thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/thinkwork/main.tf

@@ -53,11 +53,6 @@ locals {
     : module.vpc.private_subnet_ids
   )
 
-  # Hindsight is the canonical user/Space memory provider for full ThinkWork
-  # installs. AgentCore managed memory remains available as an explicit
-  # low-cost/development opt-out. We still honor var.memory_engine == "hindsight"
-  # so existing tfvars keep working even when enable_hindsight was not set.
-  hindsight_enabled      = var.enable_hindsight || var.memory_engine == "hindsight"
   twenty_provisioned     = var.twenty_provisioned
   twenty_runtime_enabled = var.twenty_provisioned && var.twenty_runtime_enabled
   twenty_domain          = var.twenty_domain != "" ? var.twenty_domain : (var.www_domain != "" ? "crm.${var.www_domain}" : "")
@@ -83,8 +78,28 @@ locals {
     module.vpc.private_route_table_ids,
     module.vpc.public_route_table_ids,
   )
-  okf_wiki_private_endpoints_enabled = var.okf_wiki_efs_enabled && var.okf_wiki_create_vpc_endpoints
-  okf_wiki_interface_endpoint_services = toset(concat(
+  # THINK-589 PR 1 (deprecate-to-no-op): the OKF wiki EFS feature is dead.
+  # Every EFS consumer below (client/EFS security groups, NFS rule, mount
+  # targets, access points, Pi/hydrator wiring) is hard-conditioned off via
+  # this local regardless of the deprecated okf_wiki_* inputs. The EFS
+  # filesystem itself and the NAT gateway are intentionally NOT conditioned
+  # off: destroying the filesystem is PR 2's gated delete, and the NAT is
+  # shared VPC egress that live non-OKF workloads ride.
+  #
+  # The VPC interface endpoints were re-homed out of the OKF lane on
+  # 2026-08-28 (the vpc_interface_* resources below — they were only ever
+  # "okf-wiki" by accident of being created by the first VPC-attached
+  # workload). They still ride the okf_wiki_* enable gates for stage
+  # compatibility; the SERVICE SET and ENI count are now per-stage inputs.
+  okf_wiki_efs_consumers_active   = false
+  vpc_interface_endpoints_enabled = var.okf_wiki_efs_enabled && var.okf_wiki_create_vpc_endpoints
+  # Legacy full set — what every stage had before the cost review. An
+  # interface endpoint with private DNS does not grant reachability (the
+  # private subnets are NAT-routed and the Lambda SGs allow 443 out); it only
+  # keeps the call on AWS's network, at ~$7.30/mo per ENI regardless of
+  # traffic. Stages that care about posture keep the data-touching ones
+  # (secretsmanager, rds-data, bedrock-runtime) and let the rest ride the NAT.
+  vpc_interface_endpoint_services_legacy = toset(concat(
     [
       "bedrock",
       "bedrock-agentcore",
@@ -106,18 +121,17 @@ locals {
       "bedrock-runtime",
     ],
   ))
-
-  # Canonical long-term memory engine for this deployment. Exactly one engine
-  # is active per deployment for recall/inspect/export. Empty selects
-  # Hindsight for full installs; callers can explicitly choose AgentCore for
-  # low-cost/development deployments. Legacy value "managed" maps to
-  # "agentcore".
-  resolved_memory_engine = (
-    var.memory_engine == "hindsight" || var.memory_engine == "agentcore"
-    ? var.memory_engine
-    : var.memory_engine == "managed"
-    ? "agentcore"
-    : local.hindsight_enabled ? "hindsight" : "agentcore"
+  vpc_interface_endpoint_services = (
+    var.vpc_interface_endpoint_services != null
+    ? toset(var.vpc_interface_endpoint_services)
+    : local.vpc_interface_endpoint_services_legacy
+  )
+  # Single-AZ: one ENI in the lowest sorted subnet. Callers in the other AZ
+  # cross AZs at $0.01/GB — nothing at these volumes next to a second ENI.
+  vpc_interface_endpoint_subnet_ids = (
+    var.vpc_interface_endpoint_single_az
+    ? slice(sort(local.okf_wiki_subnet_ids), 0, min(1, length(local.okf_wiki_subnet_ids)))
+    : local.okf_wiki_subnet_ids
   )
 
   # Customer-domain namespace (<name>.thinkwork.ai). The zone is created as
@@ -487,14 +501,16 @@ resource "terraform_data" "n8n_runtime_state_guardrails" {
     }
   }
 }
-# Egress-only SG for the VPC-attached analyst data-path Lambdas
-# (analyst_lambda_vpc_egress). Their whole point is a stable NAT egress IP for
-# external database allowlists; they accept no inbound traffic.
-resource "aws_security_group" "analyst_egress_lambda" {
-  count = var.analyst_lambda_vpc_egress ? 1 : 0
-
-  name_prefix = "thinkwork-${var.stage}-analyst-egress-"
-  description = "Egress for VPC-attached analyst data-path Lambdas"
+# Company Brain U5: general egress for the VPC-attached identity-graph-
+# projector (twin-query retired to the platform service — THINK-339 U15).
+# Pairs with the etl neptune stack's
+# client SG (8182-only) — this one covers Aurora (5432), Secrets/S3/Lambda
+# APIs (443) through the NAT-routed private subnets.
+resource "aws_security_group" "twin_lambda_egress" {
+  #checkov:skip=CKV2_AWS_5: attached to the twin Lambdas via lambda-api's neptune vpc_config
+  count       = var.neptune_client_security_group_id != "" ? 1 : 0
+  name        = "thinkwork-${var.stage}-twin-lambda-egress"
+  description = "Twin Lambdas - general egress (Aurora, AWS APIs)"
   vpc_id      = module.vpc.vpc_id
 
   egress {
@@ -503,20 +519,10 @@ resource "aws_security_group" "analyst_egress_lambda" {
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
-
-  tags = { Name = "thinkwork-${var.stage}-analyst-egress-lambda-sg" }
-
-  lifecycle {
-    create_before_destroy = true
-    precondition {
-      condition     = length(module.vpc.private_subnet_ids) > 0
-      error_message = "analyst_lambda_vpc_egress requires private (NAT-routed) subnets — a Lambda in a public subnet has no internet egress."
-    }
-  }
 }
 
 resource "aws_security_group" "okf_wiki_lambda" {
-  count = var.okf_wiki_efs_enabled ? 1 : 0
+  count = local.okf_wiki_efs_consumers_active ? 1 : 0 # THINK-589: always off
 
   name_prefix = "thinkwork-${var.stage}-okf-wiki-lambda-"
   description = "OKF wiki EFS clients for hydrator and Pi"
@@ -534,7 +540,7 @@ resource "aws_security_group" "okf_wiki_lambda" {
 }
 
 resource "aws_security_group" "okf_wiki_efs" {
-  count = var.okf_wiki_efs_enabled ? 1 : 0
+  count = local.okf_wiki_efs_consumers_active ? 1 : 0 # THINK-589: always off
 
   name_prefix = "thinkwork-${var.stage}-okf-wiki-efs-"
   description = "NFS ingress for OKF wiki current-view EFS"
@@ -544,74 +550,83 @@ resource "aws_security_group" "okf_wiki_efs" {
   lifecycle { create_before_destroy = true }
 }
 
-resource "aws_security_group" "okf_wiki_vpc_endpoint" {
-  count = var.okf_wiki_efs_enabled && var.okf_wiki_create_vpc_endpoints ? 1 : 0
+# Re-homed from okf_wiki_vpc_endpoint (2026-08-28). name_prefix AND
+# description keep their historical values on purpose: either change replaces
+# the SG, which every live endpoint references — the Name tag carries the new
+# identity instead.
+resource "aws_security_group" "vpc_interface_endpoint" {
+  count = local.vpc_interface_endpoints_enabled ? 1 : 0
 
   name_prefix = "thinkwork-${var.stage}-okf-wiki-vpce-"
   description = "HTTPS endpoints for OKF wiki VPC-attached Lambdas"
   vpc_id      = module.vpc.vpc_id
 
-  tags = { Name = "thinkwork-${var.stage}-okf-wiki-vpce-sg" }
+  tags = { Name = "thinkwork-${var.stage}-vpce-sg" }
   lifecycle { create_before_destroy = true }
 }
 
 resource "aws_security_group_rule" "okf_wiki_vpce_from_lambda" {
-  count = local.okf_wiki_private_endpoints_enabled ? 1 : 0
+  # THINK-589: always off — the OKF client SG no longer exists; VPC workloads
+  # reach the endpoints via vpc_interface_endpoint_from_vpc (VPC CIDR).
+  count = local.okf_wiki_efs_consumers_active ? 1 : 0
 
   type                     = "ingress"
   from_port                = 443
   to_port                  = 443
   protocol                 = "tcp"
   source_security_group_id = aws_security_group.okf_wiki_lambda[0].id
-  security_group_id        = aws_security_group.okf_wiki_vpc_endpoint[0].id
+  security_group_id        = aws_security_group.vpc_interface_endpoint[0].id
 }
 # Interface endpoints with private DNS capture the WHOLE VPC's traffic to the
 # covered AWS APIs (logs, ssm, sts, bedrock, ...): every workload in the VPC
 # resolves those hostnames to the endpoint's private IP, so per-source-SG
-# rules silently black-hole anything not enumerated — harness cycle-7's
-# Hindsight tasks died on "cannot find the CloudWatch log group ... connection
-# issue" because only the Lambda SG was admitted. Allow the VPC CIDR.
-resource "aws_security_group_rule" "okf_wiki_vpce_from_vpc" {
-  count = local.okf_wiki_private_endpoints_enabled ? 1 : 0
+# rules silently black-hole anything not enumerated — harness cycle-7's ECS
+# tasks died on "cannot find the CloudWatch log group ... connection issue"
+# because only the Lambda SG was admitted. Allow the VPC CIDR.
+resource "aws_security_group_rule" "vpc_interface_endpoint_from_vpc" {
+  count = local.vpc_interface_endpoints_enabled ? 1 : 0
 
   type              = "ingress"
   from_port         = 443
   to_port           = 443
   protocol          = "tcp"
   cidr_blocks       = [module.vpc.vpc_cidr_block]
-  security_group_id = aws_security_group.okf_wiki_vpc_endpoint[0].id
+  security_group_id = aws_security_group.vpc_interface_endpoint[0].id
   description       = "All VPC workloads (private-DNS endpoints capture the whole VPC)"
 }
 
-resource "aws_security_group_rule" "okf_wiki_vpce_from_twenty" {
-  count = local.okf_wiki_private_endpoints_enabled && local.twenty_provisioned ? 1 : 0
+resource "aws_security_group_rule" "vpc_interface_endpoint_from_twenty" {
+  count = local.vpc_interface_endpoints_enabled && local.twenty_provisioned ? 1 : 0
 
   type                     = "ingress"
   from_port                = 443
   to_port                  = 443
   protocol                 = "tcp"
   source_security_group_id = module.twenty[0].twenty_security_group_id
-  security_group_id        = aws_security_group.okf_wiki_vpc_endpoint[0].id
+  security_group_id        = aws_security_group.vpc_interface_endpoint[0].id
 }
 
-resource "aws_vpc_endpoint" "okf_wiki_interface" {
-  for_each = local.okf_wiki_private_endpoints_enabled ? local.okf_wiki_interface_endpoint_services : toset([])
+resource "aws_vpc_endpoint" "vpc_interface" {
+  for_each = local.vpc_interface_endpoints_enabled ? local.vpc_interface_endpoint_services : toset([])
 
   vpc_id              = module.vpc.vpc_id
   service_name        = "com.amazonaws.${var.region}.${each.key}"
   vpc_endpoint_type   = "Interface"
-  subnet_ids          = local.okf_wiki_subnet_ids
-  security_group_ids  = [aws_security_group.okf_wiki_vpc_endpoint[0].id]
+  subnet_ids          = local.vpc_interface_endpoint_subnet_ids
+  security_group_ids  = [aws_security_group.vpc_interface_endpoint[0].id]
   private_dns_enabled = true
 
   tags = {
-    Name    = "thinkwork-${var.stage}-okf-wiki-${each.key}-vpce"
-    Purpose = "okf-wiki-private-egress"
+    Name    = "thinkwork-${var.stage}-vpce-${each.key}"
+    Purpose = "vpc-private-egress"
   }
 }
 
-resource "aws_vpc_endpoint" "okf_wiki_s3" {
-  count = local.okf_wiki_private_endpoints_enabled && length(local.okf_wiki_route_table_ids) > 0 ? 1 : 0
+# Gateway endpoint: free, no ENIs — never part of the diet. The Brain stack
+# mirrors these tags on the shared mcpherson endpoint (its accounts tfvars);
+# change them in lockstep.
+resource "aws_vpc_endpoint" "vpc_s3" {
+  count = local.vpc_interface_endpoints_enabled && length(local.okf_wiki_route_table_ids) > 0 ? 1 : 0
 
   vpc_id            = module.vpc.vpc_id
   service_name      = "com.amazonaws.${var.region}.s3"
@@ -619,12 +634,37 @@ resource "aws_vpc_endpoint" "okf_wiki_s3" {
   route_table_ids   = local.okf_wiki_route_table_ids
 
   tags = {
-    Name    = "thinkwork-${var.stage}-okf-wiki-s3-vpce"
-    Purpose = "okf-wiki-private-egress"
+    Name    = "thinkwork-${var.stage}-vpce-s3"
+    Purpose = "vpc-private-egress"
   }
 }
+
+# 2026-08-28 re-home: the endpoint group was created by (and named after)
+# the dead OKF wiki lane. Same AWS resources, new addresses — a VPC endpoint
+# Terraform destroys and recreates is a live outage for everything routing
+# through it.
+moved {
+  from = aws_security_group.okf_wiki_vpc_endpoint
+  to   = aws_security_group.vpc_interface_endpoint
+}
+moved {
+  from = aws_security_group_rule.okf_wiki_vpce_from_vpc
+  to   = aws_security_group_rule.vpc_interface_endpoint_from_vpc
+}
+moved {
+  from = aws_security_group_rule.okf_wiki_vpce_from_twenty
+  to   = aws_security_group_rule.vpc_interface_endpoint_from_twenty
+}
+moved {
+  from = aws_vpc_endpoint.okf_wiki_interface
+  to   = aws_vpc_endpoint.vpc_interface
+}
+moved {
+  from = aws_vpc_endpoint.okf_wiki_s3
+  to   = aws_vpc_endpoint.vpc_s3
+}
 resource "aws_security_group_rule" "okf_wiki_efs_from_lambda" {
-  count = var.okf_wiki_efs_enabled ? 1 : 0
+  count = local.okf_wiki_efs_consumers_active ? 1 : 0 # THINK-589: always off
 
   type                     = "ingress"
   from_port                = 2049
@@ -634,6 +674,10 @@ resource "aws_security_group_rule" "okf_wiki_efs_from_lambda" {
   security_group_id        = aws_security_group.okf_wiki_efs[0].id
 }
 
+# THINK-589 PR 1: deliberately NOT conditioned off — flipping this count to 0
+# would DESTROY the filesystem (and its data) on the next apply. All consumers
+# (mount targets, access points, Lambda mounts, IAM) are detached below; the
+# filesystem delete happens in PR 2 behind the destructive-step gates.
 resource "aws_efs_file_system" "okf_wiki" {
   count = var.okf_wiki_efs_enabled ? 1 : 0
 
@@ -651,7 +695,7 @@ resource "aws_efs_file_system" "okf_wiki" {
 }
 
 resource "aws_efs_mount_target" "okf_wiki" {
-  count = var.okf_wiki_efs_enabled ? length(local.okf_wiki_subnet_ids) : 0
+  count = local.okf_wiki_efs_consumers_active ? length(local.okf_wiki_subnet_ids) : 0 # THINK-589: always off
 
   file_system_id  = aws_efs_file_system.okf_wiki[0].id
   subnet_id       = local.okf_wiki_subnet_ids[count.index]
@@ -659,7 +703,7 @@ resource "aws_efs_mount_target" "okf_wiki" {
 }
 
 resource "aws_efs_access_point" "okf_wiki_refresh" {
-  count = var.okf_wiki_efs_enabled ? 1 : 0
+  count = local.okf_wiki_efs_consumers_active ? 1 : 0 # THINK-589: always off
 
   file_system_id = aws_efs_file_system.okf_wiki[0].id
 
@@ -684,7 +728,7 @@ resource "aws_efs_access_point" "okf_wiki_refresh" {
 }
 
 resource "aws_efs_access_point" "okf_wiki_pi_read" {
-  count = var.okf_wiki_efs_enabled ? 1 : 0
+  count = local.okf_wiki_efs_consumers_active ? 1 : 0 # THINK-589: always off
 
   file_system_id = aws_efs_file_system.okf_wiki[0].id
 
@@ -722,7 +766,16 @@ module "vpc" {
   existing_private_subnet_ids      = var.existing_private_subnet_ids
   existing_public_route_table_ids  = var.existing_public_route_table_ids
   existing_private_route_table_ids = var.existing_private_route_table_ids
-  enable_nat_gateway               = var.okf_wiki_efs_enabled && var.okf_wiki_create_nat_gateway
+  # THINK-589 PR 1: NAT egress historically rode the OKF EFS flags but is
+  # shared VPC plumbing — Neptune twin Lambdas (and any other VPC-attached
+  # workload) depend on the NAT-routed private subnets. Left gated as before
+  # so PR 1 changes no networking; PR 2 re-homes this onto the surviving VPC
+  # consumers (the lambda_vpc_access precedent in lambda-api/main.tf).
+  # THINK-1082: a VPC-attached deployment runner has no public IP and needs
+  # NAT egress (GitHub release manifest, apt/pip, STS/S3/Secrets Manager).
+  # THINK-1082: VPC-attached api Lambdas / Pi have no public IP either (AWS
+  # APIs, Bedrock, Slack, GitHub, model providers).
+  enable_nat_gateway = (var.okf_wiki_efs_enabled && var.okf_wiki_create_nat_gateway) || var.deployment_runner_in_vpc || var.api_lambdas_in_vpc
 }
 
 module "kms" {
@@ -736,30 +789,35 @@ module "cognito" {
   stage  = var.stage
   region = var.region
 
-  create_cognito            = var.create_cognito
-  existing_user_pool_id     = var.existing_user_pool_id
-  existing_user_pool_arn    = var.existing_user_pool_arn
-  existing_admin_client_id  = var.existing_admin_client_id
-  existing_mobile_client_id = var.existing_mobile_client_id
-  existing_identity_pool_id = var.existing_identity_pool_id
-
-  google_oauth_client_id     = var.google_oauth_client_id
-  google_oauth_client_secret = var.google_oauth_client_secret
-  oidc_identity_providers    = var.oidc_identity_providers
-  saml_identity_providers    = var.saml_identity_providers
-  pre_signup_lambda_zip      = var.pre_signup_lambda_zip
-  custom_auth_lambda_zip     = var.cognito_custom_auth_lambda_zip
-  # Remote custom auth is part of the pinned enterprise release bundle. Keep
-  # the shared artifact bucket inert for direct module consumers that have not
-  # opted into required release artifacts; local zip configuration remains an
-  # independent explicit opt-in below.
-  custom_auth_lambda_s3_bucket = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
-  custom_auth_lambda_s3_key    = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-custom-auth.zip" : ""
-  api_auth_secret              = var.api_auth_secret
-  email_source_arn             = var.cognito_email_source_arn
-  from_email_address           = var.cognito_from_email_address
-  reply_to_email_address       = var.cognito_reply_to_email_address
-  invite_email_subject         = var.cognito_invite_email_subject
+  create_cognito              = var.create_cognito
+  existing_user_pool_id       = var.existing_user_pool_id
+  existing_user_pool_arn      = var.existing_user_pool_arn
+  existing_admin_client_id    = var.existing_admin_client_id
+  existing_mobile_client_id   = var.existing_mobile_client_id
+  existing_identity_pool_id   = var.existing_identity_pool_id
+  existing_auth_route_clients = var.existing_auth_route_clients
+
+  google_oauth_client_id                = var.google_oauth_client_id
+  google_oauth_client_secret            = var.google_oauth_client_secret
+  microsoft_oauth_client_id             = var.microsoft_oauth_client_id
+  microsoft_oauth_client_secret         = var.microsoft_oauth_client_secret
+  microsoft_oauth_tenant                = var.microsoft_oauth_tenant
+  tenant_entra_connections              = var.tenant_entra_connections
+  oidc_identity_providers               = var.oidc_identity_providers
+  saml_identity_providers               = var.saml_identity_providers
+  pre_signup_lambda_zip                 = var.pre_signup_lambda_zip
+  auth_retirement_phase                 = var.auth_retirement_phase
+  custom_auth_lambda_zip                = var.cognito_custom_auth_lambda_zip
+  custom_auth_lambda_s3_bucket          = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
+  custom_auth_lambda_s3_key             = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-custom-auth.zip" : ""
+  api_auth_secret                       = var.api_auth_secret
+  pre_token_generation_lambda_s3_bucket = var.require_lambda_artifacts ? var.lambda_artifact_bucket : ""
+  pre_token_generation_lambda_s3_key    = var.require_lambda_artifacts && var.lambda_artifact_bucket != "" ? "${trim(trimspace(var.lambda_artifact_prefix), "/")}/cognito-pre-token-client-deny.zip" : ""
+  denied_app_client_ids                 = var.cognito_denied_app_client_ids
+  email_source_arn                      = var.cognito_email_source_arn
+  from_email_address                    = var.cognito_from_email_address
+  reply_to_email_address                = var.cognito_reply_to_email_address
+  invite_email_subject                  = var.cognito_invite_email_subject
   invite_email_message = (
     var.cognito_invite_email_message != ""
     ? var.cognito_invite_email_message
@@ -782,16 +840,38 @@ module "cognito" {
   # entry — login works on both domains. Flipping
   # customer_domain_legacy_retired REMOVES the legacy (non-customer-domain)
   # app entries — the CloudFront default domain, the legacy app/computer
-  # domains — as a reviewable Terraform change. Explicit caller-supplied,
-  # localhost dev, and desktop entries are never retired here.
+  # domains — as a reviewable Terraform change. Explicit caller-supplied and
+  # localhost dev entries are never retired here.
   admin_callback_urls = distinct(concat(
     var.admin_callback_urls,
     local.customer_domain_legacy_retired ? [] : ["https://${module.computer_site.distribution_domain}", "https://${module.computer_site.distribution_domain}/auth/callback"],
     local.customer_domain_legacy_retired ? [] : (local.legacy_end_user_app_domain != "" ? ["https://${local.legacy_end_user_app_domain}", "https://${local.legacy_end_user_app_domain}/auth/callback"] : []),
     local.customer_domain_web_enabled ? ["https://${var.customer_domain}", "https://${var.customer_domain}/auth/callback"] : [],
     local.customer_domain_legacy_retired ? [] : (var.computer_domain != "" ? ["https://${var.computer_domain}", "https://${var.computer_domain}/auth/callback"] : []),
-    ["http://localhost:5180", "http://localhost:5180/auth/callback"],
-    var.desktop_callback_urls
+    [
+      "http://localhost:5180",
+      "http://localhost:5180/auth/callback",
+      "http://127.0.0.1:5180",
+      "http://127.0.0.1:5180/auth/callback",
+    ],
+    # Hosted Company Brain console origins (dev only): the console's CloudFront
+    # distribution and the future custom domain must be able to complete OAuth
+    # against the dev web-family clients. Dev-scoped so customer stacks don't
+    # carry dev console origins in their pools.
+    var.stage == "dev" ? [
+      "https://d3q9a98mhsakjf.cloudfront.net",
+      "https://d3q9a98mhsakjf.cloudfront.net/auth/callback",
+      "https://brain.thinkwork.ai",
+      "https://brain.thinkwork.ai/auth/callback",
+    ] : [],
+    # Operator-supplied web-family callback origins. Customer stacks host the
+    # Company Brain console in their OWN account (separate repo/CloudFront), so
+    # the product stack can't derive those URLs — they arrive here from the
+    # deployment runner (runner-secrets `adminCallbackUrls`). Empty by default;
+    # both bare and /auth/callback entries should be supplied by the caller.
+    # This is what keeps the console origins from being stripped on every
+    # controller apply (dev has the hardcoded block above; customers use this).
+    var.additional_admin_callback_urls,
   ))
   admin_logout_urls = distinct(concat(
     var.admin_logout_urls,
@@ -799,12 +879,28 @@ module "cognito" {
     local.customer_domain_legacy_retired ? [] : (local.legacy_end_user_app_domain != "" ? ["https://${local.legacy_end_user_app_domain}"] : []),
     local.customer_domain_web_enabled ? ["https://${var.customer_domain}"] : [],
     local.customer_domain_legacy_retired ? [] : (var.computer_domain != "" ? ["https://${var.computer_domain}"] : []),
-    ["http://localhost:5180"],
-    var.desktop_callback_urls
+    ["http://localhost:5180", "http://127.0.0.1:5180"],
+    # Hosted Company Brain console origins (dev only) — see admin_callback_urls.
+    var.stage == "dev" ? [
+      "https://d3q9a98mhsakjf.cloudfront.net",
+      "https://d3q9a98mhsakjf.cloudfront.net/auth/callback",
+      "https://brain.thinkwork.ai",
+      "https://brain.thinkwork.ai/auth/callback",
+    ] : [],
+    # Operator-supplied web-family logout origins — see admin_callback_urls.
+    var.additional_admin_logout_urls,
   ))
-  desktop_callback_urls = var.desktop_callback_urls
-  mobile_callback_urls  = var.mobile_callback_urls
-  mobile_logout_urls    = var.mobile_logout_urls
+  cli_callback_urls    = var.cli_callback_urls
+  cli_logout_urls      = var.cli_logout_urls
+  mobile_callback_urls = var.mobile_callback_urls
+  mobile_logout_urls   = var.mobile_logout_urls
+
+  # Company Brain console client (U13 — ship-inert, default off). The console's
+  # CloudFront URL must be in console_callback_urls BEFORE first login
+  # (redirect_mismatch otherwise).
+  console_client_enabled = var.console_client_enabled
+  console_callback_urls  = var.console_callback_urls
+  console_logout_urls    = var.console_logout_urls
 }
 
 module "dns" {
@@ -894,6 +990,12 @@ module "database" {
   subnet_ids  = module.vpc.public_subnet_ids
   db_password = var.db_password
 
+  # THINK-1082: network exposure. Defaults = today's public endpoint + world-
+  # open 5432. Closed per stage only after the Lambdas and the runner are in
+  # the VPC (api_lambdas_in_vpc / deployment_runner_in_vpc).
+  publicly_accessible  = var.db_publicly_accessible
+  public_ingress_cidrs = var.db_public_ingress_cidrs
+
   database_name   = var.database_name
   database_engine = var.database_engine
 
@@ -907,13 +1009,54 @@ module "database" {
   enable_aws_s3      = var.database_engine == "aurora-serverless"
 }
 
-module "bedrock_kb" {
-  source = "../data/bedrock-knowledge-base"
+################################################################################
+# API Lambdas inside the VPC (THINK-1082)
+#
+# Off by default (ship-inert). When on, every database-connected Lambda of the
+# agent (lambda-api handlers, agentcore-admin, agentcore-pi, the capability
+# broker) attaches to the private subnets with this security group, and the
+# database security group grants it tcp/5432 — the same standalone-rule
+# pattern the ECS modules and the deployment runner use, so the grant survives
+# the aurora-postgres module's `ignore_changes = [ingress]`. With this live the
+# world-open 0.0.0.0/0 -> 5432 rule can be revoked without taking the app down.
+################################################################################
 
-  stage       = var.stage
-  account_id  = var.account_id
-  region      = var.region
-  bucket_name = module.s3.bucket_name
+resource "aws_security_group" "api_lambda" {
+  count = var.api_lambdas_in_vpc ? 1 : 0
+
+  name        = "thinkwork-${var.stage}-api-lambda-sg"
+  description = "ThinkWork API Lambdas (VPC) for ${var.stage}."
+  vpc_id      = module.vpc.vpc_id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name    = "thinkwork-${var.stage}-api-lambda-sg"
+    Stage   = var.stage
+    Purpose = "api-lambda"
+  }
+}
+
+resource "aws_security_group_rule" "db_from_api_lambda" {
+  count = var.api_lambdas_in_vpc ? 1 : 0
+
+  type                     = "ingress"
+  description              = "ThinkWork API Lambdas (VPC)"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  security_group_id        = module.database.db_security_group_id
+  source_security_group_id = aws_security_group.api_lambda[0].id
+}
+
+locals {
+  api_lambda_vpc_subnet_ids         = var.api_lambdas_in_vpc ? module.vpc.private_subnet_ids : []
+  api_lambda_vpc_security_group_ids = var.api_lambdas_in_vpc ? [aws_security_group.api_lambda[0].id] : []
 }
 
 ################################################################################
@@ -930,6 +1073,7 @@ module "appsync" {
 
   stage               = var.stage
   region              = var.region
+  account_id          = var.account_id
   user_pool_id        = module.cognito.user_pool_id
   subscription_schema = local.subscription_schema
 }
@@ -964,6 +1108,13 @@ module "deployment_control_plane" {
 
   log_retention_days         = var.deployment_control_plane_log_retention_days
   create_secret_placeholders = var.deployment_control_plane_create_secret_placeholders
+
+  # THINK-1082: runner inside the VPC — DB access by security group, not a
+  # world-open port. The NAT this needs is switched on module.vpc above.
+  runner_in_vpc        = var.deployment_runner_in_vpc
+  vpc_id               = module.vpc.vpc_id
+  subnet_ids           = module.vpc.private_subnet_ids
+  db_security_group_id = module.database.db_security_group_id
 }
 
 # ── Capability signing keypair (THINK-173 KTD-3) ──────────────────────────
@@ -988,15 +1139,40 @@ resource "aws_secretsmanager_secret_version" "capability_signing_key" {
   secret_string = tls_private_key.capability_signing.private_key_pem
 }
 
+# AppSync subscription tickets use a separate key and domain from capability
+# envelopes. The authorizer receives only the public key; ticket issuance
+# resolves the private key by secret name at runtime.
+resource "tls_private_key" "subscription_ticket_signing" {
+  algorithm = "ED25519"
+}
+
+resource "aws_secretsmanager_secret" "subscription_ticket_signing_key" {
+  name        = "thinkwork/${var.stage}/subscription-ticket-signing-key"
+  description = "Ed25519 private key signing one-use AppSync subscription tickets."
+}
+
+resource "aws_secretsmanager_secret_version" "subscription_ticket_signing_key" {
+  secret_id     = aws_secretsmanager_secret.subscription_ticket_signing_key.id
+  secret_string = tls_private_key.subscription_ticket_signing.private_key_pem
+}
+
 module "api" {
   source = "../app/lambda-api"
 
   capability_signing_public_key         = tls_private_key.capability_signing.public_key_pem
   capability_signing_private_key_secret = aws_secretsmanager_secret.capability_signing_key.name
+  subscription_ticket_signing_key_id    = "${var.stage}-subscription-v1"
+  subscription_ticket_public_keys = jsonencode([{
+    keyId     = "${var.stage}-subscription-v1"
+    publicKey = tls_private_key.subscription_ticket_signing.public_key_pem
+  }])
+  subscription_ticket_private_key_secret = aws_secretsmanager_secret.subscription_ticket_signing_key.name
 
-  stage      = var.stage
-  account_id = var.account_id
-  region     = var.region
+  stage                            = var.stage
+  account_id                       = var.account_id
+  region                           = var.region
+  auth_retirement_phase            = var.auth_retirement_phase
+  auth_migration_recovery_deadline = var.auth_migration_recovery_deadline
 
   lambda_artifact_bucket   = var.lambda_artifact_bucket
   lambda_artifact_prefix   = var.lambda_artifact_prefix
@@ -1038,26 +1214,20 @@ module "api" {
   compliance_reader_secret_arn                 = module.database.compliance_reader_secret_arn
   compliance_anchor_object_lock_retention_days = var.compliance_anchor_retention_days
 
-  # THINK-228 — analyst query broker: hardened reader role credentials +
-  # the broker caller credential the seeded connector row references.
   # THINK-246 — artifact email delivery sender: customer stages send from
   # their own verified domain (noreply@<customer_domain>); dev keeps the
   # code fallback via the empty default.
   artifact_delivery_from_email = var.customer_domain != "" ? "noreply@${var.customer_domain}" : ""
 
-  analyst_reader_secret_arn = module.database.analyst_reader_secret_arn
-  analyst_broker_secret_arn = module.database.analyst_broker_secret_arn
-  # THINK-229 U1 — keys the broker's rds-db:connect grant and switches the
-  # reader connection to per-connect RDS IAM auth tokens.
-  analyst_db_cluster_resource_id = module.database.cluster_resource_id
-  analyst_policy_source          = var.analyst_policy_source
-
   # Governed autonomy — per-tenant self-extension opt-in allowlist (default off).
-  capability_self_extension_tenants = var.capability_self_extension_tenants
 
-  # THINK-311 U4 — keys the Harness invoker grants in the grouped ai policy
-  # (empty string when the harness module is disabled = grants omitted).
-  agentcore_harness_execution_role_arn = module.agentcore_harness.execution_role_arn
+  # THINK-316 U2 — request path receives only Harness invocation. Terraform
+  # owns provisioning/version/endpoint control, avoiding a module cycle and
+  # keeping PassRole/create/update/list out of chat Lambdas.
+  # THINK-324: the managed-harness/proof plane is retired; its handlers,
+  # KMS plane, and Gateway are gone. The proof flag survives only as a
+  # declared variable so existing -var passthroughs stay valid.
+  enable_agentcore_multiplayer_proof = false
 
   # Phase 3 U8b — KMS key + Object Lock mode forwarded as
   # COMPLIANCE_ANCHOR_KMS_KEY_ARN and COMPLIANCE_ANCHOR_OBJECT_LOCK_MODE
@@ -1079,19 +1249,23 @@ module "api" {
   bucket_arn  = module.s3.bucket_arn
 
   plugin_catalog_github_token_secret_arn = var.plugin_catalog_github_token_secret_arn
+  brain_m2m_platform_agent_secret_arn    = var.brain_m2m_platform_agent_secret_arn
+  brain_ops_api_url                      = var.brain_ops_api_url
+  brain_ops_m2m_secret_arn               = var.brain_ops_m2m_secret_arn
 
   brain_artifacts_kms_key_arn = module.kms.key_arn
 
-  user_pool_id        = module.cognito.user_pool_id
-  user_pool_arn       = module.cognito.user_pool_arn
-  admin_client_id     = module.cognito.admin_client_id
-  mobile_client_id    = module.cognito.mobile_client_id
+  user_pool_id     = module.cognito.user_pool_id
+  user_pool_arn    = module.cognito.user_pool_arn
+  admin_client_id  = module.cognito.admin_client_id
+  mobile_client_id = module.cognito.mobile_client_id
+  # R16: console client id joins the COGNITO_APP_CLIENT_IDS allowlist when
+  # enabled ("" otherwise — the lambda-api module compacts it away).
+  console_client_id   = var.console_client_enabled ? module.cognito.console_client_id : ""
   cognito_auth_domain = module.cognito.auth_domain
 
+  appsync_api_id  = module.appsync.graphql_api_id
   appsync_api_url = module.appsync.graphql_api_url
-  appsync_api_key = module.appsync.graphql_api_key
-
-  kb_service_role_arn = module.bedrock_kb.kb_service_role_arn
 
   lambda_zips_dir                       = var.lambda_zips_dir
   api_auth_secret                       = var.api_auth_secret
@@ -1100,33 +1274,51 @@ module "api" {
   agentcore_pi_function_name            = module.agentcore_pi.agentcore_pi_function_name
   agentcore_pi_function_arn             = module.agentcore_pi.agentcore_pi_function_arn
   enable_agentcore_pi_invoke_policy     = true
-  hindsight_endpoint                    = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : ""
-  hindsight_database_name               = var.hindsight_database_name
   agentcore_memory_id                   = module.agentcore_memory.memory_id
-  memory_engine                         = local.resolved_memory_engine
-  okf_efs_subnet_ids                    = var.okf_wiki_efs_enabled ? local.okf_wiki_subnet_ids : []
-  okf_efs_security_group_ids            = var.okf_wiki_efs_enabled ? [aws_security_group.okf_wiki_lambda[0].id] : []
-  analyst_egress_subnet_ids             = var.analyst_lambda_vpc_egress ? module.vpc.private_subnet_ids : []
-  analyst_egress_security_group_ids     = var.analyst_lambda_vpc_egress ? [aws_security_group.analyst_egress_lambda[0].id] : []
-  okf_efs_mount_target_ids              = var.okf_wiki_efs_enabled ? aws_efs_mount_target.okf_wiki[*].id : []
-  okf_efs_file_system_arn               = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].arn : ""
-  okf_efs_refresh_access_point_arn      = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_refresh[0].arn : ""
-  twenty_provisioned                    = local.twenty_provisioned
-  twenty_runtime_enabled                = local.twenty_runtime_enabled
-  twenty_url                            = local.twenty_provisioned ? module.twenty[0].twenty_url : ""
-  twenty_alb_arn                        = local.twenty_provisioned ? module.twenty[0].twenty_alb_arn : ""
-  twenty_target_group_arn               = local.twenty_provisioned ? module.twenty[0].twenty_target_group_arn : ""
-  twenty_cluster_arn                    = local.twenty_provisioned ? module.twenty[0].twenty_cluster_arn : ""
-  twenty_server_service_name            = local.twenty_provisioned ? module.twenty[0].twenty_server_service_name : ""
-  twenty_worker_service_name            = local.twenty_provisioned ? module.twenty[0].twenty_worker_service_name : ""
-  twenty_server_log_group_name          = local.twenty_provisioned ? module.twenty[0].twenty_server_log_group_name : ""
-  twenty_worker_log_group_name          = local.twenty_provisioned ? module.twenty[0].twenty_worker_log_group_name : ""
-  admin_url                             = local.end_user_app_url
-  docs_url                              = "https://${module.docs_site.distribution_domain}"
-  www_url                               = var.www_domain != "" ? "https://${var.www_domain}" : "https://${module.www_site.distribution_domain}"
-  stripe_price_ids_json                 = var.stripe_price_ids_json
-  appsync_realtime_url                  = module.appsync.graphql_realtime_url
-  ecr_repository_url                    = module.agentcore_platform.ecr_repository_url
+  # THINK-589: OKF EFS inputs are deprecated no-ops — always pass empty.
+  okf_efs_subnet_ids         = []
+  okf_efs_security_group_ids = []
+  # Company Brain U5: projector VPC attach only when the neptune-client SG
+  # is configured (the twin's Neptune cluster lives in this same VPC). The
+  # client SG only opens 8182→Neptune, so twin Lambdas ALSO attach the
+  # egress SG below — without it a VPC-attached Lambda cannot reach
+  # Aurora/Secrets/S3 and every DB connection times out (seen live on the
+  # first dev rebuild invoke).
+  lambda_max_memory_mb        = var.lambda_max_memory_mb
+  neptune_endpoint            = var.neptune_endpoint
+  brain_mcp_url               = var.brain_mcp_url
+  neptune_cluster_resource_id = var.neptune_cluster_resource_id
+  neptune_subnet_ids          = var.neptune_client_security_group_id != "" ? module.vpc.private_subnet_ids : []
+  neptune_security_group_ids  = var.neptune_client_security_group_id != "" ? [var.neptune_client_security_group_id, aws_security_group.twin_lambda_egress[0].id] : []
+  # THINK-1082: every handler inside the VPC behind the api-lambda SG (merged
+  # with the Neptune SGs on the projector). NAT is switched on module.vpc.
+  lambdas_in_vpc         = var.api_lambdas_in_vpc
+  vpc_subnet_ids         = local.api_lambda_vpc_subnet_ids
+  vpc_security_group_ids = local.api_lambda_vpc_security_group_ids
+  # Bulk-rebuild lane (THINK-331): loader staging bucket + cluster loader
+  # role, both default-empty (ship inert, KTD-9).
+  neptune_load_bucket     = var.neptune_load_bucket
+  neptune_loader_role_arn = var.neptune_loader_role_arn
+  # Company Brain U7: twin tool seam flag (KTD-5 rollout posture).
+  # THINK-589: OKF EFS inputs are deprecated no-ops — always pass empty.
+  okf_efs_mount_target_ids         = []
+  okf_efs_file_system_arn          = ""
+  okf_efs_refresh_access_point_arn = ""
+  twenty_provisioned               = local.twenty_provisioned
+  twenty_runtime_enabled           = local.twenty_runtime_enabled
+  twenty_url                       = local.twenty_provisioned ? module.twenty[0].twenty_url : ""
+  twenty_alb_arn                   = local.twenty_provisioned ? module.twenty[0].twenty_alb_arn : ""
+  twenty_target_group_arn          = local.twenty_provisioned ? module.twenty[0].twenty_target_group_arn : ""
+  twenty_cluster_arn               = local.twenty_provisioned ? module.twenty[0].twenty_cluster_arn : ""
+  twenty_server_service_name       = local.twenty_provisioned ? module.twenty[0].twenty_server_service_name : ""
+  twenty_worker_service_name       = local.twenty_provisioned ? module.twenty[0].twenty_worker_service_name : ""
+  twenty_server_log_group_name     = local.twenty_provisioned ? module.twenty[0].twenty_server_log_group_name : ""
+  twenty_worker_log_group_name     = local.twenty_provisioned ? module.twenty[0].twenty_worker_log_group_name : ""
+  admin_url                        = local.end_user_app_url
+  www_url                          = var.www_domain != "" ? "https://${var.www_domain}" : "https://${module.www_site.distribution_domain}"
+  stripe_price_ids_json            = var.stripe_price_ids_json
+  appsync_realtime_url             = module.appsync.graphql_realtime_url
+  ecr_repository_url               = module.agentcore_platform.ecr_repository_url
   # Static truth for count gating: agentcore_platform's ECR repo is
   # unconditional, but its URL attribute is unknown until apply. The runner
   # additionally needs its image tag seeded (CI does this for repo-managed
@@ -1146,22 +1338,19 @@ module "api" {
   enable_slack_workspace_app                    = var.enable_slack_workspace_app
   enable_msteams_app                            = var.enable_msteams_app
   agentcore_code_interpreter_id                 = var.agentcore_code_interpreter_id
-  wiki_compile_model_id                         = var.wiki_compile_model_id
   brain_source_agent_model_id                   = var.brain_source_agent_model_id
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
-  knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
+  identity_drift_match_enabled                  = var.identity_drift_match_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
-  google_places_api_key                         = var.google_places_api_key
   enable_workspace_orchestration                = var.enable_workspace_orchestration
+  agentcore_session_scope                       = var.agentcore_session_scope
   requester_idle_memory_learning_enabled        = var.requester_idle_memory_learning_enabled
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
   requester_memory_dreaming_model_id            = var.requester_memory_dreaming_model_id
   brain_dream_state_enabled                     = var.brain_dream_state_enabled
   brain_dream_state_schedule_expression         = var.brain_dream_state_schedule_expression
-  retry_dispatcher_enabled                      = var.retry_dispatcher_enabled
-  stall_threshold_minutes                       = var.stall_threshold_minutes
   # Per-user OAuth client credentials — fed to Secrets Manager in
   # app/lambda-api/oauth-secrets.tf. Reuses the same google_oauth_client_*
   # tfvars that already flow to the Cognito federated-signin module.
@@ -1170,6 +1359,19 @@ module "api" {
   redirect_success_url       = var.redirect_success_url
   platform_operator_emails   = var.platform_operator_emails
 
+  # THINK-583 U3 — warm chat path (KTD5: these two handlers only).
+  chat_agent_invoke_provisioned_concurrency  = var.chat_agent_invoke_provisioned_concurrency
+  workspace_renderer_provisioned_concurrency = var.workspace_renderer_provisioned_concurrency
+  agentcore_runtime_dispatch_enabled         = var.agentcore_runtime_dispatch_enabled
+
+  # THINK-915 — chat turn-latency observability.
+  enable_chat_turn_latency_observability  = var.enable_chat_turn_latency_observability
+  enable_chat_turn_latency_metric_filters = var.enable_chat_turn_latency_metric_filters
+  chat_turn_latency_metric_namespace      = var.chat_turn_latency_metric_namespace
+  chat_turn_runtime_log_group_name        = var.chat_turn_runtime_log_group_name
+  chat_turn_p95_alarm_threshold_ms        = var.chat_turn_p95_alarm_threshold_ms
+  chat_turn_latency_alarm_actions         = var.chat_turn_latency_alarm_actions
+
   mcp_custom_domain       = var.mcp_custom_domain
   mcp_custom_domain_ready = var.mcp_custom_domain_ready
 
@@ -1184,6 +1386,8 @@ module "api" {
   capability_broker_audience          = module.capability_broker.broker_audience
   capability_broker_api_id            = module.capability_broker.private_api_id
   capability_broker_vpce_dns          = module.capability_broker.execute_api_vpce_dns_name
+  # THINK-643 — "postgres" (default) leaves the auth-state table unprovisioned.
+  auth_state_store = var.auth_state_store
 
   depends_on = [module.cognito]
 }
@@ -1207,7 +1411,8 @@ module "agentcore_memory" {
 module "agentcore_platform" {
   source = "../app/agentcore-platform"
 
-  stage = var.stage
+  stage                         = var.stage
+  release_mirror_principal_arns = var.release_image_mirror_principal_arns
 }
 
 ################################################################################
@@ -1229,10 +1434,7 @@ module "agentcore_pi" {
   source_image_uri   = var.agentcore_pi_source_image_uri
   async_dlq_arn      = module.agentcore_platform.agentcore_async_dlq_arn
 
-  hindsight_endpoint                     = local.hindsight_enabled ? module.hindsight[0].hindsight_endpoint : ""
-  hindsight_database_name                = var.hindsight_database_name
   agentcore_memory_id                    = module.agentcore_memory.memory_id
-  memory_engine                          = local.resolved_memory_engine
   requester_idle_memory_learning_enabled = var.requester_idle_memory_learning_enabled
 
   api_endpoint    = module.api.api_endpoint
@@ -1244,32 +1446,60 @@ module "agentcore_pi" {
   db_cluster_arn = module.database.db_cluster_arn
   db_secret_arn  = module.database.graphql_db_secret_arn
 
-  okf_efs_enabled               = var.okf_wiki_efs_enabled
-  okf_efs_subnet_ids            = var.okf_wiki_efs_enabled ? local.okf_wiki_subnet_ids : []
-  okf_efs_security_group_ids    = var.okf_wiki_efs_enabled ? [aws_security_group.okf_wiki_lambda[0].id] : []
-  okf_efs_file_system_arn       = var.okf_wiki_efs_enabled ? aws_efs_file_system.okf_wiki[0].arn : ""
-  okf_efs_read_access_point_arn = var.okf_wiki_efs_enabled ? aws_efs_access_point.okf_wiki_pi_read[0].arn : ""
-}
-
-# AgentCore Harness trial (THINK-311 U4) — ship-inert, pure IAM. Provisions
-# the Harness microVM execution role; the api Lambda's Harness invoker grants
-# ride the grouped ai policy in lambda-api (keyed off this module's role-ARN
-# output). No handler creates or invokes a Harness until U5.
-module "agentcore_harness" {
-  source = "../app/agentcore-harness"
-
-  enabled     = var.enable_agentcore_harness
-  stage       = var.stage
-  region      = var.region
-  account_id  = var.account_id
-  bucket_name = module.s3.bucket_name
+  # THINK-589: OKF EFS inputs are deprecated no-ops — always pass disabled.
+  okf_efs_enabled               = false
+  okf_efs_subnet_ids            = []
+  okf_efs_security_group_ids    = []
+  okf_efs_file_system_arn       = ""
+  okf_efs_read_access_point_arn = ""
+
+  # THINK-1082: network-only VPC attachment alongside the api handlers.
+  in_vpc                 = var.api_lambdas_in_vpc
+  vpc_subnet_ids         = local.api_lambda_vpc_subnet_ids
+  vpc_security_group_ids = local.api_lambda_vpc_security_group_ids
+}
+
+# THINK-316 U1 proof-only Identity and Gateway plane. These resources use the
+# regional execute-api URL because the dev account rejects public Lambda
+# Function URLs and a custom domain may be unavailable in a fresh stage.
+module "agentcore_proof_identity" {
+  source = "../app/agentcore-identity"
+
+  # THINK-324: the proof plane is retired — permanently off. The module's
+  # proof half (workload-identity lifecycle + proof credential provider) no
+  # longer reconciles; delete_identity.sh retains the shared workload
+  # identity for the Twenty half below.
+  enabled = false
+  # THINK-324 — the Twenty user-federation identity (shared workload
+  # identity + twenty-crm credential provider + DCR client secret) survives
+  # the proof plane's retirement: it stays enabled wherever a Twenty
+  # instance is provisioned, and — while the proof flag is still on — on
+  # proof stages too, so flipping the proof flag off later destroys only
+  # proof resources. After the harness retirement removes the proof flag,
+  # this reduces to twenty_provisioned alone.
+  twenty_enabled      = local.twenty_provisioned || var.enable_agentcore_multiplayer_proof
+  stage               = var.stage
+  region              = var.region
+  account_id          = var.account_id
+  oauth_issuer        = ""
+  oauth_client_id     = "thinkwork-${var.stage}-agentcore-proof"
+  oauth_client_secret = ""
+  user_federation_return_urls = [
+    "${module.api.api_endpoint}/api/skills/mcp-oauth/agentcore/complete",
+  ]
+  # The identity module's issuer/resource defaults are dev's CRM domain;
+  # every stage must point at its own Twenty instance or the credential
+  # provider is reconciled with a foreign issuer (observed live on tei-e2e:
+  # Connect-AgentCore 404'd against crm.thinkwork.ai).
+  twenty_oauth_issuer   = local.twenty_public_url != "" ? trimsuffix(local.twenty_public_url, "/") : "https://crm.thinkwork.ai"
+  twenty_oauth_resource = local.twenty_public_url != "" ? "${trimsuffix(local.twenty_public_url, "/")}/mcp" : "https://crm.thinkwork.ai/mcp"
 }
 
 # Capability Broker (THINK-280 U3) — ship-inert, gated by
 # var.enable_capability_broker (default false). When off, this module creates
 # nothing; the broker Lambda code also fails closed. Owns a DEDICATED
 # execute-api VPCE with private DNS disabled — never folded into
-# okf_wiki_interface_endpoint_services (THINK-144).
+# vpc_interface_endpoint_services (THINK-144).
 module "capability_broker" {
   source = "../app/capability-broker"
 
@@ -1288,6 +1518,10 @@ module "capability_broker" {
   db_password         = var.db_password
   database_name       = var.database_name
 
+  # THINK-1082: the broker is already VPC-attached; give it the api-lambda SG
+  # so it keeps its DB path once the public 5432 rule closes.
+  additional_security_group_ids = local.api_lambda_vpc_security_group_ids
+
   lambda_zips_dir        = var.lambda_zips_dir
   lambda_artifact_bucket = var.lambda_artifact_bucket
   lambda_artifact_prefix = var.lambda_artifact_prefix
@@ -1334,6 +1568,11 @@ module "agentcore_admin" {
 
   capability_private_subnet_ids         = module.agentcore_code_interpreter.capability_private_subnet_ids
   capability_private_security_group_ids = module.agentcore_code_interpreter.capability_private_security_group_ids
+
+  # THINK-1082: the admin handler opens DATABASE_URL — same VPC lane.
+  in_vpc                 = var.api_lambdas_in_vpc
+  vpc_subnet_ids         = local.api_lambda_vpc_subnet_ids
+  vpc_security_group_ids = local.api_lambda_vpc_security_group_ids
 }
 
 # Runtime identity rename: the former dedicated Flue module is now the Pi
@@ -1459,25 +1698,9 @@ module "workflow_interpreter_stepfunctions" {
   execution_callback_lambda_arn = module.api.workflow_execution_callback_fn_arn
 }
 
-module "hindsight" {
-  count  = local.hindsight_enabled ? 1 : 0
-  source = "../app/hindsight-memory"
-
-  stage                = var.stage
-  vpc_id               = module.vpc.vpc_id
-  subnet_ids           = module.vpc.public_subnet_ids
-  db_security_group_id = module.database.db_security_group_id
-  database_url         = module.database.database_url
-  database_name        = var.hindsight_database_name
-  image_tag            = var.hindsight_image_tag
-
-  enable_auto_consolidation     = var.hindsight_enable_auto_consolidation
-  consolidation_dedup_threshold = var.hindsight_consolidation_dedup_threshold
-  observations_mission          = var.hindsight_observations_mission
-}
 module "twenty" {
   count  = local.twenty_provisioned ? 1 : 0
-  source = "../../../plugins/twenty/terraform/twenty"
+  source = "../app/twenty"
 
   stage                = var.stage
   vpc_id               = module.vpc.vpc_id
@@ -1515,7 +1738,7 @@ module "twenty" {
 
 module "n8n" {
   count  = local.n8n_provisioned ? 1 : 0
-  source = "../../../plugins/n8n/terraform/n8n"
+  source = "../app/n8n"
 
   stage                = var.stage
   vpc_id               = module.vpc.vpc_id
@@ -1595,14 +1818,38 @@ locals {
   # Host CSP for the Computer SPA (plan-012 U10 / contract v1 §CSP profile).
   # Generated apps always execute in the sandbox iframe shell, so the parent
   # origin never needs blob: script/worker execution for transformed modules.
-  computer_host_script_src = "'self'"
-  computer_host_worker_src = "'self'"
-  computer_host_frame_src  = local.computer_sandbox_enabled ? "https://${var.computer_sandbox_domain}" : "'none'"
+  #
+  # 'wasm-unsafe-eval' permits WebAssembly compilation only (not JS eval) —
+  # the in-app knowledge document viewer (Zrimo) renders Office files with
+  # client-side WASM.
+  computer_host_script_src = "'self' 'wasm-unsafe-eval'"
+  # blob: workers are how Zrimo (knowledge document viewer) spawns its
+  # render workers. With script-src carrying no blob:/eval, only
+  # first-party page code can mint a blob worker, and blob workers
+  # inherit this document's CSP — the U10 blob-execution escape hatch
+  # (generated-app script on the host origin) stays closed.
+  computer_host_worker_src = "'self' blob:"
+  # frame-src carries the sandbox shell plus the cited-knowledge-document
+  # frames: browser-native formats (pdf/txt/md) render in an iframe on the
+  # signed /kb/doc link — a *.thinkwork.ai brain host that 302s to the
+  # customer's evidence bucket presign, and CSP re-checks every redirect
+  # hop, so both origins must be allowed (mirroring what connect-src
+  # already trusts for the Zrimo fetch path).
+  computer_host_frame_src = join(" ", compact([
+    local.computer_sandbox_enabled ? "https://${var.computer_sandbox_domain}" : "",
+    "https://*.thinkwork.ai",
+    "https://*.s3.${var.region}.amazonaws.com",
+    "https://s3.${var.region}.amazonaws.com",
+  ]))
   computer_host_frame_ancestors = join(" ", compact([
     "'self'",
   ]))
 
-  computer_host_csp = "default-src 'self'; script-src ${local.computer_host_script_src}; style-src 'self' 'unsafe-inline'; worker-src ${local.computer_host_worker_src}; frame-src ${local.computer_host_frame_src}; connect-src 'self' https://*.execute-api.${var.region}.amazonaws.com https://*.appsync-api.${var.region}.amazonaws.com wss://*.appsync-realtime-api.${var.region}.amazonaws.com https://cognito-idp.${var.region}.amazonaws.com https://*.auth.${var.region}.amazoncognito.com https://*.s3.${var.region}.amazonaws.com https://s3.${var.region}.amazonaws.com; img-src 'self' data: blob: ${local.computer_sandbox_map_img_src}; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors ${local.computer_host_frame_ancestors};"
+  # connect-src includes https://*.thinkwork.ai for the knowledge document
+  # viewer: signed /kb/doc citation links live on brain MCP hosts
+  # (mcp.brain.<customer>.thinkwork.ai), and a tenant may register another
+  # stage's brain, so the host cannot be pinned per-stage.
+  computer_host_csp = "default-src 'self'; script-src ${local.computer_host_script_src}; style-src 'self' 'unsafe-inline'; worker-src ${local.computer_host_worker_src}; frame-src ${local.computer_host_frame_src}; connect-src 'self' https://*.thinkwork.ai https://*.execute-api.${var.region}.amazonaws.com https://*.appsync-api.${var.region}.amazonaws.com wss://*.appsync-realtime-api.${var.region}.amazonaws.com https://cognito-idp.${var.region}.amazonaws.com https://*.auth.${var.region}.amazoncognito.com https://*.s3.${var.region}.amazonaws.com https://s3.${var.region}.amazonaws.com; img-src 'self' data: blob: ${local.computer_sandbox_map_img_src}; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors ${local.computer_host_frame_ancestors};"
 }
 
 module "computer_site" {
@@ -1704,7 +1951,7 @@ module "customer_domain" {
 #     https://*.tile.openstreetmap.org https://api.mapbox.com;
 #   font-src 'self' data:; connect-src 'none';
 #   frame-src https://www.openstreetmap.org; object-src 'none';
-#   base-uri 'self'; frame-ancestors <web parents + desktop custom protocols>;
+#   base-uri 'self'; frame-ancestors <web parents>;
 #
 # Provisioning is gated on var.computer_sandbox_domain — leave empty in
 # stages that haven't allocated the subdomain yet.
@@ -1713,18 +1960,10 @@ module "customer_domain" {
 locals {
   computer_sandbox_enabled = var.computer_sandbox_domain != ""
 
-  computer_sandbox_desktop_parent_origins = [
-    "thinkwork://app",
-    "thinkwork-dev://app",
-    "thinkwork-canary://app",
-  ]
-  computer_sandbox_allowed_parent_origin_list = distinct(concat(
-    [
-      for origin in split(",", replace(var.computer_sandbox_allowed_parent_origins, " ", "")) :
-      origin if origin != ""
-    ],
-    local.computer_sandbox_desktop_parent_origins
-  ))
+  computer_sandbox_allowed_parent_origin_list = distinct([
+    for origin in split(",", replace(var.computer_sandbox_allowed_parent_origins, " ", "")) :
+    origin if origin != ""
+  ])
   computer_sandbox_allowed_parent_origins_effective = join(",", local.computer_sandbox_allowed_parent_origin_list)
   computer_sandbox_frame_ancestors                  = local.computer_sandbox_enabled && length(local.computer_sandbox_allowed_parent_origin_list) > 0 ? join(" ", local.computer_sandbox_allowed_parent_origin_list) : "'none'"
 
@@ -1776,20 +2015,6 @@ module "computer_sandbox_site" {
   }
 }
 
-################################################################################
-# Docs Static Site
-################################################################################
-
-module "docs_site" {
-  source = "../app/static-site"
-
-  stage           = var.stage
-  site_name       = "docs"
-  bucket_name     = "thinkwork-${var.stage}-${var.account_id}-docs"
-  custom_domain   = var.docs_domain
-  certificate_arn = var.docs_certificate_arn
-}
-
 ################################################################################
 # Public Website (www)
 ################################################################################