thinkwork-cli 0.13.1 → 0.13.2

package/dist/terraform/modules/app/lambda-api/iam-grouped.tf

@@ -181,6 +181,8 @@ locals {
           "cognito-idp:AdminRespondToAuthChallenge",
           "cognito-idp:AdminSetUserPassword",
           "cognito-idp:AdminUpdateUserAttributes",
+          "cognito-idp:DescribeIdentityProvider",
+          "cognito-idp:DescribeUserPoolClient",
           "cognito-idp:ListUsers",
         ]
         Resource = var.user_pool_arn
@@ -346,6 +348,7 @@ locals {
     # refresh path cannot replace the old manual AWS CLI step.
     var.deployment_evidence_bucket != "" ? [
       {
+        Sid    = "DeploymentEvidenceBucket"
         Effect = "Allow"
         Action = [
           "s3:GetObject",
@@ -357,6 +360,12 @@ locals {
           "arn:aws:s3:::${var.deployment_evidence_bucket}/*",
         ]
       },
+      {
+        Sid      = "AgentCoreHarnessGatewayOauthSecret"
+        Effect   = "Allow"
+        Action   = ["secretsmanager:GetSecretValue"]
+        Resource = ["arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:bedrock-agentcore-identity!default/oauth2/thinkwork-${var.stage}-proof-oauth-*"]
+      },
     ] : [],
     var.billing_export_bucket_name != "" ? [
       {
@@ -524,6 +533,17 @@ locals {
           # wiki-bootstrap-import: bootstrapJournalImport admin mutation
           # Event-invokes this for the long-running ingest path.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-wiki-bootstrap-import",
+          # harness-runner: chat-agent-invoke Event-invokes this for chat
+          # turns routed to the AWS AgentCore runtime (THINK-311 trial).
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-harness-runner",
+          # harness-runner queues the same canonical post-turn memory pipeline
+          # as Pi after a completed AgentCore turn. The retain ledger makes the
+          # Event invoke idempotent on the thread-turn source key.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-memory-retain",
+          # harness-runner RequestResponse-invokes this dedicated signer. The
+          # signer re-derives the actor/tenant/thread tuple from the running
+          # turn and alone holds KMS Sign; the shared runner role never does.
+          "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-turn-assertion-mint",
           # ontology-scan: startOntologySuggestionScan Event-invokes this
           # after inserting a durable scan job row.
           "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-ontology-scan",
@@ -887,14 +907,14 @@ locals {
       Resource = "*"
     },
     ],
-    # THINK-311 U4 — AgentCore Harness trial invoker grants, present only when
-    # the agentcore-harness module is enabled (empty role ARN = module off).
-    # Ship-inert: no handler calls Harness until U5's harness-runner lands.
+    # THINK-316 U2 — request path receives data-plane invocation only.
+    # Provisioning/version/endpoint/PassRole rights belong to Terraform's
+    # dedicated Harness lifecycle and never reach a chat Lambda.
     #
     # CRITICAL: never grant `bedrock-agentcore:InvokeAgentRuntimeCommand`
     # anywhere — it bypasses Harness allowedTools enforcement. Invocation goes
     # through InvokeHarness / InvokeAgentRuntime only.
-    var.agentcore_harness_execution_role_arn != "" ? [
+    var.enable_agentcore_harness_invocation ? [
       {
         # Data plane — invoke a Harness (and its runtime endpoints) directly.
         Sid    = "AgentCoreHarnessInvoke"
@@ -903,45 +923,27 @@ locals {
           "bedrock-agentcore:InvokeHarness",
           "bedrock-agentcore:InvokeAgentRuntime",
         ]
-        Resource = "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:harness/*"
+        Resource = ["arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:harness/*"]
       },
       {
-        # Control plane — CreateHarness has no resource ARN at create time
-        # (same non-scopable shape as bedrock:CreateKnowledgeBase above), so
-        # this statement is "*"; PassRole below stays scoped to the single
-        # Harness execution role.
-        Sid    = "AgentCoreHarnessControl"
+        # The deterministic report adapter uses the same AgentCore Identity
+        # chain as Harness Gateway outbound auth: turn JWT -> workload token
+        # -> OBO Gateway token. No provider client secret enters Lambda.
+        Sid    = "AgentCoreHarnessGatewayIdentity"
         Effect = "Allow"
         Action = [
-          "bedrock-agentcore:CreateHarness",
-          "bedrock-agentcore:GetHarness",
-          "bedrock-agentcore:UpdateHarness",
-          "bedrock-agentcore:DeleteHarness",
-          "bedrock-agentcore:CreateHarnessEndpoint",
-          "bedrock-agentcore:GetHarnessEndpoint",
-          "bedrock-agentcore:ListHarnessEndpoints",
-          "bedrock-agentcore:ListHarnesses",
-          "bedrock-agentcore:ListHarnessVersions",
+          "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
+          "bedrock-agentcore:GetWorkloadAccessTokenForUserId",
+          "bedrock-agentcore:GetResourceOauth2Token",
+          "bedrock-agentcore:CompleteResourceTokenAuth",
+        ]
+        Resource = [
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:workload-identity-directory/default",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:workload-identity-directory/default/workload-identity/thinkwork-${var.stage}-multiplayer-proof",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default/oauth2credentialprovider/thinkwork-${var.stage}-proof-oauth",
+          "arn:aws:bedrock-agentcore:${var.region}:${var.account_id}:token-vault/default/oauth2credentialprovider/thinkwork-${var.stage}-twenty-crm",
         ]
-        Resource = "*"
-      },
-    ] : [],
-    # (Separate conditional from the two statements above only because the
-    # Condition attribute gives this object a different Terraform type —
-    # same gate, same feature.)
-    var.agentcore_harness_execution_role_arn != "" ? [
-      {
-        # CreateHarness takes executionRoleArn; the caller must be able to
-        # pass exactly that role, and only to the bedrock-agentcore service.
-        Sid      = "AgentCoreHarnessPassExecutionRole"
-        Effect   = "Allow"
-        Action   = ["iam:PassRole"]
-        Resource = var.agentcore_harness_execution_role_arn
-        Condition = {
-          StringEquals = {
-            "iam:PassedToService" = "bedrock-agentcore.amazonaws.com"
-          }
-        }
       },
     ] : [],
   )
@@ -1040,6 +1042,33 @@ locals {
   )
 
   api_observability_statements = concat(local.api_observability_sqs_statements, [
+    # Backend notification publishing is IAM-only. Scope the shared API
+    # execution role to the NONE-resolver mutation fields; end-user identity-
+    # pool credentials have no AppSync grant. This statement lives in the
+    # observability envelope for size balance: adding subscription invalidation
+    # pushed the data-plane policy over IAM's 6,144-character hard cap.
+    {
+      Sid    = "PublishAppSyncNotifications"
+      Effect = "Allow"
+      Action = ["appsync:GraphQL"]
+      Resource = [
+        for field in [
+          "notifyAgentStatus",
+          "notifyNewMessage",
+          "notifyHeartbeatActivity",
+          "notifyThreadActivity",
+          "notifyThreadUpdate",
+          "notifyInboxItemUpdate",
+          "notifyThreadTurnUpdate",
+          "notifyThreadTurnStep",
+          "notifyOrgUpdate",
+          "notifyCostRecorded",
+          "notifyEvalRunUpdate",
+          "notifyWorkspaceAccessRevoked",
+          "invalidateSubscription",
+        ] : "arn:aws:appsync:${var.region}:${var.account_id}:apis/${var.appsync_api_id}/types/Mutation/fields/${field}"
+      ]
+    },
     # (was inline policy "cloudwatch-logs-read")
     {
       Effect = "Allow"
@@ -1083,16 +1112,41 @@ locals {
       Resource = "*"
     },
   ])
+
+  api_grouped_policy_documents = {
+    data_plane = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_data_plane_statements
+    })
+    orchestration = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_orchestration_statements
+    })
+    ai = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_ai_statements
+    })
+    observability = jsonencode({
+      Version   = "2012-10-17"
+      Statement = local.api_observability_statements
+    })
+  }
+}
+
+check "api_grouped_managed_policy_sizes" {
+  assert {
+    condition = alltrue([
+      for document in values(local.api_grouped_policy_documents) : length(document) <= 6144
+    ])
+    error_message = "Each grouped API managed-policy document must remain within AWS IAM's 6,144-character limit."
+  }
 }
 
 resource "aws_iam_policy" "api_data_plane" {
   name        = "thinkwork-${var.stage}-api-data-plane"
   description = "Grouped data-plane grants (RDS Data API, Secrets Manager, S3, DynamoDB, Cognito, SSM, KMS-via-SSM, SQS) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_data_plane_statements
-  })
+  policy = local.api_grouped_policy_documents.data_plane
 }
 
 resource "aws_iam_role_policy_attachment" "api_data_plane" {
@@ -1104,10 +1158,7 @@ resource "aws_iam_policy" "api_orchestration" {
   name        = "thinkwork-${var.stage}-api-orchestration"
   description = "Grouped orchestration grants (Lambda invoke, EventBridge Scheduler, Step Functions, SES) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_orchestration_statements
-  })
+  policy = local.api_grouped_policy_documents.orchestration
 }
 
 resource "aws_iam_role_policy_attachment" "api_orchestration" {
@@ -1119,10 +1170,7 @@ resource "aws_iam_policy" "api_ai" {
   name        = "thinkwork-${var.stage}-api-ai"
   description = "Grouped AI grants (Bedrock invoke, Knowledge Bases, AgentCore memory/eval/code-interpreter) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_ai_statements
-  })
+  policy = local.api_grouped_policy_documents.ai
 }
 
 resource "aws_iam_role_policy_attachment" "api_ai" {
@@ -1134,10 +1182,7 @@ resource "aws_iam_policy" "api_observability" {
   name        = "thinkwork-${var.stage}-api-observability"
   description = "Grouped observability grants (CloudWatch Logs reads, ECS/ALB health reads) for the shared api Lambda role"
 
-  policy = jsonencode({
-    Version   = "2012-10-17"
-    Statement = local.api_observability_statements
-  })
+  policy = local.api_grouped_policy_documents.observability
 }
 
 resource "aws_iam_role_policy_attachment" "api_observability" {

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -73,6 +73,14 @@ resource "aws_apigatewayv2_stage" "default" {
     throttling_burst_limit = 20
   }
 
+  # Session revocation is authenticated and independently rate-limited in the
+  # handler per principal. This edge throttle also bounds aggregate abuse.
+  route_settings {
+    route_key              = "POST /api/auth/revoke"
+    throttling_rate_limit  = 5
+    throttling_burst_limit = 10
+  }
+
   # UpdateStage 404s ("Unable to find Route by key … within the provided
   # RouteSettings") if the stage update races the route creation — Terraform
   # sees no reference edge between route_settings.route_key and the route
@@ -256,3 +264,19 @@ resource "aws_lambda_permission" "placeholder_apigw" {
   principal     = "apigateway.amazonaws.com"
   source_arn    = "${aws_apigatewayv2_api.main.execution_arn}/*/*"
 }
+resource "terraform_data" "auth_migration_recovery_deadline_guard" {
+  input = {
+    phase    = var.auth_retirement_phase
+    deadline = var.auth_migration_recovery_deadline
+  }
+
+  lifecycle {
+    precondition {
+      condition = var.auth_retirement_phase != "coexistence" || (
+        trimspace(var.auth_migration_recovery_deadline) != "" &&
+        can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+      )
+      error_message = "auth_migration_recovery_deadline must be an RFC3339 timestamp when auth_retirement_phase is coexistence."
+    }
+  }
+}

package/dist/terraform/modules/app/lambda-api/mcp-oauth.tf

@@ -1,8 +1,185 @@
 locals {
-  mcp_oauth_api_base_url       = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
-  mcp_oauth_cognito_base_url   = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
-  mcp_oauth_identity_providers = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
-  mcp_oauth_logo_path          = "${path.module}/../../../../apps/web/public/logo.png"
+  mcp_oauth_api_base_url          = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
+  mcp_oauth_cognito_base_url      = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
+  mcp_oauth_identity_providers    = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
+  mcp_oauth_logo_path             = "${path.module}/../../../../apps/web/public/logo.png"
+  agentcore_turn_assertion_issuer = "${local.mcp_oauth_api_base_url}/agentcore"
+  agentcore_harness_audience      = "urn:thinkwork:${var.stage}:agentcore:harness"
+  agentcore_gateway_audience      = "urn:thinkwork:${var.stage}:agentcore:gateway"
+  agentcore_turn_assertion_keys = {
+    for version, key in aws_kms_key.agentcore_turn_assertion : version => {
+      key_id = key.arn
+      # A version label alone is not globally unique: destroying and
+      # reprovisioning v1 creates different RSA material while downstream JWT
+      # validators may still cache the old public key under the same kid.
+      # Bind the kid to the immutable KMS key id so a reprovision is observed
+      # as a real key rotation instead of an invalid-signature outage.
+      kid = "thinkwork-${var.stage}-agentcore-turn-${version}-${substr(key.key_id, 0, 8)}"
+    }
+  }
+  agentcore_turn_assertion_active_key = try(
+    local.agentcore_turn_assertion_keys[var.agentcore_turn_assertion_active_key_version],
+    { key_id = "", kid = "" },
+  )
+}
+
+# THINK-316 U1: short-lived CUSTOM_JWT assertions are signed by KMS so private
+# key material never enters Lambda configuration or process memory. The key
+# policy is the capability boundary: the dedicated mint role can Sign, while
+# the shared mcp-oauth role can only fetch the public key for JWKS publication.
+resource "aws_iam_role" "turn_assertion_mint" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-turn-assertion-mint-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "turn_assertion_mint_basic" {
+  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  role       = aws_iam_role.turn_assertion_mint[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+# The synthetic OAuth provider and boundary target are public proof surfaces
+# but need no AWS data-plane permissions. A sibling logs-only role prevents a
+# parser defect from inheriting the shared API role or its platform secrets.
+resource "aws_iam_role" "agentcore_proof_boundary" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-proof-boundary-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "agentcore_proof_boundary_basic" {
+  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  role       = aws_iam_role.agentcore_proof_boundary[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+# The token-exchange provider is the only proof boundary allowed to mint the
+# derived Gateway assertion. Keep that capability off the public target role.
+resource "aws_iam_role" "agentcore_proof_provider" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-proof-provider-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "agentcore_proof_provider_basic" {
+  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  role       = aws_iam_role.agentcore_proof_provider[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy" "agentcore_proof_provider_kms" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-agentcore-proof-provider-key"
+  role  = aws_iam_role.agentcore_proof_provider[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["kms:Sign"]
+      Resource = [local.agentcore_turn_assertion_active_key.key_id]
+      Condition = {
+        StringEquals = {
+          "kms:SigningAlgorithm" = "RSASSA_PKCS1_V1_5_SHA_256"
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_kms_key" "agentcore_turn_assertion" {
+  for_each = var.enable_agentcore_multiplayer_proof ? toset(var.agentcore_turn_assertion_key_versions) : toset([])
+
+  description              = "ThinkWork ${var.stage} AgentCore per-turn assertion signing ${each.key}"
+  key_usage                = "SIGN_VERIFY"
+  customer_master_key_spec = "RSA_2048"
+  deletion_window_in_days  = 7
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AccountAdministration"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${var.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+    ]
+  })
+
+  tags = {
+    Name       = "thinkwork-${var.stage}-agentcore-turn-assertion-${each.key}"
+    KeyVersion = each.key
+  }
+}
+
+resource "aws_kms_alias" "agentcore_turn_assertion" {
+  for_each      = aws_kms_key.agentcore_turn_assertion
+  name          = "alias/thinkwork-${var.stage}-agentcore-turn-assertion-${each.key}"
+  target_key_id = each.value.key_id
+}
+
+# The mint role can sign with exactly the active key. The public discovery
+# handler can read all currently published public keys, but can never sign.
+resource "aws_iam_role_policy" "turn_assertion_mint_kms" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-turn-assertion-active-key"
+  role  = aws_iam_role.turn_assertion_mint[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["kms:Sign"]
+      Resource = [local.agentcore_turn_assertion_active_key.key_id]
+      Condition = {
+        StringEquals = {
+          "kms:SigningAlgorithm" = "RSASSA_PKCS1_V1_5_SHA_256"
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "turn_assertion_jwks_kms" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  name  = "thinkwork-${var.stage}-turn-assertion-published-keys"
+  role  = aws_iam_role.lambda.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["kms:GetPublicKey"]
+      Resource = [for key in values(local.agentcore_turn_assertion_keys) : key.key_id]
+    }]
+  })
 }
 
 resource "aws_dynamodb_table" "mcp_oauth_revocations" {

package/dist/terraform/modules/app/lambda-api/outputs.tf

@@ -8,6 +8,41 @@ output "api_endpoint" {
   value       = local.api_base_url
 }
 
+output "agentcore_turn_assertion_issuer" {
+  description = "Proof-only CUSTOM_JWT issuer on the regional HTTP API."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_issuer : ""
+}
+
+output "agentcore_harness_audience" {
+  description = "Purpose-bound audience for proof Harness invocations."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_harness_audience : ""
+}
+
+output "agentcore_gateway_audience" {
+  description = "Purpose-bound audience for proof Gateway operations."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_gateway_audience : ""
+}
+
+output "agentcore_turn_assertion_active_key_arn" {
+  description = "Operator-only active proof signing key ARN used by deployed verification probes."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_active_key.key_id : ""
+}
+
+output "agentcore_turn_assertion_active_kid" {
+  description = "Public JWKS key identifier for the active proof signing key."
+  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_active_key.kid : ""
+}
+
+output "agentcore_proof_oauth_issuer" {
+  description = "Synthetic proof OAuth issuer on the regional HTTP API."
+  value       = var.enable_agentcore_multiplayer_proof ? "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth" : ""
+}
+
+output "agentcore_proof_target_base_url" {
+  description = "Regional HTTP API base URL hosting the controlled identity target."
+  value       = var.enable_agentcore_multiplayer_proof ? local.mcp_oauth_api_base_url : ""
+}
+
 output "api_execution_arn" {
   description = "API Gateway V2 execution ARN (for Lambda permissions)"
   value       = aws_apigatewayv2_api.main.execution_arn

package/dist/terraform/modules/app/lambda-api/runtime-config.tf

@@ -51,9 +51,9 @@ locals {
 # ----------------------------------------------------------------------------
 # Platform secrets (plan 2026-06-11-006 U5/R4)
 #
-# API_AUTH_SECRET and APPSYNC_API_KEY leave plaintext Lambda env: the
-# runtime-config loader prefetches these at cold start (getApiAuthSecret /
-# getAppsyncApiKey accessors, env-wins during the transition window). Names
+# API_AUTH_SECRET leaves plaintext Lambda env: the runtime-config loader
+# prefetches it at cold start (getApiAuthSecret, env-wins during the transition
+# window). Names
 # use the `thinkwork/${stage}/...` prefix so the shared role's existing
 # `secretsmanager:GetSecretValue` grant on `thinkwork/*` covers them.
 # The env copies in common_env are dropped one release AFTER this ships
@@ -83,24 +83,6 @@ resource "aws_secretsmanager_secret_version" "api_auth" {
   # console.
 }
 
-resource "aws_secretsmanager_secret" "appsync_api_key" {
-  name        = "thinkwork/${var.stage}/appsync-api-key"
-  description = "AppSync API key for subscription notify fan-out. Prefetched at Lambda cold start by @thinkwork/runtime-config."
-  tags = {
-    Name  = "thinkwork-${var.stage}-appsync-api-key"
-    Stage = var.stage
-  }
-}
-
-resource "aws_secretsmanager_secret_version" "appsync_api_key" {
-  secret_id     = aws_secretsmanager_secret.appsync_api_key.id
-  secret_string = var.appsync_api_key
-
-  # AppSync keys are terraform-rotated (the appsync module recreates them),
-  # so track the var here — unlike api_auth there is no operator rotation
-  # path outside terraform.
-}
-
 # The standalone compliance Lambdas (anchor, export-runner) bundle the
 # runtime-config loader but run under dedicated roles that lack the shared
 # role's ssm grant. Without these, every cold start auto-prime fails