Python aws agent core

.bedrock_agentcore.yaml

@@ -1,23 +1,127 @@
-agentRuntimeName: jira-readiness-agent
-entrypoint: src/agent/main.py
-runtime: python3.12
-buildContext: .
-networkConfig:
-  type: PUBLIC
-observabilityConfig:
-  enabled: true
-authorizerConfiguration:
-  customJWTAuthorizer:
-    discoveryUrl: ${AGENTCORE_JWT_DISCOVERY_URL}
-    allowedAudience: ["${AGENTCORE_JWT_AUDIENCE}"]
-environmentVariables:
-  AGENT_PROFILE: aws
-  AWS_REGION: ${AWS_REGION}
-  BEDROCK_MODEL_ID: us.anthropic.claude-sonnet-4-5-20250929-v1:0
-  MCP_BASE_URL: http://mcp-internal.internal:8081/mcp
-secretsManagerArns:
-  - ${MCP_BEARER_TOKEN_ARN}
-  - ${JIRA_API_TOKEN_ARN}
-  - ${ANTHROPIC_API_KEY_ARN}
-  - ${BEDROCK_GUARDRAIL_IDENTIFIER_ARN}
-  - ${BEDROCK_GUARDRAIL_VERSION_ARN}
+default_agent: jira_readiness_agent
+agents:
+  create_agent:
+    name: create_agent
+    language: python
+    node_version: '20'
+    entrypoint: src/agent/server.py
+    deployment_type: container
+    runtime_type: null
+    platform: linux/arm64
+    container_runtime: docker
+    source_path: /Users/davidparry/code/github/aws-agent-core
+    aws:
+      execution_role: arn:aws:iam::577638396504:role/jira-readiness-agent-execution
+      execution_role_auto_create: false
+      account: '577638396504'
+      region: us-east-1
+      ecr_repository: null
+      ecr_auto_create: false
+      s3_path: null
+      s3_auto_create: false
+      network_configuration:
+        network_mode: PUBLIC
+        network_mode_config: null
+      protocol_configuration:
+        server_protocol: HTTP
+      observability:
+        enabled: true
+      lifecycle_configuration:
+        idle_runtime_session_timeout: null
+        max_lifetime: null
+    bedrock_agentcore:
+      agent_id: null
+      agent_arn: null
+      agent_session_id: null
+    codebuild:
+      project_name: null
+      execution_role: null
+      source_bucket: null
+    memory:
+      mode: STM_ONLY
+      memory_id: create_agent_mem-d9eb8hDNS3
+      memory_arn: arn:aws:bedrock-agentcore:us-east-1:577638396504:memory/create_agent_mem-d9eb8hDNS3
+      memory_name: create_agent_mem
+      event_expiry_days: 30
+      first_invoke_memory_check_done: true
+      was_created_by_toolkit: true
+    identity:
+      credential_providers: []
+      workload: null
+    aws_jwt:
+      enabled: false
+      audiences: []
+      signing_algorithm: ES384
+      issuer_url: null
+      duration_seconds: 300
+    authorizer_configuration: null
+    request_header_configuration: null
+    oauth_configuration: null
+    api_key_env_var_name: null
+    api_key_credential_provider_name: null
+    is_generated_by_agentcore_create: false
+  jira_readiness_agent:
+    name: jira_readiness_agent
+    language: python
+    node_version: '20'
+    entrypoint: src/agent/server.py
+    deployment_type: container
+    runtime_type: null
+    platform: linux/arm64
+    container_runtime: docker
+    source_path: /Users/davidparry/code/github/aws-agent-core
+    aws:
+      execution_role: arn:aws:iam::577638396504:role/jira-readiness-agent-execution
+      execution_role_auto_create: false
+      account: '577638396504'
+      region: us-east-1
+      ecr_repository: 577638396504.dkr.ecr.us-east-1.amazonaws.com/bedrock-agentcore-jira_readiness_agent
+      ecr_auto_create: false
+      s3_path: null
+      s3_auto_create: false
+      network_configuration:
+        network_mode: VPC
+        network_mode_config:
+          security_groups:
+          - sg-0f3c0db822d3d7cda
+          subnets:
+          - subnet-0fef3db39a146229e
+          - subnet-007eaee970b15a41d
+      protocol_configuration:
+        server_protocol: HTTP
+      observability:
+        enabled: true
+      lifecycle_configuration:
+        idle_runtime_session_timeout: null
+        max_lifetime: null
+    bedrock_agentcore:
+      agent_id: jira_readiness_agent-cnVZj34P86
+      agent_arn: arn:aws:bedrock-agentcore:us-east-1:577638396504:runtime/jira_readiness_agent-cnVZj34P86
+      agent_session_id: null
+    codebuild:
+      project_name: bedrock-agentcore-jira_readiness_agent-builder
+      execution_role: arn:aws:iam::577638396504:role/AmazonBedrockAgentCoreSDKCodeBuild-us-east-1-846bb58ffc
+      source_bucket: bedrock-agentcore-codebuild-sources-577638396504-us-east-1
+    memory:
+      mode: STM_ONLY
+      memory_id: jira_readiness_agent_mem-25jINP8uDf
+      memory_arn: arn:aws:bedrock-agentcore:us-east-1:577638396504:memory/jira_readiness_agent_mem-25jINP8uDf
+      memory_name: jira_readiness_agent_mem
+      event_expiry_days: 30
+      first_invoke_memory_check_done: true
+      was_created_by_toolkit: false
+    identity:
+      credential_providers: []
+      workload: null
+    aws_jwt:
+      enabled: false
+      audiences: []
+      signing_algorithm: ES384
+      issuer_url: null
+      duration_seconds: 300
+    authorizer_configuration: null
+    request_header_configuration: null
+    oauth_configuration: null
+    api_key_env_var_name: null
+    api_key_credential_provider_name: null
+    is_generated_by_agentcore_create: false

.cursorignore

@@ -0,0 +1,12 @@
+.coverage
+htmlcov/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.hypothesis/
+.import_linter_cache/
+.env
+.env.local
+.env.*.local
+*.pem
+*.key

.dockerignore

@@ -4,6 +4,25 @@
 # Keep the build context tight so docker layer caching is effective and
 # developer-only state never leaks into the image.  The runtime image
 # only needs `pyproject.toml`, `README.md`, and `src/` (see Dockerfile).
+#
+# IMPORTANT — `agentcore deploy` does NOT honor this file.
+# The bedrock-agentcore-starter-toolkit hardcodes its own bundled
+# `dockerignore.template` (verified in
+#   bedrock_agentcore_starter_toolkit.services.codebuild
+#   ::CodeBuildService._parse_dockerignore
+# and `utils/runtime/package.py::_get_ignore_patterns`). The toolkit
+# template excludes `terraform/`, `cdk/`, `tests/`, `docs/`, and
+# `mcp/lambda/`, but NOT `mcp/` itself.
+#
+# `mcp/` no longer carries the ~62 MB Spring Boot fat-JAR (it is
+# resolved from `${MCP_INTERNAL_REPO}/build/libs` at build time — see
+# `scripts/build_mcp_image.sh` and `mcp/README.md`), so the size driver
+# behind the original AgentCore source.zip bloat is gone. The
+# stash-and-restore in `scripts/bootstrap_agentcore_runtime.sh` is
+# retained as topology hygiene (the runtime container does not consume
+# anything from `mcp/`) and as defence-in-depth against future growth.
+# Tracked upstream under "AgentCore source-zip filtering" in
+# `docs/DEFERRED.md`.
 # =============================================================================
 
 # VCS / IDE / cache state.

.env.local.example

@@ -29,11 +29,20 @@ AGENT_PROFILE=local
 # `DynamoDbTokenBudgetEnforcer`.
 AGENT_BUDGET_SCOPE=local-pod-dev
 
-# --- LLM provider (Anthropic direct, local profile) --------------------------
-# Consumed by `anthropic_model_factory(api_key=...)`.
+# --- LLM provider (local profile) -------------------------------------------
+# `anthropic` uses the hosted Anthropic API. `ollama` runs fully local via
+# `langchain_ollama.ChatOllama` and does not require ANTHROPIC_API_KEY.
+LLM_PROVIDER=anthropic
+# Consumed only when LLM_PROVIDER=anthropic or DESIGN_LLM_PROVIDER=anthropic.
 ANTHROPIC_API_KEY=sk-ant-FILL-IN
 # Pinned in lockstep with BEDROCK_MODEL_ID for production parity.
 ANTHROPIC_MODEL=claude-sonnet-4-5-20250929
+# Consumed only when LLM_PROVIDER=ollama or DESIGN_LLM_PROVIDER=ollama.
+OLLAMA_BASE_URL=http://ollama:11434
+OLLAMA_MODEL=llama3.1
+# Optional; defaults to LLM_PROVIDER. Set to `ollama` to run the designer
+# locally even when the assessor stays on Anthropic.
+DESIGN_LLM_PROVIDER=anthropic
 
 # --- MCP transport (HTTP-streamable) -----------------------------------------
 # Cluster-internal URL; `localhost` variant only applies when port-forwarded.
@@ -71,9 +80,20 @@ AGENT_JIRA_ACCOUNT_ID=local-bot-account-id
 AGENT_JIRA_EMAIL=local-bot@example.test
 
 # --- Observability -----------------------------------------------------------
-# Selects the tracer factory: `jaeger` locally, `xray` in production.
+# Selects the tracer factory: `jaeger` (default, span-to-log fallback when
+# the OTLP SDK is missing), `otlp` (strict OTLP/HTTP — fails loudly on
+# missing SDK or endpoint), `noop` (no tracer), or `xray` (production AWS
+# profile only).
 OBSERVABILITY_BACKEND=jaeger
 
+# OTLP/HTTP exporter endpoint.  Defaults to the Jaeger sidecar's OTLP
+# receiver under `deploy/local/jaeger.yaml`; redirect to a real OTel
+# Collector / Datadog / Grafana Tempo / etc. by overriding here.  The
+# `OBSERVABILITY_BACKEND=otlp` peer choice **requires** this env var to
+# be reachable; the `OBSERVABILITY_BACKEND=jaeger` choice degrades to a
+# span-to-log shim if the endpoint is unreachable.
+OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4318/v1/traces
+
 # --- Webhook signing ---------------------------------------------------------
 # HMAC-SHA256 secret shared between Atlassian (webhook registration) and
 # `agent.infrastructure.signature.HmacSha256SignatureVerifier`. The local
@@ -85,7 +105,7 @@ WEBHOOK_HMAC_SECRET=local-dev-secret
 # value left blank or 0 disables that particular cap. The default window is
 # 1 hour (TOKEN_BUDGET_WINDOW_SECONDS=3600).
 #
-# Wired into `agent.application.token_governance.GovernedAssessmentLanguageModel`
+# Wired into `agent.application.token_governance.GovernedAgenticChatModel`
 # via `agent.composition.TokenGovernanceConfig`. The application enforces
 # them in addition to the AWS profile's hard cap (AgentCore Harness
 # `maxTokens` enforced at the runtime layer, terraform/agentcore-runtime).

.gitattributes

@@ -1,21 +1,21 @@
 # =============================================================================
-# Git LFS pins for the local mcp-internal Spring Boot JAR.
+# Git LFS pins.
 #
-# The `mcp-internal` HTTP-streamable MCP server ships as a Spring Boot
-# fat-JAR (`ai.qodo.mcp.InternalMcpApplication`, ~62 MB).
-# It is the build context for `mcp/Dockerfile` and is referenced by
-# `scripts/build_mcp_image.sh`. Storing it in Git LFS keeps `git clone`
-# fast on shallow checkouts and keeps the regular pack files small.
+# Historically `mcp/*.jar filter=lfs diff=lfs merge=lfs -text` lived here
+# so the ~62 MB `mcp-internal-*.jar` Spring Boot fat-JAR could ride along
+# in this repository without bloating the regular pack files.
 #
-# Developer prerequisite (one-time, host-level):
-#     brew install git-lfs && git lfs install
+# That pin has been removed: the JAR is now resolved from outside this
+# repository at build time by `scripts/build_mcp_image.sh`
+# (--jar / MCP_INTERNAL_JAR / ${MCP_INTERNAL_REPO}/build/libs/mcp-internal-*.jar
+# in that resolution order). The script stages the resolved JAR into
+# `mcp/.build/mcp-internal.jar` for the duration of `docker build` and
+# removes it on exit, so nothing ever needs to live in the working tree.
 #
-# After cloning the repository:
-#     git lfs pull
+# See `mcp/README.md` "External JAR contract" for the developer-facing
+# rationale and the matching CI wire-up in `.github/workflows/smoke.yml`
+# (downloads a Release artifact from the upstream `mcp-internal` repo).
 #
-# CI / production digest pinning is owned by `scripts/promote_mcp_image.sh`
-# (the production-only `mcp-internal` image-pin / bearer-token rotation
-# seam) and is independent of the local LFS pin.
+# Re-introduce an `lfs` pin here only if a future asset (a real binary
+# fixture, a test corpus, etc.) genuinely needs to ride in-tree.
 # =============================================================================
-
-mcp/*.jar filter=lfs diff=lfs merge=lfs -text