AI agent Windows Deployment with AWS Access sep 2026

Python/FastAPI AI Agent Tutor: Hybrid RAG, AWS & Security Testing Project and contract This is an educational project: choose and build an example AI agent and teach me to reproduce it independently, end to end. Include a FastAPI backend, Python-driven frontend/admin, memory within/between chats, and hybrid RAG. Run the application on Windows with secure AWS access and a very low-cost AWS-hosted database. One fixed-price milestone covers the application, deployment, security, tests, source code, reports, screenshot-based DOCX manual, videos, and handover. No separate paid milestones. Progress demonstrations are expected. 1. Python application, frontend, and admin Use Python for the application and all custom tests, with FastAPI and a compatible Python-driven UI. Framework-generated browser code is acceptable; no separate JavaScript/TypeScript application. Supporting HTML/CSS, SQL, configuration, and PowerShell are acceptable. Choose an example such as a document knowledge assistant. Explain architecture, model/provider, dependencies, hardware, and costs. Include a bounded agent action such as search or saving an approved note; no unrestricted command/file access. Users need login/logout, new chats, history, uploads, processing status, source references, and memory controls. Admins need user/role management, account deactivation, shared documents, ingestion status, usage/errors, and configuration profiles. Deliver readable code, pinned dependencies, and secret-free configuration templates. 2. Memory within and between chats Implement within-chat context and user-specific memory recalled in new chats after logout, application restart, and Windows reboot. Chat-history storage alone is insufficient. Explain storage, context limits, and differences between history, memory, and RAG. Users must be able to inspect/delete history and memory. Isolate private data. 3. Hybrid RAG and flexible chunking Support .md, .txt, text-based .pdf, and .docx; state whether OCR is included. Implement validation, extraction, chunking, embeddings, indexing, status, and errors. Provide selectable dense-only, keyword-only, and hybrid retrieval. Explain the similarity metric, actual lexical algorithm, and fusion method; do not claim BM25 unless implemented. Admins must be able to inspect queries, chunks, sources, component scores/rankings, and final rankings. Answers need document and available page/section/chunk references. Test unsupported questions. Support private and shared documents with retrieval-time permissions. Deletion must remove active retrieval entries; explain treatment of originals, previous answers, and backups. Provide admin settings without editing Python: at least two chunking strategies, chunk size with token/character units, overlap including zero, relevant text boundaries, separate dense/keyword candidate counts, hybrid weights/fusion parameters, and final context size. Record embedding model/dimensions. Include saved/exportable/importable profiles, three examples, and chunk previews with text, boundaries, sizes, sources, and settings. Implement versioned reindexing with progress/errors. Explain when re-chunking/re-embedding is needed. Prevent stale/duplicate chunks, incompatible embeddings, and incomplete rebuilds becoming active. 4. Low-cost AWS database and Windows deployment Prefer PostgreSQL with pgvector and full-text search on small EC2/Lightsail hosting, also storing conversations, memory, metadata, and settings. Justify alternatives and validate sizing. Teach installation, secure access, schema/migrations, backups/restoration, updates, and original-file storage. No unrestricted public database access. Run the main application directly on Windows—no Docker/containers. Remote users must reach it over HTTPS through AWS. Do not move the main application to AWS. No third-party hosted tunnels and no inbound home/office router port forwarding. Demonstrate the network path; SSM is preferred where suitable. Validate forwarding direction, Windows compatibility, unattended credentials, and reconnection. Justify origin restrictions and CloudFront/WAF or alternatives. Automate startup/recovery after reboot, crashes, and network loss. Explain availability limits. I will not provide my AWS account or credentials. Develop, record, and test in your own authorized account. My later deployment must not depend on your accounts/resources. Disclose development AWS/API expenses and itemize all recurring infrastructure/model costs, including networking, security, backups, and monitoring. Separate temporary free-tier benefits. 5. Mandatory protection against hacking and automation Protect the Windows host, application, AWS resources, database, Python source, secrets, documents, conversations, and memory. Authorized testing using this exact repository is required: https://github.com/whaleyxbt/patchright-enhanced Also use Python Playwright and direct HTTP requests. Review/pin the exact repository revision. Disclose/isolate external runtimes; custom tests/orchestration stay in Python. No silent substitution. Prevent unauthorized actions even when browser/WAF checks are passed. Report browser detection separately from authentication, authorization, and quotas. Implement and test: Approved accounts, MFA, invalid/expired-session rejection, account deactivation, role checks, and cross-user isolation, including modified requests. Protection of source, .env, repository metadata, backups, configuration, and secrets. Relevant SQL/command injection, path traversal, XSS, CSRF, and unsafe-upload defenses. Backend-enforced agent permissions against malicious prompts and instructions embedded in documents. Least-privilege AWS/database access, a non-admin Windows service account, origin restrictions, and encrypted connections. Account quotas, concurrency/upload/processing limits, and controlled overload handling. Test only authorized infrastructure. Deliver repeatable tests, results/evidence, and remaining risks; fix failed ag