thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -43,15 +43,6 @@ locals {
       "msteams-install-complete",
       "msteams-account-link-complete",
     ],
-    var.enable_agentcore_multiplayer_proof ? [] : [
-      "turn-assertion-mint",
-      "agentcore-proof-oauth-provider",
-      "agentcore-identity-boundary-target",
-      "harness-capability-mcp",
-      "harness-code-interpreter-target",
-      "harness-builtin-tools-target",
-      "harness-platform-tools-target",
-    ],
   )
 
   # Config-class configuration shared by all API handlers. As of plan
@@ -75,33 +66,39 @@ locals {
     SUBSCRIPTION_TICKET_PUBLIC_KEYS        = var.subscription_ticket_public_keys
     SUBSCRIPTION_TICKET_PRIVATE_KEY_SECRET = var.subscription_ticket_private_key_secret
     APPSYNC_API_ID                         = var.appsync_api_id
-    # THINK-229 U3/KTD5 — the analyst policy-source enforcement flip.
-    # "row" (default) keeps sidecar policy shadow-only; "sidecar" makes the
-    # signed sidecar block authoritative (budgets/policyClaims flow). Flip
-    # ONLY after clean shadow parity on live traffic.
-    ANALYST_POLICY_SOURCE = var.analyst_policy_source
-    # Governed autonomy — per-tenant opt-in allowlist for autonomous capability
-    # self-extension (the two self_admit_connection / self_approve_routine
-    # actions on capability-control-service). Comma/space-separated tenant ids;
-    # empty (default) = NO tenant enabled, so self-extension ships inert and
-    # fail-closed. Read via getConfig() (env-wins) in isSelfExtensionEnabled.
-    CAPABILITY_SELF_EXTENSION_TENANTS = var.capability_self_extension_tenants
-    # THINK-230 — the operator-facing provisionAnalystConnector mutation runs
-    # the analyst connector provisioning ceremony inside graphql-http, so the
-    # shared api handlers read the same broker-secret ARN + rds_iam connect
-    # config the analyst-query-broker handler carries per-handler. Read via
-    # getConfig() (env-wins), never process.env (runtime-config fixture gate).
-    # ANALYST_DB_CLUSTER_ENDPOINT gates on the resource id so a stage without
-    # the IAM grant leaves rds_iam provisioning off (resolveAnalystRdsIamConfig
-    # returns null) instead of half-seeding a credential row.
-    ANALYST_BROKER_SECRET_ARN      = var.analyst_broker_secret_arn
-    ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
-    ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
-    ANALYST_DB_NAME                = var.database_name
-    ANALYST_DB_USER                = "analyst_reader"
-    DATABASE_SECRET_ARN            = var.graphql_db_secret_arn
-    DATABASE_HOST                  = var.db_cluster_endpoint
-    DATABASE_NAME                  = var.database_name
+    # THINK-585 U6 (KTD3): stage kill-switch for AgentCore Runtime chat
+    # dispatch. Empty when off (stripped from the document — getConfig sees
+    # unset). The per-agent agents.agentcore_runtime_dispatch flag gates on
+    # top; both must be on for a turn to ride the dispatcher.
+    AGENTCORE_RUNTIME_DISPATCH_ENABLED = var.agentcore_runtime_dispatch_enabled ? "true" : ""
+    # Neptune endpoint for the
+    # identity-graph-projector's nudge gate (THINK-339 U15: the twin READ
+    # Lambdas retired to the platform service; the write/projection lane
+    # stays product-side — the platform identity_sync pipeline invokes it).
+    # Document, not env: graphql-http's env sits near the 4KB ceiling.
+    # Readers use getConfig; env still wins on the VPC projector.
+    NEPTUNE_ENDPOINT = var.neptune_endpoint
+    # Consolidation U14: platform-served Brain MCP endpoint. When set,
+    # mcp-twin-provision registers the twin connector against it instead
+    # of the product /mcp/twin route. Empty = legacy default.
+    BRAIN_MCP_URL = var.brain_mcp_url
+    # THINK-781: Brain ops-api base URL + the agent-identity m2m secret the
+    # flagThreadToBrain resolver posts /flags with. NOT the /mcp lane pair
+    # above — POST /flags verifies against the Brain's operator pool, so it
+    # needs the etl-platform/agent/cognito-m2m-brain credential (scope
+    # etl-agent/tasks), not the brain-mcp platform-agent lane. Empty = the
+    # "Send to the Brain" action fails with "no Brain connection configured".
+    BRAIN_OPS_API_URL        = var.brain_ops_api_url
+    BRAIN_OPS_M2M_SECRET_ARN = var.brain_ops_m2m_secret_arn
+    # Same class of bug, second instance (2026-07-22): a post-apply
+    # twin-export hook read BRAIN_ARTIFACTS_BUCKET from env it never had
+    # and silently returned skipped_no_bucket on every apply.
+    # Document-served so every api handler resolves it via getConfig; the
+    # handlers that already carry it as env keep winning.
+    BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+    DATABASE_SECRET_ARN    = var.graphql_db_secret_arn
+    DATABASE_HOST          = var.db_cluster_endpoint
+    DATABASE_NAME          = var.database_name
     # THINK-280 U8: the LAST rollout gate. External capability search + the
     # Inspector governed-runtime operation layer stay inert until the broker is
     # enabled for the stage. Off by default — read via getConfig() (env-wins).
@@ -120,9 +117,17 @@ locals {
     COGNITO_AUTH_BASE_URL       = local.mcp_oauth_cognito_base_url
     MCP_OAUTH_CALLBACK_URL      = "${local.mcp_oauth_api_base_url}/mcp/oauth/callback"
     MCP_OAUTH_REVOCATIONS_TABLE = aws_dynamodb_table.mcp_oauth_revocations.name
-    COGNITO_APP_CLIENT_IDS      = "${var.admin_client_id},${var.mobile_client_id}"
-    APPSYNC_ENDPOINT            = var.appsync_api_url
-    THINKWORK_API_URL           = local.api_base_url
+    # THINK-643: backing store for short-lived auth-flow state. While this is
+    # "postgres" the auth handlers never touch DynamoDB and AUTH_STATE_TABLE is
+    # empty (no table exists). Read via getConfig() — never process.env.
+    AUTH_STATE_STORE = var.auth_state_store
+    AUTH_STATE_TABLE = local.auth_state_enabled ? aws_dynamodb_table.auth_state[0].name : ""
+    # R16: comma-separated app-client allowlist. The optional console client id
+    # (U13) joins only when enabled; compact() drops the empty placeholder so
+    # the value is byte-identical to before while the console is off.
+    COGNITO_APP_CLIENT_IDS = join(",", compact([var.admin_client_id, var.mobile_client_id, var.console_client_id]))
+    APPSYNC_ENDPOINT       = var.appsync_api_url
+    THINKWORK_API_URL      = local.api_base_url
     # Deterministic routines v1 (plan 2026-07-03-004 U6): activates the
     # git-backed routine lifecycle tool suite on the admin-ops MCP server
     # (routine_repo_list/read/commit, routine_run_fixtures, routine_runs).
@@ -156,13 +161,11 @@ locals {
     # WORKSPACE_RENDERER_FUNCTION_NAME is derived from the per-stage naming
     # convention by deriveFunctionName("workspace-renderer") — stored
     # nowhere (R7).
-    WORKSPACE_BUCKET   = var.bucket_name
-    HINDSIGHT_ENDPOINT = var.hindsight_endpoint
-    # THINK-220 cutover flag: empty = hindsight schema on the primary DB;
-    # set = that database's public schema via the database-pg seam.
-    HINDSIGHT_DATABASE_NAME = var.hindsight_database_name
-    AGENTCORE_MEMORY_ID     = var.agentcore_memory_id
-    MEMORY_ENGINE           = var.memory_engine
+    WORKSPACE_BUCKET    = var.bucket_name
+    AGENTCORE_MEMORY_ID = var.agentcore_memory_id
+    # AgentCore managed memory is the only engine (THINK-407). The env var
+    # stays so the API's memory config seam keeps an explicit value.
+    MEMORY_ENGINE = "agentcore"
     # CHAT_AGENT_INVOKE_FN_ARN (~112 serialized bytes) was dropped for the
     # 4KB env ceiling (#2375): getChatAgentInvokeFnArn and managed-dispatch
     # now derive the ARN from the deterministic naming pattern
@@ -178,7 +181,6 @@ locals {
     # deploymentStatus reads ADMIN_URL directly — so the single canonical
     # ADMIN_URL is sufficient. Re-add aliases only after env vars move to SSM.
     ADMIN_URL            = var.admin_url
-    DOCS_URL             = var.docs_url
     APPSYNC_REALTIME_URL = var.appsync_realtime_url
     ECR_REPOSITORY_URL   = var.ecr_repository_url
     # Per-user OAuth wiring (Google Workspace today; Microsoft 365 follow-up).
@@ -264,20 +266,7 @@ locals {
   # THINK-316 U1: the assertion mint runs on a sibling role and receives only
   # the database connection plus immutable stage identity. In particular it
   # does not inherit API_AUTH_SECRET or APPSYNC_API_KEY from common_env.
-  turn_assertion_mint_env = {
-    STAGE          = var.stage
-    DATABASE_URL   = "postgresql://${var.db_username}:${urlencode(var.db_password)}@${var.db_cluster_endpoint}:5432/${var.database_name}?sslmode=no-verify"
-    AWS_ACCOUNT_ID = var.account_id
-    NODE_OPTIONS   = "--enable-source-maps"
-  }
 
-  # THINK-316 U1: the synthetic provider/target are proof-only public
-  # boundaries. They receive no database URL, platform bearer, or AppSync key.
-  agentcore_proof_boundary_env = {
-    STAGE          = var.stage
-    AWS_ACCOUNT_ID = var.account_id
-    NODE_OPTIONS   = "--enable-source-maps"
-  }
 
   # Per-handler env-var overrides. ARNs are constructed from the naming
   # pattern (same trick as the api-cross-function-invoke statement in
@@ -292,70 +281,12 @@ locals {
   }
 
   handler_extra_env = {
-    # THINK-316 U1: short-lived, server-minted identity assertions for
-    # AgentCore Harness and Gateway. The public mcp-oauth handler receives the
-    # key id only to publish GetPublicKey-derived JWKS; its role cannot Sign.
-    "mcp-oauth" = {
-      AGENTCORE_TURN_ASSERTION_ISSUER = local.agentcore_turn_assertion_issuer
-      AGENTCORE_TURN_ASSERTION_JWKS_KEYS = jsonencode([
-        for key in values(local.agentcore_turn_assertion_keys) : {
-          keyId = key.key_id
-          kid   = key.kid
-        }
-      ])
-    }
     "skills" = {
       AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
       AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
       AGENTCORE_USER_OAUTH_RETURN_URL           = "${local.mcp_oauth_api_base_url}/api/skills/mcp-oauth/agentcore/complete"
       AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
     }
-    "turn-assertion-mint" = {
-      AGENTCORE_TURN_ASSERTION_ISSUER     = local.agentcore_turn_assertion_issuer
-      AGENTCORE_HARNESS_AUDIENCE          = local.agentcore_harness_audience
-      AGENTCORE_GATEWAY_AUDIENCE          = local.agentcore_gateway_audience
-      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.agentcore_turn_assertion_active_key.key_id
-      AGENTCORE_TURN_ASSERTION_KID        = local.agentcore_turn_assertion_active_key.kid
-    }
-    "agentcore-proof-oauth-provider" = {
-      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
-      AGENTCORE_PROOF_OAUTH_CLIENT_ID     = var.agentcore_proof_oauth_client_id
-      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
-      AGENTCORE_ASSERTION_ISSUER          = local.agentcore_turn_assertion_issuer
-      AGENTCORE_HARNESS_AUDIENCE          = local.agentcore_harness_audience
-      AGENTCORE_GATEWAY_AUDIENCE          = local.agentcore_gateway_audience
-      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.agentcore_turn_assertion_active_key.key_id
-      AGENTCORE_TURN_ASSERTION_KID        = local.agentcore_turn_assertion_active_key.kid
-      AGENTCORE_PROOF_OWNER_ALLOWLIST     = var.agentcore_proof_owner_allowlist
-    }
-    "agentcore-identity-boundary-target" = {
-      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
-      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
-      AGENTCORE_PROOF_OWNER_ALLOWLIST     = var.agentcore_proof_owner_allowlist
-    }
-    "harness-capability-mcp" = {
-      AGENTCORE_PROOF_OAUTH_ISSUER              = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
-      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET       = var.agentcore_proof_oauth_client_secret
-      AGENTCORE_GATEWAY_POLICY_REVISION         = "mcp-list-call-v2-tenant-admission"
-      AGENTCORE_IDENTITY_WORKLOAD_NAME          = "thinkwork-${var.stage}-multiplayer-proof"
-      AGENTCORE_TWENTY_CREDENTIAL_PROVIDER_NAME = "thinkwork-${var.stage}-twenty-crm"
-      AGENTCORE_TWENTY_OAUTH_RESOURCE           = "https://crm.thinkwork.ai/mcp"
-    }
-    "harness-code-interpreter-target" = {
-      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
-      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
-      AGENTCORE_GATEWAY_POLICY_REVISION   = "sandbox-execute-v1-tenant-admission"
-    }
-    "harness-builtin-tools-target" = {
-      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
-      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
-      AGENTCORE_GATEWAY_POLICY_REVISION   = "builtin-web-v1-tenant-admission"
-    }
-    "harness-platform-tools-target" = {
-      AGENTCORE_PROOF_OAUTH_ISSUER        = "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth"
-      AGENTCORE_PROOF_OAUTH_CLIENT_SECRET = var.agentcore_proof_oauth_client_secret
-      AGENTCORE_GATEWAY_POLICY_REVISION   = "platform-tools-v4-user-questions"
-    }
     "workos-auth" = {
       # During cutover/soak the callback, bridge, and logout paths remain for
       # already-issued state, but the handler independently refuses every new
@@ -371,40 +302,6 @@ locals {
     "auth-enrollment" = {
       AUTH_MIGRATION_RECOVERY_DEADLINE = var.auth_migration_recovery_deadline
     }
-    # Analyst query broker (THINK-228 U3). Reader role + caller credential
-    # secrets, and the workspace bucket's analyst-staging/ prefix for
-    # large-result CSVs (lifecycle TTL lives on the bucket module). The
-    # shared writer DATABASE_SECRET_ARN also lands in this handler's env
-    # via common_env, but the broker code never uses it — SQL runs only as
-    # analyst_reader.
-    "analyst-query-broker" = {
-      ANALYST_READER_SECRET_ARN = var.analyst_reader_secret_arn
-      ANALYST_BROKER_SECRET_ARN = var.analyst_broker_secret_arn
-      ANALYST_STAGING_BUCKET    = var.bucket_name
-      ANALYST_STAGING_PREFIX    = "analyst-staging"
-      # THINK-229 U1: RDS IAM connect config. Endpoint presence switches
-      # analyst-reader-db.ts to the IAM-token path (password secret above
-      # is the pre-GRANT-rds_iam fallback, retired once IAM is proven).
-      # Gated on the resource ID so a stage without the IAM grant keeps
-      # the password path instead of failing into the fallback every cold
-      # start.
-      ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
-      ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
-      ANALYST_DB_NAME                = var.database_name
-      ANALYST_DB_USER                = "analyst_reader"
-    }
-    # THINK-229 U5 — the connection reconciler probes the analyst_reader
-    # connection EXACTLY as the broker does (getAnalystReaderClient), so it
-    # needs the same IAM-connect config + the password-fallback secret. The
-    # shared lambda execution role already holds rds-db:connect on the
-    # analyst_reader dbuser (iam-grouped.tf, granted in U1), so no extra IAM.
-    "analyst-connection-reconciler" = {
-      ANALYST_READER_SECRET_ARN      = var.analyst_reader_secret_arn
-      ANALYST_DB_CLUSTER_ENDPOINT    = var.analyst_db_cluster_resource_id != "" ? var.db_cluster_endpoint : ""
-      ANALYST_DB_CLUSTER_RESOURCE_ID = var.analyst_db_cluster_resource_id
-      ANALYST_DB_NAME                = var.database_name
-      ANALYST_DB_USER                = "analyst_reader"
-    }
     # THINK-246: customer stages cannot send as the dev fallback domain
     # (noreply@agents.thinkwork.ai is only verified in the dev account) —
     # observed live on TEI as ses_send_failed on the deliver step.
@@ -447,46 +344,6 @@ locals {
       CAPABILITY_BROKER_VPCE_DNS      = var.capability_broker_vpce_dns
       CAPABILITY_BROKER_SESSION_TABLE = var.capability_broker_session_table
     }
-    # Compounding Memory compile Lambda. Any Converse-compatible Bedrock
-    # model works; the planner + section-writer cap themselves at ~500
-    # records / 25 new pages per invocation so a 480 s timeout covers
-    # the worst case comfortably. Env vars come from variables so
-    # unrelated deploys don't wipe them back to defaults (the aggregation
-    # flag got reset on every terraform apply before this was pinned).
-    "wiki-compile" = {
-      BEDROCK_MODEL_ID                   = var.wiki_compile_model_id
-      WIKI_AGGREGATION_PASS_ENABLED      = var.wiki_aggregation_pass_enabled
-      WIKI_DETERMINISTIC_LINKING_ENABLED = var.wiki_deterministic_linking_enabled
-      # Wiki pipeline source dispatch (plan 2026-06-09-004 U10):
-      # 'planner' (default, LLM compile) | 'graph' (deterministic
-      # graph→wiki materializer over the knowledge-graph mirror).
-      WIKI_SOURCE = var.wiki_source
-      # Name (not value) of the SecureString SSM parameter that holds the
-      # Google Places API key. wiki-compile fetches + caches on cold start.
-      # The parameter may contain a placeholder value at apply time — the
-      # Lambda logs and degrades gracefully if decryption returns empty.
-      GOOGLE_PLACES_SSM_PARAM_NAME = "/thinkwork/${var.stage}/google-places/api-key"
-      # THINK-200 chain: a successful compile Event-invokes okf-materialize
-      # so the OKF projection (and, chained, the Pi navigator's EFS view)
-      # stays current without manual invocation.
-      OKF_MATERIALIZE_FN_NAME = "thinkwork-${var.stage}-api-okf-materialize"
-    }
-    "ontology-scan" = {
-      BEDROCK_MODEL_ID = var.wiki_compile_model_id
-    }
-    "wiki-export" = {
-      WIKI_EXPORT_BUCKET     = aws_s3_bucket.wiki_exports.bucket
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-    }
-    "okf-materialize" = {
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-      # THINK-200 chain: fresh bundles fan out to the EFS current view.
-      OKF_EFS_REFRESH_FN_NAME = "thinkwork-${var.stage}-api-okf-efs-refresh"
-    }
-    "okf-efs-refresh" = {
-      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
-      OKF_EFS_ROOT           = var.okf_efs_mount_path
-    }
     # THINK-193 U1 (Codex F6): normalized evidence snapshots live in the
     # encrypted brain-artifacts bucket under evidence-snapshots/ — Postgres
     # keeps only the s3:// ref + hash. 30-day lifecycle expiration below.
@@ -517,58 +374,72 @@ locals {
       CONTEXT_ENGINE_MEMORY_QUERY_MODE = "reflect"
       CONTEXT_ENGINE_MEMORY_TIMEOUT_MS = "20000"
     }
-    # Agent graph access (plan 2026-06-09-004 U8): stage gate for the Pi
-    # knowledge_graph_search tool; the per-agent tool policy gates on top.
+    "agentcore-runtime-dispatch" = {
+      # THINK-585 U6: the dispatcher resolves the Pi runtime id from SSM
+      # (5-min cache) and derives the ARN from identity env. Stage-scoped
+      # param name is config, not identity — env is the right layer.
+      AGENTCORE_PI_RUNTIME_SSM_NAME = "/thinkwork/${var.stage}/agentcore/runtime-id-pi"
+      # THINK-909: runtime session scope. "thread" (default) keys the
+      # AgentCore session per thread — today's behavior. "user" keys it per
+      # (tenant, agent, user) so a new thread reuses the warm microVM, with
+      # an immediate per-thread fallback on a 409. Flip a stage to "user"
+      # ONLY after its Pi runtime image dual-accepts both session ids.
+      AGENTCORE_SESSION_SCOPE = var.agentcore_session_scope
+    }
     "chat-agent-invoke" = {
-      KNOWLEDGE_GRAPH_TOOL_ENABLED = tostring(var.knowledge_graph_tool_enabled)
+      # THINK-324 C18: mint the signed-turn assertion with the active key.
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+      # THINK-321 U5: stage gate for the Pi identity-resolution tools; the
+      # per-agent tool policy gates on top. Mirrored on wakeup-processor so
+      # wakeup turns carry the same payload flag (env-gated feature is dead
+      # in deployed stacks without the terraform var).
+      IDENTITY_RESOLUTION_ENABLED = tostring(var.identity_resolution_tool_enabled)
       # THINK-311 U5: no HARNESS_RUNNER_FUNCTION_NAME env — derivable
       # thinkwork-<stage>-api-* names never ride env (R1/R10 identity-only
       # rule); resolveRuntimeFunctionName derives it from STAGE at call
       # time, exactly like workspace-renderer.
     }
+    # THINK-321 U5: wakeup turns read the same identity-resolution stage
+    # gate as chat-agent-invoke (both payload builders emit
+    # identity_resolution_enabled).
+    "wakeup-processor" = {
+      # THINK-324 C18: wakeup dispatches mint the same signed-turn assertion.
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+      IDENTITY_RESOLUTION_ENABLED         = tostring(var.identity_resolution_tool_enabled)
+    }
+    # THINK-324 C18/C19: the ledger endpoint verifies presented assertions
+    # with the cached public key of the same active mint key. Required mode:
+    # its only producer (the Pi tool-execution emitter) echoes the assertion
+    # since C18, so assertion-less ledger writes are refused. Verifier
+    # unavailability still degrades to bearer-only (never a write outage);
+    # a mint failure at dispatch costs that turn's evidence, logged loudly.
+    "tool-executions" = {
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+      TURN_ASSERTION_REQUIRED             = "true"
+    }
+    # THINK-324 C19: activity + finalize verify presented assertions
+    # (tolerant posture — legacy producers don't echo yet).
+    "chat-agent-activity" = {
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+    }
+    "chat-agent-finalize" = {
+      AGENTCORE_TURN_ASSERTION_KMS_KEY_ID = local.turn_assertion_active_key_arn
+    }
     # THINK-316 U5: the runner reads the server-only attested profile and
     # invokes its named endpoint with a purpose-bound CUSTOM_JWT. It receives
     # no Harness control-plane inputs or permissions.
-    "harness-runner" = {}
-    # 240s: sync Hindsight retain (LLM extraction + auto-consolidation) can
-    # exceed 60s; the client timeout must stay below the Lambda timeout (300s)
-    # and below the Hindsight ALB idle_timeout (300s) so failures classify as
-    # client timeouts, never ALB 504s.
-    "memory-retain" = {
-      HINDSIGHT_TIMEOUT_MS = "240000"
-    }
-    "brain-dream-state" = {
-      BRAIN_DREAM_STATE_ENABLED = tostring(var.brain_dream_state_enabled)
-    }
-    # Bedrock KB provisioning. Per-handler (not common_env) so these don't bloat
-    # the already-near-4KB graphql-http env. Bedrock's RDS-backed KB needs the
-    # cluster ARN + the KB service role (passed at CreateKnowledgeBase time).
-    "knowledge-base-manager" = {
-      KB_SERVICE_ROLE_ARN  = var.kb_service_role_arn
-      DATABASE_CLUSTER_ARN = var.db_cluster_arn
-    }
-    # Observations → Knowledge Graph worker. Extraction is now a Bedrock
-    # structured-output call inside this Lambda. KG_EXTRACTION_MODEL_ID pins
-    # the gpt-oss extraction model (Bedrock IAM via the shared lambda_bedrock
-    # invoke policy, same as the promotion-gate classifier).
-    "knowledge-graph-observations-ingest" = {
-      BRAIN_ARTIFACTS_BUCKET          = aws_s3_bucket.brain_artifacts.bucket
-      OBSERVATION_CLASSIFIER_MODEL_ID = var.observation_classifier_model_id
-      KG_EXTRACTION_MODEL_ID          = var.kg_extraction_model_id
-      # Per-run candidate cap bounds classifier + extraction cost; a
-      # truncated backlog drains via an in-process loop inside one
-      # invocation (never Lambda self-invoke — AWS recursive-loop
-      # detection terminates worker-to-self Event chains).
-      KG_OBS_MAX_CANDIDATES_PER_RUN = var.kg_obs_max_candidates_per_run
-      # THINK-193 U4 dead-handoff fix: a successful observations ingest
-      # enqueues the tenant graph wiki-compile job inside its own commit
-      # and Event-invokes wiki-compile post-commit. WIKI_SOURCE must match
-      # the wiki-compile handler's dispatch flag (stage-global); the
-      # per-tenant kill switch stays tenants.wiki_compile_enabled. The
-      # invoke rides the shared lambda role's existing wiki-compile
-      # lambda:InvokeFunction grant (iam-grouped.tf); the function name is
-      # derived from STAGE (common_env) at call time.
-      WIKI_SOURCE = var.wiki_source
+    # 240s: a sync memory retain (LLM extraction + consolidation) can exceed
+    # 60s; the client timeout must stay below the Lambda timeout.
+    # Company Brain U5: Neptune coordinates for the twin graph projector.
+    # Empty endpoint leaves the projector inert (nudge helper skips too).
+    "identity-graph-projector" = {
+      NEPTUNE_ENDPOINT       = var.neptune_endpoint
+      NEPTUNE_PORT           = "8182"
+      BRAIN_ARTIFACTS_BUCKET = aws_s3_bucket.brain_artifacts.bucket
+      # Bulk-rebuild lane (THINK-331): loader staging coordinates. Empty =
+      # bulk-rebuild mode returns a structured "not configured" error.
+      NEPTUNE_LOAD_BUCKET     = var.neptune_load_bucket
+      NEPTUNE_LOADER_ROLE_ARN = var.neptune_loader_role_arn
     }
     # routine-task-python (Phase B U6) needs the AgentCore code-interpreter
     # id + the per-stage S3 routine-output bucket. The interpreter id is
@@ -704,10 +575,17 @@ resource "aws_lambda_function" "skill_trust_runner" {
 # Helper: creates Lambda functions from a local zip directory or release S3 keys
 # ---------------------------------------------------------------------------
 
-resource "aws_lambda_function" "handler" {
-  for_each = local.deploy_lambda_handlers ? setsubtract(toset([
+# The set of api handlers this module deploys (the for_each source for
+# aws_lambda_function.handler). Hoisted into a local so the per-handler VPC
+# placement map below (THINK-1082) can be built over the same names.
+locals {
+  handler_names = local.deploy_lambda_handlers ? setsubtract(toset([
     "graphql-http",
     "chat-agent-invoke",
+    # THINK-585 U6: thin waiting dispatcher (InvokeAgentRuntime, held
+    # connection) + its DLQ redrive consumer (see dispatch-dlq.tf).
+    "agentcore-runtime-dispatch",
+    "agentcore-dispatch-dlq-redrive",
     # Mobile agent harness: cloud Bedrock Converse proxy + completed-turn
     # persistence. Routes for these live in local.api_routes; the function
     # names must also be listed here (this set is the for_each source for
@@ -728,13 +606,6 @@ resource "aws_lambda_function" "handler" {
     # Client Engagement app API. Calls Twenty REST API directly server-side;
     # it is not backed by ThinkWork GraphQL or the agent MCP runtime.
     "twenty-client-engagement",
-    # Desktop-local Pi tombstone endpoints. Kept temporarily so old packaged
-    # desktop clients receive a stable 410 while all supported Pi execution
-    # routes through managed AgentCore.
-    "desktop-runtime-session",
-    "desktop-workspace-prewarm",
-    "managed-delegation",
-    "desktop-eval-runs",
     # chat-agent-finalize — POST /api/threads/{threadId}/finalize. The
     # AgentCore runtime POSTs here at end-of-turn so the post-AgentCore
     # bookkeeping (cost recording, message insert, AppSync notify,
@@ -743,23 +614,14 @@ resource "aws_lambda_function" "handler" {
     # Bearer API_AUTH_SECRET. Idempotent on thread_turns.finalized_at
     # (migration 0123). Plan: 2026-05-22-006.
     "chat-agent-finalize",
-    # harness-runner — THINK-311 U5: Event-mode target for harness-flagged
     # agents. The chat dispatch selector (resolveRuntimeFunctionName) routes
     # a trial agent's turn here instead of the Pi container Lambda; the
     # runner projects the payload into an AWS AgentCore Harness config,
     # drives InvokeHarness, fulfills emit_document, and finalizes the turn
     # via processFinalize. No API route — direct Event invoke only.
-    "harness-runner",
     # THINK-316 U1: direct-invoke-only assertion mint. It derives all identity
     # claims from the persisted turn tuple and signs with a dedicated KMS key;
     # there is intentionally no public API Gateway route.
-    "turn-assertion-mint",
-    "agentcore-proof-oauth-provider",
-    "agentcore-identity-boundary-target",
-    "harness-capability-mcp",
-    "harness-code-interpreter-target",
-    "harness-builtin-tools-target",
-    "harness-platform-tools-target",
     # canvas-refresh — headless Living Artifacts data-refresh (THINK-145 U6).
     # Invoked RequestResponse by the refreshCanvasData mutation (graphql-http)
     # and by job-trigger's canvas_refresh branch (U7). Re-runs the saved
@@ -815,6 +677,9 @@ resource "aws_lambda_function" "handler" {
     "mcp-open-engine",
     # THINK-280 U8: scoped external capability search MCP facade.
     "mcp-capability-search",
+    # THINK-333 / consolidation U14: provisions the tenant Brain MCP
+    # connector against the platform endpoint (BRAIN_MCP_URL).
+    "mcp-twin-provision",
     "activity",
     "routines",
     "budgets",
@@ -829,11 +694,6 @@ resource "aws_lambda_function" "handler" {
     "webhooks-admin",
     "webhook-deliveries-cleanup",
     "skill-runs-reconciler",
-    # THINK-229 U5 — probes the analyst_reader connection (reachability, IAM
-    # auth, SELECT-grant introspection, schema drift; all read-only) every 30
-    # min and stamps the verdict onto runtime_metadata.analyst_probe so
-    # dispatch can withhold a failing/stale connection loudly.
-    "analyst-connection-reconciler",
     "cron-stall-monitor",
     "webhook-crm-opportunity",
     "webhook-task-event",
@@ -842,8 +702,6 @@ resource "aws_lambda_function" "handler" {
     # 2026-06-12-002 U4). Bearer API_AUTH_SECRET + x-tenant-id; the runtime
     # fetch tool authorizes here, then downloads the returned S3 keys itself.
     "workspace-fetch-source",
-    "knowledge-base-manager",
-    "knowledge-base-files",
     "email-send",
     "email-inbound",
     "email-provider-webhook",
@@ -854,9 +712,7 @@ resource "aws_lambda_function" "handler" {
     "msteams-install-complete",
     "msteams-account-link-complete",
     "github-app",
-    "memory",
     "memory-retain",
-    "brain-dream-state",
     "memory-stage-worker",
     # THINK-193 U2 (Codex P1 #3): scheduled retry drainer for the retraction
     # saga ledger. Claims due/stale memory_retraction_attempts rows with the
@@ -871,15 +727,15 @@ resource "aws_lambda_function" "handler" {
     # terminal step event + SendTaskFailure. rate(15 minutes) schedule
     # (dedicated resource below).
     "memory-stage-sweeper",
-    "wiki-compile",
-    "knowledge-graph-observations-ingest",
-    "ontology-scan",
-    "ontology-reprocess",
-    "wiki-lint",
-    "wiki-export",
-    "okf-materialize",
-    "okf-efs-refresh",
-    "wiki-bootstrap-import",
+    # THINK-321 U7: bootstrap/drift identity matching job. Event-invoked by
+    # startIdentityMatchJob; the drift EventBridge Scheduler rule targets it
+    # directly (identity_drift_match_enabled, ships DISABLED).
+    "identity-match",
+    # Company Brain U5 (KTD-4): identity → twin graph projector. VPC-attached
+    # (Neptune). Event-invoked as a post-commit nudge by identity mutations;
+    # RequestResponse for the rebuild command. The per-tenant cursor row is
+    # the source of truth — missed nudges are harmless.
+    "identity-graph-projector",
     "artifact-deliver",
     "recipe-refresh",
     "agent-skills-list",
@@ -966,16 +822,14 @@ resource "aws_lambda_function" "handler" {
     # Admin-Ops MCP — JSON-RPC endpoint at POST /mcp/admin, exposes the
     # @thinkwork/admin-ops package as MCP tools for managed agents.
     "admin-ops-mcp",
-    # Analyst query broker — first-party MCP server at POST /mcp/analyst
-    # (THINK-228 U3). One tool, query: EXPLAIN-gated, extended-protocol
-    # single-statement SQL as the analyst_reader role; large results stage
-    # to S3 under analyst-staging/; every query emits a data.query_executed
-    # compliance audit event via POST /api/compliance/events.
-    "analyst-query-broker",
     # MCP admin key management — per-tenant Bearer tokens for admin-ops.
     # Admin-ops-mcp authenticates incoming tokens by sha256-hash lookup
     # against tenant_mcp_admin_keys, populated by this handler's routes.
     "mcp-admin-keys",
+    # Brain API key management — user-minted `tkt_` Bearer tokens for the
+    # platform Company Brain MCP. Create/revoke republish the hashed-key
+    # manifest the platform verifier reads (twin-mcp-keys/<tenantId>/).
+    "brain-api-keys",
     # One-shot tenant provisioning: mints a tkm_ key + stores in Secrets
     # Manager at thinkwork/<stage>/mcp/<tenantId>/admin-ops + upserts
     # tenant_mcp_servers. SM IAM is already granted on thinkwork/* by
@@ -990,6 +844,16 @@ resource "aws_lambda_function" "handler" {
     # Daily sweeper: auto-rejects MCP servers pending > 30 days. Triggered
     # by EventBridge schedule (mcp-approval-sweeper-daily).
     "mcp-approval-sweeper",
+    # Daily sweeper: cancels computer_approval inbox items past expires_at
+    # (or older than the TTL, for rows predating it). Keeps the approvals
+    # queue a list of live decisions instead of a months-deep graveyard.
+    "inbox-approval-sweeper",
+    # Hourly retention sweeper for auth_subscription_tickets. Tickets are
+    # single-use and expire 60s after mint but were never deleted; the
+    # table reached 551k rows / 306 MB (idx_scan=0) on a customer stage.
+    # Batched ctid DELETEs, 1h grace past expires_at. Triggered by
+    # EventBridge (aws_scheduler_schedule.auth_ticket_sweeper).
+    "auth-ticket-sweeper",
     # Finance pilot U2 — thread-attachment upload (presign + finalize).
     # presign issues a 5-min PUT URL the end-user client uses to push
     # Excel/CSV bytes directly to S3; finalize sniffs magic bytes, scans
@@ -999,6 +863,11 @@ resource "aws_lambda_function" "handler" {
     # threads.tenant_id lookup. Needs WORKSPACE_BUCKET env for S3.
     "thread-attachments-presign",
     "thread-attachments-finalize",
+    # Runtime-generated file registration (execute_code output_files).
+    # Bearer API_AUTH_SECRET + x-tenant-id; the Pi runtime uploads the
+    # sandbox file to the same staging prefix and registers it here with
+    # the same magic-byte + OOXML validation as finalize.
+    "thread-attachments-register",
     # U9-remainder of finance pilot — tenant-pinned download endpoint.
     # GET /api/threads/{tid}/attachments/{aid}/download returns a 302
     # to a 5-minute presigned S3 GET URL with ResponseContentDisposition:
@@ -1013,14 +882,10 @@ resource "aws_lambda_function" "handler" {
     # POSTs one row per agent-session-start. Shared
     # API_AUTH_SECRET bearer (runtime→API; no tenant OAuth).
     "manifest-log",
-    # Governed capability runtime control-plane service (THINK-280 U2).
-    # NO HTTP route: the Pi container invokes it directly (RequestResponse)
-    # via lambda:InvokeFunction over the approved in-account path — public
-    # execute-api is not reliable from Pi's private VPC. Identity comes
-    # exclusively from the Ed25519-signed capability caller context (the
-    # CAPABILITY_SIGNING_PUBLIC_KEY in the shared runtime-config document
-    # verifies it); plaintext payload fields are never trusted.
-    "capability-control-service",
+    # Pi tool-execution ledger write endpoint (THINK-324 C17). The runtime
+    # POSTs paired started/terminal evidence rows per tool call. Shared
+    # API_AUTH_SECRET bearer (runtime→API; no tenant OAuth).
+    "tool-executions",
     # SI-7 catalog-list read endpoint (plan §U15 pt 3/3). The runtime
     # fetches the allowed builtin-tool slug set once per
     # session-start + feature-flag-gated enforcement filter drops
@@ -1060,12 +925,44 @@ resource "aws_lambda_function" "handler" {
     # new standalone resource (see U8b plan operator-step section).
   ]), toset(local.optional_integration_handler_names)) : toset([])
 
+  # THINK-1082: one vpc_config per function, resolved here so the resource
+  # block stays a single dynamic block. Three shapes:
+  #   - identity-graph-projector with Neptune wired: the Neptune subnets (the
+  #     projector must reach the Neptune cluster), security groups = the
+  #     Neptune client SGs UNION the api-lambda SGs when lambdas_in_vpc is on
+  #     (the projector also opens DATABASE_URL, so it needs the DB grant too).
+  #   - any handler when lambdas_in_vpc: the VPC subnets + api-lambda SGs.
+  #   - otherwise null: no vpc_config, byte-identical to today.
+  handler_vpc = {
+    for name in local.handler_names : name => (
+      name == "identity-graph-projector" && local.neptune_vpc_enabled ? {
+        subnet_ids = var.neptune_subnet_ids
+        security_group_ids = distinct(concat(
+          var.neptune_security_group_ids,
+          var.lambdas_in_vpc ? var.vpc_security_group_ids : [],
+        ))
+        } : var.lambdas_in_vpc ? {
+        subnet_ids         = var.vpc_subnet_ids
+        security_group_ids = var.vpc_security_group_ids
+      } : null
+    )
+  }
+}
+
+resource "aws_lambda_function" "handler" {
+  for_each = local.handler_names
+
   function_name = "thinkwork-${var.stage}-api-${each.key}"
+  # THINK-583 U3: publish a numbered version for the two chat-critical
+  # handlers only — provisioned concurrency requires a published version
+  # behind the `live` alias (resources below). Scoped so the other ~90
+  # handlers don't accumulate a version per apply.
+  publish = contains(local.provisioned_concurrency_handlers, each.key)
   # S2 (THINK-193 U2): memory-retraction-drainer runs under a DEDICATED role
   # so its destructive evidence-snapshot S3 capability (version enumeration +
   # bulk version deletion) never leaks into the 90+ handlers on the shared
   # role. Everything else keeps the shared role.
-  role    = each.key == "memory-retraction-drainer" ? aws_iam_role.memory_retraction_drainer.arn : each.key == "turn-assertion-mint" ? aws_iam_role.turn_assertion_mint[0].arn : each.key == "agentcore-proof-oauth-provider" ? aws_iam_role.agentcore_proof_provider[0].arn : each.key == "agentcore-identity-boundary-target" ? aws_iam_role.agentcore_proof_boundary[0].arn : aws_iam_role.lambda.arn
+  role    = each.key == "memory-retraction-drainer" ? aws_iam_role.memory_retraction_drainer.arn : aws_iam_role.lambda.arn
   handler = "index.handler"
   runtime = local.runtime
   # Parameters and Secrets extension: container-local cache for the SSM
@@ -1082,9 +979,6 @@ resource "aws_lambda_function" "handler" {
   # eval-runner walks every test case sequentially, invoking an agent +
   # waiting up to 2 min for spans to propagate per test, so a 10-test run
   # can easily exceed the 30 s default. 900 s covers ~5-15 min sweeps.
-  # wiki-bootstrap-import runs a full Hindsight ingest for ~3,000 records;
-  # the LLM-backed retain path makes it the longest-running Lambda in the
-  # set. 900 s is Lambda's per-invocation max and matches eval-runner's ceiling.
   # routine-task-python wraps a 300s sandbox session and needs headroom
   # for the Start/Invoke/Stop/S3-offload round trip; 360s leaves ~60s
   # for AWS-call setup and offload after the sandbox's own ceiling.
@@ -1092,11 +986,16 @@ resource "aws_lambda_function" "handler" {
   # validates the agent, builds the AgentCore invoke payload, dispatches
   # Event-mode, and returns. Setup is ~5s in practice; 60s gives 12×
   # headroom for transient slowness.
-  # harness-runner holds the Lambda open for the full Harness turn (the
   # reference QBR run was ~2 min; 900s is the ceiling — a longer run is a
   # legitimate trial limitation, recorded, not engineered around).
-  timeout     = each.key == "harness-runner" ? 900 : each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "wiki-compile" ? 480 : each.key == "knowledge-graph-observations-ingest" ? 480 : each.key == "requester-memory-dreaming" ? 300 : each.key == "ontology-scan" ? 300 : each.key == "ontology-reprocess" ? 300 : each.key == "wiki-lint" ? 300 : each.key == "wiki-export" ? 600 : each.key == "okf-materialize" ? 600 : each.key == "okf-efs-refresh" ? 600 : each.key == "wiki-bootstrap-import" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "brain-dream-state" ? 900 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
-  memory_size = each.key == "harness-runner" ? 512 : each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "wiki-compile" ? 1024 : each.key == "knowledge-graph-observations-ingest" ? 1024 : each.key == "requester-memory-dreaming" ? 512 : each.key == "ontology-scan" ? 512 : each.key == "wiki-export" ? 1024 : each.key == "okf-materialize" ? 1024 : each.key == "okf-efs-refresh" ? 1024 : each.key == "wiki-bootstrap-import" ? 1024 : each.key == "folder-bundle-import" ? 1024 : 256
+  timeout = each.key == "wakeup-processor" ? 300 : each.key == "chat-agent-invoke" ? 60 : each.key == "agentcore-runtime-dispatch" ? 900 : each.key == "agentcore-dispatch-dlq-redrive" ? 60 : each.key == "chat-agent-finalize" ? 60 : each.key == "workspace-event-dispatcher" ? 60 : each.key == "eval-runner" ? 900 : each.key == "eval-worker" ? 240 : each.key == "requester-memory-dreaming" ? 300 : each.key == "identity-match" ? 300 : each.key == "identity-graph-projector" ? 900 : each.key == "folder-bundle-import" ? 300 : each.key == "routine-task-python" ? 360 : each.key == "routine-exec-git" ? 360 : each.key == "job-trigger" ? 600 : each.key == "model-converse" ? 60 : each.key == "memory-retain" ? 300 : each.key == "memory-stage-worker" ? 900 : each.key == "memory-stage-sweeper" ? 120 : each.key == "auth-ticket-sweeper" ? 120 : each.key == "memory-retraction-drainer" ? 300 : each.key == "canvas-refresh" ? 120 : each.key == "document-conformance-judge" ? 300 : each.key == "workflow-step-dispatch" ? 600 : each.key == "workflow-execution-callback" ? 60 : each.key == "workflow-resume" ? 60 : 30
+  # THINK-583 U2: chat-agent-invoke and workspace-renderer get a full vCPU
+  # (1769 MB). At 256 MB (~1/7 vCPU) the parallelized setup awaits starved on
+  # CPU — per-leg timing showed three independent {1 DB read + 1 S3/Secrets
+  # read} legs each taking ~1.5 s in parallel while sequential stage-1 reads
+  # were fast. Memory is priced per GB-s, but wall-clock drops far more than
+  # 7x cost rises on these short, provisioned-concurrency-warmed functions.
+  memory_size = each.key == "graphql-http" ? 512 : each.key == "wakeup-processor" ? 512 : each.key == "workspace-event-dispatcher" ? 512 : each.key == "eval-runner" ? 512 : each.key == "eval-worker" ? 512 : each.key == "requester-memory-dreaming" ? 512 : each.key == "identity-match" ? 512 : each.key == "identity-graph-projector" ? min(8192, var.lambda_max_memory_mb) : each.key == "folder-bundle-import" ? 1024 : each.key == "chat-agent-invoke" ? 1769 : each.key == "workspace-renderer" ? 1769 : each.key == "agentcore-runtime-dispatch" ? 512 : 256
 
   filename         = local.use_local_zips ? "${var.lambda_zips_dir}/${each.key}.zip" : null
   source_code_hash = local.use_local_zips ? filebase64sha256("${var.lambda_zips_dir}/${each.key}.zip") : null
@@ -1114,64 +1013,32 @@ resource "aws_lambda_function" "handler" {
   # document-conformance-judge is also a single-writer: direct
   # process-and-complete with no in-flight claim status depends on never
   # having two sweepers race the same pending rows (THINK-189 KTD4).
-  # analyst-query-broker is capped low: each concurrent execution holds a
-  # dedicated analyst_reader Postgres connection and runs model-authored
-  # SQL — the cap bounds both connection pressure and the blast radius of
-  # a runaway delegation (THINK-228 U3).
-  # analyst-connection-reconciler is capped at 1: the probe holds one
-  # analyst_reader connection and overlapping probes are pointless (the
-  # cluster-global reader has one grant surface / one live schema).
-  reserved_concurrent_executions = each.key == "compliance-outbox-drainer" ? 1 : each.key == "document-conformance-judge" ? 1 : each.key == "eval-worker" ? 40 : each.key == "analyst-query-broker" ? 4 : each.key == "analyst-connection-reconciler" ? 1 : -1
+  reserved_concurrent_executions = each.key == "compliance-outbox-drainer" ? 1 : each.key == "document-conformance-judge" ? 1 : each.key == "eval-worker" ? 40 : -1
 
   environment {
     variables = merge(
-      each.key == "turn-assertion-mint" ? local.turn_assertion_mint_env : contains([
-        "agentcore-proof-oauth-provider",
-        "agentcore-identity-boundary-target",
-      ], each.key) ? local.agentcore_proof_boundary_env : local.common_env,
+      local.common_env,
       { FUNCTION_NAME = each.key },
       lookup(local.handler_extra_env, each.key, {}),
     )
   }
 
+  # Company Brain U5 + THINK-1082: at most one vpc_config per function. The
+  # placement (Neptune projector, whole-module VPC lane, or none) is resolved
+  # in local.handler_vpc above; absent entirely when that entry is null.
   dynamic "vpc_config" {
-    for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
-
-    content {
-      subnet_ids         = var.okf_efs_subnet_ids
-      security_group_ids = var.okf_efs_security_group_ids
-    }
-  }
-
-  # Analyst data-path handlers get a stable NAT egress IP when
-  # analyst_egress_subnet_ids is set — external Postgres sources behind an IP
-  # allowlist admit that one EIP. Disjoint from the okf-efs-refresh block
-  # above (a function takes at most one vpc_config).
-  dynamic "vpc_config" {
-    for_each = contains(local.analyst_vpc_handlers, each.key) && local.analyst_vpc_enabled ? [1] : []
-
-    content {
-      subnet_ids         = var.analyst_egress_subnet_ids
-      security_group_ids = var.analyst_egress_security_group_ids
-    }
-  }
-
-  dynamic "file_system_config" {
-    for_each = each.key == "okf-efs-refresh" && local.okf_efs_vpc_enabled ? [1] : []
+    for_each = local.handler_vpc[each.key] == null ? [] : [local.handler_vpc[each.key]]
 
     content {
-      arn              = var.okf_efs_refresh_access_point_arn
-      local_mount_path = var.okf_efs_mount_path
+      subnet_ids         = vpc_config.value.subnet_ids
+      security_group_ids = vpc_config.value.security_group_ids
     }
   }
 
   lifecycle {
     precondition {
-      condition = each.key != "okf-efs-refresh" || var.okf_efs_refresh_access_point_arn == "" || (
-        length(var.okf_efs_mount_target_ids) == length(var.okf_efs_subnet_ids) &&
-        alltrue([for id in var.okf_efs_mount_target_ids : id != ""])
-      )
-      error_message = "okf-efs-refresh requires an available EFS mount target dependency for every configured subnet."
+      condition     = local.lambda_vpc_inputs_complete
+      error_message = "lambdas_in_vpc requires non-empty vpc_subnet_ids and vpc_security_group_ids."
     }
   }
 
@@ -1182,31 +1049,59 @@ resource "aws_lambda_function" "handler" {
 }
 
 # ---------------------------------------------------------------------------
-# wiki-compile async retry config + DLQ
+# Warm sessions (THINK-583 U3): published version + `live` alias +
+# provisioned concurrency for chat-agent-invoke and workspace-renderer
 # ---------------------------------------------------------------------------
+# KTD5: these two zip Lambdas ONLY — never the Pi Lambda (its warmth is
+# superseded by AgentCore session reuse, and deploy.yml publishes Pi code
+# to $LATEST out-of-band).
 #
-# AWS Lambda's default async invoke retries the function 2 times with a
-# 1-minute delay before sending failures to a DLQ (or dropping). For
-# wiki-compile, retries duplicate Bedrock cost AND can produce duplicate
-# user-visible threads + workspace_runs (the brain-enrichment draft path
-# in particular — see plan 2026-05-01-002 U5/U6 and
-# docs/solutions/architecture-patterns/async-retry-idempotency-lessons).
-#
-# Pin retries to 0 and route failures to a dedicated DLQ. The runner's
-# job-status short-circuit (running/succeeded/failed/skipped) is the
-# in-process protection against duplicate writebacks; this is the
-# infrastructure-level belt-and-suspenders.
+# Provisioned concurrency only serves invokes addressed to the alias, so
+# EVERY invoker resolves `<fn>:live` (graphql/utils.ts, mobile-turns/
+# managed-dispatch.ts, and the workspaceRendererFunctionName helpers in
+# chat-agent-invoke.ts / wakeup-processor.ts). The alias exists even when
+# the concurrency count is 0 — an alias with no PC config serves normally
+# from $LATEST-equivalent cold starts — so disabled stages keep working
+# unchanged and opt in purely by raising the count variable.
 
-resource "aws_sqs_queue" "wiki_compile_dlq" {
-  count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-wiki-compile-dlq"
-  message_retention_seconds = 1209600 # 14 days
-
-  tags = {
-    Name = "thinkwork-${var.stage}-wiki-compile-dlq"
+locals {
+  provisioned_concurrency_handlers = toset([
+    "chat-agent-invoke",
+    "workspace-renderer",
+  ])
+  provisioned_concurrency_counts = {
+    "chat-agent-invoke"  = var.chat_agent_invoke_provisioned_concurrency
+    "workspace-renderer" = var.workspace_renderer_provisioned_concurrency
   }
 }
 
+resource "aws_lambda_alias" "live" {
+  for_each = local.deploy_lambda_handlers ? local.provisioned_concurrency_handlers : toset([])
+
+  name             = "live"
+  description      = "Warm-session alias (THINK-583 U3) — provisioned-concurrency target; all invokers alias-qualify."
+  function_name    = aws_lambda_function.handler[each.key].function_name
+  function_version = aws_lambda_function.handler[each.key].version
+}
+
+resource "aws_lambda_provisioned_concurrency_config" "live" {
+  # aws_lambda_provisioned_concurrency_config rejects a count of 0, so a
+  # disabled handler simply has no config resource (the alias remains).
+  for_each = local.deploy_lambda_handlers ? {
+    for name in local.provisioned_concurrency_handlers :
+    name => local.provisioned_concurrency_counts[name]
+    if local.provisioned_concurrency_counts[name] > 0
+  } : {}
+
+  function_name                     = aws_lambda_function.handler[each.key].function_name
+  qualifier                         = aws_lambda_alias.live[each.key].name
+  provisioned_concurrent_executions = each.value
+}
+
+# ---------------------------------------------------------------------------
+# Async retry configuration
+# ---------------------------------------------------------------------------
+
 # chat-agent-invoke retry-0 (plan 2026-05-22-006 U3). After the
 # direct-callback finalize refactor, chat-agent-invoke is Event-mode-
 # dispatched by the GraphQL resolver and itself dispatches AgentCore
@@ -1225,80 +1120,41 @@ resource "aws_lambda_function_event_invoke_config" "chat_agent_invoke" {
   maximum_event_age_in_seconds = 3600
 }
 
-# harness-runner retry-0 (THINK-311 U5, async-retry idempotency): an AWS
-# async retry would re-execute a whole agent turn. Failures finalize the
-# turn in-process (finalize-through-failure); a hard crash is reconciled
-# by the stall monitor (timed_out + checkout release, no retry enqueue
-# for harness turns). No DLQ destination for the same reason as
-# chat-agent-invoke above: the shared role's inline policy budget is at
-# the AWS cap, and the stall monitor is the operational surface.
-resource "aws_lambda_function_event_invoke_config" "harness_runner" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["harness-runner"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-}
-
-resource "aws_lambda_function_event_invoke_config" "wiki_compile" {
+# THINK-583 U3: the resolver now Event-invokes the `live` alias, and async
+# invoke config is per-qualifier — without this duplicate on the alias the
+# alias path would regress to AWS's default 2 retries and the 5-min stall
+# cascade above could recur. Same retry-0 posture, pinned explicitly.
+resource "aws_lambda_function_event_invoke_config" "chat_agent_invoke_live" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["wiki-compile"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-
-  destination_config {
-    on_failure {
-      destination = aws_sqs_queue.wiki_compile_dlq[0].arn
-    }
-  }
-}
-
-# Ontology suggestion scans are durable-job driven. Disable AWS async
-# retries so duplicate scan invocations do not create duplicate review
-# proposals; the scan job row is the retry/observability surface.
-resource "aws_sqs_queue" "ontology_scan_dlq" {
-  count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-ontology-scan-dlq"
-  message_retention_seconds = 1209600 # 14 days
-
-  tags = {
-    Name = "thinkwork-${var.stage}-ontology-scan-dlq"
-  }
-}
-
-resource "aws_lambda_function_event_invoke_config" "ontology_scan" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["ontology-scan"].function_name
+  function_name                = aws_lambda_function.handler["chat-agent-invoke"].function_name
+  qualifier                    = aws_lambda_alias.live["chat-agent-invoke"].name
   maximum_retry_attempts       = 0
   maximum_event_age_in_seconds = 3600
-
-  destination_config {
-    on_failure {
-      destination = aws_sqs_queue.ontology_scan_dlq[0].arn
-    }
-  }
 }
 
-# Ontology reprocess jobs are row-ledger driven and explicitly claim work.
-# Disable AWS async retries to keep failure/retry state in ontology.reprocess_jobs.
-resource "aws_sqs_queue" "ontology_reprocess_dlq" {
+# Identity match jobs (THINK-321 U7) are durable-job driven. Disable AWS
+# async retries so duplicate match invocations do not
+# double-write mappings/cases; identity.match_jobs is the retry/
+# observability surface.
+resource "aws_sqs_queue" "identity_match_dlq" {
   count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-ontology-reprocess-dlq"
+  name                      = "thinkwork-${var.stage}-identity-match-dlq"
   message_retention_seconds = 1209600 # 14 days
 
   tags = {
-    Name = "thinkwork-${var.stage}-ontology-reprocess-dlq"
+    Name = "thinkwork-${var.stage}-identity-match-dlq"
   }
 }
 
-resource "aws_lambda_function_event_invoke_config" "ontology_reprocess" {
+resource "aws_lambda_function_event_invoke_config" "identity_match" {
   count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["ontology-reprocess"].function_name
+  function_name                = aws_lambda_function.handler["identity-match"].function_name
   maximum_retry_attempts       = 0
   maximum_event_age_in_seconds = 3600
 
   destination_config {
     on_failure {
-      destination = aws_sqs_queue.ontology_reprocess_dlq[0].arn
+      destination = aws_sqs_queue.identity_match_dlq[0].arn
     }
   }
 }
@@ -1322,7 +1178,7 @@ resource "aws_lambda_function_event_invoke_config" "routine_approval_callback" {
 # memory-retain after every chat turn. AWS Lambda's default async-retry
 # policy is 2 attempts; without overriding it, a transient failure on the
 # canonical-transcript fetch or adapter write retries the entire writeback
-# and can multi-write the same per-turn document into Hindsight. The
+# and can multi-write the same per-turn document into memory. The
 # longest-suffix-prefix merge in memory-retain.ts dedupes content but the
 # retain-cost path (Bedrock tokens charged in adapter.retainConversation)
 # is NOT idempotent — retries multiply LLM cost. Per
@@ -1632,21 +1488,6 @@ locals {
       # Agent actions (start/stop/heartbeat/budget)
       "ANY /api/agent-actions/{proxy+}" = "agent-actions"
 
-      # Desktop-local Pi tombstones. Specific routes before broad REST handlers;
-      # OPTIONS is handled inside the Lambda before auth.
-      "POST /api/desktop/runtime-session"               = "desktop-runtime-session"
-      "OPTIONS /api/desktop/runtime-session"            = "desktop-runtime-session"
-      "POST /api/desktop/workspace-prewarm"             = "desktop-workspace-prewarm"
-      "OPTIONS /api/desktop/workspace-prewarm"          = "desktop-workspace-prewarm"
-      "POST /api/desktop/managed-delegation"            = "managed-delegation"
-      "OPTIONS /api/desktop/managed-delegation"         = "managed-delegation"
-      "POST /api/desktop/eval-runs"                     = "desktop-eval-runs"
-      "OPTIONS /api/desktop/eval-runs"                  = "desktop-eval-runs"
-      "POST /api/desktop/eval-runs/{runId}/sessions"    = "desktop-eval-runs"
-      "OPTIONS /api/desktop/eval-runs/{runId}/sessions" = "desktop-eval-runs"
-      "POST /api/desktop/eval-runs/{runId}/results"     = "desktop-eval-runs"
-      "OPTIONS /api/desktop/eval-runs/{runId}/results"  = "desktop-eval-runs"
-
       # Mobile agent harness model proxy (cloud Bedrock Converse). OPTIONS is
       # handled inside the Lambda before auth.
       "POST /api/model/converse"    = "model-converse"
@@ -1719,34 +1560,6 @@ locals {
       # under /agentcore so the existing user-memory OAuth issuer is unchanged.
       "GET /agentcore/.well-known/openid-configuration" = "mcp-oauth"
       "GET /agentcore/oauth/jwks"                       = "mcp-oauth"
-      # THINK-316 U1 proof-only provider and downstream HTTPS target. Both
-      # handlers validate their own credentials; the route filter removes all
-      # five when enable_agentcore_multiplayer_proof is false.
-      "GET /agentcore-proof/oauth/.well-known/openid-configuration" = "agentcore-proof-oauth-provider"
-      "GET /agentcore-proof/oauth/authorize"                        = "agentcore-proof-oauth-provider"
-      "POST /agentcore-proof/oauth/token"                           = "agentcore-proof-oauth-provider"
-      "GET /agentcore-proof/target/owner"                           = "agentcore-identity-boundary-target"
-      "GET /agentcore-proof/target/mixed"                           = "agentcore-identity-boundary-target"
-      "POST /agentcore/capabilities/mcp/tools/list"                 = "harness-capability-mcp"
-      "POST /agentcore/capabilities/mcp/tools/call"                 = "harness-capability-mcp"
-      "POST /agentcore/capabilities/sandbox/execute"                = "harness-code-interpreter-target"
-      "POST /agentcore/capabilities/web/search"                     = "harness-builtin-tools-target"
-      "POST /agentcore/capabilities/web/extract"                    = "harness-builtin-tools-target"
-      "POST /agentcore/capabilities/brain/query"                    = "harness-platform-tools-target"
-      "POST /agentcore/capabilities/workspace/skills/list"          = "harness-platform-tools-target"
-      "POST /agentcore/capabilities/workspace/skills/load"          = "harness-platform-tools-target"
-      "POST /agentcore/capabilities/message/attachments/list"       = "harness-platform-tools-target"
-      "POST /agentcore/capabilities/message/attachments/read"       = "harness-platform-tools-target"
-      "POST /agentcore/capabilities/user/questions/ask"             = "harness-platform-tools-target"
-      "POST /agentcore/capabilities/email/send"                     = "harness-platform-tools-target"
-      "POST /mcp/oauth/register"                                    = "mcp-oauth"
-      "GET /mcp/oauth/authorize"                                    = "mcp-oauth"
-      "GET /mcp/oauth/callback"                                     = "mcp-oauth"
-      "POST /mcp/oauth/token"                                       = "mcp-oauth"
-      "POST /mcp/oauth/revoke"                                      = "mcp-oauth"
-      "ANY /mcp/user-memory"                                        = "mcp-user-memory"
-      "ANY /mcp/context-engine"                                     = "mcp-context-engine"
-      "ANY /mcp/open-engine"                                        = "mcp-open-engine"
       # THINK-280 U8: scoped external capability search facade. The handler is
       # inert unless CAPABILITY_EXTERNAL_SEARCH_ENABLED (gated on
       # enable_capability_broker) is on — routing it while disabled returns an
@@ -1861,9 +1674,6 @@ locals {
       # Workspace files
       "ANY /api/workspaces/{proxy+}" = "workspace-files"
 
-      # Knowledge bases
-      "ANY /api/knowledge-bases/{proxy+}" = "knowledge-base-files"
-
       # Email
       "POST /api/email/send"                                 = "email-send"
       "POST /api/email/provider-webhook/{providerInstallId}" = "email-provider-webhook"
@@ -1885,7 +1695,6 @@ locals {
       "POST /msteams/account-link/complete" = "msteams-account-link-complete"
 
       # Memory
-      "ANY /api/memory/{proxy+}" = "memory"
 
       # Artifacts
       "POST /api/artifacts/{proxy+}" = "artifact-deliver"
@@ -1951,20 +1760,6 @@ locals {
       # retained as a break-glass superuser path for bootstrap/debug.
       "POST /mcp/admin" = "admin-ops-mcp"
 
-      # Analyst query broker — first-party MCP server exposing query
-      # (THINK-228 U3). Callers present the tenant-wide broker service
-      # credential as Bearer; SQL executes as the hardened analyst_reader
-      # role. The seeded postgres-dev connector row points at this route.
-      "POST /mcp/analyst" = "analyst-query-broker"
-
-      # Sourced analyst broker route (THINK-239) — the same handler serves a
-      # registered EXTERNAL Postgres source at /mcp/analyst/<slug>. The broker
-      # requires a signed caller context whose sourceClaims.slug matches the
-      # path (the legacy bearer is never accepted here) and connects using the
-      # per-source reader credential (thinkwork/<stage>/analyst/*, covered by
-      # the shared secretsmanager:GetSecretValue on thinkwork/*).
-      "POST /mcp/analyst/{sourceSlug}" = "analyst-query-broker"
-
       # MCP admin key management — per-tenant Bearer token CRUD. Tokens
       # are shown ONCE at creation (POST returns raw value); server stores
       # sha256 hash only. These specific routes take precedence over the
@@ -1974,6 +1769,15 @@ locals {
       "GET /api/tenants/{tenantId}/mcp-admin-keys"            = "mcp-admin-keys"
       "DELETE /api/tenants/{tenantId}/mcp-admin-keys/{keyId}" = "mcp-admin-keys"
 
+      "POST /api/tenants/{tenantId}/brain-api-keys"           = "brain-api-keys"
+      "GET /api/tenants/{tenantId}/brain-api-keys"            = "brain-api-keys"
+      "OPTIONS /api/tenants/{tenantId}/brain-api-keys"        = "brain-api-keys"
+      "DELETE /api/tenants/{tenantId}/brain-api-keys/{keyId}" = "brain-api-keys"
+      # Per-key grants edit (twin-mcp-keys/v2): securityGroups +
+      # kbCollections, republishing the manifest on change.
+      "PATCH /api/tenants/{tenantId}/brain-api-keys/{keyId}"   = "brain-api-keys"
+      "OPTIONS /api/tenants/{tenantId}/brain-api-keys/{keyId}" = "brain-api-keys"
+
       # One-shot tenant provisioning for the admin-ops MCP. Mints a fresh
       # tkm_ key + stores it in Secrets Manager at
       # thinkwork/<stage>/mcp/<tenantId>/admin-ops + upserts the
@@ -1981,6 +1785,13 @@ locals {
       # any agent that gets it assigned via agent_mcp_servers.
       "POST /api/tenants/{tenantId}/mcp-admin-provision" = "mcp-admin-provision"
 
+      # Digital Twin MCP provisioning (THINK-333 U4): mints the tkt_ key,
+      # writes the secret, upserts the approved digital-twin connector row
+      # (url_hash pinned), and materializes connectors/digital-twin/ into
+      # every agent workspace. Re-run = rotate.
+      "POST /api/tenants/{tenantId}/mcp-twin-provision"    = "mcp-twin-provision"
+      "OPTIONS /api/tenants/{tenantId}/mcp-twin-provision" = "mcp-twin-provision"
+
       # MCP server admin approval (plan §U11, SI-5). Externally-sourced MCP
       # servers land with status='pending'; these routes flip them to
       # approved/rejected. Cognito JWT only (mcp-approval handler rejects
@@ -1998,6 +1809,10 @@ locals {
       "POST /api/threads/{threadId}/attachments/finalize"    = "thread-attachments-finalize"
       "OPTIONS /api/threads/{threadId}/attachments/finalize" = "thread-attachments-finalize"
 
+      # Runtime-generated attachments (execute_code output_files). Shared
+      # API_AUTH_SECRET; no browser callers, so no OPTIONS route.
+      "POST /api/threads/{threadId}/attachments/register" = "thread-attachments-register"
+
       # U9-remainder of finance pilot — tenant-pinned download endpoint.
       "GET /api/threads/{threadId}/attachments/{attachmentId}/download"     = "thread-attachment-download"
       "OPTIONS /api/threads/{threadId}/attachments/{attachmentId}/download" = "thread-attachment-download"
@@ -2012,13 +1827,19 @@ locals {
       "POST /api/runtime/manifests"    = "manifest-log"
       "OPTIONS /api/runtime/manifests" = "manifest-log"
 
+      # Pi tool-execution ledger (THINK-324 C17). The runtime POSTs paired
+      # started/terminal evidence rows per tool call. Shared API_AUTH_SECRET;
+      # no tenant OAuth.
+      "POST /api/runtime/tool-executions"    = "tool-executions"
+      "OPTIONS /api/runtime/tool-executions" = "tool-executions"
+
       # SI-7 catalog-list read (plan §U15 pt 3/3). The runtime fetches
       # the allowed slug set once per session-start. Shared API_AUTH_SECRET.
       "GET /api/runtime/capability-catalog"     = "capability-catalog-list"
       "OPTIONS /api/runtime/capability-catalog" = "capability-catalog-list"
     } : route_key => handler_name
     if !contains(local.optional_integration_handler_names, handler_name) && (
-      var.enable_agentcore_multiplayer_proof || !startswith(route_key, "GET /agentcore/")
+      !startswith(route_key, "GET /agentcore/")
     )
   } : {}
 }
@@ -2177,42 +1998,6 @@ resource "aws_scheduler_schedule" "webhook_deliveries_cleanup" {
 # Requester memory dreaming — broad per-user memory compaction/reflection sweep
 # ---------------------------------------------------------------------------
 
-# ---------------------------------------------------------------------------
-# Brain dream state — per-bank Hindsight consolidation with audit ledger
-# (THINK-133 U4). Retries are the ledger's job (staged plan -> atomic apply
-# -> applied markers; unfinished runs resume on the next tick), so Lambda
-# async retries stay at 0, mirroring memory-retain.
-# ---------------------------------------------------------------------------
-
-resource "aws_lambda_function_event_invoke_config" "brain_dream_state" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["brain-dream-state"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-}
-
-resource "aws_scheduler_schedule" "brain_dream_state" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-brain-dream-state"
-  group_name          = "default"
-  schedule_expression = var.brain_dream_state_schedule_expression
-  state               = var.brain_dream_state_enabled ? "ENABLED" : "DISABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["brain-dream-state"].arn
-    role_arn = aws_iam_role.scheduler.arn
-
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
-  }
-}
-
 resource "aws_scheduler_schedule" "requester_memory_dreaming" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
@@ -2275,20 +2060,12 @@ resource "aws_scheduler_schedule" "mcp_approval_sweeper" {
   }
 }
 
-# ---------------------------------------------------------------------------
-# skill_runs reconciler — transitions stuck-running rows to failed every 5 min.
-# Guards against agentcore Lambda crashes / OOMs that drop the
-# /api/skills/complete writeback and leave the row at 'running' forever,
-# which in turn blocks the dedup partial unique index from letting retries
-# through.
-# ---------------------------------------------------------------------------
-
-resource "aws_scheduler_schedule" "skill_runs_reconciler" {
+resource "aws_scheduler_schedule" "inbox_approval_sweeper" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-skill-runs-reconciler"
+  name                = "thinkwork-${var.stage}-inbox-approval-sweeper"
   group_name          = "default"
-  schedule_expression = "rate(5 minutes)"
+  schedule_expression = "cron(30 4 * * ? *)" # daily at 04:30 UTC (offset from mcp-approval-sweeper)
   state               = "ENABLED"
 
   flexible_time_window {
@@ -2296,53 +2073,50 @@ resource "aws_scheduler_schedule" "skill_runs_reconciler" {
   }
 
   target {
-    arn      = aws_lambda_function.handler["skill-runs-reconciler"].arn
+    arn      = aws_lambda_function.handler["inbox-approval-sweeper"].arn
     role_arn = aws_iam_role.scheduler.arn
   }
 }
 
-# ---------------------------------------------------------------------------
-# analyst_connection_reconciler — probes the analyst_reader connection every
-# 30 min (reachability, IAM auth, SELECT-grant introspection, zero-write
-# assertion, schema-drift hash; all read-only) and stamps the verdict onto
-# tenant_mcp_servers.runtime_metadata.analyst_probe. Dispatch withholds a
-# failing/stale connection loudly (THINK-229 U5, R7/R8, KTD8).
-#
-# retry-0 + DLQ (project_async_retry_idempotency_lessons): the probe is
-# cheap and idempotent — the next 30-minute tick IS the retry, so stacking
-# scheduler retries only adds redundant connections. A failure lands in the
-# DLQ for operator visibility instead.
-# ---------------------------------------------------------------------------
+# auth_subscription_tickets retention. Unlike the approval sweepers this is
+# a volume problem, not a queue-hygiene one: ~30 tickets/min are minted on
+# every connect + subscription registration and nothing deleted them
+# (551k rows / 306 MB and +24 MB/day on a customer stage, idx_scan=0).
+# Hourly rather than daily so each tick's backlog stays small enough that a
+# single batch usually drains it; the handler's own 45s budget bounds the
+# first few catch-up runs on a stage with an existing backlog.
+resource "aws_scheduler_schedule" "auth_ticket_sweeper" {
+  count = local.deploy_lambda_handlers ? 1 : 0
 
-resource "aws_sqs_queue" "analyst_connection_reconciler_dlq" {
-  count                     = local.deploy_lambda_handlers ? 1 : 0
-  name                      = "thinkwork-${var.stage}-analyst-connection-reconciler-dlq"
-  message_retention_seconds = 1209600 # 14 days
+  name                = "thinkwork-${var.stage}-auth-ticket-sweeper"
+  group_name          = "default"
+  schedule_expression = "rate(1 hour)"
+  state               = "ENABLED"
 
-  tags = {
-    Name = "thinkwork-${var.stage}-analyst-connection-reconciler-dlq"
+  flexible_time_window {
+    mode = "OFF"
   }
-}
 
-resource "aws_lambda_function_event_invoke_config" "analyst_connection_reconciler" {
-  count                        = local.deploy_lambda_handlers ? 1 : 0
-  function_name                = aws_lambda_function.handler["analyst-connection-reconciler"].function_name
-  maximum_retry_attempts       = 0
-  maximum_event_age_in_seconds = 3600
-
-  destination_config {
-    on_failure {
-      destination = aws_sqs_queue.analyst_connection_reconciler_dlq[0].arn
-    }
+  target {
+    arn      = aws_lambda_function.handler["auth-ticket-sweeper"].arn
+    role_arn = aws_iam_role.scheduler.arn
   }
 }
 
-resource "aws_scheduler_schedule" "analyst_connection_reconciler" {
+# ---------------------------------------------------------------------------
+# skill_runs reconciler — transitions stuck-running rows to failed every 5 min.
+# Guards against agentcore Lambda crashes / OOMs that drop the
+# /api/skills/complete writeback and leave the row at 'running' forever,
+# which in turn blocks the dedup partial unique index from letting retries
+# through.
+# ---------------------------------------------------------------------------
+
+resource "aws_scheduler_schedule" "skill_runs_reconciler" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-analyst-connection-reconciler"
+  name                = "thinkwork-${var.stage}-skill-runs-reconciler"
   group_name          = "default"
-  schedule_expression = "rate(30 minutes)"
+  schedule_expression = "rate(5 minutes)"
   state               = "ENABLED"
 
   flexible_time_window {
@@ -2350,12 +2124,8 @@ resource "aws_scheduler_schedule" "analyst_connection_reconciler" {
   }
 
   target {
-    arn      = aws_lambda_function.handler["analyst-connection-reconciler"].arn
+    arn      = aws_lambda_function.handler["skill-runs-reconciler"].arn
     role_arn = aws_iam_role.scheduler.arn
-
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
   }
 }
 
@@ -2721,160 +2491,39 @@ resource "aws_scheduler_schedule" "stall_monitor" {
 # Compounding Memory — nightly hygiene + export
 # ---------------------------------------------------------------------------
 
-resource "aws_scheduler_schedule" "wiki_compile_drainer" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-wiki-compile-drainer"
-  group_name          = "default"
-  schedule_expression = "rate(1 minutes)"
-  state               = "ENABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["wiki-compile"].arn
-    role_arn = aws_iam_role.scheduler.arn
-  }
-}
-
-# Observations → Knowledge Graph sweep (plan 2026-06-09-004 U5). Enumerates
-# tenants and runs an incremental observations ingest per tenant; the stable
-# source_ref's active-run dedupe drops overlap with operator-started runs and
-# the in-handler stale-run reaper clears stranded rows past the run ceiling.
-resource "aws_scheduler_schedule" "knowledge_graph_observations_ingest" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-knowledge-graph-observations-ingest"
-  group_name          = "default"
-  schedule_expression = "rate(30 minutes)"
-  # Ships DISABLED (plan 2026-07-03-005 U4/KTD-6): the schedule enables on dev
-  # only after a manual golden-set-validated run. Driven by the GHA
-  # WIKI_KG_INGEST_ENABLED var.
-  state = var.knowledge_graph_observations_ingest_enabled ? "ENABLED" : "DISABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["knowledge-graph-observations-ingest"].arn
-    role_arn = aws_iam_role.scheduler.arn
-    input    = jsonencode({ sweep = true, trigger = "scheduled" })
-
-    # Periodic idempotent worker: the next 30-minute tick IS the retry.
-    # Scheduler-level retries stack extra invocations onto a cadence that
-    # already self-corrects (cursor-guarded), compounding the invocation
-    # volume that helped trip Lambda recursive-loop detection.
-    retry_policy {
-      maximum_retry_attempts = 0
-    }
-  }
-}
-
-# Ontology suggestion scan sweep (THINK-320 U4/KTD-3). Enumerates tenants and
-# starts a suggestion scan job per tenant; tenants with a pending/running scan
-# are skipped in the handler, and the scan-job dedupe key drops same-bucket
-# duplicate starts. Ships DISABLED — enabled per stage via
-# ontology_scan_sweep_enabled after the Living Map review surfaces land.
-resource "aws_scheduler_schedule" "ontology_scan_sweep" {
+# Identity drift match sweep (THINK-321 U7 / KTD-7 — R10). Enumerates
+# tenants with registered identity sources and starts a per-tenant match
+# job; tenants with a pending/running job are skipped in the handler and
+# the job dedupe key drops same-bucket duplicate starts. Ships DISABLED —
+# enabled per stage via identity_drift_match_enabled once bootstrap has
+# been proven on the stage.
+resource "aws_scheduler_schedule" "identity_drift_match" {
   count = local.deploy_lambda_handlers ? 1 : 0
 
-  name                = "thinkwork-${var.stage}-ontology-scan-sweep"
+  name                = "thinkwork-${var.stage}-identity-drift-match"
   group_name          = "default"
   schedule_expression = "rate(1 days)"
-  state               = var.ontology_scan_sweep_enabled ? "ENABLED" : "DISABLED"
+  state               = var.identity_drift_match_enabled ? "ENABLED" : "DISABLED"
 
   flexible_time_window {
     mode = "OFF"
   }
 
   target {
-    arn      = aws_lambda_function.handler["ontology-scan"].arn
+    arn      = aws_lambda_function.handler["identity-match"].arn
     role_arn = aws_iam_role.scheduler.arn
-    input    = jsonencode({ sweep = true, trigger = "scheduled" })
+    input    = jsonencode({ drift = true, trigger = "scheduled" })
 
-    # Periodic idempotent worker: the next daily tick IS the retry (mirrors
-    # the knowledge_graph_observations_ingest precedent — scheduler retries
-    # only stack invocations onto a self-correcting cadence).
+    # Periodic idempotent worker: the next daily tick IS the retry —
+    # scheduler retries only stack invocations onto a self-correcting
+    # cadence.
     retry_policy {
       maximum_retry_attempts = 0
     }
   }
 }
 
-resource "aws_scheduler_schedule" "wiki_lint" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-wiki-lint"
-  group_name          = "default"
-  schedule_expression = "cron(0 2 * * ? *)" # daily at 02:00 UTC
-  state               = "ENABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["wiki-lint"].arn
-    role_arn = aws_iam_role.scheduler.arn
-  }
-}
-
-resource "aws_scheduler_schedule" "wiki_export" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  name                = "thinkwork-${var.stage}-wiki-export"
-  group_name          = "default"
-  schedule_expression = "cron(0 3 * * ? *)" # daily at 03:00 UTC (after lint)
-  state               = "ENABLED"
-
-  flexible_time_window {
-    mode = "OFF"
-  }
-
-  target {
-    arn      = aws_lambda_function.handler["wiki-export"].arn
-    role_arn = aws_iam_role.scheduler.arn
-  }
-}
-
-# S3 bucket for markdown vault exports. One bundle per (tenant, owner, date).
-# Retention is handled by the lifecycle rule below (30 days).
-resource "aws_s3_bucket" "wiki_exports" {
-  bucket        = "thinkwork-${var.stage}-wiki-exports"
-  force_destroy = var.stage == "dev"
-
-  tags = {
-    Name = "thinkwork-${var.stage}-wiki-exports"
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "wiki_exports" {
-  bucket                  = aws_s3_bucket.wiki_exports.id
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "wiki_exports" {
-  bucket = aws_s3_bucket.wiki_exports.id
-
-  rule {
-    id     = "expire-old-bundles"
-    status = "Enabled"
-
-    filter {}
-
-    expiration {
-      days = 30
-    }
-  }
-}
-
-# Canonical ThinkWork Brain artifact store. Unlike wiki_exports, this bucket
+# Canonical ThinkWork Brain artifact store. This bucket
 # is the durable replay/projection substrate for Brain source artifacts,
 # ingestion manifests, migration snapshots, vault projections, and exports.
 resource "aws_s3_bucket" "brain_artifacts" {
@@ -2997,7 +2646,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "brain_artifacts" {
 
   # THINK-193 U1 (Codex F6): normalized evidence snapshots are short-lived
   # working copies — the durable record is the evidence row (hash + ref) and
-  # the Hindsight projection. Expire content after 30 days; the app mirrors
+  # the memory projection. Expire content after 30 days; the app mirrors
   # this via memory_evidence_items.snapshot_expires_at.
   rule {
     id     = "expire-evidence-snapshots"
@@ -3037,6 +2686,48 @@ resource "aws_s3_bucket_lifecycle_configuration" "brain_artifacts" {
       noncurrent_days = 365
     }
   }
+
+  # THINK-630: async brain_ask task records are a polling buffer, not an
+  # archive — they hold answer content and principal metadata, so they must
+  # not accumulate. Seven days far exceeds any task's useful life. The
+  # brain-mcp module (company-brain repo) deliberately does NOT manage this
+  # bucket's lifecycle (it would silently drop the rules above); this stack
+  # is the bucket's single lifecycle author.
+  rule {
+    id     = "expire-brain-ask-tasks"
+    status = "Enabled"
+
+    filter {
+      prefix = "brain-ask-tasks/"
+    }
+
+    expiration {
+      days = 7
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 7
+    }
+  }
+
+  # THINK-629 C2: ask exchange records (follow-up continuity) age out the
+  # same way — the durable record is the thread itself.
+  rule {
+    id     = "expire-brain-ask-exchanges"
+    status = "Enabled"
+
+    filter {
+      prefix = "brain-ask-exchanges/"
+    }
+
+    expiration {
+      days = 7
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 7
+    }
+  }
 }
 
 data "aws_iam_policy_document" "brain_artifacts_bucket" {
@@ -3121,33 +2812,6 @@ resource "aws_iam_role_policy" "scheduler_invoke" {
 # SSM Parameters — Lambda ARNs for cross-function invocation
 # ---------------------------------------------------------------------------
 
-########################################################################
-# SecureString parameter for the Google Places API key. wiki-compile reads
-# this on cold start via loadGooglePlacesClientFromSsm() and caches the
-# client at module scope. When google_places_api_key is empty (the
-# default), we seed the parameter with a placeholder so the Lambda init
-# path can distinguish "unconfigured" (skip Google entirely, degrade
-# gracefully) from "configured but wrong" (log + skip). lifecycle.ignore_
-# changes on `value` lets ops rotate via
-#   aws ssm put-parameter --overwrite \
-#     --name /thinkwork/<stage>/google-places/api-key \
-#     --type SecureString --value <KEY>
-# without terraform fighting it on the next apply.
-########################################################################
-
-resource "aws_ssm_parameter" "google_places_api_key" {
-  name        = "/thinkwork/${var.stage}/google-places/api-key"
-  type        = "SecureString"
-  value       = var.google_places_api_key != "" ? var.google_places_api_key : "PLACEHOLDER_SET_VIA_CLI"
-  description = "Google Places API (New) key consumed by wiki-compile. See docs/plans/2026-04-21-005-feat-wiki-place-capability-v2-plan.md Unit 4."
-
-  lifecycle {
-    # Allow `aws ssm put-parameter --overwrite` to stick across applies.
-    # New-key rotation or initial population by ops should happen via CLI,
-    # not via terraform var.
-    ignore_changes = [value]
-  }
-}
 
 ########################################################################
 # SecureString parameter for the graphql-http Lambda's OWN Cloudflare
@@ -3191,8 +2855,10 @@ resource "aws_ssm_parameter" "cloudflare_namespace_token" {
 
 resource "aws_ssm_parameter" "lambda_arns" {
   for_each = local.deploy_lambda_handlers ? {
-    "chat-agent-invoke-fn-arn"    = aws_lambda_function.handler["chat-agent-invoke"].arn
-    "kb-manager-fn-arn"           = aws_lambda_function.handler["knowledge-base-manager"].arn
+    # THINK-583 U3: alias-qualified so the SSM-fallback path in
+    # getChatAgentInvokeFnArn (graphql/utils.ts) also lands on the
+    # provisioned-concurrency alias, not $LATEST.
+    "chat-agent-invoke-fn-arn"    = aws_lambda_alias.live["chat-agent-invoke"].arn
     "job-schedule-manager-fn-arn" = aws_lambda_function.handler["job-schedule-manager"].arn
     "memory-retain-fn-arn"        = aws_lambda_function.handler["memory-retain"].arn
     "eval-runner-fn-arn"          = aws_lambda_function.handler["eval-runner"].arn
@@ -3251,6 +2917,17 @@ resource "aws_lambda_function" "compliance_anchor" {
       COMPLIANCE_ANCHOR_OBJECT_LOCK_MODE = var.compliance_anchor_object_lock_mode
     }
   }
+
+  # THINK-1082: this function opens a database connection (see env above), so
+  # the whole-module VPC lane covers it too. Absent when lambdas_in_vpc is off.
+  dynamic "vpc_config" {
+    for_each = var.lambdas_in_vpc ? [1] : []
+
+    content {
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
+    }
+  }
 }
 
 resource "aws_sqs_queue" "compliance_anchor_dlq" {
@@ -3557,6 +3234,17 @@ resource "aws_lambda_function" "compliance_export_runner" {
       DATABASE_NAME = var.database_name
     }
   }
+
+  # THINK-1082: this function opens a database connection (see env above), so
+  # the whole-module VPC lane covers it too. Absent when lambdas_in_vpc is off.
+  dynamic "vpc_config" {
+    for_each = var.lambdas_in_vpc ? [1] : []
+
+    content {
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
+    }
+  }
 }
 
 # SQS → Lambda event source mapping. batch_size=1 so each export is a