Staging - #575
Open
rafaelpereyra wants to merge 10 commits into
Open
Conversation
The AgentCore constructs that follow need L1 resources and alpha modules that 2.241 does not ship. Bumped on its own so the dependency change is reviewable in isolation from the feature work.
Waggle, the PetStore assistant: a Strands orchestrator that delegates to four framework-diverse sub-agents, each on a different model and provider, each auto-instrumented by ADOT so one trace spans several agent frameworks. | Agent | Framework | Model | | ------------ | ----------------- | ----------------- | | orchestrator | Strands | Claude Sonnet 5 | | nutrition | LangGraph | Claude Sonnet 5 | | ordering | CrewAI | Nova 2 Lite | | adoption | LlamaIndex | Llama 4 Maverick | | concierge | OpenAI Agents SDK | gpt-oss-120b | Each agent is a package holding an `agent.py` (agent + tools) and a `server.py` (AgentCore Runtime entrypoint). Shared pieces live in `common/`: config resolved from SSM, the model registry, an AgentCore Memory helper for short and long-term recall, and a thin client over the PetStore backends. `rag/` provisions and queries a nutrition Knowledge Base on S3 Vectors over a 10-document corpus. Auth is SigV4 throughout via the standard credential chain — no API keys and no bearer tokens. One build context, one Dockerfile and one pinned requirements file per agent, all ARM64. Nothing deploys these yet; the CDK wiring follows.
…re the old agent Adds the CDK for the Waggle AI platform and points the container pipeline at the new agent packages, replacing the single-agent `petfoodagent-strands-py` service (source now deleted). New constructs under `lib/microservices/`: - `waggle-ai-agents-runtime.ts` — five AgentCore Runtimes, one per agent, each from its own ECR image with an execution role scoped to that agent - `waggle-ai-agents-memory.ts` — AgentCore Memory with short and long-term strategies for cross-session recall - `waggle-ai-agents-gateway.ts` — AgentCore Gateway fronting the sub-agents - `waggle-ai-agents-guardrail.ts` — Bedrock Guardrail on the orchestrator - `waggle-ai-nutrition-kb.ts` — Knowledge Base over S3 Vectors for nutrition RAG Everything the agents and PetSite need at runtime is published to SSM under `/petstore/waggleai/`, so no ARNs are hardcoded on either side. Gated by `ENABLE_WAGGLE_AI_AGENTS`; the pre-rename `ENABLE_PET_FOOD_AGENT` is still honored so existing `.env` files and stored configuration keep working.
Adds the customer-facing entry point to the agents: a floating chat widget that streams responses from the orchestrator over SigV4-signed requests, keeping a session id so AgentCore Memory can carry context across turns. The AgentCore endpoint is read from SSM at startup rather than baked into the image. Also refreshes the site chrome — navigation, cards, and dark-mode contrast — so the widget sits in a consistent design rather than on top of the old styling.
Updates the docs site, `AGENTS.md`, `CONTRIBUTING.md`, and both changelogs for the new topology: the agent service list, the SSM parameters the agents publish and PetSite reads, the `ENABLE_WAGGLE_AI_AGENTS` flag, and the deployment gotchas found while bringing the runtimes up. Replaces the `petfoodagent-strands-py` service page with `waggle-ai-agents.md` and releases as 3.1.0, bumping `package.json` in step as prior releases did. A minor bump: the agents are additive and supersede the removed single-agent service, and every previous release carrying an `Added` section was minor or major — the 3.0.1 and 3.0.2 patches were `Changed`-only.
The orchestrator and the nutrition agent both default to the backbone Claude model, which moves from us.anthropic.claude-sonnet-5 to us.anthropic.claude-sonnet-4-6. Both ids are ACTIVE cross-region inference profiles in us-east-1, and the runtime IAM policies grant InvokeModel on foundation-model/*, so no policy change is needed. BEDROCK_CLAUDE_MODEL_ID still overrides the default, and the ORCHESTRATOR_MODEL_ID / NUTRITION_MODEL_ID per-agent overrides are unchanged. Renames the SONNET_5 constant to SONNET_4_6 and updates the agent table in the package README to match.
* chore: Fix ASH HIGH deps and remove archive folder
Resolve all ASH CRITICAL/HIGH findings and delete the legacy archive
directory (slated for removal per AGENTS.md, confirmed with the team).
Dependency bumps (grype HIGH -> 0):
- npm: aws-cdk-lib 2.241.0 -> 2.265.0 + audit fix across root, src/cdk,
and 4 node lambdas (clears brace-expansion, fast-uri, fast-xml-parser,
fast-xml-builder, flatted, js-yaml)
- Rust (petfood-rs): openssl 0.10.75 -> 0.10.81, aws-lc-sys 0.38.0 ->
0.44.0, rustls-webpki 0.103.9 -> 0.103.14
- Go (payforadoption-go): golang.org/x/net 0.46 -> 0.58, x/text 0.30 ->
0.41, google.golang.org/grpc 1.76 -> 1.83.1, go.opentelemetry.io/otel
1.40 -> 1.45
.ash/.ash.yaml: remove the dead archive ignore entry, prune 5 expired
minimatch suppressions, and add one suppression for rustls-webpki
0.101.7 (semver-locked by hyper-rustls 0.24.x; expires 2026-11-19).
ASH result: 0 CRITICAL, 0 HIGH (5 MEDIUM remain, below threshold).
Verified: CDK tsc + jest, Rust cargo check, Go build, eslint, flake8.
* fix(payforadoption-go): Bump Go base image to 1.25
The dependency bump raised go.mod's go directive to 1.25.0 (grpc, otel,
golang.org/x/net and x/text all now require go 1.25.0), so the
golang:1.24 builder image failed "RUN go get ." with a toolchain
version mismatch in the docker-builds CI job. Bump the builder base
image to golang:1.25. Verified with a local docker build (exit 0).
* ci: Pin GitHub Actions to commit SHAs and fix shell injection
Resolve the semgrep SAST findings on the CI workflows (pre-existing on
main, surfaced by the ASH scan):
- Pin all 33 action references to full commit SHAs, each with a trailing
version comment so Dependabot can still track updates, instead of
mutable tags or branches (github-actions-mutable-action-tag).
- acceptance.yaml: move the ${{ secrets.PIPELINE_NAME }},
${{ github.repository_owner }} and ${{ github.ref_name }} context
values into env vars referenced as quoted shell variables, removing
direct context interpolation into the run step (run-shell-injection).
semgrep now reports 0 findings on .github/workflows.
* fix(keycloak): Don't pipe curl into bash for helm
Download the get-helm-3 installer to a file and execute it instead of
piping curl directly into bash, resolving the semgrep HIGH finding
bash.curl.security.curl-pipe-bash in keycloak-setup.sh. Mirrors the
existing safe install pattern in setup-cloudshell.sh; get-helm-3
verifies the helm binary checksum itself.
---------
Co-authored-by: Rafael Pereyra <rapg@amazon.com>
feat(waggle-ai-agents): Add Waggle AI multi framework agents + refresh PetStore UI
#574) - Remove duplicate Bootstrap and jQuery CDN links from Adoption view that conflicted with _Layout includes and caused theme regression - Change checkout button from btn-primary to btn-success to match "Pay and Adopt" styling and prevent theme flip - Replace inline flex layout with ps-nextrow class and add SVG icons to payment flow buttons (food shop, Waggle chat) - Add food shop button styling with amber gradient (ps-next-food) and Waggle button with teal gradient (ps-next-waggle) - Define new CSS variables for food button theme: --ps-food-from, --ps-food-to, --ps-food-ink, --ps-food-glow in both light and dark modes - Fix readonly/disabled form control styling to use ps-surface background instead of Bootstrap's grey, improving readability in dark mode - Rebuild Bootstrap alert component styling for dark mode with proper contrast and tinted backgrounds instead of muddy near-black fills - Apply color-mix for alert variants (success, warning, danger) with appropriate heading colors for dark theme
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
N/A
Description of changes:
Security updates and CSS changes
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.