thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -14,6 +14,12 @@ locals {
   # deployment jobs — plan 2026-06-12-001 U10); the TWENTY config key is
   # retired.
   optional_integration_handler_names = concat(
+    var.auth_retirement_phase == "retired" ? [
+      # The native login UI never publishes this handler. It remains reachable
+      # only as an operator-controlled rollback seam through coexistence and
+      # cutover/soak, then Terraform removes the Lambda and routes atomically.
+      "workos-auth",
+    ] : [],
     var.deployment_control_plane_enabled ? [] : [
       # Host-only onboarding/deployment API. Customer foundations disable the
       # deployment control plane, so release-based customer installs must not
@@ -47,49 +53,59 @@ locals {
   # The reader-coverage fixture test in apps/cli fails CI if a key in this
   # map still has a direct process.env reader. Identity values (STAGE,
   # AWS_ACCOUNT_ID, NODE_OPTIONS) and secrets (DATABASE_URL,
-  # API_AUTH_SECRET, APPSYNC_API_KEY) stay out of this map — identity stays
+  # API_AUTH_SECRET) stay out of this map — identity stays
   # env forever, secrets live in Secrets Manager (R4), never in the String
   # document.
   config_env = merge({
     # THINK-173: PUBLIC verification key (not a secret) + the NAME of the
     # private-key secret (resolved via runtime-config's secret loader —
     # the PEM itself never enters the env or the String document).
-    CAPABILITY_SIGNING_PUBLIC_KEY         = var.capability_signing_public_key
-    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET = var.capability_signing_private_key_secret
-    # THINK-229 U3/KTD5 — the analyst policy-source enforcement flip.
-    # "row" (default) keeps sidecar policy shadow-only; "sidecar" makes the
-    # signed sidecar block authoritative (budgets/policyClaims flow). Flip
-    # ONLY after clean shadow parity on live traffic.
-    ANALYST_POLICY_SOURCE = var.analyst_policy_source
-    # Governed autonomy — per-tenant opt-in allowlist for autonomous capability
-    # self-extension (the two self_admit_connection / self_approve_routine
-    # actions on capability-control-service). Comma/space-separated tenant ids;
-    # empty (default) = NO tenant enabled, so self-extension ships inert and
-    # fail-closed. Read via getConfig() (env-wins) in isSelfExtensionEnabled.
-    CAPABILITY_SELF_EXTENSION_TENANTS = var.capability_self_extension_tenants
-    # THINK-230 — the operator-facing provisionAnalystConnector mutation runs
-    # the analyst connector provisioning ceremony inside graphql-http, so the
-    # shared api handlers read the same broker-secret ARN + rds_iam connect
-    # config the analyst-query-broker handler carries per-handler. Read via
-    # getConfig() (env-wins), never process.env (runtime-config fixture gate).
-    # ANALYST_DB_CLUSTER_ENDPOINT gates on the resource id so a stage without
-    # the IAM grant leaves rds_iam provisioning off (resolveAnalystRdsIamConfig
-    # returns null) instead of half-seeding a credential row.
-    ANALYST_BROKER_SECRET_ARN      = var.analyst_broker_secret_arn
-    ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
-    ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
-    ANALYST_DB_NAME                = var.database_name
-    ANALYST_DB_USER                = "analyst_reader"
-    DATABASE_SECRET_ARN            = var.graphql_db_secret_arn
-    DATABASE_HOST                  = var.db_cluster_endpoint
-    DATABASE_NAME                  = var.database_name
+    CAPABILITY_SIGNING_PUBLIC_KEY          = var.capability_signing_public_key
+    CAPABILITY_SIGNING_PRIVATE_KEY_SECRET  = var.capability_signing_private_key_secret
+    SUBSCRIPTION_TICKET_SIGNING_KEY_ID     = var.subscription_ticket_signing_key_id
+    SUBSCRIPTION_TICKET_PUBLIC_KEYS        = var.subscription_ticket_public_keys
+    SUBSCRIPTION_TICKET_PRIVATE_KEY_SECRET = var.subscription_ticket_private_key_secret
+    APPSYNC_API_ID                         = var.appsync_api_id
+    # THINK-585 U6 (KTD3): stage kill-switch for AgentCore Runtime chat
+    # dispatch. Empty when off (stripped from the document — getConfig sees
+    # unset). The per-agent agents.agentcore_runtime_dispatch flag gates on
+    # top; both must be on for a turn to ride the dispatcher.
+    AGENTCORE_RUNTIME_DISPATCH_ENABLED = var.agentcore_runtime_dispatch_enabled ? "true" : ""
+    # Neptune endpoint for the
+    # identity-graph-projector's nudge gate (THINK-339 U15: the twin READ
+    # Lambdas retired to the platform service; the write/projection lane
+    # stays product-side — the platform identity_sync pipeline invokes it).
+    # Document, not env: graphql-http's env sits near the 4KB ceiling.
+    # Readers use getConfig; env still wins on the VPC projector.
+    NEPTUNE_ENDPOINT = var.neptune_endpoint
+    # Consolidation U14: platform-served Brain MCP endpoint. When set,
+    # mcp-twin-provision registers the twin connector against it instead
+    # of the product /mcp/twin route. Empty = legacy default.
+    BRAIN_MCP_URL = var.brain_mcp_url
+    # THINK-781: Brain ops-api base URL + the agent-identity m2m secret the
+    # flagThreadToBrain resolver posts /flags with. NOT the /mcp lane pair
+    # above — POST /flags verifies against the Brain's operator pool, so it
+    # needs the etl-platform/agent/cognito-m2m-brain credential (scope
+    # etl-agent/tasks), not the brain-mcp platform-agent lane. Empty = the
+    # "Send to the Brain" action fails with "no Brain connection configured".
+    BRAIN_OPS_API_URL        = var.brain_ops_api_url
+    BRAIN_OPS_M2M_SECRET_ARN = var.brain_ops_m2m_secret_arn
+    # Same class of bug, second instance (2026-07-22): a post-apply
+    # twin-export hook read BRAIN_ARTIFACTS_BUCKET from env it never had
+    # and silently returned skipped_no_bucket on every apply.
+    # Document-served so every api handler resolves it via getConfig; the
+    # handlers that already carry it as env keep winning.
+    BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+    DATABASE_SECRET_ARN    = var.graphql_db_secret_arn
+    DATABASE_HOST          = var.db_cluster_endpoint
+    DATABASE_NAME          = var.database_name
     # THINK-280 U8: the LAST rollout gate. External capability search + the
     # Inspector governed-runtime operation layer stay inert until the broker is
     # enabled for the stage. Off by default — read via getConfig() (env-wins).
     CAPABILITY_EXTERNAL_SEARCH_ENABLED = var.enable_capability_broker ? "true" : "false"
     ENABLE_CAPABILITY_BROKER           = var.enable_capability_broker ? "true" : "false"
     # BUCKET_NAME and USER_POOL_ID were duplicate aliases of WORKSPACE_BUCKET
-    # and COGNITO_USER_POOL_ID; GRAPHQL_API_KEY duplicated APPSYNC_API_KEY;
+    # and COGNITO_USER_POOL_ID; the legacy GRAPHQL_API_KEY alias is retired;
     # THINKWORK_API_SECRET and EMAIL_HMAC_SECRET duplicated API_AUTH_SECRET
     # (~310 serialized bytes total). graphql-http sits at Lambda's hard 4KB
     # env ceiling (#2375) — every reader falls back to the canonical name.
@@ -101,9 +117,17 @@ locals {
     COGNITO_AUTH_BASE_URL       = local.mcp_oauth_cognito_base_url
     MCP_OAUTH_CALLBACK_URL      = "${local.mcp_oauth_api_base_url}/mcp/oauth/callback"
     MCP_OAUTH_REVOCATIONS_TABLE = aws_dynamodb_table.mcp_oauth_revocations.name
-    COGNITO_APP_CLIENT_IDS      = "${var.admin_client_id},${var.mobile_client_id}"
-    APPSYNC_ENDPOINT            = var.appsync_api_url
-    THINKWORK_API_URL           = local.api_base_url
+    # THINK-643: backing store for short-lived auth-flow state. While this is
+    # "postgres" the auth handlers never touch DynamoDB and AUTH_STATE_TABLE is
+    # empty (no table exists). Read via getConfig() — never process.env.
+    AUTH_STATE_STORE = var.auth_state_store
+    AUTH_STATE_TABLE = local.auth_state_enabled ? aws_dynamodb_table.auth_state[0].name : ""
+    # R16: comma-separated app-client allowlist. The optional console client id
+    # (U13) joins only when enabled; compact() drops the empty placeholder so
+    # the value is byte-identical to before while the console is off.
+    COGNITO_APP_CLIENT_IDS = join(",", compact([var.admin_client_id, var.mobile_client_id, var.console_client_id]))
+    APPSYNC_ENDPOINT       = var.appsync_api_url
+    THINKWORK_API_URL      = local.api_base_url
     # Deterministic routines v1 (plan 2026-07-03-004 U6): activates the
     # git-backed routine lifecycle tool suite on the admin-ops MCP server
     # (routine_repo_list/read/commit, routine_run_fixtures, routine_runs).
@@ -137,13 +161,11 @@ locals {
     # WORKSPACE_RENDERER_FUNCTION_NAME is derived from the per-stage naming
     # convention by deriveFunctionName("workspace-renderer") — stored
     # nowhere (R7).
-    WORKSPACE_BUCKET   = var.bucket_name
-    HINDSIGHT_ENDPOINT = var.hindsight_endpoint
-    # THINK-220 cutover flag: empty = hindsight schema on the primary DB;
-    # set = that database's public schema via the database-pg seam.
-    HINDSIGHT_DATABASE_NAME = var.hindsight_database_name
-    AGENTCORE_MEMORY_ID     = var.agentcore_memory_id
-    MEMORY_ENGINE           = var.memory_engine
+    WORKSPACE_BUCKET    = var.bucket_name
+    AGENTCORE_MEMORY_ID = var.agentcore_memory_id
+    # AgentCore managed memory is the only engine (THINK-407). The env var
+    # stays so the API's memory config seam keeps an explicit value.
+    MEMORY_ENGINE = "agentcore"
     # CHAT_AGENT_INVOKE_FN_ARN (~112 serialized bytes) was dropped for the
     # 4KB env ceiling (#2375): getChatAgentInvokeFnArn and managed-dispatch
     # now derive the ARN from the deterministic naming pattern
@@ -159,7 +181,6 @@ locals {
     # deploymentStatus reads ADMIN_URL directly — so the single canonical
     # ADMIN_URL is sufficient. Re-add aliases only after env vars move to SSM.
     ADMIN_URL            = var.admin_url
-    DOCS_URL             = var.docs_url
     APPSYNC_REALTIME_URL = var.appsync_realtime_url
     ECR_REPOSITORY_URL   = var.ecr_repository_url
     # Per-user OAuth wiring (Google Workspace today; Microsoft 365 follow-up).
@@ -231,18 +252,22 @@ locals {
   # window (R8). Config-class keys live ONLY in the SSM runtime-config
   # document now — adding a key here is guarded by the identity-allowlist
   # fixture test in apps/cli (R10). Follow-up release: DATABASE_URL,
-  # APPSYNC_API_KEY, and API_AUTH_SECRET drop too (readers already resolve
+  # API_AUTH_SECRET drops too (readers already resolve
   # via Secrets Manager prefetch when the env copies are absent), bringing
   # every handler under the ≤1KB R1 target.
   common_env = {
     STAGE           = var.stage
     DATABASE_URL    = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
-    APPSYNC_API_KEY = var.appsync_api_key
     API_AUTH_SECRET = var.api_auth_secret
     AWS_ACCOUNT_ID  = var.account_id
     NODE_OPTIONS    = "--enable-source-maps"
   }
 
+  # THINK-316 U1: the assertion mint runs on a sibling role and receives only
+  # the database connection plus immutable stage identity. In particular it
+  # does not inherit API_AUTH_SECRET or APPSYNC_API_KEY from common_env.
+
+
   # Per-handler env-var overrides. ARNs are constructed from the naming
   # pattern (same trick as the api-cross-function-invoke statement in
   # iam-grouped.tf) so we don't introduce a self-referential dependency
@@ -256,39 +281,26 @@ locals {
   }
 
   handler_extra_env = {
-    # Analyst query broker (THINK-228 U3). Reader role + caller credential
-    # secrets, and the workspace bucket's analyst-staging/ prefix for
-    # large-result CSVs (lifecycle TTL lives on the bucket module). The
-    # shared writer DATABASE_SECRET_ARN also lands in this handler's env
-    # via common_env, but the broker code never uses it — SQL runs only as
-    # analyst_reader.
-    "analyst-query-broker" = {
-      ANALYST_READER_SECRET_ARN = var.analyst_reader_secret_arn
-      ANALYST_BROKER_SECRET_ARN = var.analyst_broker_secret_arn
-      ANALYST_STAGING_BUCKET    = var.bucket_name
-      ANALYST_STAGING_PREFIX    = "analyst-staging"
-      # THINK-229 U1: RDS IAM connect config. Endpoint presence switches
-      # analyst-reader-db.ts to the IAM-token path (password secret above
-      # is the pre-GRANT-rds_iam fallback, retired once IAM is proven).
-      # Gated on the resource ID so a stage without the IAM grant keeps
-      # the password path instead of failing into the fallback every cold
-      # start.
-      ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
-      ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
-      ANALYST_DB_NAME                = var.database_name
-      ANALYST_DB_USER                = "analyst_reader"
-    }
-    # THINK-229 U5 — the connection reconciler probes the analyst_reader
-    # connection EXACTLY as the broker does (getAnalystReaderClient), so it
-    # needs the same IAM-connect config + the password-fallback secret. The
-    # shared lambda execution role already holds rds-db:connect on the
-    # analyst_reader dbuser (iam-grouped.tf, granted in U1), so no extra IAM.
-    "analyst-connection-reconciler" = {
-      ANALYST_READER_SECRET_ARN      = var.analyst_reader_secret_arn
-      ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
-      ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
-      ANALYST_DB_NAME                = var.database_name
-      ANALYST_DB_USER                = "analyst_reader"
+    "skills" = {
+      AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
+      AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
+      AGENTCORE_USER_OAUTH_RETURN_URL           = "${local.mcp_oauth_api_base_url}/api/skills/mcp-oauth/agentcore/complete"
+      AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
+    }
+    "workos-auth" = {
+      # During cutover/soak the callback, bridge, and logout paths remain for
+      # already-issued state, but the handler independently refuses every new
+      # WorkOS authorize start. Terraform removes the handler in retired.
+      AUTH_RETIREMENT_PHASE = var.auth_retirement_phase
+    }
+    "public-auth-options" = {
+      AUTH_RETIREMENT_PHASE = var.auth_retirement_phase
+    }
+    "auth-me" = {
+      AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
+    }
+    "auth-enrollment" = {
+      AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
     }
     # THINK-246: customer stages cannot send as the dev fallback domain
     # (noreply@agents.thinkwork.ai is only verified in the dev account) —
@@ -332,46 +344,6 @@ locals {
       CAPABILITY_BROKER_VPCE_DNS      = var.capability_broker_vpce_dns
       CAPABILITY_BROKER_SESSION_TABLE = var.capability_broker_session_table
     }
-    # Compounding Memory compile Lambda. Any Converse-compatible Bedrock
-    # model works; the planner + section-writer cap themselves at ~500
-    # records / 25 new pages per invocation so a 480 s timeout covers
-    # the worst case comfortably. Env vars come from variables so
-    # unrelated deploys don't wipe them back to defaults (the aggregation
-    # flag got reset on every terraform apply before this was pinned).
-    "wiki-compile" = {
-      BEDROCK_MODEL_ID                   = var.wiki_compile_model_id
-      WIKI_AGGREGATION_PASS_ENABLED      = var.wiki_aggregation_pass_enabled
-      WIKI_DETERMINISTIC_LINKING_ENABLED = var.wiki_deterministic_linking_enabled
-      # Wiki pipeline source dispatch (plan 2026-06-09-004 U10):
-      # 'planner' (default, LLM compile) | 'graph' (deterministic
-      # graph→wiki materializer over the knowledge-graph mirror).
-      WIKI_SOURCE = var.wiki_source
-      # Name (not value) of the SecureString SSM parameter that holds the
-      # Google Places API key. wiki-compile fetches + caches on cold start.
-      # The parameter may contain a placeholder value at apply time — the
-      # Lambda logs and degrades gracefully if decryption returns empty.
-      GOOGLE_PLACES_SSM_PARAM_NAME = "/thinkwork/${var.stage}/google-places/api-key"
-      # THINK-200 chain: a successful compile Event-invokes okf-materialize
-      # so the OKF projection (and, chained, the Pi navigator's EFS view)
-      # stays current without manual invocation.
-      OKF_MATERIALIZE_FN_NAME = "thinkwork-${var.stage}-api-okf-materialize"
-    }
-    "ontology-scan" = {
-      BEDROCK_MODEL_ID = var.wiki_compile_model_id
-    }
-    "wiki-export" = {
-      WIKI_EXPORT_BUCKET     = aws_s3_bucket.wiki_exports.bucket
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-    }
-    "okf-materialize" = {
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-      # THINK-200 chain: fresh bundles fan out to the EFS current view.
-      OKF_EFS_REFRESH_FN_NAME = "thinkwork-${var.stage}-api-okf-efs-refresh"
-    }
-    "okf-efs-refresh" = {
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-      OKF_EFS_ROOT           = var.okf_efs_mount_path
-    }
     # THINK-193 U1 (Codex F6): normalized evidence snapshots live in the
     # encrypted brain-artifacts bucket under evidence-snapshots/ — Postgres
     # keeps only the s3:// ref + hash. 30-day lifecycle expiration below.
@@ -402,56 +374,72 @@ locals {
       CONTEXT_ENGINE_MEMORY_QUERY_MODE = "reflect"
       CONTEXT_ENGINE_MEMORY_TIMEOUT_MS = "20000"
     }
-    # Agent graph access (plan 2026-06-09-004 U8): stage gate for the Pi
-    # knowledge_graph_search tool; the per-agent tool policy gates on top.
+    "agentcore-runtime-dispatch" = {
+      # THINK-585 U6: the dispatcher resolves the Pi runtime id from SSM
+      # (5-min cache) and derives the ARN from identity env. Stage-scoped
+      # param name is config, not identity — env is the right layer.
+      AGENTCORE_PI_RUNTIME_SSM_NAME = "/thinkwork/${var.stage}/agentcore/runtime-id-pi"
+      # THINK-909: runtime session scope. "thread" (default) keys the
+      # AgentCore session per thread — today's behavior. "user" keys it per
+      # (tenant, agent, user) so a new thread reuses the warm microVM, with
+      # an immediate per-thread fallback on a 409. Flip a stage to "user"
+      # ONLY after its Pi runtime image dual-accepts both session ids.
+      AGENTCORE_SESSION_SCOPE = var.agentcore_session_scope
+    }
     "chat-agent-invoke" = {
-      KNOWLEDGE_GRAPH_TOOL_ENABLED = tostring(var.knowledge_graph_tool_enabled)
-    }
-    # 240s: sync Hindsight retain (LLM extraction + auto-consolidation) can
-    # exceed 60s; the client timeout must stay below the Lambda timeout (300s)
-    # and below the Hindsight ALB idle_timeout (300s) so failures classify as
-    # client timeouts, never ALB 504s.
-    "memory-retain" = {
-      HINDSIGHT_TIMEOUT_MS = "240000"
-    }
-    "brain-dream-state" = {
-      BRAIN_DREAM_STATE_ENABLED = tostring(var.brain_dream_state_enabled)
-    }
-    # THINK-307 KTD2: the origin-freshness guard reads the same stall
-    # threshold as the stall monitor — one operational knob, two consumers,
-    # no drift between "stalled" and "recovered".
-    "cron-retry-dispatcher" = {
-      STALL_THRESHOLD_MINUTES = tostring(var.stall_threshold_minutes)
-    }
-    # Bedrock KB provisioning. Per-handler (not common_env) so these don't bloat
-    # the already-near-4KB graphql-http env. Bedrock's RDS-backed KB needs the
-    # cluster ARN + the KB service role (passed at CreateKnowledgeBase time).
-    "knowledge-base-manager" = {
-      KB_SERVICE_ROLE_ARN  = var.kb_service_role_arn
-      DATABASE_CLUSTER_ARN = var.db_cluster_arn
-    }
-    # Observations → Knowledge Graph worker. Extraction is now a Bedrock
-    # structured-output call inside this Lambda. KG_EXTRACTION_MODEL_ID pins
-    # the gpt-oss extraction model (Bedrock IAM via the shared lambda_bedrock
-    # invoke policy, same as the promotion-gate classifier).
-    "knowledge-graph-observations-ingest" = {
-      BRAIN_ARTIFACTS_BUCKET          = aws_s3_bucket.brain_artifacts.bucket
-      OBSERVATION_CLASSIFIER_MODEL_ID = var.observation_classifier_model_id
-      KG_EXTRACTION_MODEL_ID          = var.kg_extraction_model_id
-      # Per-run candidate cap bounds classifier + extraction cost; a
-      # truncated backlog drains via an in-process loop inside one
-      # invocation (never Lambda self-invoke — AWS recursive-loop
-      # detection terminates worker-to-self Event chains).
-      KG_OBS_MAX_CANDIDATES_PER_RUN = var.kg_obs_max_candidates_per_run
-      # THINK-193 U4 dead-handoff fix: a successful observations ingest
-      # enqueues the tenant graph wiki-compile job inside its own commit
-      # and Event-invokes wiki-compile post-commit. WIKI_SOURCE must match
-      # the wiki-compile handler's dispatch flag (stage-global); the
-      # per-tenant kill switch stays tenants.wiki_compile_enabled. The
-      # invoke rides the shared lambda role's existing wiki-compile
-      # lambda:InvokeFunction grant (iam-grouped.tf); the function name is
-      # derived from STAGE (common_env) at call time.
-      WIKI_SOURCE = var.wiki_source
+      # THINK-324 C18: mint the signed-turn assertion with the active key.
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+      # THINK-321 U5: stage gate for the Pi identity-resolution tools; the
+      # per-agent tool policy gates on top. Mirrored on wakeup-processor so
+      # wakeup turns carry the same payload flag (env-gated feature is dead
+      # in deployed stacks without the terraform var).
+      IDENTITY_RESOLUTION_ENABLED = tostring(var.identity_resolution_tool_enabled)
+      # THINK-311 U5: no HARNESS_RUNNER_FUNCTION_NAME env — derivable
+      # thinkwork-<stage>-api-* names never ride env (R1/R10 identity-only
+      # rule); resolveRuntimeFunctionName derives it from STAGE at call
+      # time, exactly like workspace-renderer.
+    }
+    # THINK-321 U5: wakeup turns read the same identity-resolution stage
+    # gate as chat-agent-invoke (both payload builders emit
+    # identity_resolution_enabled).
+    "wakeup-processor" = {
+      # THINK-324 C18: wakeup dispatches mint the same signed-turn assertion.
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+      IDENTITY_RESOLUTION_ENABLED         = tostring(var.identity_resolution_tool_enabled)
+    }
+    # THINK-324 C18/C19: the ledger endpoint verifies presented assertions
+    # with the cached public key of the same active mint key. Required mode:
+    # its only producer (the Pi tool-execution emitter) echoes the assertion
+    # since C18, so assertion-less ledger writes are refused. Verifier
+    # unavailability still degrades to bearer-only (never a write outage);
+    # a mint failure at dispatch costs that turn's evidence, logged loudly.
+    "tool-executions" = {
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+      TURN_ASSERTION_REQUIRED             = "true"
+    }
+    # THINK-324 C19: activity + finalize verify presented assertions
+    # (tolerant posture — legacy producers don't echo yet).
+    "chat-agent-activity" = {
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+    }
+    "chat-agent-finalize" = {
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+    }
+    # THINK-316 U5: the runner reads the server-only attested profile and
+    # invokes its named endpoint with a purpose-bound CUSTOM_JWT. It receives
+    # no Harness control-plane inputs or permissions.
+    # 240s: a sync memory retain (LLM extraction + consolidation) can exceed
+    # 60s; the client timeout must stay below the Lambda timeout.
+    # Company Brain U5: Neptune coordinates for the twin graph projector.
+    # Empty endpoint leaves the projector inert (nudge helper skips too).
+    "identity-graph-projector" = {
+      NEPTUNE_ENDPOINT       = var.neptune_endpoint
+      NEPTUNE_PORT           = "8182"
+      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+      # Bulk-rebuild lane (THINK-331): loader staging coordinates. Empty =
+      # bulk-rebuild mode returns a structured "not configured" error.
+      NEPTUNE_LOAD_BUCKET     = var.neptune_load_bucket
+      NEPTUNE_LOADER_ROLE_ARN = var.neptune_loader_role_arn
     }
     # routine-task-python (Phase B U6) needs the AgentCore code-interpreter
     # id + the per-stage S3 routine-output bucket. The interpreter id is
@@ -587,10 +575,17 @@ resource "aws_lambda_function" "skill_trust_runner" {
 # Helper: creates Lambda functions from a local zip directory or release S3 keys
 # ---------------------------------------------------------------------------
 
-resource "aws_lambda_function" "handler" {
-  for_each = local.deploy_lambda_handlers ? setsubtract(toset([
+# The set of api handlers this module deploys (the for_each source for
+# aws_lambda_function.handler). Hoisted into a local so the per-handler VPC
+# placement map below (THINK-1082) can be built over the same names.
+locals {
+  handler_names = local.deploy_lambda_handlers ? setsubtract(toset([
     "graphql-http",
     "chat-agent-invoke",
+    # THINK-585 U6: thin waiting dispatcher (InvokeAgentRuntime, held
+    # connection) + its DLQ redrive consumer (see dispatch-dlq.tf).
+    "agentcore-runtime-dispatch",
+    "agentcore-dispatch-dlq-redrive",
     # Mobile agent harness: cloud Bedrock Converse proxy + completed-turn
     # persistence. Routes for these live in local.api_routes; the function
     # names must also be listed here (this set is the for_each source for
@@ -611,13 +606,6 @@ resource "aws_lambda_function" "handler" {
     # Client Engagement app API. Calls Twenty REST API directly server-side;
     # it is not backed by ThinkWork GraphQL or the agent MCP runtime.
     "twenty-client-engagement",
-    # Desktop-local Pi tombstone endpoints. Kept temporarily so old packaged
-    # desktop clients receive a stable 410 while all supported Pi execution
-    # routes through managed AgentCore.
-    "desktop-runtime-session",
-    "desktop-workspace-prewarm",
-    "managed-delegation",
-    "desktop-eval-runs",
     # chat-agent-finalize — POST /api/threads/{threadId}/finalize. The
     # AgentCore runtime POSTs here at end-of-turn so the post-AgentCore
     # bookkeeping (cost recording, message insert, AppSync notify,
@@ -626,6 +614,14 @@ resource "aws_lambda_function" "handler" {
     # Bearer API_AUTH_SECRET. Idempotent on thread_turns.finalized_at
     # (migration 0123). Plan: 2026-05-22-006.
     "chat-agent-finalize",
+    # agents. The chat dispatch selector (resolveRuntimeFunctionName) routes
+    # a trial agent's turn here instead of the Pi container Lambda; the
+    # runner projects the payload into an AWS AgentCore Harness config,
+    # drives InvokeHarness, fulfills emit_document, and finalizes the turn
+    # via processFinalize. No API route — direct Event invoke only.
+    # THINK-316 U1: direct-invoke-only assertion mint. It derives all identity
+    # claims from the persisted turn tuple and signs with a dedicated KMS key;
+    # there is intentionally no public API Gateway route.
     # canvas-refresh — headless Living Artifacts data-refresh (THINK-145 U6).
     # Invoked RequestResponse by the refreshCanvasData mutation (graphql-http)
     # and by job-trigger's canvas_refresh branch (U7). Re-runs the saved
@@ -659,7 +655,13 @@ resource "aws_lambda_function" "handler" {
     "stripe-subscription",
     "deployment-sessions",
     "auth-me",
+    "auth-revoke",
+    "auth-enrollment",
+    "auth-subscription-ticket",
+    "appsync-subscription-authorizer",
+    "subscription-invalidation",
     "public-auth-options",
+    "auth-provider-reconcile",
     "workos-auth",
     # Public artifact share links (THINK-208): GET /share/{token}, token
     # verified in handler code (no gateway auth, uniform 404 on any miss).
@@ -675,6 +677,9 @@ resource "aws_lambda_function" "handler" {
     "mcp-open-engine",
     # THINK-280 U8: scoped external capability search MCP facade.
     "mcp-capability-search",
+    # THINK-333 / consolidation U14: provisions the tenant Brain MCP
+    # connector against the platform endpoint (BRAIN_MCP_URL).
+    "mcp-twin-provision",
     "activity",
     "routines",
     "budgets",
@@ -689,16 +694,7 @@ resource "aws_lambda_function" "handler" {
     "webhooks-admin",
     "webhook-deliveries-cleanup",
     "skill-runs-reconciler",
-    # THINK-229 U5 — probes the analyst_reader connection (reachability, IAM
-    # auth, SELECT-grant introspection, schema drift; all read-only) every 30
-    # min and stamps the verdict onto runtime_metadata.analyst_probe so
-    # dispatch can withhold a failing/stale connection loudly.
-    "analyst-connection-reconciler",
     "cron-stall-monitor",
-    # THINK-307: drains retry_queue rows the stall monitor enqueues. Built by
-    # scripts/build-lambdas.sh since PRD-09 but first registered here; its
-    # schedule ships DISABLED (var.retry_dispatcher_enabled default false).
-    "cron-retry-dispatcher",
     "webhook-crm-opportunity",
     "webhook-task-event",
     "workspace-files",
@@ -706,8 +702,6 @@ resource "aws_lambda_function" "handler" {
     # 2026-06-12-002 U4). Bearer API_AUTH_SECRET + x-tenant-id; the runtime
     # fetch tool authorizes here, then downloads the returned S3 keys itself.
     "workspace-fetch-source",
-    "knowledge-base-manager",
-    "knowledge-base-files",
     "email-send",
     "email-inbound",
     "email-provider-webhook",
@@ -718,9 +712,7 @@ resource "aws_lambda_function" "handler" {
     "msteams-install-complete",
     "msteams-account-link-complete",
     "github-app",
-    "memory",
     "memory-retain",
-    "brain-dream-state",
     "memory-stage-worker",
     # THINK-193 U2 (Codex P1 #3): scheduled retry drainer for the retraction
     # saga ledger. Claims due/stale memory_retraction_attempts rows with the
@@ -735,15 +727,15 @@ resource "aws_lambda_function" "handler" {
     # terminal step event + SendTaskFailure. rate(15 minutes) schedule
     # (dedicated resource below).
     "memory-stage-sweeper",
-    "wiki-compile",
-    "knowledge-graph-observations-ingest",
-    "ontology-scan",
-    "ontology-reprocess",
-    "wiki-lint",
-    "wiki-export",
-    "okf-materialize",
-    "okf-efs-refresh",
-    "wiki-bootstrap-import",
+    # THINK-321 U7: bootstrap/drift identity matching job. Event-invoked by
+    # startIdentityMatchJob; the drift EventBridge Scheduler rule targets it
+    # directly (identity_drift_match_enabled, ships DISABLED).
+    "identity-match",
+    # Company Brain U5 (KTD-4): identity → twin graph projector. VPC-attached
+    # (Neptune). Event-invoked as a post-commit nudge by identity mutations;
+    # RequestResponse for the rebuild command. The per-tenant cursor row is
+    # the source of truth — missed nudges are harmless.
+    "identity-graph-projector",
     "artifact-deliver",
     "recipe-refresh",
     "agent-skills-list",
@@ -830,16 +822,14 @@ resource "aws_lambda_function" "handler" {
     # Admin-Ops MCP — JSON-RPC endpoint at POST /mcp/admin, exposes the
     # @thinkwork/admin-ops package as MCP tools for managed agents.
     "admin-ops-mcp",
-    # Analyst query broker — first-party MCP server at POST /mcp/analyst
-    # (THINK-228 U3). One tool, query: EXPLAIN-gated, extended-protocol
-    # single-statement SQL as the analyst_reader role; large results stage
-    # to S3 under analyst-staging/; every query emits a data.query_executed
-    # compliance audit event via POST /api/compliance/events.
-    "analyst-query-broker",
     # MCP admin key management — per-tenant Bearer tokens for admin-ops.
     # Admin-ops-mcp authenticates incoming tokens by sha256-hash lookup
     # against tenant_mcp_admin_keys, populated by this handler's routes.
     "mcp-admin-keys",
+    # Brain API key management — user-minted `tkt_` Bearer tokens for the
+    # platform Company Brain MCP. Create/revoke republish the hashed-key
+    # manifest the platform verifier reads (twin-mcp-keys/<tenantId>/).
+    "brain-api-keys",
     # One-shot tenant provisioning: mints a tkm_ key + stores in Secrets
     # Manager at thinkwork/<stage>/mcp/<tenantId>/admin-ops + upserts
     # tenant_mcp_servers. SM IAM is already granted on thinkwork/* by
@@ -854,6 +844,16 @@ resource "aws_lambda_function" "handler" {
     # Daily sweeper: auto-rejects MCP servers pending > 30 days. Triggered
     # by EventBridge schedule (mcp-approval-sweeper-daily).
     "mcp-approval-sweeper",
+    # Daily sweeper: cancels computer_approval inbox items past expires_at
+    # (or older than the TTL, for rows predating it). Keeps the approvals
+    # queue a list of live decisions instead of a months-deep graveyard.
+    "inbox-approval-sweeper",
+    # Hourly retention sweeper for auth_subscription_tickets. Tickets are
+    # single-use and expire 60s after mint but were never deleted; the
+    # table reached 551k rows / 306 MB (idx_scan=0) on a customer stage.
+    # Batched ctid DELETEs, 1h grace past expires_at. Triggered by
+    # EventBridge (aws_scheduler_schedule.auth_ticket_sweeper).
+    "auth-ticket-sweeper",
     # Finance pilot U2 — thread-attachment upload (presign + finalize).
     # presign issues a 5-min PUT URL the end-user client uses to push
     # Excel/CSV bytes directly to S3; finalize sniffs magic bytes, scans
@@ -863,6 +863,11 @@ resource "aws_lambda_function" "handler" {
     # threads.tenant_id lookup. Needs WORKSPACE_BUCKET env for S3.
     "thread-attachments-presign",
     "thread-attachments-finalize",
+    # Runtime-generated file registration (execute_code output_files).
+    # Bearer API_AUTH_SECRET + x-tenant-id; the Pi runtime uploads the
+    # sandbox file to the same staging prefix and registers it here with
+    # the same magic-byte + OOXML validation as finalize.
+    "thread-attachments-register",
     # U9-remainder of finance pilot — tenant-pinned download endpoint.
     # GET /api/threads/{tid}/attachments/{aid}/download returns a 302
     # to a 5-minute presigned S3 GET URL with ResponseContentDisposition:
@@ -877,14 +882,10 @@ resource "aws_lambda_function" "handler" {
     # POSTs one row per agent-session-start. Shared
     # API_AUTH_SECRET bearer (runtime→API; no tenant OAuth).
     "manifest-log",
-    # Governed capability runtime control-plane service (THINK-280 U2).
-    # NO HTTP route: the Pi container invokes it directly (RequestResponse)
-    # via lambda:InvokeFunction over the approved in-account path — public
-    # execute-api is not reliable from Pi's private VPC. Identity comes
-    # exclusively from the Ed25519-signed capability caller context (the
-    # CAPABILITY_SIGNING_PUBLIC_KEY in the shared runtime-config document
-    # verifies it); plaintext payload fields are never trusted.
-    "capability-control-service",
+    # Pi tool-execution ledger write endpoint (THINK-324 C17). The runtime
+    # POSTs paired started/terminal evidence rows per tool call. Shared
+    # API_AUTH_SECRET bearer (runtime→API; no tenant OAuth).
+    "tool-executions",
     # SI-7 catalog-list read endpoint (plan §U15 pt 3/3). The runtime
     # fetches the allowed builtin-tool slug set once per
     # session-start + feature-flag-gated enforcement filter drops
@@ -924,7 +925,39 @@ resource "aws_lambda_function" "handler" {
     # new standalone resource (see U8b plan operator-step section).
   ]), toset(local.optional_integration_handler_names)) : toset([])
 
+  # THINK-1082: one vpc_config per function, resolved here so the resource
+  # block stays a single dynamic block. Three shapes:
+  #   - identity-graph-projector with Neptune wired: the Neptune subnets (the
+  #     projector must reach the Neptune cluster), security groups = the
+  #     Neptune client SGs UNION the api-lambda SGs when lambdas_in_vpc is on
+  #     (the projector also opens DATABASE_URL, so it needs the DB grant too).
+  #   - any handler when lambdas_in_vpc: the VPC subnets + api-lambda SGs.
+  #   - otherwise null: no vpc_config, byte-identical to today.
+  handler_vpc = {
+    for name in local.handler_names : name => (
+      name == "identity-graph-projector" && local.neptune_vpc_enabled ? {
+        subnet_ids = var.neptune_subnet_ids
+        security_group_ids = distinct(concat(
+          var.neptune_security_group_ids,
+          var.lambdas_in_vpc ? var.vpc_security_group_ids : [],
+        ))
+        } : var.lambdas_in_vpc ? {
+        subnet_ids         = var.vpc_subnet_ids
+        security_group_ids = var.vpc_security_group_ids
+      } : null
+    )
+  }
+}
+
+resource "aws_lambda_function" "handler" {
+  for_each = local.handler_names
+
   function_name = "thinkwork-${var.stage}-api-${each.key}"
+  # THINK-583 U3: publish a numbered version for the two chat-critical
+  # handlers only — provisioned concurrency requires a published version
+  # behind the `live` alias (resources below). Scoped so the other ~90
+  # handlers don't accumulate a version per apply.
+  publish = contains(local.provisioned_concurrency_handlers, each.key)
   # S2 (THINK-193 U2): memory-retraction-drainer runs under a DEDICATED role
   # so its destructive evidence-snapshot S3 capability (version enumeration +
   # bulk version deletion) never leaks into the 90+ handlers on the shared
@@ -942,14 +975,10 @@ resource "aws_lambda_function" "handler" {
   depends_on = [
     aws_ssm_parameter.runtime_config,
     aws_secretsmanager_secret_version.api_auth,
-    aws_secretsmanager_secret_version.appsync_api_key,
   ]
   # eval-runner walks every test case sequentially, invoking an agent +
   # waiting up to 2 min for spans to propagate per test, so a 10-test run
   # can easily exceed the 30 s default. 900 s covers ~5-15 min sweeps.
-  # wiki-bootstrap-import runs a full Hindsight ingest for ~3,000 records;
-  # the LLM-backed retain path makes it the longest-running Lambda in the
-  # set. 900 s is Lambda's per-invocation max and matches eval-runner's ceiling.
   # routine-task-python wraps a 300s sandbox session and needs headroom
   # for the Start/Invoke/Stop/S3-offload round trip; 360s leaves ~60s
   # for AWS-call setup and offload after the sandbox's own ceiling.
@@ -957,8 +986,16 @@ resource "aws_lambda_function" "handler" {
   # validates the agent, builds the AgentCore invoke payload, dispatches
   # Event-mode, and returns. Setup is ~5s in practice; 60s gives 12×
   # headroom for transient slowness.
-  timeout     = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
-  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
+  # reference QBR run was ~2 min; 900s is the ceiling — a longer run is a
+  # legitimate trial limitation, recorded, not engineered around).
+  timeout = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "agentcore-runtime-dispatch" ? 900 : each.key == "agentcore-dispatch-dlq-redrive" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "requester-memory-dreaming" ? 300 : each.key == "identity-match" ? 300 : each.key == "identity-graph-projector" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "auth-ticket-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
+  # THINK-583 U2: chat-agent-invoke and workspace-renderer get a full vCPU
+  # (1769 MB). At 256 MB (~1/7 vCPU) the parallelized setup awaits starved on
+  # CPU — per-leg timing showed three independent {1 DB read + 1 S3/Secrets
+  # read} legs each taking ~1.5 s in parallel while sequential stage-1 reads
+  # were fast. Memory is priced per GB-s, but wall-clock drops far more than
+  # 7x cost rises on these short, provisioned-concurrency-warmed functions.
+  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "requester-memory-dreaming" ? 512 : each.key == "identity-match" ? 512 : each.key == "identity-graph-projector" ? min(8192, var.lambda_max_memory_mb) : each.key == "folder-bundle-import" ? 1024 : each.key == "chat-agent-invoke" ? 1769 : each.key == "workspace-renderer" ? 1769 : each.key == "agentcore-runtime-dispatch" ? 512 : 256
 
   filename         = local.use_local_zips ? "${var.lambda_zips_dir}/${each.key}.zip" : null
   source_code_hash = local.use_local_zips ? filebase64sha256("${var.lambda_zips_dir}/${each.key}.zip") : null
@@ -976,14 +1013,7 @@ resource "aws_lambda_function" "handler" {
   # document-conformance-judge is also a single-writer: direct
   # process-and-complete with no in-flight claim status depends on never
   # having two sweepers race the same pending rows (THINK-189 KTD4).
-  # analyst-query-broker is capped low: each concurrent execution holds a
-  # dedicated analyst_reader Postgres connection and runs model-authored
-  # SQL — the cap bounds both connection pressure and the blast radius of
-  # a runaway delegation (THINK-228 U3).
-  # analyst-connection-reconciler is capped at 1: the probe holds one
-  # analyst_reader connection and overlapping probes are pointless (the
-  # cluster-global reader has one grant surface / one live schema).
-  reserved_concurrent_executions = each.key == "compliance-outbox-drainer" ? 1 : each.key == "document-conformance-judge" ? 1 : each.key == "eval-worker" ? 40 : each.key == "analyst-query-broker" ? 4 : each.key == "analyst-connection-reconciler" ? 1 : -1
+  reserved_concurrent_executions = each.key == "compliance-outbox-drainer" ? 1 : each.key == "document-conformance-judge" ? 1 : each.key == "eval-worker" ? 40 : -1
 
   environment {
     variables = merge(
@@ -993,44 +1023,22 @@ resource "aws_lambda_function" "handler" {
     )
   }
 
+  # Company Brain U5 + THINK-1082: at most one vpc_config per function. The
+  # placement (Neptune projector, whole-module VPC lane, or none) is resolved
+  # in local.handler_vpc above; absent entirely when that entry is null.
   dynamic "vpc_config" {
-    for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
-
-    content {
-      subnet_ids         = var.okf_efs_subnet_ids
-      security_group_ids = var.okf_efs_security_group_ids
-    }
-  }
-
-  # Analyst data-path handlers get a stable NAT egress IP when
-  # analyst_egress_subnet_ids is set — external Postgres sources behind an IP
-  # allowlist admit that one EIP. Disjoint from the okf-efs-refresh block
-  # above (a function takes at most one vpc_config).
-  dynamic "vpc_config" {
-    for_each = contains(local.analyst_vpc_handlers, each.key) && local.analyst_vpc_enabled ? [1] : []
-
-    content {
-      subnet_ids         = var.analyst_egress_subnet_ids
-      security_group_ids = var.analyst_egress_security_group_ids
-    }
-  }
-
-  dynamic "file_system_config" {
-    for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
+    for_each = local.handler_vpc[each.key] == null ? [] : [local.handler_vpc[each.key]]
 
     content {
-      arn              = var.okf_efs_refresh_access_point_arn
-      local_mount_path = var.okf_efs_mount_path
+      subnet_ids         = vpc_config.value.subnet_ids
+      security_group_ids = vpc_config.value.security_group_ids
     }
   }
 
   lifecycle {
     precondition {
-      condition = each.key != "okf-efs-refresh" || var.okf_efs_refresh_access_point_arn == "" || (
-        length(var.okf_efs_mount_target_ids) == length(var.okf_efs_subnet_ids) &&
-        alltrue([for id in var.okf_efs_mount_target_ids : id != ""])
-      )
-      error_message = "okf-efs-refresh requires an available EFS mount target dependency for every configured subnet."
+      condition     = local.lambda_vpc_inputs_complete
+      error_message = "lambdas_in_vpc requires non-empty vpc_subnet_ids and vpc_security_group_ids."
     }
   }
 
@@ -1041,31 +1049,59 @@ resource "aws_lambda_function" "handler" {
 }
 
 # ---------------------------------------------------------------------------
-# wiki-compile async retry config + DLQ
+# Warm sessions (THINK-583 U3): published version + `live` alias +
+# provisioned concurrency for chat-agent-invoke and workspace-renderer
 # ---------------------------------------------------------------------------
+# KTD5: these two zip Lambdas ONLY — never the Pi Lambda (its warmth is
+# superseded by AgentCore session reuse, and deploy.yml publishes Pi code
+# to $LATEST out-of-band).
 #
-# AWS Lambda's default async invoke retries the function 2 times with a
-# 1-minute delay before sending failures to a DLQ (or dropping). For
-# wiki-compile, retries duplicate Bedrock cost AND can produce duplicate
-# user-visible threads + workspace_runs (the brain-enrichment draft path
-# in particular — see plan 2026-05-01-002 U5/U6 and
-# docs/solutions/architecture-patterns/async-retry-idempotency-lessons).
-#
-# Pin retries to 0 and route failures to a dedicated DLQ. The runner's
-# job-status short-circuit (running/succeeded/failed/skipped) is the
-# in-process protection against duplicate writebacks; this is the
-# infrastructure-level belt-and-suspenders.
+# Provisioned concurrency only serves invokes addressed to the alias, so
+# EVERY invoker resolves `<fn>:live` (graphql/utils.ts, mobile-turns/
+# managed-dispatch.ts, and the workspaceRendererFunctionName helpers in
+# chat-agent-invoke.ts / wakeup-processor.ts). The alias exists even when
+# the concurrency count is 0 — an alias with no PC config serves normally
+# from $LATEST-equivalent cold starts — so disabled stages keep working
+# unchanged and opt in purely by raising the count variable.
 
-resource "aws_sqs_queue" "wiki_compile_dlq" {
-  count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-wiki-compile-dlq"
-  message_retention_seconds = 1209600 # 14 days
-
-  tags = {
-    Name = "thinkwork-${var.stage}-wiki-compile-dlq"
+locals {
+  provisioned_concurrency_handlers = toset([
+    "chat-agent-invoke",
+    "workspace-renderer",
+  ])
+  provisioned_concurrency_counts = {
+    "chat-agent-invoke"  = var.chat_agent_invoke_provisioned_concurrency
+    "workspace-renderer" = var.workspace_renderer_provisioned_concurrency
   }
 }
 
+resource "aws_lambda_alias" "live" {
+  for_each = local.deploy_lambda_handlers ? local.provisioned_concurrency_handlers : toset([])
+
+  name             = "live"
+  description      = "Warm-session alias (THINK-583 U3) — provisioned-concurrency target; all invokers alias-qualify."
+  function_name    = aws_lambda_function.handler[each.key].function_name
+  function_version = aws_lambda_function.handler[each.key].version
+}
+
+resource "aws_lambda_provisioned_concurrency_config" "live" {
+  # aws_lambda_provisioned_concurrency_config rejects a count of 0, so a
+  # disabled handler simply has no config resource (the alias remains).
+  for_each = local.deploy_lambda_handlers ? {
+    for name in local.provisioned_concurrency_handlers :
+    name => local.provisioned_concurrency_counts[name]
+    if local.provisioned_concurrency_counts[name] > 0
+  } : {}
+
+  function_name                     = aws_lambda_function.handler[each.key].function_name
+  qualifier                         = aws_lambda_alias.live[each.key].name
+  provisioned_concurrent_executions = each.value
+}
+
+# ---------------------------------------------------------------------------
+# Async retry configuration
+# ---------------------------------------------------------------------------
+
 # chat-agent-invoke retry-0 (plan 2026-05-22-006 U3). After the
 # direct-callback finalize refactor, chat-agent-invoke is Event-mode-
 # dispatched by the GraphQL resolver and itself dispatches AgentCore
@@ -1084,66 +1120,41 @@ resource "aws_lambda_function_event_invoke_config" "chat_agent_invoke" {
   maximum_event_age_in_seconds = 3600
 }
 
-resource "aws_lambda_function_event_invoke_config" "wiki_compile" {
+# THINK-583 U3: the resolver now Event-invokes the `live` alias, and async
+# invoke config is per-qualifier — without this duplicate on the alias the
+# alias path would regress to AWS's default 2 retries and the 5-min stall
+# cascade above could recur. Same retry-0 posture, pinned explicitly.
+resource "aws_lambda_function_event_invoke_config" "chat_agent_invoke_live" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["wiki-compile"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-
-  destination_config {
-    on_failure {
-      destination = aws_sqs_queue.wiki_compile_dlq[0].arn
-    }
-  }
-}
-
-# Ontology suggestion scans are durable-job driven. Disable AWS async
-# retries so duplicate scan invocations do not create duplicate review
-# proposals; the scan job row is the retry/observability surface.
-resource "aws_sqs_queue" "ontology_scan_dlq" {
-  count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-ontology-scan-dlq"
-  message_retention_seconds = 1209600 # 14 days
-
-  tags = {
-    Name = "thinkwork-${var.stage}-ontology-scan-dlq"
-  }
-}
-
-resource "aws_lambda_function_event_invoke_config" "ontology_scan" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["ontology-scan"].function_name
+  function_name                = aws_lambda_function.handler["chat-agent-invoke"].function_name
+  qualifier                    = aws_lambda_alias.live["chat-agent-invoke"].name
   maximum_retry_attempts       = 0
   maximum_event_age_in_seconds = 3600
-
-  destination_config {
-    on_failure {
-      destination = aws_sqs_queue.ontology_scan_dlq[0].arn
-    }
-  }
 }
 
-# Ontology reprocess jobs are row-ledger driven and explicitly claim work.
-# Disable AWS async retries to keep failure/retry state in ontology.reprocess_jobs.
-resource "aws_sqs_queue" "ontology_reprocess_dlq" {
+# Identity match jobs (THINK-321 U7) are durable-job driven. Disable AWS
+# async retries so duplicate match invocations do not
+# double-write mappings/cases; identity.match_jobs is the retry/
+# observability surface.
+resource "aws_sqs_queue" "identity_match_dlq" {
   count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-ontology-reprocess-dlq"
+  name                      = "thinkwork-${var.stage}-identity-match-dlq"
   message_retention_seconds = 1209600 # 14 days
 
   tags = {
-    Name = "thinkwork-${var.stage}-ontology-reprocess-dlq"
+    Name = "thinkwork-${var.stage}-identity-match-dlq"
   }
 }
 
-resource "aws_lambda_function_event_invoke_config" "ontology_reprocess" {
+resource "aws_lambda_function_event_invoke_config" "identity_match" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["ontology-reprocess"].function_name
+  function_name                = aws_lambda_function.handler["identity-match"].function_name
   maximum_retry_attempts       = 0
   maximum_event_age_in_seconds = 3600
 
   destination_config {
     on_failure {
-      destination = aws_sqs_queue.ontology_reprocess_dlq[0].arn
+      destination = aws_sqs_queue.identity_match_dlq[0].arn
     }
   }
 }
@@ -1167,7 +1178,7 @@ resource "aws_lambda_function_event_invoke_config" "routine_approval_callback" {
 # memory-retain after every chat turn. AWS Lambda's default async-retry
 # policy is 2 attempts; without overriding it, a transient failure on the
 # canonical-transcript fetch or adapter write retries the entire writeback
-# and can multi-write the same per-turn document into Hindsight. The
+# and can multi-write the same per-turn document into memory. The
 # longest-suffix-prefix merge in memory-retain.ts dedupes content but the
 # retain-cost path (Bedrock tokens charged in adapter.retainConversation)
 # is NOT idempotent — retries multiply LLM cost. Per
@@ -1454,8 +1465,13 @@ locals {
       # Public login capabilities. Unauthenticated by design; the handler
       # resolves tenant-scoped OAuth options only from trusted API Gateway
       # domain metadata and fails closed for unknown/shared hosts.
-      "GET /api/auth/options"              = "public-auth-options"
-      "OPTIONS /api/auth/options"          = "public-auth-options"
+      "GET /api/auth/options"     = "public-auth-options"
+      "OPTIONS /api/auth/options" = "public-auth-options"
+      # Operator/deployment-only metadata seam. The Lambda independently
+      # verifies API_AUTH_SECRET and rejects raw secret values.
+      "POST /api/auth/providers/reconcile" = "auth-provider-reconcile"
+      # Rollback-only routes. No native client links to these, and the entire
+      # handler is filtered from Lambda/API Gateway in the retired phase.
       "GET /api/auth/workos/authorize"     = "workos-auth"
       "OPTIONS /api/auth/workos/authorize" = "workos-auth"
       "GET /api/auth/workos/callback"      = "workos-auth"
@@ -1472,21 +1488,6 @@ locals {
       # Agent actions (start/stop/heartbeat/budget)
       "ANY /api/agent-actions/{proxy+}" = "agent-actions"
 
-      # Desktop-local Pi tombstones. Specific routes before broad REST handlers;
-      # OPTIONS is handled inside the Lambda before auth.
-      "POST /api/desktop/runtime-session"               = "desktop-runtime-session"
-      "OPTIONS /api/desktop/runtime-session"            = "desktop-runtime-session"
-      "POST /api/desktop/workspace-prewarm"             = "desktop-workspace-prewarm"
-      "OPTIONS /api/desktop/workspace-prewarm"          = "desktop-workspace-prewarm"
-      "POST /api/desktop/managed-delegation"            = "managed-delegation"
-      "OPTIONS /api/desktop/managed-delegation"         = "managed-delegation"
-      "POST /api/desktop/eval-runs"                     = "desktop-eval-runs"
-      "OPTIONS /api/desktop/eval-runs"                  = "desktop-eval-runs"
-      "POST /api/desktop/eval-runs/{runId}/sessions"    = "desktop-eval-runs"
-      "OPTIONS /api/desktop/eval-runs/{runId}/sessions" = "desktop-eval-runs"
-      "POST /api/desktop/eval-runs/{runId}/results"     = "desktop-eval-runs"
-      "OPTIONS /api/desktop/eval-runs/{runId}/results"  = "desktop-eval-runs"
-
       # Mobile agent harness model proxy (cloud Bedrock Converse). OPTIONS is
       # handled inside the Lambda before auth.
       "POST /api/model/converse"    = "model-converse"
@@ -1555,14 +1556,10 @@ locals {
       "GET /.well-known/oauth-authorization-server"        = "mcp-oauth"
       "GET /.well-known/openid-configuration"              = "mcp-oauth"
       "GET /mcp/oauth/jwks"                                = "mcp-oauth"
-      "POST /mcp/oauth/register"                           = "mcp-oauth"
-      "GET /mcp/oauth/authorize"                           = "mcp-oauth"
-      "GET /mcp/oauth/callback"                            = "mcp-oauth"
-      "POST /mcp/oauth/token"                              = "mcp-oauth"
-      "POST /mcp/oauth/revoke"                             = "mcp-oauth"
-      "ANY /mcp/user-memory"                               = "mcp-user-memory"
-      "ANY /mcp/context-engine"                            = "mcp-context-engine"
-      "ANY /mcp/open-engine"                               = "mcp-open-engine"
+      # THINK-316 U1: AgentCore CUSTOM_JWT discovery is deliberately isolated
+      # under /agentcore so the existing user-memory OAuth issuer is unchanged.
+      "GET /agentcore/.well-known/openid-configuration" = "mcp-oauth"
+      "GET /agentcore/oauth/jwks"                       = "mcp-oauth"
       # THINK-280 U8: scoped external capability search facade. The handler is
       # inert unless CAPABILITY_EXTERNAL_SEARCH_ENABLED (gated on
       # enable_capability_broker) is on — routing it while disabled returns an
@@ -1607,6 +1604,18 @@ locals {
       "OPTIONS /api/deployment-sessions/{sessionId}/teardown"                   = "deployment-sessions"
       "GET /api/auth/me"                                                        = "auth-me"
       "OPTIONS /api/auth/me"                                                    = "auth-me"
+      "POST /api/auth/revoke"                                                   = "auth-revoke"
+      "OPTIONS /api/auth/revoke"                                                = "auth-revoke"
+      "POST /api/auth/subscription-ticket"                                      = "auth-subscription-ticket"
+      "OPTIONS /api/auth/subscription-ticket"                                   = "auth-subscription-ticket"
+      "POST /api/auth/enrollment/consume"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/consume"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/recover"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/recover"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/migrate"                                       = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/migrate"                                    = "auth-enrollment"
+      "POST /api/auth/enrollment/auto-link"                                     = "auth-enrollment"
+      "OPTIONS /api/auth/enrollment/auto-link"                                  = "auth-enrollment"
       "ANY /api/extensions/{extensionId}"                                       = "extension-proxy"
       "ANY /api/extensions/{extensionId}/{proxy+}"                              = "extension-proxy"
 
@@ -1665,9 +1674,6 @@ locals {
       # Workspace files
       "ANY /api/workspaces/{proxy+}" = "workspace-files"
 
-      # Knowledge bases
-      "ANY /api/knowledge-bases/{proxy+}" = "knowledge-base-files"
-
       # Email
       "POST /api/email/send"                                 = "email-send"
       "POST /api/email/provider-webhook/{providerInstallId}" = "email-provider-webhook"
@@ -1689,7 +1695,6 @@ locals {
       "POST /msteams/account-link/complete" = "msteams-account-link-complete"
 
       # Memory
-      "ANY /api/memory/{proxy+}" = "memory"
 
       # Artifacts
       "POST /api/artifacts/{proxy+}" = "artifact-deliver"
@@ -1755,20 +1760,6 @@ locals {
       # retained as a break-glass superuser path for bootstrap/debug.
       "POST /mcp/admin" = "admin-ops-mcp"
 
-      # Analyst query broker — first-party MCP server exposing query
-      # (THINK-228 U3). Callers present the tenant-wide broker service
-      # credential as Bearer; SQL executes as the hardened analyst_reader
-      # role. The seeded postgres-dev connector row points at this route.
-      "POST /mcp/analyst" = "analyst-query-broker"
-
-      # Sourced analyst broker route (THINK-239) — the same handler serves a
-      # registered EXTERNAL Postgres source at /mcp/analyst/<slug>. The broker
-      # requires a signed caller context whose sourceClaims.slug matches the
-      # path (the legacy bearer is never accepted here) and connects using the
-      # per-source reader credential (thinkwork/<stage>/analyst/*, covered by
-      # the shared secretsmanager:GetSecretValue on thinkwork/*).
-      "POST /mcp/analyst/{sourceSlug}" = "analyst-query-broker"
-
       # MCP admin key management — per-tenant Bearer token CRUD. Tokens
       # are shown ONCE at creation (POST returns raw value); server stores
       # sha256 hash only. These specific routes take precedence over the
@@ -1778,6 +1769,15 @@ locals {
       "GET /api/tenants/{tenantId}/mcp-admin-keys"            = "mcp-admin-keys"
       "DELETE /api/tenants/{tenantId}/mcp-admin-keys/{keyId}" = "mcp-admin-keys"
 
+      "POST /api/tenants/{tenantId}/brain-api-keys"           = "brain-api-keys"
+      "GET /api/tenants/{tenantId}/brain-api-keys"            = "brain-api-keys"
+      "OPTIONS /api/tenants/{tenantId}/brain-api-keys"        = "brain-api-keys"
+      "DELETE /api/tenants/{tenantId}/brain-api-keys/{keyId}" = "brain-api-keys"
+      # Per-key grants edit (twin-mcp-keys/v2): securityGroups +
+      # kbCollections, republishing the manifest on change.
+      "PATCH /api/tenants/{tenantId}/brain-api-keys/{keyId}"   = "brain-api-keys"
+      "OPTIONS /api/tenants/{tenantId}/brain-api-keys/{keyId}" = "brain-api-keys"
+
       # One-shot tenant provisioning for the admin-ops MCP. Mints a fresh
       # tkm_ key + stores it in Secrets Manager at
       # thinkwork/<stage>/mcp/<tenantId>/admin-ops + upserts the
@@ -1785,6 +1785,13 @@ locals {
       # any agent that gets it assigned via agent_mcp_servers.
       "POST /api/tenants/{tenantId}/mcp-admin-provision" = "mcp-admin-provision"
 
+      # Digital Twin MCP provisioning (THINK-333 U4): mints the tkt_ key,
+      # writes the secret, upserts the approved digital-twin connector row
+      # (url_hash pinned), and materializes connectors/digital-twin/ into
+      # every agent workspace. Re-run = rotate.
+      "POST /api/tenants/{tenantId}/mcp-twin-provision"    = "mcp-twin-provision"
+      "OPTIONS /api/tenants/{tenantId}/mcp-twin-provision" = "mcp-twin-provision"
+
       # MCP server admin approval (plan §U11, SI-5). Externally-sourced MCP
       # servers land with status='pending'; these routes flip them to
       # approved/rejected. Cognito JWT only (mcp-approval handler rejects
@@ -1802,6 +1809,10 @@ locals {
       "POST /api/threads/{threadId}/attachments/finalize"    = "thread-attachments-finalize"
       "OPTIONS /api/threads/{threadId}/attachments/finalize" = "thread-attachments-finalize"
 
+      # Runtime-generated attachments (execute_code output_files). Shared
+      # API_AUTH_SECRET; no browser callers, so no OPTIONS route.
+      "POST /api/threads/{threadId}/attachments/register" = "thread-attachments-register"
+
       # U9-remainder of finance pilot — tenant-pinned download endpoint.
       "GET /api/threads/{threadId}/attachments/{attachmentId}/download"     = "thread-attachment-download"
       "OPTIONS /api/threads/{threadId}/attachments/{attachmentId}/download" = "thread-attachment-download"
@@ -1816,12 +1827,20 @@ locals {
       "POST /api/runtime/manifests"    = "manifest-log"
       "OPTIONS /api/runtime/manifests" = "manifest-log"
 
+      # Pi tool-execution ledger (THINK-324 C17). The runtime POSTs paired
+      # started/terminal evidence rows per tool call. Shared API_AUTH_SECRET;
+      # no tenant OAuth.
+      "POST /api/runtime/tool-executions"    = "tool-executions"
+      "OPTIONS /api/runtime/tool-executions" = "tool-executions"
+
       # SI-7 catalog-list read (plan §U15 pt 3/3). The runtime fetches
       # the allowed slug set once per session-start. Shared API_AUTH_SECRET.
       "GET /api/runtime/capability-catalog"     = "capability-catalog-list"
       "OPTIONS /api/runtime/capability-catalog" = "capability-catalog-list"
     } : route_key => handler_name
-    if !contains(local.optional_integration_handler_names, handler_name)
+    if !contains(local.optional_integration_handler_names, handler_name) && (
+      !startswith(route_key, "GET /agentcore/")
+    )
   } : {}
 }
 
@@ -1842,6 +1861,16 @@ resource "aws_apigatewayv2_route" "handler" {
   target    = "integrations/${aws_apigatewayv2_integration.handler[each.key].id}"
 }
 
+resource "aws_lambda_permission" "appsync_subscription_authorizer" {
+  count = local.deploy_lambda_handlers ? 1 : 0
+
+  statement_id  = "AllowAppSyncSubscriptionAuthorization"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.handler["appsync-subscription-authorizer"].function_name
+  principal     = "appsync.amazonaws.com"
+  source_arn    = "arn:aws:appsync:${var.region}:${var.account_id}:apis/${var.appsync_api_id}"
+}
+
 resource "aws_lambda_permission" "handler_apigw" {
   for_each = local.deploy_lambda_handlers ? toset(distinct(values(local.api_routes))) : toset([])
 
@@ -1917,16 +1946,15 @@ resource "aws_scheduler_schedule" "wakeup_processor" {
   }
 }
 
-# ---------------------------------------------------------------------------
-# webhook_deliveries retention cron — daily delete of rows older than 90 days
-# ---------------------------------------------------------------------------
-
-resource "aws_scheduler_schedule" "webhook_deliveries_cleanup" {
+# Replays durable authorization-revocation invalidations. The worker owns its
+# retry state in Aurora and suppresses tenant realtime fan-out until AppSync
+# confirms every sensitive subscription class has been invalidated.
+resource "aws_scheduler_schedule" "subscription_invalidation" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-webhook-deliveries-cleanup"
+  name                = "thinkwork-${var.stage}-subscription-invalidation"
   group_name          = "default"
-  schedule_expression = "cron(0 4 * * ? *)" # daily at 04:00 UTC
+  schedule_expression = "rate(1 minutes)"
   state               = "ENABLED"
 
   flexible_time_window {
@@ -1934,51 +1962,42 @@ resource "aws_scheduler_schedule" "webhook_deliveries_cleanup" {
   }
 
   target {
-    arn      = aws_lambda_function.handler["webhook-deliveries-cleanup"].arn
+    arn      = aws_lambda_function.handler["subscription-invalidation"].arn
     role_arn = aws_iam_role.scheduler.arn
+    input    = jsonencode({ limit = 25 })
+
+    retry_policy {
+      maximum_retry_attempts = 0
+    }
   }
 }
 
 # ---------------------------------------------------------------------------
-# Requester memory dreaming — broad per-user memory compaction/reflection sweep
-# ---------------------------------------------------------------------------
-
-# ---------------------------------------------------------------------------
-# Brain dream state — per-bank Hindsight consolidation with audit ledger
-# (THINK-133 U4). Retries are the ledger's job (staged plan -> atomic apply
-# -> applied markers; unfinished runs resume on the next tick), so Lambda
-# async retries stay at 0, mirroring memory-retain.
+# webhook_deliveries retention cron — daily delete of rows older than 90 days
 # ---------------------------------------------------------------------------
 
-resource "aws_lambda_function_event_invoke_config" "brain_dream_state" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["brain-dream-state"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-}
-
-resource "aws_scheduler_schedule" "brain_dream_state" {
+resource "aws_scheduler_schedule" "webhook_deliveries_cleanup" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-brain-dream-state"
+  name                = "thinkwork-${var.stage}-webhook-deliveries-cleanup"
   group_name          = "default"
-  schedule_expression = var.brain_dream_state_schedule_expression
-  state               = var.brain_dream_state_enabled ? "ENABLED" : "DISABLED"
+  schedule_expression = "cron(0 4 * * ? *)" # daily at 04:00 UTC
+  state               = "ENABLED"
 
   flexible_time_window {
     mode = "OFF"
   }
 
   target {
-    arn      = aws_lambda_function.handler["brain-dream-state"].arn
+    arn      = aws_lambda_function.handler["webhook-deliveries-cleanup"].arn
     role_arn = aws_iam_role.scheduler.arn
-
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
   }
 }
 
+# ---------------------------------------------------------------------------
+# Requester memory dreaming — broad per-user memory compaction/reflection sweep
+# ---------------------------------------------------------------------------
+
 resource "aws_scheduler_schedule" "requester_memory_dreaming" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
@@ -2041,20 +2060,12 @@ resource "aws_scheduler_schedule" "mcp_approval_sweeper" {
   }
 }
 
-# ---------------------------------------------------------------------------
-# skill_runs reconciler — transitions stuck-running rows to failed every 5 min.
-# Guards against agentcore Lambda crashes / OOMs that drop the
-# /api/skills/complete writeback and leave the row at 'running' forever,
-# which in turn blocks the dedup partial unique index from letting retries
-# through.
-# ---------------------------------------------------------------------------
-
-resource "aws_scheduler_schedule" "skill_runs_reconciler" {
+resource "aws_scheduler_schedule" "inbox_approval_sweeper" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-skill-runs-reconciler"
+  name                = "thinkwork-${var.stage}-inbox-approval-sweeper"
   group_name          = "default"
-  schedule_expression = "rate(5 minutes)"
+  schedule_expression = "cron(30 4 * * ? *)" # daily at 04:30 UTC (offset from mcp-approval-sweeper)
   state               = "ENABLED"
 
   flexible_time_window {
@@ -2062,53 +2073,50 @@ resource "aws_scheduler_schedule" "skill_runs_reconciler" {
   }
 
   target {
-    arn      = aws_lambda_function.handler["skill-runs-reconciler"].arn
+    arn      = aws_lambda_function.handler["inbox-approval-sweeper"].arn
     role_arn = aws_iam_role.scheduler.arn
   }
 }
 
-# ---------------------------------------------------------------------------
-# analyst_connection_reconciler — probes the analyst_reader connection every
-# 30 min (reachability, IAM auth, SELECT-grant introspection, zero-write
-# assertion, schema-drift hash; all read-only) and stamps the verdict onto
-# tenant_mcp_servers.runtime_metadata.analyst_probe. Dispatch withholds a
-# failing/stale connection loudly (THINK-229 U5, R7/R8, KTD8).
-#
-# retry-0 + DLQ (project_async_retry_idempotency_lessons): the probe is
-# cheap and idempotent — the next 30-minute tick IS the retry, so stacking
-# scheduler retries only adds redundant connections. A failure lands in the
-# DLQ for operator visibility instead.
-# ---------------------------------------------------------------------------
+# auth_subscription_tickets retention. Unlike the approval sweepers this is
+# a volume problem, not a queue-hygiene one: ~30 tickets/min are minted on
+# every connect + subscription registration and nothing deleted them
+# (551k rows / 306 MB and +24 MB/day on a customer stage, idx_scan=0).
+# Hourly rather than daily so each tick's backlog stays small enough that a
+# single batch usually drains it; the handler's own 45s budget bounds the
+# first few catch-up runs on a stage with an existing backlog.
+resource "aws_scheduler_schedule" "auth_ticket_sweeper" {
+  count = local.deploy_lambda_handlers ? 1 : 0
 
-resource "aws_sqs_queue" "analyst_connection_reconciler_dlq" {
-  count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-analyst-connection-reconciler-dlq"
-  message_retention_seconds = 1209600 # 14 days
+  name                = "thinkwork-${var.stage}-auth-ticket-sweeper"
+  group_name          = "default"
+  schedule_expression = "rate(1 hour)"
+  state               = "ENABLED"
 
-  tags = {
-    Name = "thinkwork-${var.stage}-analyst-connection-reconciler-dlq"
+  flexible_time_window {
+    mode = "OFF"
   }
-}
 
-resource "aws_lambda_function_event_invoke_config" "analyst_connection_reconciler" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["analyst-connection-reconciler"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-
-  destination_config {
-    on_failure {
-      destination = aws_sqs_queue.analyst_connection_reconciler_dlq[0].arn
-    }
+  target {
+    arn      = aws_lambda_function.handler["auth-ticket-sweeper"].arn
+    role_arn = aws_iam_role.scheduler.arn
   }
 }
 
-resource "aws_scheduler_schedule" "analyst_connection_reconciler" {
+# ---------------------------------------------------------------------------
+# skill_runs reconciler — transitions stuck-running rows to failed every 5 min.
+# Guards against agentcore Lambda crashes / OOMs that drop the
+# /api/skills/complete writeback and leave the row at 'running' forever,
+# which in turn blocks the dedup partial unique index from letting retries
+# through.
+# ---------------------------------------------------------------------------
+
+resource "aws_scheduler_schedule" "skill_runs_reconciler" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-analyst-connection-reconciler"
+  name                = "thinkwork-${var.stage}-skill-runs-reconciler"
   group_name          = "default"
-  schedule_expression = "rate(30 minutes)"
+  schedule_expression = "rate(5 minutes)"
   state               = "ENABLED"
 
   flexible_time_window {
@@ -2116,12 +2124,8 @@ resource "aws_scheduler_schedule" "analyst_connection_reconciler" {
   }
 
   target {
-    arn      = aws_lambda_function.handler["analyst-connection-reconciler"].arn
+    arn      = aws_lambda_function.handler["skill-runs-reconciler"].arn
     role_arn = aws_iam_role.scheduler.arn
-
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
   }
 }
 
@@ -2482,175 +2486,44 @@ resource "aws_scheduler_schedule" "stall_monitor" {
   }
 }
 
-# ---------------------------------------------------------------------------
-# Retry dispatcher — drains retry_queue rows the stall monitor enqueues and
-# re-runs genuinely stalled turns (THINK-307). First-ever scheduling of this
-# handler; state is var-driven and defaults DISABLED — never enable on a
-# stage before THINK-305/308/309 are live there (parent plan deploy ordering).
-# The 1-minute rate is fixed by design: the queue's own scheduled_at does the
-# pacing. Scheduler retries stay at 0 — the next 1-minute tick IS the retry.
-# ---------------------------------------------------------------------------
-
-# Lambda async retries are disabled (mirrors memory-retraction-drainer): the
-# claim is a CAS UPDATE so a duplicate invocation only picks up new rows, and
-# the next 1-minute tick is the retry.
-resource "aws_lambda_function_event_invoke_config" "retry_dispatcher" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["cron-retry-dispatcher"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-}
-
-resource "aws_scheduler_schedule" "retry_dispatcher" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-retry-dispatcher"
-  group_name          = "default"
-  schedule_expression = "rate(1 minutes)"
-  state               = var.retry_dispatcher_enabled ? "ENABLED" : "DISABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["cron-retry-dispatcher"].arn
-    role_arn = aws_iam_role.scheduler.arn
-
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
-  }
-}
-
 
 # ---------------------------------------------------------------------------
 # Compounding Memory — nightly hygiene + export
 # ---------------------------------------------------------------------------
 
-resource "aws_scheduler_schedule" "wiki_compile_drainer" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-wiki-compile-drainer"
-  group_name          = "default"
-  schedule_expression = "rate(1 minutes)"
-  state               = "ENABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["wiki-compile"].arn
-    role_arn = aws_iam_role.scheduler.arn
-  }
-}
-
-# Observations → Knowledge Graph sweep (plan 2026-06-09-004 U5). Enumerates
-# tenants and runs an incremental observations ingest per tenant; the stable
-# source_ref's active-run dedupe drops overlap with operator-started runs and
-# the in-handler stale-run reaper clears stranded rows past the run ceiling.
-resource "aws_scheduler_schedule" "knowledge_graph_observations_ingest" {
+# Identity drift match sweep (THINK-321 U7 / KTD-7 — R10). Enumerates
+# tenants with registered identity sources and starts a per-tenant match
+# job; tenants with a pending/running job are skipped in the handler and
+# the job dedupe key drops same-bucket duplicate starts. Ships DISABLED —
+# enabled per stage via identity_drift_match_enabled once bootstrap has
+# been proven on the stage.
+resource "aws_scheduler_schedule" "identity_drift_match" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-knowledge-graph-observations-ingest"
+  name                = "thinkwork-${var.stage}-identity-drift-match"
   group_name          = "default"
-  schedule_expression = "rate(30 minutes)"
-  # Ships DISABLED (plan 2026-07-03-005 U4/KTD-6): the schedule enables on dev
-  # only after a manual golden-set-validated run. Driven by the GHA
-  # WIKI_KG_INGEST_ENABLED var.
-  state = var.knowledge_graph_observations_ingest_enabled ? "ENABLED" : "DISABLED"
+  schedule_expression = "rate(1 days)"
+  state               = var.identity_drift_match_enabled ? "ENABLED" : "DISABLED"
 
   flexible_time_window {
     mode = "OFF"
   }
 
   target {
-    arn      = aws_lambda_function.handler["knowledge-graph-observations-ingest"].arn
+    arn      = aws_lambda_function.handler["identity-match"].arn
     role_arn = aws_iam_role.scheduler.arn
-    input    = jsonencode({ sweep = true, trigger = "scheduled" })
+    input    = jsonencode({ drift = true, trigger = "scheduled" })
 
-    # Periodic idempotent worker: the next 30-minute tick IS the retry.
-    # Scheduler-level retries stack extra invocations onto a cadence that
-    # already self-corrects (cursor-guarded), compounding the invocation
-    # volume that helped trip Lambda recursive-loop detection.
+    # Periodic idempotent worker: the next daily tick IS the retry —
+    # scheduler retries only stack invocations onto a self-correcting
+    # cadence.
     retry_policy {
       maximum_retry_attempts = 0
     }
   }
 }
 
-resource "aws_scheduler_schedule" "wiki_lint" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-wiki-lint"
-  group_name          = "default"
-  schedule_expression = "cron(0 2 * * ? *)" # daily at 02:00 UTC
-  state               = "ENABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["wiki-lint"].arn
-    role_arn = aws_iam_role.scheduler.arn
-  }
-}
-
-resource "aws_scheduler_schedule" "wiki_export" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-wiki-export"
-  group_name          = "default"
-  schedule_expression = "cron(0 3 * * ? *)" # daily at 03:00 UTC (after lint)
-  state               = "ENABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["wiki-export"].arn
-    role_arn = aws_iam_role.scheduler.arn
-  }
-}
-
-# S3 bucket for markdown vault exports. One bundle per (tenant, owner, date).
-# Retention is handled by the lifecycle rule below (30 days).
-resource "aws_s3_bucket" "wiki_exports" {
-  bucket        = "thinkwork-${var.stage}-wiki-exports"
-  force_destroy = var.stage == "dev"
-
-  tags = {
-    Name = "thinkwork-${var.stage}-wiki-exports"
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "wiki_exports" {
-  bucket                  = aws_s3_bucket.wiki_exports.id
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "wiki_exports" {
-  bucket = aws_s3_bucket.wiki_exports.id
-
-  rule {
-    id     = "expire-old-bundles"
-    status = "Enabled"
-
-    filter {}
-
-    expiration {
-      days = 30
-    }
-  }
-}
-
-# Canonical ThinkWork Brain artifact store. Unlike wiki_exports, this bucket
+# Canonical ThinkWork Brain artifact store. This bucket
 # is the durable replay/projection substrate for Brain source artifacts,
 # ingestion manifests, migration snapshots, vault projections, and exports.
 resource "aws_s3_bucket" "brain_artifacts" {
@@ -2773,7 +2646,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "brain_artifacts" {
 
   # THINK-193 U1 (Codex F6): normalized evidence snapshots are short-lived
   # working copies — the durable record is the evidence row (hash + ref) and
-  # the Hindsight projection. Expire content after 30 days; the app mirrors
+  # the memory projection. Expire content after 30 days; the app mirrors
   # this via memory_evidence_items.snapshot_expires_at.
   rule {
     id     = "expire-evidence-snapshots"
@@ -2813,6 +2686,48 @@ resource "aws_s3_bucket_lifecycle_configuration" "brain_artifacts" {
       noncurrent_days = 365
     }
   }
+
+  # THINK-630: async brain_ask task records are a polling buffer, not an
+  # archive — they hold answer content and principal metadata, so they must
+  # not accumulate. Seven days far exceeds any task's useful life. The
+  # brain-mcp module (company-brain repo) deliberately does NOT manage this
+  # bucket's lifecycle (it would silently drop the rules above); this stack
+  # is the bucket's single lifecycle author.
+  rule {
+    id     = "expire-brain-ask-tasks"
+    status = "Enabled"
+
+    filter {
+      prefix = "brain-ask-tasks/"
+    }
+
+    expiration {
+      days = 7
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 7
+    }
+  }
+
+  # THINK-629 C2: ask exchange records (follow-up continuity) age out the
+  # same way — the durable record is the thread itself.
+  rule {
+    id     = "expire-brain-ask-exchanges"
+    status = "Enabled"
+
+    filter {
+      prefix = "brain-ask-exchanges/"
+    }
+
+    expiration {
+      days = 7
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 7
+    }
+  }
 }
 
 data "aws_iam_policy_document" "brain_artifacts_bucket" {
@@ -2897,33 +2812,6 @@ resource "aws_iam_role_policy" "scheduler_invoke" {
 # SSM Parameters — Lambda ARNs for cross-function invocation
 # ---------------------------------------------------------------------------
 
-########################################################################
-# SecureString parameter for the Google Places API key. wiki-compile reads
-# this on cold start via loadGooglePlacesClientFromSsm() and caches the
-# client at module scope. When google_places_api_key is empty (the
-# default), we seed the parameter with a placeholder so the Lambda init
-# path can distinguish "unconfigured" (skip Google entirely, degrade
-# gracefully) from "configured but wrong" (log + skip). lifecycle.ignore_
-# changes on `value` lets ops rotate via
-#   aws ssm put-parameter --overwrite \
-#     --name /thinkwork/<stage>/google-places/api-key \
-#     --type SecureString --value <KEY>
-# without terraform fighting it on the next apply.
-########################################################################
-
-resource "aws_ssm_parameter" "google_places_api_key" {
-  name        = "/thinkwork/${var.stage}/google-places/api-key"
-  type        = "SecureString"
-  value       = var.google_places_api_key != "" ? var.google_places_api_key : "PLACEHOLDER_SET_VIA_CLI"
-  description = "Google Places API (New) key consumed by wiki-compile. See docs/plans/2026-04-21-005-feat-wiki-place-capability-v2-plan.md Unit 4."
-
-  lifecycle {
-    # Allow `aws ssm put-parameter --overwrite` to stick across applies.
-    # New-key rotation or initial population by ops should happen via CLI,
-    # not via terraform var.
-    ignore_changes = [value]
-  }
-}
 
 ########################################################################
 # SecureString parameter for the graphql-http Lambda's OWN Cloudflare
@@ -2967,8 +2855,10 @@ resource "aws_ssm_parameter" "cloudflare_namespace_token" {
 
 resource "aws_ssm_parameter" "lambda_arns" {
   for_each = local.deploy_lambda_handlers ? {
-    "chat-agent-invoke-fn-arn"    = aws_lambda_function.handler["chat-agent-invoke"].arn
-    "kb-manager-fn-arn"           = aws_lambda_function.handler["knowledge-base-manager"].arn
+    # THINK-583 U3: alias-qualified so the SSM-fallback path in
+    # getChatAgentInvokeFnArn (graphql/utils.ts) also lands on the
+    # provisioned-concurrency alias, not $LATEST.
+    "chat-agent-invoke-fn-arn"    = aws_lambda_alias.live["chat-agent-invoke"].arn
     "job-schedule-manager-fn-arn" = aws_lambda_function.handler["job-schedule-manager"].arn
     "memory-retain-fn-arn"        = aws_lambda_function.handler["memory-retain"].arn
     "eval-runner-fn-arn"          = aws_lambda_function.handler["eval-runner"].arn
@@ -3027,6 +2917,17 @@ resource "aws_lambda_function" "compliance_anchor" {
       COMPLIANCE_ANCHOR_OBJECT_LOCK_MODE = var.compliance_anchor_object_lock_mode
     }
   }
+
+  # THINK-1082: this function opens a database connection (see env above), so
+  # the whole-module VPC lane covers it too. Absent when lambdas_in_vpc is off.
+  dynamic "vpc_config" {
+    for_each = var.lambdas_in_vpc ? [1] : []
+
+    content {
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
+    }
+  }
 }
 
 resource "aws_sqs_queue" "compliance_anchor_dlq" {
@@ -3333,6 +3234,17 @@ resource "aws_lambda_function" "compliance_export_runner" {
       DATABASE_NAME = var.database_name
     }
   }
+
+  # THINK-1082: this function opens a database connection (see env above), so
+  # the whole-module VPC lane covers it too. Absent when lambdas_in_vpc is off.
+  dynamic "vpc_config" {
+    for_each = var.lambdas_in_vpc ? [1] : []
+
+    content {
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
+    }
+  }
 }
 
 # SQS → Lambda event source mapping. batch_size=1 so each export is a