thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/identity-after.tf

@@ -0,0 +1,8 @@
+resource "terraform_data" "twenty_identity_reconciliation" {
+  count = 1
+  input = "new-idempotent-reconciliation-marker"
+
+  provisioner "local-exec" {
+    command = "printf '%s\\n' reconciled > '${path.root}/reconciled.log'"
+  }
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/identity-before.tf

@@ -0,0 +1,9 @@
+resource "terraform_data" "twenty_identity_lifecycle" {
+  count = 1
+  input = "legacy-state-only-marker"
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "printf '%s\\n' destroyed > '${path.root}/destroyed.log'"
+  }
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/thinkwork-after.tf

@@ -0,0 +1,3 @@
+module "agentcore_proof_identity" {
+  source = "./agentcore-identity"
+}

package/dist/terraform/modules/app/agentcore-identity/tests/tainted-marker/thinkwork-before.tf

@@ -0,0 +1,3 @@
+module "agentcore_proof_identity" {
+  source = "./agentcore-identity"
+}

package/dist/terraform/modules/app/agentcore-identity/variables.tf

@@ -4,6 +4,12 @@ variable "enabled" {
   default     = false
 }
 
+variable "twenty_enabled" {
+  description = "THINK-324 — keep the Twenty CRM user-federation identity (shared workload identity, twenty-crm credential provider, DCR client secret) alive independent of the proof plane, so retiring the managed-harness proof (enabled = false) does not destroy the live Twenty connector."
+  type        = bool
+  default     = false
+}
+
 variable "stage" {
   description = "Deployment stage."
   type        = string

package/dist/terraform/modules/app/agentcore-memory/README.md

@@ -10,12 +10,24 @@ the ThinkWork AgentCore runtime uses for automatic retention:
 | summaries   | `session_{sessionId}`            | Per-thread rolling summaries         |
 | episodes    | `episodes_{actorId}/{sessionId}` | Episodic memory of past interactions |
 
-Automatic retention is wired in the agent container: every turn emits a
-`CreateEvent` via `memory.store_turn_pair`, and AgentCore's background
-strategies extract facts into the namespaces above. Agents can read them
-back via the `recall()` tool (also always registered). There is no need for
-the model to call `remember()` explicitly — it only exists for user-driven
-"please remember X" requests.
+Automatic retention is wired through the API's normalized memory layer:
+every turn emits a `CreateEvent` (`AgentCoreAdapter.retainTurn`, actor =
+the user UUID), and AgentCore's background strategies extract facts into
+the namespaces above. Agents read them back via the `recall()` tool, which
+fans out over `assistant_{actorId}`, `preferences_{actorId}` and
+`user_{actorId}`. There is no need for the model to call `remember()`
+explicitly — it only exists for user-driven "please remember X" requests,
+and writes direct records into `user_{actorId}`.
+
+**The namespace templates above are a contract**, not an implementation
+detail. Readers that must stay in sync:
+
+- `packages/api/src/lib/memory/adapters/agentcore-adapter.ts` (`ACTOR_NAMESPACES`)
+- `packages/agentcore-pi/agent-container/src/tools/memory.ts` (`recallNamespaces`)
+
+Changing a template here without changing those makes extraction write
+where nothing reads — silent, and invisible until someone notices the
+agent has amnesia.
 
 ## Usage
 
@@ -42,12 +54,37 @@ The AWS Terraform provider does not (yet) expose a
 `aws_bedrockagentcore_memory` resource. Until it does, this module drives
 the lifecycle through the `aws bedrock-agentcore-control` CLI:
 
-- **Create/find**: `data "external"` runs `scripts/create_or_find_memory.sh`,
-  which is idempotent — it looks up an existing memory by name before
-  creating a new one. Safe to re-run.
+- **Ensure**: `data "external"` runs `scripts/create_or_find_memory.sh` on
+  every plan and apply. It pages through `list-memories` for candidates
+  matching the logical name, probes each one with `get-memory`, and uses the
+  first that is ACTIVE (waiting out a `CREATING` one). Safe to re-run.
 - **Destroy**: a paired `terraform_data` resource has a destroy-time
   `local-exec` that calls `delete-memory` on the ID captured during create.
 
+## Self-healing
+
+The memory ID this module outputs comes from a **live lookup on every
+plan**, never from stored state. If the memory resource is deleted
+out-of-band — as happened to `dev` in THINK-404, where SSM still advertised
+`AGENTCORE_MEMORY_ID` for a resource `GetMemory` returned
+`ResourceNotFound` for — the next plan sees the ID no longer resolves and
+the next apply creates a replacement with the same strategy set, waits for
+it to reach `ACTIVE`, and rewires the runtime to it. No import, no state
+surgery, no manual `create-memory`.
+
+Two invariants keep that safe:
+
+- **The ensure path never deletes.** Candidates in `DELETING` or `FAILED`
+  are skipped, not cleaned up. Deletion happens only through the
+  destroy-time provisioner.
+- **Healing is not a replacement.** The destroy provisioner's
+  `triggers_replace` is keyed on the memory name and region, not the ID, so
+  recovering a new ID for the same logical memory can't fire a delete.
+
+The cost of healing is the records: a recreated memory starts empty.
+Extraction refills it from subsequent conversations; nothing recovers the
+old records, because AgentCore has no export of a deleted memory.
+
 When the AWS provider adds a native resource, migrate by importing the
 existing memory ID into the new resource and removing this module's
 external data source.

package/dist/terraform/modules/app/agentcore-memory/main.tf

@@ -10,11 +10,18 @@
 #
 # **Why not a first-class resource?** The AWS provider does not (yet) expose a
 # `aws_bedrockagentcore_memory` resource type. Until it does, we drive the
-# create/find/destroy lifecycle through the `aws bedrock-agentcore-control`
+# ensure/destroy lifecycle through the `aws bedrock-agentcore-control`
 # CLI via a small shell script, and read the resulting memory ID back into
-# Terraform via `data "external"`. The script is idempotent — it lists
-# existing memories with the same name and returns the existing ID if found,
-# which keeps `terraform apply` safe to re-run.
+# Terraform via `data "external"`.
+#
+# **Self-healing.** The script is an *ensure*, not a one-shot create: it
+# probes the live resource on every plan and every apply, and recreates it
+# when it has gone missing. That matters because Terraform state can hold a
+# memory ID whose resource was deleted out-of-band (THINK-404 found dev in
+# exactly that state — SSM advertised a memory ID that GetMemory 404'd on,
+# and nothing in the module ever re-checked). The module output therefore
+# reflects the memory that actually exists right now, not the one state
+# remembers.
 #
 # **BYO override:** If you already have an AgentCore Memory resource, set
 # `var.existing_memory_id` to skip provisioning. The module output will echo
@@ -97,12 +104,15 @@ resource "aws_iam_role_policy" "memory_execution" {
 }
 
 ################################################################################
-# Create-or-find via shell script (only when no existing_memory_id was given).
+# Ensure via shell script (only when no existing_memory_id was given).
 #
 # The script produces JSON: `{"memory_id": "..."}`. Terraform re-runs it on
-# every plan — if the memory already exists, the script returns the same ID
-# without side effects. Inputs are passed as JSON on stdin; outputs MUST be
-# a single JSON object on stdout for `data "external"` to parse.
+# every plan — if an ACTIVE memory with this name already exists, the script
+# returns that same ID and only drift-corrects its strategy list; if the
+# memory is missing, unresolvable, or DELETING/FAILED, the script creates a
+# replacement and waits for it to reach ACTIVE. It never deletes anything.
+# Inputs are passed as JSON on stdin; outputs MUST be a single JSON object
+# on stdout for `data "external"` to parse.
 ################################################################################
 
 data "external" "memory" {
@@ -121,8 +131,15 @@ data "external" "memory" {
 #
 # Terraform's `data "external"` has no destroy hook, so we use a paired
 # `terraform_data` resource with a destroy-time local-exec that deletes the
-# memory by ID. `triggers_replace` binds the resource to the memory ID so
-# that replacing one memory correctly destroys the old one.
+# memory by ID.
+#
+# `triggers_replace` is deliberately keyed on the memory *name* and region,
+# NOT on the memory ID. Keying it on the ID would turn every self-heal (new
+# ID for the same logical memory) into a replacement, firing the destroy
+# provisioner against the ID the heal just recovered from — at best a no-op
+# delete of an already-gone resource, at worst a delete of the freshly
+# created one. Renaming or re-regioning the memory is a real replacement and
+# still destroys the old resource; healing is an in-place `input` update.
 ################################################################################
 
 resource "terraform_data" "memory_lifecycle" {

package/dist/terraform/modules/app/agentcore-memory/scripts/create_or_find_memory.sh

@@ -2,8 +2,9 @@
 ################################################################################
 # create_or_find_memory.sh
 #
-# Idempotent create-or-find for a Bedrock AgentCore Memory resource, plus
-# drift-correction for the strategy list on already-existing resources.
+# Idempotent **ensure** for a Bedrock AgentCore Memory resource: guarantee
+# that an ACTIVE memory with the desired strategy set exists, and return its
+# live ID. Runs on every plan and every apply.
 #
 # Input (stdin, JSON):
 #   {"name": "<logical name>", "region": "<aws-region>",
@@ -11,18 +12,34 @@
 # Output (stdout, JSON): {"memory_id": "<resource-id>"}
 #
 # Behavior:
-#   1. Lists existing memories via `aws bedrock-agentcore-control list-memories`
-#      and matches by exact `name` OR by ID starting with `name-` (the API
-#      uses `{name}-{randomSuffix}` for the resource ID, and `name` sometimes
-#      comes back null on existing resources).
-#   2. If a match exists: get-memory, diff its current strategies against the
-#      desired set, and call update-memory with addMemoryStrategies for any
-#      that are missing. This lets us add new strategies to an existing
-#      memory without destructive recreation.
-#   3. If no match: create-memory with the full desired strategy list.
+#   1. Pages through `aws bedrock-agentcore-control list-memories` and
+#      collects candidates matching by exact `name` OR by ID starting with
+#      `name-` (the API uses `{name}-{randomSuffix}` for the resource ID,
+#      and `name` sometimes comes back null on existing resources).
+#   2. Probes each candidate with `get-memory`, which is the authoritative
+#      answer. A candidate is usable only if get-memory succeeds AND its
+#      status is ACTIVE (a CREATING memory is waited out). Candidates that
+#      404, or that report DELETING / FAILED, are skipped.
+#   3. Usable candidate: diff its current strategies against the desired set
+#      and `update-memory` with addMemoryStrategies for any that are missing.
+#      Adds new strategies without destructive recreation.
+#   4. No usable candidate: `create-memory` with the full desired strategy
+#      list, then wait for ACTIVE.
 #
-# Strategy set must match memory.py:STRATEGY_NAMESPACES exactly so the
-# agent container's recall() finds records written by the extractors:
+# **Self-healing (THINK-404).** The dev memory was deleted out from under
+# Terraform while state still held its ID, so every runtime read 404'd until
+# a human noticed. Steps 1-2 are what make that unrecoverable-by-hand state
+# impossible: the ID is re-derived from a live probe on every plan, so a
+# missing or dying memory is simply recreated on the next apply and the
+# module output tracks the resource that actually exists. The probe never
+# deletes anything — teardown remains the exclusive job of the destroy-time
+# provisioner in main.tf, whose `triggers_replace` deliberately does NOT
+# include the memory ID so healing can't cascade into a delete.
+#
+# Strategy set must match the namespaces read by
+# `packages/api/src/lib/memory/adapters/agentcore-adapter.ts` and
+# `packages/agentcore-pi/agent-container/src/tools/memory.ts` so recall
+# finds records written by the extractors:
 #   semantic     -> assistant_{actorId}
 #   preferences  -> preferences_{actorId}
 #   summaries    -> session_{sessionId}
@@ -30,7 +47,8 @@
 #
 # Called from terraform/modules/app/agentcore-memory/main.tf via
 # `data "external"`. Keep stdout strictly JSON — any stray echo will break
-# Terraform's JSON parser. All diagnostics go to stderr.
+# Terraform's JSON parser. All diagnostics go to stderr. Dependencies are
+# bash, `aws`, and `jq` only, because this runs on the CI runner.
 ################################################################################
 
 set -euo pipefail
@@ -103,18 +121,123 @@ strategies_json='[
 desired_names=("semantic" "preferences" "summaries" "episodes")
 
 # ---------------------------------------------------------------------------
-# Step 1: look for an existing memory with this name
+# Helpers
 # ---------------------------------------------------------------------------
 
-existing_id="$(
-  aws bedrock-agentcore-control list-memories \
+# Echo the memory's status, or nothing at all when get-memory fails (the
+# resource is gone). get-memory — not the list output — is the authority:
+# list-memories has been observed returning IDs that no longer resolve.
+memory_status() {
+  local id="$1" out
+  # `|| true` twice, deliberately: under `set -e -o pipefail` a failing
+  # get-memory (i.e. the memory is gone — the case this whole function
+  # exists to detect) would otherwise abort the script through the command
+  # substitution that calls it.
+  out="$(aws bedrock-agentcore-control get-memory \
     --region "$region" \
-    --output json 2>/dev/null \
-    | jq -r --arg n "$name" '.memories[]? | select(.name == $n or (.id | startswith($n + "-"))) | .id' \
-    | head -n1 || true
-)"
+    --memory-id "$id" \
+    --output json 2>/dev/null || true)"
+  jq -r '.memory.status // empty' <<<"$out" 2>/dev/null || true
+  return 0
+}
+
+# Block until the memory reports ACTIVE. Returns non-zero if it never gets
+# there (deleted mid-wait, stuck in FAILED, or the wait budget expires).
+# ~5 minutes: creation is normally well under a minute.
+wait_for_active() {
+  local id="$1"
+  local status
+  for _ in $(seq 1 30); do
+    status="$(memory_status "$id")"
+    case "$status" in
+      ACTIVE) return 0 ;;
+      "" | FAILED | DELETING)
+        echo "[create_or_find_memory] $id is ${status:-gone}; not usable" >&2
+        return 1
+        ;;
+      *)
+        echo "[create_or_find_memory] $id is $status; waiting for ACTIVE" >&2
+        sleep 10
+        ;;
+    esac
+  done
+  echo "[create_or_find_memory] timed out waiting for $id to become ACTIVE" >&2
+  return 1
+}
+
+# ---------------------------------------------------------------------------
+# Step 1: find a live memory with this name
+#
+# Paginated so a large account can't hide the existing resource behind a
+# page boundary and trick us into creating a duplicate. Every candidate is
+# probed with get-memory before it is trusted — that probe is what heals a
+# memory that was deleted behind Terraform's back.
+# ---------------------------------------------------------------------------
+
+candidate_ids=()
+next_token=""
+list_err="$(mktemp)"
+trap 'rm -f "$list_err"' EXIT
+while :; do
+  set +e
+  if [[ -n "$next_token" ]]; then
+    page="$(aws bedrock-agentcore-control list-memories \
+      --region "$region" --max-results 100 --next-token "$next_token" \
+      --output json 2>"$list_err")"
+  else
+    page="$(aws bedrock-agentcore-control list-memories \
+      --region "$region" --max-results 100 \
+      --output json 2>"$list_err")"
+  fi
+  list_status=$?
+  set -e
+  # Fail loudly rather than treating an API error as "no memories exist" —
+  # that misreading would create a duplicate memory alongside the healthy
+  # one and silently split the tenant's records across two resources.
+  if [[ $list_status -ne 0 ]]; then
+    echo '{"error": "list-memories failed"}' >&2
+    cat "$list_err" >&2
+    exit "$list_status"
+  fi
+
+  while IFS= read -r id; do
+    [[ -n "$id" ]] && candidate_ids+=("$id")
+  done < <(
+    jq -r --arg n "$name" \
+      '.memories[]? | select(.name == $n or ((.id // "") | startswith($n + "-"))) | .id' \
+      <<<"$page"
+  )
+
+  next_token="$(jq -r '.nextToken // empty' <<<"$page")"
+  [[ -z "$next_token" ]] && break
+done
 
-if [[ -n "$existing_id" && "$existing_id" != "null" ]]; then
+existing_id=""
+for candidate in ${candidate_ids[@]+"${candidate_ids[@]}"}; do
+  status="$(memory_status "$candidate")"
+  case "$status" in
+    ACTIVE)
+      existing_id="$candidate"
+      break
+      ;;
+    CREATING)
+      if wait_for_active "$candidate"; then
+        existing_id="$candidate"
+        break
+      fi
+      ;;
+    "")
+      # Listed but unresolvable: the resource was deleted out from under us
+      # (exactly the state THINK-404 found dev in). Fall through to create.
+      echo "[create_or_find_memory] listed memory $candidate no longer exists; will recreate" >&2
+      ;;
+    *)
+      echo "[create_or_find_memory] skipping $candidate in status $status" >&2
+      ;;
+  esac
+done
+
+if [[ -n "$existing_id" ]]; then
   # ---------------------------------------------------------------------------
   # Step 2a: memory exists — drift-correct its strategy list
   #
@@ -128,7 +251,7 @@ if [[ -n "$existing_id" && "$existing_id" != "null" ]]; then
       --region "$region" \
       --memory-id "$existing_id" \
       --output json 2>/dev/null \
-      | jq -r '.memory.strategies[]? | .name'
+      | jq -r '.memory.strategies[]? | .name' || true
   )"
 
   missing=()
@@ -200,7 +323,7 @@ fi
 create_output=""
 create_status=1
 err_file="$(mktemp)"
-trap 'rm -f "$err_file"' EXIT
+trap 'rm -f "$err_file" "$list_err"' EXIT
 for attempt in $(seq 1 12); do
   set +e
   create_output="$(
@@ -240,4 +363,13 @@ if [[ -z "$new_id" || "$new_id" == "null" ]]; then
   exit 1
 fi
 
+# Don't hand Terraform an ID the runtime can't use yet: a memory in CREATING
+# rejects CreateEvent, and downstream SSM/runtime wiring is written in the
+# same apply.
+if ! wait_for_active "$new_id"; then
+  echo '{"error": "created memory never became ACTIVE"}' >&2
+  exit 1
+fi
+
+echo "[create_or_find_memory] created memory $new_id" >&2
 jq -nc --arg id "$new_id" '{memory_id: $id}'

package/dist/terraform/modules/app/agentcore-pi/README.md

@@ -8,7 +8,7 @@ This module owns the dedicated Pi Lambda + log group + IAM role + event-invoke c
 
 - `aws_iam_role.agentcore_pi` (`thinkwork-${stage}-agentcore-pi-role`) — assumed by Lambda + Bedrock AgentCore Runtime principals.
 - `aws_iam_role_policy.agentcore_pi` — baseline permissions (S3 skill catalog, Bedrock model invoke, AgentCore Memory + Code Interpreter, CloudWatch Logs, X-Ray ingestion, ECR pull, SSM parameter access, memory-retain Lambda invoke). Forward-compat additions for U4-U8: Aurora Data API + Secrets Manager scoped to `thinkwork-${stage}-*`.
-- `aws_iam_role_policy_attachment.agentcore_pi_vpc_access` — attached when Pi needs private-network access for the OKF EFS mount.
+- `aws_iam_role_policy_attachment.agentcore_pi_vpc_access` — retired (THINK-589): the OKF wiki EFS mount is removed, Pi is not VPC-attached, and the attachment is conditioned off pending deletion in the follow-up PR.
 - `aws_iam_role_policy.agentcore_pi_dlq_send` — `sqs:SendMessage` against the shared async DLQ (injected via `var.async_dlq_arn`).
 - `aws_cloudwatch_log_group.agentcore_pi` (`/thinkwork/${stage}/agentcore-pi`).
 - `aws_lambda_function.agentcore_pi` (`thinkwork-${stage}-agentcore-pi`) — `package_type = "Image"`, pulls `${ecr_repository_url}:pi-latest`.
@@ -43,11 +43,9 @@ The Lambda function name changes from `thinkwork-${stage}-agentcore-flue` to `th
 | `bucket_name`         | yes      | Primary S3 bucket for skills + workspace files.                                |
 | `ecr_repository_url`  | yes      | Shared ECR repo URL from `module.agentcore_platform.ecr_repository_url`.       |
 | `async_dlq_arn`       | yes      | Shared async DLQ ARN from `module.agentcore_platform.agentcore_async_dlq_arn`. |
-| `hindsight_endpoint`  | no       | Hindsight API endpoint when enabled; empty disables Hindsight tools.           |
 | `agentcore_memory_id` | no       | AgentCore Memory resource ID for auto-retention.                               |
 | `api_endpoint`        | no       | API Gateway base URL for the `/api/skills/complete` callback.                  |
 | `api_auth_secret`     | no       | Service-auth bearer for the same callback.                                     |
-| `memory_engine`       | no       | `hindsight` or `agentcore`; surfaced as `MEMORY_ENGINE` env var.               |
 
 ## Outputs
 

package/dist/terraform/modules/app/agentcore-pi/main.tf

@@ -26,34 +26,19 @@ locals {
   chat_agent_activity_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.chat_agent_activity_fn_name}"
   manifest_log_fn_name        = "thinkwork-${var.stage}-api-manifest-log"
   manifest_log_fn_arn         = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.manifest_log_fn_name}"
-  # THINK-280 U2 — capability control plane service (capability_search /
-  # connection_research Pi tools). Direct InvokeCommand, RequestResponse;
-  # no HTTP route exists for this Lambda.
-  capability_control_fn_name = "thinkwork-${var.stage}-api-capability-control-service"
-  capability_control_fn_arn  = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.capability_control_fn_name}"
+  tool_executions_fn_name     = "thinkwork-${var.stage}-api-tool-executions"
+  tool_executions_fn_arn      = "arn:aws:lambda:${var.region}:${var.account_id}:function:${local.tool_executions_fn_name}"
   # Release-backed deployments use an immutable, source-derived target tag so
   # changing the release image also changes aws_lambda_function.image_uri.
   # Reusing pi-latest lets Terraform miss the update even after ECR is retagged.
-  pi_image_tag               = var.source_image_uri != "" ? "pi-${substr(sha256(var.source_image_uri), 0, 16)}" : "pi-latest"
-  pi_image_uri               = "${var.ecr_repository_url}:${local.pi_image_tag}"
-  okf_efs_vpc_enabled        = var.okf_efs_enabled && length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
-  private_vpc_enabled        = local.okf_efs_vpc_enabled
-  private_subnet_ids         = var.okf_efs_subnet_ids
-  private_security_group_ids = var.okf_efs_security_group_ids
-  okf_efs_mount_enabled      = local.okf_efs_vpc_enabled && var.okf_efs_file_system_arn != "" && var.okf_efs_read_access_point_arn != ""
-  okf_efs_iam_statements = local.okf_efs_mount_enabled ? [
-    {
-      Sid      = "OkfWikiEfsReadOnlyMount"
-      Effect   = "Allow"
-      Action   = ["elasticfilesystem:ClientMount"]
-      Resource = var.okf_efs_file_system_arn
-      Condition = {
-        StringEquals = {
-          "elasticfilesystem:AccessPointArn" = var.okf_efs_read_access_point_arn
-        }
-      }
-    },
-  ] : []
+  pi_image_tag = var.source_image_uri != "" ? "pi-${substr(sha256(var.source_image_uri), 0, 16)}" : "pi-latest"
+  pi_image_uri = "${var.ecr_repository_url}:${local.pi_image_tag}"
+  # THINK-589 PR 1 (deprecate-to-no-op): the OKF wiki EFS feature is dead. The
+  # okf_efs_* inputs remain declared as deprecated no-ops so customer-stage
+  # passthroughs keep working, but nothing is wired regardless of their
+  # values: no VPC attach, no EFS mount, no OKF env, no EFS IAM grant.
+  # PR 2 deletes the variables outright.
+  okf_efs_mount_enabled = false
 }
 
 ################################################################################
@@ -83,7 +68,7 @@ resource "aws_iam_role_policy" "agentcore_pi" {
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = concat([
+    Statement = [
       {
         Sid    = "S3Access"
         Effect = "Allow"
@@ -264,13 +249,12 @@ resource "aws_iam_role_policy" "agentcore_pi" {
           local.chat_agent_finalize_fn_arn,
           local.chat_agent_activity_fn_arn,
           local.manifest_log_fn_arn,
-          local.capability_control_fn_arn,
+          local.tool_executions_fn_arn,
         ]
       },
       {
-        # Aurora Data API — U4 SessionStore and Hindsight exact-memory recall
-        # read/write via the RDS Data API rather than long-lived Postgres
-        # connections. Cover both the canonical cluster name and suffixed
+        # Aurora Data API — U4 SessionStore reads/writes via the RDS Data
+        # API rather than long-lived Postgres connections. Cover both the canonical cluster name and suffixed
         # replacement names.
         Sid    = "AuroraDataAPI"
         Effect = "Allow"
@@ -299,12 +283,16 @@ resource "aws_iam_role_policy" "agentcore_pi" {
         ]
         Resource = "arn:aws:secretsmanager:${var.region}:${var.account_id}:secret:thinkwork-${var.stage}-*"
       },
-    ], local.okf_efs_iam_statements)
+    ]
   })
 }
 
+# THINK-589 retired this with the OKF wiki EFS mount (Pi's only VPC
+# attachment at the time). THINK-1082 brings it back for the network-only
+# in_vpc lane: a VPC-attached function needs the ENI grant. Still never
+# created when in_vpc is off.
 resource "aws_iam_role_policy_attachment" "agentcore_pi_vpc_access" {
-  count = local.private_vpc_enabled ? 1 : 0
+  count = var.in_vpc ? 1 : 0
 
   role       = aws_iam_role.agentcore_pi.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
@@ -384,51 +372,53 @@ resource "aws_lambda_function" "agentcore_pi" {
       AWS_LWA_PORT                           = "8080"
       AGENTCORE_MEMORY_ID                    = var.agentcore_memory_id
       AGENTCORE_FILES_BUCKET                 = var.bucket_name
-      MEMORY_ENGINE                          = var.memory_engine
+      MEMORY_ENGINE                          = "agentcore"
       REQUESTER_IDLE_MEMORY_LEARNING_ENABLED = tostring(var.requester_idle_memory_learning_enabled)
       MEMORY_RETAIN_FN_NAME                  = local.memory_retain_fn_name
       CHAT_AGENT_FINALIZE_FN_NAME            = local.chat_agent_finalize_fn_name
       CHAT_AGENT_ACTIVITY_FN_NAME            = local.chat_agent_activity_fn_name
       MANIFEST_LOG_FUNCTION_NAME             = local.manifest_log_fn_name
-      CAPABILITY_CONTROL_FN_NAME             = local.capability_control_fn_name
-      HINDSIGHT_ENDPOINT                     = var.hindsight_endpoint
-      # THINK-220 cutover flag — see the variable description.
-      HINDSIGHT_DATABASE_NAME = var.hindsight_database_name
-      THINKWORK_API_URL       = var.api_endpoint
-      API_AUTH_SECRET         = var.api_auth_secret
+      TOOL_EXECUTIONS_FUNCTION_NAME          = local.tool_executions_fn_name
+      THINKWORK_API_URL                      = var.api_endpoint
+      API_AUTH_SECRET                        = var.api_auth_secret
       # Plan §005 U4 — AuroraSessionStore uses the RDS Data API to persist
       # Pi's SessionData blobs against threads.session_data. Empty during
       # the first greenfield apply (DB cluster doesn't exist yet); the
       # constructor fail-closes if either is missing at runtime.
-      DB_CLUSTER_ARN             = var.db_cluster_arn
-      DB_SECRET_ARN              = var.db_secret_arn
-      OKF_WIKI_NAVIGATOR_ENABLED = tostring(local.okf_efs_mount_enabled)
+      DB_CLUSTER_ARN = var.db_cluster_arn
+      DB_SECRET_ARN  = var.db_secret_arn
       # THINK-173 U6: PUBLIC key only — the container verifies capability
       # manifests and must never hold signing material (KTD-3).
       CAPABILITY_SIGNING_PUBLIC_KEY = var.capability_signing_public_key
-      OKF_WIKI_ROOT                 = var.okf_efs_mount_path
       # Per-model Bedrock region overrides, honored by the patched pi-ai
       # provider (patches/@earendil-works__pi-ai). SigV4 signing and endpoint
       # selection both follow the override.
       PI_BEDROCK_MODEL_REGIONS = jsonencode(var.pi_bedrock_model_regions)
+      # THINK-324: 1-hour Bedrock prompt-cache TTL (pi-ai resolveCacheRetention).
+      # The default 5-minute TTL made any thread idle >5 min pay full uncached
+      # input on its next turn.
+      PI_CACHE_RETENTION = "long"
     }
   }
 
+  # THINK-589: the OKF wiki EFS mount (and the VPC attachment that existed
+  # solely to reach it) is removed — no file_system_config, ever.
+  # THINK-1082: the VPC attachment returns as a NETWORK-ONLY lane so Pi can sit
+  # behind the api-lambda security group with the rest of the agent's database
+  # clients. Absent entirely when in_vpc is off.
   dynamic "vpc_config" {
-    for_each = local.private_vpc_enabled ? [1] : []
+    for_each = var.in_vpc ? [1] : []
 
     content {
-      subnet_ids         = local.private_subnet_ids
-      security_group_ids = local.private_security_group_ids
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
     }
   }
 
-  dynamic "file_system_config" {
-    for_each = local.okf_efs_vpc_enabled ? [1] : []
-
-    content {
-      arn              = var.okf_efs_read_access_point_arn
-      local_mount_path = var.okf_efs_mount_path
+  lifecycle {
+    precondition {
+      condition     = !var.in_vpc || (length(var.vpc_subnet_ids) > 0 && length(var.vpc_security_group_ids) > 0)
+      error_message = "in_vpc requires non-empty vpc_subnet_ids and vpc_security_group_ids."
     }
   }
 

package/dist/terraform/modules/app/agentcore-pi/outputs.tf

@@ -23,16 +23,16 @@ output "agentcore_pi_log_group_name" {
 }
 
 output "okf_wiki_mount_enabled" {
-  description = "Whether the OKF wiki EFS view is mounted into the Pi Lambda."
+  description = "DEPRECATED (THINK-589): always false — the OKF wiki EFS view is never mounted into the Pi Lambda. Removal pending (PR 2)."
   value       = local.okf_efs_mount_enabled
 }
 
 output "okf_wiki_mount_path" {
-  description = "Pi local mount path for the OKF wiki EFS view."
+  description = "DEPRECATED (THINK-589): inert echo of the deprecated okf_efs_mount_path input; nothing is mounted. Removal pending (PR 2)."
   value       = var.okf_efs_mount_path
 }
 
 output "okf_wiki_read_access_point_arn" {
-  description = "EFS access point ARN mounted by Pi for read-only OKF wiki traversal."
+  description = "DEPRECATED (THINK-589): inert echo of the deprecated okf_efs_read_access_point_arn input; nothing is mounted. Removal pending (PR 2)."
   value       = var.okf_efs_read_access_point_arn
 }