feat: configure inbound SMS webhooks

docs/bootstrap.md

@@ -2,17 +2,17 @@
 
 ## Scope
 
-This root validates the OpenTofu toolchain, remote state backend, encrypted provider-credential delivery, and Twilio provider authentication. It now also owns the pilot phone-number inventory: exactly one purchased US local SMS/MMS-capable number per primary agent (`lawnmowerman`, `grillmaster`, `homesteader`, `homerepair`), declared in `numbers.tf`.
+This root validates the OpenTofu toolchain, remote state backend, encrypted provider-credential delivery, and Twilio provider authentication. It owns the pilot phone-number inventory: exactly one purchased US local SMS/MMS-capable number per primary agent (`lawnmowerman`, `grillmaster`, `homesteader`, `homerepair`), declared in `numbers.tf`.
 
-It configures **no** inbound messaging webhook. The `messaging` block on each number is added only in a separately reviewed change after the `kustomize-cluster` bridge is reconciled, healthy, and explicitly approved for functional testing. The root does not own the bridge workload, Cloudflare workload route or DNS, number-to-agent mapping, approved-source allowlist, bridge credentials, or runtime encryption material; those runtime concerns belong to `kustomize-cluster`.
+It also owns the four numbers' inbound `messaging` webhook fields. Each uses `POST` to the healthy, cluster-owned `https://sms.makeitwork.cloud/twilio/inbound` bridge endpoint. The root does not own the bridge workload, Cloudflare workload route or DNS, number-to-agent mapping, approved-source allowlist, bridge credentials, or runtime encryption material; those runtime concerns belong to `kustomize-cluster`.
 
 The evaluated provider is `RJPearson94/twilio` `0.27.1`. The provider is intentionally configured with no static attributes: OpenTofu receives its credentials only in a SOPS `exec-env` child, and the resource `account_sid` reaches OpenTofu only as `TF_VAR_account_sid` inside that same child process. The purchased number values live only in remote state and the `agent_phone_numbers` output.
 
 ## Intended message flow
 
-The owner's intended outcome is one Twilio phone number for each primary agent. Each number will initially accept inbound SMS/MMS only from the one owner-approved source phone number, then route the request to its corresponding agent for a timely reply using that agent's existing context, knowledge base, and MCP integrations. The sender allowlist is intentionally extensible: adding a further approved source number after the pilot is a separate runtime-configuration change, not a Twilio-root redesign.
+The owner's intended outcome is one Twilio phone number for each primary agent. Each number initially accepts inbound SMS/MMS only from the one owner-approved source phone number, then routes the request to its corresponding agent for a timely reply using that agent's existing context, knowledge base, and MCP integrations. The sender allowlist is intentionally extensible: adding a further approved source number after the pilot is a separate runtime-configuration change, not a Twilio-root redesign.
 
-`kustomize-cluster` exclusively owns the bridge workload, number-to-agent map, sender allowlist and its later expansion, runtime secrets, `TunnelBinding`/DNS, and public route. This root may later own only the Twilio number inventory and the inbound messaging-webhook fields pointing at the already-healthy bridge. It must not duplicate any bridge/runtime configuration.
+`kustomize-cluster` exclusively owns the bridge workload, number-to-agent map, sender allowlist and its later expansion, runtime secrets, `TunnelBinding`/DNS, and public route. This root owns only the Twilio number inventory and inbound messaging-webhook fields pointing at the already-healthy bridge. It must not duplicate bridge/runtime configuration.
 
 ## Backend and credential contract
 

main.tf

@@ -1,4 +1,3 @@
-# This root has a selected remote backend but intentionally contains no Twilio
-# resources, data sources, provider configuration, or secret material. A later
-# reviewed change must establish encrypted credential delivery before adding a
-# provider block or managing Twilio inventory.
+# The selected remote backend, provider constraints, and provider configuration live
+# in providers.tf. Twilio number inventory and inbound messaging webhooks live in
+# numbers.tf; runtime bridge configuration remains cluster-owned.

numbers.tf

@@ -1,13 +1,16 @@
 # One pilot number per primary agent. Purchased US local numbers with SMS
-# and MMS capability; no inbound webhook is configured here. The messaging
-# webhook is added only after the kustomize-cluster bridge is healthy.
+# and MMS capability; each inbound message is delivered to the healthy,
+# cluster-owned bridge. Routing, sender allowlisting, and runtime secrets remain
+# owned by kustomize-cluster.
 
 variable "account_sid" {
   type        = string
   description = "Twilio account SID, supplied only from SOPS exec-env through TF_VAR_account_sid."
 }
 
 locals {
+  inbound_messaging_url = "https://sms.makeitwork.cloud/twilio/inbound"
+
   agent_numbers = {
     lawnmowerman = "opencode-sms lawnmowerman"
     grillmaster  = "opencode-sms grillmaster"
@@ -31,6 +34,11 @@ resource "twilio_phone_number" "agent" {
       mms_enabled = true
     }
   }
+
+  messaging {
+    url    = local.inbound_messaging_url
+    method = "POST"
+  }
 }
 
 output "agent_phone_numbers" {