thinkwork-cli 0.13.1 → 0.13.2

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -14,6 +14,12 @@ locals {
   # deployment jobs — plan 2026-06-12-001 U10); the TWENTY config key is
   # retired.
   optional_integration_handler_names = concat(
+    var.auth_retirement_phase == "retired" ? [
+      # The native login UI never publishes this handler. It remains reachable
+      # only as an operator-controlled rollback seam through coexistence and
+      # cutover/soak, then Terraform removes the Lambda and routes atomically.
+      "workos-auth",
+    ] : [],
     var.deployment_control_plane_enabled ? [] : [
       # Host-only onboarding/deployment API. Customer foundations disable the
       # deployment control plane, so release-based customer installs must not
@@ -37,6 +43,15 @@ locals {
       "msteams-install-complete",
       "msteams-account-link-complete",
     ],
+    var.enable_agentcore_multiplayer_proof ? [] : [
+      "turn-assertion-mint",
+      "agentcore-proof-oauth-provider",
+      "agentcore-identity-boundary-target",
+      "harness-capability-mcp",
+      "harness-code-interpreter-target",
+      "harness-builtin-tools-target",
+      "harness-platform-tools-target",
+    ],
   )
 
   # Config-class configuration shared by all API handlers. As of plan
@@ -47,15 +62,19 @@ locals {
   # The reader-coverage fixture test in apps/cli fails CI if a key in this
   # map still has a direct process.env reader. Identity values (STAGE,
   # AWS_ACCOUNT_ID, NODE_OPTIONS) and secrets (DATABASE_URL,
-  # API_AUTH_SECRET, APPSYNC_API_KEY) stay out of this map — identity stays
+  # API_AUTH_SECRET) stay out of this map — identity stays
   # env forever, secrets live in Secrets Manager (R4), never in the String
   # document.
   config_env = merge({
     # THINK-173: PUBLIC verification key (not a secret) + the NAME of the
     # private-key secret (resolved via runtime-config's secret loader —
     # the PEM itself never enters the env or the String document).
-    CAPABILITY_SIGNING_PUBLIC_KEY         = var.capability_signing_public_key
-    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET = var.capability_signing_private_key_secret
+    CAPABILITY_SIGNING_PUBLIC_KEY          = var.capability_signing_public_key
+    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET  = var.capability_signing_private_key_secret
+    SUBSCRIPTION_TICKET_SIGNING_KEY_ID     = var.subscription_ticket_signing_key_id
+    SUBSCRIPTION_TICKET_PUBLIC_KEYS        = var.subscription_ticket_public_keys
+    SUBSCRIPTION_TICKET_PRIVATE_KEY_SECRET = var.subscription_ticket_private_key_secret
+    APPSYNC_API_ID                         = var.appsync_api_id
     # THINK-229 U3/KTD5 — the analyst policy-source enforcement flip.
     # "row" (default) keeps sidecar policy shadow-only; "sidecar" makes the
     # signed sidecar block authoritative (budgets/policyClaims flow). Flip
@@ -89,7 +108,7 @@ locals {
     CAPABILITY_EXTERNAL_SEARCH_ENABLED = var.enable_capability_broker ? "true" : "false"
     ENABLE_CAPABILITY_BROKER           = var.enable_capability_broker ? "true" : "false"
     # BUCKET_NAME and USER_POOL_ID were duplicate aliases of WORKSPACE_BUCKET
-    # and COGNITO_USER_POOL_ID; GRAPHQL_API_KEY duplicated APPSYNC_API_KEY;
+    # and COGNITO_USER_POOL_ID; the legacy GRAPHQL_API_KEY alias is retired;
     # THINKWORK_API_SECRET and EMAIL_HMAC_SECRET duplicated API_AUTH_SECRET
     # (~310 serialized bytes total). graphql-http sits at Lambda's hard 4KB
     # env ceiling (#2375) — every reader falls back to the canonical name.
@@ -231,18 +250,35 @@ locals {
   # window (R8). Config-class keys live ONLY in the SSM runtime-config
   # document now — adding a key here is guarded by the identity-allowlist
   # fixture test in apps/cli (R10). Follow-up release: DATABASE_URL,
-  # APPSYNC_API_KEY, and API_AUTH_SECRET drop too (readers already resolve
+  # API_AUTH_SECRET drops too (readers already resolve
   # via Secrets Manager prefetch when the env copies are absent), bringing
   # every handler under the ≤1KB R1 target.
   common_env = {
     STAGE           = var.stage
     DATABASE_URL    = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
-    APPSYNC_API_KEY = var.appsync_api_key
     API_AUTH_SECRET = var.api_auth_secret
     AWS_ACCOUNT_ID  = var.account_id
     NODE_OPTIONS    = "--enable-source-maps"
   }
 
+  # THINK-316 U1: the assertion mint runs on a sibling role and receives only
+  # the database connection plus immutable stage identity. In particular it
+  # does not inherit API_AUTH_SECRET or APPSYNC_API_KEY from common_env.
+  turn_assertion_mint_env = {
+    STAGE          = var.stage
+    DATABASE_URL   = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
+    AWS_ACCOUNT_ID = var.account_id
+    NODE_OPTIONS   = "--enable-source-maps"
+  }
+
+  # THINK-316 U1: the synthetic provider/target are proof-only public
+  # boundaries. They receive no database URL, platform bearer, or AppSync key.
+  agentcore_proof_boundary_env = {
+    STAGE          = var.stage
+    AWS_ACCOUNT_ID = var.account_id
+    NODE_OPTIONS   = "--enable-source-maps"
+  }
+
   # Per-handler env-var overrides. ARNs are constructed from the naming
   # pattern (same trick as the api-cross-function-invoke statement in
   # iam-grouped.tf) so we don't introduce a self-referential dependency
@@ -256,6 +292,85 @@ locals {
   }
 
   handler_extra_env = {
+    # THINK-316 U1: short-lived, server-minted identity assertions for
+    # AgentCore Harness and Gateway. The public mcp-oauth handler receives the
+    # key id only to publish GetPublicKey-derived JWKS; its role cannot Sign.
+    "mcp-oauth" = {
+      AGENTCORE_TURN_ASSERTION_ISSUER = local.agentcore_turn_assertion_issuer
+      AGENTCORE_TURN_ASSERTION_JWKS_KEYS = jsonencode([
+        for key in values(local.agentcore_turn_assertion_keys) : {
+          keyId = key.key_id
+          kid   = key.kid
+        }
+      ])
+    }
+    "skills" = {
+      AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
+      AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
+      AGENTCORE_USER_OAUTH_RETURN_URL           = "${local.mcp_oauth_api_base_url}/api/skills/mcp-oauth/agentcore/complete"
+      AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
+    }
+    "turn-assertion-mint" = {
+      AGENTCORE_TURN_ASSERTION_ISSUER     = local.agentcore_turn_assertion_issuer
+      AGENTCORE_HARNESS_AUDIENCE          = local.agentcore_harness_audience
+      AGENTCORE_GATEWAY_AUDIENCE          = local.agentcore_gateway_audience
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.agentcore_turn_assertion_active_key.key_id
+      AGENTCORE_TURN_ASSERTION_KID        = local.agentcore_turn_assertion_active_key.kid
+    }
+    "agentcore-proof-oauth-provider" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_ID     = var.agentcore_proof_oauth_client_id
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_ASSERTION_ISSUER          = local.agentcore_turn_assertion_issuer
+      AGENTCORE_HARNESS_AUDIENCE          = local.agentcore_harness_audience
+      AGENTCORE_GATEWAY_AUDIENCE          = local.agentcore_gateway_audience
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.agentcore_turn_assertion_active_key.key_id
+      AGENTCORE_TURN_ASSERTION_KID        = local.agentcore_turn_assertion_active_key.kid
+      AGENTCORE_PROOF_OWNER_ALLOWLIST     = var.agentcore_proof_owner_allowlist
+    }
+    "agentcore-identity-boundary-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_PROOF_OWNER_ALLOWLIST     = var.agentcore_proof_owner_allowlist
+    }
+    "harness-capability-mcp" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER              = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET       = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION         = "mcp-list-call-v2-tenant-admission"
+      AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
+      AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
+      AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
+    }
+    "harness-code-interpreter-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION   = "sandbox-execute-v1-tenant-admission"
+    }
+    "harness-builtin-tools-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION   = "builtin-web-v1-tenant-admission"
+    }
+    "harness-platform-tools-target" = {
+      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
+      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
+      AGENTCORE_GATEWAY_POLICY_REVISION   = "platform-tools-v4-user-questions"
+    }
+    "workos-auth" = {
+      # During cutover/soak the callback, bridge, and logout paths remain for
+      # already-issued state, but the handler independently refuses every new
+      # WorkOS authorize start. Terraform removes the handler in retired.
+      AUTH_RETIREMENT_PHASE = var.auth_retirement_phase
+    }
+    "public-auth-options" = {
+      AUTH_RETIREMENT_PHASE = var.auth_retirement_phase
+    }
+    "auth-me" = {
+      AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
+    }
+    "auth-enrollment" = {
+      AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
+    }
     # Analyst query broker (THINK-228 U3). Reader role + caller credential
     # secrets, and the workspace bucket's analyst-staging/ prefix for
     # large-result CSVs (lifecycle TTL lives on the bucket module). The
@@ -406,7 +521,15 @@ locals {
     # knowledge_graph_search tool; the per-agent tool policy gates on top.
     "chat-agent-invoke" = {
       KNOWLEDGE_GRAPH_TOOL_ENABLED = tostring(var.knowledge_graph_tool_enabled)
-    }
+      # THINK-311 U5: no HARNESS_RUNNER_FUNCTION_NAME env — derivable
+      # thinkwork-<stage>-api-* names never ride env (R1/R10 identity-only
+      # rule); resolveRuntimeFunctionName derives it from STAGE at call
+      # time, exactly like workspace-renderer.
+    }
+    # THINK-316 U5: the runner reads the server-only attested profile and
+    # invokes its named endpoint with a purpose-bound CUSTOM_JWT. It receives
+    # no Harness control-plane inputs or permissions.
+    "harness-runner" = {}
     # 240s: sync Hindsight retain (LLM extraction + auto-consolidation) can
     # exceed 60s; the client timeout must stay below the Lambda timeout (300s)
     # and below the Hindsight ALB idle_timeout (300s) so failures classify as
@@ -417,12 +540,6 @@ locals {
     "brain-dream-state" = {
       BRAIN_DREAM_STATE_ENABLED = tostring(var.brain_dream_state_enabled)
     }
-    # THINK-307 KTD2: the origin-freshness guard reads the same stall
-    # threshold as the stall monitor — one operational knob, two consumers,
-    # no drift between "stalled" and "recovered".
-    "cron-retry-dispatcher" = {
-      STALL_THRESHOLD_MINUTES = tostring(var.stall_threshold_minutes)
-    }
     # Bedrock KB provisioning. Per-handler (not common_env) so these don't bloat
     # the already-near-4KB graphql-http env. Bedrock's RDS-backed KB needs the
     # cluster ARN + the KB service role (passed at CreateKnowledgeBase time).
@@ -626,6 +743,23 @@ resource "aws_lambda_function" "handler" {
     # Bearer API_AUTH_SECRET. Idempotent on thread_turns.finalized_at
     # (migration 0123). Plan: 2026-05-22-006.
     "chat-agent-finalize",
+    # harness-runner — THINK-311 U5: Event-mode target for harness-flagged
+    # agents. The chat dispatch selector (resolveRuntimeFunctionName) routes
+    # a trial agent's turn here instead of the Pi container Lambda; the
+    # runner projects the payload into an AWS AgentCore Harness config,
+    # drives InvokeHarness, fulfills emit_document, and finalizes the turn
+    # via processFinalize. No API route — direct Event invoke only.
+    "harness-runner",
+    # THINK-316 U1: direct-invoke-only assertion mint. It derives all identity
+    # claims from the persisted turn tuple and signs with a dedicated KMS key;
+    # there is intentionally no public API Gateway route.
+    "turn-assertion-mint",
+    "agentcore-proof-oauth-provider",
+    "agentcore-identity-boundary-target",
+    "harness-capability-mcp",
+    "harness-code-interpreter-target",
+    "harness-builtin-tools-target",
+    "harness-platform-tools-target",
     # canvas-refresh — headless Living Artifacts data-refresh (THINK-145 U6).
     # Invoked RequestResponse by the refreshCanvasData mutation (graphql-http)
     # and by job-trigger's canvas_refresh branch (U7). Re-runs the saved
@@ -659,7 +793,13 @@ resource "aws_lambda_function" "handler" {
     "stripe-subscription",
     "deployment-sessions",
     "auth-me",
+    "auth-revoke",
+    "auth-enrollment",
+    "auth-subscription-ticket",
+    "appsync-subscription-authorizer",
+    "subscription-invalidation",
     "public-auth-options",
+    "auth-provider-reconcile",
     "workos-auth",
     # Public artifact share links (THINK-208): GET /share/{token}, token
     # verified in handler code (no gateway auth, uniform 404 on any miss).
@@ -695,10 +835,6 @@ resource "aws_lambda_function" "handler" {
     # dispatch can withhold a failing/stale connection loudly.
     "analyst-connection-reconciler",
     "cron-stall-monitor",
-    # THINK-307: drains retry_queue rows the stall monitor enqueues. Built by
-    # scripts/build-lambdas.sh since PRD-09 but first registered here; its
-    # schedule ships DISABLED (var.retry_dispatcher_enabled default false).
-    "cron-retry-dispatcher",
     "webhook-crm-opportunity",
     "webhook-task-event",
     "workspace-files",
@@ -929,7 +1065,7 @@ resource "aws_lambda_function" "handler" {
   # so its destructive evidence-snapshot S3 capability (version enumeration +
   # bulk version deletion) never leaks into the 90+ handlers on the shared
   # role. Everything else keeps the shared role.
-  role    = each.key == "memory-retraction-drainer" ? aws_iam_role.memory_retraction_drainer.arn : aws_iam_role.lambda.arn
+  role    = each.key == "memory-retraction-drainer" ? aws_iam_role.memory_retraction_drainer.arn : each.key == "turn-assertion-mint" ? aws_iam_role.turn_assertion_mint[0].arn : each.key == "agentcore-proof-oauth-provider" ? aws_iam_role.agentcore_proof_provider[0].arn : each.key == "agentcore-identity-boundary-target" ? aws_iam_role.agentcore_proof_boundary[0].arn : aws_iam_role.lambda.arn
   handler = "index.handler"
   runtime = local.runtime
   # Parameters and Secrets extension: container-local cache for the SSM
@@ -942,7 +1078,6 @@ resource "aws_lambda_function" "handler" {
   depends_on = [
     aws_ssm_parameter.runtime_config,
     aws_secretsmanager_secret_version.api_auth,
-    aws_secretsmanager_secret_version.appsync_api_key,
   ]
   # eval-runner walks every test case sequentially, invoking an agent +
   # waiting up to 2 min for spans to propagate per test, so a 10-test run
@@ -957,8 +1092,11 @@ resource "aws_lambda_function" "handler" {
   # validates the agent, builds the AgentCore invoke payload, dispatches
   # Event-mode, and returns. Setup is ~5s in practice; 60s gives 12×
   # headroom for transient slowness.
-  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
-  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
+  # harness-runner holds the Lambda open for the full Harness turn (the
+  # reference QBR run was ~2 min; 900s is the ceiling — a longer run is a
+  # legitimate trial limitation, recorded, not engineered around).
+  timeout     = each.key == "harness-runner" ? 900 : each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
+  memory_size = each.key == "harness-runner" ? 512 : each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
 
   filename         = local.use_local_zips ? "${var.lambda_zips_dir}/${each.key}.zip" : null
   source_code_hash = local.use_local_zips ? filebase64sha256("${var.lambda_zips_dir}/${each.key}.zip") : null
@@ -987,7 +1125,10 @@ resource "aws_lambda_function" "handler" {
 
   environment {
     variables = merge(
-      local.common_env,
+      each.key == "turn-assertion-mint" ? local.turn_assertion_mint_env : contains([
+        "agentcore-proof-oauth-provider",
+        "agentcore-identity-boundary-target",
+      ], each.key) ? local.agentcore_proof_boundary_env : local.common_env,
       { FUNCTION_NAME = each.key },
       lookup(local.handler_extra_env, each.key, {}),
     )
@@ -1084,6 +1225,20 @@ resource "aws_lambda_function_event_invoke_config" "chat_agent_invoke" {
   maximum_event_age_in_seconds = 3600
 }
 
+# harness-runner retry-0 (THINK-311 U5, async-retry idempotency): an AWS
+# async retry would re-execute a whole agent turn. Failures finalize the
+# turn in-process (finalize-through-failure); a hard crash is reconciled
+# by the stall monitor (timed_out + checkout release, no retry enqueue
+# for harness turns). No DLQ destination for the same reason as
+# chat-agent-invoke above: the shared role's inline policy budget is at
+# the AWS cap, and the stall monitor is the operational surface.
+resource "aws_lambda_function_event_invoke_config" "harness_runner" {
+  count                        = local.deploy_lambda_handlers ? 1 : 0
+  function_name                = aws_lambda_function.handler["harness-runner"].function_name
+  maximum_retry_attempts       = 0
+  maximum_event_age_in_seconds = 3600
+}
+
 resource "aws_lambda_function_event_invoke_config" "wiki_compile" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
   function_name                = aws_lambda_function.handler["wiki-compile"].function_name
@@ -1454,8 +1609,13 @@ locals {
       # Public login capabilities. Unauthenticated by design; the handler
       # resolves tenant-scoped OAuth options only from trusted API Gateway
       # domain metadata and fails closed for unknown/shared hosts.
-      "GET /api/auth/options"              = "public-auth-options"
-      "OPTIONS /api/auth/options"          = "public-auth-options"
+      "GET /api/auth/options"     = "public-auth-options"
+      "OPTIONS /api/auth/options" = "public-auth-options"
+      # Operator/deployment-only metadata seam. The Lambda independently
+      # verifies API_AUTH_SECRET and rejects raw secret values.
+      "POST /api/auth/providers/reconcile" = "auth-provider-reconcile"
+      # Rollback-only routes. No native client links to these, and the entire
+      # handler is filtered from Lambda/API Gateway in the retired phase.
       "GET /api/auth/workos/authorize"     = "workos-auth"
       "OPTIONS /api/auth/workos/authorize" = "workos-auth"
       "GET /api/auth/workos/callback"      = "workos-auth"
@@ -1555,14 +1715,38 @@ locals {
       "GET /.well-known/oauth-authorization-server"        = "mcp-oauth"
       "GET /.well-known/openid-configuration"              = "mcp-oauth"
       "GET /mcp/oauth/jwks"                                = "mcp-oauth"
-      "POST /mcp/oauth/register"                           = "mcp-oauth"
-      "GET /mcp/oauth/authorize"                           = "mcp-oauth"
-      "GET /mcp/oauth/callback"                            = "mcp-oauth"
-      "POST /mcp/oauth/token"                              = "mcp-oauth"
-      "POST /mcp/oauth/revoke"                             = "mcp-oauth"
-      "ANY /mcp/user-memory"                               = "mcp-user-memory"
-      "ANY /mcp/context-engine"                            = "mcp-context-engine"
-      "ANY /mcp/open-engine"                               = "mcp-open-engine"
+      # THINK-316 U1: AgentCore CUSTOM_JWT discovery is deliberately isolated
+      # under /agentcore so the existing user-memory OAuth issuer is unchanged.
+      "GET /agentcore/.well-known/openid-configuration" = "mcp-oauth"
+      "GET /agentcore/oauth/jwks"                       = "mcp-oauth"
+      # THINK-316 U1 proof-only provider and downstream HTTPS target. Both
+      # handlers validate their own credentials; the route filter removes all
+      # five when enable_agentcore_multiplayer_proof is false.
+      "GET /agentcore-proof/oauth/.well-known/openid-configuration" = "agentcore-proof-oauth-provider"
+      "GET /agentcore-proof/oauth/authorize"                        = "agentcore-proof-oauth-provider"
+      "POST /agentcore-proof/oauth/token"                           = "agentcore-proof-oauth-provider"
+      "GET /agentcore-proof/target/owner"                           = "agentcore-identity-boundary-target"
+      "GET /agentcore-proof/target/mixed"                           = "agentcore-identity-boundary-target"
+      "POST /agentcore/capabilities/mcp/tools/list"                 = "harness-capability-mcp"
+      "POST /agentcore/capabilities/mcp/tools/call"                 = "harness-capability-mcp"
+      "POST /agentcore/capabilities/sandbox/execute"                = "harness-code-interpreter-target"
+      "POST /agentcore/capabilities/web/search"                     = "harness-builtin-tools-target"
+      "POST /agentcore/capabilities/web/extract"                    = "harness-builtin-tools-target"
+      "POST /agentcore/capabilities/brain/query"                    = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/workspace/skills/list"          = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/workspace/skills/load"          = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/message/attachments/list"       = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/message/attachments/read"       = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/user/questions/ask"             = "harness-platform-tools-target"
+      "POST /agentcore/capabilities/email/send"                     = "harness-platform-tools-target"
+      "POST /mcp/oauth/register"                                    = "mcp-oauth"
+      "GET /mcp/oauth/authorize"                                    = "mcp-oauth"
+      "GET /mcp/oauth/callback"                                     = "mcp-oauth"
+      "POST /mcp/oauth/token"                                       = "mcp-oauth"
+      "POST /mcp/oauth/revoke"                                      = "mcp-oauth"
+      "ANY /mcp/user-memory"                                        = "mcp-user-memory"
+      "ANY /mcp/context-engine"                                     = "mcp-context-engine"
+      "ANY /mcp/open-engine"                                        = "mcp-open-engine"
       # THINK-280 U8: scoped external capability search facade. The handler is
       # inert unless CAPABILITY_EXTERNAL_SEARCH_ENABLED (gated on
       # enable_capability_broker) is on — routing it while disabled returns an
@@ -1607,6 +1791,18 @@ locals {
       "OPTIONS /api/deployment-sessions/{sessionId}/teardown"                   = "deployment-sessions"
       "GET /api/auth/me"                                                        = "auth-me"
       "OPTIONS /api/auth/me"                                                    = "auth-me"
+      "POST /api/auth/revoke"                                                   = "auth-revoke"
+      "OPTIONS /api/auth/revoke"                                                = "auth-revoke"
+      "POST /api/auth/subscription-ticket"                                      = "auth-subscription-ticket"
+      "OPTIONS /api/auth/subscription-ticket"                                   = "auth-subscription-ticket"
+      "POST /api/auth/enrollment/consume"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/consume"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/recover"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/recover"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/migrate"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/migrate"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/auto-link"                                     = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/auto-link"                                  = "auth-enrollment"
       "ANY /api/extensions/{extensionId}"                                       = "extension-proxy"
       "ANY /api/extensions/{extensionId}/{proxy+}"                              = "extension-proxy"
 
@@ -1821,7 +2017,9 @@ locals {
       "GET /api/runtime/capability-catalog"     = "capability-catalog-list"
       "OPTIONS /api/runtime/capability-catalog" = "capability-catalog-list"
     } : route_key => handler_name
-    if !contains(local.optional_integration_handler_names, handler_name)
+    if !contains(local.optional_integration_handler_names, handler_name) && (
+      var.enable_agentcore_multiplayer_proof || !startswith(route_key, "GET /agentcore/")
+    )
   } : {}
 }
 
@@ -1842,6 +2040,16 @@ resource "aws_apigatewayv2_route" "handler" {
   target    = "integrations/${aws_apigatewayv2_integration.handler[each.key].id}"
 }
 
+resource "aws_lambda_permission" "appsync_subscription_authorizer" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  statement_id  = "AllowAppSyncSubscriptionAuthorization"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.handler["appsync-subscription-authorizer"].function_name
+  principal     = "appsync.amazonaws.com"
+  source_arn    = "arn:aws:appsync:${var.region}:${var.account_id}:apis/${var.appsync_api_id}"
+}
+
 resource "aws_lambda_permission" "handler_apigw" {
   for_each = local.deploy_lambda_handlers ? toset(distinct(values(local.api_routes))) : toset([])
 
@@ -1917,6 +2125,32 @@ resource "aws_scheduler_schedule" "wakeup_processor" {
   }
 }
 
+# Replays durable authorization-revocation invalidations. The worker owns its
+# retry state in Aurora and suppresses tenant realtime fan-out until AppSync
+# confirms every sensitive subscription class has been invalidated.
+resource "aws_scheduler_schedule" "subscription_invalidation" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-subscription-invalidation"
+  group_name          = "default"
+  schedule_expression = "rate(1 minutes)"
+  state               = "ENABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["subscription-invalidation"].arn
+    role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ limit = 25 })
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 # ---------------------------------------------------------------------------
 # webhook_deliveries retention cron — daily delete of rows older than 90 days
 # ---------------------------------------------------------------------------
@@ -2482,47 +2716,6 @@ resource "aws_scheduler_schedule" "stall_monitor" {
   }
 }
 
-# ---------------------------------------------------------------------------
-# Retry dispatcher — drains retry_queue rows the stall monitor enqueues and
-# re-runs genuinely stalled turns (THINK-307). First-ever scheduling of this
-# handler; state is var-driven and defaults DISABLED — never enable on a
-# stage before THINK-305/308/309 are live there (parent plan deploy ordering).
-# The 1-minute rate is fixed by design: the queue's own scheduled_at does the
-# pacing. Scheduler retries stay at 0 — the next 1-minute tick IS the retry.
-# ---------------------------------------------------------------------------
-
-# Lambda async retries are disabled (mirrors memory-retraction-drainer): the
-# claim is a CAS UPDATE so a duplicate invocation only picks up new rows, and
-# the next 1-minute tick is the retry.
-resource "aws_lambda_function_event_invoke_config" "retry_dispatcher" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["cron-retry-dispatcher"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-}
-
-resource "aws_scheduler_schedule" "retry_dispatcher" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-retry-dispatcher"
-  group_name          = "default"
-  schedule_expression = "rate(1 minutes)"
-  state               = var.retry_dispatcher_enabled ? "ENABLED" : "DISABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["cron-retry-dispatcher"].arn
-    role_arn = aws_iam_role.scheduler.arn
-
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
-  }
-}
-
 
 # ---------------------------------------------------------------------------
 # Compounding Memory — nightly hygiene + export
@@ -2580,6 +2773,37 @@ resource "aws_scheduler_schedule" "knowledge_graph_observations_ingest" {
   }
 }
 
+# Ontology suggestion scan sweep (THINK-320 U4/KTD-3). Enumerates tenants and
+# starts a suggestion scan job per tenant; tenants with a pending/running scan
+# are skipped in the handler, and the scan-job dedupe key drops same-bucket
+# duplicate starts. Ships DISABLED — enabled per stage via
+# ontology_scan_sweep_enabled after the Living Map review surfaces land.
+resource "aws_scheduler_schedule" "ontology_scan_sweep" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  name                = "thinkwork-${var.stage}-ontology-scan-sweep"
+  group_name          = "default"
+  schedule_expression = "rate(1 days)"
+  state               = var.ontology_scan_sweep_enabled ? "ENABLED" : "DISABLED"
+
+  flexible_time_window {
+    mode = "OFF"
+  }
+
+  target {
+    arn      = aws_lambda_function.handler["ontology-scan"].arn
+    role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ sweep = true, trigger = "scheduled" })
+
+    # Periodic idempotent worker: the next daily tick IS the retry (mirrors
+    # the knowledge_graph_observations_ingest precedent — scheduler retries
+    # only stack invocations onto a self-correcting cadence).
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
+  }
+}
+
 resource "aws_scheduler_schedule" "wiki_lint" {
   count = local.deploy_lambda_handlers ? 1 : 0