Skip to main content

ADR-0189: Navin Enterprise Industrial Quality Control Agent, an industry product layer above the Control Plane

  • Status: proposed on 2026-11-04, awaiting user validation (see "Points to validate")
  • Date: 2026-11-04
  • Scope: new project navin-enterprise-industrie-controle-qualite/ (FastAPI backend navin_qualite, workers, Navin integration, no frontend of its own: the shared frontend shell of ADR-0180 carries the interface), additive types of the OpenFGA model (deploy/policies/openfga/model.fga, type quality_instance and objects inspection_control, nonconformity, quality_disposition, capa_record, quality_document), OPA package eai.industrie_qualite (deploy/policies/opa/industrie_qualite.rego, key eai.config.industrie_qualite of data.json), contracts contracts/v1/industrie-controle-qualite-action-request.schema.json and contracts/v1/industrie-controle-qualite-copilot-event.schema.json, Navin Manager agent template prepared but not published (navin-industrie-qualite-agent)
  • Related documents: ADR-0101 (licence policy), ADR-0103 (vLLM and LiteLLM), ADR-0108 (Opik), ADR-0166 (ClamAV and YARA-X), ADR-0173 (Manager and Enterprise separation), ADR-0174 (Mem0 and Cognee memory), ADR-0176 (Banking Back-Office), ADR-0180 (sector agents frontend shell), ADR-0183 (Claims agent, the reference implementation whose generic modules are copied), decisions of 2026-11-04 (.navin/continuity/DECISIONS.md: identities of the industry agents UC-06 to UC-10, template ids limited to 40 characters), brief agent_uses_cases/07_Industrie_Controle_Qualite.md

Context​

The customer asks for an industrial quality control agent: inspection plans and sampling, acquisition and metrology, assisted visual inspection, tolerances and statistical process control, nonconformities and containment, dispositions and deviations, root causes and corrective actions (CAPA), lot traceability and effectiveness verification, an AI copilot for the inspector and the quality manager. The brief requires that the LLM never releases, scraps or blocks a lot, never declares conformity and never closes a nonconformity: every effect goes through the Action Gateway with a human in the loop, maker-checker separation and the confirmation of the source system (MES, QMS, ERP or WMS).

The platform already provides, under governance, identity and tenant/project context, the tool gateway with OPA decisions, approvals with separation of duties and idempotency keys, dated delegations, mandatory file scanning (quarantine, ClamAV, YARA-X), Mem0 and Cognee memory, knowledge bases and the chained audit. UC-01 (ADR-0183) showed how a product layer builds on these bricks.

Decision​

  1. Backend derived by copy: package navin_qualite takes the generic modules of navin_sinistres unchanged (apart from the package name and product identifiers); only the business modules (specifications and plans, measurement sessions, visual findings, statistical process control, nonconformities, dispositions, CAPA, traceability, supplier certificates) and their state machines are written for this product. No frontend: product.manifest.json describes menus, entities, columns, write actions and copilot prompts to the shared shell.
  2. Fixed identity: product_id industrie-controle-qualite, prefix /api/v1/industrie-controle-qualite, development ports web 3480, API 8478, Redis 6400, PostgreSQL schema qualite, roles navin_qualite_app and navin_qualite_worker without BYPASSRLS.
  3. Specification frozen per control: every control records the specification and plan versions in force at sampling time; a new specification version never re-evaluates a historical control, the comparison is an explicit read (/inspection-controls/{id}/compare-spec).
  4. Measurements: raw value, corrected value and method kept as numeric(20, 6) bound from decimal strings (a float is refused at bind time), mandatory unit, no sum or comparison across units, no rounding before the verdict; inclusive limits without an additional guard band unless a versioned decision rule says otherwise. An instrument out of calibration, a missing tolerance or an invalid acquisition gives the verdict unknown, never pass.
  5. Indicators, never decisions: control charts and Cp/Cpk are computed only when the assumptions (sample size, non-zero sigma, declared stability) hold, with engine_version, input_snapshot_id and warnings; otherwise the result is insufficient_data or not_computed with its reasons. A visual finding without a scale carries no physical dimension (constraint dimension_requires_scale).
  6. Release, containment and disposition by the source: the blocked status of a lot (containment_status) and the execution of a disposition are source_confirmed only after the MES, WMS or ERP connector answer has been re-read; a missing answer gives unknown_pending_confirmation and a confirmation job; no local "released" status.
  7. Maker-checker as data: OPA eai.industrie_qualite reads the delegation matrix of section 15 from data.json (operations, preparer and approver roles, quantity tiers per unit, quorum, urgency); OpenFGA carries can_approve ... but not maker and can_review ... but not uploader. The package exposes decision.applies true for its own actions only (qualite.*, document.*).
  8. CAPA: an action marked as done moves to effectiveness_pending; closing requires a recorded effectiveness result with evidence and an approval by another human; a recurrence detected by traceability blocks the closure.
  9. Documents and images: same pipeline as UC-01 (quarantine, mandatory ClamAV and YARA-X, Docling, manual review); images are evidence linked to findings, never a measurement.
  10. Copilot: copied runtime (SSE, Last-Event-ID, injection governance, DLP, budget, figures); read tools under RLS, prepare tools through the gateway, side-effect tools after approval by a human other than the run owner; event contract derived from assurance-sinistres-copilot-event.
  11. Connectors: declared capability contracts (QMS, MES, ERP/WMS, instrument gateway, vision, DMS), deterministic sandbox refused in production mode, never a simulated confirmation presented as the source's.

Consequences​

  • Positive: full reuse of the governed bricks, tenant isolation by RLS on every table, delegation matrix editable without redeployment, complete traceability of measurements, versions and decisions.
  • Negative: copying the generic modules creates a synchronisation debt with UC-01 (recorded in KNOWN_LIMITATIONS.md); the real connectors (QMS, MES, ERP, instruments, vision) remain to be configured by the customer; the template is not published until the artifact pipeline has run.

Points to validate​

  • Quantity tiers and quorums per unit of eai.config.industrie_qualite (starting values, to be adjusted by the customer).
  • Decision rules per characteristic (uncertainty guard band): inclusive limits without guard by default.
  • Reconciliation delay of unknown_pending_confirmation containments before an alert.

Rejected alternatives​

  • One frontend per product: refused by the decision of 2026-11-04.
  • A local released status set at decision time: refused, only the source confirms the execution.
  • A conformity verdict produced by a vision model or an LLM: refused, the engine is deterministic and versioned, the LLM explains.

Implementation plan​

Sub-plan of task t-c15fbf1a (S1 audit and ADR, S2 contracts and policies, S3 foundation, S4 and S5 business modules, S6 state machine, S7 documents, S8 copilot, S9 security, S10 acceptance, S11 manifest and template, S12 docs).