## Flow diagram

```mermaid
flowchart TB
  advisor(["Advisor (browser)"])
  ui["Advisor UI<br/>S3 + CloudFront<br/>(split view)"]

  subgraph entry["Entry / orchestration"]
    fusion["Fusion SaaS (prod)<br/>— or —<br/>/demo Lambda (Fusion-less dry run)"]
  end

  subgraph cloudzone["CLOUD zone (Zone=cloud-VPC-B) — sees TOKENS only"]
    runtime["AgentCore Runtime<br/>Strands agent + Bedrock<br/>apac Claude 3.5 Sonnet v2"]
    gateway["AgentCore Gateway<br/>MCP · AWS_IAM / SigV4"]
  end

  subgraph onprem["ON-PREM zone (Zone=on-prem-VPC-A) — holds the reversible map + PII"]
    tokenize["/tokenize Lambda (in-VPC)<br/>detect → mint → vault → splice"]
    presidio["Presidio detector<br/>Fargate (PRIVATE, SG-locked :5001)"]
    vault[("DynamoDB VAULT<br/>token &lt;-&gt; PII (+customer_id)")]
    customers[("DynamoDB CUSTOMERS<br/>raw records — never leave")]
    rag["RAG tool Lambda<br/>token -> evidence (no PII out)"]
    restore["/restore Lambda<br/>re-attach identity"]
  end

  advisor -- "1 query: 王小明 + A123456789" --> ui
  ui -- "POST {query}" --> fusion
  fusion -- "2 {query}" --> tokenize
  tokenize -- "POST /analyze" --> presidio
  presidio -- "typed findings" --> tokenize
  tokenize -- "write {token,type,value,session}" --> vault
  tokenize -- "3 deidentified_prompt (CUST_*)" --> runtime
  runtime -- "4 tools/call get_customer_activity_summary(CUST_*)" --> gateway
  gateway -- "5 invoke (SigV4)" --> rag
  rag -- "6 resolve token" --> vault
  rag -- "read record" --> customers
  rag -- "7 evidence package (token-keyed, no PII)" --> runtime
  runtime -- "talking points (tokens only)" --> fusion
  fusion -- "8 {session_id, text}" --> restore
  restore -- "lookup session tokens" --> vault
  restore -- "final: （客戶：王小明）…" --> fusion
  fusion -- "{final, deidentified_prompt, agent_tokenized}" --> ui
  ui -- "split view: restored vs tokenized" --> advisor
```