thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/thinkwork/variables.tf

@@ -51,22 +51,38 @@ variable "google_oauth_client_secret" {
 }
 
 variable "microsoft_oauth_client_id" {
-  description = "Microsoft OAuth client ID reserved for future Cognito/OAuth wiring. Accepted here so deployment-control-plane generated wrappers stay forward-compatible."
+  description = "Microsoft Entra application client ID for the deployment's default tenant-specific Cognito OIDC route."
   type        = string
   default     = ""
 }
 
 variable "microsoft_oauth_client_secret" {
-  description = "Microsoft OAuth client secret reserved for future Cognito/OAuth wiring."
+  description = "Microsoft Entra application client secret for the deployment's default tenant-specific Cognito OIDC route."
   type        = string
   sensitive   = true
   default     = ""
 }
 
 variable "microsoft_oauth_tenant" {
-  description = "Microsoft OAuth tenant reserved for future Cognito/OAuth wiring."
+  description = "Microsoft Entra tenant for the deployment's default Microsoft login route: a directory GUID or one of the Cognito-supported multi-tenant aliases (common, organizations, consumers)."
   type        = string
-  default     = "organizations"
+  default     = ""
+
+  validation {
+    condition     = var.microsoft_oauth_tenant == "" || contains(["common", "organizations", "consumers"], var.microsoft_oauth_tenant) || can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", var.microsoft_oauth_tenant))
+    error_message = "microsoft_oauth_tenant must be an Entra directory GUID or one of the Cognito-supported aliases: common, organizations, consumers."
+  }
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe tenant-specific Entra provider metadata. Secrets are reconciled outside Terraform and are never accepted here."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
 }
 
 variable "oidc_identity_providers" {
@@ -117,26 +133,51 @@ variable "platform_operator_emails" {
   default     = ""
 }
 
-variable "analyst_lambda_vpc_egress" {
-  description = "VPC-attach the analyst data-path Lambdas (graphql-http, analyst-query-broker, analyst-connection-reconciler) to the stack's private subnets so their egress rides the NAT gateway's stable EIP. Enables external analyst data sources that sit behind an IP allowlist: the DBA admits the one NAT IP (see the analyst_egress_ip output) instead of opening the database to the world. Requires private (NAT-routed) subnets."
-  type        = bool
-  default     = false
+# THINK-583 U3 — provisioned concurrency for the two chat-critical zip
+# Lambdas ONLY (KTD5: never the Pi Lambda). Safe default 0 = disabled;
+# the `live` alias is still created so alias-qualified invokers work on
+# every stage and customer stages opt in on their own release cadence.
+# Dev enables 1/1 via scripts/deploy/terraform-vars.sh (deploy.yml is
+# dev-only — same pattern as enable_capability_broker).
+
+variable "chat_agent_invoke_provisioned_concurrency" {
+  description = "Provisioned concurrency on chat-agent-invoke's `live` alias. 0 = disabled (alias still exists)."
+  type        = number
+  default     = 0
+}
+
+variable "workspace_renderer_provisioned_concurrency" {
+  description = "Provisioned concurrency on workspace-renderer's `live` alias. 0 = disabled (alias still exists)."
+  type        = number
+  default     = 0
 }
 
 variable "okf_wiki_efs_enabled" {
-  description = "Provision the OKF Wiki Navigator EFS current-view substrate and mount it into the okf-efs-refresh Lambda plus Pi."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature is dead — no mount, access point, mount target, or client security group is created regardless of this value. It currently only retains the already-provisioned EFS filesystem (PR 2 deletes it behind the destructive-step gates) and, with okf_wiki_create_nat_gateway, the shared NAT egress that non-OKF VPC workloads still ride. Declaration retained so customer-stage passthroughs and tfvars keep working."
   type        = bool
   default     = true
 }
 
 variable "okf_wiki_create_vpc_endpoints" {
-  description = "Create private AWS service VPC endpoints required by VPC-attached OKF hydrator and Pi Lambdas. Disable only when equivalent NAT or endpoints already exist."
+  description = "DEPRECATED (THINK-589): no-op for OKF, removal pending. The OKF hydrator and Pi are no longer VPC-attached. The private VPC endpoints this gates are retained unchanged in PR 1 because their private DNS serves the whole VPC (Neptune twin Lambdas, Twenty); PR 2 re-homes or deletes them."
   type        = bool
   default     = true
 }
 
+variable "vpc_interface_endpoint_services" {
+  description = "AWS services that get a private interface endpoint in the VPC (service suffixes: secretsmanager, rds-data, bedrock-runtime, logs, ...). null = the legacy full set the stage was built with; [] = none. The private subnets are NAT-routed and the Lambda SGs allow 443 out, so an endpoint only keeps a call on AWS's network — it is a posture choice billed at ~$7.30/mo per ENI, not a reachability requirement. Cost review 2026-08-28."
+  type        = list(string)
+  default     = null
+}
+
+variable "vpc_interface_endpoint_single_az" {
+  description = "Place each interface endpoint in one private subnet instead of every one. Halves the hourly bill; the other AZ's callers cross AZs at $0.01/GB. Cost review 2026-08-28."
+  type        = bool
+  default     = false
+}
+
 variable "okf_wiki_create_nat_gateway" {
-  description = "Create NAT egress for private subnets when OKF EFS attaches Pi to the VPC. Disable only when equivalent public egress already exists."
+  description = "DEPRECATED (THINK-589): removal pending. Pi no longer attaches to the VPC for OKF EFS. NAT egress is retained unchanged in PR 1 because Neptune twin Lambdas and other VPC-attached workloads route through it; PR 2 re-homes the gate onto the surviving VPC consumers."
   type        = bool
   default     = true
 }
@@ -147,6 +188,30 @@ variable "enable_deployment_control_plane" {
   default     = true
 }
 
+variable "deployment_runner_in_vpc" {
+  description = "Run the deployment runner CodeBuild inside this VPC (private subnets, dedicated runner security group) and grant that group tcp/5432 on the database security group. Rationale (THINK-1082): the runner's psql schema step otherwise reaches Aurora over its public endpoint and depends on the world-open 0.0.0.0/0 -> 5432 rule the aurora-postgres module seeds; a customer that revokes that rule (deliberate lockdown) breaks every deploy at the psql step. Turning this on also turns on the VPC NAT gateway, which a VPC-attached CodeBuild needs to reach GitHub, apt/pip, STS, S3, and Secrets Manager. Ship-inert: default false leaves networking untouched. Applies to the control plane this module embeds (enable_deployment_control_plane); an externally bootstrapped control plane (thinkwork enterprise bootstrap) takes the same inputs through its own root."
+  type        = bool
+  default     = false
+}
+
+variable "api_lambdas_in_vpc" {
+  description = "Attach every database-connected Lambda of the agent (all lambda-api handlers incl. compliance-anchor / compliance-export-runner, the agentcore-admin Lambda, the agentcore-pi runtime, and the already-VPC-attached capability broker) to this VPC's private subnets behind a dedicated api-lambda security group, and grant that group tcp/5432 on the database security group. Rationale (THINK-1082): those functions carry a database connection and, with no vpc_config, reach Aurora only over its public endpoint through the world-open 0.0.0.0/0 -> 5432 rule the aurora-postgres module seeds. When a human revoked that rule on a live customer stage the whole app was down for two hours (auth-me -> DB timeout -> 401 'No tenant assigned'). With this on, the Lambdas reach the database privately and the public rule can be closed (db_public_ingress_cidrs / db_publicly_accessible). Turns on the VPC NAT gateway — VPC-attached Lambdas have no public IP and still need AWS APIs, Bedrock, Slack, GitHub, model providers; NAT data-processing charges apply to that egress. Ship-inert: default false leaves every function byte-identical."
+  type        = bool
+  default     = false
+}
+
+variable "db_publicly_accessible" {
+  description = "aurora-postgres publicly_accessible passthrough (THINK-1082). Default true = today's public endpoint. Set false only after api_lambdas_in_vpc and deployment_runner_in_vpc are live and verified."
+  type        = bool
+  default     = true
+}
+
+variable "db_public_ingress_cidrs" {
+  description = "aurora-postgres public_ingress_cidrs passthrough (THINK-1082): CIDRs seeded as tcp/5432 ingress on a NEW database security group. Default [\"0.0.0.0/0\"] = today's world-open rule; [] = none. The group ignores ingress drift, so shrinking this does not revoke a live rule — the operator revokes it by hand once the clients are in the VPC (see modules/app/deployment-control-plane/README.md, 'Closing the database port')."
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
 variable "deployment_state_machine_arn" {
   description = "Existing deployment orchestration Step Functions ARN for environments whose controller is bootstrapped outside this app stack."
   type        = string
@@ -321,6 +386,21 @@ variable "existing_identity_pool_id" {
   default = null
 }
 
+variable "existing_auth_route_clients" {
+  description = "Safe route-client manifest for BYO Cognito pools."
+  type = map(object({
+    client_id           = string
+    route_key           = string
+    client_family       = string
+    provider_names      = list(string)
+    explicit_auth_flows = list(string)
+    callback_urls       = list(string)
+    logout_urls         = list(string)
+    lifecycle_state     = string
+  }))
+  default = {}
+}
+
 variable "create_database" {
   description = "Create a new Aurora cluster (false = BYO)"
   type        = bool
@@ -353,10 +433,16 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
+variable "external_kb_source_arns" {
+  description = "DEPRECATED (THINK-402): Knowledge Bases were removed from the product; this input is inert and ignored. Declaration retained so existing customer-stage -var passthroughs keep working."
+  type        = list(string)
+  default     = []
+}
+
 variable "enable_hindsight" {
-  description = "Enable Hindsight long-term memory. Full ThinkWork installs default this on because Hindsight is the canonical user and Space memory provider; set false only for explicit low-cost/development AgentCore-only deployments."
+  description = "DEPRECATED (THINK-407): the Hindsight memory engine and its infrastructure were removed; this input is inert and ignored. Declaration retained so existing customer-stage -var passthroughs and tfvars keep working."
   type        = bool
-  default     = true
+  default     = false
 }
 
 variable "enable_agentcore_harness" {
@@ -365,52 +451,65 @@ variable "enable_agentcore_harness" {
   default     = true
 }
 
-variable "enable_capability_broker" {
-  description = "Enable the THINK-280 governed capability broker (private REST API + dedicated execute-api VPCE with private DNS disabled, DynamoDB session store, broker Lambda). Ship-inert: defaults OFF; U4 flips it on after the live negative-egress proof. The broker Lambda code also fails closed independent of this flag."
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Provision the non-production THINK-316 Identity/Gateway proof substrate. Defaults off; requires the Harness IAM surface and never changes the tenant runtime selector by itself."
   type        = bool
   default     = false
 }
 
-variable "memory_engine" {
-  description = "Active long-term memory engine for canonical recall/inspect/export. Exactly one engine is authoritative per deployment. Empty auto-selects Hindsight for full installs. Accepted values: 'hindsight' (requires enable_hindsight = true) or 'agentcore' (explicit low-cost/development managed-memory mode). Legacy value 'managed' maps to 'agentcore'."
+variable "agentcore_multiplayer_proof_tenant_slug" {
+  description = "Explicit non-production pilot tenant slug for the one-Harness multiplayer proof. Required when the proof is enabled."
   type        = string
   default     = ""
-
-  validation {
-    condition     = var.memory_engine == "" || contains(["managed", "hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be empty, 'hindsight', 'agentcore', or legacy 'managed'."
-  }
 }
 
-variable "hindsight_image_tag" {
-  description = "Hindsight Docker image tag (used when enable_hindsight = true). 0.8.4 upgrade validated 2026-07-06 (THINK-201): migration rehearsal over a dev-data copy passed (orphan-observation backsweep deletes ~650 broken-provenance rows — expected); retain/recall/consolidation verified; 0.8.4 fixes the Bedrock-Anthropic extraction tool schema AND fails retain loudly (500) instead of silently storing zero units. Known upstream gap: maintenance discovery routines (reconcile sweep, mental-model cron, llm_requests retention) expect functions in the public schema and no-op with warnings when HINDSIGHT_API_DATABASE_SCHEMA != public."
+variable "agentcore_multiplayer_proof_owner_allowlist" {
+  description = "Comma-separated non-production subjects for the manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants are admitted from canonical tenant membership, not this list."
   type        = string
-  default     = "0.8.4"
+  default     = ""
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published assertion key versions for the managed Harness proof."
+  type        = list(string)
+  default     = ["v1"]
 }
 
-variable "hindsight_database_name" {
-  description = "Dedicated Hindsight database name on the primary Aurora cluster (THINK-220 cutover flag). Empty (default) = legacy layout: Hindsight lives in the `hindsight` schema of the primary database and its upstream maintenance discovery no-ops (see hindsight_image_tag note). Set to e.g. \"thinkwork_hindsight\" AFTER the database exists and its data is migrated (plan 2026-07-07-004): flips the Hindsight service, the api Lambdas, and the Pi runtime to that database's `public` schema in one apply."
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "Assertion key version used for new Harness and Gateway tokens."
   type        = string
-  default     = ""
+  default     = "v1"
 }
 
-variable "hindsight_enable_auto_consolidation" {
-  description = "Run Hindsight's observation consolidation engine automatically after retain (used when enable_hindsight = true)."
+variable "enable_capability_broker" {
+  description = "Enable the THINK-280 governed capability broker (private REST API + dedicated execute-api VPCE with private DNS disabled, DynamoDB session store, broker Lambda). Ship-inert: defaults OFF; U4 flips it on after the live negative-egress proof. The broker Lambda code also fails closed independent of this flag."
   type        = bool
-  default     = true
+  default     = false
 }
 
-variable "hindsight_consolidation_dedup_threshold" {
-  description = "Cosine-similarity threshold for Hindsight near-duplicate observation reconciliation (0.0-1.0; 1.0 disables)."
+variable "auth_state_store" {
+  description = "THINK-643: backing store for short-lived auth-flow state (AppSync subscription tickets + connect rate-limit counters). \"postgres\" (default) keeps the Aurora auth_subscription_tickets path; \"dynamo\" provisions thinkwork-<stage>-auth-state and points the auth handlers at it. Ship-inert: dev opts in via the deploy workflow, customer stages on their own cadence."
   type        = string
-  default     = "0.97"
+  default     = "postgres"
+
+  validation {
+    condition     = contains(["postgres", "dynamo"], var.auth_state_store)
+    error_message = "auth_state_store must be \"postgres\" or \"dynamo\"."
+  }
 }
 
-variable "hindsight_observations_mission" {
-  description = "Service-level default observations mission for Hindsight consolidation. Empty string falls back to the image default. Per-bank config overrides apply on top."
+
+variable "memory_engine" {
+  description = "DEPRECATED (THINK-407): AgentCore managed memory is the only engine; this input is inert and ignored. Declaration retained so existing customer-stage -var passthroughs and tfvars keep working. Legacy values ('hindsight', 'managed') are accepted and discarded."
   type        = string
-  default     = "Synthesize durable, institutional facts about the business: customers, projects, decisions, processes, tools, relationships, and recurring patterns. Filter out ephemeral state, secrets, and personal small talk."
+  default     = ""
+
+  validation {
+    condition     = var.memory_engine == "" || contains(["managed", "hindsight", "agentcore"], var.memory_engine)
+    error_message = "memory_engine must be empty, 'agentcore', or a legacy value ('hindsight', 'managed'). The input is ignored either way."
+  }
 }
+
 variable "twenty_provisioned" {
   description = "Provision the retained Twenty CRM managed-app substrate. Runtime can be parked independently with twenty_runtime_enabled."
   type        = bool
@@ -829,6 +928,17 @@ variable "enable_workspace_orchestration" {
   default     = false
 }
 
+variable "agentcore_session_scope" {
+  description = "THINK-909/THINK-946 AgentCore runtime session scope. \"thread\" (default) keys the session per thread; \"user\" keys it per (tenant, agent, user) so a new thread lands on the user's warm microVM and reuses its retained MCP connections and toolset (THINK-946). Set \"user\" only after the stage's Pi runtime image dual-accepts both session ids. mcpherson runs \"user\"; every other stage keeps the default."
+  type        = string
+  default     = "thread"
+
+  validation {
+    condition     = contains(["thread", "user"], var.agentcore_session_scope)
+    error_message = "agentcore_session_scope must be \"thread\" or \"user\"."
+  }
+}
+
 variable "requester_idle_memory_learning_enabled" {
   description = "Enable requester-scoped 15-minute idle memory learning."
   type        = bool
@@ -865,18 +975,6 @@ variable "brain_dream_state_schedule_expression" {
   default     = "cron(0 5 * * ? *)"
 }
 
-variable "retry_dispatcher_enabled" {
-  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there (parent plan deploy ordering); manual invokes work regardless."
-  type        = bool
-  default     = false
-}
-
-variable "stall_threshold_minutes" {
-  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307 — one knob, two consumers)."
-  type        = number
-  default     = 5
-}
-
 # ---------------------------------------------------------------------------
 # Naming / Buckets
 # ---------------------------------------------------------------------------
@@ -918,6 +1016,24 @@ variable "plugin_catalog_github_token_secret_arn" {
   default     = ""
 }
 
+variable "brain_m2m_platform_agent_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Company Brain platform-agent machine-lane secret (Cognito client-credentials blob, THINK-628). When set, the shared API Lambda role may read it so MCP config build can mint short-lived bearers for the Brain connector. Empty leaves the tkt_ lane untouched."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_api_url" {
+  description = "Optional Company Brain ops-api base URL for the Send-to-the-Brain flag path (THINK-781). Empty disables the action."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_m2m_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Brain agent-identity m2m secret (ops-api operator pool, scope etl-agent/tasks) used by flagThreadToBrain to POST /flags (THINK-781)."
+  type        = string
+  default     = ""
+}
+
 variable "database_name" {
   description = "Aurora database name"
   type        = string
@@ -952,6 +1068,12 @@ variable "skill_trust_runner_enabled" {
   default     = true
 }
 
+variable "release_image_mirror_principal_arns" {
+  description = "IAM principals allowed to push release runtime images (`<releaseVersion>-pi-arm64`) into this stage's AgentCore ECR repository, so the vendor's release pipeline can mirror the arm64 AgentCore Runtime image into this account (THINK-616). Empty by default: cross-account push is opt-in per stage, never implied by deploying this module. ThinkWork-operated customer stages set this to the ThinkWork release account (arn:aws:iam::487219502366:root)."
+  type        = list(string)
+  default     = []
+}
+
 variable "manage_bedrock_invocation_logging" {
   description = "Own the account/region-level Bedrock model-invocation logging (log group /thinkwork/bedrock/model-invocations, IAM role, and the account logging configuration). Exactly ONE stage per account+region may manage it — a second stack collides on the log group and would clobber/destroy the account-level config (harness cycle-5 ledger entry)."
   type        = bool
@@ -986,8 +1108,12 @@ variable "admin_callback_urls" {
   default = [
     "http://localhost:5174",
     "http://localhost:5174/auth/callback",
+    "http://127.0.0.1:5174",
+    "http://127.0.0.1:5174/auth/callback",
     "http://localhost:5175",
     "http://localhost:5175/auth/callback",
+    "http://127.0.0.1:5175",
+    "http://127.0.0.1:5175/auth/callback",
     "http://127.0.0.1:42010/callback",
     "http://localhost:42010/callback",
   ]
@@ -997,19 +1123,58 @@ variable "admin_logout_urls" {
   type = list(string)
   default = [
     "http://localhost:5174",
+    "http://127.0.0.1:5174",
     "http://localhost:5175",
+    "http://127.0.0.1:5175",
+  ]
+}
+
+variable "additional_admin_callback_urls" {
+  type        = list(string)
+  default     = []
+  description = "Extra OAuth callback URLs appended to the web-family Cognito clients, beyond the computed defaults (localhost, customer/app domains, dev console). Customer stacks host the Company Brain console in their own account, so those origins can't be derived here and arrive from the deployment runner (runner-secrets `adminCallbackUrls`). Supply both the bare origin and its /auth/callback variant. Purely additive — empty leaves behavior unchanged."
+}
+
+variable "additional_admin_logout_urls" {
+  type        = list(string)
+  default     = []
+  description = "Extra OAuth logout URLs appended to the web-family Cognito clients (companion to additional_admin_callback_urls; runner-secrets `adminLogoutUrls`)."
+}
+
+variable "cli_callback_urls" {
+  type = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
   ]
 }
 
-variable "desktop_callback_urls" {
+variable "cli_logout_urls" {
   type = list(string)
   default = [
-    "thinkwork://oauth/callback",
-    "thinkwork-dev://oauth/callback",
-    "thinkwork-canary://oauth/callback",
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
   ]
 }
 
+variable "console_client_enabled" {
+  description = "Create the optional Company Brain console Cognito app client (U13). Default false = ship-inert; nothing is created and console_client_id is null."
+  type        = bool
+  default     = false
+}
+
+variable "console_callback_urls" {
+  description = "OAuth callback URLs for the console client — must include the console hosting URL BEFORE first login (redirect_mismatch otherwise). Required non-empty when console_client_enabled."
+  type        = list(string)
+  default     = []
+}
+
+variable "console_logout_urls" {
+  description = "OAuth logout URLs for the console client"
+  type        = list(string)
+  default     = []
+}
+
 variable "mobile_callback_urls" {
   type    = list(string)
   default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"]
@@ -1030,28 +1195,42 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
-variable "cognito_custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip"
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired (no WorkOS runtime); existing deployments must explicitly select coexistence/cutover until their evidence-gated retirement is complete."
   type        = string
-  default     = ""
-}
+  default     = "retired"
 
-# ---------------------------------------------------------------------------
-# Docs site (custom domain — optional)
-# ---------------------------------------------------------------------------
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
 
-variable "docs_domain" {
-  description = "Custom domain for the docs site (e.g. docs.thinkwork.ai). Leave empty for CloudFront default."
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for legacy-session identity migration. Must be supplied explicitly for coexistence deployments."
   type        = string
   default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
 }
 
-variable "docs_certificate_arn" {
-  description = "ACM certificate ARN for the docs domain (us-east-1, required for CloudFront custom domains)"
+variable "cognito_custom_auth_lambda_zip" {
+  description = "Local WorkOS bridge custom-auth artifact retained only as a rollback runtime before auth retirement."
   type        = string
   default     = ""
 }
 
+variable "cognito_denied_app_client_ids" {
+  description = "Cognito app clients denied new and refresh token issuance during native-auth cutover"
+  type        = list(string)
+  default     = []
+}
+
 # ---------------------------------------------------------------------------
 # Public website (custom domain — optional)
 # ---------------------------------------------------------------------------
@@ -1142,7 +1321,7 @@ variable "computer_sandbox_certificate_arn" {
 }
 
 variable "computer_sandbox_allowed_parent_origins" {
-  description = "Comma-separated list of trusted web parent origins that may frame the sandbox iframe (e.g. 'https://thinkwork.ai,https://dev.thinkwork.ai'). Desktop custom-protocol origins are appended automatically. Wired into the sandbox CSP frame-ancestors directive AND mirrored at iframe-shell build time as __ALLOWED_PARENT_ORIGINS__. The two trust sets MUST stay in sync. Leave empty to allow only desktop custom-protocol parents."
+  description = "Comma-separated list of trusted web parent origins that may frame the sandbox iframe (e.g. 'https://thinkwork.ai,https://dev.thinkwork.ai'). Wired into the sandbox CSP frame-ancestors directive AND mirrored at iframe-shell build time as __ALLOWED_PARENT_ORIGINS__. The two trust sets MUST stay in sync. Leave empty to disallow framing entirely."
   type        = string
   default     = ""
 }
@@ -1265,8 +1444,8 @@ variable "cognito_invite_sms_message" {
   }
 }
 
-variable "wiki_compile_model_id" {
-  description = "Bedrock model id used by the wiki-compile Lambda (leaf planner + aggregation planner + section writer). Any Converse-compatible model works; change without a code deploy."
+variable "ontology_scan_model_id" {
+  description = "DEPRECATED (THINK-408): the ontology / knowledge-graph subsystem was removed; this variable is accepted for compatibility and has no effect."
   type        = string
   default     = "openai.gpt-oss-120b-1:0"
 }
@@ -1278,7 +1457,19 @@ variable "brain_source_agent_model_id" {
 }
 
 variable "knowledge_graph_observations_ingest_enabled" {
-  description = "Enable the Brain distillation schedule (Hindsight observations -> knowledge graph). Ships disabled (plan 2026-07-03-005 U4)."
+  description = "DEPRECATED (THINK-408): the ontology / knowledge-graph subsystem was removed; this variable is accepted for compatibility and has no effect."
+  type        = bool
+  default     = false
+}
+
+variable "ontology_scan_sweep_enabled" {
+  description = "DEPRECATED (THINK-408): the ontology / knowledge-graph subsystem was removed; this variable is accepted for compatibility and has no effect."
+  type        = bool
+  default     = false
+}
+
+variable "identity_drift_match_enabled" {
+  description = "Enable the recurring per-tenant identity drift match sweep (THINK-321 U7/KTD-7). Ships disabled."
   type        = bool
   default     = false
 }
@@ -1306,12 +1497,6 @@ variable "wiki_deterministic_linking_enabled" {
   default     = "true"
 }
 
-variable "google_places_api_key" {
-  description = "Google Places API (New) key used by wiki-compile for POI → city/state/country hierarchy enrichment. Stored as SSM SecureString at /thinkwork/<stage>/google-places/api-key. Empty string = parameter created with a placeholder; operator populates via `aws ssm put-parameter --overwrite`. Compile gracefully degrades to metadata-only rows when the key is absent — never fails compile."
-  type        = string
-  default     = ""
-  sensitive   = true
-}
 
 variable "mapbox_public_token" {
   description = "Mapbox public pk.* token consumed by the apps/web MapView primitive (in @thinkwork/computer-stdlib) for inline map tile rendering inside generated applets. Flows from this variable → terraform output → scripts/build-web.sh → apps/web/.env.production as VITE_MAPBOX_PUBLIC_TOKEN. URL-restrict on the Mapbox dashboard to the deployed `computer.<apex>` host (and any dev hosts) — the token ships in the public Vite bundle, so URL allowlist is the security boundary. Empty string is acceptable: MapView falls back to OpenStreetMap tiles when the env var is unset, so dev environments without an operator-provisioned token still render maps."
@@ -1353,30 +1538,109 @@ variable "compliance_anchor_object_lock_mode" {
   }
 }
 
-variable "analyst_policy_source" {
-  description = "THINK-229 KTD5 enforcement flip for the analyst connection policy source: 'row' (default — signed sidecar policy is shadow-only) or 'sidecar' (the sidecar block is authoritative). Flip only after clean shadow parity on live traffic."
-  type        = string
-  default     = "row"
+variable "compliance_anchor_retention_days" {
+  description = "Default Object Lock retention in days for the compliance audit-anchor bucket. SOC2 Type 1 baseline is 12 months (365)."
+  type        = number
+  default     = 365
 
   validation {
-    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
-    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
+    condition     = var.compliance_anchor_retention_days > 0
+    error_message = "compliance_anchor_retention_days must be greater than 0."
   }
 }
 
-variable "capability_self_extension_tenants" {
-  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities. Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed."
+# ---------------------------------------------------------------------------
+# Company Brain twin (plan 2026-07-21-001): Neptune wiring for the
+# identity-graph-projector. Values come from the etl-platform neptune stack's
+# outputs; all default-empty so stages without the twin deploy unchanged.
+# ---------------------------------------------------------------------------
+
+variable "neptune_endpoint" {
+  type        = string
+  default     = ""
+  description = "Neptune twin cluster writer endpoint (etl-platform neptune stack output; empty = twin disabled)"
+}
+
+variable "brain_mcp_url" {
   type        = string
   default     = ""
+  description = "Platform-served Brain MCP endpoint (consolidation U14). When set, twin-connector provisioning registers agents against it instead of the product /mcp/twin route. Empty = legacy product-served default."
 }
 
-variable "compliance_anchor_retention_days" {
-  description = "Default Object Lock retention in days for the compliance audit-anchor bucket. SOC2 Type 1 baseline is 12 months (365)."
+variable "neptune_cluster_resource_id" {
+  type        = string
+  default     = ""
+  description = "Neptune cluster resource id (etl-platform neptune stack output) for neptune-db IAM ARNs"
+}
+
+variable "neptune_client_security_group_id" {
+  type        = string
+  default     = ""
+  description = "neptune-client SG id (etl-platform neptune stack output) attached to the identity-graph-projector"
+}
+
+variable "neptune_load_bucket" {
+  type        = string
+  default     = ""
+  description = "Neptune bulk-load staging bucket name (etl-platform neptune stack; empty = bulk-rebuild disabled)"
+}
+
+variable "neptune_loader_role_arn" {
+  type        = string
+  default     = ""
+  description = "IAM role ARN the Neptune cluster assumes to read the load bucket (etl-platform neptune stack; empty = bulk-rebuild disabled)"
+}
+
+
+variable "lambda_max_memory_mb" {
   type        = number
-  default     = 365
+  default     = 10240
+  description = "Account-level Lambda memory ceiling in MB. Legacy AWS accounts cap function memory at 3008 (raised only via AWS support case); handlers requesting more are clamped so a capped account's deploy doesn't fail mid-apply. Set via the runner-secrets key lambdaMaxMemoryMb on managed deployments."
+}
 
-  validation {
-    condition     = var.compliance_anchor_retention_days > 0
-    error_message = "compliance_anchor_retention_days must be greater than 0."
-  }
+variable "agentcore_runtime_dispatch_enabled" {
+  description = "THINK-585 U6: stage kill-switch for AgentCore Runtime chat dispatch (see lambda-api module)."
+  type        = bool
+  default     = false
+}
+
+################################################################################
+# THINK-915 — chat turn-latency observability (passthrough to the lambda-api
+# module; see terraform/modules/app/lambda-api/chat-latency-observability.tf).
+################################################################################
+
+variable "enable_chat_turn_latency_observability" {
+  description = "THINK-915: create the per-stage chat turn-latency dashboard, the saved turn-timeline Logs Insights query, and the Lambda-native dispatch p95 alarm."
+  type        = bool
+  default     = true
+}
+
+variable "enable_chat_turn_latency_metric_filters" {
+  description = "THINK-915: create the agentcore_phase log metric filters (TurnRuntimeInvokeMs, AgentLoopMs) and the metric-filter-backed p95 alarm. OFF by default because the Lambda log groups are implicit and PutMetricFilter fails on a stage that has never served a chat turn."
+  type        = bool
+  default     = false
+}
+
+variable "chat_turn_latency_metric_namespace" {
+  description = "THINK-915: CloudWatch namespace prefix for the chat phase metrics; the stage is appended (Thinkwork/Chat/<stage>)."
+  type        = string
+  default     = "Thinkwork/Chat"
+}
+
+variable "chat_turn_runtime_log_group_name" {
+  description = "THINK-915: explicit AgentCore Pi runtime log group name. Empty discovers it by prefix at plan time."
+  type        = string
+  default     = ""
+}
+
+variable "chat_turn_p95_alarm_threshold_ms" {
+  description = "THINK-915: p95 threshold (ms) for the whole AgentCore runtime call, breaching on 2 of 3 five-minute periods."
+  type        = number
+  default     = 30000
+}
+
+variable "chat_turn_latency_alarm_actions" {
+  description = "THINK-915: SNS topic ARNs notified by the chat turn-latency alarms. Empty by default (no general alarm topic exists in the stack)."
+  type        = list(string)
+  default     = []
 }