# Demo flow diagrams (Mermaid)

Step-oriented architecture for the goose lab harnesses. Rendered on
[goose.maniak.ai](https://goose.maniak.ai/demos.html#workshop) and natively on
GitHub.

Run the suite: `./scripts/test-workshop-phases.sh all`

---

## Multi-provider LLM

```mermaid
flowchart LR
  C[Client OpenAI SDK] --> P[agentgateway-proxy / dedicated GWs]
  P --> O[OpenAI gpt-5.5]
  P --> X[xAI grok-4.5]
  P --> A[Anthropic Claude]
  P --> G[Gemini 2.5 Flash]
  P --> D[DGX Qwen]
  V[(Vault + ESO)] -.->|keys| P
```

**Script:** `./scripts/test-llm-gateways.sh all`

---

## Phase A — Guardrails

```mermaid
sequenceDiagram
  participant U as Client
  participant G as AgentGateway /guard-demo
  participant O as OpenAI
  U->>G: clean prompt
  G->>O: forward
  O-->>U: 200
  U->>G: ignore previous instructions
  G-->>U: 403 prompt injection
  U->>G: email / API key in prompt
  G-->>U: 422 PII or secret
```

**Script:** `./scripts/test-guardrails.sh` · path `:30160/guard-demo`

---

## Phase A — Prompt enrichment

```mermaid
sequenceDiagram
  participant U as Client
  participant G as AgentGateway /enrich-demo
  participant O as OpenAI
  Note over G: prepend system message
  U->>G: What is 2+2?
  G->>O: system JSON contract + user
  O-->>U: {"answer":"4","source":"agentgateway-prompt-enrichment"}
```

**Script:** `./scripts/test-prompt-enrichment.sh`

---

## Phase A — Streaming + embeddings

```mermaid
flowchart TB
  subgraph stream [SSE chat]
    C1[Client stream true] --> AG1[AgentGateway /openai]
    AG1 --> O1[OpenAI]
    O1 -->|data chunks| C1
  end
  subgraph emb [Embeddings]
    C2[Client] --> AG2[AgentGateway /embeddings]
    AG2 -->|rewrite /v1/embeddings| O2[OpenAI embeddings]
    O2 -->|vector dims| C2
  end
```

**Scripts:** `test-llm-stream.sh` · `test-embeddings.sh`

---

## Phase B — Body-based model routing

```mermaid
flowchart TB
  C[Client POST /route-by-model] --> PR[PreRouting extract body.model]
  PR --> H{x-gateway-model-name}
  H -->|gpt-5.5| O[openai backend]
  H -->|grok-4.5| X[xai-grok]
  H -->|gemini-2.5-flash| G[google-gemini]
  H -->|mock-gpt or missing| M[mock-gpt local]
```

**Script:** `./scripts/test-body-routing.sh`

---

## Phase B — LLM token rate limit

```mermaid
sequenceDiagram
  participant U as Client
  participant G as AgentGateway /token-rl
  participant O as OpenAI
  U->>G: chat 1
  G->>O: ok under 40 tok/min
  O-->>U: 200
  U->>G: chat 2..n
  G-->>U: 429 when token window exceeded
```

**Script:** `./scripts/test-llm-token-ratelimit.sh`

---

## Phase C — OpenAPI → MCP

```mermaid
sequenceDiagram
  participant C as MCP client
  participant G as virtual-mcp-gateway /openapi-mcp
  participant W as api.open-meteo.com
  C->>G: initialize + tools/list
  G-->>C: getWeatherForecast
  C->>G: tools/call lat/lon
  G->>W: GET /v1/forecast OpenAPI
  W-->>G: weather JSON
  G-->>C: tool result
```

**Script:** `./scripts/test-openapi-mcp.sh`

---

## Phase C — Composable MCP

```mermaid
flowchart LR
  C[MCP client] -->|tools/call account-brief| G[AgentGateway /composable]
  G -->|GET /accounts/id| A[demo-apis]
  G -->|GET /orders/id| A
  G -->|merge CEL output| C
```

**Script:** `./scripts/test-composable-mcp.sh`

---

## Phase E — Entra JWT on LLM

```mermaid
sequenceDiagram
  participant U as Client
  participant G as AgentGateway /secure-openai
  participant E as Entra JWKS
  participant O as OpenAI
  U->>G: no Authorization
  G-->>U: 401
  U->>G: Bearer Entra JWT
  G->>E: validate iss/aud
  G->>O: chat/completions
  O-->>U: 200
```

**Script:** `./scripts/test-llm-jwt-entra.sh` · same app as `/mcp-secure`

---

## Phase E — WAF first-pass

```mermaid
sequenceDiagram
  participant U as Client
  participant W as WAFPolicy
  participant G as AgentGateway /waf-demo
  participant O as OpenAI
  U->>W: clean JSON body
  W->>G: allow
  G->>O: forward
  O-->>U: 200
  U->>W: ignore previous instructions
  W-->>U: 403 injection-block
```

**Script:** `./scripts/test-waf.sh`

---

## MCP security (existing)

```mermaid
sequenceDiagram
  participant U as User az CLI
  participant G as virtual-mcp-gateway /mcp-secure
  participant E as Entra
  participant M as mcp-server-everything
  U->>G: initialize no JWT
  G-->>U: 401
  U->>E: get-access-token
  U->>G: initialize + Bearer
  G->>E: JWKS
  G->>M: MCP
  Note over G: tool RBAC + local rate limit by group
```

**Script:** `./scripts/test-mcp-security.sh`

---

## LLM LB + failover (existing)

```mermaid
flowchart TB
  C[Client] --> LB[/llm-lb P2C]
  LB --> O1[gpt-5.5]
  LB --> X1[grok-4.5]
  C --> FO[/llm-failover priority]
  FO -->|1 healthy| O2[gpt-5.5]
  FO -->|2| X2[grok]
  FO -->|3| A2[claude]
```

**Script:** `./scripts/test-llm-lb-failover.sh`

---

## AWS Bedrock

```mermaid
flowchart LR
  C[Client OpenAI SDK] --> P[aws-bedrock-gateway /bedrock]
  P --> B[Bedrock Claude Sonnet 4.5]
  V[(Vault + ESO)] -.->|bedrock-secret bearer key| P
```

**Script:** `./scripts/test-bedrock.sh` · path `:30275/bedrock`

---

## Bedrock LB (P2C)

```mermaid
flowchart TB
  C[Client] --> LB[/bedrock-lb P2C]
  LB --> N1[Amazon Nova Pro]
  LB --> N2[Amazon Nova Lite]
  LB --> L1[Meta Llama 3.3 70B]
  V[(Vault + ESO)] -.->|one bearer key| LB
```

**Script:** `./scripts/test-bedrock-lb.sh` · path `:30160/bedrock-lb`

---

## Bedrock failover

```mermaid
flowchart TB
  C[Client] --> FO[/bedrock-failover priority]
  FO -->|1 healthy| S[Claude Sonnet 4.5]
  FO -->|2| N[Amazon Nova Pro]
  FO -->|3| L[Meta Llama 3.3 70B]
```

**Script:** `./scripts/test-bedrock-failover.sh [failover|failover-force|restore]` · path `:30160/bedrock-failover` · health policy `bedrock-failover-health` (5xx/429 → evict 15s)