Lab 01 — The AgentCore Runtime & Session Isolation

Phase 20 · Lab 01 · Phase README · Warmup

The problem

Amazon Bedrock AgentCore is a framework-agnostic, serverless agentic platform: you bring the agent (LangGraph, CrewAI, Strands, LlamaIndex, the OpenAI Agents SDK — anything) and AWS hosts it. The service that hosts your agent is the Runtime, and two properties define its contract:

A single entrypoint. You package the agent behind entrypoint(payload, context) — in the real SDK, the @app.entrypoint decorator on a BedrockAgentCoreApp. The Runtime receives an invocation, hands the entrypoint the request payload and a context (carrying the session_id), and returns whatever the entrypoint returns — a value, or a stream of chunks for a generator entrypoint.
True session isolation. Each session_id runs in its own isolated environment — in production, a dedicated microVM with its own memory and filesystem — and nothing leaks between sessions. A reused session stays warm (state survives across invocations); a new one is a cold start in a fresh environment.

You will build a faithful miniature of that contract and prove the isolation.

What you build

Piece	What it does	The lesson
`BedrockAgentCoreApp` + `@app.entrypoint` / `@app.ping`	register the agent's entrypoint and health check	the packaging contract — one function, not a framework lock-in
`RequestContext`	`session_id`, the isolated `store`, a deterministic `invocation_id`, `cold_start`	what the agent sees per request
`Session`	one isolated environment: its own `store`, invocation count, tick markers	the miniature microVM
`Runtime.invoke` / `Runtime.stream`	run the entrypoint in the session's isolated store; stream a generator	the hosting loop
`Runtime.evict` + `max_sessions` (LRU)	reclaim a microVM; bound the session pool	cold start is a state, not an accident

File map

File	Role
`lab.py`	your implementation (fill the `# TODO`s)
`solution.py`	reference implementation + worked example (`python solution.py`)
`test_lab.py`	25 tests: invocation, isolation, warm/cold, streaming, health, pool eviction
`requirements.txt`	`pytest` only

Run it

pytest test_lab.py -v                       # your lab.py (red until you implement)
LAB_MODULE=solution pytest test_lab.py -v   # the reference (green)
python solution.py                          # worked example

Success criteria

invoke(session_id, payload) returns the entrypoint's result and passes the payload through.
Session A and B are independent — B's store never contains A's data (the isolation proof).
A reused session is warm — its store survives across invocations; a new/evicted one is a cold start with a fresh store.
A generator entrypoint streams chunks via stream; invoke collects them into a list.
ping() reports health; invocation_id is a deterministic monotonic counter.
All 25 tests pass under both lab and solution.

How this maps to the real stack

BedrockAgentCoreApp + @app.entrypoint is the real bedrock_agentcore SDK shape. In production you write the entrypoint, then agentcore configure (build a container image and an IAM execution role) and agentcore launch (deploy to the managed Runtime), and call it with agentcore invoke '{"prompt": "..."}' or the InvokeAgentRuntime API. Our Runtime.invoke stands in for that managed process.
Session isolation is AgentCore's headline security property: every session gets a dedicated microVM (AWS Firecracker-class isolation) with isolated CPU, memory, and filesystem, torn down after the session ends — so one user's agent cannot observe another's state even in a shared, multi-tenant service. Our per-Session store is that boundary in miniature; our evict models the microVM being reclaimed.
Cold vs warm is a real operational concern: AgentCore advertises fast cold starts and keeps sessions warm for follow-up turns. Our cold_start flag and is_warm model exactly that distinction, which drives latency budgets (Phase 00) and where you keep short-term memory (Lab 03).
Streaming matches AgentCore's streaming responses (SSE) for token-by-token agents; the extended/async Runtime handles long-running invocations the same way, yielding progress.
Framework-agnostic: because the contract is just entrypoint(payload, context), the agent inside can be a LangGraph graph (Phase 18), a CrewAI crew (Phase 07), or a raw ReAct loop (Phase 01) — the Runtime does not know or care. That is the entire pitch: AgentCore is the operational layer, not another agent framework.

Limits of the miniature. A real microVM enforces isolation at the hypervisor level with a real kernel, filesystem, and network namespace; ours is a Python dict, so it teaches the contract and the no-leak invariant, not the mechanism of hardware isolation. Real cold starts involve image pull and boot latency; ours is instantaneous. Identity/auth (who may invoke) is Lab 02's Policy/Identity story, not modeled here.

Extensions (your own machine)

Add an idle-TTL evictor: pass an injected tick clock and evict sessions whose last_tick is older than a TTL — the real "reclaim idle microVMs" behaviour.
Add HealthyBusy: track in-flight async invocations and have ping() report busy while a long-running (extended-runtime) entrypoint is still working.
Wrap a real LangGraph CompiledGraph (Phase 18) as the entrypoint and confirm the Runtime hosts it unchanged — proving the framework-agnostic claim.

Interview / resume signal

"Built a faithful miniature of the Bedrock AgentCore Runtime — the @app.entrypoint hosting contract with per-session microVM isolation (proved no cross-session state leakage), warm/cold-start semantics, streaming entrypoints, and a bounded session pool with LRU reclamation — the operational layer that lets any agent framework run securely at scale."

Agentic AI Engineer — Agent Infrastructure, Platforms & Production Systems