cscott/hncb-fusion-deid-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement reversible PII de-identification round trip (T1–T7)

Browse Source 
Build the AWS side of the HNCB demo end to end (region ap-southeast-1):

- T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret
  auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap
  resolution so a ROC ID stays TW_ROC_ID.
- T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB
  gateway endpoint); only /tokenize + /restore are public.
- T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4);
  agentcore_setup.sh + a SigV4 MCP invoke test.
- T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac
  inference profile, pinned deps.
- T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo)
  chaining tokenize -> runtime -> restore.
- T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR.

Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the
real name. Secrets stay in gitignored local.auto.tfvars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Conan Scott
2026-07-01 17:10:58 +10:00
parent 6b2a051be3
commit 78d67a2469
21 changed files with 1439 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ui/index.html
View File

@@ -40,19 +40,26 @@
<div class="card cloud">
<h2>What the cloud actually saw <span class="tag">tokenized</span></h2>
<pre id="deid">—</pre>
<h2 style="margin-top:12px">Agent talking points <span class="tag">tokenized</span></h2>
<pre id="agent">—</pre>
</div>
</div>
</div>
<!-- Injected at deploy time (S3) with the live demo orchestrator URL. -->
<script src="config.js"></script>
<script>
// TODO: point this at your Fusion gateway endpoint after deploy.
const GATEWAY_URL = "http://REPLACE_ME_FUSION_HOST:8080/advisor";
// Fusion is shared SaaS; for a self-contained dry run the UI calls the demo
// orchestrator (/demo), which runs tokenize -> agent -> restore server-side.
// In production, point this at the Fusion gateway entrypoint instead.
const GATEWAY_URL = window.DEMO_ENDPOINT || "http://REPLACE_ME_FUSION_HOST:8080/advisor";
async function run() {
const btn = document.getElementById("go");
btn.disabled = true;
document.getElementById("final").textContent = "…thinking…";
document.getElementById("deid").textContent = "…";
document.getElementById("agent").textContent = "…";
try {
const res = await fetch(GATEWAY_URL, {
method: "POST",
@@ -60,9 +67,10 @@
body: JSON.stringify({ query: document.getElementById("q").value }),
});
const data = await res.json();
// Fusion is expected to return { final, deidentified_prompt }.
// Orchestrator (or Fusion) returns { final, deidentified_prompt, agent_tokenized }.
document.getElementById("final").textContent = data.final || JSON.stringify(data, null, 2);
document.getElementById("deid").textContent = data.deidentified_prompt || "(gateway did not echo the de-identified prompt)";
document.getElementById("deid").textContent = data.deidentified_prompt || "(no de-identified prompt echoed)";
document.getElementById("agent").textContent = data.agent_tokenized || "(no agent answer)";
} catch (e) {
document.getElementById("final").textContent = "Error: " + e.message;
} finally {