thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/examples/greenfield/main.tf

@@ -81,6 +81,24 @@ variable "plugin_catalog_github_token_secret_arn" {
   default     = ""
 }
 
+variable "brain_m2m_platform_agent_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Company Brain platform-agent machine-lane secret (Cognito client-credentials blob, THINK-628). When set, the shared API Lambda role may read it so MCP config build can mint short-lived bearers for the Brain connector. Empty leaves the tkt_ lane untouched."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_api_url" {
+  description = "Optional Company Brain ops-api base URL for the Send-to-the-Brain flag path (THINK-781). Empty disables the action."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_m2m_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Brain agent-identity m2m secret (ops-api operator pool, scope etl-agent/tasks) used by flagThreadToBrain to POST /flags (THINK-781)."
+  type        = string
+  default     = ""
+}
+
 variable "db_password" {
   description = "Master password for the Aurora cluster"
   type        = string
@@ -93,16 +111,16 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
-variable "hindsight_database_name" {
-  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty keeps Hindsight in the hindsight schema of the primary database."
-  type        = string
-  default     = ""
-}
-
 variable "enable_hindsight" {
-  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
+  description = "DEPRECATED (THINK-407): the Hindsight memory engine and its infrastructure were removed; this input is inert and ignored. Retained so existing tfvars keep working."
   type        = bool
-  default     = true
+  default     = false
+}
+
+variable "external_kb_source_arns" {
+  description = "DEPRECATED (THINK-402): Knowledge Bases were removed from the product; this input is inert and ignored. Retained so existing tfvars keep working."
+  type        = list(string)
+  default     = []
 }
 
 variable "enable_capability_broker" {
@@ -111,6 +129,18 @@ variable "enable_capability_broker" {
   default     = false
 }
 
+variable "auth_state_store" {
+  description = "THINK-643: backing store for short-lived auth-flow state (AppSync subscription tickets + connect rate-limit counters). \"postgres\" (default) keeps the Aurora auth_subscription_tickets path; \"dynamo\" provisions thinkwork-<stage>-auth-state and points the auth handlers at it. Ship-inert: dev opts in via the deploy workflow, customer stages on their own cadence."
+  type        = string
+  default     = "postgres"
+
+  validation {
+    condition     = contains(["postgres", "dynamo"], var.auth_state_store)
+    error_message = "auth_state_store must be \"postgres\" or \"dynamo\"."
+  }
+}
+
+
 variable "enable_agentcore_multiplayer_proof" {
   description = "Opt in to the non-production THINK-316 AgentCore Identity/Gateway proof substrate."
   type        = bool
@@ -141,14 +171,44 @@ variable "agentcore_turn_assertion_active_key_version" {
   default     = "v1"
 }
 
-variable "analyst_lambda_vpc_egress" {
-  description = "VPC-attach the analyst data-path Lambdas so their egress rides the NAT gateway's stable EIP — required when an external analyst data source sits behind an IP allowlist. See the thinkwork module's analyst_egress_ip output for the IP to allowlist."
-  type        = bool
-  default     = false
+variable "neptune_endpoint" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: Neptune writer endpoint (etl-platform neptune stack output; empty = twin disabled)"
+}
+
+variable "brain_mcp_url" {
+  type        = string
+  default     = ""
+  description = "Platform-served Brain MCP endpoint (consolidation U14); empty = legacy product-served /mcp/twin"
+}
+
+variable "neptune_cluster_resource_id" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: Neptune cluster resource id for IAM ARNs"
+}
+
+variable "neptune_client_security_group_id" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: neptune-client SG id for the identity-graph-projector"
+}
+
+variable "neptune_load_bucket" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: Neptune bulk-load staging bucket (empty = bulk-rebuild disabled)"
+}
+
+variable "neptune_loader_role_arn" {
+  type        = string
+  default     = ""
+  description = "Company Brain twin: IAM role the Neptune cluster assumes to read the load bucket"
 }
 
 variable "memory_engine" {
-  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments."
+  description = "DEPRECATED (THINK-407): AgentCore managed memory is the only engine; this input is inert and ignored. Retained so existing tfvars keep working."
   type        = string
   default     = ""
 }
@@ -158,6 +218,12 @@ variable "twenty_provisioned" {
   default     = false
 }
 
+variable "release_image_mirror_principal_arns" {
+  description = "IAM principals allowed to push release runtime images into this stage's AgentCore ECR repository (THINK-616). ThinkWork-operated customer stages set [\"arn:aws:iam::487219502366:root\"] so the release workflow can mirror `<releaseVersion>-pi-arm64`; leave empty for self-hosted deployments."
+  type        = list(string)
+  default     = []
+}
+
 variable "twenty_runtime_enabled" {
   description = "Run Twenty CRM server/worker tasks when the retained substrate is provisioned."
   type        = bool
@@ -358,6 +424,24 @@ variable "tenant_entra_connections" {
   default = []
 }
 
+variable "console_client_enabled" {
+  description = "Create the optional Company Brain console Cognito app client (U13). Default false = ship-inert."
+  type        = bool
+  default     = false
+}
+
+variable "console_callback_urls" {
+  description = "OAuth callback URLs for the console client — must include the console hosting URL BEFORE first login (redirect_mismatch otherwise)"
+  type        = list(string)
+  default     = []
+}
+
+variable "console_logout_urls" {
+  description = "OAuth logout URLs for the console client"
+  type        = list(string)
+  default     = []
+}
+
 variable "pre_signup_lambda_zip" {
   description = "Path to the Cognito pre-signup Lambda zip"
   type        = string
@@ -437,6 +521,41 @@ variable "platform_operator_emails" {
   default     = ""
 }
 
+# THINK-583 U3 — provisioned concurrency for chat-agent-invoke /
+# workspace-renderer (KTD5: never the Pi Lambda). Default 0 = disabled;
+# the `live` alias always exists so alias-qualified invokers work either
+# way. Dev sets 1/1 via scripts/deploy/terraform-vars.sh; customer stages
+# opt in through their runner-secrets tfvars on their release cadence.
+
+variable "agentcore_runtime_dispatch_enabled" {
+  description = "THINK-585 U6: stage kill-switch for AgentCore Runtime chat dispatch."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_session_scope" {
+  description = "THINK-909/THINK-946 AgentCore runtime session scope. \"thread\" (default) keys the runtime session per thread; \"user\" keys it per (tenant, agent, user) so a user's NEW thread lands on their already-warm microVM and reuses its MCP connections and toolset. Set \"user\" only after the stage's Pi runtime image dual-accepts both session ids. mcpherson runs \"user\"; every other stage runs the default."
+  type        = string
+  default     = "thread"
+
+  validation {
+    condition     = contains(["thread", "user"], var.agentcore_session_scope)
+    error_message = "agentcore_session_scope must be \"thread\" or \"user\"."
+  }
+}
+
+variable "chat_agent_invoke_provisioned_concurrency" {
+  description = "Provisioned concurrency on chat-agent-invoke's `live` alias. 0 = disabled (alias still exists)."
+  type        = number
+  default     = 0
+}
+
+variable "workspace_renderer_provisioned_concurrency" {
+  description = "Provisioned concurrency on workspace-renderer's `live` alias. 0 = disabled (alias still exists)."
+  type        = number
+  default     = 0
+}
+
 variable "www_domain" {
   description = "Public website apex domain (e.g. thinkwork.ai). Leave empty to skip the custom domain and DNS wiring."
   type        = string
@@ -473,21 +592,6 @@ variable "stripe_price_ids_json" {
   default     = "{}"
 }
 
-variable "wiki_compile_model_id" {
-  description = <<-EOT
-    Bedrock model id the wiki-compile Lambda uses for the leaf planner,
-    aggregation planner, and section writer. Any Converse-compatible
-    model works; change without a code deploy.
-
-    Default: openai.gpt-oss-120b-1:0 (strong output quality at a lower
-    per-minute throttle risk than Claude Haiku 4.5 on shared dev
-    accounts). Swap to us.anthropic.claude-haiku-4-5-20251001-v1:0 for
-    Claude, or amazon.nova-micro-v1:0 for a low-cost spike.
-  EOT
-  type        = string
-  default     = "openai.gpt-oss-120b-1:0"
-}
-
 variable "requester_idle_memory_learning_enabled" {
   description = "Enable requester-scoped 15-minute idle memory learning."
   type        = bool
@@ -528,14 +632,20 @@ variable "brain_source_agent_model_id" {
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
-variable "knowledge_graph_observations_ingest_enabled" {
-  description = "Enable the Brain distillation schedule (observations -> knowledge graph). Ships disabled; flip on dev after a validated manual run (plan 2026-07-03-005 U4)."
+variable "identity_drift_match_enabled" {
+  description = "Enable the recurring per-tenant identity drift match sweep (THINK-321 U7/KTD-7 — R10). Ships disabled; enabled per stage once bootstrap matching has been proven there."
   type        = bool
   default     = false
 }
 
-variable "ontology_scan_sweep_enabled" {
-  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled; enabled per stage once the Living Map review surfaces land."
+variable "vpc_interface_endpoint_services" {
+  description = "AWS services that get a private interface endpoint (null = legacy full set, [] = none). See modules/thinkwork. Cost review 2026-08-28."
+  type        = list(string)
+  default     = null
+}
+
+variable "vpc_interface_endpoint_single_az" {
+  description = "One ENI per interface endpoint instead of one per AZ. Cost review 2026-08-28."
   type        = bool
   default     = false
 }
@@ -551,23 +661,6 @@ variable "wiki_source" {
   }
 }
 
-variable "analyst_policy_source" {
-  description = "THINK-229 KTD5 enforcement flip for the analyst connection policy source: 'row' (default — signed sidecar policy is shadow-only) or 'sidecar' (the sidecar block is authoritative). Flip only after clean shadow parity on live traffic."
-  type        = string
-  default     = "row"
-
-  validation {
-    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
-    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
-  }
-}
-
-variable "capability_self_extension_tenants" {
-  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed."
-  type        = string
-  default     = ""
-}
-
 variable "wiki_aggregation_pass_enabled" {
   description = <<-EOT
     Feature flag for the wiki aggregation pass — the second LLM call
@@ -582,23 +675,6 @@ variable "wiki_aggregation_pass_enabled" {
   default     = "true"
 }
 
-variable "google_places_api_key" {
-  description = <<-EOT
-    Google Places API (New) key used by wiki-compile to enrich POI records
-    with city/state/country hierarchy during compile. When empty, compile
-    gracefully degrades to metadata-only place rows (no hierarchy, no
-    backing pages), so this is opt-in. Stored as a SecureString at
-    /thinkwork/<stage>/google-places/api-key — see
-    terraform/modules/app/lambda-api/handlers.tf for the SSM resource.
-
-    The parameter's value has lifecycle.ignore_changes set, so you can
-    rotate via `aws ssm put-parameter --overwrite` without terraform
-    fighting you on the next apply.
-  EOT
-  type        = string
-  default     = ""
-  sensitive   = true
-}
 
 variable "mapbox_public_token" {
   description = <<-EOT
@@ -678,6 +754,30 @@ variable "customer_domain" {
   default     = ""
 }
 
+variable "deployment_runner_in_vpc" {
+  description = "Run the deployment runner CodeBuild inside the VPC and grant it tcp/5432 on the database security group instead of relying on the world-open DB ingress (THINK-1082). Also turns on the VPC NAT gateway. Default false = no networking change."
+  type        = bool
+  default     = false
+}
+
+variable "api_lambdas_in_vpc" {
+  description = "Run every database-connected Lambda (api handlers, agentcore-admin, Pi, broker) inside the VPC behind the api-lambda security group, granted tcp/5432 on the database security group (THINK-1082). Also turns on the VPC NAT gateway. Default false = no networking change."
+  type        = bool
+  default     = false
+}
+
+variable "db_publicly_accessible" {
+  description = "Aurora publicly_accessible (THINK-1082). Default true. Set false only after api_lambdas_in_vpc and deployment_runner_in_vpc are live."
+  type        = bool
+  default     = true
+}
+
+variable "db_public_ingress_cidrs" {
+  description = "tcp/5432 CIDR ingress seeded on a NEW database security group (THINK-1082). Default [\"0.0.0.0/0\"]; [] = none. Does not revoke a live rule — see modules/app/deployment-control-plane/README.md."
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
 variable "customer_domain_delegated" {
   description = "Set true once the apex zone's NS records point at the customer zone (claim tool phase two). Gates the ACM certificate, the web alias records, and the customer-domain Cognito callback entries. Requires customer_domain."
   type        = bool
@@ -690,9 +790,20 @@ variable "customer_domain_legacy_retired" {
   default     = false
 }
 
+variable "additional_admin_callback_urls" {
+  description = "Extra OAuth callback URLs appended to the web-family Cognito clients (e.g. a hosted Company Brain console origin). Supply both the bare origin and its /auth/callback variant. Empty leaves behavior unchanged."
+  type        = list(string)
+  default     = []
+}
+
+variable "additional_admin_logout_urls" {
+  description = "Extra OAuth logout URLs appended to the web-family Cognito clients (companion to additional_admin_callback_urls)."
+  type        = list(string)
+  default     = []
+}
+
 locals {
   www_dns_enabled = var.www_domain != "" && var.cloudflare_zone_id != ""
-  docs_domain     = var.www_domain != "" ? "docs.${var.www_domain}" : ""
   app_domain      = var.www_domain != "" ? "app.${var.www_domain}" : ""
   computer_domain = var.www_domain != "" ? "computer.${var.www_domain}" : ""
   sandbox_domain  = var.www_domain != "" ? "sandbox.${var.www_domain}" : ""
@@ -853,19 +964,29 @@ module "thinkwork" {
   account_id = var.account_id
 
   plugin_catalog_github_token_secret_arn = var.plugin_catalog_github_token_secret_arn
+  brain_m2m_platform_agent_secret_arn    = var.brain_m2m_platform_agent_secret_arn
+  brain_ops_api_url                      = var.brain_ops_api_url
+  brain_ops_m2m_secret_arn               = var.brain_ops_m2m_secret_arn
 
   db_password                                 = var.db_password
   database_engine                             = var.database_engine
   enable_hindsight                            = var.enable_hindsight
+  external_kb_source_arns                     = var.external_kb_source_arns
   enable_capability_broker                    = var.enable_capability_broker
+  auth_state_store                            = var.auth_state_store
   enable_agentcore_multiplayer_proof          = var.enable_agentcore_multiplayer_proof
   agentcore_multiplayer_proof_tenant_slug     = var.agentcore_multiplayer_proof_tenant_slug
   agentcore_multiplayer_proof_owner_allowlist = var.agentcore_multiplayer_proof_owner_allowlist
   agentcore_turn_assertion_key_versions       = var.agentcore_turn_assertion_key_versions
   agentcore_turn_assertion_active_key_version = var.agentcore_turn_assertion_active_key_version
-  analyst_lambda_vpc_egress                   = var.analyst_lambda_vpc_egress
-  hindsight_database_name                     = var.hindsight_database_name
+  neptune_endpoint                            = var.neptune_endpoint
+  brain_mcp_url                               = var.brain_mcp_url
+  neptune_cluster_resource_id                 = var.neptune_cluster_resource_id
+  neptune_client_security_group_id            = var.neptune_client_security_group_id
+  neptune_load_bucket                         = var.neptune_load_bucket
+  neptune_loader_role_arn                     = var.neptune_loader_role_arn
   memory_engine                               = var.memory_engine
+  release_image_mirror_principal_arns         = var.release_image_mirror_principal_arns
   twenty_provisioned                          = var.twenty_provisioned
   twenty_runtime_enabled                      = var.twenty_runtime_enabled
   twenty_image_uri                            = var.twenty_image_uri
@@ -899,6 +1020,9 @@ module "thinkwork" {
   microsoft_oauth_client_secret               = var.microsoft_oauth_client_secret
   microsoft_oauth_tenant                      = var.microsoft_oauth_tenant
   tenant_entra_connections                    = var.tenant_entra_connections
+  console_client_enabled                      = var.console_client_enabled
+  console_callback_urls                       = var.console_callback_urls
+  console_logout_urls                         = var.console_logout_urls
   pre_signup_lambda_zip                       = var.pre_signup_lambda_zip
   auth_retirement_phase                       = var.auth_retirement_phase
   auth_migration_recovery_deadline            = var.auth_migration_recovery_deadline
@@ -910,17 +1034,15 @@ module "thinkwork" {
   enable_workspace_orchestration              = var.enable_workspace_orchestration
   api_auth_secret                             = var.api_auth_secret
   platform_operator_emails                    = var.platform_operator_emails
+  agentcore_runtime_dispatch_enabled          = var.agentcore_runtime_dispatch_enabled
+  agentcore_session_scope                     = var.agentcore_session_scope
+  chat_agent_invoke_provisioned_concurrency   = var.chat_agent_invoke_provisioned_concurrency
+  workspace_renderer_provisioned_concurrency  = var.workspace_renderer_provisioned_concurrency
 
   # Public website custom domain (optional — wired only when www_domain is set)
   www_domain          = var.www_domain
   www_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
 
-  # Docs site custom domain (derived from www_domain — docs.<apex>). The
-  # same ACM cert covers apex + www + docs + app/computer so every distribution
-  # shares it.
-  docs_domain          = local.www_dns_enabled ? local.docs_domain : ""
-  docs_certificate_arn = local.www_dns_enabled ? module.www_dns[0].certificate_arn : ""
-
   # End-user app custom domain (derived from www_domain — app.<apex>).
   # Same ACM cert covers it via the include_app SAN gate on www_dns.
   app_domain          = local.www_dns_enabled ? local.app_domain : ""
@@ -934,7 +1056,7 @@ module "thinkwork" {
 
   # Computer iframe sandbox (derived from www_domain — sandbox.<apex>).
   # Uses its own ACM certificate so sandbox bootstrap/rotation cannot replace
-  # the shared apex/www/docs/app/computer/api certificate.
+  # the shared apex/www/app/computer/api certificate.
   computer_sandbox_domain                 = local.www_dns_enabled ? local.sandbox_domain : ""
   computer_sandbox_certificate_arn        = local.www_dns_enabled ? aws_acm_certificate_validation.computer_sandbox[0].certificate_arn : ""
   computer_sandbox_allowed_parent_origins = local.www_dns_enabled ? "https://${local.app_domain}" : ""
@@ -947,16 +1069,13 @@ module "thinkwork" {
   # Wiki compile Lambda config. Pinned so unrelated terraform applies
   # don't wipe the Bedrock model or the aggregation flag back to
   # whatever the Lambda env defaults to.
-  wiki_compile_model_id                         = var.wiki_compile_model_id
   brain_source_agent_model_id                   = var.brain_source_agent_model_id
   wiki_aggregation_pass_enabled                 = var.wiki_aggregation_pass_enabled
   wiki_source                                   = var.wiki_source
-  analyst_policy_source                         = var.analyst_policy_source
-  capability_self_extension_tenants             = var.capability_self_extension_tenants
-  knowledge_graph_observations_ingest_enabled   = var.knowledge_graph_observations_ingest_enabled
-  ontology_scan_sweep_enabled                   = var.ontology_scan_sweep_enabled
+  vpc_interface_endpoint_services               = var.vpc_interface_endpoint_services
+  vpc_interface_endpoint_single_az              = var.vpc_interface_endpoint_single_az
+  identity_drift_match_enabled                  = var.identity_drift_match_enabled
   wiki_deterministic_linking_enabled            = var.wiki_deterministic_linking_enabled
-  google_places_api_key                         = var.google_places_api_key
   requester_idle_memory_learning_enabled        = var.requester_idle_memory_learning_enabled
   requester_memory_dreaming_enabled             = var.requester_memory_dreaming_enabled
   requester_memory_dreaming_schedule_expression = var.requester_memory_dreaming_schedule_expression
@@ -985,11 +1104,21 @@ module "thinkwork" {
   customer_domain_delegated      = var.customer_domain_delegated
   customer_domain_legacy_retired = var.customer_domain_legacy_retired
 
+  # Deployment runner / API Lambdas inside the VPC + database exposure (THINK-1082)
+  # — see modules/app/deployment-control-plane/README.md, "Closing the database port".
+  deployment_runner_in_vpc = var.deployment_runner_in_vpc
+  api_lambdas_in_vpc       = var.api_lambdas_in_vpc
+  db_publicly_accessible   = var.db_publicly_accessible
+  db_public_ingress_cidrs  = var.db_public_ingress_cidrs
+
+  additional_admin_callback_urls = var.additional_admin_callback_urls
+  additional_admin_logout_urls   = var.additional_admin_logout_urls
+
   # Greenfield: create everything (all defaults are true)
 }
 
 ################################################################################
-# Public Website DNS (Cloudflare zone, ACM cert, www→apex redirect, docs)
+# Public Website DNS (Cloudflare zone, ACM cert, www→apex redirect)
 ################################################################################
 
 module "www_dns" {
@@ -1001,12 +1130,10 @@ module "www_dns" {
   cloudflare_zone_id     = var.cloudflare_zone_id
   cloudfront_domain_name = module.thinkwork.www_distribution_domain
 
-  # Docs: include_docs is a plain bool (no output reference) so the
-  # ACM cert SAN list doesn't depend on the docs distribution output,
-  # which itself depends on the cert. docs_cloudfront_domain_name is
-  # read only after the cert is created, for the CNAME record.
-  include_docs                = true
-  docs_cloudfront_domain_name = module.thinkwork.docs_distribution_domain
+  # This stack predates THINK-702, so the shared cert still carries the
+  # retired docs.<domain> SAN. Dropping it would force a cert replacement
+  # that cycles against the thinkwork module — keep the dead SAN instead.
+  retain_docs_san = true
 
   # End-user app: canonical app.<apex> host. The compatibility output names
   # still use computer_* while the source path is apps/web.
@@ -1154,6 +1281,11 @@ output "mobile_client_id" {
   value       = module.thinkwork.mobile_client_id
 }
 
+output "console_client_id" {
+  description = "Cognito app client ID for the Company Brain console (null while console_client_enabled = false)"
+  value       = module.thinkwork.console_client_id
+}
+
 output "ecr_repository_url" {
   description = "ECR repository URL for the AgentCore container"
   value       = module.thinkwork.ecr_repository_url
@@ -1179,15 +1311,6 @@ output "database_name" {
   value       = module.thinkwork.database_name
 }
 
-output "hindsight_enabled" {
-  description = "Whether Hindsight canonical memory is enabled"
-  value       = module.thinkwork.hindsight_enabled
-}
-
-output "hindsight_endpoint" {
-  description = "Hindsight API endpoint (null when enable_hindsight = false)"
-  value       = module.thinkwork.hindsight_endpoint
-}
 output "twenty_provisioned" {
   description = "Whether the Twenty CRM retained managed-app substrate is provisioned"
   value       = module.thinkwork.twenty_provisioned
@@ -1363,21 +1486,6 @@ output "computer_sandbox_allowed_parent_origins" {
   value       = module.thinkwork.computer_sandbox_allowed_parent_origins
 }
 
-output "docs_url" {
-  description = "Docs site URL"
-  value       = local.www_dns_enabled ? "https://${local.docs_domain}" : "https://${module.thinkwork.docs_distribution_domain}"
-}
-
-output "docs_distribution_id" {
-  description = "CloudFront distribution ID for docs (for cache invalidation)"
-  value       = module.thinkwork.docs_distribution_id
-}
-
-output "docs_bucket_name" {
-  description = "S3 bucket for docs site assets"
-  value       = module.thinkwork.docs_bucket_name
-}
-
 output "www_url" {
   description = "Public website URL"
   value       = var.www_domain != "" ? "https://${var.www_domain}" : "https://${module.thinkwork.www_distribution_domain}"
@@ -1449,67 +1557,17 @@ output "customer_domain_name_servers" {
   value       = module.thinkwork.customer_domain_name_servers
 }
 
-output "analyst_egress_ip" {
-  description = "Stable NAT egress IP of the VPC-attached analyst data-path Lambdas (null unless analyst_lambda_vpc_egress is set)"
-  value       = module.thinkwork.analyst_egress_ip
-}
+# The original AgentCore Twenty reconciliation marker never owned external
+# cleanup, but an interrupted local-exec may have left it tainted. Forget it
+# from state without refresh or destroy provisioners — the child module owns
+# the replacement idempotent reconciliation marker under a new address. The
+# managed customer-update root (deployment-control-plane runner) carries the
+# same block; without it here, a dev push plans a delete the destructive-apply
+# guard rightly refuses.
+removed {
+  from = module.thinkwork.module.agentcore_proof_identity.terraform_data.twenty_identity_lifecycle
 
-output "agentcore_harness_proof_arn" {
-  description = "Deprecated: use agentcore_harness_arn."
-  value       = module.thinkwork.agentcore_harness_proof_arn
-}
-
-output "agentcore_harness_arn" {
-  description = "Managed tenant/profile AgentCore Harness ARN."
-  value       = module.thinkwork.agentcore_harness_arn
-}
-
-output "agentcore_harness_endpoint_name" {
-  description = "Named version-pinned managed AgentCore Harness qualifier."
-  value       = module.thinkwork.agentcore_harness_endpoint_name
-}
-
-output "agentcore_harness_version" {
-  description = "Attested immutable managed AgentCore Harness version."
-  value       = module.thinkwork.agentcore_harness_version
-}
-
-output "agentcore_harness_status" {
-  description = "Safe managed AgentCore Harness readiness state."
-  value       = module.thinkwork.agentcore_harness_status
-}
-
-output "agentcore_harness_proof_endpoint_name" {
-  description = "Deprecated: use agentcore_harness_endpoint_name."
-  value       = module.thinkwork.agentcore_harness_proof_endpoint_name
-}
-
-output "agentcore_harness_proof_version" {
-  description = "Deprecated: use agentcore_harness_version."
-  value       = module.thinkwork.agentcore_harness_proof_version
-}
-
-output "agentcore_harness_proof_status" {
-  description = "Deprecated: use agentcore_harness_status."
-  value       = module.thinkwork.agentcore_harness_proof_status
-}
-
-output "agentcore_turn_assertion_issuer" {
-  description = "Proof CUSTOM_JWT issuer used by deployed operator probes."
-  value       = module.thinkwork.agentcore_turn_assertion_issuer
-}
-
-output "agentcore_harness_audience" {
-  description = "Purpose-bound proof Harness audience."
-  value       = module.thinkwork.agentcore_harness_audience
-}
-
-output "agentcore_turn_assertion_active_key_arn" {
-  description = "Operator-only active proof signing key ARN."
-  value       = module.thinkwork.agentcore_turn_assertion_active_key_arn
-}
-
-output "agentcore_turn_assertion_active_kid" {
-  description = "Public JWKS key identifier for the active proof signing key."
-  value       = module.thinkwork.agentcore_turn_assertion_active_kid
+  lifecycle {
+    destroy = false
+  }
 }

package/dist/terraform/examples/greenfield/terraform.tfvars.example

@@ -13,12 +13,9 @@ account_id = "123456789012"  # your AWS account ID
 database_engine = "rds-postgres"
 
 # Memory:
-#   Hindsight is the canonical user and Space memory provider for full
-#   ThinkWork installs and is enabled by default. Set enable_hindsight = false
-#   and memory_engine = "agentcore" only for explicit low-cost/development
-#   AgentCore-only deployments.
-# enable_hindsight = false
-# memory_engine    = "agentcore"
+#   Bedrock AgentCore managed memory is the only engine. The legacy
+#   `enable_hindsight` / `memory_engine` inputs are deprecated no-ops that are
+#   still accepted so old tfvars keep applying.
 
 # Managed applications:
 #   Twenty CRM is optional. First enable should set both booleans true after
@@ -74,7 +71,7 @@ db_password = "CHANGE_ME_strong_password_here"
 # google_oauth_client_secret = ""
 # microsoft_oauth_client_id     = ""
 # microsoft_oauth_client_secret = "" # Supply securely; never commit a real value.
-# microsoft_oauth_tenant        = "" # Entra directory GUID; organizations/common are not valid Cognito issuers.
+# microsoft_oauth_tenant        = "" # Entra directory GUID, or common/organizations/consumers (Cognito-supported aliases).
 
 # Tenant-specific Entra IdPs are reconciled by `thinkwork enterprise
 # identity-provider`; Terraform receives safe provider metadata only.
@@ -115,7 +112,6 @@ db_password = "CHANGE_ME_strong_password_here"
 #     --name /thinkwork/<stage>/google-places/api-key --value <KEY>
 # (terraform's lifecycle.ignore_changes on the value keeps your manual
 # value from being overwritten on future applies.)
-# google_places_api_key = ""
 
 # Public website (apps/www) custom domain.
 # Leave www_domain empty to skip the custom domain and serve on the raw
@@ -137,3 +133,11 @@ db_password = "CHANGE_ME_strong_password_here"
 # ses_inbound_domain = "agents.thinkwork.ai"
 # ses_parent_domain = "thinkwork.ai"
 # tenant_slugs      = ["dev"]
+
+# Company Brain platform-agent machine lane (optional, THINK-628/THINK-710).
+# Secrets Manager ARN of etl-platform/brain-mcp/m2m/platform-agent in this
+# account. When set, the shared API Lambda role gets read on it so MCP config
+# build can mint short-lived Cognito bearers for the Brain connector instead
+# of using a stored tkt_ key. Leave empty until the lane's manifest entry is
+# published (see the Brain repo's brain-mcp-m2m-migration runbook).
+# brain_m2m_platform_agent_secret_arn = "arn:aws:secretsmanager:us-east-1:<account-id>:secret:etl-platform/brain-mcp/m2m/platform-agent-XXXXXX"