cscott/hncb-fusion-deid-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
25a005e7408da719c6177a3f5ae38b240f7b38b5
hncb-fusion-deid-demo/AGENTS.md

12 KiB
Raw Blame History

AGENTS.md

Guidance for Codex working in this repo. Read this first.

What this is

A demo (not production) of a reversible PII de-identification round trip for HNCB: advisor query with a real name → tokenized before it leaves for the cloud → Amazon Bedrock AgentCore agent reasons on tokens only → identity restored on-prem before the advisor sees the answer. Everything runs in one AWS account; "on-prem" is a logical, tag-labelled zone standing in for the branch data centre. The demo proves data-flow behaviour, not physical residency.

Critical context

  • Fusion is a shared SaaS instance. DO NOT build, host, or Terraform it. It is configured in the Amplify AI Gateway console (see fusion/POLICY_SETUP.md). Because it is SaaS, anything it calls must be a public HTTPS endpoint with auth — it cannot reach private VPC resources or use local AWS creds.
  • This means the AWS side's job is to expose two endpoints Fusion will call: /tokenize (ingress) and /restore (egress), plus host the detector, vault, RAG tool, and agent. See the task backlog below.
  • Detection ≠ redaction. The detector returns typed findings; our code owns minting tokens, writing the vault, and restoring. Never redact-and-discard.
  • Tokens must be random per request and stored in the vault keyed by session.

Architecture (maps to the customer's 8 steps)

Advisor UI → Fusion SaaS → [/tokenize: detect (Presidio) + mint + vault-write] → AgentCore Runtime (Bedrock model) → tool call via AgentCore Gateway → RAG Lambda (resolve token → de-identified evidence) → agent talking points → Fusion SaaS → [/restore: vault lookup] → Advisor UI.

Repo map

terraform/       DynamoDB (vault + customers), RAG Lambda, IAM, Presidio hosting
lambda_rag/      RAG tool (real): token resolve -> evidence package
gateway_api/     TODO: /tokenize and /restore HTTPS endpoints Fusion calls  (T1, T2)
agent/           Strands agent for AgentCore Runtime + tool schema
presidio/        detector service (typed findings) + Dockerfile
seed/            fake customer (Wang Xiaoming) + seed script
ui/              advisor UI (restored-vs-tokenized split view)
scripts/         deploy.sh, agentcore_setup.sh, teardown.sh
fusion/          POLICY_SETUP.md (SaaS console config — human does this, not you)

Commands

  • Deploy core infra: bash scripts/deploy.sh (review first)
  • Seed data: VAULT_TABLE=... CUSTOMERS_TABLE=... python seed/seed.py --with-demo-token
  • AgentCore: bash scripts/agentcore_setup.sh (verify against agentcore --help)
  • Teardown (do this to stop spend): bash scripts/teardown.sh
  • Terraform: run all terraform commands with -chdir=terraform.

Conventions & guardrails

  • Region default us-east-1 (best Bedrock/AgentCore quotas). Keep it a variable.
  • Never commit AWS creds, tokens, or real PII. Seed data is synthetic only.
  • Python: standard library + boto3; keep handlers small and dependency-light.
  • Pin bedrock-agentcore / strands-agents versions before agentcore launch — these SDKs move fast; verify signatures against installed versions, don't assume.
  • Prefer Lambda Function URLs (with auth) or API Gateway for the public endpoints.
  • After any infra change, remind the human to teardown when done recording.

Task backlog (pick these up)

Each task: keep it demo-grade, add a note in the file, and update this list.

  • T1 — /tokenize endpoint ✅ done + live-verified (gateway_api/tokenize/handler.py, terraform terraform/gateway.tf). Lambda behind a public API Gateway HTTP API (not a Function URL — this account's SCP blocks unauthenticated Function URLs), shared-secret auth (tokenize_api_key, sent as x-api-key / bearer, checked in-handler). Calls Presidio /analyze, resolves overlapping findings (specific entity wins, so the ROC ID stays TW_ROC_ID not PERSON), mints random CUST_<rand>/TW_<rand> tokens, writes vault rows {token, type, value, session_id, expires_at [, customer_id]} (value = original PII for /restore; customer_id best-effort resolved for the RAG tool), splices right-to-left, returns {deidentified_prompt, session_id}. Verified live in ap-southeast-1: 王小明→CUST_*, A123456789→TW_*, clean prompt, vault rows written with resolved customer_id, repeat→different tokens, no/bad key→401. Infra changes made while deploying: Presidio task bumped to 2GB (1GB OOM'd on the 603MB zh model → connection refused), awslogs added, ARM64/Graviton runtime (built on Apple Silicon via podman). All AWS objects tagged Owner="conan hncb demo". Caveats: Presidio has no stable endpoint — its Fargate public IP changes per task launch, so presidio_url in terraform/local.auto.tfvars must be refreshed and the tokenize Lambda re-applied (an ALB/Cloud Map would fix this; out of scope for the demo). The default VPC was created by hand and tagged maintenance=manual-cleanup-required (Terraform doesn't own it, so teardown.sh won't remove it).
  • T2 — /restore endpoint ✅ done + live-verified (gateway_api/restore/handler.py, terraform in terraform/gateway.tf). POST /restore on the same API Gateway, same shared-secret auth; IAM is read-only dynamodb:Scan on the vault. Input {session_id, text} → scans the vault for THIS session's tokens (scoped, so one session can't restore another's), swaps inline tokens back to the original PII (longest-token-first), and prepends the customer's real name at the envelope level (（客戶：王小明）). Returns {final, restored}. Verified live with the full T1→T2 round trip: tokenized prompt out → simulated token-only cloud answer → 王小明 + A123456789 restored, no tokens left; no/bad key → 401; unknown session → text unchanged, restored:0 (no cross-session leak). restore_url is a Terraform output.
  • T3 — reachability from SaaS ✅ done + live-verified (terraform/ecs.tf, terraform/gateway.tf). Presidio is now private: its SG allows 5001 only from the tokenize Lambda's SG (no 0.0.0.0/0). The tokenize Lambda runs in the VPC (vpc_config + AWSLambdaVPCAccessExecutionRole) and reaches Presidio on its private IP; DynamoDB is reached via a gateway VPC endpoint (no NAT). The Fargate task keeps a public IP only to pull from ECR, but all inbound is SG-locked. Only the API Gateway (/tokenize + /restore, shared-secret auth) is public. Verified live: Presidio's public IP :5001 now times out from the internet; the full round trip still works through the private path. Caveat update: the tokenize Lambda now targets Presidio's private IP (172.31.2.216 currently), which still changes per task launch — refresh presidio_url in terraform/local.auto.tfvars and re-apply aws_lambda_function.tokenize if the task restarts (Cloud Map/ALB would give a stable name; out of scope for the demo).
  • T4 — AgentCore Gateway target ✅ done + live-verified (terraform/agentcore.tf, scripts/agentcore_setup.sh, scripts/gateway_invoke_test.py). Created an MCP Gateway (hncb-rag-gateway, authorizerType=AWS_IAM so inbound is SigV4 — no Cognito) with the RAG Lambda registered as a lambda MCP target; the Gateway assumes a Terraform-managed IAM role that can only lambda:InvokeFunction the RAG tool. Built the Gateway/target with aws bedrock-agentcore-control (Terraform lags here). Verified live: gateway_invoke_test.py (SigV4 MCP initialize→tools/list→tools/call) returned the full de-identified evidence package for CUST_000123 through the Gateway; the tool shows up namespaced as rag___get_customer_activity_summary. Gotchas handled: the Gateway inputSchema is a restricted JSON-Schema subset (strip default/unknown keys); MCP responses can be SSE; tool names are target-prefixed. Gateway tagged Owner="conan hncb demo"; teardown.sh deletes it (not in Terraform state). MCP URL is printed by the setup script. Note: .venv-t4/ (gitignored) holds boto3 for the invoke test.
  • T5 — Agent runtime ✅ done + live-verified (agent/agent.py, agent/requirements.txt, scripts/agentcore_setup.sh T5 section). Pinned deps (bedrock-agentcore 1.16.0 / strands-agents 1.45.0 / mcp 1.28.1 / boto3 1.43.38), agentcore configure --non-interactive + agentcore launch (cloud CodeBuild, auto-created execution role + ECR + STM memory). Runtime ARN: arn:aws:bedrock-agentcore:ap-southeast-1:286171702468:runtime/hncb_advisor_agent-duWZOT5Far. Verified live: agentcore invoke {"prompt": "...CUST_000123..."} returns numbered talking points built only from the de-identified evidence — no name, no leaked token. Three gotchas fixed (all captured in code/scripts):
    1. In ap-southeast-1 the model is INFERENCE_PROFILE-only → use apac.anthropic.Codex-3-5-sonnet-20241022-v2:0, not the raw id.
    2. Our Gateway is AWS_IAM, so agent.py SigV4-signs MCP requests (httpx.Auth) instead of using a bearer token.
    3. The auto-created runtime execution role can't call the Gateway by default → must attach bedrock-agentcore:InvokeGateway on the gateway ARN (the launch step in agentcore_setup.sh shows the exact command). Runtime + memory added to teardown.sh; agent logic was de-risked locally before launch.
  • T6 — UI wiring ✅ done + live-verified (ui/index.html, terraform/ui.tf, gateway_api/orchestrator/). Hosted on S3 + CloudFront (private bucket, OAC). For the Fusion-less dry run I added a thin demo orchestrator (POST /demo, a Lambda on the same API) that runs the full chain server-side — /tokenize → SigV4 InvokeAgentRuntime → /restore — and returns {final, deidentified_prompt, agent_tokenized} (this stands in for Fusion ONLY for the dry run; we still never build/host Fusion). index.html reads the live endpoint from a generated config.js (so no ephemeral URL is committed) and renders the split view. CORS enabled on the API. UI: https://d3n89cj9w7ynf0.cloudfront.net. Verified live: CloudFront serves index.html + config.js (200); /demo returns 王小明→CUST_* on the cloud side and 王小明-restored talking points on the advisor side. Only the browser render itself is left as a human eyeball check. All resources tagged.
  • T7 — E2E rehearsal ✅ done + live-verified (README demo/deploy sections rewritten with the real commands). Ran the full round trip via /demo (王小明→CUST_317499 out, agent talking points on tokens only, 王小明 restored). Money shot proven: in the cloud runtime CloudWatch trace for that session the token appears in 13 events while 王小明 and A123456789 appear in 0 — the Bedrock/AgentCore trace is token-only. Teardown verified (non-destructively): terraform destroy targets 43 resources (Fargate, CloudFront, S3, DynamoDB, all Lambdas, API GW, VPC endpoint, SGs, IAM) and teardown.sh additionally deletes the Gateway/targets, Runtime, Memory, and both ECR repos — i.e. every billed resource. Residual is free-only: the hand-made default VPC, the AgentCore SDK exec role, an idle CodeBuild project. The actual teardown.sh run is left for the human to fire after recording (didn't auto-destroy the live demo).

Known caveats (don't "fix" these silently)

  • zh-TW detection is demo-narrow (tuned to the scripted entities), not production recall.
  • The agentic token-resolution loop (T4) is custom orchestration by design.
  • If you touch fusion/, it's documentation for a human — do not try to automate SaaS config.