thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/examples/greenfield/terraform.tfvars.example

@@ -13,12 +13,9 @@ account_id = "123456789012"  # your AWS account ID
 database_engine = "rds-postgres"
 
 # Memory:
-#   Hindsight is the canonical user and Space memory provider for full
-#   ThinkWork installs and is enabled by default. Set enable_hindsight = false
-#   and memory_engine = "agentcore" only for explicit low-cost/development
-#   AgentCore-only deployments.
-# enable_hindsight = false
-# memory_engine    = "agentcore"
+#   Bedrock AgentCore managed memory is the only engine. The legacy
+#   `enable_hindsight` / `memory_engine` inputs are deprecated no-ops that are
+#   still accepted so old tfvars keep applying.
 
 # Managed applications:
 #   Twenty CRM is optional. First enable should set both booleans true after
@@ -72,10 +69,24 @@ db_password = "CHANGE_ME_strong_password_here"
 # Google OAuth (optional — leave empty to skip Google social login)
 # google_oauth_client_id     = ""
 # google_oauth_client_secret = ""
+# microsoft_oauth_client_id     = ""
+# microsoft_oauth_client_secret = "" # Supply securely; never commit a real value.
+# microsoft_oauth_tenant        = "" # Entra directory GUID, or common/organizations/consumers (Cognito-supported aliases).
+
+# Tenant-specific Entra IdPs are reconciled by `thinkwork enterprise
+# identity-provider`; Terraform receives safe provider metadata only.
+# tenant_entra_connections = [{
+#   connection_key = "microsoft:tenant:00000000-0000-4000-8000-000000000000"
+#   tenant_id      = "00000000-0000-4000-8000-000000000000"
+#   provider_name  = "Entra_0000000000004000_ab12cd34"
+#   display_name   = "Example organization"
+# }]
 
 # Cognito trigger Lambdas (optional — leave empty if not using custom auth logic)
 # pre_signup_lambda_zip           = "./lambdas/cognito-pre-signup.zip"
-# cognito_custom_auth_lambda_zip  = "./lambdas/cognito-custom-auth.zip"
+# auth_retirement_phase          = "retired" # greenfield default; existing upgrades explicitly use coexistence -> cutover -> retired
+# auth_migration_recovery_deadline = "2026-08-01T00:00:00Z" # required when auth_retirement_phase = "coexistence"
+# cognito_custom_auth_lambda_zip = "./lambdas/cognito-custom-auth.zip" # rollback only
 
 # Lambda artifacts:
 # - Source checkout deploys can set lambda_zips_dir after `pnpm build:lambdas`.
@@ -101,7 +112,6 @@ db_password = "CHANGE_ME_strong_password_here"
 #     --name /thinkwork/<stage>/google-places/api-key --value <KEY>
 # (terraform's lifecycle.ignore_changes on the value keeps your manual
 # value from being overwritten on future applies.)
-# google_places_api_key = ""
 
 # Public website (apps/www) custom domain.
 # Leave www_domain empty to skip the custom domain and serve on the raw
@@ -123,3 +133,11 @@ db_password = "CHANGE_ME_strong_password_here"
 # ses_inbound_domain = "agents.thinkwork.ai"
 # ses_parent_domain = "thinkwork.ai"
 # tenant_slugs      = ["dev"]
+
+# Company Brain platform-agent machine lane (optional, THINK-628/THINK-710).
+# Secrets Manager ARN of etl-platform/brain-mcp/m2m/platform-agent in this
+# account. When set, the shared API Lambda role gets read on it so MCP config
+# build can mint short-lived Cognito bearers for the Brain connector instead
+# of using a stored tkt_ key. Leave empty until the lane's manifest entry is
+# published (see the Brain repo's brain-mcp-m2m-migration runbook).
+# brain_m2m_platform_agent_secret_arn = "arn:aws:secretsmanager:us-east-1:<account-id>:secret:etl-platform/brain-mcp/m2m/platform-agent-XXXXXX"

package/dist/terraform/modules/app/agentcore-admin/main.tf

@@ -100,6 +100,28 @@ variable "graphql_db_secret_arn" {
   type        = string
 }
 
+# ---- VPC placement (THINK-1082) ------------------------------------------------
+# The handler opens DATABASE_URL against Aurora's public endpoint today. When
+# in_vpc is on it attaches to the private subnets behind the api-lambda
+# security group (which the database SG admits) so the public rule can close.
+variable "in_vpc" {
+  description = "Attach the admin Lambda to the VPC (vpc_subnet_ids + vpc_security_group_ids); NAT-routed subnets required. Default off = no change."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_subnet_ids" {
+  description = "Private (NAT-routed) subnet IDs for the admin Lambda when in_vpc is true."
+  type        = list(string)
+  default     = []
+}
+
+variable "vpc_security_group_ids" {
+  description = "Security groups for the admin Lambda when in_vpc is true."
+  type        = list(string)
+  default     = []
+}
+
 # ---- Capability-private interpreter VPC placement (THINK-280 U4) ---------------
 # Empty when the capability broker is disabled → handler skips capability-private
 # provisioning. Sourced from the broker outputs via the code-interpreter module.
@@ -174,6 +196,14 @@ resource "aws_secretsmanager_secret_version" "admin_token" {
 # AWS SDK calls (see packages/lambda/agentcore-admin.ts).
 ################################################################################
 
+# THINK-1082: ENI grant for the in_vpc lane; never created when off.
+resource "aws_iam_role_policy_attachment" "admin_vpc_access" {
+  count = local.deploy && var.in_vpc ? 1 : 0
+
+  role       = aws_iam_role.admin[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
 resource "aws_iam_role" "admin" {
   count = local.deploy ? 1 : 0
   name  = "thinkwork-${var.stage}-agentcore-admin"
@@ -333,6 +363,23 @@ resource "aws_lambda_function" "admin" {
     }
   }
 
+  # THINK-1082: network-only VPC attachment; absent when in_vpc is off.
+  dynamic "vpc_config" {
+    for_each = var.in_vpc ? [1] : []
+
+    content {
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
+    }
+  }
+
+  lifecycle {
+    precondition {
+      condition     = !var.in_vpc || (length(var.vpc_subnet_ids) > 0 && length(var.vpc_security_group_ids) > 0)
+      error_message = "in_vpc requires non-empty vpc_subnet_ids and vpc_security_group_ids."
+    }
+  }
+
   tags = {
     Name    = local.function_name
     Stage   = var.stage

package/dist/terraform/modules/app/agentcore-code-interpreter/README.md

@@ -1,53 +1,45 @@
-# `agentcore-code-interpreter` — stage-level base image substrate
+# `agentcore-code-interpreter` — stage-level sandbox substrate
 
-Stage-scoped artifacts for the AgentCore Code Interpreter sandbox. **Per-tenant
+Stage-scoped substrate for the AgentCore Code Interpreter sandbox. **Per-tenant
 Code Interpreter instances are created at runtime** by the `agentcore-admin`
 Lambda (see `docs/adrs/per-tenant-aws-resource-fanout.md`) — this module
-stops at the substrate everything else depends on.
-
-## What it creates
-
-- **ECR repository** `thinkwork-{stage}-sandbox-base` — immutable tags, last 10
-  kept, scan-on-push.
-- **Outputs** consumed by downstream modules + the provisioning Lambda:
-  - `ecr_repository_url` — where the blessed image lives.
-  - `environment_ids` + `environments` — the v1 environment catalog (`default-public`,
-    `internal-only`) with network modes.
-  - `tenant_role_trust_policy_template` / `tenant_role_inline_policy_template` —
-    JSON templates the provisioning Lambda substitutes `{tenant_id}` into at
-    `CreateRole` time (plan Unit 5).
-
-## Files
-
-| File                                     | Purpose                                                                                                                                   |
-| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `main.tf`                                | ECR + outputs. No per-tenant resources.                                                                                                   |
-| `Dockerfile.sandbox-base`                | Python 3.12 + pinned libs + `sitecustomize.py`. Build context is the **repo root** so the COPY can reach the module-owned sandbox helper. |
-| `scripts/build_and_push_sandbox_base.sh` | CI builds + pushes. Not called from Terraform — image lifecycle is a reviewable-PR concern.                                               |
-
-The Python source `sitecustomize.py` and its pytest suite `test_sitecustomize.py`
-live under `terraform/modules/app/agentcore-code-interpreter/sandbox/`, next to
-the sandbox base image they protect.
+stops at the stage-level pieces everything else depends on.
+
+## What it provides
+
+The module creates no AWS resources today; it is a typed catalog + policy-template
+surface consumed by the provisioning Lambda and by downstream modules:
+
+- `environment_ids` + `environments` — the environment catalog (`default-public`,
+  `internal-only`, `capability-private`) with network modes.
+- `tenant_role_trust_policy_template` / `tenant_role_inline_policy_template` —
+  JSON templates the provisioning Lambda substitutes `{tenant_id}` into at
+  `CreateRole` time (plan Unit 5).
+- `capability_private_role_inline_policy_template` — logs-only policy for the
+  THINK-280 U4 capability-private interpreter role.
+- `capability_private_subnet_ids` / `capability_private_security_group_ids` —
+  pass-through of the broker's no-NAT VPC placement (empty when the broker is
+  disabled); wired into the `agentcore-admin` module.
+
+## No custom sandbox image (THINK-617)
+
+This module used to own an ECR repo (`thinkwork-{stage}-sandbox-base`), a
+`Dockerfile.sandbox-base` (Python 3.12 + pinned libs + a `sitecustomize.py`
+stdio scrubber) and a CI build script. **AgentCore Code Interpreter cannot use
+a custom image** — `CreateCodeInterpreterRequest` has no image/container
+parameter (verified against `@aws-sdk/client-bedrock-agentcore-control`
+3.1103.0), and `agentcore-admin` has only ever created interpreters on the
+AWS-managed image.
+
+The practical need (openpyxl et al. in the sandbox) is covered by the runtime's
+on-demand install preamble — `ON_DEMAND_LIBRARIES` in
+`packages/agentcore-pi/agent-container/src/runtime/tools/execute-code.ts`.
+
+Consequence for log scrubbing: the value-based in-image redactor never ran in
+production. The `sandbox-log-scrubber` CloudWatch subscription filter
+(pattern-based, known OAuth token shapes) is the only scrubbing layer.
 
 ## What this module does **not** do
 
-- Create per-tenant Code Interpreter instances — that's Unit 5 (agentcore-admin Lambda).
-- Build or push the Docker image — that's CI, via the shell script above.
-- Grant the provisioning Lambda IAM permissions on the new resources — that's added in Unit 5 when the Lambda resource lands.
-
-## Bumping the image
-
-1. Edit `Dockerfile.sandbox-base` (pin a new pandas / add a lib / etc.).
-2. Edit `terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py` if the R13 invariant or its coverage gaps shift.
-3. PR. CI runs `pytest` on the scrubber plus a build-then-startup-assertion smoke test.
-4. After merge, `build_and_push_sandbox_base.sh` tags with the merge-commit SHA.
-
-## Named residual
-
-The R13 invariant this module's scrubber enforces is **honestly scoped** to
-Python-stdio-mediated writes + known-shape CloudWatch patterns. See the
-brainstorm and the `sitecustomize.py` module docstring for the full list of
-stdio-bypass classes (os.write, subprocess env dumps, C-extension direct
-writes, multiprocessing workers, adversarial split-writes) that the Unit 12
-pattern backstop catches partially and the v2 in-process credential proxy
-addresses structurally.
+- Create per-tenant Code Interpreter instances — that's the `agentcore-admin` Lambda.
+- Build or push any container image.

package/dist/terraform/modules/app/agentcore-code-interpreter/main.tf

@@ -1,23 +1,25 @@
 ################################################################################
 # AgentCore Code Interpreter — App Module (stage-level)
 #
-# Stage-scoped artifacts for the AgentCore Code Interpreter sandbox:
-#   * ECR repository for the blessed sandbox base image (Python 3.12 +
-#     pinned libs + sitecustomize.py R13 scrubber baked in).
-#   * Lifecycle policy to trim old images.
-#   * Outputs the per-tenant provisioning Lambda (Unit 5) consumes to
-#     CreateCodeInterpreter for each tenant on demand.
+# Stage-scoped substrate for the AgentCore Code Interpreter sandbox:
+#   * The environment catalog (network modes) the runtime selects from.
+#   * IAM policy templates + capability-private VPC placement the per-tenant
+#     provisioning Lambda (Unit 5) consumes to CreateCodeInterpreter for each
+#     tenant on demand.
 #
 # **Per-tenant resources live elsewhere.** AgentCore Code Interpreter
 # instances are created per-tenant by the ``agentcore-admin`` Lambda at
 # tenant-create time — see docs/adrs/per-tenant-aws-resource-fanout.md.
 # This module stops at the stage-level substrate.
 #
-# **Image build.** The Dockerfile.sandbox-base next to this file is built
-# and pushed by a CI job (scripts/build_and_push_sandbox_base.sh) — not by
-# Terraform. Terraform owns the ECR repo and IAM plumbing; the image
-# lifecycle is intentionally owned by CI so a repository bump is a
-# reviewable PR rather than a ``terraform apply`` side-effect.
+# **No custom image (THINK-617).** This module used to own an ECR repo for a
+# "blessed" sandbox base image (Python 3.12 + pinned libs + a sitecustomize.py
+# stdio scrubber). AgentCore Code Interpreter has no way to attach one:
+# CreateCodeInterpreterRequest carries no image/container parameter. Sandboxes
+# always run the AWS-managed image; libraries that image may lack are installed
+# on demand by the runtime's execute_code preamble (ON_DEMAND_LIBRARIES in
+# packages/agentcore-pi/.../tools/execute-code.ts). The image substrate was
+# retired — git history and THINK-617 preserve it.
 ################################################################################
 
 terraform {
@@ -44,12 +46,6 @@ variable "account_id" {
   type        = string
 }
 
-variable "image_retention_count" {
-  description = "Keep the last N image tags in ECR; older ones are lifecycle-expired."
-  type        = number
-  default     = 10
-}
-
 # THINK-280 U4 — VPC placement for the capability-private interpreter. Sourced
 # (when the capability broker is enabled) from the broker module's no-NAT
 # interpreter subnets + dedicated egress-only SG. Empty by default: the
@@ -91,45 +87,6 @@ locals {
   }
 }
 
-################################################################################
-# ECR repository — stage-level base image
-################################################################################
-
-resource "aws_ecr_repository" "sandbox_base" {
-  name                 = "thinkwork-${var.stage}-sandbox-base"
-  image_tag_mutability = "IMMUTABLE"
-  force_delete         = true
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-
-  tags = {
-    Name    = "thinkwork-${var.stage}-sandbox-base"
-    Stage   = var.stage
-    Purpose = "agentcore-code-interpreter-base-image"
-  }
-}
-
-resource "aws_ecr_lifecycle_policy" "sandbox_base" {
-  repository = aws_ecr_repository.sandbox_base.name
-
-  policy = jsonencode({
-    rules = [{
-      rulePriority = 1
-      description  = "Keep last ${var.image_retention_count} images"
-      selection = {
-        tagStatus   = "any"
-        countType   = "imageCountMoreThan"
-        countNumber = var.image_retention_count
-      }
-      action = {
-        type = "expire"
-      }
-    }]
-  })
-}
-
 ################################################################################
 # IAM policy document — per-tenant trust template
 #
@@ -207,16 +164,6 @@ locals {
 # Outputs
 ################################################################################
 
-output "ecr_repository_name" {
-  description = "Name of the sandbox base image ECR repo."
-  value       = aws_ecr_repository.sandbox_base.name
-}
-
-output "ecr_repository_url" {
-  description = "Full URL of the sandbox base image ECR repo."
-  value       = aws_ecr_repository.sandbox_base.repository_url
-}
-
 output "environment_ids" {
   description = "Enum of valid sandbox environment identifiers."
   value       = keys(local.environments)

package/dist/terraform/modules/app/agentcore-identity/main.tf

@@ -0,0 +1,253 @@
+################################################################################
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = ">= 2.3.0"
+    }
+  }
+}
+# THINK-316 U1 — AgentCore Identity proof substrate
+#
+# The AWS provider does not yet model Workload Identity or OAuth2 credential
+# providers. A terraform_data lifecycle wrapper reconciles them with the
+# current AWS CLI and owns destroy cleanup. The client secret is passed only in
+# the local-exec environment and never printed by the scripts.
+################################################################################
+
+locals {
+  # THINK-324: the workload identity is SHARED — live Twenty 3LO
+  # (lib/harness/agentcore-user-oauth.ts via AGENTCORE_IDENTITY_WORKLOAD_NAME)
+  # rides the same workload identity the proof plane created. It must exist
+  # whenever either half is enabled, and its deletion is owned by the Twenty
+  # cleanup owner (not the proof lifecycle) so retiring the proof plane never
+  # invalidates per-user Twenty grants.
+  identity_enabled                = var.enabled || var.twenty_enabled
+  workload_identity_name          = "thinkwork-${var.stage}-multiplayer-proof"
+  credential_provider_name        = "thinkwork-${var.stage}-proof-oauth"
+  twenty_credential_provider_name = "thinkwork-${var.stage}-twenty-crm"
+  oauth_issuer = trimsuffix(var.oauth_issuer, "/")
+  # THINK-324: with the proof plane retired the issuer is empty; a bare
+  # "/complete" fails UpdateWorkloadIdentity's URL-pattern validation, so the
+  # proof return URL only joins the allowlist when an issuer is configured.
+  oauth_return_url                = local.oauth_issuer != "" ? "${local.oauth_issuer}/complete" : ""
+  allowed_oauth_return_urls       = distinct(concat(compact([local.oauth_return_url]), var.user_federation_return_urls))
+  configuration_hash = nonsensitive(sha256(jsonencode({
+    issuer        = local.oauth_issuer
+    client_id     = var.oauth_client_id
+    secret_digest = sha256(var.oauth_client_secret)
+    return_url    = local.oauth_return_url
+  })))
+  twenty_configuration_hash = nonsensitive(sha256(jsonencode({
+    allowed_oauth_return_urls       = local.allowed_oauth_return_urls
+    twenty_credential_provider_name = local.twenty_credential_provider_name
+    twenty_oauth_issuer             = var.twenty_oauth_issuer
+    twenty_oauth_resource           = var.twenty_oauth_resource
+    twenty_client_secret_arn        = try(aws_secretsmanager_secret.twenty_oauth_client[0].arn, "")
+    bootstrap_script_sha256         = filesha256("${path.module}/scripts/bootstrap_twenty_oauth_client.sh")
+    provider_reconciler_sha256      = filesha256("${path.module}/scripts/reconcile_twenty_provider.mjs")
+    identity_reconciler_sha256      = filesha256("${path.module}/scripts/reconcile_twenty_identity.sh")
+  })))
+}
+
+# The DCR client secret is written by the reconciler, not Terraform, so its
+# value never enters Terraform state. AgentCore Identity reads the JSON key
+# directly and remains the sole custodian of each user's downstream grant.
+resource "aws_secretsmanager_secret" "twenty_oauth_client" {
+  count = var.twenty_enabled ? 1 : 0
+
+  name                    = "thinkwork/${var.stage}/agentcore-identity/twenty-crm-oauth-client"
+  description             = "Confidential Twenty OAuth client used only by AgentCore Identity Token Vault"
+  recovery_window_in_days = 7
+
+  tags = {
+    "managed-by"        = "terraform"
+    "thinkwork:stage"   = var.stage
+    "thinkwork:purpose" = "agentcore-identity-user-federation"
+  }
+}
+
+resource "aws_secretsmanager_secret_policy" "twenty_oauth_client" {
+  count      = var.twenty_enabled ? 1 : 0
+  secret_arn = aws_secretsmanager_secret.twenty_oauth_client[0].arn
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid       = "AgentCoreIdentityRead"
+      Effect    = "Allow"
+      Principal = { Service = "bedrock-agentcore.amazonaws.com" }
+      Action    = "secretsmanager:GetSecretValue"
+      Resource  = aws_secretsmanager_secret.twenty_oauth_client[0].arn
+      Condition = {
+        StringEquals = { "aws:SourceAccount" = var.account_id }
+      }
+    }]
+  })
+}
+
+resource "terraform_data" "identity_lifecycle" {
+  count = var.enabled ? 1 : 0
+
+  input = {
+    region                   = var.region
+    workload_identity_name   = local.workload_identity_name
+    credential_provider_name = local.credential_provider_name
+  }
+  triggers_replace = [local.configuration_hash]
+
+  provisioner "local-exec" {
+    command = "bash ${path.module}/scripts/reconcile_identity.sh"
+    environment = {
+      AWS_REGION               = var.region
+      WORKLOAD_IDENTITY_NAME   = local.workload_identity_name
+      CREDENTIAL_PROVIDER_NAME = local.credential_provider_name
+      OAUTH_ISSUER             = local.oauth_issuer
+      OAUTH_CLIENT_ID          = var.oauth_client_id
+      OAUTH_CLIENT_SECRET      = var.oauth_client_secret
+      OAUTH_RETURN_URL         = local.oauth_return_url
+    }
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "bash ${path.module}/scripts/delete_identity.sh"
+    environment = {
+      AWS_REGION               = self.input.region
+      WORKLOAD_IDENTITY_NAME   = self.input.workload_identity_name
+      CREDENTIAL_PROVIDER_NAME = self.input.credential_provider_name
+    }
+  }
+}
+
+# THINK-324 — Twenty-side workload-identity guarantee. When the proof plane
+# is retired (enabled = false) the identity_lifecycle resource above no longer
+# runs, but live Twenty 3LO still needs the shared workload identity. This
+# ensure step is create-if-missing only (it never rewrites the return-url
+# allowlist — twenty_identity_reconciliation owns that) and has NO destroy
+# action; deletion is owned by workload_identity_cleanup_owner below.
+resource "terraform_data" "workload_identity_ensure" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                 = var.region
+    workload_identity_name = local.workload_identity_name
+  }
+
+  provisioner "local-exec" {
+    command = "bash ${path.module}/scripts/ensure_workload_identity.sh"
+    environment = {
+      AWS_REGION             = var.region
+      WORKLOAD_IDENTITY_NAME = local.workload_identity_name
+      OAUTH_RETURN_URLS_JSON = jsonencode(local.allowed_oauth_return_urls)
+    }
+  }
+}
+
+# THINK-324 — the shared workload identity's deletion moved here from the
+# proof lifecycle (delete_identity.sh no longer touches it): it is deleted
+# only when the Twenty identity half itself is removed, never when the proof
+# plane is retired. Note: on a hypothetical proof-only stage (enabled = true,
+# twenty_enabled = false) the workload identity is leaked on teardown rather
+# than risking a destructive replace of identity_lifecycle here; no such
+# stage exists (dev, the only proof stage, runs Twenty).
+resource "terraform_data" "workload_identity_cleanup_owner" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                 = var.region
+    workload_identity_name = local.workload_identity_name
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "bash ${path.module}/scripts/delete_workload_identity.sh"
+    environment = {
+      AWS_REGION             = self.input.region
+      WORKLOAD_IDENTITY_NAME = self.input.workload_identity_name
+    }
+  }
+}
+
+# Stable cleanup ownership is deliberately separate from reconciliation.
+# Script-only changes must never replace a resource whose destroy provisioner
+# deletes the external provider and invalidates its service-issued callback.
+resource "terraform_data" "twenty_identity_cleanup_owner" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                          = var.region
+    twenty_credential_provider_name = local.twenty_credential_provider_name
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "bash ${path.module}/scripts/delete_twenty_identity.sh"
+    environment = {
+      AWS_REGION                      = self.input.region
+      TWENTY_CREDENTIAL_PROVIDER_NAME = self.input.twenty_credential_provider_name
+    }
+  }
+}
+
+# Additive user-federation reconciliation. Code/configuration revisions replace
+# only this terraform_data record; it has no destroy action and always updates
+# the provider in place. The stable owner above deletes only when the module is
+# truly disabled or removed.
+resource "terraform_data" "twenty_identity_reconciliation" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                          = var.region
+    workload_identity_name          = local.workload_identity_name
+    twenty_credential_provider_name = local.twenty_credential_provider_name
+  }
+  triggers_replace = [local.twenty_configuration_hash]
+
+  provisioner "local-exec" {
+    command = "bash ${path.module}/scripts/reconcile_twenty_identity.sh"
+    environment = {
+      AWS_REGION                      = var.region
+      WORKLOAD_IDENTITY_NAME          = local.workload_identity_name
+      OAUTH_RETURN_URLS_JSON          = jsonencode(local.allowed_oauth_return_urls)
+      TWENTY_CREDENTIAL_PROVIDER_NAME = local.twenty_credential_provider_name
+      TWENTY_CLIENT_SECRET_ARN        = aws_secretsmanager_secret.twenty_oauth_client[0].arn
+      TWENTY_OAUTH_ISSUER             = trimsuffix(var.twenty_oauth_issuer, "/")
+      TWENTY_OAUTH_RESOURCE           = var.twenty_oauth_resource
+    }
+  }
+
+  depends_on = [
+    terraform_data.identity_lifecycle,
+    terraform_data.workload_identity_ensure,
+    terraform_data.twenty_identity_cleanup_owner,
+    aws_secretsmanager_secret_policy.twenty_oauth_client,
+  ]
+}
+
+# Read back the service-generated ARNs only after apply-time reconciliation.
+# Gateway IAM can therefore scope vault and secret access exactly rather than
+# granting a token-vault or Secrets Manager wildcard.
+data "external" "identity_state" {
+  count = local.identity_enabled ? 1 : 0
+  depends_on = [
+    terraform_data.identity_lifecycle,
+    terraform_data.workload_identity_ensure,
+    terraform_data.twenty_identity_reconciliation,
+  ]
+  program = ["bash", "${path.module}/scripts/read_identity.sh"]
+
+  query = {
+    region                 = var.region
+    workload_identity_name = local.workload_identity_name
+    # Empty names tell the reader to skip that half (THINK-324: the proof
+    # provider is absent once the proof plane is retired; the Twenty provider
+    # is absent on proof-only stages).
+    credential_provider_name        = var.enabled ? local.credential_provider_name : ""
+    twenty_credential_provider_name = var.twenty_enabled ? local.twenty_credential_provider_name : ""
+  }
+}

package/dist/terraform/modules/app/agentcore-identity/outputs.tf

@@ -0,0 +1,51 @@
+output "workload_identity_name" {
+  description = "Name used for GetWorkloadAccessTokenForJWT. Empty when disabled."
+  value       = local.identity_enabled ? local.workload_identity_name : ""
+}
+
+output "credential_provider_name" {
+  description = "AgentCore Identity OAuth2 credential-provider name. Empty when disabled."
+  value       = var.enabled ? local.credential_provider_name : ""
+}
+
+output "oauth_return_url" {
+  description = "Allowed user-federation return URL. Empty when disabled."
+  value       = var.enabled ? local.oauth_return_url : ""
+}
+
+output "twenty_credential_provider_name" {
+  description = "AgentCore Identity provider name for per-user Twenty grants."
+  value       = var.twenty_enabled ? local.twenty_credential_provider_name : ""
+}
+
+output "twenty_credential_provider_arn" {
+  description = "AgentCore Identity provider ARN for per-user Twenty grants."
+  value       = var.twenty_enabled ? data.external.identity_state[0].result.twenty_credential_provider_arn : ""
+}
+
+output "twenty_oauth_callback_url" {
+  description = "Service-generated callback URL registered with Twenty OAuth."
+  value       = var.twenty_enabled ? data.external.identity_state[0].result.twenty_oauth_callback_url : ""
+}
+
+output "twenty_client_secret_arn" {
+  description = "External Secrets Manager client record consumed by AgentCore Identity."
+  value       = var.twenty_enabled ? aws_secretsmanager_secret.twenty_oauth_client[0].arn : ""
+  sensitive   = true
+}
+
+output "workload_identity_arn" {
+  description = "Service-generated workload identity ARN. Empty when disabled."
+  value       = local.identity_enabled ? data.external.identity_state[0].result.workload_identity_arn : ""
+}
+
+output "credential_provider_arn" {
+  description = "Service-generated OAuth2 credential-provider ARN. Empty when disabled."
+  value       = var.enabled ? data.external.identity_state[0].result.credential_provider_arn : ""
+}
+
+output "credential_secret_arn" {
+  description = "AgentCore-managed Secrets Manager ARN backing the provider. Empty when disabled."
+  value       = var.enabled ? data.external.identity_state[0].result.credential_secret_arn : ""
+  sensitive   = true
+}