thinkwork-cli 0.13.1 → 0.13.2

package/dist/terraform/modules/foundation/cognito/outputs.tf

@@ -32,3 +32,45 @@ output "identity_provider_names" {
   description = "Supported Cognito identity providers for created app clients."
   value       = local.identity_providers
 }
+
+output "auth_route_clients" {
+  description = "Safe app-client-to-route manifest. Contains no upstream provider secrets."
+  value = local.create ? {
+    for key, client in aws_cognito_user_pool_client.auth_route : key => {
+      client_id           = client.id
+      route_key           = local.auth_routes[key].route_key
+      client_family       = local.auth_routes[key].client_family
+      provider_names      = local.auth_routes[key].provider_names
+      explicit_auth_flows = local.auth_routes[key].explicit_auth_flows
+      callback_urls       = distinct(local.auth_routes[key].callback_urls)
+      logout_urls         = distinct(local.auth_routes[key].logout_urls)
+      lifecycle_state     = "native"
+    }
+  } : var.existing_auth_route_clients
+}
+
+output "auth_retirement_phase" {
+  description = "Applied authentication retirement phase used for safe controller upgrades."
+  value       = var.auth_retirement_phase
+}
+
+output "web_local_client_id" {
+  description = "Local-password-only Cognito app client for the web client family."
+  value = local.create ? aws_cognito_user_pool_client.auth_route["web:local"].id : try(
+    var.existing_auth_route_clients["web:local"].client_id,
+    null,
+  )
+}
+
+output "mobile_local_client_id" {
+  description = "Local-password-only Cognito app client for the mobile client family."
+  value = local.create ? aws_cognito_user_pool_client.auth_route["mobile:local"].id : try(
+    var.existing_auth_route_clients["mobile:local"].client_id,
+    null,
+  )
+}
+
+output "microsoft_identity_provider_name" {
+  description = "Default tenant-specific Microsoft Cognito provider name, or null when not configured."
+  value       = var.microsoft_oauth_client_id != "" ? "MicrosoftOrganizations" : null
+}

package/dist/terraform/modules/foundation/cognito/variables.tf

@@ -128,6 +128,51 @@ variable "google_oauth_client_secret" {
   default     = ""
 }
 
+variable "microsoft_oauth_client_id" {
+  description = "Microsoft Entra application client ID for the default tenant-specific OIDC route"
+  type        = string
+  default     = ""
+}
+
+variable "microsoft_oauth_client_secret" {
+  description = "Microsoft Entra application client secret for the default tenant-specific OIDC route"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "microsoft_oauth_tenant" {
+  description = "Microsoft Entra directory GUID used to build the exact OIDC issuer for the default Microsoft route"
+  type        = string
+  default     = ""
+
+  validation {
+    condition     = var.microsoft_oauth_tenant == "" || can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", var.microsoft_oauth_tenant))
+    error_message = "microsoft_oauth_tenant must be an Entra directory GUID."
+  }
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe metadata for tenant-specific Entra OIDC providers reconciled before Terraform creates their route clients. Contains no upstream secret values."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
+
+  validation {
+    condition = alltrue([
+      for connection in var.tenant_entra_connections :
+      can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", connection.tenant_id)) &&
+      can(regex("^Entra_[a-f0-9]{16}_[a-f0-9]{8}$", connection.provider_name)) &&
+      connection.connection_key != "" && connection.display_name != ""
+    ])
+    error_message = "Every tenant Entra connection must use a GUID tenant_id, a deterministic Entra_<tenant>_<hash> provider name, and non-empty safe labels."
+  }
+}
+
 variable "oidc_identity_providers" {
   description = "Additional Cognito OIDC identity providers. Secrets should be sourced from Secrets Manager/SSM by the caller, not committed to tfvars."
   type = list(object({
@@ -170,26 +215,55 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired; coexistence/cutover are explicit upgrade-only rollback states."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
 variable "custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip file"
+  description = "Local Cognito custom-auth rollback Lambda artifact used only before the retired phase."
   type        = string
   default     = ""
 }
 
 variable "custom_auth_lambda_s3_bucket" {
-  description = "S3 bucket containing the Cognito custom-auth challenge Lambda release artifact"
+  description = "S3 bucket containing the Cognito custom-auth rollback Lambda artifact."
   type        = string
   default     = ""
 }
 
 variable "custom_auth_lambda_s3_key" {
-  description = "S3 key for the Cognito custom-auth challenge Lambda release artifact"
+  description = "S3 key for the Cognito custom-auth rollback Lambda artifact."
+  type        = string
+  default     = ""
+}
+
+variable "pre_token_generation_lambda_s3_bucket" {
+  description = "S3 bucket containing the Cognito pre-token client-deny Lambda release artifact"
   type        = string
   default     = ""
 }
 
+variable "pre_token_generation_lambda_s3_key" {
+  description = "S3 key for the Cognito pre-token client-deny Lambda release artifact"
+  type        = string
+  default     = ""
+}
+
+variable "denied_app_client_ids" {
+  description = "Cognito app clients denied new and refresh token issuance during auth cutover"
+  type        = list(string)
+  default     = []
+}
+
 variable "api_auth_secret" {
-  description = "Shared signing secret used by the custom-auth challenge Lambda"
+  description = "Shared signing secret used by the pre-retirement custom-auth rollback Lambda"
   type        = string
   sensitive   = true
   default     = ""
@@ -205,6 +279,8 @@ variable "admin_callback_urls" {
   default = [
     "http://localhost:5174",
     "http://localhost:5174/auth/callback",
+    "http://127.0.0.1:5174",
+    "http://127.0.0.1:5174/auth/callback",
     "http://127.0.0.1:42010/callback",
     "http://localhost:42010/callback",
   ]
@@ -215,6 +291,7 @@ variable "admin_logout_urls" {
   type        = list(string)
   default = [
     "http://localhost:5174",
+    "http://127.0.0.1:5174",
   ]
 }
 
@@ -228,6 +305,39 @@ variable "desktop_callback_urls" {
   ]
 }
 
+variable "cli_callback_urls" {
+  description = "OAuth loopback callbacks reserved for the CLI client family."
+  type        = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "cli_logout_urls" {
+  description = "OAuth loopback logout destinations reserved for the CLI client family."
+  type        = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "existing_auth_route_clients" {
+  description = "Safe route-client manifest when using a BYO Cognito pool. Keys use <family>:<route>."
+  type = map(object({
+    client_id           = string
+    route_key           = string
+    client_family       = string
+    provider_names      = list(string)
+    explicit_auth_flows = list(string)
+    callback_urls       = list(string)
+    logout_urls         = list(string)
+    lifecycle_state     = string
+  }))
+  default = {}
+}
+
 variable "mobile_callback_urls" {
   description = "OAuth callback URLs for the mobile client. Host apps that embed the SDK register their own deep-link here. Proper per-host app client isolation is 0.3.0 work — this is the stopgap capture of the drift from the CLI-applied URIs."
   type        = list(string)

package/dist/terraform/modules/thinkwork/main.tf

@@ -736,30 +736,35 @@ module "cognito" {
   stage  = var.stage
   region = var.region
 
-  create_cognito            = var.create_cognito
-  existing_user_pool_id     = var.existing_user_pool_id
-  existing_user_pool_arn    = var.existing_user_pool_arn
-  existing_admin_client_id  = var.existing_admin_client_id
-  existing_mobile_client_id = var.existing_mobile_client_id
-  existing_identity_pool_id = var.existing_identity_pool_id
-
-  google_oauth_client_id     = var.google_oauth_client_id
-  google_oauth_client_secret = var.google_oauth_client_secret
-  oidc_identity_providers    = var.oidc_identity_providers
-  saml_identity_providers    = var.saml_identity_providers
-  pre_signup_lambda_zip      = var.pre_signup_lambda_zip
-  custom_auth_lambda_zip     = var.cognito_custom_auth_lambda_zip
-  # Remote custom auth is part of the pinned enterprise release bundle. Keep
-  # the shared artifact bucket inert for direct module consumers that have not
-  # opted into required release artifacts; local zip configuration remains an
-  # independent explicit opt-in below.
-  custom_auth_lambda_s3_bucket = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
-  custom_auth_lambda_s3_key    = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-custom-auth.zip" : ""
-  api_auth_secret              = var.api_auth_secret
-  email_source_arn             = var.cognito_email_source_arn
-  from_email_address           = var.cognito_from_email_address
-  reply_to_email_address       = var.cognito_reply_to_email_address
-  invite_email_subject         = var.cognito_invite_email_subject
+  create_cognito              = var.create_cognito
+  existing_user_pool_id       = var.existing_user_pool_id
+  existing_user_pool_arn      = var.existing_user_pool_arn
+  existing_admin_client_id    = var.existing_admin_client_id
+  existing_mobile_client_id   = var.existing_mobile_client_id
+  existing_identity_pool_id   = var.existing_identity_pool_id
+  existing_auth_route_clients = var.existing_auth_route_clients
+
+  google_oauth_client_id                = var.google_oauth_client_id
+  google_oauth_client_secret            = var.google_oauth_client_secret
+  microsoft_oauth_client_id             = var.microsoft_oauth_client_id
+  microsoft_oauth_client_secret         = var.microsoft_oauth_client_secret
+  microsoft_oauth_tenant                = var.microsoft_oauth_tenant
+  tenant_entra_connections              = var.tenant_entra_connections
+  oidc_identity_providers               = var.oidc_identity_providers
+  saml_identity_providers               = var.saml_identity_providers
+  pre_signup_lambda_zip                 = var.pre_signup_lambda_zip
+  auth_retirement_phase                 = var.auth_retirement_phase
+  custom_auth_lambda_zip                = var.cognito_custom_auth_lambda_zip
+  custom_auth_lambda_s3_bucket          = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
+  custom_auth_lambda_s3_key             = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-custom-auth.zip" : ""
+  api_auth_secret                       = var.api_auth_secret
+  pre_token_generation_lambda_s3_bucket = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
+  pre_token_generation_lambda_s3_key    = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-pre-token-client-deny.zip" : ""
+  denied_app_client_ids                 = var.cognito_denied_app_client_ids
+  email_source_arn                      = var.cognito_email_source_arn
+  from_email_address                    = var.cognito_from_email_address
+  reply_to_email_address                = var.cognito_reply_to_email_address
+  invite_email_subject                  = var.cognito_invite_email_subject
   invite_email_message = (
     var.cognito_invite_email_message != ""
     ? var.cognito_invite_email_message
@@ -790,8 +795,12 @@ module "cognito" {
     local.customer_domain_legacy_retired ? [] : (local.legacy_end_user_app_domain != "" ? ["https://${local.legacy_end_user_app_domain}", "https://${local.legacy_end_user_app_domain}/auth/callback"] : []),
     local.customer_domain_web_enabled ? ["https://${var.customer_domain}", "https://${var.customer_domain}/auth/callback"] : [],
     local.customer_domain_legacy_retired ? [] : (var.computer_domain != "" ? ["https://${var.computer_domain}", "https://${var.computer_domain}/auth/callback"] : []),
-    ["http://localhost:5180", "http://localhost:5180/auth/callback"],
-    var.desktop_callback_urls
+    [
+      "http://localhost:5180",
+      "http://localhost:5180/auth/callback",
+      "http://127.0.0.1:5180",
+      "http://127.0.0.1:5180/auth/callback",
+    ]
   ))
   admin_logout_urls = distinct(concat(
     var.admin_logout_urls,
@@ -799,10 +808,11 @@ module "cognito" {
     local.customer_domain_legacy_retired ? [] : (local.legacy_end_user_app_domain != "" ? ["https://${local.legacy_end_user_app_domain}"] : []),
     local.customer_domain_web_enabled ? ["https://${var.customer_domain}"] : [],
     local.customer_domain_legacy_retired ? [] : (var.computer_domain != "" ? ["https://${var.computer_domain}"] : []),
-    ["http://localhost:5180"],
-    var.desktop_callback_urls
+    ["http://localhost:5180", "http://127.0.0.1:5180"]
   ))
   desktop_callback_urls = var.desktop_callback_urls
+  cli_callback_urls     = var.cli_callback_urls
+  cli_logout_urls       = var.cli_logout_urls
   mobile_callback_urls  = var.mobile_callback_urls
   mobile_logout_urls    = var.mobile_logout_urls
 }
@@ -930,6 +940,7 @@ module "appsync" {
 
   stage               = var.stage
   region              = var.region
+  account_id          = var.account_id
   user_pool_id        = module.cognito.user_pool_id
   subscription_schema = local.subscription_schema
 }
@@ -978,6 +989,23 @@ resource "tls_private_key" "capability_signing" {
   algorithm = "ED25519"
 }
 
+resource "random_password" "agentcore_proof_oauth_client_secret" {
+  count   = var.enable_agentcore_multiplayer_proof ? 1 : 0
+  length  = 48
+  special = false
+}
+
+check "agentcore_multiplayer_proof_requires_harness" {
+  assert {
+    condition = !var.enable_agentcore_multiplayer_proof || (
+      var.enable_agentcore_harness &&
+      can(regex("^[a-z0-9][a-z0-9-]{0,47}$", var.agentcore_multiplayer_proof_tenant_slug)) &&
+      length(distinct(compact([for owner in split(",", var.agentcore_multiplayer_proof_owner_allowlist) : trimspace(owner)]))) >= 2
+    )
+    error_message = "enable_agentcore_multiplayer_proof requires enable_agentcore_harness, an explicit lowercase tenant slug, and at least two explicit distinct proof owner subjects."
+  }
+}
+
 resource "aws_secretsmanager_secret" "capability_signing_key" {
   name        = "thinkwork/${var.stage}/capability-signing-key"
   description = "Ed25519 private key (PKCS8 PEM) signing capability sidecars and manifests (THINK-173)."
@@ -988,15 +1016,40 @@ resource "aws_secretsmanager_secret_version" "capability_signing_key" {
   secret_string = tls_private_key.capability_signing.private_key_pem
 }
 
+# AppSync subscription tickets use a separate key and domain from capability
+# envelopes. The authorizer receives only the public key; ticket issuance
+# resolves the private key by secret name at runtime.
+resource "tls_private_key" "subscription_ticket_signing" {
+  algorithm = "ED25519"
+}
+
+resource "aws_secretsmanager_secret" "subscription_ticket_signing_key" {
+  name        = "thinkwork/${var.stage}/subscription-ticket-signing-key"
+  description = "Ed25519 private key signing one-use AppSync subscription tickets."
+}
+
+resource "aws_secretsmanager_secret_version" "subscription_ticket_signing_key" {
+  secret_id     = aws_secretsmanager_secret.subscription_ticket_signing_key.id
+  secret_string = tls_private_key.subscription_ticket_signing.private_key_pem
+}
+
 module "api" {
   source = "../app/lambda-api"
 
   capability_signing_public_key         = tls_private_key.capability_signing.public_key_pem
   capability_signing_private_key_secret = aws_secretsmanager_secret.capability_signing_key.name
+  subscription_ticket_signing_key_id    = "${var.stage}-subscription-v1"
+  subscription_ticket_public_keys = jsonencode([{
+    keyId     = "${var.stage}-subscription-v1"
+    publicKey = tls_private_key.subscription_ticket_signing.public_key_pem
+  }])
+  subscription_ticket_private_key_secret = aws_secretsmanager_secret.subscription_ticket_signing_key.name
 
-  stage      = var.stage
-  account_id = var.account_id
-  region     = var.region
+  stage                            = var.stage
+  account_id                       = var.account_id
+  region                           = var.region
+  auth_retirement_phase            = var.auth_retirement_phase
+  auth_migration_recovery_deadline = var.auth_migration_recovery_deadline
 
   lambda_artifact_bucket   = var.lambda_artifact_bucket
   lambda_artifact_prefix   = var.lambda_artifact_prefix
@@ -1055,9 +1108,20 @@ module "api" {
   # Governed autonomy — per-tenant self-extension opt-in allowlist (default off).
   capability_self_extension_tenants = var.capability_self_extension_tenants
 
-  # THINK-311 U4 — keys the Harness invoker grants in the grouped ai policy
-  # (empty string when the harness module is disabled = grants omitted).
-  agentcore_harness_execution_role_arn = module.agentcore_harness.execution_role_arn
+  # THINK-316 U2 — request path receives only Harness invocation. Terraform
+  # owns provisioning/version/endpoint control, avoiding a module cycle and
+  # keeping PassRole/create/update/list out of chat Lambdas.
+  enable_agentcore_harness_invocation = var.enable_agentcore_multiplayer_proof
+
+  # THINK-316 U1 — proof-only assertion/provider handlers remain absent unless
+  # explicitly enabled. The generated secret stays in Terraform sensitive
+  # state and is passed only to the two narrow boundary Lambdas and Identity.
+  enable_agentcore_multiplayer_proof          = var.enable_agentcore_multiplayer_proof
+  agentcore_turn_assertion_key_versions       = var.agentcore_turn_assertion_key_versions
+  agentcore_turn_assertion_active_key_version = var.agentcore_turn_assertion_active_key_version
+  agentcore_proof_oauth_client_id             = "thinkwork-${var.stage}-agentcore-proof"
+  agentcore_proof_oauth_client_secret         = var.enable_agentcore_multiplayer_proof ? random_password.agentcore_proof_oauth_client_secret[0].result : ""
+  agentcore_proof_owner_allowlist             = var.agentcore_multiplayer_proof_owner_allowlist
 
   # Phase 3 U8b — KMS key + Object Lock mode forwarded as
   # COMPLIANCE_ANCHOR_KMS_KEY_ARN and COMPLIANCE_ANCHOR_OBJECT_LOCK_MODE
@@ -1088,8 +1152,8 @@ module "api" {
   mobile_client_id    = module.cognito.mobile_client_id
   cognito_auth_domain = module.cognito.auth_domain
 
+  appsync_api_id  = module.appsync.graphql_api_id
   appsync_api_url = module.appsync.graphql_api_url
-  appsync_api_key = module.appsync.graphql_api_key
 
   kb_service_role_arn = module.bedrock_kb.kb_service_role_arn
 
@@ -1151,6 +1215,7 @@ module "api" {
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
   knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
+  ontology_scan_sweep_enabled                   = var.ontology_scan_sweep_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
   google_places_api_key                         = var.google_places_api_key
   enable_workspace_orchestration                = var.enable_workspace_orchestration
@@ -1160,8 +1225,6 @@ module "api" {
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
   brain_dream_state_enabled                     = var.brain_dream_state_enabled
   brain_dream_state_schedule_expression         = var.brain_dream_state_schedule_expression
-  retry_dispatcher_enabled                      = var.retry_dispatcher_enabled
-  stall_threshold_minutes                       = var.stall_threshold_minutes
   # Per-user OAuth client credentials — fed to Secrets Manager in
   # app/lambda-api/oauth-secrets.tf. Reuses the same google_oauth_client_*
   # tfvars that already flow to the Cognito federated-signin module.
@@ -1251,18 +1314,178 @@ module "agentcore_pi" {
   okf_efs_read_access_point_arn = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_pi_read[0].arn : ""
 }
 
-# AgentCore Harness trial (THINK-311 U4) — ship-inert, pure IAM. Provisions
-# the Harness microVM execution role; the api Lambda's Harness invoker grants
-# ride the grouped ai policy in lambda-api (keyed off this module's role-ARN
-# output). No handler creates or invokes a Harness until U5.
+# AgentCore Harness execution role and managed tenant/profile runtime. The
+# public root inputs retain their rollout-era names until the example-stack
+# compatibility window closes; this module boundary uses managed semantics.
 module "agentcore_harness" {
   source = "../app/agentcore-harness"
 
-  enabled     = var.enable_agentcore_harness
-  stage       = var.stage
-  region      = var.region
-  account_id  = var.account_id
-  bucket_name = module.s3.bucket_name
+  enabled                       = var.enable_agentcore_harness
+  managed_runtime_enabled       = var.enable_agentcore_multiplayer_proof
+  stage                         = var.stage
+  region                        = var.region
+  account_id                    = var.account_id
+  bucket_name                   = module.s3.bucket_name
+  tenant_slug                   = var.agentcore_multiplayer_proof_tenant_slug
+  discovery_url                 = "${module.api.agentcore_turn_assertion_issuer}/.well-known/openid-configuration"
+  harness_audience              = module.api.agentcore_harness_audience
+  gateway_arn                   = module.agentcore_proof_gateway.gateway_arn
+  oauth_credential_provider_arn = module.agentcore_proof_identity.credential_provider_arn
+  oauth_credential_secret_arn   = module.agentcore_proof_identity.credential_secret_arn
+  oauth_return_url              = module.agentcore_proof_identity.oauth_return_url
+}
+
+# The Harness depends on the public issuer/API, so feeding its generated ARN
+# back into the api module would create a Terraform cycle. Publish the
+# non-secret, attested readiness contract under deterministic SSM keys; the
+# runner and DeploymentStatus resolver read it server-side. No browser token,
+# participant id, credential, prompt, or private result is stored here. Keep
+# the original address during the migration so deployed runners never lose
+# their profile between releases.
+locals {
+  agentcore_harness_profile_value = jsonencode({
+    tenantSlug                     = var.agentcore_multiplayer_proof_tenant_slug
+    trustProfile                   = "default"
+    harnessArn                     = module.agentcore_harness.managed_harness_arn
+    endpointArn                    = module.agentcore_harness.managed_endpoint_arn
+    endpointName                   = module.agentcore_harness.managed_endpoint_name
+    expectedVersion                = module.agentcore_harness.managed_target_version
+    liveVersion                    = module.agentcore_harness.managed_live_version
+    modelId                        = module.agentcore_harness.managed_model_id
+    status                         = module.agentcore_harness.managed_status
+    configurationFingerprint       = module.agentcore_harness.managed_configuration_fingerprint
+    authorizerAudience             = module.api.agentcore_harness_audience
+    sessionStrategy                = "fresh"
+    gatewayArn                     = module.agentcore_proof_gateway.gateway_arn
+    gatewayUrl                     = module.agentcore_proof_gateway.gateway_url
+    gatewayTargetName              = module.agentcore_proof_gateway.target_name
+    identityWorkloadName           = module.agentcore_proof_identity.workload_identity_name
+    identityCredentialProviderName = module.agentcore_proof_identity.credential_provider_name
+    identityCredentialProviderArn  = module.agentcore_proof_identity.credential_provider_arn
+    invocationToolsContract        = "control-plane-attested-full-override-v1"
+    invocationToolsFingerprint     = module.agentcore_harness.managed_invocation_tools_fingerprint
+    invocationTools                = jsondecode(module.agentcore_harness.managed_invocation_tools_json)
+    strategyDecisionRule           = "reuse_only_if_correct_and_20_percent_benefit"
+    capacityEnvelope = {
+      activeSessions       = 100
+      newSessionsPerSecond = 10
+      minimumHeadroom      = 0.50
+    }
+  })
+}
+
+resource "aws_ssm_parameter" "agentcore_harness_proof_profile" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  name = "/thinkwork/${var.stage}/agentcore-harness-proof-profile"
+  type = "String"
+  # The exact immutable Harness tool schemas sit close to Standard's 4 KiB
+  # ceiling. Intelligent-Tiering stays Standard while possible and safely
+  # promotes only when a legitimate governed schema requires more room.
+  tier  = "Intelligent-Tiering"
+  value = local.agentcore_harness_profile_value
+
+  lifecycle {
+    precondition {
+      # Base64 expands every three UTF-8 bytes to four ASCII characters. A
+      # conservative 10,920-character ceiling admits at most 8,190 bytes and
+      # cannot cross SSM's 8 KiB Advanced parameter limit.
+      condition     = length(base64encode(local.agentcore_harness_profile_value)) <= 10920
+      error_message = "The AgentCore Harness managed profile exceeds SSM's 8 KiB parameter limit."
+    }
+  }
+
+  tags = {
+    Name                   = "thinkwork-${var.stage}-agentcore-harness-proof-profile"
+    "thinkwork:proof"      = "THINK-316"
+    "thinkwork:tenant"     = var.agentcore_multiplayer_proof_tenant_slug
+    "thinkwork:profile"    = "default"
+    "thinkwork:visibility" = "server-only-nonsecret"
+  }
+}
+
+# Managed per-tenant profile address. Runtime lookup reads this first and only
+# falls back to the original single-tenant key during the migration window.
+# Adding the scoped key is non-destructive and lets later tenants receive their
+# own attested profile without changing Lambda configuration or hot-path
+# control-plane resources.
+resource "aws_ssm_parameter" "agentcore_harness_profile" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  name  = "/thinkwork/${var.stage}/agentcore-harness-profiles/${var.agentcore_multiplayer_proof_tenant_slug}"
+  type  = aws_ssm_parameter.agentcore_harness_proof_profile[0].type
+  tier  = "Intelligent-Tiering"
+  value = aws_ssm_parameter.agentcore_harness_proof_profile[0].value
+
+  tags = {
+    Name                   = "thinkwork-${var.stage}-agentcore-harness-profile-${var.agentcore_multiplayer_proof_tenant_slug}"
+    "thinkwork:managed-by" = "terraform"
+    "thinkwork:tenant"     = var.agentcore_multiplayer_proof_tenant_slug
+    "thinkwork:profile"    = "default"
+    "thinkwork:visibility" = "server-only-nonsecret"
+  }
+}
+
+# Publish the new immutable endpoint/profile first, then reclaim older
+# endpoint versions. Retain the active endpoint plus exactly one prior endpoint
+# for guarded rollback; the dedicated Harness owns no unrelated endpoints.
+resource "terraform_data" "agentcore_harness_endpoint_retention" {
+  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
+
+  triggers_replace = {
+    active_endpoint = module.agentcore_harness.managed_endpoint_name
+    profile_digest  = module.agentcore_harness.managed_configuration_fingerprint
+  }
+
+  provisioner "local-exec" {
+    command = "bash ${path.module}/../app/agentcore-harness/scripts/prune_harness.sh"
+    environment = {
+      AWS_REGION           = var.region
+      HARNESS_ID           = module.agentcore_harness.managed_harness_id
+      ACTIVE_ENDPOINT_NAME = module.agentcore_harness.managed_endpoint_name
+      ENDPOINT_PREFIX      = "ThinkworkProofV"
+      LEGACY_ENDPOINT_NAME = "ThinkworkProof"
+    }
+  }
+
+  depends_on = [
+    aws_ssm_parameter.agentcore_harness_proof_profile,
+    aws_ssm_parameter.agentcore_harness_profile,
+  ]
+}
+
+# THINK-316 U1 proof-only Identity and Gateway plane. These resources use the
+# regional execute-api URL because the dev account rejects public Lambda
+# Function URLs and a custom domain may be unavailable in a fresh stage.
+module "agentcore_proof_identity" {
+  source = "../app/agentcore-identity"
+
+  enabled             = var.enable_agentcore_multiplayer_proof
+  stage               = var.stage
+  region              = var.region
+  account_id          = var.account_id
+  oauth_issuer        = module.api.agentcore_proof_oauth_issuer
+  oauth_client_id     = "thinkwork-${var.stage}-agentcore-proof"
+  oauth_client_secret = var.enable_agentcore_multiplayer_proof ? random_password.agentcore_proof_oauth_client_secret[0].result : ""
+  user_federation_return_urls = [
+    "${module.api.api_endpoint}/api/skills/mcp-oauth/agentcore/complete",
+  ]
+}
+
+module "agentcore_proof_gateway" {
+  source = "../app/agentcore-gateway"
+
+  enabled                       = var.enable_agentcore_multiplayer_proof
+  stage                         = var.stage
+  region                        = var.region
+  account_id                    = var.account_id
+  discovery_url                 = "${module.api.agentcore_turn_assertion_issuer}/.well-known/openid-configuration"
+  gateway_audience              = module.api.agentcore_gateway_audience
+  target_base_url               = module.api.agentcore_proof_target_base_url
+  oauth_credential_provider_arn = module.agentcore_proof_identity.credential_provider_arn
+  oauth_credential_secret_arn   = module.agentcore_proof_identity.credential_secret_arn
+  oauth_return_url              = module.agentcore_proof_identity.oauth_return_url
+  proof_owner_allowlist         = var.agentcore_multiplayer_proof_owner_allowlist
 }
 
 # Capability Broker (THINK-280 U3) — ship-inert, gated by