thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/app/lambda-api/msteams-app-secrets.tf

@@ -0,0 +1,46 @@
+################################################################################
+# Microsoft Teams app credentials
+#
+# Stored in Secrets Manager as a JSON blob with two fields:
+#
+#   {
+#     "app_id":        "Teams (Entra) app registration / bot app id",
+#     "client_secret": "Entra app client secret"
+#   }
+#
+# The Teams install + account-link handlers receive only this secret ARN in
+# Lambda configuration. The client_secret doubles as the HMAC signing key for
+# install state and account-link tokens — transport-only material that must
+# never appear in logs or responses. The shared Lambda role already has
+# access to the `thinkwork/*` prefix, so no additional IAM attachment is
+# needed (same as the Slack app credentials secret).
+#
+# Operators populate the real value out-of-band. Terraform creates an initial
+# empty version so Lambdas fail with a clear missing-field error before setup,
+# and lifecycle.ignore_changes prevents later applies from overwriting rotated
+# credentials.
+################################################################################
+
+resource "aws_secretsmanager_secret" "msteams_app_credentials" {
+  count       = var.enable_msteams_app ? 1 : 0
+  name        = "thinkwork/${var.stage}/msteams/app"
+  description = "Microsoft Teams app credentials (app_id, client_secret). Populate via Secrets Manager; never via tfvars."
+  tags = {
+    Name     = "thinkwork-${var.stage}-msteams-app"
+    Stage    = var.stage
+    Provider = "msteams"
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "msteams_app_credentials_initial" {
+  count     = var.enable_msteams_app ? 1 : 0
+  secret_id = aws_secretsmanager_secret.msteams_app_credentials[0].id
+  secret_string = jsonencode({
+    app_id        = ""
+    client_secret = ""
+  })
+
+  lifecycle {
+    ignore_changes = [secret_string]
+  }
+}

package/dist/terraform/modules/app/lambda-api/outputs.tf

@@ -8,6 +8,41 @@ output "api_endpoint" {
   value       = local.api_base_url
 }
 
+output "agentcore_turn_assertion_issuer" {
+  description = "Proof-only CUSTOM_JWT issuer on the regional HTTP API."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_issuer : ""
+}
+
+output "agentcore_harness_audience" {
+  description = "Purpose-bound audience for proof Harness invocations."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_harness_audience : ""
+}
+
+output "agentcore_gateway_audience" {
+  description = "Purpose-bound audience for proof Gateway operations."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_gateway_audience : ""
+}
+
+output "agentcore_turn_assertion_active_key_arn" {
+  description = "Operator-only active proof signing key ARN used by deployed verification probes."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_active_key.key_id : ""
+}
+
+output "agentcore_turn_assertion_active_kid" {
+  description = "Public JWKS key identifier for the active proof signing key."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_active_key.kid : ""
+}
+
+output "agentcore_proof_oauth_issuer" {
+  description = "Synthetic proof OAuth issuer on the regional HTTP API."
+  value       = var.enable_agentcore_multiplayer_proof ? "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth" : ""
+}
+
+output "agentcore_proof_target_base_url" {
+  description = "Regional HTTP API base URL hosting the controlled identity target."
+  value       = var.enable_agentcore_multiplayer_proof ? local.mcp_oauth_api_base_url : ""
+}
+
 output "api_execution_arn" {
   description = "API Gateway V2 execution ARN (for Lambda permissions)"
   value       = aws_apigatewayv2_api.main.execution_arn

package/dist/terraform/modules/app/lambda-api/runtime-config.tf

@@ -51,9 +51,9 @@ locals {
 # ----------------------------------------------------------------------------
 # Platform secrets (plan 2026-06-11-006 U5/R4)
 #
-# API_AUTH_SECRET and APPSYNC_API_KEY leave plaintext Lambda env: the
-# runtime-config loader prefetches these at cold start (getApiAuthSecret /
-# getAppsyncApiKey accessors, env-wins during the transition window). Names
+# API_AUTH_SECRET leaves plaintext Lambda env: the runtime-config loader
+# prefetches it at cold start (getApiAuthSecret, env-wins during the transition
+# window). Names
 # use the `thinkwork/${stage}/...` prefix so the shared role's existing
 # `secretsmanager:GetSecretValue` grant on `thinkwork/*` covers them.
 # The env copies in common_env are dropped one release AFTER this ships
@@ -83,24 +83,6 @@ resource "aws_secretsmanager_secret_version" "api_auth" {
   # console.
 }
 
-resource "aws_secretsmanager_secret" "appsync_api_key" {
-  name        = "thinkwork/${var.stage}/appsync-api-key"
-  description = "AppSync API key for subscription notify fan-out. Prefetched at Lambda cold start by @thinkwork/runtime-config."
-  tags = {
-    Name  = "thinkwork-${var.stage}-appsync-api-key"
-    Stage = var.stage
-  }
-}
-
-resource "aws_secretsmanager_secret_version" "appsync_api_key" {
-  secret_id     = aws_secretsmanager_secret.appsync_api_key.id
-  secret_string = var.appsync_api_key
-
-  # AppSync keys are terraform-rotated (the appsync module recreates them),
-  # so track the var here — unlike api_auth there is no operator rotation
-  # path outside terraform.
-}
-
 # The standalone compliance Lambdas (anchor, export-runner) bundle the
 # runtime-config loader but run under dedicated roles that lack the shared
 # role's ssm grant. Without these, every cold start auto-prime fails

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -13,6 +13,30 @@ variable "region" {
   type        = string
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired; WorkOS callback/bridge routes exist only for explicitly configured upgrade rollback windows."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for completing legacy-session identity migration. Required while auth_retirement_phase is coexistence."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "lambda_artifact_bucket" {
   description = "S3 bucket containing Lambda deployment artifacts"
   type        = string
@@ -135,10 +159,9 @@ variable "appsync_api_url" {
   type        = string
 }
 
-variable "appsync_api_key" {
-  description = "AppSync API key"
+variable "appsync_api_id" {
+  description = "AppSync subscriptions API ID used as the subscription-ticket audience"
   type        = string
-  sensitive   = true
 }
 
 variable "kb_service_role_arn" {
@@ -146,6 +169,70 @@ variable "kb_service_role_arn" {
   type        = string
 }
 
+variable "agentcore_harness_execution_role_arn" {
+  description = "Legacy Harness execution-role input retained for module compatibility. Request-path PassRole/control-plane grants were removed by THINK-316 U2."
+  type        = string
+  default     = ""
+}
+
+variable "enable_agentcore_harness_invocation" {
+  description = "Grant only the Harness data-plane invocation actions to the request path. Harness control-plane permissions remain outside Lambda."
+  type        = bool
+  default     = false
+}
+
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Enable the non-production THINK-316 AgentCore Identity/Gateway/Harness proof surfaces. Defaults off and never changes ordinary Pi routing."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published AgentCore assertion KMS key versions. Use two only during the bounded rotation overlap."
+  type        = list(string)
+  default     = ["v1"]
+
+  validation {
+    condition = (
+      length(var.agentcore_turn_assertion_key_versions) >= 1 &&
+      length(var.agentcore_turn_assertion_key_versions) <= 2 &&
+      length(distinct(var.agentcore_turn_assertion_key_versions)) == length(var.agentcore_turn_assertion_key_versions) &&
+      alltrue([for version in var.agentcore_turn_assertion_key_versions : can(regex("^[a-z0-9][a-z0-9-]{0,15}$", version))])
+    )
+    error_message = "agentcore_turn_assertion_key_versions must contain one or two unique lowercase version labels."
+  }
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "Published AgentCore assertion key version used for new signatures."
+  type        = string
+  default     = "v1"
+
+  validation {
+    condition     = contains(var.agentcore_turn_assertion_key_versions, var.agentcore_turn_assertion_active_key_version)
+    error_message = "agentcore_turn_assertion_active_key_version must be present in agentcore_turn_assertion_key_versions."
+  }
+}
+
+variable "agentcore_proof_oauth_client_id" {
+  description = "Synthetic OAuth client id used only by the THINK-316 proof provider."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_proof_oauth_client_secret" {
+  description = "Synthetic OAuth client secret used only by the THINK-316 proof provider and boundary target."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "agentcore_proof_owner_allowlist" {
+  description = "Comma-separated synthetic subjects used by the THINK-316 manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants do not require registration here."
+  type        = string
+  default     = ""
+}
+
 variable "certificate_arn" {
   description = "ACM certificate ARN for custom API domain"
   type        = string
@@ -273,6 +360,18 @@ variable "memory_engine" {
   }
 }
 
+variable "analyst_egress_subnet_ids" {
+  description = "Private (NAT-routed) subnet IDs for VPC-attaching the analyst data-path handlers (graphql-http, analyst-query-broker, analyst-connection-reconciler) so external Postgres sources can allowlist the stack's stable NAT egress IP. Leave empty to keep the handlers outside any VPC."
+  type        = list(string)
+  default     = []
+}
+
+variable "analyst_egress_security_group_ids" {
+  description = "Security group IDs for the VPC-attached analyst data-path handlers. Leave empty to keep the handlers outside any VPC."
+  type        = list(string)
+  default     = []
+}
+
 variable "okf_efs_subnet_ids" {
   description = "Subnet IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
   type        = list(string)
@@ -435,6 +534,12 @@ variable "enable_slack_workspace_app" {
   default     = true
 }
 
+variable "enable_msteams_app" {
+  description = "Provision Microsoft Teams app Lambdas, API routes, and credentials placeholder secret."
+  type        = bool
+  default     = false
+}
+
 variable "appsync_realtime_url" {
   description = "AppSync realtime/WebSocket endpoint URL"
   type        = string
@@ -513,6 +618,12 @@ variable "knowledge_graph_observations_ingest_enabled" {
   default     = false
 }
 
+variable "ontology_scan_sweep_enabled" {
+  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled; enabled per stage once the Living Map review surfaces land."
+  type        = bool
+  default     = false
+}
+
 variable "wiki_source" {
   description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer over the knowledge-graph mirror and makes successful observation-ingest runs the compile trigger. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
   type        = string
@@ -764,6 +875,24 @@ variable "capability_signing_private_key_secret" {
   default     = ""
 }
 
+variable "subscription_ticket_signing_key_id" {
+  description = "Active Ed25519 subscription-ticket signing key ID."
+  type        = string
+  default     = ""
+}
+
+variable "subscription_ticket_public_keys" {
+  description = "JSON verifier keyring for AppSync subscription tickets; contains public material only."
+  type        = string
+  default     = "[]"
+}
+
+variable "subscription_ticket_private_key_secret" {
+  description = "Secrets Manager name holding the isolated subscription-ticket Ed25519 private key."
+  type        = string
+  default     = ""
+}
+
 # ---------------------------------------------------------------------------
 # THINK-228 U3 — analyst query broker runtime config
 # ---------------------------------------------------------------------------
@@ -790,6 +919,12 @@ variable "analyst_policy_source" {
   }
 }
 
+variable "capability_self_extension_tenants" {
+  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed. Read via getConfig() in capability-control-service."
+  type        = string
+  default     = ""
+}
+
 variable "analyst_db_cluster_resource_id" {
   description = "Immutable RDS cluster resource ID (cluster-XXXX / db-XXXX) for the stage database (THINK-229 U1). Wired from `module.database.cluster_resource_id`. Keys the broker's `rds-db:connect` IAM grant — the rds-db ARN format requires the resource ID, not the cluster ARN — and gates the IAM connect env on the broker Lambda: when empty, the broker stays on the password path."
   type        = string
@@ -801,3 +936,53 @@ variable "artifact_delivery_from_email" {
   type        = string
   default     = ""
 }
+
+variable "enable_capability_broker" {
+  description = "THINK-280 U8 rollout gate (default off). When true, the governed capability runtime's external MCP search facade (/mcp/capabilities) and the Inspector governed-runtime operation layer are enabled for the stage. The external-search leg is the LAST rollout stage (shadow → internal search → private broker dogfood → promotion/tracer → external search): keep this false until the earlier stages are proven for the stage. When false every U8 surface is inert and returns no data — the handler and route still deploy, but read nothing."
+  type        = bool
+  default     = false
+}
+
+# THINK-280 — sandbox provisioning + capability broker wiring. -----------------
+variable "agentcore_admin_lambda_arn" {
+  description = "ARN of the agentcore-admin Lambda (AGENTCORE_ADMIN_LAMBDA_ARN on graphql-http). createTenant RequestResponse-invokes it. Empty when the Lambda is not deployed."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_admin_token" {
+  description = "Bearer token graphql-http presents when invoking agentcore-admin (AGENTCORE_ADMIN_TOKEN). Must match the token the admin Lambda validates. Empty when not deployed."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "capability_broker_session_table" {
+  description = "DynamoDB broker session table name (CAPABILITY_BROKER_SESSION_TABLE). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_session_table_arn" {
+  description = "ARN of the broker session table — grants routine-exec-git DynamoDB access to mint/advance PoP sessions. Empty when the broker is disabled (no grant)."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_audience" {
+  description = "Capability broker PoP audience (CAPABILITY_BROKER_AUDIENCE). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_api_id" {
+  description = "Capability broker private REST API id (CAPABILITY_BROKER_API_ID). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}
+
+variable "capability_broker_vpce_dns" {
+  description = "Capability broker execute-api VPCE DNS name (CAPABILITY_BROKER_VPCE_DNS). Empty when the broker is disabled."
+  type        = string
+  default     = ""
+}

package/dist/terraform/modules/app/workflow-interpreter-stepfunctions/alarms.tf

@@ -0,0 +1,47 @@
+# THINK-193 U8 — workflow-interpreter execution failure alarms.
+#
+# Terminal FAILED/TIMED_OUT/ABORTED executions are projected onto the run
+# row by workflow-execution-callback (DB, not a parseable log line), so the
+# reliable infrastructure signal is the Step Functions service metrics on
+# the interpreter state machine itself. Memory workflows (personal +
+# shared) execute through this machine — an execution failure here is the
+# "workflow-interpreter execution failures" rollout gate signal.
+#
+# alarm_actions are empty: no paging SNS topic exists in this module.
+# Operators subscribe one when the rollout needs paging.
+
+resource "aws_cloudwatch_metric_alarm" "interpreter_executions_failed" {
+  alarm_name          = "thinkwork-${var.stage}-workflow-interpreter-executions-failed"
+  alarm_description   = "Workflow-interpreter Step Functions executions FAILED — check the run's timeline (workflow_step_failed events) and the execution history."
+  namespace           = "AWS/States"
+  metric_name         = "ExecutionsFailed"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    StateMachineArn = aws_sfn_state_machine.interpreter.arn
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "interpreter_executions_timed_out" {
+  alarm_name          = "thinkwork-${var.stage}-workflow-interpreter-executions-timed-out"
+  alarm_description   = "Workflow-interpreter Step Functions executions TIMED_OUT — a parked task token (approval / memory stage) was never resolved within the execution timeout."
+  namespace           = "AWS/States"
+  metric_name         = "ExecutionsTimedOut"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    StateMachineArn = aws_sfn_state_machine.interpreter.arn
+  }
+}

package/dist/terraform/modules/app/workflow-interpreter-stepfunctions/main.tf

@@ -211,8 +211,8 @@ resource "aws_iam_role_policy" "execution_states" {
 #
 # See KTD1 for the loop shape. Directives are the FROZEN protocol the
 # step-dispatch Lambda emits: dispatch_agent, wait_until, execute_step,
-# await_approval, continue, rollover, terminal_success, terminal_failure,
-# terminal_canceled.
+# await_approval, await_memory_stage, continue, rollover, terminal_success,
+# terminal_failure, terminal_canceled.
 ################################################################################
 
 resource "aws_sfn_state_machine" "interpreter" {
@@ -254,6 +254,7 @@ resource "aws_sfn_state_machine" "interpreter" {
           { Variable = "$.directive", StringEquals = "wait_until", Next = "WaitState" },
           { Variable = "$.directive", StringEquals = "execute_step", Next = "ExecuteStep" },
           { Variable = "$.directive", StringEquals = "await_approval", Next = "ApprovalStep" },
+          { Variable = "$.directive", StringEquals = "await_memory_stage", Next = "MemoryStageStep" },
           { Variable = "$.directive", StringEquals = "continue", Next = "LoadNextStep" },
           { Variable = "$.directive", StringEquals = "rollover", Next = "RolloverStart" },
           { Variable = "$.directive", StringEquals = "terminal_success", Next = "SucceedState" },
@@ -369,6 +370,46 @@ resource "aws_sfn_state_machine" "interpreter" {
         Next       = "DirectiveChoice"
       }
 
+      # ---- Memory-stage step: park on a task token while the async memory-
+      # stage worker runs one pipeline stage; the await phase Event-invokes the
+      # worker, which resumes the token via SendTaskSuccess with a result JSON.
+      MemoryStageStep = {
+        Type     = "Task"
+        Resource = "arn:aws:states:::lambda:invoke.waitForTaskToken"
+        Parameters = {
+          FunctionName = local.step_dispatch_lambda_arn
+          Payload = {
+            phase         = "await_memory_stage"
+            "cursor.$"    = "$.cursor"
+            "taskToken.$" = "$$.Task.Token"
+          }
+        }
+        ResultPath       = "$.result"
+        TimeoutSeconds   = 7200
+        HeartbeatSeconds = 3600
+        Catch = [{
+          ErrorEquals = ["States.Timeout"]
+          Next        = "FailState"
+        }]
+        Next = "RecordMemoryStage"
+      }
+
+      RecordMemoryStage = {
+        Type     = "Task"
+        Resource = "arn:aws:states:::lambda:invoke"
+        Parameters = {
+          FunctionName = local.step_dispatch_lambda_arn
+          Payload = {
+            phase      = "record_memory_stage"
+            "cursor.$" = "$.cursor"
+            "result.$" = "$.result"
+          }
+        }
+        OutputPath = "$.Payload"
+        Retry      = local.lambda_invoke_retry
+        Next       = "DirectiveChoice"
+      }
+
       # ---- Record the step outcome, evaluate policy, emit the next directive -
       RecordAdvance = {
         Type     = "Task"