thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -116,6 +116,24 @@ variable "plugin_catalog_github_token_secret_arn" {
   default     = ""
 }
 
+variable "brain_m2m_platform_agent_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Company Brain platform-agent machine-lane secret (Cognito client-credentials blob, THINK-628). When set, the shared API Lambda role may read it so MCP config build can mint short-lived bearers for the Brain connector. Empty leaves the tkt_ lane untouched."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_api_url" {
+  description = "Optional Company Brain ops-api base URL (the API Gateway endpoint the Brain console uses, e.g. https://xxxx.execute-api.us-east-1.amazonaws.com). When set alongside brain_ops_m2m_secret_arn, the flagThreadToBrain mutation can POST /flags (THINK-781). Empty disables the Send-to-the-Brain action."
+  type        = string
+  default     = ""
+}
+
+variable "brain_ops_m2m_secret_arn" {
+  description = "Optional Secrets Manager ARN of the Brain agent-identity m2m secret (Cognito client-credentials blob for the ops-api operator pool, scope etl-agent/tasks — e.g. etl-platform/agent/cognito-m2m-brain). When set, the shared API Lambda role may read it so flagThreadToBrain can mint bearers for POST /flags (THINK-781)."
+  type        = string
+  default     = ""
+}
+
 variable "brain_artifacts_kms_key_arn" {
   description = "Optional KMS key ARN used to encrypt canonical ThinkWork Brain artifacts. AES256 encryption is used when unset."
   type        = string
@@ -148,6 +166,12 @@ variable "mobile_client_id" {
   type        = string
 }
 
+variable "console_client_id" {
+  description = "Optional Company Brain console client ID (U13). Empty when the console client is disabled — kept out of COGNITO_APP_CLIENT_IDS via compact()."
+  type        = string
+  default     = ""
+}
+
 variable "cognito_auth_domain" {
   description = "Cognito hosted UI domain prefix, e.g. thinkwork-dev. Empty disables MCP OAuth login."
   type        = string
@@ -164,11 +188,6 @@ variable "appsync_api_id" {
   type        = string
 }
 
-variable "kb_service_role_arn" {
-  description = "Bedrock Knowledge Base service role ARN"
-  type        = string
-}
-
 variable "agentcore_harness_execution_role_arn" {
   description = "Legacy Harness execution-role input retained for module compatibility. Request-path PassRole/control-plane grants were removed by THINK-316 U2."
   type        = string
@@ -208,9 +227,14 @@ variable "agentcore_turn_assertion_active_key_version" {
   type        = string
   default     = "v1"
 
+  # Membership in agentcore_turn_assertion_key_versions is enforced by a
+  # precondition on aws_kms_key.agentcore_turn_assertion — variable validations
+  # cannot reference other variables until Terraform 1.9, and this module
+  # supports the repo floor of Terraform 1.5 (the customer deployment runner
+  # pins 1.8.5).
   validation {
-    condition     = contains(var.agentcore_turn_assertion_key_versions, var.agentcore_turn_assertion_active_key_version)
-    error_message = "agentcore_turn_assertion_active_key_version must be present in agentcore_turn_assertion_key_versions."
+    condition     = can(regex("^[a-z0-9][a-z0-9-]{0,15}$", var.agentcore_turn_assertion_active_key_version))
+    error_message = "agentcore_turn_assertion_active_key_version must be a lowercase version label."
   }
 }
 
@@ -332,78 +356,44 @@ variable "extension_proxy_signing_secret" {
   default     = ""
 }
 
-variable "hindsight_endpoint" {
-  description = "Hindsight API endpoint (empty when enable_hindsight = false)"
-  type        = string
-  default     = ""
-}
-
-variable "hindsight_database_name" {
-  description = "Dedicated Hindsight database name (THINK-220 cutover flag). Empty = Hindsight tables live in the `hindsight` schema of the primary database; set = the api reads them from this database's `public` schema. Rides the SSM runtime-config document (getConfig), not Lambda env."
-  type        = string
-  default     = ""
-}
-
 variable "agentcore_memory_id" {
   description = "Bedrock AgentCore Memory resource ID — used by the GraphQL memory resolvers to list records across tenant agents."
   type        = string
   default     = ""
 }
 
-variable "memory_engine" {
-  description = "Active long-term memory engine for this deployment. Exactly one engine is canonical for recall/inspect/export."
-  type        = string
-  default     = "hindsight"
-  validation {
-    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
-  }
-}
-
-variable "analyst_egress_subnet_ids" {
-  description = "Private (NAT-routed) subnet IDs for VPC-attaching the analyst data-path handlers (graphql-http, analyst-query-broker, analyst-connection-reconciler) so external Postgres sources can allowlist the stack's stable NAT egress IP. Leave empty to keep the handlers outside any VPC."
-  type        = list(string)
-  default     = []
-}
-
-variable "analyst_egress_security_group_ids" {
-  description = "Security group IDs for the VPC-attached analyst data-path handlers. Leave empty to keep the handlers outside any VPC."
-  type        = list(string)
-  default     = []
-}
-
 variable "okf_efs_subnet_ids" {
-  description = "Subnet IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_security_group_ids" {
-  description = "Security group IDs for the OKF EFS hydrator Lambda VPC attachment. Leave empty to deploy the hydrator without an EFS mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_mount_target_ids" {
-  description = "EFS mount target IDs that must exist before creating the OKF EFS hydrator Lambda."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = list(string)
   default     = []
 }
 
 variable "okf_efs_file_system_arn" {
-  description = "EFS file system ARN for the OKF wiki current view. Empty disables EFS IAM grants."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = string
   default     = ""
 }
 
 variable "okf_efs_refresh_access_point_arn" {
-  description = "EFS access point ARN mounted by the okf-efs-refresh Lambda. Empty disables the mount."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = string
   default     = ""
 }
 
 variable "okf_efs_mount_path" {
-  description = "Local Lambda mount path for the OKF wiki EFS view. Must be under /mnt."
+  description = "DEPRECATED (THINK-589): no-op, removal pending. The OKF wiki EFS feature (okf-efs-refresh hydrator mount) is dead and this module no longer consumes the input. Declaration retained so existing passthroughs keep working until the follow-up PR deletes it."
   type        = string
   default     = "/mnt/thinkwork-okf"
 }
@@ -498,12 +488,6 @@ variable "admin_url" {
   default     = ""
 }
 
-variable "docs_url" {
-  description = "Docs site URL (e.g. https://d2grg1uavrp7lx.cloudfront.net)"
-  type        = string
-  default     = ""
-}
-
 variable "www_url" {
   description = "Marketing site URL (e.g. https://thinkwork.ai). Used for Stripe Checkout cancel_url and CORS origin."
   type        = string
@@ -576,24 +560,12 @@ variable "job_scheduler_role_arn" {
   default     = ""
 }
 
-variable "wiki_compile_model_id" {
-  description = "Bedrock model id the wiki-compile Lambda uses for the leaf planner, aggregation planner, and section writer. Any Converse-compatible model works. Override per-env if you want to spike a different model without re-deploying code."
-  type        = string
-  default     = "openai.gpt-oss-120b-1:0"
-}
-
 variable "brain_source_agent_model_id" {
   description = "Bedrock model id the GraphQL context-engine Brain source-agent runtime uses for JSON tool/action turns. Kept separate from the high-throughput wiki compiler model so source agents can use a model tuned for reliable action JSON."
   type        = string
   default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
 }
 
-variable "kg_obs_max_candidates_per_run" {
-  description = "Per-run candidate cap for the observations → Knowledge Graph ingest worker (KG_OBS_MAX_CANDIDATES_PER_RUN). Bounds the layered-gate classifier cost and lets truncated runs self-invoke to drain the remaining backlog. Stored as a string because the Lambda reads it verbatim from env."
-  type        = string
-  default     = "10"
-}
-
 variable "wiki_aggregation_pass_enabled" {
   description = "Feature flag for the wiki aggregation pass (parent section rollups + section promotion). Pipeline stops after leaf compile when this is off and never populates hub rollups. Stored as a string because the Lambda reads it verbatim from env; must be 'true' / '1' / 'yes' to enable."
   type        = string
@@ -606,26 +578,14 @@ variable "wiki_deterministic_linking_enabled" {
   default     = "true"
 }
 
-variable "kg_extraction_model_id" {
-  description = "Bedrock model id for knowledge-graph entity/relationship extraction from observations (plan 2026-07-03-005). Defaults to a gpt-oss high-quota model; overridable per stage."
-  type        = string
-  default     = "openai.gpt-oss-120b-1:0"
-}
-
-variable "knowledge_graph_observations_ingest_enabled" {
-  description = "Enable the recurring Brain distillation schedule (Hindsight observations -> knowledge graph). Ships disabled; dev flips on after a golden-set-validated manual run (plan 2026-07-03-005 U4)."
-  type        = bool
-  default     = false
-}
-
-variable "ontology_scan_sweep_enabled" {
-  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled; enabled per stage once the Living Map review surfaces land."
+variable "identity_drift_match_enabled" {
+  description = "Enable the recurring per-tenant identity drift match sweep (THINK-321 U7/KTD-7 — R10). Ships disabled; enabled per stage once bootstrap matching has been proven there."
   type        = bool
   default     = false
 }
 
 variable "wiki_source" {
-  description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer over the knowledge-graph mirror and makes successful observation-ingest runs the compile trigger. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
+  description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
   type        = string
   default     = "planner"
 
@@ -635,12 +595,6 @@ variable "wiki_source" {
   }
 }
 
-variable "google_places_api_key" {
-  description = "Google Places API (New) key used by wiki-compile for POI → city/state/country hierarchy enrichment. Stored as a SecureString SSM parameter at /thinkwork/<stage>/google-places/api-key. Empty default creates the parameter with a placeholder value; operator populates via `aws ssm put-parameter --overwrite`. The parameter's value has lifecycle.ignore_changes set so CLI rotation sticks across terraform applies. Compile gracefully degrades when the key is absent (metadata-only place rows) — never fails compile."
-  type        = string
-  default     = ""
-  sensitive   = true
-}
 
 # ---------------------------------------------------------------------------
 # Per-user OAuth client credentials
@@ -851,8 +805,19 @@ variable "compliance_exports_runner_role_name" {
   default     = ""
 }
 
-variable "knowledge_graph_tool_enabled" {
-  description = "Stage gate for the Pi knowledge_graph_search tool (plan 2026-06-09-004 U8). Per-agent tool policy gates on top."
+variable "agentcore_session_scope" {
+  description = "THINK-909/THINK-946 AgentCore runtime session scope for agentcore-runtime-dispatch. \"thread\" (default) keys the session per thread; \"user\" keys it per (tenant, agent, user) so a new thread reuses the user's warm microVM — and, per THINK-946, its retained MCP connections and toolset — falling back to the per-thread session on a 409. Set \"user\" only after the stage's Pi runtime image dual-accepts both session ids. mcpherson runs \"user\"; every other stage keeps the default."
+  type        = string
+  default     = "thread"
+
+  validation {
+    condition     = contains(["thread", "user"], var.agentcore_session_scope)
+    error_message = "agentcore_session_scope must be \"thread\" or \"user\"."
+  }
+}
+
+variable "identity_resolution_tool_enabled" {
+  description = "Stage gate for the Pi identity-resolution tools (resolve_entities / propose_mapping_candidates / confirm_mapping, THINK-321 U5). Per-agent tool policy gates on top."
   type        = bool
   default     = true
 }
@@ -893,44 +858,6 @@ variable "subscription_ticket_private_key_secret" {
   default     = ""
 }
 
-# ---------------------------------------------------------------------------
-# THINK-228 U3 — analyst query broker runtime config
-# ---------------------------------------------------------------------------
-
-variable "analyst_reader_secret_arn" {
-  description = "ARN of the Secrets Manager secret holding the `analyst_reader` Aurora role credentials (THINK-228 U2). Wired from `module.database.analyst_reader_secret_arn`. The analyst-query-broker Lambda executes model-authored SQL exclusively under this role."
-  type        = string
-  default     = ""
-}
-
-variable "analyst_broker_secret_arn" {
-  description = "ARN of the Secrets Manager secret holding the analyst query-broker caller credential (JSON {token, tenantId}; THINK-228 U3). Wired from `module.database.analyst_broker_secret_arn`. The broker validates incoming Bearer tokens against it; the seeded connector row references it as auth_config.secretRef."
-  type        = string
-  default     = ""
-}
-
-variable "analyst_policy_source" {
-  description = "THINK-229 KTD5 enforcement flip: 'row' (default — sidecar policy is shadow-only) or 'sidecar' (the signed sidecar policy block is authoritative: budgets + retain_sql flow into dispatch and the broker). Flip only after clean analyst-policy-shadow parity on live traffic AND a provision refresh so every connection sidecar carries a policy block."
-  type        = string
-  default     = "row"
-  validation {
-    condition     = contains(["row", "sidecar"], var.analyst_policy_source)
-    error_message = "analyst_policy_source must be 'row' or 'sidecar'."
-  }
-}
-
-variable "capability_self_extension_tenants" {
-  description = "Governed autonomy opt-in: comma/space-separated tenant ids allowed to autonomously self-extend capabilities (self_admit_connection / self_approve_routine). Empty (default) = NO tenant enabled; self-extension ships inert and fail-closed. Read via getConfig() in capability-control-service."
-  type        = string
-  default     = ""
-}
-
-variable "analyst_db_cluster_resource_id" {
-  description = "Immutable RDS cluster resource ID (cluster-XXXX / db-XXXX) for the stage database (THINK-229 U1). Wired from `module.database.cluster_resource_id`. Keys the broker's `rds-db:connect` IAM grant — the rds-db ARN format requires the resource ID, not the cluster ARN — and gates the IAM connect env on the broker Lambda: when empty, the broker stays on the password path."
-  type        = string
-  default     = ""
-}
-
 variable "artifact_delivery_from_email" {
   description = "Default SES from-address for artifact email delivery. Empty keeps the code fallback (noreply@agents.thinkwork.ai — only verified in the ThinkWork dev account, so customer stages MUST set this)."
   type        = string
@@ -986,3 +913,169 @@ variable "capability_broker_vpce_dns" {
   type        = string
   default     = ""
 }
+
+# ---------------------------------------------------------------------------
+# Company Brain twin (plan 2026-07-21-001 U5): Neptune wiring for the
+# identity-graph-projector. All default-empty — the projector deploys inert
+# (no VPC, no endpoint) until the stage's neptune outputs are supplied.
+# ---------------------------------------------------------------------------
+
+variable "neptune_endpoint" {
+  type        = string
+  default     = ""
+  description = "Neptune twin cluster writer endpoint (from the etl-platform neptune stack; empty = twin disabled)"
+}
+
+variable "brain_mcp_url" {
+  type        = string
+  default     = ""
+  description = "Platform-served Brain MCP endpoint (e.g. https://mcp.brain.thinkwork.ai/mcp). When set, twin-connector provisioning registers agents against it instead of the product /mcp/twin route (consolidation U14). Empty = legacy product-served default."
+}
+
+variable "neptune_cluster_resource_id" {
+  type        = string
+  default     = ""
+  description = "Neptune cluster resource id for neptune-db IAM ARNs (empty = no data-access grant)"
+}
+
+variable "neptune_subnet_ids" {
+  type        = list(string)
+  default     = []
+  description = "Private subnets for the identity-graph-projector's vpc_config (Neptune is VPC-only)"
+}
+
+variable "neptune_security_group_ids" {
+  type        = list(string)
+  default     = []
+  description = "SGs for the projector (the etl neptune stack's neptune-client SG)"
+}
+
+# ---------------------------------------------------------------------------
+# THINK-1082: every handler inside the VPC. Each handler carries DATABASE_URL
+# (common_env) and, with no vpc_config, reaches Aurora only over the cluster's
+# PUBLIC endpoint through the world-open 0.0.0.0/0 -> 5432 rule the
+# aurora-postgres module seeds. Revoking that rule took the whole app down
+# (auth-me -> DB timeout -> 401 "No tenant assigned"). With lambdas_in_vpc the
+# functions attach to the VPC's private subnets behind a security group the
+# database security group admits, so the public rule can be closed. All
+# default-off — the module deploys byte-identical until the caller opts in.
+# ---------------------------------------------------------------------------
+
+variable "lambdas_in_vpc" {
+  type        = bool
+  default     = false
+  description = "Attach every DB-connected Lambda in this module (all api handlers, compliance-anchor, compliance-export-runner) to the VPC via vpc_subnet_ids + vpc_security_group_ids so Aurora is reached by security group instead of the public endpoint. The subnets must be NAT-routed (handlers call AWS APIs, Bedrock, Slack, GitHub, ...). Requires non-empty vpc_subnet_ids and vpc_security_group_ids."
+}
+
+variable "vpc_subnet_ids" {
+  type        = list(string)
+  default     = []
+  description = "Private (NAT-routed) subnet IDs the handlers attach to when lambdas_in_vpc is true."
+}
+
+variable "vpc_security_group_ids" {
+  type        = list(string)
+  default     = []
+  description = "Security groups for the handlers when lambdas_in_vpc is true (the thinkwork module passes its api-lambda SG, which the database SG admits on tcp/5432). Merged with neptune_security_group_ids on the identity-graph-projector."
+}
+
+# Bulk-rebuild lane (THINK-331 U4): Neptune bulk-loader staging. Both
+# default-empty — bulk-rebuild returns a structured "not configured" error
+# until the etl-platform neptune stack's load bucket + loader role are
+# supplied.
+
+variable "neptune_load_bucket" {
+  type        = string
+  default     = ""
+  description = "Neptune bulk-load staging bucket name (etl-platform neptune stack; empty = bulk-rebuild disabled)"
+}
+
+variable "neptune_loader_role_arn" {
+  type        = string
+  default     = ""
+  description = "IAM role ARN the Neptune cluster assumes to read the load bucket (etl-platform neptune stack; empty = bulk-rebuild disabled)"
+}
+
+variable "lambda_max_memory_mb" {
+  type        = number
+  default     = 10240
+  description = "Account-level Lambda memory ceiling. Legacy AWS accounts cap function memory at 3008 MB (raised only via support case); handlers that request more are clamped to this value so deploys on capped accounts don't fail mid-apply."
+}
+
+# THINK-583 U3 — provisioned concurrency for the two chat-critical zip
+# Lambdas (chat-agent-invoke, workspace-renderer) ONLY (KTD5: never the Pi
+# Lambda). 0 (the default) disables the provisioned-concurrency config but
+# STILL creates the published version + `live` alias, so alias-qualified
+# invokers keep working on every stage; customer stages opt in on their own
+# release cadence. Dev is enabled via scripts/deploy/terraform-vars.sh
+# (deploy.yml is dev-only — same pattern as enable_capability_broker).
+
+variable "chat_agent_invoke_provisioned_concurrency" {
+  type        = number
+  default     = 0
+  description = "Provisioned concurrency on chat-agent-invoke's `live` alias. 0 = disabled (alias still exists)."
+}
+
+variable "workspace_renderer_provisioned_concurrency" {
+  type        = number
+  default     = 0
+  description = "Provisioned concurrency on workspace-renderer's `live` alias. 0 = disabled (alias still exists)."
+}
+
+variable "agentcore_runtime_dispatch_enabled" {
+  description = "THINK-585 U6 (KTD3): stage kill-switch for chat dispatch through the Bedrock AgentCore Runtime (per-thread sessions). The per-agent agents.agentcore_runtime_dispatch flag gates on top. Default off; dev opts in via the deploy workflow, customer stages via runner-secrets on their own cadence."
+  type        = bool
+  default     = false
+}
+
+variable "auth_state_store" {
+  description = "THINK-643: backing store for short-lived auth-flow state (AppSync subscription tickets + the per-principal connect rate-limit counter). \"postgres\" (default) keeps the Aurora `auth_subscription_tickets` path. \"dynamo\" provisions thinkwork-<stage>-auth-state and points the auth handlers at it; the authorizer still falls back to a Postgres read for tickets minted just before the flip."
+  type        = string
+  default     = "postgres"
+
+  validation {
+    condition     = contains(["postgres", "dynamo"], var.auth_state_store)
+    error_message = "auth_state_store must be \"postgres\" or \"dynamo\"."
+  }
+}
+
+################################################################################
+# THINK-915 — chat turn-latency observability
+# (see chat-latency-observability.tf for the constraints behind each of these)
+################################################################################
+
+variable "enable_chat_turn_latency_observability" {
+  description = "THINK-915: create the per-stage chat turn-latency dashboard, the saved thinkwork-<stage>-turn-timeline Logs Insights query, and the Lambda-native dispatch p95 alarm. On by default — none of these depend on a log group already existing."
+  type        = bool
+  default     = true
+}
+
+variable "enable_chat_turn_latency_metric_filters" {
+  description = "THINK-915: create the agentcore_phase log metric filters (TurnRuntimeInvokeMs, AgentLoopMs) and the metric-filter-backed p95 alarm. OFF by default: the Lambda log groups are created implicitly on first invocation and are not Terraform-managed, so PutMetricFilter fails with ResourceNotFoundException on a greenfield stage (see memory-alarms.tf). Turn on for a stage that has already served chat traffic."
+  type        = bool
+  default     = false
+}
+
+variable "chat_turn_latency_metric_namespace" {
+  description = "THINK-915: CloudWatch namespace prefix for the chat phase metrics. The stage is appended (Thinkwork/Chat/<stage>) because metric-filter dimensions may only reference JSON fields of the matched log event, and the agentcore_phase record carries no stage field."
+  type        = string
+  default     = "Thinkwork/Chat"
+}
+
+variable "chat_turn_runtime_log_group_name" {
+  description = "THINK-915: explicit AgentCore Pi runtime log group (/aws/bedrock-agentcore/runtimes/thinkwork_<stage>_pi-<runtimeId>-DEFAULT). Empty (default) skips the runtime-sourced metric, widgets, and query leg — plan-time prefix discovery was removed because it defers to apply in customer deployment-runner plans and breaks them."
+  type        = string
+  default     = ""
+}
+
+variable "chat_turn_p95_alarm_threshold_ms" {
+  description = "THINK-915: p95 threshold (ms) for the whole AgentCore runtime call, breaching on 2 of 3 five-minute periods."
+  type        = number
+  default     = 30000
+}
+
+variable "chat_turn_latency_alarm_actions" {
+  description = "THINK-915: SNS topic ARNs notified by the chat turn-latency alarms (also used as OK actions). Empty by default — the only topic in this module is the cost-alert channel, and latency pages do not belong there."
+  type        = list(string)
+  default     = []
+}

package/dist/{plugins/n8n/terraform → terraform/modules/app}/n8n/README.md

@@ -89,7 +89,7 @@ packages.
 
 ```hcl
 module "n8n" {
-  source = "../../../plugins/n8n/terraform/n8n"
+  source = "../app/n8n"
 
   stage                = var.stage
   vpc_id               = module.vpc.vpc_id

package/dist/{plugins/n8n/terraform → terraform/modules/app}/n8n/main.tf

@@ -292,24 +292,24 @@ resource "terraform_data" "database_lifecycle" {
 
 resource "terraform_data" "configuration_guardrails" {
   input = {
-    runtime_enabled                         = var.runtime_enabled
-    main_desired_count                      = var.main_desired_count
-    worker_desired_count                    = var.worker_desired_count
-    image_uri                               = var.image_uri
-    public_url                              = var.public_url
-    certificate_arn                         = var.certificate_arn
-    database_host                           = var.database_host
-    database_name                           = var.database_name
-    database_username                       = var.database_username
-    database_url_secret_arn                 = local.effective_database_url_secret_arn
-    encryption_key_secret_arn               = local.effective_encryption_key_secret_arn
-    operator_secret_arn                     = local.effective_operator_secret_arn
-    service_credential_secret_arn           = local.effective_service_credential_secret_arn
-    storage_bucket_name                     = var.storage_bucket_name
-    storage_prefix                          = local.storage_prefix
-    queue_mode                              = var.queue_mode
-    cache_engine                            = var.cache_engine
-    cache_subnet_ids                        = local.effective_cache_subnet_ids
+    runtime_enabled               = var.runtime_enabled
+    main_desired_count            = var.main_desired_count
+    worker_desired_count          = var.worker_desired_count
+    image_uri                     = var.image_uri
+    public_url                    = var.public_url
+    certificate_arn               = var.certificate_arn
+    database_host                 = var.database_host
+    database_name                 = var.database_name
+    database_username             = var.database_username
+    database_url_secret_arn       = local.effective_database_url_secret_arn
+    encryption_key_secret_arn     = local.effective_encryption_key_secret_arn
+    operator_secret_arn           = local.effective_operator_secret_arn
+    service_credential_secret_arn = local.effective_service_credential_secret_arn
+    storage_bucket_name           = var.storage_bucket_name
+    storage_prefix                = local.storage_prefix
+    queue_mode                    = var.queue_mode
+    cache_engine                  = var.cache_engine
+    cache_subnet_ids              = local.effective_cache_subnet_ids
   }
 
   lifecycle {

package/dist/terraform/modules/app/sandbox-log-scrubber/README.md

@@ -5,17 +5,18 @@ redacts known-shape OAuth tokens in AgentCore `APPLICATION_LOGS` before they
 land in the long-term CloudWatch tier. See plan Unit 12 +
 `docs/brainstorms/2026-04-22-agentcore-code-sandbox-requirements.md` R13.
 
-## Relationship to the primary scrubber
+## The only scrubbing layer (THINK-617)
 
-The primary layer is the base-image `sitecustomize.py` stdio wrapper shipped
-by [`terraform/modules/app/agentcore-code-interpreter`](../agentcore-code-interpreter/)
-(plan Unit 4). That layer redacts by **value** — session-scoped token
-strings registered by the preamble — and can therefore catch any token the
-agent's own preamble has handled.
+The plan's primary layer was a base-image `sitecustomize.py` stdio wrapper
+redacting by **value** (plan Unit 4). It never ran: AgentCore Code Interpreter
+has no custom-image parameter, so the blessed image was unattachable and the
+[`agentcore-code-interpreter`](../agentcore-code-interpreter/) image substrate
+has been retired. Sandboxes run the AWS-managed image, so this filter is the
+only scrubbing in force.
 
-This backstop redacts by **pattern**: it has no access to session values,
-only to the bytes that reach CloudWatch. It exists to mitigate *stdio-bypass
-classes* named in R13's residual list:
+It redacts by **pattern**: it has no access to session values, only to the
+bytes that reach CloudWatch. It covers the _stdio-bypass_ classes named in
+R13's residual list —
 
 - `subprocess.run(['env'])`, `subprocess.run(['cat', '/proc/self/environ'])`
 - `os.write(fd, ...)` at the file-descriptor level
@@ -25,7 +26,7 @@ classes* named in R13's residual list:
 - Adversarial split-writes that fragment a token across more bytes than the
   rolling-buffer window
 
-When those bytes carry a token whose *shape* is recognizable, this backstop
+When those bytes carry a token whose _shape_ is recognizable, this backstop
 catches it. When they don't (bespoke token formats, high-entropy opaque
 strings with no prefix), only the v2 in-process credential proxy can help.
 

package/dist/terraform/modules/app/sandbox-log-scrubber/main.tf

@@ -5,11 +5,11 @@
 # (plan Unit 12). Pattern-redacts known-shape OAuth tokens in AgentCore
 # APPLICATION_LOGS before they land in the long-term CloudWatch tier.
 #
-# **This is not the primary R13 layer.** The primary layer is the base-image
-# sitecustomize.py stdio wrapper (plan Unit 4, terraform/modules/app/
-# agentcore-code-interpreter) which redacts by *value* using the session-
-# scoped token set. That layer can catch any token the preamble registered,
-# regardless of shape.
+# **This is the only scrubbing layer that actually runs (THINK-617).** The plan
+# called for a primary value-based layer in a blessed base image's
+# sitecustomize.py (Unit 4), but AgentCore Code Interpreter has no custom-image
+# parameter, so that image was never attachable and has been retired. Sandboxes
+# run the AWS-managed image; only this pattern backstop is in force.
 #
 # This backstop redacts by *pattern* — Authorization: Bearer, JWTs, and
 # known OAuth prefixes (gh[opsru]_, xox[abep]-, ya29.). It does not have

package/dist/terraform/modules/app/static-site/main.tf

@@ -55,7 +55,7 @@ variable "viewer_request_function_code" {
 # Response-headers policy (optional, plan-012 U3)
 #
 # Two opt-in forms, both backwards compatible — existing callers
-# (computer_site, docs_site, www_site) leave both unset and the
+# (computer_site, www_site) leave both unset and the
 # distribution is created with no response-headers policy attached:
 #
 #   - Pass `response_headers_policy_id` to attach an existing policy by id.