thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -13,6 +13,30 @@ variable "region" {
   type        = string
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired; WorkOS callback/bridge routes exist only for explicitly configured upgrade rollback windows."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for completing legacy-session identity migration. Required while auth_retirement_phase is coexistence."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "lambda_artifact_bucket" {
   description = "S3 bucket containing Lambda deployment artifacts"
   type        = string
@@ -92,6 +116,24 @@ variable "plugin_catalog_github_token_secret_arn" {
   default     = ""
 }
 
+variable "brain_m2m_platform_agent_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Company Brain platform-agent machine-lane secret (Cognito client-credentials blob, THINK-628). When set, the shared API Lambda role may read it so MCP config build can mint short-lived bearers for the Brain connector. Empty leaves the tkt_ lane untouched."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_api_url" {
+  description = "Optional Company Brain ops-api base URL (the API Gateway endpoint the Brain console uses, e.g. https://xxxx.execute-api.us-east-1.amazonaws.com). When set alongside brain_ops_m2m_secret_arn, the flagThreadToBrain mutation can POST /flags (THINK-781). Empty disables the Send-to-the-Brain action."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_m2m_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Brain agent-identity m2m secret (Cognito client-credentials blob for the ops-api operator pool, scope etl-agent/tasks — e.g. etl-platform/agent/cognito-m2m-brain). When set, the shared API Lambda role may read it so flagThreadToBrain can mint bearers for POST /flags (THINK-781)."
+  type        = string
+  default     = ""
+}
+
 variable "brain_artifacts_kms_key_arn" {
   description = "Optional KMS key ARN used to encrypt canonical ThinkWork Brain artifacts. AES256 encryption is used when unset."
   type        = string
@@ -124,6 +166,12 @@ variable "mobile_client_id" {
   type        = string
 }
 
+variable "console_client_id" {
+  description = "Optional Company Brain console client ID (U13). Empty when the console client is disabled — kept out of COGNITO_APP_CLIENT_IDS via compact()."
+  type        = string
+  default     = ""
+}
+
 variable "cognito_auth_domain" {
   description = "Cognito hosted UI domain prefix, e.g. thinkwork-dev. Empty disables MCP OAuth login."
   type        = string
@@ -135,19 +183,76 @@ variable "appsync_api_url" {
   type        = string
 }
 
-variable "appsync_api_key" {
-  description = "AppSync API key"
+variable "appsync_api_id" {
+  description = "AppSync subscriptions API ID used as the subscription-ticket audience"
   type        = string
-  sensitive   = true
 }
 
-variable "kb_service_role_arn" {
-  description = "Bedrock Knowledge Base service role ARN"
+variable "agentcore_harness_execution_role_arn" {
+  description = "Legacy Harness execution-role input retained for module compatibility. Request-path PassRole/control-plane grants were removed by THINK-316 U2."
   type        = string
+  default     = ""
 }
 
-variable "agentcore_harness_execution_role_arn" {
-  description = "AgentCore Harness execution role ARN (THINK-311 U4). Empty string (harness module disabled) omits the Harness invoker grants from the grouped ai policy."
+variable "enable_agentcore_harness_invocation" {
+  description = "Grant only the Harness data-plane invocation actions to the request path. Harness control-plane permissions remain outside Lambda."
+  type        = bool
+  default     = false
+}
+
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Enable the non-production THINK-316 AgentCore Identity/Gateway/Harness proof surfaces. Defaults off and never changes ordinary Pi routing."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published AgentCore assertion KMS key versions. Use two only during the bounded rotation overlap."
+  type        = list(string)
+  default     = ["v1"]
+
+  validation {
+    condition = (
+      length(var.agentcore_turn_assertion_key_versions) >= 1 &&
+      length(var.agentcore_turn_assertion_key_versions) <= 2 &&
+      length(distinct(var.agentcore_turn_assertion_key_versions)) == length(var.agentcore_turn_assertion_key_versions) &&
+      alltrue([for version in var.agentcore_turn_assertion_key_versions : can(regex("^[a-z0-9][a-z0-9-]{0,15}$", version))])
+    )
+    error_message = "agentcore_turn_assertion_key_versions must contain one or two unique lowercase version labels."
+  }
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "Published AgentCore assertion key version used for new signatures."
+  type        = string
+  default     = "v1"
+
+  # Membership in agentcore_turn_assertion_key_versions is enforced by a
+  # precondition on aws_kms_key.agentcore_turn_assertion — variable validations
+  # cannot reference other variables until Terraform 1.9, and this module
+  # supports the repo floor of Terraform 1.5 (the customer deployment runner
+  # pins 1.8.5).
+  validation {
+    condition     = can(regex("^[a-z0-9][a-z0-9-]{0,15}$", var.agentcore_turn_assertion_active_key_version))
+    error_message = "agentcore_turn_assertion_active_key_version must be a lowercase version label."
+  }
+}
+
+variable "agentcore_proof_oauth_client_id" {
+  description = "Synthetic OAuth client id used only by the THINK-316 proof provider."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_proof_oauth_client_secret" {
+  description = "Synthetic OAuth client secret used only by the THINK-316 proof provider and boundary target."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "agentcore_proof_owner_allowlist" {
+  description = "Comma-separated synthetic subjects used by the THINK-316 manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants do not require registration here."
   type        = string
   default     = ""
 }
@@ -244,18 +349,6 @@ variable "brain_dream_state_schedule_expression" {
   default     = "cron(0 5 * * ? *)"
 }
 
-variable "retry_dispatcher_enabled" {
-  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there (parent plan deploy ordering); manual invokes work regardless."
-  type        = bool
-  default     = false
-}
-
-variable "stall_threshold_minutes" {
-  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307 — one knob, two consumers)."
-  type        = number
-  default     = 5
-}
-
 variable "extension_proxy_signing_secret" {
   description = "Shared HMAC secret used by the generic Admin extension proxy to sign actor context for extension backends."
   type        = string
@@ -263,78 +356,44 @@ variable "extension_proxy_signing_secret" {
   default     = ""
 }
 
-variable "hindsight_endpoint" {
-  description = "Hindsight API endpoint (empty when enable_hindsight = false)"
-  type        = string
-  default     = ""
-}
-
-variable "hindsight_database_name" {
-  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty = Hindsight tables live in the `hindsight` schema of the primary database; set = the api reads them from this database's `public` schema. Rides the SSM runtime-config document (getConfig), not Lambda env."
-  type        = string
-  default     = ""
-}
-
 variable "agentcore_memory_id" {
   description = "Bedrock AgentCore Memory resource ID — used by the GraphQL memory resolvers to list records across tenant agents."
   type        = string
   default     = ""
 }
 
-variable "memory_engine" {
-  description = "Active long-term memory engine for this deployment. Exactly one engine is canonical for recall/inspect/export."
-  type        = string
-  default     = "hindsight"
-  validation {
-    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
-  }
-}
-
-variable "analyst_egress_subnet_ids" {
-  description = "Private (NAT-routed) subnet IDs for VPC-attaching the analyst data-path handlers (graphql-http, analyst-query-broker, analyst-connection-reconciler) so external Postgres sources can allowlist the stack's stable NAT egress IP. Leave empty to keep the handlers outside any VPC."
-  type        = list(string)
-  default     = []
-}
-
-variable "analyst_egress_security_group_ids" {
-  description = "Security group IDs for the VPC-attached analyst data-path handlers. Leave empty to keep the handlers outside any VPC."
-  type        = list(string)
-  default     = []
-}
-
 variable "okf_efs_subnet_ids" {
-  description = "Subnet IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_security_group_ids" {
-  description = "Security group IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_mount_target_ids" {
-  description = "EFS mount target IDs that must exist before creating the OKF EFS hydrator Lambda."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_file_system_arn" {
-  description = "EFS file system ARN for the OKF wiki current view. Empty disables EFS IAM grants."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = string
   default     = ""
 }
 
 variable "okf_efs_refresh_access_point_arn" {
-  description = "EFS access point ARN mounted by the okf-efs-refresh Lambda. Empty disables the mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = string
   default     = ""
 }
 
 variable "okf_efs_mount_path" {
-  description = "Local Lambda mount path for the OKF wiki EFS view. Must be under /mnt."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = string
   default     = "/mnt/thinkwork-okf"
 }
@@ -429,12 +488,6 @@ variable "admin_url" {
   default     = ""
 }
 
-variable "docs_url" {
-  description = "Docs site URL (e.g. https://d2grg1uavrp7lx.cloudfront.net)"
-  type        = string
-  default     = ""
-}
-
 variable "www_url" {
   description = "Marketing site URL (e.g. https://thinkwork.ai). Used for Stripe Checkout cancel_url and CORS origin."
   type        = string
@@ -507,24 +560,12 @@ variable "job_scheduler_role_arn" {
   default     = ""
 }
 
-variable "wiki_compile_model_id" {
-  description = "Bedrock model id the wiki-compile Lambda uses for the leaf planner, aggregation planner, and section writer. Any Converse-compatible model works. Override per-env if you want to spike a different model without re-deploying code."
-  type        = string
-  default     = "openai.gpt-oss-120b-1:0"
-}
-
 variable "brain_source_agent_model_id" {
   description = "Bedrock model id the GraphQL context-engine Brain source-agent runtime uses for JSON tool/action turns. Kept separate from the high-throughput wiki compiler model so source agents can use a model tuned for reliable action JSON."
   type        = string
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
-variable "kg_obs_max_candidates_per_run" {
-  description = "Per-run candidate cap for the observations → Knowledge Graph ingest worker (KG_OBS_MAX_CANDIDATES_PER_RUN). Bounds the layered-gate classifier cost and lets truncated runs self-invoke to drain the remaining backlog. Stored as a string because the Lambda reads it verbatim from env."
-  type        = string
-  default     = "10"
-}
-
 variable "wiki_aggregation_pass_enabled" {
   description = "Feature flag for the wiki aggregation pass (parent section rollups + section promotion). Pipeline stops after leaf compile when this is off and never populates hub rollups. Stored as a string because the Lambda reads it verbatim from env; must be 'true' / '1' / 'yes' to enable."
   type        = string
@@ -537,20 +578,14 @@ variable "wiki_deterministic_linking_enabled" {
   default     = "true"
 }
 
-variable "kg_extraction_model_id" {
-  description = "Bedrock model id for knowledge-graph entity/relationship extraction from observations (plan 2026-07-03-005). Defaults to a gpt-oss high-quota model; overridable per stage."
-  type        = string
-  default     = "openai.gpt-oss-120b-1:0"
-}
-
-variable "knowledge_graph_observations_ingest_enabled" {
-  description = "Enable the recurring Brain distillation schedule (Hindsight observations -> knowledge graph). Ships disabled; dev flips on after a golden-set-validated manual run (plan 2026-07-03-005 U4)."
+variable "identity_drift_match_enabled" {
+  description = "Enable the recurring per-tenant identity drift match sweep (THINK-321 U7/KTD-7 — R10). Ships disabled; enabled per stage once bootstrap matching has been proven there."
   type        = bool
   default     = false
 }
 
 variable "wiki_source" {
-  description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer over the knowledge-graph mirror and makes successful observation-ingest runs the compile trigger. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
+  description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
   type        = string
   default     = "planner"
 
@@ -560,12 +595,6 @@ variable "wiki_source" {
   }
 }
 
-variable "google_places_api_key" {
-  description = "Google Places API (New) key used by wiki-compile for POI → city/state/country hierarchy enrichment. Stored as a SecureString SSM parameter at /thinkwork/<stage>/google-places/api-key. Empty default creates the parameter with a placeholder value; operator populates via `aws ssm put-parameter --overwrite`. The parameter's value has lifecycle.ignore_changes set so CLI rotation sticks across terraform applies. Compile gracefully degrades when the key is absent (metadata-only place rows) — never fails compile."
-  type        = string
-  default     = ""
-  sensitive   = true
-}
 
 # ---------------------------------------------------------------------------
 # Per-user OAuth client credentials
@@ -776,8 +805,19 @@ variable "compliance_exports_runner_role_name" {
   default     = ""
 }
 
-variable "knowledge_graph_tool_enabled" {
-  description = "Stage gate for the Pi knowledge_graph_search tool (plan 2026-06-09-004 U8). Per-agent tool policy gates on top."
+variable "agentcore_session_scope" {
+  description = "THINK-909/THINK-946 AgentCore runtime session scope for agentcore-runtime-dispatch. \"thread\" (default) keys the session per thread; \"user\" keys it per (tenant, agent, user) so a new thread reuses the user's warm microVM — and, per THINK-946, its retained MCP connections and toolset — falling back to the per-thread session on a 409. Set \"user\" only after the stage's Pi runtime image dual-accepts both session ids. mcpherson runs \"user\"; every other stage keeps the default."
+  type        = string
+  default     = "thread"
+
+  validation {
+    condition     = contains(["thread", "user"], var.agentcore_session_scope)
+    error_message = "agentcore_session_scope must be \"thread\" or \"user\"."
+  }
+}
+
+variable "identity_resolution_tool_enabled" {
+  description = "Stage gate for the Pi identity-resolution tools (resolve_entities / propose_mapping_candidates / confirm_mapping, THINK-321 U5). Per-agent tool policy gates on top."
   type        = bool
   default     = true
 }
@@ -800,40 +840,20 @@ variable "capability_signing_private_key_secret" {
   default     = ""
 }
 
-# ---------------------------------------------------------------------------
-# THINK-228 U3 — analyst query broker runtime config
-# ---------------------------------------------------------------------------
-
-variable "analyst_reader_secret_arn" {
-  description = "ARN of the Secrets Manager secret holding the `analyst_reader` Aurora role credentials (THINK-228 U2). Wired from `module.database.analyst_reader_secret_arn`. The analyst-query-broker Lambda executes model-authored SQL exclusively under this role."
-  type        = string
-  default     = ""
-}
-
-variable "analyst_broker_secret_arn" {
-  description = "ARN of the Secrets Manager secret holding the analyst query-broker caller credential (JSON {token, tenantId}; THINK-228 U3). Wired from `module.database.analyst_broker_secret_arn`. The broker validates incoming Bearer tokens against it; the seeded connector row references it as auth_config.secretRef."
+variable "subscription_ticket_signing_key_id" {
+  description = "Active Ed25519 subscription-ticket signing key ID."
   type        = string
   default     = ""
 }
 
-variable "analyst_policy_source" {
-  description = "THINK-229 KTD5 enforcement flip: 'row' (default — sidecar policy is shadow-only) or 'sidecar' (the signed sidecar policy block is authoritative: budgets + retain_sql flow into dispatch and the broker). Flip only after clean analyst-policy-shadow parity on live traffic AND a provision refresh so every connection sidecar carries a policy block."
-  type        = string
-  default     = "row"
-  validation {
-    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
-    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
-  }
-}
-
-variable "capability_self_extension_tenants" {
-  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed. Read via getConfig() in capability-control-service."
+variable "subscription_ticket_public_keys" {
+  description = "JSON verifier keyring for AppSync subscription tickets; contains public material only."
   type        = string
-  default     = ""
+  default     = "[]"
 }
 
-variable "analyst_db_cluster_resource_id" {
-  description = "Immutable RDS cluster resource ID (cluster-XXXX / db-XXXX) for the stage database (THINK-229 U1). Wired from `module.database.cluster_resource_id`. Keys the broker's `rds-db:connect` IAM grant — the rds-db ARN format requires the resource ID, not the cluster ARN — and gates the IAM connect env on the broker Lambda: when empty, the broker stays on the password path."
+variable "subscription_ticket_private_key_secret" {
+  description = "Secrets Manager name holding the isolated subscription-ticket Ed25519 private key."
   type        = string
   default     = ""
 }
@@ -893,3 +913,169 @@ variable "capability_broker_vpce_dns" {
   type        = string
   default     = ""
 }
+
+# ---------------------------------------------------------------------------
+# Company Brain twin (plan 2026-07-21-001 U5): Neptune wiring for the
+# identity-graph-projector. All default-empty — the projector deploys inert
+# (no VPC, no endpoint) until the stage's neptune outputs are supplied.
+# ---------------------------------------------------------------------------
+
+variable "neptune_endpoint" {
+  type        = string
+  default     = ""
+  description = "Neptune twin cluster writer endpoint (from the etl-platform neptune stack; empty = twin disabled)"
+}
+
+variable "brain_mcp_url" {
+  type        = string
+  default     = ""
+  description = "Platform-served Brain MCP endpoint (e.g. https://mcp.brain.thinkwork.ai/mcp). When set, twin-connector provisioning registers agents against it instead of the product /mcp/twin route (consolidation U14). Empty = legacy product-served default."
+}
+
+variable "neptune_cluster_resource_id" {
+  type        = string
+  default     = ""
+  description = "Neptune cluster resource id for neptune-db IAM ARNs (empty = no data-access grant)"
+}
+
+variable "neptune_subnet_ids" {
+  type        = list(string)
+  default     = []
+  description = "Private subnets for the identity-graph-projector's vpc_config (Neptune is VPC-only)"
+}
+
+variable "neptune_security_group_ids" {
+  type        = list(string)
+  default     = []
+  description = "SGs for the projector (the etl neptune stack's neptune-client SG)"
+}
+
+# ---------------------------------------------------------------------------
+# THINK-1082: every handler inside the VPC. Each handler carries DATABASE_URL
+# (common_env) and, with no vpc_config, reaches Aurora only over the cluster's
+# PUBLIC endpoint through the world-open 0.0.0.0/0 -> 5432 rule the
+# aurora-postgres module seeds. Revoking that rule took the whole app down
+# (auth-me -> DB timeout -> 401 "No tenant assigned"). With lambdas_in_vpc the
+# functions attach to the VPC's private subnets behind a security group the
+# database security group admits, so the public rule can be closed. All
+# default-off — the module deploys byte-identical until the caller opts in.
+# ---------------------------------------------------------------------------
+
+variable "lambdas_in_vpc" {
+  type        = bool
+  default     = false
+  description = "Attach every DB-connected Lambda in this module (all api handlers, compliance-anchor, compliance-export-runner) to the VPC via vpc_subnet_ids + vpc_security_group_ids so Aurora is reached by security group instead of the public endpoint. The subnets must be NAT-routed (handlers call AWS APIs, Bedrock, Slack, GitHub, ...). Requires non-empty vpc_subnet_ids and vpc_security_group_ids."
+}
+
+variable "vpc_subnet_ids" {
+  type        = list(string)
+  default     = []
+  description = "Private (NAT-routed) subnet IDs the handlers attach to when lambdas_in_vpc is true."
+}
+
+variable "vpc_security_group_ids" {
+  type        = list(string)
+  default     = []
+  description = "Security groups for the handlers when lambdas_in_vpc is true (the thinkwork module passes its api-lambda SG, which the database SG admits on tcp/5432). Merged with neptune_security_group_ids on the identity-graph-projector."
+}
+
+# Bulk-rebuild lane (THINK-331 U4): Neptune bulk-loader staging. Both
+# default-empty — bulk-rebuild returns a structured "not configured" error
+# until the etl-platform neptune stack's load bucket + loader role are
+# supplied.
+
+variable "neptune_load_bucket" {
+  type        = string
+  default     = ""
+  description = "Neptune bulk-load staging bucket name (etl-platform neptune stack; empty = bulk-rebuild disabled)"
+}
+
+variable "neptune_loader_role_arn" {
+  type        = string
+  default     = ""
+  description = "IAM role ARN the Neptune cluster assumes to read the load bucket (etl-platform neptune stack; empty = bulk-rebuild disabled)"
+}
+
+variable "lambda_max_memory_mb" {
+  type        = number
+  default     = 10240
+  description = "Account-level Lambda memory ceiling. Legacy AWS accounts cap function memory at 3008 MB (raised only via support case); handlers that request more are clamped to this value so deploys on capped accounts don't fail mid-apply."
+}
+
+# THINK-583 U3 — provisioned concurrency for the two chat-critical zip
+# Lambdas (chat-agent-invoke, workspace-renderer) ONLY (KTD5: never the Pi
+# Lambda). 0 (the default) disables the provisioned-concurrency config but
+# STILL creates the published version + `live` alias, so alias-qualified
+# invokers keep working on every stage; customer stages opt in on their own
+# release cadence. Dev is enabled via scripts/deploy/terraform-vars.sh
+# (deploy.yml is dev-only — same pattern as enable_capability_broker).
+
+variable "chat_agent_invoke_provisioned_concurrency" {
+  type        = number
+  default     = 0
+  description = "Provisioned concurrency on chat-agent-invoke's `live` alias. 0 = disabled (alias still exists)."
+}
+
+variable "workspace_renderer_provisioned_concurrency" {
+  type        = number
+  default     = 0
+  description = "Provisioned concurrency on workspace-renderer's `live` alias. 0 = disabled (alias still exists)."
+}
+
+variable "agentcore_runtime_dispatch_enabled" {
+  description = "THINK-585 U6 (KTD3): stage kill-switch for chat dispatch through the Bedrock AgentCore Runtime (per-thread sessions). The per-agent agents.agentcore_runtime_dispatch flag gates on top. Default off; dev opts in via the deploy workflow, customer stages via runner-secrets on their own cadence."
+  type        = bool
+  default     = false
+}
+
+variable "auth_state_store" {
+  description = "THINK-643: backing store for short-lived auth-flow state (AppSync subscription tickets + the per-principal connect rate-limit counter). \"postgres\" (default) keeps the Aurora `auth_subscription_tickets` path. \"dynamo\" provisions thinkwork-<stage>-auth-state and points the auth handlers at it; the authorizer still falls back to a Postgres read for tickets minted just before the flip."
+  type        = string
+  default     = "postgres"
+
+  validation {
+    condition     = contains(["postgres", "dynamo"], var.auth_state_store)
+    error_message = "auth_state_store must be \"postgres\" or \"dynamo\"."
+  }
+}
+
+################################################################################
+# THINK-915 — chat turn-latency observability
+# (see chat-latency-observability.tf for the constraints behind each of these)
+################################################################################
+
+variable "enable_chat_turn_latency_observability" {
+  description = "THINK-915: create the per-stage chat turn-latency dashboard, the saved thinkwork-<stage>-turn-timeline Logs Insights query, and the Lambda-native dispatch p95 alarm. On by default — none of these depend on a log group already existing."
+  type        = bool
+  default     = true
+}
+
+variable "enable_chat_turn_latency_metric_filters" {
+  description = "THINK-915: create the agentcore_phase log metric filters (TurnRuntimeInvokeMs, AgentLoopMs) and the metric-filter-backed p95 alarm. OFF by default: the Lambda log groups are created implicitly on first invocation and are not Terraform-managed, so PutMetricFilter fails with ResourceNotFoundException on a greenfield stage (see memory-alarms.tf). Turn on for a stage that has already served chat traffic."
+  type        = bool
+  default     = false
+}
+
+variable "chat_turn_latency_metric_namespace" {
+  description = "THINK-915: CloudWatch namespace prefix for the chat phase metrics. The stage is appended (Thinkwork/Chat/<stage>) because metric-filter dimensions may only reference JSON fields of the matched log event, and the agentcore_phase record carries no stage field."
+  type        = string
+  default     = "Thinkwork/Chat"
+}
+
+variable "chat_turn_runtime_log_group_name" {
+  description = "THINK-915: explicit AgentCore Pi runtime log group (/aws/bedrock-agentcore/runtimes/thinkwork_<stage>_pi-<runtimeId>-DEFAULT). Empty (default) skips the runtime-sourced metric, widgets, and query leg — plan-time prefix discovery was removed because it defers to apply in customer deployment-runner plans and breaks them."
+  type        = string
+  default     = ""
+}
+
+variable "chat_turn_p95_alarm_threshold_ms" {
+  description = "THINK-915: p95 threshold (ms) for the whole AgentCore runtime call, breaching on 2 of 3 five-minute periods."
+  type        = number
+  default     = 30000
+}
+
+variable "chat_turn_latency_alarm_actions" {
+  description = "THINK-915: SNS topic ARNs notified by the chat turn-latency alarms (also used as OK actions). Empty by default — the only topic in this module is the cost-alert channel, and latency pages do not belong there."
+  type        = list(string)
+  default     = []
+}

package/dist/{plugins/n8n/terraform → terraform/modules/app}/n8n/README.md

@@ -89,7 +89,7 @@ packages.
 
 ```hcl
 module "n8n" {
-  source = "../../../plugins/n8n/terraform/n8n"
+  source = "../app/n8n"
 
   stage                = var.stage
   vpc_id               = module.vpc.vpc_id

package/dist/{plugins/n8n/terraform → terraform/modules/app}/n8n/main.tf

@@ -292,24 +292,24 @@ resource "terraform_data" "database_lifecycle" {
 
 resource "terraform_data" "configuration_guardrails" {
   input = {
-    runtime_enabled                         = var.runtime_enabled
-    main_desired_count                      = var.main_desired_count
-    worker_desired_count                    = var.worker_desired_count
-    image_uri                               = var.image_uri
-    public_url                              = var.public_url
-    certificate_arn                         = var.certificate_arn
-    database_host                           = var.database_host
-    database_name                           = var.database_name
-    database_username                       = var.database_username
-    database_url_secret_arn                 = local.effective_database_url_secret_arn
-    encryption_key_secret_arn               = local.effective_encryption_key_secret_arn
-    operator_secret_arn                     = local.effective_operator_secret_arn
-    service_credential_secret_arn           = local.effective_service_credential_secret_arn
-    storage_bucket_name                     = var.storage_bucket_name
-    storage_prefix                          = local.storage_prefix
-    queue_mode                              = var.queue_mode
-    cache_engine                            = var.cache_engine
-    cache_subnet_ids                        = local.effective_cache_subnet_ids
+    runtime_enabled               = var.runtime_enabled
+    main_desired_count            = var.main_desired_count
+    worker_desired_count          = var.worker_desired_count
+    image_uri                     = var.image_uri
+    public_url                    = var.public_url
+    certificate_arn               = var.certificate_arn
+    database_host                 = var.database_host
+    database_name                 = var.database_name
+    database_username             = var.database_username
+    database_url_secret_arn       = local.effective_database_url_secret_arn
+    encryption_key_secret_arn     = local.effective_encryption_key_secret_arn
+    operator_secret_arn           = local.effective_operator_secret_arn
+    service_credential_secret_arn = local.effective_service_credential_secret_arn
+    storage_bucket_name           = var.storage_bucket_name
+    storage_prefix                = local.storage_prefix
+    queue_mode                    = var.queue_mode
+    cache_engine                  = var.cache_engine
+    cache_subnet_ids              = local.effective_cache_subnet_ids
   }
 
   lifecycle {