thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -19,18 +19,19 @@
 data "aws_caller_identity" "current" {}
 
 locals {
-  okf_efs_vpc_enabled = length(var.okf_efs_subnet_ids) > 0 && length(var.okf_efs_security_group_ids) > 0
-  # Handlers that open direct Postgres connections to registered analyst data
-  # sources. VPC-attaching them (analyst_egress_subnet_ids) gives their egress
-  # the NAT gateway's stable EIP, which external databases behind an IP
-  # allowlist can admit — a non-VPC Lambda egresses from the shared AWS pool
-  # and can never satisfy such an allowlist.
-  analyst_vpc_enabled = length(var.analyst_egress_subnet_ids) > 0 && length(var.analyst_egress_security_group_ids) > 0
-  analyst_vpc_handlers = toset([
-    "graphql-http",
-    "analyst-query-broker",
-    "analyst-connection-reconciler",
-  ])
+  # Company Brain U5: the identity-graph-projector attaches to the VPC only
+  # when both Neptune network inputs are present (disjoint from the two
+  # block above — a function takes at most one vpc_config).
+  neptune_vpc_enabled = length(var.neptune_subnet_ids) > 0 && length(var.neptune_security_group_ids) > 0
+  # THINK-1082: any VPC attachment in this module (Neptune projector or the
+  # whole-module lambdas_in_vpc lane) needs the ENI grant on the shared role.
+  lambda_vpc_enabled = local.neptune_vpc_enabled || var.lambdas_in_vpc
+  # lambdas_in_vpc needs both network inputs; checked as a precondition on the
+  # handler functions because cross-variable validation is not available at
+  # the repo's Terraform floor (1.8.5).
+  lambda_vpc_inputs_complete = !var.lambdas_in_vpc || (
+    length(var.vpc_subnet_ids) > 0 && length(var.vpc_security_group_ids) > 0
+  )
   # Constructed rather than read from aws_apigatewayv2_stage.default.invoke_url
   # (the two are identical for an HTTP API's $default stage). Reading it off
   # the stage made every Lambda's env depend on the stage, which forbids the
@@ -194,13 +195,50 @@ resource "aws_iam_role_policy_attachment" "lambda_basic" {
 # aggregate hit IAM's 10,240-byte cap on 2026-06-11 (#2378/#2379). New grants
 # go into the grouped managed policies, never inline.
 
+# Every VPC-attached handler on the shared Lambda role needs the ENI
+# create/describe/delete grant, or its invocations fail before the handler
+# runs. This was gated on the OKF EFS mount alone, which was true by accident:
+# okf-efs-refresh was simply the first VPC-attached handler. The
+# Neptune-attached identity-graph-projector shares this role and had been
+# riding that gate. Gate on the surviving VPC consumer instead — the OKF
+# mount is gone as of the wiki-removal arc U3.
+# THINK-1082: also gated on lambdas_in_vpc — every handler attaches then.
 resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
-  count = local.okf_efs_vpc_enabled ? 1 : 0
+  count = local.lambda_vpc_enabled ? 1 : 0
 
   role       = aws_iam_role.lambda.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
 }
 
+# THINK-1082: compliance-anchor and compliance-export-runner run on sibling
+# roles owned by the compliance bucket modules (not aws_iam_role.lambda). They
+# carry a database connection too, so when lambdas_in_vpc attaches them the
+# ENI grant has to land on those roles as well.
+resource "aws_iam_role_policy_attachment" "compliance_anchor_vpc_access" {
+  count = var.lambdas_in_vpc && local.deploy_lambda_handlers ? 1 : 0
+
+  role       = var.compliance_anchor_lambda_role_name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "compliance_export_runner_vpc_access" {
+  count = var.lambdas_in_vpc && local.deploy_lambda_handlers ? 1 : 0
+
+  role       = var.compliance_exports_runner_role_name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+# memory-retraction-drainer runs on its own role (handlers.tf) — the first
+# McPherson VPC cut-over (2026-08-25) failed on exactly this function:
+# "The provided execution role does not have permissions to call
+# CreateNetworkInterface on EC2".
+resource "aws_iam_role_policy_attachment" "memory_retraction_drainer_vpc_access" {
+  count = var.lambdas_in_vpc && local.deploy_lambda_handlers ? 1 : 0
+
+  role       = aws_iam_role.memory_retraction_drainer.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
 ################################################################################
 # Placeholder Lambda — proves the infrastructure works
 #

package/dist/terraform/modules/app/lambda-api/mcp-oauth.tf

@@ -1,185 +1,8 @@
 locals {
-  mcp_oauth_api_base_url          = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
-  mcp_oauth_cognito_base_url      = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
-  mcp_oauth_identity_providers    = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
-  mcp_oauth_logo_path             = "${path.module}/../../../../apps/web/public/logo.png"
-  agentcore_turn_assertion_issuer = "${local.mcp_oauth_api_base_url}/agentcore"
-  agentcore_harness_audience      = "urn:thinkwork:${var.stage}:agentcore:harness"
-  agentcore_gateway_audience      = "urn:thinkwork:${var.stage}:agentcore:gateway"
-  agentcore_turn_assertion_keys = {
-    for version, key in aws_kms_key.agentcore_turn_assertion : version => {
-      key_id = key.arn
-      # A version label alone is not globally unique: destroying and
-      # reprovisioning v1 creates different RSA material while downstream JWT
-      # validators may still cache the old public key under the same kid.
-      # Bind the kid to the immutable KMS key id so a reprovision is observed
-      # as a real key rotation instead of an invalid-signature outage.
-      kid = "thinkwork-${var.stage}-agentcore-turn-${version}-${substr(key.key_id, 0, 8)}"
-    }
-  }
-  agentcore_turn_assertion_active_key = try(
-    local.agentcore_turn_assertion_keys[var.agentcore_turn_assertion_active_key_version],
-    { key_id = "", kid = "" },
-  )
-}
-
-# THINK-316 U1: short-lived CUSTOM_JWT assertions are signed by KMS so private
-# key material never enters Lambda configuration or process memory. The key
-# policy is the capability boundary: the dedicated mint role can Sign, while
-# the shared mcp-oauth role can only fetch the public key for JWKS publication.
-resource "aws_iam_role" "turn_assertion_mint" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  name  = "thinkwork-${var.stage}-turn-assertion-mint-role"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect    = "Allow"
-      Principal = { Service = "lambda.amazonaws.com" }
-      Action    = "sts:AssumeRole"
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "turn_assertion_mint_basic" {
-  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  role       = aws_iam_role.turn_assertion_mint[0].name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-}
-
-# The synthetic OAuth provider and boundary target are public proof surfaces
-# but need no AWS data-plane permissions. A sibling logs-only role prevents a
-# parser defect from inheriting the shared API role or its platform secrets.
-resource "aws_iam_role" "agentcore_proof_boundary" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  name  = "thinkwork-${var.stage}-agentcore-proof-boundary-role"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect    = "Allow"
-      Principal = { Service = "lambda.amazonaws.com" }
-      Action    = "sts:AssumeRole"
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "agentcore_proof_boundary_basic" {
-  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  role       = aws_iam_role.agentcore_proof_boundary[0].name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-}
-
-# The token-exchange provider is the only proof boundary allowed to mint the
-# derived Gateway assertion. Keep that capability off the public target role.
-resource "aws_iam_role" "agentcore_proof_provider" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  name  = "thinkwork-${var.stage}-agentcore-proof-provider-role"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect    = "Allow"
-      Principal = { Service = "lambda.amazonaws.com" }
-      Action    = "sts:AssumeRole"
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "agentcore_proof_provider_basic" {
-  count      = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  role       = aws_iam_role.agentcore_proof_provider[0].name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-}
-
-resource "aws_iam_role_policy" "agentcore_proof_provider_kms" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  name  = "thinkwork-${var.stage}-agentcore-proof-provider-key"
-  role  = aws_iam_role.agentcore_proof_provider[0].id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["kms:Sign"]
-      Resource = [local.agentcore_turn_assertion_active_key.key_id]
-      Condition = {
-        StringEquals = {
-          "kms:SigningAlgorithm" = "RSASSA_PKCS1_V1_5_SHA_256"
-        }
-      }
-    }]
-  })
-}
-
-resource "aws_kms_key" "agentcore_turn_assertion" {
-  for_each = var.enable_agentcore_multiplayer_proof ? toset(var.agentcore_turn_assertion_key_versions) : toset([])
-
-  description              = "ThinkWork ${var.stage} AgentCore per-turn assertion signing ${each.key}"
-  key_usage                = "SIGN_VERIFY"
-  customer_master_key_spec = "RSA_2048"
-  deletion_window_in_days  = 7
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid       = "AccountAdministration"
-        Effect    = "Allow"
-        Principal = { AWS = "arn:aws:iam::${var.account_id}:root" }
-        Action    = "kms:*"
-        Resource  = "*"
-      },
-    ]
-  })
-
-  tags = {
-    Name       = "thinkwork-${var.stage}-agentcore-turn-assertion-${each.key}"
-    KeyVersion = each.key
-  }
-}
-
-resource "aws_kms_alias" "agentcore_turn_assertion" {
-  for_each      = aws_kms_key.agentcore_turn_assertion
-  name          = "alias/thinkwork-${var.stage}-agentcore-turn-assertion-${each.key}"
-  target_key_id = each.value.key_id
-}
-
-# The mint role can sign with exactly the active key. The public discovery
-# handler can read all currently published public keys, but can never sign.
-resource "aws_iam_role_policy" "turn_assertion_mint_kms" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  name  = "thinkwork-${var.stage}-turn-assertion-active-key"
-  role  = aws_iam_role.turn_assertion_mint[0].id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["kms:Sign"]
-      Resource = [local.agentcore_turn_assertion_active_key.key_id]
-      Condition = {
-        StringEquals = {
-          "kms:SigningAlgorithm" = "RSASSA_PKCS1_V1_5_SHA_256"
-        }
-      }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "turn_assertion_jwks_kms" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-  name  = "thinkwork-${var.stage}-turn-assertion-published-keys"
-  role  = aws_iam_role.lambda.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["kms:GetPublicKey"]
-      Resource = [for key in values(local.agentcore_turn_assertion_keys) : key.key_id]
-    }]
-  })
+  mcp_oauth_api_base_url       = "https://${aws_apigatewayv2_api.main.id}.execute-api.${var.region}.amazonaws.com"
+  mcp_oauth_cognito_base_url   = var.cognito_auth_domain != "" ? "https://${var.cognito_auth_domain}.auth.${var.region}.amazoncognito.com" : ""
+  mcp_oauth_identity_providers = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
+  mcp_oauth_logo_path          = "${path.module}/../../../../apps/web/public/logo.png"
 }
 
 resource "aws_dynamodb_table" "mcp_oauth_revocations" {

package/dist/terraform/modules/app/lambda-api/memory-alarms.tf

@@ -2,9 +2,7 @@
 #
 # Alarms here fire from metrics that EXIST without any log-group management:
 #   - AWS/Lambda Errors for the memory-stage worker and the retraction drainer
-#     (handler crashes, including ones that never reach a log line);
-#   - the wiki-compile DLQ depth (the only memory-path Lambda with an
-#     on_failure destination).
+#     (handler crashes, including ones that never reach a log line).
 #
 # DELIBERATELY NOT HERE — log-metric filters over the drainer's structured
 # summary line and the worker's "status=failed" line. They require the
@@ -18,8 +16,8 @@
 # packages/api/scripts/external-memory-readiness.ts (which reports due,
 # failed, and dead-lettered attempts directly from the ledger).
 #
-# Also runbook-only (no metric exists): source checkpoint age, graph-to-wiki
-# lag, evidence lag, deferred identity count/age.
+# Also runbook-only (no metric exists): source checkpoint age, evidence lag,
+# deferred identity count/age.
 #
 # alarm_actions are empty: the only SNS topic in this module
 # (aws_sns_topic.cost_alerts) is the cost-alert channel — wiring memory alarms
@@ -67,26 +65,3 @@ resource "aws_cloudwatch_metric_alarm" "memory_retraction_drainer_lambda_errors"
   }
 }
 
-# ---------------------------------------------------------------------------
-# wiki-compile DLQ depth (graph → wiki handoff failures)
-# ---------------------------------------------------------------------------
-
-resource "aws_cloudwatch_metric_alarm" "wiki_compile_dlq_depth" {
-  count = local.deploy_lambda_handlers ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-wiki-compile-dlq-depth"
-  alarm_description   = "wiki-compile DLQ has messages — a compile invocation crashed before the job ledger recorded an outcome; canonical pages are stale until replayed."
-  namespace           = "AWS/SQS"
-  metric_name         = "ApproximateNumberOfMessagesVisible"
-  statistic           = "Maximum"
-  period              = 60
-  evaluation_periods  = 1
-  threshold           = 1
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    QueueName = aws_sqs_queue.wiki_compile_dlq[0].name
-  }
-}

package/dist/terraform/modules/app/lambda-api/oauth-secrets.tf

@@ -36,8 +36,7 @@ resource "aws_secretsmanager_secret_version" "oauth_google_productivity" {
   })
 
   # If the operator rotates the secret via AWS console / CLI without touching
-  # tfvars, terraform shouldn't clobber it on next apply. Matches the pattern
-  # used for google_places_api_key in the wiki-compile handler.
+  # tfvars, terraform shouldn't clobber it on next apply.
   lifecycle {
     ignore_changes = [secret_string]
   }

package/dist/terraform/modules/app/lambda-api/outputs.tf

@@ -8,41 +8,6 @@ output "api_endpoint" {
   value       = local.api_base_url
 }
 
-output "agentcore_turn_assertion_issuer" {
-  description = "Proof-only CUSTOM_JWT issuer on the regional HTTP API."
-  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_issuer : ""
-}
-
-output "agentcore_harness_audience" {
-  description = "Purpose-bound audience for proof Harness invocations."
-  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_harness_audience : ""
-}
-
-output "agentcore_gateway_audience" {
-  description = "Purpose-bound audience for proof Gateway operations."
-  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_gateway_audience : ""
-}
-
-output "agentcore_turn_assertion_active_key_arn" {
-  description = "Operator-only active proof signing key ARN used by deployed verification probes."
-  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_active_key.key_id : ""
-}
-
-output "agentcore_turn_assertion_active_kid" {
-  description = "Public JWKS key identifier for the active proof signing key."
-  value       = var.enable_agentcore_multiplayer_proof ? local.agentcore_turn_assertion_active_key.kid : ""
-}
-
-output "agentcore_proof_oauth_issuer" {
-  description = "Synthetic proof OAuth issuer on the regional HTTP API."
-  value       = var.enable_agentcore_multiplayer_proof ? "${local.mcp_oauth_api_base_url}/agentcore-proof/oauth" : ""
-}
-
-output "agentcore_proof_target_base_url" {
-  description = "Regional HTTP API base URL hosting the controlled identity target."
-  value       = var.enable_agentcore_multiplayer_proof ? local.mcp_oauth_api_base_url : ""
-}
-
 output "api_execution_arn" {
   description = "API Gateway V2 execution ARN (for Lambda permissions)"
   value       = aws_apigatewayv2_api.main.execution_arn
@@ -83,16 +48,6 @@ output "workflow_execution_callback_fn_arn" {
   value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["workflow-execution-callback"].arn : ""
 }
 
-output "okf_efs_refresh_fn_name" {
-  description = "OKF EFS refresh Lambda function name."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["okf-efs-refresh"].function_name : ""
-}
-
-output "okf_efs_refresh_fn_arn" {
-  description = "OKF EFS refresh Lambda ARN."
-  value       = local.deploy_lambda_handlers ? aws_lambda_function.handler["okf-efs-refresh"].arn : ""
-}
-
 output "brain_artifacts_bucket_name" {
   description = "Canonical ThinkWork Brain S3 bucket for source artifacts, ingestion manifests, migration snapshots, vault projections, and exports."
   value       = aws_s3_bucket.brain_artifacts.bucket
@@ -165,6 +120,23 @@ output "mcp_custom_domain_validation" {
   ] : []
 }
 
+# --- THINK-915 chat turn-latency observability -------------------------------
+
+output "chat_turn_latency_dashboard_name" {
+  description = "CloudWatch dashboard carrying the chat turn-latency phase metrics, dispatch Duration p95, and turn-path Lambda invocations/errors. Empty when the feature is disabled."
+  value       = local.chat_latency_enabled ? aws_cloudwatch_dashboard.chat_turn_latency[0].dashboard_name : ""
+}
+
+output "chat_turn_latency_metric_namespace" {
+  description = "CloudWatch namespace holding TurnRuntimeInvokeMs / AgentLoopMs for this stage."
+  value       = local.chat_latency_namespace
+}
+
+output "chat_turn_runtime_log_group_name_effective" {
+  description = "AgentCore Pi runtime log group actually used by the AgentLoopMs metric filter and the saved turn-timeline query (explicit override, else prefix discovery). Empty when the runtime has not logged yet."
+  value       = local.chat_latency_runtime_log_group
+}
+
 output "mcp_custom_domain_target" {
   description = "Regional target for the final mcp.thinkwork.ai → API Gateway CNAME. Only populated on the second apply (when mcp_custom_domain_ready = true). Includes { target_domain_name, hosted_zone_id } so the CF sync script can upsert the record."
   value = var.mcp_custom_domain != "" && var.mcp_custom_domain_ready ? {

package/dist/terraform/modules/app/lambda-api/turn-assertion.tf

@@ -0,0 +1,45 @@
+# Signed-turn identity (THINK-324 Wave-3 C18).
+#
+# An asymmetric SIGN_VERIFY key per published version label. The dispatch
+# Lambdas (chat-agent-invoke, wakeup-processor) mint a short-lived assertion
+# binding {tenant, thread, turn} into the Pi invoke payload; the runtime
+# echoes it on callbacks; verifiers (tool-executions today, more in C19)
+# check the signature locally against the cached public key. The private key
+# never leaves KMS — a compromised Lambda cannot exfiltrate the signer.
+#
+# The `agentcore_turn_assertion_*` variables predate this plane's rebuild
+# (the THINK-311 trial's key was destroyed with the managed harness); the
+# same one-or-two-version rotation contract applies.
+
+resource "aws_kms_key" "agentcore_turn_assertion" {
+  for_each = toset(var.agentcore_turn_assertion_key_versions)
+
+  description              = "ThinkWork ${var.stage} signed-turn assertion key (${each.key})"
+  key_usage                = "SIGN_VERIFY"
+  customer_master_key_spec = "ECC_NIST_P256"
+  deletion_window_in_days  = 7
+
+  lifecycle {
+    precondition {
+      condition     = contains(var.agentcore_turn_assertion_key_versions, var.agentcore_turn_assertion_active_key_version)
+      error_message = "agentcore_turn_assertion_active_key_version must be one of agentcore_turn_assertion_key_versions."
+    }
+  }
+
+  tags = {
+    Stage     = var.stage
+    Component = "turn-assertion"
+  }
+}
+
+resource "aws_kms_alias" "agentcore_turn_assertion" {
+  for_each = toset(var.agentcore_turn_assertion_key_versions)
+
+  name          = "alias/thinkwork-${var.stage}-turn-assertion-${each.key}"
+  target_key_id = aws_kms_key.agentcore_turn_assertion[each.key].key_id
+}
+
+locals {
+  turn_assertion_active_key_arn = aws_kms_key.agentcore_turn_assertion[var.agentcore_turn_assertion_active_key_version].arn
+  turn_assertion_key_arns       = [for key in aws_kms_key.agentcore_turn_assertion : key.arn]
+}