Capability

Implementation

Westgard multirule

1_2s (warning), 1_3s, 2_2s, R_4s, 4_1s, 10_x within runs, across runs per level and across levels and runs; every violation includes a current-run result; per-target rule selection

Levey-Jennings

Control limits (±1/2/3 SD), z-scored points with rule flags, observed mean/SD/CV and bias

Target establishment

Laboratory mean and SD from ≥20 baseline values (CLSI C24), sample SD

Sigma metrics

σ = (TEa% − |bias%|) / CV%, TEa from the analyte catalogue (greater of % and absolute), Westgard Sigma Rules recommendation (rules, N, R)

HL7 v2

Full delimiter, repetition, component, subcomponent and escape handling; ORU^R01 QC profile (SPM-11 Q, INV control/reagent lots, OBX-18 instrument); HL7 ACK (AA/AE/AR)

ASTM

E1381 frames (checksum, frame sequence, ETB continuation) and E1394 H/P/O/R/C/L records; QC by H-12 Q or O-12 Q

Patient-data guard

Messages carrying patient identifiers (PID, ASTM P) or non-control specimens are refused; policy denies RESTRICTED data

Investigation agent

Deterministic, explainable root-cause scoring over calibration, maintenance, reagent/control lot changes, faults, cross-analyte failures and calibration age; patient-impact window from the last accepted run

Narrative

Optional model summary via the agentic-core ModelRouter, ContentGuard on input and output, citation grounding check; never on the decision path

CAPA

Proposed → approved → action completed → verified → closed (or rejected); 21 CFR Part 11 style signatures with record digest; separation of duties

Verification rules

Complete runs at all levels after the action, all results within ±2 SD, no rejection rule across verification runs, residual bias check for systematic errors

Identity

agent-identity-fabric credentials (introspection, /v1/authorize, jwt-bearer for the service's own agents) or enterprise OIDC; local ABAC policy otherwise, never allow-all

MCP

Official mcp SDK MCPServer, streamable HTTP at /mcp/, typed tool input and output schemas

A2A

Agent card at /.well-known/agent-card.json, JSON-RPC message/send at /a2a

Audit

agentic-core hash-chained, Ed25519-signed audit log for every decision and state change

Observability

Prometheus metrics, OpenTelemetry traces, JSON logs with correlation IDs, alert rules, Grafana dashboard

Endpoint

Caller

Purpose

POST /v1/qc/hl7, /v1/qc/astm, /v1/qc/runs

Interface engine, technologist, agent

Ingest and evaluate QC runs

GET /v1/qc/runs, /v1/qc/runs/{id}

Staff, auditors, agents

Run evaluations

GET/PUT /v1/qc/targets, POST /v1/qc/targets/establish

Supervisor (write)

Control targets

GET /v1/qc/levey-jennings, /v1/qc/sigma

Staff, agents

Statistics

POST /v1/instrument-events

Interface engine, technologist

Calibration, maintenance, lots, faults

GET /v1/holds

LIS, staff

Patient-result release holds

POST/GET /v1/investigations

Staff, agents

Root cause investigations

POST/GET /v1/capas, /v1/capas/{id}/approve|reject|complete-action|verify|close

Staff, supervisor

CAPA workflow

/mcp/

Agent runtimes

MCP tools

/.well-known/agent-card.json, POST /a2a

Other agents

A2A

/healthz, /readyz, /metrics

Platform

Operations

Layer

Location

Container image

Dockerfile (non-root, read-only root filesystem compatible)

Helm chart

deployments/helm/lab-quality-control-agents (StatefulSet for per-replica audit chains, PDB, HPA, NetworkPolicy, ServiceMonitor)

Namespace and secret sync

deployments/kubernetes (restricted Pod Security, External Secrets)

Cloud infrastructure

deployments/terraform/{azure,aws,gcp}: managed PostgreSQL, secret store, WORM audit storage, workload identity. Azure is the reference deployment.