JD4 Labs — Build the Banking Agentic Stack
Seven hands-on labs that build, layer by layer, toward a banking agentic assistant (capstone). Every lab ships runnable, fully-documented reference code with a passing test suite — 64 tests total — that runs offline with no Azure account, no network, and no model downloads. Each lab has a goal, runnable code with a run.py demo and test_*.py, a measurable result, and a resume bullet.
Why offline? Each lab implements the architecture in pure Python (a hybrid RAG engine, a from-scratch LangGraph clone, an IDP pipeline, real OpenCV, a FastAPI service, an eval harness) behind pluggable provider interfaces: the default Fake*/Local* providers are deterministic and free; going live is a documented one-class swap to the Azure* provider. You learn the system, not just the SDK — and you can run it all tonight.
Run everything
# from this labs/ directory — each lab is self-contained
for d in lab-*/; do (cd "$d" && pip install -q -r requirements.txt && pytest -q); done
Or per lab: cd lab-01-rag-azure-ai-search && pip install -r requirements.txt && python run.py && pytest -q.
| Labs | Deps | Tests |
|---|---|---|
| 01 RAG · 02 Agent · 03 IDP · 06 Eval · 07 Capstone · 08 NL→SQL · 10 MCP/SK | pure stdlib + pytest | 9·8·9·10·9·12·8 |
| 04 Multimodal/Arabic | numpy + opencv-python-headless | 9 |
| 05 Productionize | fastapi + uvicorn + httpx | 10 |
| 09 Streamlit PoC | streamlit (UI) + pytest (logic) | 6 |
Total: 10 labs, 90 passing tests, all offline (+ a sizing-calculator tool with 6 more).
Interview-tomorrow note. If you only have one evening, run Lab 01 (
python run.py) and read its code — being able to say "I built an Azure-pattern hybrid RAG pipeline with security-trimmed retrieval and RRF last night, here's the A/B" beats any memorized answer. Then run Lab 02 (the agent) and Lab 07 (the capstone).
The labs
| # | Lab | Builds | JD requirement |
|---|---|---|---|
| 01 | RAG over Azure AI Search | Hybrid + semantic grounded Q&A over banking docs with citations | GenAI/RAG (Azure OpenAI + AI Search) |
| 02 | LangGraph Banking Agent | Stateful agent: route RAG vs tool vs refuse, checkpoint + human approval | Agentic AI architectures |
| 03 | Document Intelligence Pipeline | Statement/KYC extraction → JSON → indexed, with confidence/human review | Document processing |
| 04 | Multimodal + Arabic | OpenCV + OCR + GPT-4o vision over an Arabic cheque/ID | Multimodal & multilingual |
| 05 | Productionize | FastAPI (async/SSE) → Docker → ACR → Container Apps; Cosmos store; CI/CD | FastAPI, Docker, Containers, Cosmos, CI/CD |
| 06 | Eval & Guardrails | Groundedness/safety eval harness + Content Safety + PII redaction + CI gate | LLM evaluation, security |
| 07 | Capstone — Banking Agentic Assistant | Everything wired into one deployable, evaluated, secured service + demo | The whole JD |
| 08 | NL→SQL Banking Analytics | Safe natural-language→SQL over a banking DB (read-only, allowlist, row-level security, parameterized) as an agent tool | Python and SQL (mandatory) |
| 09 | Streamlit PoC UI | A chat UI (Streamlit + Flask variant) over the capstone with the human-approval handshake | Streamlit/Flask (good-to-have) |
| 10 | MCP + Semantic Kernel | A minimal MCP client/server + a Semantic-Kernel-style kernel, bridged (tool written once, used anywhere) | MCP, Semantic Kernel/Agent Framework (good-to-have) |
Plus a Cost & PTU Sizing Calculator tool, a Glossary, and a Cheat-Sheet.
Recommended order
01 → 02 → 06 → 03 → 04 → 05 → 08 → 07, then the good-to-haves 09 (UI), 10 (MCP/SK). Build RAG (01), make it agentic (02), make it safe (06) — that trio is the heart of the role; then ingestion (03), multimodal/Arabic (04), production (05), the SQL analytics tool (08), assemble the capstone (07), and add a UI (09) and the MCP/Semantic-Kernel concepts (10).
Setup once
python -m venv .venv && source .venv/bin/activate
pip install openai azure-identity azure-search-documents azure-ai-documentintelligence \
azure-cosmos langgraph langchain langchain-openai ragas \
fastapi uvicorn pydantic opencv-python-headless python-dotenv tiktoken
# Azure path: set AZURE_OPENAI_ENDPOINT, deployments, and use DefaultAzureCredential (keyless).
# Local fallback: Ollama/local embeddings + a local vector store; Azurite + Cosmos emulator.
Keyless first. Use DefaultAzureCredential (Managed Identity in Azure, your az login locally) — never hard-code keys. This mirrors what a bank requires (K00).