From c77ffc0aece8d3a0a1772dd5fb462c72c7e8d7a8 Mon Sep 17 00:00:00 2001
From: odinwang <48194321+odinwang@users.noreply.github.com>
Date: Thu, 1 Oct 2026 18:47:46 +0800
Subject: [PATCH] README: show the agentcore_gateway model-access diagram on
 the repo page

The diagram explaining how kernels reach a private LiteLLM through
AgentCore Gateway (PrivateLink in, VPC Lattice out) was only linked from
the README. Embed it right under the model-access summary so the repo
front page opens with it, and drop the now-redundant link below the hero.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 README.md | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 118de19..ffe2991 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ ways to get there:
   with per-session STS credentials (revoked by an IAM Deny on the session
   tag); runtime → gateway can stay on PrivateLink and gateway → LiteLLM on a
   managed VPC Lattice path, so LiteLLM needs no public endpoint.
-  [How it works](docs/architecture.md#how-the-agentcore_gateway-backend-reaches-a-private-litellm).
+  [Walkthrough of every hop](docs/architecture.md#how-the-agentcore_gateway-backend-reaches-a-private-litellm).
 - **`llm-edge`** (`litellm`). A platform-side service holds the key and
   forwards session-scoped calls; runtimes egress through a NAT Gateway with a
   **fixed EIP** you can put on the gateway's source-IP allow-list.
@@ -34,6 +34,8 @@ ways to get there:
 Direct Bedrock access (cross-region inference) is supported as an
 alternative.
 
+![agentcore_gateway backend: AgentCore Gateway in front of a private LiteLLM](docs/images/agentcore-gateway-litellm.svg?v=1)
+
 ![portal overview](docs/images/portal-overview.png)
 
 <!-- ?v= bumps the URL so GitHub's image cache serves the current diagram
@@ -47,10 +49,7 @@ that carry the security story: the
 traffic) and the
 [customer-owned MCP hub chains](docs/images/mcp-hub-chains.svg)
 (how production applications and the Dev Workbench reach a self-hosted tool
-backend with per-application HMAC signatures and a forwarded user token). A third, the
-[agentcore_gateway model path](docs/images/agentcore-gateway-litellm.svg),
-shows how a kernel reaches a private LiteLLM through AgentCore Gateway over
-PrivateLink and VPC Lattice.
+backend with per-application HMAC signatures and a forwarded user token).
 
 ## What's inside