Architecture
How the portfolio thinks
Two surfaces, same product language as Ops: the always-on Bedrock RAG path, and the approval-gated ephemeral EKS LangGraph lab.
Architecture surface
Public Experience
Visitor Browser[agentic]
public website entrypoint
Portfolio Ops Panel[agentic]
Ask · Inspect · Evaluate
Eval Badge[agentic]
57/60 golden · 16/16 agent
Edge + API
CloudFront Edge[agentic]
one public hostname for every surface
Query API[agentic]
answer + inspect + traceId
Eval API[agentic]
runs + summary
Trace API[agentic]
trace by id + drill-in
Core APIs[agentic]
ingest · docs · search (MCP)
Thin Agent Layer
Orchestrator[agentic]
thin workflow, not a giant agent
Retrieval Tool[agentic]
RAG is one tool
Self-Check[agentic]
LLM-as-judge grounding
Guard + Fan-out[agentic]
grounding guard · fan-out · validators
Concept Router[agentic]
abstract terms → project evidence
Visitor Gate[agentic]
interrupt · clarify · extend the loop
Knowledge + Models
Hybrid Embed[agentic]
Titan dense + BM25 sparse query path
Hybrid Retrieval[agentic]
RRF fusion + score floor
Qdrant[agentic]
hybrid collection
Answer Model[agentic]
final answer + inspect payload
Humanizer[agentic]
second Nova pass, every answer
State + Storage
Quota Push (IoT Core)
MQTT/WSS retained · live
Upload + Meta[agentic]
core corpus state
Session Store[agentic]
thread memory only
Trace Store[agentic]
query-level artifacts
Evals + Traces
Trace Builder[agentic]
step-by-step answer trace
Eval Runner[agentic]
scheduled and on-demand
Golden Query Suite[agentic]
60 retrieval + 16 agent cases
Threshold Judge[agentic]
source, retrieval, answer, latency
Eval Results[agentic]
public pass/fail history
Baseline mode traces the single-shot RAG path; Agentic mode is the live bounded loop, plan → retrieve → self-check → answer, with the grounding guardrail, the deterministic profile fan-out, and a concept router that bridges abstract questions (race conditions, idempotency) to the right project evidence. Broad profile answers are now forced to stand on project evidence rather than an indexed biography shortcut. Uploads are session-scoped: retrieved only for the visitor who added them. Retrieval is hybrid today: Titan dense embeddings plus BM25 sparse vectors fused in Qdrant with a calibrated confidence floor. Every answer then takes a second humanizer pass before it streams, and enumerated answers are policed deterministically (invalid filter lines dropped, omitted members appended) as visible guard steps, behind per-IP and global daily quotas.
Cloud infrastructure
AWS · multi-region · serverlessThe same system drawn with the official AWS Architecture Icons, the real services, regions, and request flow behind the demo, with the denial-of-wallet guardrails called out.
Why these choices
Read the decision records →The diagram shows what the system is. These records cover why: the alternatives I rejected and the costs I took on, each verifiable in the live system.