thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -19,18 +19,19 @@
 data "aws_caller_identity" "current" {}
 
 locals {
-  okf_efs_vpc_enabled = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
-  # Handlers that open direct Postgres connections to registered analyst data
-  # sources. VPC-attaching them (analyst_egress_subnet_ids) gives their egress
-  # the NAT gateway's stable EIP, which external databases behind an IP
-  # allowlist can admit — a non-VPC Lambda egresses from the shared AWS pool
-  # and can never satisfy such an allowlist.
-  analyst_vpc_enabled = length(var.analyst_egress_subnet_ids) > 0 && length(var.analyst_egress_security_group_ids) > 0
-  analyst_vpc_handlers = toset([
-    "graphql-http",
-    "analyst-query-broker",
-    "analyst-connection-reconciler",
-  ])
+  # Company Brain U5: the identity-graph-projector attaches to the VPC only
+  # when both Neptune network inputs are present (disjoint from the two
+  # block above — a function takes at most one vpc_config).
+  neptune_vpc_enabled = length(var.neptune_subnet_ids) > 0 && length(var.neptune_security_group_ids) > 0
+  # THINK-1082: any VPC attachment in this module (Neptune projector or the
+  # whole-module lambdas_in_vpc lane) needs the ENI grant on the shared role.
+  lambda_vpc_enabled = local.neptune_vpc_enabled || var.lambdas_in_vpc
+  # lambdas_in_vpc needs both network inputs; checked as a precondition on the
+  # handler functions because cross-variable validation is not available at
+  # the repo's Terraform floor (1.8.5).
+  lambda_vpc_inputs_complete = !var.lambdas_in_vpc || (
+    length(var.vpc_subnet_ids) > 0 && length(var.vpc_security_group_ids) > 0
+  )
   # Constructed rather than read from aws_apigatewayv2_stage.default.invoke_url
   # (the two are identical for an HTTP API's $default stage). Reading it off
   # the stage made every Lambda's env depend on the stage, which forbids the
@@ -73,6 +74,14 @@ resource "aws_apigatewayv2_stage" "default" {
     throttling_burst_limit = 20
   }
 
+  # Session revocation is authenticated and independently rate-limited in the
+  # handler per principal. This edge throttle also bounds aggregate abuse.
+  route_settings {
+    route_key              = "POST /api/auth/revoke"
+    throttling_rate_limit  = 5
+    throttling_burst_limit = 10
+  }
+
   # UpdateStage 404s ("Unable to find Route by key … within the provided
   # RouteSettings") if the stage update races the route creation — Terraform
   # sees no reference edge between route_settings.route_key and the route
@@ -186,13 +195,50 @@ resource "aws_iam_role_policy_attachment" "lambda_basic" {
 # aggregate hit IAM's 10,240-byte cap on 2026-06-11 (#2378/#2379). New grants
 # go into the grouped managed policies, never inline.
 
+# Every VPC-attached handler on the shared Lambda role needs the ENI
+# create/describe/delete grant, or its invocations fail before the handler
+# runs. This was gated on the OKF EFS mount alone, which was true by accident:
+# okf-efs-refresh was simply the first VPC-attached handler. The
+# Neptune-attached identity-graph-projector shares this role and had been
+# riding that gate. Gate on the surviving VPC consumer instead — the OKF
+# mount is gone as of the wiki-removal arc U3.
+# THINK-1082: also gated on lambdas_in_vpc — every handler attaches then.
 resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
-  count = local.okf_efs_vpc_enabled ? 1 : 0
+  count = local.lambda_vpc_enabled ? 1 : 0
 
   role       = aws_iam_role.lambda.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
 }
 
+# THINK-1082: compliance-anchor and compliance-export-runner run on sibling
+# roles owned by the compliance bucket modules (not aws_iam_role.lambda). They
+# carry a database connection too, so when lambdas_in_vpc attaches them the
+# ENI grant has to land on those roles as well.
+resource "aws_iam_role_policy_attachment" "compliance_anchor_vpc_access" {
+  count = var.lambdas_in_vpc && local.deploy_lambda_handlers ? 1 : 0
+
+  role       = var.compliance_anchor_lambda_role_name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "compliance_export_runner_vpc_access" {
+  count = var.lambdas_in_vpc && local.deploy_lambda_handlers ? 1 : 0
+
+  role       = var.compliance_exports_runner_role_name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+# memory-retraction-drainer runs on its own role (handlers.tf) — the first
+# McPherson VPC cut-over (2026-08-25) failed on exactly this function:
+# "The provided execution role does not have permissions to call
+# CreateNetworkInterface on EC2".
+resource "aws_iam_role_policy_attachment" "memory_retraction_drainer_vpc_access" {
+  count = var.lambdas_in_vpc && local.deploy_lambda_handlers ? 1 : 0
+
+  role       = aws_iam_role.memory_retraction_drainer.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
 ################################################################################
 # Placeholder Lambda — proves the infrastructure works
 #
@@ -256,3 +302,19 @@ resource "aws_lambda_permission" "placeholder_apigw" {
   principal     = "apigateway.amazonaws.com"
   source_arn    = "${aws_apigatewayv2_api.main.execution_arn}/*/*"
 }
+resource "terraform_data" "auth_migration_recovery_deadline_guard" {
+  input = {
+    phase    = var.auth_retirement_phase
+    deadline = var.auth_migration_recovery_deadline
+  }
+
+  lifecycle {
+    precondition {
+      condition = var.auth_retirement_phase != "coexistence" || (
+        trimspace(var.auth_migration_recovery_deadline) != "" &&
+        can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+      )
+      error_message = "auth_migration_recovery_deadline must be an RFC3339 timestamp when auth_retirement_phase is coexistence."
+    }
+  }
+}

package/dist/terraform/modules/app/lambda-api/memory-alarms.tf

@@ -2,9 +2,7 @@
 #
 # Alarms here fire from metrics that EXIST without any log-group management:
 #   - AWS/Lambda Errors for the memory-stage worker and the retraction drainer
-#     (handler crashes, including ones that never reach a log line);
-#   - the wiki-compile DLQ depth (the only memory-path Lambda with an
-#     on_failure destination).
+#     (handler crashes, including ones that never reach a log line).
 #
 # DELIBERATELY NOT HERE — log-metric filters over the drainer's structured
 # summary line and the worker's "status=failed" line. They require the
@@ -18,8 +16,8 @@
 # packages/api/scripts/external-memory-readiness.ts (which reports due,
 # failed, and dead-lettered attempts directly from the ledger).
 #
-# Also runbook-only (no metric exists): source checkpoint age, graph-to-wiki
-# lag, evidence lag, deferred identity count/age.
+# Also runbook-only (no metric exists): source checkpoint age, evidence lag,
+# deferred identity count/age.
 #
 # alarm_actions are empty: the only SNS topic in this module
 # (aws_sns_topic.cost_alerts) is the cost-alert channel — wiring memory alarms
@@ -67,26 +65,3 @@ resource "aws_cloudwatch_metric_alarm" "memory_retraction_drainer_lambda_errors"
   }
 }
 
-# ---------------------------------------------------------------------------
-# wiki-compile DLQ depth (graph → wiki handoff failures)
-# ---------------------------------------------------------------------------
-
-resource "aws_cloudwatch_metric_alarm" "wiki_compile_dlq_depth" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-wiki-compile-dlq-depth"
-  alarm_description   = "wiki-compile DLQ has messages — a compile invocation crashed before the job ledger recorded an outcome; canonical pages are stale until replayed."
-  namespace           = "AWS/SQS"
-  metric_name         = "ApproximateNumberOfMessagesVisible"
-  statistic           = "Maximum"
-  period              = 60
-  evaluation_periods  = 1
-  threshold           = 1
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    QueueName = aws_sqs_queue.wiki_compile_dlq[0].name
-  }
-}

package/dist/terraform/modules/app/lambda-api/oauth-secrets.tf

@@ -36,8 +36,7 @@ resource "aws_secretsmanager_secret_version" "oauth_google_productivity" {
   })
 
   # If the operator rotates the secret via AWS console / CLI without touching
-  # tfvars, terraform shouldn't clobber it on next apply. Matches the pattern
-  # used for google_places_api_key in the wiki-compile handler.
+  # tfvars, terraform shouldn't clobber it on next apply.
   lifecycle {
     ignore_changes = [secret_string]
   }

package/dist/terraform/modules/app/lambda-api/outputs.tf

@@ -48,16 +48,6 @@ output "workflow_execution_callback_fn_arn" {
   value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["workflow-execution-callback"].arn : ""
 }
 
-output "okf_efs_refresh_fn_name" {
-  description = "OKF EFS refresh Lambda function name."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["okf-efs-refresh"].function_name : ""
-}
-
-output "okf_efs_refresh_fn_arn" {
-  description = "OKF EFS refresh Lambda ARN."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["okf-efs-refresh"].arn : ""
-}
-
 output "brain_artifacts_bucket_name" {
   description = "Canonical ThinkWork Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
   value       = aws_s3_bucket.brain_artifacts.bucket
@@ -130,6 +120,23 @@ output "mcp_custom_domain_validation" {
   ] : []
 }
 
+# --- THINK-915 chat turn-latency observability -------------------------------
+
+output "chat_turn_latency_dashboard_name" {
+  description = "CloudWatch dashboard carrying the chat turn-latency phase metrics, dispatch Duration p95, and turn-path Lambda invocations/errors. Empty when the feature is disabled."
+  value       = local.chat_latency_enabled ? aws_cloudwatch_dashboard.chat_turn_latency[0].dashboard_name : ""
+}
+
+output "chat_turn_latency_metric_namespace" {
+  description = "CloudWatch namespace holding TurnRuntimeInvokeMs / AgentLoopMs for this stage."
+  value       = local.chat_latency_namespace
+}
+
+output "chat_turn_runtime_log_group_name_effective" {
+  description = "AgentCore Pi runtime log group actually used by the AgentLoopMs metric filter and the saved turn-timeline query (explicit override, else prefix discovery). Empty when the runtime has not logged yet."
+  value       = local.chat_latency_runtime_log_group
+}
+
 output "mcp_custom_domain_target" {
   description = "Regional target for the final mcp.thinkwork.ai → API Gateway CNAME. Only populated on the second apply (when mcp_custom_domain_ready = true). Includes { target_domain_name, hosted_zone_id } so the CF sync script can upsert the record."
   value = var.mcp_custom_domain != "" && var.mcp_custom_domain_ready ? {

package/dist/terraform/modules/app/lambda-api/runtime-config.tf

@@ -51,9 +51,9 @@ locals {
 # ----------------------------------------------------------------------------
 # Platform secrets (plan 2026-06-11-006 U5/R4)
 #
-# API_AUTH_SECRET and APPSYNC_API_KEY leave plaintext Lambda env: the
-# runtime-config loader prefetches these at cold start (getApiAuthSecret /
-# getAppsyncApiKey accessors, env-wins during the transition window). Names
+# API_AUTH_SECRET leaves plaintext Lambda env: the runtime-config loader
+# prefetches it at cold start (getApiAuthSecret, env-wins during the transition
+# window). Names
 # use the `thinkwork/${stage}/...` prefix so the shared role's existing
 # `secretsmanager:GetSecretValue` grant on `thinkwork/*` covers them.
 # The env copies in common_env are dropped one release AFTER this ships
@@ -83,24 +83,6 @@ resource "aws_secretsmanager_secret_version" "api_auth" {
   # console.
 }
 
-resource "aws_secretsmanager_secret" "appsync_api_key" {
-  name        = "thinkwork/${var.stage}/appsync-api-key"
-  description = "AppSync API key for subscription notify fan-out. Prefetched at Lambda cold start by @thinkwork/runtime-config."
-  tags = {
-    Name  = "thinkwork-${var.stage}-appsync-api-key"
-    Stage = var.stage
-  }
-}
-
-resource "aws_secretsmanager_secret_version" "appsync_api_key" {
-  secret_id     = aws_secretsmanager_secret.appsync_api_key.id
-  secret_string = var.appsync_api_key
-
-  # AppSync keys are terraform-rotated (the appsync module recreates them),
-  # so track the var here — unlike api_auth there is no operator rotation
-  # path outside terraform.
-}
-
 # The standalone compliance Lambdas (anchor, export-runner) bundle the
 # runtime-config loader but run under dedicated roles that lack the shared
 # role's ssm grant. Without these, every cold start auto-prime fails

package/dist/terraform/modules/app/lambda-api/turn-assertion.tf

@@ -0,0 +1,45 @@
+# Signed-turn identity (THINK-324 Wave-3 C18).
+#
+# An asymmetric SIGN_VERIFY key per published version label. The dispatch
+# Lambdas (chat-agent-invoke, wakeup-processor) mint a short-lived assertion
+# binding {tenant, thread, turn} into the Pi invoke payload; the runtime
+# echoes it on callbacks; verifiers (tool-executions today, more in C19)
+# check the signature locally against the cached public key. The private key
+# never leaves KMS — a compromised Lambda cannot exfiltrate the signer.
+#
+# The `agentcore_turn_assertion_*` variables predate this plane's rebuild
+# (the THINK-311 trial's key was destroyed with the managed harness); the
+# same one-or-two-version rotation contract applies.
+
+resource "aws_kms_key" "agentcore_turn_assertion" {
+  for_each = toset(var.agentcore_turn_assertion_key_versions)
+
+  description              = "ThinkWork ${var.stage} signed-turn assertion key (${each.key})"
+  key_usage                = "SIGN_VERIFY"
+  customer_master_key_spec = "ECC_NIST_P256"
+  deletion_window_in_days  = 7
+
+  lifecycle {
+    precondition {
+      condition     = contains(var.agentcore_turn_assertion_key_versions, var.agentcore_turn_assertion_active_key_version)
+      error_message = "agentcore_turn_assertion_active_key_version must be one of agentcore_turn_assertion_key_versions."
+    }
+  }
+
+  tags = {
+    Stage     = var.stage
+    Component = "turn-assertion"
+  }
+}
+
+resource "aws_kms_alias" "agentcore_turn_assertion" {
+  for_each = toset(var.agentcore_turn_assertion_key_versions)
+
+  name          = "alias/thinkwork-${var.stage}-turn-assertion-${each.key}"
+  target_key_id = aws_kms_key.agentcore_turn_assertion[each.key].key_id
+}
+
+locals {
+  turn_assertion_active_key_arn = aws_kms_key.agentcore_turn_assertion[var.agentcore_turn_assertion_active_key_version].arn
+  turn_assertion_key_arns       = [for key in aws_kms_key.agentcore_turn_assertion : key.arn]
+}