---
title: "refactor: Remove external provider-as-task-connector terraform plumbing"
type: refactor
status: completed
date: 2026-04-28
origin: docs/brainstorms/2026-04-28-pre-launch-cleanup-sweep-requirements.md
---

# refactor: Remove external provider-as-task-connector terraform plumbing

## Overview

Remove the `task_system_tasks_api_url` Terraform variable definitions and the `task_system_tasks_API_URL` Lambda env-var injection across five terraform files. The external provider-as-task-connector surface was retired 2026-04-20; the external provider-as-MCP-server surface stays and is **not** affected by this PR.

The precondition called out in the origin doc — "no Lambda handler still reads the env var" — is satisfied: a repo-wide grep across `packages/`, `apps/` (excluding `apps/cli/dist/` build artifacts), and `scripts/` returns zero readers of `task_system_tasks_API_URL` or `task_system_tasks_api_url`. The variable currently injects the value as an env on the `graphql-http` (or sibling api-lambda) function, but no handler code consumes it — it has been a no-op env entry since the connector retirement.

This is item R2 in the pre-launch cleanup sweep brainstorm and is intentionally a single-PR change per the origin's "one PR per cleanup item" Key Decision.

## Problem Frame

Dead Terraform variables are worse than dead code in two ways: (1) they appear in `terraform plan` output as live config, suggesting they still matter; (2) when grouped with related variables (per-tenant connector wiring, OAuth, Bedrock model IDs) they imply the external provider task connector is still part of the live integration surface. Operators reading the module signature can reasonably mistake the variable for active wiring. Removing it makes the module signature reflect reality.

## Requirements Trace

- R1. Remove the `task_system_tasks_api_url` variable from greenfield example, thinkwork umbrella module, and lambda-api module (origin §Requirements R2, see origin: `docs/brainstorms/2026-04-28-pre-launch-cleanup-sweep-requirements.md`).
- R2. Remove the `task_system_tasks_API_URL` env injection from the api-lambda function definition (origin §Requirements R2).
- R3. Confirm pre-removal that no Lambda handler still reads the env var (origin §Requirements R2 precondition; verified during planning — see Open Questions §Resolved During Planning).
- R4. After removal, repo-wide grep for `task_system_tasks_api_url` and `task_system_tasks_API_URL` returns zero hits in `terraform/` (origin §Success Criteria).

## Scope Boundaries

- **Out of scope: anything external provider-as-MCP-server.** The CLI commands (`thinkwork mcp add mobile-host`, `thinkwork mcp update routing-server`, `--oauth-provider mobile-host`), the per-user MCP OAuth wiring, and the external provider MCP server registration all stay untouched. Only the task-connector REST surface is being removed.
- **Out of scope: per-tenant `webhooks.config.baseUrl`.** The greenfield `task_system_tasks_api_url` variable description references a per-tenant override that lived on the retired admin Connectors page. The connector UI was already removed in an earlier sweep (see brainstorm `docs/brainstorms/2026-04-20-remove-admin-connectors-requirements.md`); any residual `webhooks.config.baseUrl` rows in the database are application data and not in scope here.
- **Out of scope: the `outbound sync path` and `syncExternalTaskOnCreate` code.** The variable description mentions an outbound sync path that was removed when the connector was retired; that code cleanup (if any residue exists) is its own concern, not blocked by this PR.
- **Out of scope: the `apps/cli/dist/terraform/...` bundled copies.** These are CLI build artifacts regenerated by the CLI's bundling step; they should not be hand-edited. Whether the dist regeneration ships in this PR or rides along the next CLI release is an implementation-time choice — see Open Questions §Deferred to Implementation.
- **Out of scope: `terraform.tfvars.example`.** Verified during planning that this file does not currently set a value for `task_system_tasks_api_url`, so there is nothing to remove there.

## Context & Research

### Relevant Code and Patterns

- `terraform/examples/greenfield/main.tf:151-165` — variable declaration with a long heredoc description; line `:297` passes it through to the `thinkwork` module along with a 3-line explanatory comment block at `:295-296`.
- `terraform/modules/thinkwork/main.tf:219` — single-line pass-through to the `app` module.
- `terraform/modules/thinkwork/variables.tf:359-363` — variable declaration.
- `terraform/modules/app/lambda-api/handlers.tf:67` — env-var injection. Lines `:63-66` are an explanatory comment block that becomes orphaned once the injection is removed.
- `terraform/modules/app/lambda-api/variables.tf:249-253` — variable declaration.
- All 5 files are atomic in one PR; terraform's variable-reference checks pass as long as every reference is removed alongside every declaration.

### Institutional Learnings

- "external provider-as-task-connector is retired (2026-04-20); external provider-as-MCP-server stays. Don't conflate them when sweeping." (memory: `project_mobile-host_two_surfaces`)
- "ThinkWork supersedes maniflow" — the variable dates from the maniflow era when this was the primary task integration. The `apps/cli/dist/` artifacts mirror the source modules and are regenerated by the CLI build (per `CLAUDE.md`: "`apps/cli` … bundles Terraform modules").

### External References

- _None._ This is internal-only Terraform module surgery; no AWS-provider or community-pattern research required.

## Key Technical Decisions

- **One PR for all 5 files.** Terraform validates references atomically. Splitting (e.g., remove the env injection in PR1, then the variable in PR2) would temporarily break `terraform validate` between PRs and provides no safety benefit.
- **Remove orphaned comments alongside the code.** The 4-line external provider comment block at `terraform/modules/app/lambda-api/handlers.tf:63-66` and the 2-line comment block at `terraform/examples/greenfield/main.tf:295-296` exist only to explain the env injection / pass-through. They become misleading once the code is gone — delete them in the same change.
- **Don't pre-migrate the example variable description.** The variable description in `greenfield/main.tf:151-160` references the retired admin Connectors page. Since the variable itself is being deleted, no rewrite is needed.
- **Defer CLI dist regeneration to implementation.** The implementer should follow whatever the existing CLI build flow expects (run the CLI's build/bundle script, commit regenerated `apps/cli/dist/terraform/...` files if they are tracked in git, otherwise skip). This decision depends on current CLI build conventions and is recorded in Deferred Implementation Questions.

## Open Questions

### Resolved During Planning

- "Does any Lambda handler still read `task_system_tasks_API_URL`?" — Resolved: **no**. Grep across `packages/`, `apps/` (excluding `apps/cli/dist/`), and `scripts/` for `task_system_tasks_API_URL` and `task_system_tasks_api_url` returns zero matches in code; only terraform files (and their bundled cli/dist mirrors) still reference the symbol. Precondition satisfied.
- "Does `terraform.tfvars.example` set a value that needs to be removed?" — Resolved: **no**. Grep of `terraform/examples/greenfield/terraform.tfvars.example` for `mobile-host` returns zero matches.
- "Does the **gitignored** `terraform.tfvars` (operator-local config) set a value?" — Resolved: **yes**. `terraform/examples/greenfield/terraform.tfvars:29-31` actively assigns `task_system_tasks_api_url = "https://api-dev.mobile-host-tei.com"` (this operator's dev-stage value). Because the file is gitignored, this assignment exists per-operator and cannot be cleaned up via the PR — every operator with an existing dev-stage `terraform.tfvars` must remove the 3 lines locally before running `terraform plan`, or terraform will error with `Error: Value for undeclared variable task_system_tasks_api_url`. See U1 Approach for the local-cleanup step and Documentation / Operational Notes for the cross-operator callout.
- "Are the CLI mentions of `mobile-host` in `apps/cli/src/commands/mcp.ts` and `apps/cli/src/lib/resolve-identifier.ts` related?" — Resolved: **no**. All CLI source mentions reference the external provider-as-MCP-server flow (`thinkwork mcp add mobile-host`, `--oauth-provider mobile-host`, `routing-server`), which stays.
- "Is `apps/cli/dist/terraform/...` tracked in git?" — Resolved: **no**. Confirmed via `git ls-files apps/cli/dist/terraform/` returning empty. Dist mirrors are regenerated locally by the CLI build (`apps/cli/scripts/bundle-terraform.js`); they are not part of any PR's diff and need no special handling here.

### Deferred to Implementation

- _None._ Planning verified the CLI dist artifacts are gitignored (no PR action needed) and that the tfvars assignment requires per-operator local cleanup (captured in U1 Approach + Documentation / Operational Notes below).

## Implementation Units

- U1. **Delete the external provider tasks variable and env injection across all 5 terraform files**

**Goal:** Atomically remove the variable declaration in 3 places, the pass-through wiring in 2 places, the Lambda env injection, and the orphaned comment blocks that explained the now-removed wiring.

**Requirements:** R1, R2, R3, R4.

**Dependencies:** None. Precondition (no code reader of the env var) verified during planning.

**Files:**
- Modify: `terraform/examples/greenfield/main.tf` — remove the `variable "task_system_tasks_api_url"` block (currently `:151-165`) **and** the pass-through line + 2-line comment block (currently `:295-297`).
- Modify: `terraform/modules/thinkwork/main.tf` — remove the pass-through line (currently `:219`).
- Modify: `terraform/modules/thinkwork/variables.tf` — remove the `variable "task_system_tasks_api_url"` block (currently `:359-363`).
- Modify: `terraform/modules/app/lambda-api/handlers.tf` — remove the `task_system_tasks_API_URL = var.task_system_tasks_api_url` line (currently `:67`) **and** the 4-line comment block above it (currently `:63-66`).
- Modify: `terraform/modules/app/lambda-api/variables.tf` — remove the `variable "task_system_tasks_api_url"` block (currently `:249-253`).

**Approach:**
- Edit all 5 files in one commit. Terraform's variable-reference validation requires consumer and declaration to disappear together.
- Remove orphaned comments in the same edit so reviewers see the full intent of the cleanup.
- **Operator-local tfvars cleanup (precondition for `terraform plan`).** Before running `terraform plan`, remove the `task_system_tasks_api_url = ...` assignment + the 2-line comment block above it from any local `terraform/examples/greenfield/terraform.tfvars`. This file is gitignored (so it cannot be cleaned up via the PR itself), but its assignment will cause terraform to error with `Value for undeclared variable` once U1's variable declaration is gone. Verify with `grep mobile-host terraform/examples/greenfield/terraform.tfvars` returning zero hits.
- After the source edits and the local tfvars cleanup, run `terraform validate` from `terraform/examples/greenfield/` (or the equivalent dev-stack init dir) to confirm the module graph still resolves.
- Run `terraform plan` against the dev stage to confirm the only diff is the `task_system_tasks_API_URL` env-var key being removed from the relevant Lambda function definitions. Any other diff is a surprise that must be explained before merging.
- CLI dist regeneration is **not** required for this PR — `apps/cli/dist/terraform/...` is gitignored and rebuilt locally by `apps/cli/scripts/bundle-terraform.js` when the CLI is next released.

**Patterns to follow:**
- Standard pre-commit gate: `pnpm lint && pnpm typecheck && pnpm test && pnpm format:check` per `CLAUDE.md`.
- Match the existing terraform module style — no formatting churn beyond the deleted lines.

**Test scenarios:**
- Test expectation: none — terraform module signature surgery with no behavioral change. Validation comes from `terraform validate` and a clean `terraform plan` diff (see Verification).

**Verification:**
- `git status` shows exactly 5 modified files; no other source changes (`apps/cli/dist/terraform/...` is gitignored).
- Local `terraform/examples/greenfield/terraform.tfvars` no longer contains the `task_system_tasks_api_url` assignment (verified by `grep mobile-host <tfvars>` returning zero hits).
- `terraform validate` passes from the greenfield example directory.
- `terraform plan` against the dev stage shows only the `task_system_tasks_API_URL` env-var key being removed from the affected Lambda function(s); no other plan diff. If terraform errors with `Value for undeclared variable task_system_tasks_api_url`, the local tfvars cleanup step was skipped — go back and apply it.
- Repo-wide grep for `task_system_tasks_api_url` and `task_system_tasks_API_URL` across `terraform/`, `packages/`, `apps/admin`, `apps/mobile`, `apps/cli/src`, and `scripts/` returns zero hits.
- After deploy to dev: `aws lambda get-function-configuration --function-name thinkwork-dev-api-graphql-http` (or the relevant lambda name) does not list `task_system_tasks_API_URL` in its env vars.

## Documentation / Operational Notes

- **PR description must call out the operator-local tfvars cleanup.** The `terraform.tfvars` file at `terraform/examples/greenfield/terraform.tfvars` is gitignored, so each operator (Eric + any teammate with a dev-stage checkout) keeps a private copy that currently contains `task_system_tasks_api_url = "..."`. After this PR merges, anyone with that file will hit `Error: Value for undeclared variable task_system_tasks_api_url` on their next `terraform plan`. The PR description should include a one-line note: _"After pulling, remove the `task_system_tasks_api_url` assignment + 2-line comment from your local `terraform/examples/greenfield/terraform.tfvars` before running `terraform plan`."_

## Sources & References

- **Origin document:** [docs/brainstorms/2026-04-28-pre-launch-cleanup-sweep-requirements.md](../brainstorms/2026-04-28-pre-launch-cleanup-sweep-requirements.md)
- Related earlier cleanup: [docs/brainstorms/2026-04-20-remove-admin-connectors-requirements.md](../brainstorms/2026-04-20-remove-admin-connectors-requirements.md) — removed the admin Connectors page that the variable's description still mentions.
- Related code: `terraform/examples/greenfield/main.tf`, `terraform/modules/thinkwork/{main.tf, variables.tf}`, `terraform/modules/app/lambda-api/{handlers.tf, variables.tf}`.
