Laboratory integration architecture & authority

HTTPS/JSON using the Solia Lab Contract is the executable Sandbox integration path. Native REST, FHIR R4, HL7 v2/MLLP, SFTP and Edge have source and isolated tests, but native execution is disabled and no deployed native installation authority is established. A selected test pass is not permission to connect a real laboratory.

Current scoped buyer credential + Program grant
  → canonical catalog / clinical / collection checks
  → canonical order and attribution
  → installation-bound native transmission
  → transport receipt (not application acceptance)
  → explicit LIS application ACK / rejection
  → accession and individual specimen events
  → result revision and independent clinical evaluation
  → authorized release
  → scoped Partner result GET / webhook notification

The order, transmission, kit barcode, accession and result revision are distinct identities. A callback must correlate to the existing authorized order; it cannot create a replacement order or infer a missing accession.

• Core owns tenant, laboratory, installation, catalog, mapping, Program access, order and released result state. UI and descriptive profiles project these facts; they do not create authority.
• Laboratory founder supplies business identity and delegates technical work within the existing six-step journey. Laboratory IT supplies the interface and secure network inputs.
• Independent clinical reviewer approves the current code/specimen/method/component mapping and release policy. Technical mapping review alone is not clinical authorization.
• Security/operations verifies endpoint identity, TLS, credential custody, replay fences and incident procedures. Core operator separately approves installed authority.
• Each buyer retains its own client, key, Program, catalog and result/webhook scopes. A laboratory installation is laboratory-and-environment identity, not a shared buyer credential.

1. Identify the laboratory system and choose the supported path in Step 5; product selection is descriptive, not configured or certified.
2. Record the technical handoff and current mapping evidence; managed request progress is not an ACK/result proof.
3. Obtain current canonical Sandbox order, acknowledgement and result evidence for Step 5 completion.
4. Read Step 6 technical readiness freshly in the selected environment; missing, failed or refreshing evidence fails closed.
5. Treat commercial activation, authorized Production validation and release approval as separate requirements; do not bypass paused promotion.

If installed authority is absent, stop at configuration/review and synthetic acceptance. Keep existing evidence and ask the authorized owner for the missing approval, rather than adding a second order pipeline.