Description
Operators and demo presenters need to know what each new agent does and does not match from the Claude Code path: no gateway spend caps, a direct Bedrock credential, guard gaps, no login bot, per-turn generations.
Acceptance Criteria
- #1 docs/coding-agents.md, docs/security.md, docs/cost.md, docs/architecture.md, docs/demo-runbook.md, docs/traffic-corpus.md, agent-host/README.md and AGENTS.md gotchas cover Codex and pi, including the new credentials and tokens and each agent’s guard and capture gaps
- #2 Architecture diagrams show the new developer containers and their Bedrock path
- #3 No customer name, account id or credential appears, and the scrub gate passes
Definition of Done
- #1 just check
Implementation Plan
Document agent-specific routing, credentials, capture/guard/budget limitations and presenter steps; update existing architecture visuals; distinguish local proof from live verification. Keep all environment-specific identifiers out of the public repository.
Final Summary
All requested operator docs, architecture paths and repository gotchas cover direct credentials, separate native token, capture/guard/budget limitations and API-vs-visual proof. Reference Terraform inputs updated. Link/fence checks, private scrub and local gate passed; no live-host claims added.