graph TB
    subgraph "Layer 5: Trust & Governance"
        A1[AI Agent Governance]
        A2[Regulatory Compliance]
        A3[Immutable Audit Trail]
    end
    subgraph "Layer 4: Decisioning"
        B1[Autonomous Decision Engine]
        B2[Human-in-the-loop Escalation]
    end
    subgraph "Layer 3: Predictive Intelligence"
        C1[Digital Twin Simulation]
        C2[Scenario Forecasting]
    end
    subgraph "Layer 2: Cognitive Intelligence"
        D1[Memory Cortex / RAG]
        D2[Knowledge Graph Reasoning]
        D3[Root Cause Analysis]
    end
    subgraph "Layer 1: Sensing & Detection"
        E1[Multi-Source Signal Ingestion]
        E2[Real-Time Anomaly Detection]
    end

    E1 --> E2 --> D1
    D1 --> D2 --> D3
    D3 --> C1 --> C2
    C2 --> B1 --> B2
    B2 --> A1 --> A2 --> A3

graph LR
    Investors -->|funding| AEGISFI[AEGIS-FI Platform]
    BankCISO[Bank CISO] -->|requirements| AEGISFI
    ComplianceOfficer[Compliance Officer] -->|policy rules| AEGISFI
    FraudAnalyst[Fraud Analyst] -->|investigates alerts| AEGISFI
    RiskOfficer[Chief Risk Officer] -->|risk appetite| AEGISFI
    Regulator[RBI / Regulator] -->|audits| AEGISFI
    AIAgents[Autonomous AI Agents] -->|transact via| AEGISFI
    Customers -->|protected by| AEGISFI

mindmap
  root((AEGIS-FI))
    Sensing
      Transaction Ingestion
      Behavioral Telemetry
      Agent Telemetry
      External Threat Feeds
    Identity
      Customer DNA
      Device DNA
      Agent DNA
    Cognition
      Knowledge Graph
      Memory Cortex
      Root Cause Reasoning
    Foresight
      Digital Twin
      Scenario Simulation
      Outcome Forecasting
    Decisioning
      Risk Scoring
      Policy Evaluation
      Optimal Action Selection
    Governance
      AI Explainability
      Model Audit
      Bias Monitoring
    Response
      Step-up Auth
      Transaction Hold
      Account Freeze
    Trust
      Immutable Ledger
      Cryptographic Proofs
      Regulatory Reporting

journey
    title Fraud Analyst Investigation Journey
    section Alert Received
      Receives high-risk alert: 3: Analyst
      Opens AEGIS-FI dashboard: 4: Analyst
    section Investigation
      Views Sentinel risk score: 4: Analyst
      Reads Investigator root-cause summary: 5: Analyst
      Reviews 84 similar historical cases: 5: Analyst
      Checks Customer/Device/Agent DNA: 5: Analyst
    section Decision
      Views Digital Twin simulated outcomes: 5: Analyst
      Approves recommended action: 4: Analyst
    section Closure
      Case logged to Trust Ledger: 5: Analyst
      Memory Cortex updated: 5: Analyst

journey
    title Autonomous Agent Transaction Journey
    section Request
      Agent submits loan decision: 4: AI Agent
    section Trust Layer Evaluation
      Sentinel scores risk: 4: AEGIS-FI
      Investigator checks rationale: 4: AEGIS-FI
      Governance Agent checks agent track record: 5: AEGIS-FI
      Digital Twin simulates default probability: 5: AEGIS-FI
    section Outcome
      Decision Engine approves/escalates: 4: AEGIS-FI
      Trust Ledger records full reasoning chain: 5: AEGIS-FI

journey
    title Compliance Reporting Journey
    section Trigger
      Quarterly RBI audit due: 3: Compliance Officer
    section Generation
      Queries Compliance Agent: 4: Compliance Officer
      Agent pulls Trust Ledger records: 5: Compliance Officer
      Agent cross-checks AML/KYC rules: 5: Compliance Officer
    section Output
      Auto-generated report with citations: 5: Compliance Officer
      Submits to regulator: 4: Compliance Officer

graph TB
    subgraph "Sources"
        S1[Transactions]
        S2[Behavioral/Device]
        S3[AI Agent Activity]
        S4[External Threat Feeds]
    end

    subgraph "Ingestion Layer"
        K[Apache Kafka]
    end

    subgraph "Module 1: Immune Sensing Layer"
        ISL[Sensing Service]
    end

    subgraph "Identity Layer"
        FDE[Financial DNA Engine]
    end

    subgraph "Module 3: Threat Knowledge Graph"
        TKG[(Neo4j)]
    end

    subgraph "Module 4: Memory Cortex"
        MC[(Qdrant / pgvector)]
    end

    subgraph "Agentic Intelligence Layer"
        SA[Sentinel Agent]
        IA[Investigator Agent]
        CA[Compliance Agent]
        GA[Governance Agent]
    end

    subgraph "Module 7: Digital Twin Simulator"
        DTS[Simulation Engine]
    end

    subgraph "Module 8: Decision Engine"
        DE[Decision Engine]
    end

    subgraph "Module 11: Response Agent"
        RA[Response Agent]
    end

    subgraph "Module 12: Trust Ledger"
        TL[(Immutable Ledger)]
    end

    S1 & S2 & S3 & S4 --> K
    K --> ISL
    ISL --> FDE
    ISL --> SA
    FDE --> TKG
    SA --> TKG
    SA --> IA
    IA --> TKG
    IA --> MC
    IA --> DTS
    DTS --> DE
    CA --> DE
    GA --> DE
    DE --> RA
    DE --> TL
    RA --> TL
    GA --> TL

{
  "event_id": "string (uuid)",
  "source_type": "enum",
  "entity_refs": {"customer_id": "", "device_id": "", "agent_id": ""},
  "timestamp": "ISO8601",
  "raw_payload": {},
  "risk_context": "generated"
}

sequenceDiagram
    participant Src as Event Source
    participant ISL as Sensing Service
    participant K as Kafka
    Src->>ISL: POST /v1/events/ingest
    ISL->>ISL: Validate + Deduplicate
    ISL->>ISL: Enrich (geo, device, timestamp)
    ISL->>K: Publish events.enriched
    ISL-->>Src: 202 Accepted (event_id)

{
  "customer_id": "string",
  "spending_pattern": {"avg_txn": 0, "categories": {}},
  "risk_history": [{"event_id": "", "risk": 0, "date": ""}],
  "behavior_pattern": {"login_times": [], "typical_devices": []},
  "trust_score": 0.0,
  "updated_at": "ISO8601"
}

{
  "agent_id": "string",
  "decision_history": [{"decision_id": "", "outcome": ""}],
  "accuracy": 0.0,
  "failure_rate": 0.0,
  "bias_score": 0.0,
  "trust_score": 0.0
}

sequenceDiagram
    participant K as Kafka (events.enriched)
    participant FDE as Financial DNA Engine
    participant DB as DNA Store (Postgres/Redis)
    K->>FDE: consume event
    FDE->>DB: fetch existing profile
    FDE->>FDE: recompute pattern/trust score
    FDE->>DB: upsert profile
    FDE->>K: publish dna.updated

MATCH (c1:Customer)-[:USES]->(d:Device)<-[:USES]-(c2:Customer)
WHERE c1 <> c2
WITH d, collect(DISTINCT c1) + collect(DISTINCT c2) AS customers
WHERE size(customers) > 10
RETURN d, customers

sequenceDiagram
    participant FDE as Financial DNA Engine
    participant TKG as Threat Knowledge Graph (Neo4j)
    participant SA as Sentinel Agent
    FDE->>TKG: MERGE entities + relationships
    SA->>TKG: query neighbors(entity, depth=2)
    TKG-->>SA: subgraph (potential fraud ring)
    SA->>SA: incorporate graph signal into risk score

{
  "case_id": "string",
  "embedding": "vector(1536)",
  "category": "fraud|aml|cyber|compliance",
  "narrative": "text",
  "resolution": "string",
  "outcome_success": true,
  "closed_at": "ISO8601"
}

sequenceDiagram
    participant IA as Investigator Agent
    participant MC as Memory Cortex
    participant VDB as Vector DB (Qdrant/pgvector)
    IA->>MC: search(event context)
    MC->>MC: generate embedding
    MC->>VDB: ANN search top_k=10
    VDB-->>MC: similar cases
    MC-->>IA: ranked cases + resolutions + confidence

sequenceDiagram
    participant K as Kafka
    participant SA as Sentinel Agent
    participant TKG as Knowledge Graph
    participant FDE as DNA Engine
    K->>SA: events.enriched
    SA->>FDE: get DNA context
    SA->>TKG: get graph context
    SA->>SA: ensemble score (IF + XGBoost + GNN + Seq)
    SA->>K: publish risk.scored {risk, category}

sequenceDiagram
    participant SA as Sentinel Agent
    participant IA as Investigator Agent
    participant TKG as Knowledge Graph
    participant MC as Memory Cortex
    SA->>IA: risk.scored (high)
    IA->>TKG: fetch entity context
    IA->>MC: search similar cases
    IA->>IA: compose root-cause explanation
    IA->>K: publish investigation.completed {reasons: ["New Device","High Amount","Known Pattern"]}

sequenceDiagram
    participant IA as Investigator Agent
    participant DTS as Digital Twin Simulator
    participant DE as Decision Engine
    IA->>DTS: simulate(candidate_actions)
    DTS->>DTS: Monte Carlo / agent-based simulation per scenario
    DTS-->>DE: scenario outcomes (loss, churn, compliance impact)

sequenceDiagram
    participant DTS as Digital Twin
    participant CA as Compliance Agent
    participant GA as Governance Agent
    participant DE as Decision Engine
    participant RA as Response Agent
    DTS->>DE: scenario outcomes
    CA->>DE: compliance constraints
    GA->>DE: agent trust context (if AI-originated)
    DE->>DE: multi-objective optimization (loss vs churn vs compliance)
    DE->>RA: recommended_action
    DE->>TL: log decision

sequenceDiagram
    participant DE as Decision Engine
    participant RA as Response Agent
    participant CoreBank as Core Banking API
    participant Cust as Customer
    DE->>RA: action=freeze
    RA->>CoreBank: POST /accounts/{id}/freeze
    CoreBank-->>RA: 200 OK
    RA->>Cust: notify (SMS/Push)
    RA->>TL: log execution result

{
  "ledger_id": "string",
  "prev_hash": "sha256",
  "entry_hash": "sha256",
  "decision_id": "string",
  "agent_chain": ["sentinel","investigator","decision_engine","response"],
  "payload": {},
  "signature": "ed25519/dilithium",
  "timestamp": "ISO8601"
}

sequenceDiagram
    participant Any as Any Agent/Module
    participant TL as Trust Ledger Service
    participant DB as Append-only Store
    Any->>TL: write_entry(payload)
    TL->>TL: compute hash = H(prev_hash + payload)
    TL->>TL: sign(entry)
    TL->>DB: append entry
    TL-->>Any: ledger_id, entry_hash

graph TB
    subgraph "Presentation"
        WEB[Next.js Web App]
        MOB[Mobile / Analyst App]
    end
    subgraph "API Gateway"
        GW[Kong / API Gateway]
    end
    subgraph "Core Services"
        SVC1[Sensing Service]
        SVC2[DNA Service]
        SVC3[Graph Service]
        SVC4[Memory Service]
        SVC5[Simulation Service]
        SVC6[Decision Service]
        SVC7[Compliance Service]
        SVC8[Governance Service]
        SVC9[Response Service]
        SVC10[Ledger Service]
    end
    subgraph "Agent Orchestration"
        ORCH[LangGraph Orchestrator]
    end
    subgraph "Data Stores"
        PG[(PostgreSQL)]
        NEO[(Neo4j)]
        VDB[(Qdrant/pgvector)]
        REDIS[(Redis)]
        S3[(Object Storage)]
    end
    subgraph "Streaming Backbone"
        KAFKA[(Kafka)]
    end

    WEB --> GW --> SVC1
    GW --> SVC6
    GW --> SVC7
    GW --> SVC8
    SVC1 --> KAFKA
    KAFKA --> SVC2 & SVC3 & SVC4
    ORCH --> SVC2 & SVC3 & SVC4 & SVC5 & SVC6 & SVC7 & SVC8 & SVC9
    SVC2 --> PG & REDIS
    SVC3 --> NEO
    SVC4 --> VDB
    SVC5 --> PG
    SVC10 --> PG
    SVC9 --> S3

graph LR
    subgraph "Sync (REST/gRPC)"
        GW2[API Gateway] -->|REST| decision-service
        decision-service -->|gRPC| twin-service
        decision-service -->|gRPC| compliance-service
    end
    subgraph "Async (Kafka topics)"
        sensing-service -->|events.enriched| dna-service
        sensing-service -->|events.enriched| sentinel-service
        sentinel-service -->|risk.scored| investigator-service
        investigator-service -->|investigation.completed| twin-service
        decision-service -->|decision.made| response-service
        decision-service -->|decision.made| ledger-service
    end

graph TD
    Orchestrator[LangGraph / CrewAI Orchestrator]
    Orchestrator --> Sentinel[Sentinel Agent\nDetection]
    Sentinel --> Investigator[Investigator Agent\nRoot Cause]
    Investigator --> MemoryAgent[Memory Cortex Agent\nRecall]
    MemoryAgent --> Simulation[Simulation Agent\nDigital Twin]
    Simulation --> Compliance[Compliance Agent\nPolicy]
    Compliance --> Decision[Decision Agent\nOptimal Action]
    Decision --> Response[Response Agent\nExecution]
    Governance[Governance Agent\nAI Oversight] -.audits.-> Sentinel
    Governance -.audits.-> Investigator
    Governance -.audits.-> Decision
    Response --> Ledger[(Trust Ledger)]
    Decision --> Ledger
    Governance --> Ledger

{
  "trace_id": "uuid",
  "from_agent": "sentinel",
  "to_agent": "investigator",
  "payload": {},
  "confidence": 0.0,
  "timestamp": "ISO8601"
}

graph LR
    Ext1[Core Banking System] --> AEGISFI((AEGIS-FI))
    Ext2[Mobile/Web Apps] --> AEGISFI
    Ext3[Threat Intel Feeds] --> AEGISFI
    Ext4[AI Trading/Lending Agents] --> AEGISFI
    AEGISFI --> Out1[Fraud Ops Dashboard]
    AEGISFI --> Out2[Regulator Reports]
    AEGISFI --> Out3[Core Banking Action APIs]
    AEGISFI --> Out4[Customer Notifications]

graph TB
    P1((1.0\nIngest & Normalize))
    P2((2.0\nBuild/Update DNA))
    P3((3.0\nDetect Risk))
    P4((4.0\nInvestigate))
    P5((5.0\nSimulate))
    P6((6.0\nDecide))
    P7((7.0\nAct))
    P8((8.0\nRecord))

    D1[(Event Store)]
    D2[(DNA Store)]
    D3[(Knowledge Graph)]
    D4[(Memory Cortex)]
    D5[(Trust Ledger)]

    P1 --> D1
    D1 --> P2 --> D2
    D1 --> P3
    D2 --> P3
    D3 --> P3
    P3 --> P4
    D4 --> P4
    D3 --> P4
    P4 --> P5
    P5 --> P6
    D4 --> P6
    P6 --> P7
    P6 --> D5
    P7 --> D5
    P7 --> Out[Core Banking / Customer]

flowchart LR
    TXN[Transaction Event] --> KAFKA[Kafka: events.raw]
    KAFKA --> ENRICH[Enrichment Service]
    ENRICH --> KAFKA2[Kafka: events.enriched]
    KAFKA2 --> SENTINEL[Sentinel Agent]
    SENTINEL --> SCORE{Risk >= Threshold?}
    SCORE -- No --> ALLOW[Allow Transaction]
    SCORE -- Yes --> INVESTIGATOR[Investigator Agent]
    INVESTIGATOR --> TWIN[Digital Twin]
    TWIN --> DECISION[Decision Engine]
    DECISION --> RESPONSE[Response Agent]
    RESPONSE --> LEDGER[(Trust Ledger)]
    ALLOW --> LEDGER

sequenceDiagram
    autonumber
    participant U as Customer/Agent
    participant ISL as Sensing Layer
    participant FDE as DNA Engine
    participant TKG as Knowledge Graph
    participant SA as Sentinel Agent
    participant IA as Investigator Agent
    participant MC as Memory Cortex
    participant DTS as Digital Twin
    participant CA as Compliance Agent
    participant DE as Decision Engine
    participant RA as Response Agent
    participant TL as Trust Ledger

    U->>ISL: Submit transaction
    ISL->>FDE: enrich with DNA context
    FDE->>TKG: update relationships
    ISL->>SA: events.enriched
    SA->>TKG: query graph context
    SA->>SA: ensemble scoring
    SA-->>IA: risk.scored (92, Account Takeover)
    IA->>TKG: fetch entity neighbors
    IA->>MC: search similar cases
    MC-->>IA: 84 similar cases (Freeze, 91% confidence)
    IA-->>DTS: investigation.completed
    DTS->>DTS: simulate approve/verify/freeze
    DTS-->>CA: scenario outcomes
    CA->>CA: check AML/KYC/RBI rules
    CA-->>DE: compliance constraints
    DE->>DE: select optimal action (freeze)
    DE->>RA: execute(freeze)
    RA->>U: notify customer
    DE->>TL: log decision chain
    RA->>TL: log execution

sequenceDiagram
    autonumber
    participant Sched as Scheduler
    participant GA as Governance Agent
    participant TL as Trust Ledger
    participant FDE as DNA Engine (Agent DNA)
    Sched->>GA: trigger periodic audit
    GA->>TL: fetch agent decision records
    GA->>GA: compute accuracy, bias, failure rate
    GA->>FDE: update Agent DNA trust_score
    GA->>TL: log audit result
    alt trust_score below threshold
        GA->>DE: flag agent for human review
    end

erDiagram
    CUSTOMER ||--o{ ACCOUNT : owns
    CUSTOMER ||--o{ DEVICE_LINK : uses
    DEVICE ||--o{ DEVICE_LINK : linked_via
    ACCOUNT ||--o{ TRANSACTION : has
    TRANSACTION }o--|| MERCHANT : paid_to
    TRANSACTION ||--o{ RISK_SCORE : scored_by
    CUSTOMER ||--o{ CASE : subject_of
    CASE ||--o{ CASE_EMBEDDING : has
    AGENT ||--o{ DECISION : makes
    DECISION ||--o{ LEDGER_ENTRY : recorded_as
    DECISION }o--|| TRANSACTION : about
    AGENT ||--o{ AGENT_DNA : described_by
    CUSTOMER ||--o{ CUSTOMER_DNA : described_by
    DEVICE ||--o{ DEVICE_DNA : described_by

    CUSTOMER {
        uuid customer_id PK
        string name
        string kyc_status
        float trust_score
        timestamp created_at
    }
    ACCOUNT {
        uuid account_id PK
        uuid customer_id FK
        string account_type
        decimal balance
    }
    DEVICE {
        uuid device_id PK
        string fingerprint
        string geo_history
    }
    TRANSACTION {
        uuid txn_id PK
        uuid account_id FK
        decimal amount
        string status
        timestamp created_at
    }
    RISK_SCORE {
        uuid score_id PK
        uuid txn_id FK
        int risk_value
        string category
        timestamp scored_at
    }
    CASE {
        uuid case_id PK
        uuid customer_id FK
        string category
        string resolution
        bool outcome_success
    }
    CASE_EMBEDDING {
        uuid case_id FK
        vector embedding
    }
    AGENT {
        uuid agent_id PK
        string agent_type
        string model_version
    }
    DECISION {
        uuid decision_id PK
        uuid agent_id FK
        uuid txn_id FK
        string recommended_action
        float confidence
    }
    LEDGER_ENTRY {
        uuid ledger_id PK
        uuid decision_id FK
        string prev_hash
        string entry_hash
        string signature
        timestamp recorded_at
    }
    AGENT_DNA {
        uuid agent_id FK
        float accuracy
        float failure_rate
        float bias_score
        float trust_score
    }
    CUSTOMER_DNA {
        uuid customer_id FK
        json spending_pattern
        json behavior_pattern
        float trust_score
    }
    DEVICE_DNA {
        uuid device_id FK
        json fraud_association
        json geo_history
    }

graph LR
    Customer((Customer)) -- USES --> Device((Device))
    Customer -- OWNS --> Account((Account))
    Account -- INITIATES --> Transaction((Transaction))
    Transaction -- PAID_TO --> Merchant((Merchant))
    Transaction -- FROM_IP --> IP((IP Address))
    Device -- SEEN_AT --> IP
    Agent((AI Agent)) -- DECIDED --> Transaction
    Customer -- LINKED_TO --> Customer
    Device -- ASSOCIATED_WITH --> FraudRing((Fraud Ring Cluster))

// Fraud ring detection example
CALL gds.louvain.stream('customerDeviceGraph')
YIELD nodeId, communityId
WITH communityId, collect(gds.util.asNode(nodeId)) AS members
WHERE size(members) > 10
RETURN communityId, members

graph TB
    subgraph "Ingestion Pipeline"
        Case[Closed Case / Document] --> Chunk[Chunking]
        Chunk --> Embed[Embedding Model]
        Embed --> VDB[(Vector DB: Qdrant/pgvector)]
    end
    subgraph "Retrieval Pipeline"
        Query[Incoming Event/Question] --> QEmbed[Query Embedding]
        QEmbed --> ANN[ANN Search]
        VDB --> ANN
        ANN --> Rerank[Re-ranking Cross-Encoder]
        Rerank --> Context[Top-K Context]
    end
    subgraph "Generation"
        Context --> LLM[LLM: Gemini / Fine-tuned Llama-Mistral]
        LLM --> Answer[Grounded Explanation/Recommendation]
    end

graph TB
    NewEvent[New Event] --> Embed2[Embed Event Context]
    Embed2 --> Search[Similarity Search]
    Search --> VDB2[(Vector DB)]
    VDB2 --> Results[Top-K Similar Cases]
    Results --> Aggregate[Aggregate Resolutions + Confidence]
    Aggregate --> Output["Found 84 similar cases.\nMost Similar: Account Takeover\nSuccess Response: Temporary Freeze\nConfidence: 91%"]

    subgraph "Continuous Learning Loop"
        CaseClosed[Case Closed] --> Outcome[Record Outcome Success/Failure]
        Outcome --> ReEmbed[Re-embed with outcome metadata]
        ReEmbed --> VDB2
    end

{
  "case_id": "uuid",
  "embedding": "vector(1536)",
  "category": "fraud|aml|cyber|compliance",
  "entities_involved": ["customer_id","device_id"],
  "narrative": "text summary of investigation",
  "resolution": "Temporary Freeze",
  "outcome_success": true,
  "confidence_at_resolution": 0.91,
  "analyst_id": "string|null",
  "closed_at": "ISO8601"
}

graph TB
    Entity[Customer / Account / Portfolio] --> TwinBuilder[Twin State Builder]
    TwinBuilder --> TwinState[(Virtual Replica State)]
    TwinState --> ScenarioEngine[Scenario Engine]
    ScenarioEngine --> ScenA[Scenario: Approve]
    ScenarioEngine --> ScenB[Scenario: Verify]
    ScenarioEngine --> ScenC[Scenario: Freeze]
    ScenA --> MonteCarlo1[Monte Carlo: Fraud Loss Model]
    ScenB --> MonteCarlo2[Monte Carlo: Friction/Loss Model]
    ScenC --> MonteCarlo3[Agent-Based: Churn Model]
    MonteCarlo1 --> Results[Predicted Outcomes]
    MonteCarlo2 --> Results
    MonteCarlo3 --> Results
    Results --> DecisionEngine2[Decision Engine: pick optimal]

{
  "entity_id": "string",
  "entity_type": "customer|account|portfolio|institution",
  "current_state": {
    "balance": 0, "risk_score": 0, "recent_txns": []
  },
  "behavioral_model_params": {},
  "last_synced": "ISO8601"
}

graph TB
    subgraph "Kafka Topics"
        T1[events.raw]
        T2[events.enriched]
        T3[dna.updated]
        T4[risk.scored]
        T5[investigation.completed]
        T6[simulation.completed]
        T7[decision.made]
        T8[action.executed]
        T9[ledger.recorded]
        T10[governance.audit]
    end

    Sources --> T1 --> SensingSvc[Sensing Service] --> T2
    T2 --> DNASvc[DNA Service] --> T3
    T2 --> SentinelSvc[Sentinel Service] --> T4
    T4 --> InvestigatorSvc[Investigator Service] --> T5
    T5 --> TwinSvc[Twin Service] --> T6
    T6 --> DecisionSvc[Decision Service] --> T7
    T7 --> ResponseSvc[Response Service] --> T8
    T7 --> LedgerSvc[Ledger Service] --> T9
    T8 --> LedgerSvc
    T9 --> GovernanceSvc[Governance Service] --> T10

graph TB
    subgraph "Perimeter"
        WAF[WAF / DDoS Protection]
        APIGW[API Gateway + OAuth2/OIDC]
    end
    subgraph "Identity & Access"
        IAM[IAM / RBAC / ABAC]
        MFA[MFA for Analysts/Admins]
    end
    subgraph "Data Security"
        ENC1[TLS 1.3 in transit]
        ENC2[AES-256 at rest]
        HSM[HSM-backed Key Management]
        TOKEN[Tokenization of PII/PAN]
    end
    subgraph "Application Security"
        SAST[SAST/DAST in CI/CD]
        SECRETS[Secrets Manager / Vault]
        SANDBOX[Agent Sandbox/Guardrails]
    end
    subgraph "Network Security"
        VPC[Private VPC + Subnetting]
        SVCMESH[mTLS Service Mesh - Istio]
        NSG[Network Security Groups]
    end
    subgraph "Detection & Response"
        SIEM[SIEM Integration]
        IDS[IDS/IPS]
    end

    WAF --> APIGW --> IAM
    IAM --> MFA
    APIGW --> SVCMESH
    SVCMESH --> VPC --> NSG
    ENC1 & ENC2 --> HSM
    SAST & SECRETS & SANDBOX --> SVCMESH
    SVCMESH --> SIEM --> IDS

graph LR
    Entry1[Decision Entry] --> Hash1[Hash with prev_hash]
    Hash1 --> Sign1[Sign - Ed25519]
    Sign1 --> Store1[(Append-only Store)]
    Store1 --> Entry2[Next Entry]
    Entry2 --> Hash2[Hash with prev_hash]
    Hash2 --> Sign2[Sign]
    Sign2 --> Store1

    Store1 --> Anchor[Periodic Merkle Root Anchoring]
    Anchor --> ExtChain[(Public Blockchain / Notary Service - V2+)]

{
  "ledger_id": "uuid",
  "sequence_no": 10293,
  "prev_hash": "sha256:...",
  "entry_hash": "sha256:...",
  "decision_id": "uuid",
  "agent_chain": ["sentinel","investigator","decision_engine"],
  "payload": {
    "risk_score": 92,
    "category": "Account Takeover",
    "recommended_action": "freeze",
    "rationale_summary": "New device + high amount + known pattern",
    "human_override": null
  },
  "signature": "ed25519:...",
  "signer_key_id": "kms-key-001",
  "timestamp": "2026-06-21T10:15:00Z"
}

graph TB
    subgraph "Region: Primary (ap-south-1 / asia-south1)"
        subgraph "K8s Cluster - AZ1"
            PodsA[Service Pods]
        end
        subgraph "K8s Cluster - AZ2"
            PodsB[Service Pods]
        end
        LB1[Cloud Load Balancer]
        DBPrimary[(PostgreSQL Primary)]
        Neo4jPrimary[(Neo4j Cluster)]
        KafkaCluster[(Kafka Cluster - 3+ brokers)]
    end
    subgraph "Region: DR (ap-southeast-1)"
        DBReplica[(PostgreSQL Read Replica)]
        K8sDR[Standby K8s Cluster]
    end

    Internet --> CDN[CDN/WAF] --> LB1 --> PodsA & PodsB
    PodsA & PodsB --> DBPrimary
    PodsA & PodsB --> Neo4jPrimary
    PodsA & PodsB --> KafkaCluster
    DBPrimary -.async replication.-> DBReplica
    DBPrimary -.failover.-> K8sDR

graph TB
    subgraph "Namespace: aegis-core"
        D1[Deployment: sensing-service]
        D2[Deployment: dna-service]
        D3[Deployment: sentinel-service]
        D4[Deployment: investigator-service]
    end
    subgraph "Namespace: aegis-intel"
        D5[Deployment: twin-service]
        D6[Deployment: decision-service]
        D7[Deployment: compliance-service]
        D8[Deployment: governance-service]
    end
    subgraph "Namespace: aegis-trust"
        D9[Deployment: response-service]
        D10[StatefulSet: ledger-service]
    end
    subgraph "Namespace: aegis-data"
        SS1[StatefulSet: kafka]
        SS2[StatefulSet: neo4j]
        SS3[StatefulSet: qdrant]
    end
    HPA[HorizontalPodAutoscaler] --> D1 & D2 & D3
    Istio[Istio Service Mesh] -.mTLS.-> D1 & D2 & D3 & D4 & D5 & D6 & D7 & D8 & D9

POST /v1/decision/recommend
Request:
  event_id: string
  candidate_actions: [string]
Response 200:
  decision_id: string
  recommended_action: string
  confidence: number
  rationale: string
  contributing_agents: [string]
  simulated_outcomes: object
Response 422:
  error: "insufficient_context"

CREATE TABLE customer (
  customer_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL,
  kyc_status TEXT NOT NULL DEFAULT 'pending',
  trust_score NUMERIC(5,2) DEFAULT 50.0,
  created_at TIMESTAMPTZ DEFAULT now()
);

CREATE TABLE account (
  account_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  customer_id UUID REFERENCES customer(customer_id),
  account_type TEXT NOT NULL,
  balance NUMERIC(18,2) DEFAULT 0,
  created_at TIMESTAMPTZ DEFAULT now()
);

CREATE TABLE transaction (
  txn_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  account_id UUID REFERENCES account(account_id),
  amount NUMERIC(18,2) NOT NULL,
  merchant_id UUID,
  status TEXT DEFAULT 'pending',
  created_at TIMESTAMPTZ DEFAULT now()
) PARTITION BY RANGE (created_at);

CREATE TABLE risk_score (
  score_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  txn_id UUID REFERENCES transaction(txn_id),
  risk_value INT CHECK (risk_value BETWEEN 0 AND 100),
  category TEXT,
  scored_at TIMESTAMPTZ DEFAULT now()
);

CREATE TABLE agent (
  agent_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  agent_type TEXT NOT NULL,
  model_version TEXT,
  trust_score NUMERIC(5,2) DEFAULT 50.0
);

CREATE TABLE decision (
  decision_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  agent_id UUID REFERENCES agent(agent_id),
  txn_id UUID REFERENCES transaction(txn_id),
  recommended_action TEXT NOT NULL,
  confidence NUMERIC(5,4),
  created_at TIMESTAMPTZ DEFAULT now()
);

CREATE TABLE ledger_entry (
  ledger_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  sequence_no BIGSERIAL,
  decision_id UUID REFERENCES decision(decision_id),
  prev_hash TEXT NOT NULL,
  entry_hash TEXT NOT NULL,
  payload JSONB NOT NULL,
  signature TEXT NOT NULL,
  recorded_at TIMESTAMPTZ DEFAULT now()
);

-- Vector extension for Memory Cortex (pgvector option)
CREATE EXTENSION IF NOT EXISTS vector;
CREATE TABLE case_embedding (
  case_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  embedding VECTOR(1536),
  category TEXT,
  narrative TEXT,
  resolution TEXT,
  outcome_success BOOLEAN,
  closed_at TIMESTAMPTZ
);
CREATE INDEX ON case_embedding USING ivfflat (embedding vector_cosine_ops);

stateDiagram-v2
    [*] --> EventReceived
    EventReceived --> Detecting: Sentinel Agent
    Detecting --> LowRisk: risk < 40
    Detecting --> MediumRisk: 40 <= risk < 75
    Detecting --> HighRisk: risk >= 75
    LowRisk --> Allowed
    MediumRisk --> Investigating: Investigator Agent
    HighRisk --> Investigating
    Investigating --> Simulating: Digital Twin
    Simulating --> CheckingCompliance: Compliance Agent
    CheckingCompliance --> Deciding: Decision Engine
    Deciding --> AutoApproved: confidence high & policy allows
    Deciding --> HumanReview: confidence low or high-risk
    AutoApproved --> Executing: Response Agent
    HumanReview --> AnalystDecision
    AnalystDecision --> Executing
    Executing --> Recording: Trust Ledger
    Recording --> GovernanceAudit: Governance Agent (periodic)
    Allowed --> Recording
    GovernanceAudit --> [*]
    Recording --> [*]

graph LR
    Dev[Developer Commit] --> PR[Pull Request]
    PR --> Lint[Lint + Static Analysis]
    Lint --> UnitTest[Unit Tests]
    UnitTest --> SAST[SAST Scan - Semgrep]
    SAST --> Build[Build Container Image]
    Build --> ImageScan[Image Vulnerability Scan - Trivy]
    ImageScan --> Push[Push to Registry]
    Push --> DeployStaging[Deploy to Staging - ArgoCD]
    DeployStaging --> IntegTest[Integration + Contract Tests]
    IntegTest --> DAST[DAST Scan - OWASP ZAP]
    DAST --> ApprovalGate{Manual Approval}
    ApprovalGate -->|approved| DeployCanary[Canary Deploy 5%]
    DeployCanary --> Monitor[Auto-Monitor SLOs]
    Monitor -->|healthy| DeployProd[Full Production Rollout]
    Monitor -->|degraded| Rollback[Automated Rollback]

graph TB
    subgraph "Instrumentation"
        OTel[OpenTelemetry SDK in every service]
    end
    subgraph "Collection"
        OTelCollector[OTel Collector]
    end
    subgraph "Storage & Analysis"
        Prom[(Prometheus - Metrics)]
        Loki[(Loki - Logs)]
        Tempo[(Tempo - Traces)]
        Custom[(Model Monitoring - Evidently/Arize)]
    end
    subgraph "Visualization & Alerting"
        Grafana[Grafana Dashboards]
        Alertmanager[Alertmanager]
        PagerDuty[PagerDuty/Opsgenie]
    end
    OTel --> OTelCollector --> Prom & Loki & Tempo
    Prom --> Grafana --> Alertmanager --> PagerDuty
    Loki --> Grafana
    Tempo --> Grafana
    Custom --> Grafana

gantt
    title AEGIS-FI Roadmap
    dateFormat  YYYY-MM-DD
    section MVP (Hackathon)
    Core pipeline + demo        :done, mvp1, 2026-07-01, 3d
    section V1 (0-3 months)
    Real bank data integration  :v1a, 2026-07-15, 30d
    Multi-model detection       :v1b, after v1a, 30d
    Compliance rule engine      :v1c, after v1a, 30d
    section V2 (3-6 months)
    Digital Twin Monte Carlo    :v2a, 2026-10-15, 45d
    Governance Agent + scoring  :v2b, after v2a, 30d
    Multi-region deployment     :v2c, after v2a, 45d
    section V3 (6-12 months)
    AI-native agent marketplace :v3a, 2027-01-01, 60d
    Post-quantum ledger         :v3b, after v3a, 45d
    Cross-bank federated graph  :v3c, after v3a, 60d

graph TB
    CTO[CTO / Chief Architect]
    CTO --> PlatTeam[Platform Team\n4 engineers]
    CTO --> MLTeam[ML/AI Team\n5 engineers]
    CTO --> AgentTeam[Agent Systems Team\n4 engineers]
    CTO --> SecTeam[Security & Compliance Team\n3 engineers]
    CTO --> FrontendTeam[Frontend Team\n3 engineers]
    CTO --> SRE[SRE/DevOps Team\n3 engineers]
    PM[Head of Product] --> PMs[2 Product Managers]
    Domain[Banking Domain Expert] --> ComplianceAdvisors[2 Compliance Advisors]

graph TB
    Unit[Unit Tests\nper service, >80% coverage] --> Integration[Integration Tests\nservice-to-service contracts]
    Integration --> Contract[Contract Tests\nPact - API schema compatibility]
    Contract --> E2E[End-to-End Tests\nfull pipeline: event to ledger entry]
    E2E --> ModelVal[Model Validation\nprecision/recall/AUC thresholds gate deploy]
    ModelVal --> Adversarial[Adversarial/Red-Team Testing\nprompt injection, evasion attacks]
    Adversarial --> Chaos[Chaos Engineering\nkill pods, inject Kafka lag]
    Chaos --> LoadTest[Load/Performance Testing\nk6/Locust at 10K+ TPS]
    LoadTest --> Compliance[Compliance Validation\nregulatory scenario test suite]

graph LR
    Today[Today:\nHuman-Supervised\nDetection] --> Phase1[Phase 1:\nAI-Assisted\nDecisioning]
    Phase1 --> Phase2[Phase 2:\nAutonomous Agents\nwith Human Override]
    Phase2 --> Phase3[Phase 3:\nAgent-to-Agent\nFinance]
    Phase3 --> Phase4[Phase 4:\nFully AI-Native Bank\nAEGIS-FI as Trust OS]