Laboratory IntegrationGuide
Private-network Edge agent & operational security
Design of the outbound-only Edge agent for laboratories whose LIS is not reachable from the internet.
On this page
Status
Limitation
The Edge agent is implemented and tested locally only. It is not deployed, no signed release is distributed, and it cannot be installed at a laboratory today.
Design
- Outbound-only: the agent initiates HTTPS connections to Solia; it opens no inbound listener on the laboratory network.
- Signed work: every work item and configuration is signed (Ed25519) and scoped to one laboratory workspace and environment; unsigned, expired, replayed or out-of-scope work is refused.
- Destinations are restricted to private addresses explicitly approved in the signed configuration; SFTP destinations must carry a pinned host key.
- Encrypted, bounded local spool. Once a work item has started it is never automatically repeated after a restart; it is reported for reconciliation instead.
- TLS chain and hostname verification stay enabled; redirects are refused.
Before it can be offered
- Signing-key custody and a signed release pipeline.
- Hosting and installer review, and a business associate agreement where protected health information is buffered.
- Authenticated canonical ingress for agent identity.
- Local secret storage and a security review of on-premises network permissions.