refactored the docs

docs/Flow Diagram.mmd

@@ -0,0 +1,44 @@
+## Flow diagram
+
+```mermaid
+flowchart TB
+  advisor(["Advisor (browser)"])
+  ui["Advisor UI<br/>S3 + CloudFront<br/>(split view)"]
+
+  subgraph entry["Entry / orchestration"]
+    fusion["Fusion SaaS (prod)<br/>— or —<br/>/demo Lambda (Fusion-less dry run)"]
+  end
+
+  subgraph cloudzone["CLOUD zone (Zone=cloud-VPC-B) — sees TOKENS only"]
+    runtime["AgentCore Runtime<br/>Strands agent + Bedrock<br/>apac Claude 3.5 Sonnet v2"]
+    gateway["AgentCore Gateway<br/>MCP · AWS_IAM / SigV4"]
+  end
+
+  subgraph onprem["ON-PREM zone (Zone=on-prem-VPC-A) — holds the reversible map + PII"]
+    tokenize["/tokenize Lambda (in-VPC)<br/>detect → mint → vault → splice"]
+    presidio["Presidio detector<br/>Fargate (PRIVATE, SG-locked :5001)"]
+    vault[("DynamoDB VAULT<br/>token &lt;-&gt; PII (+customer_id)")]
+    customers[("DynamoDB CUSTOMERS<br/>raw records — never leave")]
+    rag["RAG tool Lambda<br/>token -> evidence (no PII out)"]
+    restore["/restore Lambda<br/>re-attach identity"]
+  end
+
+  advisor -- "1 query: 王小明 + A123456789" --> ui
+  ui -- "POST {query}" --> fusion
+  fusion -- "2 {query}" --> tokenize
+  tokenize -- "POST /analyze" --> presidio
+  presidio -- "typed findings" --> tokenize
+  tokenize -- "write {token,type,value,session}" --> vault
+  tokenize -- "3 deidentified_prompt (CUST_*)" --> runtime
+  runtime -- "4 tools/call get_customer_activity_summary(CUST_*)" --> gateway
+  gateway -- "5 invoke (SigV4)" --> rag
+  rag -- "6 resolve token" --> vault
+  rag -- "read record" --> customers
+  rag -- "7 evidence package (token-keyed, no PII)" --> runtime
+  runtime -- "talking points (tokens only)" --> fusion
+  fusion -- "8 {session_id, text}" --> restore
+  restore -- "lookup session tokens" --> vault
+  restore -- "final: （客戶：王小明）…" --> fusion
+  fusion -- "{final, deidentified_prompt, agent_tokenized}" --> ui
+  ui -- "split view: restored vs tokenized" --> advisor
+```