RelayGuard

Inspiration

Incident agents are getting more autonomous — but outages do not forgive messy handoffs. A worker can crash mid-run, come back late, and commit a duplicate fix. Or worse: retrieve a similar-looking runbook that is expired, failed before, or completely unrelated, and act on it anyway.

I built RelayGuard because agent memory needs the same rigor as production data: durable state, fencing, an audit trail, and guardrails before anything reaches remediation. CockroachDB is the natural fit — one survivable system of record for vector recall, leases, checkpoints, and the action ledger.

What it does

RelayGuard coordinates crash-safe incident handoffs for autonomous agents:

• Retrieve semantically similar memories from a 63-entry corpus (CockroachDB VECTOR)
• Classify with MemoryGate — USE, INSPECT, or AVOID (similarity alone is not enough)
• Select an allowlisted action via Amazon Bedrock (or a deterministic mock for CI)
• Reserve in an idempotent ledger with lease fencing
• Resume from checkpoints after crash or failover
• Audit every retrieval, verdict, reservation, commit, and stale rejection

Live demo story: Worker A classifies memories, Bedrock chooses Escalate to Human when an approved runbook conflicts with INSPECT precedent and three blocked failures → Worker A crashes after reserving → Worker B resumes and commits once → Worker A's stale commit is rejected → Invariants PASS.

Judges can verify on the Railway dashboard or via read-only Managed MCP — no write credentials exposed.

How I built it

• CockroachDB Cloud — memories (VECTOR index), incidents (lease + epoch), checkpoints, action_intents, action_results, audit_events
• Python workers — MemoryGate classifier, semantic retriever, checkpointed worker runtime with serializable-conflict retries (40001)
• Amazon Bedrock — Haiku 4.5 inference profile for guarded action selection; optional Titan v2 embeddings
• AWS Lambda — regional workers, Secrets Manager for DATABASE_URL, CloudWatch proof
• Next.js dashboard (Railway) — read-only judge UI; server-side Python CLI bridge to CockroachDB
• Managed MCP — read-only SELECT on audit tables for post-incident proof
• Terraform + Docker Compose for Lambda deploy and local integration tests (79/79 passing)

Challenges I ran into

• Demo title drove retrieval — meta titles pulled noise into top-5; fixing the incident title to real ops vocabulary (API latency spike…) was required for a credible MemoryGate + Bedrock story.
• Bedrock IAM — inference profiles need foundation-model ARNs and one-time AWS Marketplace permissions for model enablement.
• Guarded selection vs hero narrative — Bedrock correctly escalates when USE and INSPECT signals conflict; that is a feature, not a failure — escalation is still a committed, audited action.
• Railway + CockroachDB SSL — bundled CA certs and trusting explicit RELAYGUARD_SSL_ROOT_CERT overrides across Lambda, Railway, and Windows dev.
• Prompt accuracy — AVOID memory content is stripped from the Bedrock prompt; INSPECT memories enter with an explicit caution flag — the selector design had to be honest about that in docs and demo narration.

Accomplishments that I'm proud of

• End-to-end crash handoff with provable invariants: 1 commit, 1 stale rejection, PASS
• MemoryGate blocking high-similarity failed actions while approving the current runbook
• Live Amazon Bedrock selector on the judge dashboard — not mock, not fallback
• 63-memory corpus with real VECTOR retrieval on CockroachDB Cloud
• Read-only proof paths — Railway dashboard + Managed MCP screenshots with no write creds in the browser or MCP session
• Full evidence bundle (docs/evidence/) — CloudWatch, Lambda, Bedrock run, dashboard captures, reproducible demo scripts

What I learned

• Vector search is retrieval, not judgment — you need a gate between similarity and action selection.
• CockroachDB works well as agent execution memory: leases, epochs, and serializable transactions make "resume after crash" provable instead of hopeful.
• Bedrock fits guardrails, not autopilot — the best demo moment was the model choosing restraint (escalation) when precedent was ambiguous.

Built With

• amazon-bedrock
• aws-lambda
• cockroachdb-cloud
• docker
• managed-mcp
• next.js
• pytest
• python
• railway
• tailwind-css
• terraform
• typescript
• vector