thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/thinkwork/main.tf

@@ -15,6 +15,10 @@ terraform {
       source  = "hashicorp/tls"
       version = "~> 4.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "~> 5.0"
@@ -483,6 +487,34 @@ resource "terraform_data" "n8n_runtime_state_guardrails" {
     }
   }
 }
+# Egress-only SG for the VPC-attached analyst data-path Lambdas
+# (analyst_lambda_vpc_egress). Their whole point is a stable NAT egress IP for
+# external database allowlists; they accept no inbound traffic.
+resource "aws_security_group" "analyst_egress_lambda" {
+  count = var.analyst_lambda_vpc_egress ? 1 : 0
+
+  name_prefix = "thinkwork-${var.stage}-analyst-egress-"
+  description = "Egress for VPC-attached analyst data-path Lambdas"
+  vpc_id      = module.vpc.vpc_id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = { Name = "thinkwork-${var.stage}-analyst-egress-lambda-sg" }
+
+  lifecycle {
+    create_before_destroy = true
+    precondition {
+      condition     = length(module.vpc.private_subnet_ids) > 0
+      error_message = "analyst_lambda_vpc_egress requires private (NAT-routed) subnets — a Lambda in a public subnet has no internet egress."
+    }
+  }
+}
+
 resource "aws_security_group" "okf_wiki_lambda" {
   count = var.okf_wiki_efs_enabled ? 1 : 0
 
@@ -704,24 +736,35 @@ module "cognito" {
   stage  = var.stage
   region = var.region
 
-  create_cognito            = var.create_cognito
-  existing_user_pool_id     = var.existing_user_pool_id
-  existing_user_pool_arn    = var.existing_user_pool_arn
-  existing_admin_client_id  = var.existing_admin_client_id
-  existing_mobile_client_id = var.existing_mobile_client_id
-  existing_identity_pool_id = var.existing_identity_pool_id
-
-  google_oauth_client_id     = var.google_oauth_client_id
-  google_oauth_client_secret = var.google_oauth_client_secret
-  oidc_identity_providers    = var.oidc_identity_providers
-  saml_identity_providers    = var.saml_identity_providers
-  pre_signup_lambda_zip      = var.pre_signup_lambda_zip
-  custom_auth_lambda_zip     = var.cognito_custom_auth_lambda_zip
-  api_auth_secret            = var.api_auth_secret
-  email_source_arn           = var.cognito_email_source_arn
-  from_email_address         = var.cognito_from_email_address
-  reply_to_email_address     = var.cognito_reply_to_email_address
-  invite_email_subject       = var.cognito_invite_email_subject
+  create_cognito              = var.create_cognito
+  existing_user_pool_id       = var.existing_user_pool_id
+  existing_user_pool_arn      = var.existing_user_pool_arn
+  existing_admin_client_id    = var.existing_admin_client_id
+  existing_mobile_client_id   = var.existing_mobile_client_id
+  existing_identity_pool_id   = var.existing_identity_pool_id
+  existing_auth_route_clients = var.existing_auth_route_clients
+
+  google_oauth_client_id                = var.google_oauth_client_id
+  google_oauth_client_secret            = var.google_oauth_client_secret
+  microsoft_oauth_client_id             = var.microsoft_oauth_client_id
+  microsoft_oauth_client_secret         = var.microsoft_oauth_client_secret
+  microsoft_oauth_tenant                = var.microsoft_oauth_tenant
+  tenant_entra_connections              = var.tenant_entra_connections
+  oidc_identity_providers               = var.oidc_identity_providers
+  saml_identity_providers               = var.saml_identity_providers
+  pre_signup_lambda_zip                 = var.pre_signup_lambda_zip
+  auth_retirement_phase                 = var.auth_retirement_phase
+  custom_auth_lambda_zip                = var.cognito_custom_auth_lambda_zip
+  custom_auth_lambda_s3_bucket          = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
+  custom_auth_lambda_s3_key             = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-custom-auth.zip" : ""
+  api_auth_secret                       = var.api_auth_secret
+  pre_token_generation_lambda_s3_bucket = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
+  pre_token_generation_lambda_s3_key    = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-pre-token-client-deny.zip" : ""
+  denied_app_client_ids                 = var.cognito_denied_app_client_ids
+  email_source_arn                      = var.cognito_email_source_arn
+  from_email_address                    = var.cognito_from_email_address
+  reply_to_email_address                = var.cognito_reply_to_email_address
+  invite_email_subject                  = var.cognito_invite_email_subject
   invite_email_message = (
     var.cognito_invite_email_message != ""
     ? var.cognito_invite_email_message
@@ -752,8 +795,12 @@ module "cognito" {
     local.customer_domain_legacy_retired ? [] : (local.legacy_end_user_app_domain != "" ? ["https://${local.legacy_end_user_app_domain}", "https://${local.legacy_end_user_app_domain}/auth/callback"] : []),
     local.customer_domain_web_enabled ? ["https://${var.customer_domain}", "https://${var.customer_domain}/auth/callback"] : [],
     local.customer_domain_legacy_retired ? [] : (var.computer_domain != "" ? ["https://${var.computer_domain}", "https://${var.computer_domain}/auth/callback"] : []),
-    ["http://localhost:5180", "http://localhost:5180/auth/callback"],
-    var.desktop_callback_urls
+    [
+      "http://localhost:5180",
+      "http://localhost:5180/auth/callback",
+      "http://127.0.0.1:5180",
+      "http://127.0.0.1:5180/auth/callback",
+    ]
   ))
   admin_logout_urls = distinct(concat(
     var.admin_logout_urls,
@@ -761,10 +808,11 @@ module "cognito" {
     local.customer_domain_legacy_retired ? [] : (local.legacy_end_user_app_domain != "" ? ["https://${local.legacy_end_user_app_domain}"] : []),
     local.customer_domain_web_enabled ? ["https://${var.customer_domain}"] : [],
     local.customer_domain_legacy_retired ? [] : (var.computer_domain != "" ? ["https://${var.computer_domain}"] : []),
-    ["http://localhost:5180"],
-    var.desktop_callback_urls
+    ["http://localhost:5180", "http://127.0.0.1:5180"]
   ))
   desktop_callback_urls = var.desktop_callback_urls
+  cli_callback_urls     = var.cli_callback_urls
+  cli_logout_urls       = var.cli_logout_urls
   mobile_callback_urls  = var.mobile_callback_urls
   mobile_logout_urls    = var.mobile_logout_urls
 }
@@ -892,6 +940,7 @@ module "appsync" {
 
   stage               = var.stage
   region              = var.region
+  account_id          = var.account_id
   user_pool_id        = module.cognito.user_pool_id
   subscription_schema = local.subscription_schema
 }
@@ -940,6 +989,23 @@ resource "tls_private_key" "capability_signing" {
   algorithm = "ED25519"
 }
 
+resource "random_password" "agentcore_proof_oauth_client_secret" {
+  count   = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  length  = 48
+  special = false
+}
+
+check "agentcore_multiplayer_proof_requires_harness" {
+  assert {
+    condition = !var.enable_agentcore_multiplayer_proof || (
+      var.enable_agentcore_harness &&
+      can(regex("^[a-z0-9][a-z0-9-]{0,47}$", var.agentcore_multiplayer_proof_tenant_slug)) &&
+      length(distinct(compact([for owner in split(",", var.agentcore_multiplayer_proof_owner_allowlist) : trimspace(owner)]))) >= 2
+    )
+    error_message = "enable_agentcore_multiplayer_proof requires enable_agentcore_harness, an explicit lowercase tenant slug, and at least two explicit distinct proof owner subjects."
+  }
+}
+
 resource "aws_secretsmanager_secret" "capability_signing_key" {
   name        = "thinkwork/${var.stage}/capability-signing-key"
   description = "Ed25519 private key (PKCS8 PEM) signing capability sidecars and manifests (THINK-173)."
@@ -950,15 +1016,40 @@ resource "aws_secretsmanager_secret_version" "capability_signing_key" {
   secret_string = tls_private_key.capability_signing.private_key_pem
 }
 
+# AppSync subscription tickets use a separate key and domain from capability
+# envelopes. The authorizer receives only the public key; ticket issuance
+# resolves the private key by secret name at runtime.
+resource "tls_private_key" "subscription_ticket_signing" {
+  algorithm = "ED25519"
+}
+
+resource "aws_secretsmanager_secret" "subscription_ticket_signing_key" {
+  name        = "thinkwork/${var.stage}/subscription-ticket-signing-key"
+  description = "Ed25519 private key signing one-use AppSync subscription tickets."
+}
+
+resource "aws_secretsmanager_secret_version" "subscription_ticket_signing_key" {
+  secret_id     = aws_secretsmanager_secret.subscription_ticket_signing_key.id
+  secret_string = tls_private_key.subscription_ticket_signing.private_key_pem
+}
+
 module "api" {
   source = "../app/lambda-api"
 
   capability_signing_public_key         = tls_private_key.capability_signing.public_key_pem
   capability_signing_private_key_secret = aws_secretsmanager_secret.capability_signing_key.name
+  subscription_ticket_signing_key_id    = "${var.stage}-subscription-v1"
+  subscription_ticket_public_keys = jsonencode([{
+    keyId     = "${var.stage}-subscription-v1"
+    publicKey = tls_private_key.subscription_ticket_signing.public_key_pem
+  }])
+  subscription_ticket_private_key_secret = aws_secretsmanager_secret.subscription_ticket_signing_key.name
 
-  stage      = var.stage
-  account_id = var.account_id
-  region     = var.region
+  stage                            = var.stage
+  account_id                       = var.account_id
+  region                           = var.region
+  auth_retirement_phase            = var.auth_retirement_phase
+  auth_migration_recovery_deadline = var.auth_migration_recovery_deadline
 
   lambda_artifact_bucket   = var.lambda_artifact_bucket
   lambda_artifact_prefix   = var.lambda_artifact_prefix
@@ -1014,6 +1105,24 @@ module "api" {
   analyst_db_cluster_resource_id = module.database.cluster_resource_id
   analyst_policy_source          = var.analyst_policy_source
 
+  # Governed autonomy — per-tenant self-extension opt-in allowlist (default off).
+  capability_self_extension_tenants = var.capability_self_extension_tenants
+
+  # THINK-316 U2 — request path receives only Harness invocation. Terraform
+  # owns provisioning/version/endpoint control, avoiding a module cycle and
+  # keeping PassRole/create/update/list out of chat Lambdas.
+  enable_agentcore_harness_invocation = var.enable_agentcore_multiplayer_proof
+
+  # THINK-316 U1 — proof-only assertion/provider handlers remain absent unless
+  # explicitly enabled. The generated secret stays in Terraform sensitive
+  # state and is passed only to the two narrow boundary Lambdas and Identity.
+  enable_agentcore_multiplayer_proof          = var.enable_agentcore_multiplayer_proof
+  agentcore_turn_assertion_key_versions       = var.agentcore_turn_assertion_key_versions
+  agentcore_turn_assertion_active_key_version = var.agentcore_turn_assertion_active_key_version
+  agentcore_proof_oauth_client_id             = "thinkwork-${var.stage}-agentcore-proof"
+  agentcore_proof_oauth_client_secret         = var.enable_agentcore_multiplayer_proof ? random_password.agentcore_proof_oauth_client_secret[0].result : ""
+  agentcore_proof_owner_allowlist             = var.agentcore_multiplayer_proof_owner_allowlist
+
   # Phase 3 U8b — KMS key + Object Lock mode forwarded as
   # COMPLIANCE_ANCHOR_KMS_KEY_ARN and COMPLIANCE_ANCHOR_OBJECT_LOCK_MODE
   # env vars on the anchor Lambda. The live `_anchor_fn_live` requires
@@ -1043,8 +1152,8 @@ module "api" {
   mobile_client_id    = module.cognito.mobile_client_id
   cognito_auth_domain = module.cognito.auth_domain
 
+  appsync_api_id  = module.appsync.graphql_api_id
   appsync_api_url = module.appsync.graphql_api_url
-  appsync_api_key = module.appsync.graphql_api_key
 
   kb_service_role_arn = module.bedrock_kb.kb_service_role_arn
 
@@ -1061,6 +1170,8 @@ module "api" {
   memory_engine                         = local.resolved_memory_engine
   okf_efs_subnet_ids                    = var.okf_wiki_efs_enabled ? local.okf_wiki_subnet_ids : []
   okf_efs_security_group_ids            = var.okf_wiki_efs_enabled ? [aws_security_group.okf_wiki_lambda[0].id] : []
+  analyst_egress_subnet_ids             = var.analyst_lambda_vpc_egress ? module.vpc.private_subnet_ids : []
+  analyst_egress_security_group_ids     = var.analyst_lambda_vpc_egress ? [aws_security_group.analyst_egress_lambda[0].id] : []
   okf_efs_mount_target_ids              = var.okf_wiki_efs_enabled ? aws_efs_mount_target.okf_wiki[*].id : []
   okf_efs_file_system_arn               = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].arn : ""
   okf_efs_refresh_access_point_arn      = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_refresh[0].arn : ""
@@ -1097,12 +1208,14 @@ module "api" {
   deployment_release_manifest_sha256            = var.deployment_release_manifest_sha256
   enable_stripe_billing                         = var.enable_stripe_billing
   enable_slack_workspace_app                    = var.enable_slack_workspace_app
+  enable_msteams_app                            = var.enable_msteams_app
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
   wiki_compile_model_id                         = var.wiki_compile_model_id
   brain_source_agent_model_id                   = var.brain_source_agent_model_id
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
   knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
+  ontology_scan_sweep_enabled                   = var.ontology_scan_sweep_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
   google_places_api_key                         = var.google_places_api_key
   enable_workspace_orchestration                = var.enable_workspace_orchestration
@@ -1123,6 +1236,18 @@ module "api" {
   mcp_custom_domain       = var.mcp_custom_domain
   mcp_custom_domain_ready = var.mcp_custom_domain_ready
 
+  # THINK-280 — sandbox provisioning + capability broker wiring. The admin ARN
+  # + token let graphql-http (createTenant) RequestResponse-invoke the
+  # agentcore-admin Lambda. The four CAPABILITY_BROKER_* values are EMPTY when
+  # the broker is disabled (default), so the broker-session path stays inert.
+  agentcore_admin_lambda_arn          = module.agentcore_admin.lambda_arn
+  agentcore_admin_token               = module.agentcore_admin.admin_token
+  capability_broker_session_table     = module.capability_broker.session_table_name
+  capability_broker_session_table_arn = module.capability_broker.session_table_arn
+  capability_broker_audience          = module.capability_broker.broker_audience
+  capability_broker_api_id            = module.capability_broker.private_api_id
+  capability_broker_vpce_dns          = module.capability_broker.execute_api_vpce_dns_name
+
   depends_on = [module.cognito]
 }
 
@@ -1189,6 +1314,251 @@ module "agentcore_pi" {
   okf_efs_read_access_point_arn = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_pi_read[0].arn : ""
 }
 
+# AgentCore Harness execution role and managed tenant/profile runtime. The
+# public root inputs retain their rollout-era names until the example-stack
+# compatibility window closes; this module boundary uses managed semantics.
+module "agentcore_harness" {
+  source = "../app/agentcore-harness"
+
+  enabled                       = var.enable_agentcore_harness
+  managed_runtime_enabled       = var.enable_agentcore_multiplayer_proof
+  stage                         = var.stage
+  region                        = var.region
+  account_id                    = var.account_id
+  bucket_name                   = module.s3.bucket_name
+  tenant_slug                   = var.agentcore_multiplayer_proof_tenant_slug
+  discovery_url                 = "${module.api.agentcore_turn_assertion_issuer}/.well-known/openid-configuration"
+  harness_audience              = module.api.agentcore_harness_audience
+  gateway_arn                   = module.agentcore_proof_gateway.gateway_arn
+  oauth_credential_provider_arn = module.agentcore_proof_identity.credential_provider_arn
+  oauth_credential_secret_arn   = module.agentcore_proof_identity.credential_secret_arn
+  oauth_return_url              = module.agentcore_proof_identity.oauth_return_url
+}
+
+# The Harness depends on the public issuer/API, so feeding its generated ARN
+# back into the api module would create a Terraform cycle. Publish the
+# non-secret, attested readiness contract under deterministic SSM keys; the
+# runner and DeploymentStatus resolver read it server-side. No browser token,
+# participant id, credential, prompt, or private result is stored here. Keep
+# the original address during the migration so deployed runners never lose
+# their profile between releases.
+locals {
+  agentcore_harness_profile_value = jsonencode({
+    tenantSlug                     = var.agentcore_multiplayer_proof_tenant_slug
+    trustProfile                   = "default"
+    harnessArn                     = module.agentcore_harness.managed_harness_arn
+    endpointArn                    = module.agentcore_harness.managed_endpoint_arn
+    endpointName                   = module.agentcore_harness.managed_endpoint_name
+    expectedVersion                = module.agentcore_harness.managed_target_version
+    liveVersion                    = module.agentcore_harness.managed_live_version
+    modelId                        = module.agentcore_harness.managed_model_id
+    status                         = module.agentcore_harness.managed_status
+    configurationFingerprint       = module.agentcore_harness.managed_configuration_fingerprint
+    authorizerAudience             = module.api.agentcore_harness_audience
+    sessionStrategy                = "fresh"
+    gatewayArn                     = module.agentcore_proof_gateway.gateway_arn
+    gatewayUrl                     = module.agentcore_proof_gateway.gateway_url
+    gatewayTargetName              = module.agentcore_proof_gateway.target_name
+    identityWorkloadName           = module.agentcore_proof_identity.workload_identity_name
+    identityCredentialProviderName = module.agentcore_proof_identity.credential_provider_name
+    identityCredentialProviderArn  = module.agentcore_proof_identity.credential_provider_arn
+    invocationToolsContract        = "control-plane-attested-full-override-v1"
+    invocationToolsFingerprint     = module.agentcore_harness.managed_invocation_tools_fingerprint
+    invocationTools                = jsondecode(module.agentcore_harness.managed_invocation_tools_json)
+    strategyDecisionRule           = "reuse_only_if_correct_and_20_percent_benefit"
+    capacityEnvelope = {
+      activeSessions       = 100
+      newSessionsPerSecond = 10
+      minimumHeadroom      = 0.50
+    }
+  })
+}
+
+resource "aws_ssm_parameter" "agentcore_harness_proof_profile" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  name = "/thinkwork/${var.stage}/agentcore-harness-proof-profile"
+  type = "String"
+  # The exact immutable Harness tool schemas sit close to Standard's 4 KiB
+  # ceiling. Intelligent-Tiering stays Standard while possible and safely
+  # promotes only when a legitimate governed schema requires more room.
+  tier  = "Intelligent-Tiering"
+  value = local.agentcore_harness_profile_value
+
+  lifecycle {
+    precondition {
+      # Base64 expands every three UTF-8 bytes to four ASCII characters. A
+      # conservative 10,920-character ceiling admits at most 8,190 bytes and
+      # cannot cross SSM's 8 KiB Advanced parameter limit.
+      condition     = length(base64encode(local.agentcore_harness_profile_value)) <= 10920
+      error_message = "The AgentCore Harness managed profile exceeds SSM's 8 KiB parameter limit."
+    }
+  }
+
+  tags = {
+    Name                   = "thinkwork-${var.stage}-agentcore-harness-proof-profile"
+    "thinkwork:proof"      = "THINK-316"
+    "thinkwork:tenant"     = var.agentcore_multiplayer_proof_tenant_slug
+    "thinkwork:profile"    = "default"
+    "thinkwork:visibility" = "server-only-nonsecret"
+  }
+}
+
+# Managed per-tenant profile address. Runtime lookup reads this first and only
+# falls back to the original single-tenant key during the migration window.
+# Adding the scoped key is non-destructive and lets later tenants receive their
+# own attested profile without changing Lambda configuration or hot-path
+# control-plane resources.
+resource "aws_ssm_parameter" "agentcore_harness_profile" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  name  = "/thinkwork/${var.stage}/agentcore-harness-profiles/${var.agentcore_multiplayer_proof_tenant_slug}"
+  type  = aws_ssm_parameter.agentcore_harness_proof_profile[0].type
+  tier  = "Intelligent-Tiering"
+  value = aws_ssm_parameter.agentcore_harness_proof_profile[0].value
+
+  tags = {
+    Name                   = "thinkwork-${var.stage}-agentcore-harness-profile-${var.agentcore_multiplayer_proof_tenant_slug}"
+    "thinkwork:managed-by" = "terraform"
+    "thinkwork:tenant"     = var.agentcore_multiplayer_proof_tenant_slug
+    "thinkwork:profile"    = "default"
+    "thinkwork:visibility" = "server-only-nonsecret"
+  }
+}
+
+# Publish the new immutable endpoint/profile first, then reclaim older
+# endpoint versions. Retain the active endpoint plus exactly one prior endpoint
+# for guarded rollback; the dedicated Harness owns no unrelated endpoints.
+resource "terraform_data" "agentcore_harness_endpoint_retention" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  triggers_replace = {
+    active_endpoint = module.agentcore_harness.managed_endpoint_name
+    profile_digest  = module.agentcore_harness.managed_configuration_fingerprint
+  }
+
+  provisioner "local-exec" {
+    command = "bash ${path.module}/../app/agentcore-harness/scripts/prune_harness.sh"
+    environment = {
+      AWS_REGION           = var.region
+      HARNESS_ID           = module.agentcore_harness.managed_harness_id
+      ACTIVE_ENDPOINT_NAME = module.agentcore_harness.managed_endpoint_name
+      ENDPOINT_PREFIX      = "ThinkworkProofV"
+      LEGACY_ENDPOINT_NAME = "ThinkworkProof"
+    }
+  }
+
+  depends_on = [
+    aws_ssm_parameter.agentcore_harness_proof_profile,
+    aws_ssm_parameter.agentcore_harness_profile,
+  ]
+}
+
+# THINK-316 U1 proof-only Identity and Gateway plane. These resources use the
+# regional execute-api URL because the dev account rejects public Lambda
+# Function URLs and a custom domain may be unavailable in a fresh stage.
+module "agentcore_proof_identity" {
+  source = "../app/agentcore-identity"
+
+  enabled             = var.enable_agentcore_multiplayer_proof
+  stage               = var.stage
+  region              = var.region
+  account_id          = var.account_id
+  oauth_issuer        = module.api.agentcore_proof_oauth_issuer
+  oauth_client_id     = "thinkwork-${var.stage}-agentcore-proof"
+  oauth_client_secret = var.enable_agentcore_multiplayer_proof ? random_password.agentcore_proof_oauth_client_secret[0].result : ""
+  user_federation_return_urls = [
+    "${module.api.api_endpoint}/api/skills/mcp-oauth/agentcore/complete",
+  ]
+}
+
+module "agentcore_proof_gateway" {
+  source = "../app/agentcore-gateway"
+
+  enabled                       = var.enable_agentcore_multiplayer_proof
+  stage                         = var.stage
+  region                        = var.region
+  account_id                    = var.account_id
+  discovery_url                 = "${module.api.agentcore_turn_assertion_issuer}/.well-known/openid-configuration"
+  gateway_audience              = module.api.agentcore_gateway_audience
+  target_base_url               = module.api.agentcore_proof_target_base_url
+  oauth_credential_provider_arn = module.agentcore_proof_identity.credential_provider_arn
+  oauth_credential_secret_arn   = module.agentcore_proof_identity.credential_secret_arn
+  oauth_return_url              = module.agentcore_proof_identity.oauth_return_url
+  proof_owner_allowlist         = var.agentcore_multiplayer_proof_owner_allowlist
+}
+
+# Capability Broker (THINK-280 U3) — ship-inert, gated by
+# var.enable_capability_broker (default false). When off, this module creates
+# nothing; the broker Lambda code also fails closed. Owns a DEDICATED
+# execute-api VPCE with private DNS disabled — never folded into
+# okf_wiki_interface_endpoint_services (THINK-144).
+module "capability_broker" {
+  source = "../app/capability-broker"
+
+  enabled    = var.enable_capability_broker
+  stage      = var.stage
+  account_id = var.account_id
+  region     = var.region
+
+  vpc_id         = module.vpc.vpc_id
+  vpc_cidr_block = module.vpc.vpc_cidr_block
+  subnet_ids     = local.okf_wiki_subnet_ids
+
+  db_cluster_arn      = module.database.db_cluster_arn
+  db_secret_arn       = module.database.graphql_db_secret_arn
+  db_cluster_endpoint = module.database.cluster_endpoint
+  db_password         = var.db_password
+  database_name       = var.database_name
+
+  lambda_zips_dir        = var.lambda_zips_dir
+  lambda_artifact_bucket = var.lambda_artifact_bucket
+  lambda_artifact_prefix = var.lambda_artifact_prefix
+}
+
+# AgentCore Code Interpreter substrate (THINK-280). Stage-level ECR repo +
+# per-tenant IAM policy templates the agentcore-admin Lambda consumes. The
+# capability-private VPC placement passes through from the broker outputs —
+# EMPTY lists when the broker is disabled, so the capability-private path stays
+# inert while the regular public/internal sandbox substrate deploys.
+module "agentcore_code_interpreter" {
+  source = "../app/agentcore-code-interpreter"
+
+  stage      = var.stage
+  region     = var.region
+  account_id = var.account_id
+
+  capability_private_subnet_ids         = module.capability_broker.capability_private_interpreter_subnet_ids
+  capability_private_security_group_ids = module.capability_broker.capability_private_interpreter_security_group_id != "" ? [module.capability_broker.capability_private_interpreter_security_group_id] : []
+}
+
+# AgentCore Admin control-plane Lambda (THINK-280). Regular sandbox provisioning
+# (createTenant → invokeProvisionTenantSandbox) depends on this Lambda; it was
+# previously instantiated nowhere. Dedicated least-privilege role. The
+# capability-private env is EMPTY when the broker is disabled → the handler
+# skips capability-private provisioning (ship-inert).
+module "agentcore_admin" {
+  source = "../app/agentcore-admin"
+
+  stage      = var.stage
+  region     = var.region
+  account_id = var.account_id
+
+  lambda_zips_dir        = var.lambda_zips_dir
+  lambda_artifact_bucket = var.lambda_artifact_bucket
+  lambda_artifact_prefix = var.lambda_artifact_prefix
+
+  # db_username defaults to the aurora-postgres master username
+  # ("thinkwork_admin") — same default lambda-api relies on.
+  db_password           = var.db_password
+  db_cluster_endpoint   = module.database.cluster_endpoint
+  database_name         = var.database_name
+  graphql_db_secret_arn = module.database.graphql_db_secret_arn
+
+  capability_private_subnet_ids         = module.agentcore_code_interpreter.capability_private_subnet_ids
+  capability_private_security_group_ids = module.agentcore_code_interpreter.capability_private_security_group_ids
+}
+
 # Runtime identity rename: the former dedicated Flue module is now the Pi
 # module. Move existing state to the renamed module/resource addresses so the
 # deployed Lambda, role, log group, and invoke config are updated in place.