------
+
+resource "aws_cloudwatch_metric_alarm" "wiki_compile_dlq_depth" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-wiki-compile-dlq-depth"
+  alarm_description   = "wiki-compile DLQ has messages — a compile invocation crashed before the job ledger recorded an outcome; canonical pages are stale until replayed."
+  namespace           = "AWS/SQS"
+  metric_name         = "ApproximateNumberOfMessagesVisible"
+  statistic           = "Maximum"
+  period              = 60
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    QueueName = aws_sqs_queue.wiki_compile_dlq[0].name
+  }
+}