@pikaa-ai/pikaa 0.2.5 → 0.3.0

package/skills/iso-standards-readiness/references/iso-14971.md

@@ -0,0 +1,172 @@
+# ISO 14971 Process Framework (No Standard Text)
+
+Research basis: **2026-07-26**, building on the 2026-07-23 device-lane baseline. This
+reference summarizes a preparation process and evidence architecture for medical device
+risk management. It does not reproduce requirements and is not a substitute for the
+standard.
+
+## Copyright and authorized access
+
+ISO publications are copyrighted. Obtain ISO 14971 and ISO/TR 24971 from
+[ISO](https://www.iso.org/standard/72704.html), an ISO national member, or another
+authorized source; see [ISO copyright](https://www.iso.org/copyright.html). Do not ask
+an agent to retrieve, transcribe, summarize clause-by-clause, or store proprietary
+text.
+
+## Current edition, the guidance companion, and the European amendment
+
+- [ISO 14971:2019](https://www.iso.org/standard/72704.html) is Edition 3, published
+  December 2019, reviewed and confirmed in 2025.
+- [ISO/TR 24971:2020](https://www.iso.org/standard/74437.html) is Edition 2 and is the
+  guidance companion, following the same clause structure. It is a **Technical
+  Report**: informative, not normative. Conformity is claimed to ISO 14971, never to
+  ISO/TR 24971, and a TR cannot relax or reinterpret a normative requirement. Record
+  which guidance the organization adopted and why.
+- **EN ISO 14971:2019/A11:2021** is a European amendment to the EN adoption, cited for
+  MDR and, through the corresponding decision, IVDR support. It does not change the
+  international normative part. Track it only where the European source basis applies.
+
+## No certification lane exists for this standard
+
+There is no ISO 14971 certificate. A body cannot certify a risk-management system to
+ISO 14971 the way it certifies a QMS to ISO 13485. Risk management is instead assessed
+*inside* other lanes:
+
+- an ISO 13485 certification audit examines the risk-management process as part of the
+  QMS;
+- an FDA inspection examines risk-based decisions against applicable FDA requirements;
+- an MDSAP audit treats risk management as a foundation across its process areas; and
+- EU conformity assessment examines the risk-management file as part of technical
+  documentation against the applicable general safety and performance requirements.
+
+Any claim of "ISO 14971 certification" is a category error. Report risk-management
+readiness as evidence supporting a named lane, never as its own assurance result.
+
+## Hard boundary
+
+This skill and its files cannot:
+
+- certify, approve, or validate a risk-management file or process;
+- determine device classification, intended use, reportability, conformity route,
+  market access, or product authorization;
+- decide whether a risk is acceptable, whether benefit outweighs residual risk, or
+  whether a risk-control measure is adequate or safe;
+- set or approve risk-acceptability criteria, severity or probability scales, or a
+  risk matrix;
+- replace top management, the risk-management owner, qualified clinical and engineering
+  reviewers, RA/QA, a notified body, or a regulator; or
+- infer that a hazard set is complete, or that residual risk is acceptable, from a
+  template, a matrix, a document count, or a script result.
+
+Use outputs as a list of evidence questions for accountable human review. **Completeness
+of hazard identification cannot be established by any check in this skill** — a
+zero-finding structural result says the declared links are present, not that the
+analysis found everything.
+
+## Process and evidence domains
+
+The `iso-14971` profile carries these domain labels for manifests and gap reports.
+They are workflow topics, not clause references:
+
+`risk-management-plan`, `risk-management-file`, `competence-and-authority`,
+`intended-use-and-characteristics`, `hazard-identification`,
+`risk-estimation-and-evaluation`, `risk-control-option-analysis`,
+`risk-control-implementation-and-verification`, `risk-control-side-effects-review`,
+`residual-risk-evaluation`, `benefit-risk-analysis`,
+`overall-residual-risk-evaluation`, `risk-management-review-and-report`,
+`production-and-postproduction-information`, `change-control`.
+
+Each domain needs an owner, status, evidence IDs, source/version reference, recorded
+approval, and links to open gaps.
+
+## The chain that has to hold together
+
+Risk-management evidence is judged as a connected chain, not as a set of documents. For
+each analysed item, the following must be traceable in both directions:
+
+intended use and reasonably foreseeable misuse → characteristics related to safety →
+hazard → foreseeable sequence of events → hazardous situation → harm with severity →
+probability basis → risk evaluation against declared criteria → risk-control option
+analysis and decision → implemented control → verification that the control was
+implemented → verification of its effectiveness → review for new or increased risks
+introduced by the control → residual risk evaluation → benefit-risk analysis where
+residual risk is not acceptable → contribution to overall residual risk → disclosure of
+residual risk → production and post-production information feeding back.
+
+Break any one link and the file stops being evidence. The two links most often missing
+are **verification of control effectiveness** (distinct from verifying the control
+exists) and **review of risks introduced by the control itself**.
+
+Build the traceability register with:
+
+```bash
+PYTHONDONTWRITEBYTECODE=1 python3 scripts/check_traceability.py \
+  /path/to/traceability-matrix.json
+```
+
+That check links intended use, hazard or signal, risk evaluation, risk control, design
+input and output, verification, validation, production control, and post-market source.
+It verifies declared linkage, not analytical adequacy.
+
+## Where risk management meets the QMS
+
+ISO 14971 work is not separable from the device QMS. Keep these joins explicit and
+evidenced:
+
+- **Design and development** — risk controls that are design outputs must appear as
+  design inputs with verification, not only as risk-file rows.
+- **Production** — controls realized as process parameters, in-process checks, or
+  acceptance criteria need production evidence, and process validation where the
+  control cannot be fully verified on the finished device.
+- **Purchasing** — controls that depend on a supplier's process or component need
+  supplier controls and change notification. See
+  `scripts/check_supplier_controls.py`.
+- **Post-market** — complaints, service records, vigilance signals, and production
+  nonconformities must actually re-enter risk estimation, with evidence that the file
+  was reassessed and that changed estimates were acted on.
+- **CAPA** — where a risk estimate changes, the resulting action needs effectiveness
+  evidence before closure. See `scripts/check_capa.py`.
+- **Change control** — any change to intended use, design, process, supplier, or
+  materials triggers a documented risk reassessment.
+
+The production and post-production feedback loop is the single most common structural
+gap: files that were complete at design transfer and never updated by field
+experience.
+
+## Risk-acceptability criteria and the matrix problem
+
+Acceptability criteria belong in the risk-management plan, are set by authorized humans
+with a documented rationale, and must be applied consistently. Recurring failure modes
+to look for, none of which this skill can adjudicate:
+
+- criteria written after the analysis so that every risk lands acceptable;
+- probability values asserted with no stated basis and no data;
+- a matrix whose cells were adjusted per project to move results across the boundary;
+- risk reduction claimed from labelling or an instruction alone, where a design or
+  protective measure was available;
+- residual risk described as acceptable with no benefit-risk analysis where the
+  declared criteria were not met;
+- overall residual risk never evaluated as a whole — only item by item; and
+- no disclosure of residual risk to users where the analysis assumed it.
+
+Flag these as blockers for authorized review. Do not resolve them.
+
+## Shared checks that apply here
+
+- `scripts/validate_scope_intake.py --standard iso-14971` — declared scope, product
+  families, intended use references, and applicability owners.
+- `scripts/check_traceability.py` — the risk/design/production/post-market chain.
+- `scripts/check_capa.py` — corrective action with effectiveness evidence.
+- `scripts/check_supplier_controls.py` — controls that depend on external providers.
+- `scripts/validate_evidence_manifest.py` and `scripts/gap_analyzer.py` with
+  `--standard iso-14971`.
+
+## Sources
+
+- [ISO 14971:2019](https://www.iso.org/standard/72704.html) — catalogue entry
+- [ISO/TR 24971:2020](https://www.iso.org/standard/74437.html) — guidance companion
+- [Decision (EU) 2022/757](https://eur-lex.europa.eu/eli/dec_impl/2022/757/oj/eng) —
+  EN ISO 14971:2019/A11:2021 citation basis
+- `references/iso-13485.md` — the QMS lane this evidence usually supports
+- `references/source-ledger.md` — dated baseline and provenance limitations
+- `references/assurance-lanes.md` — why this standard has no certification lane

package/skills/iso-standards-readiness/references/iso-15189.md

@@ -0,0 +1,219 @@
+# ISO 15189 Process Framework (No Standard Text)
+
+Research basis: **2026-07-26**. This reference summarizes a preparation process and
+evidence architecture for medical laboratory quality and competence work. It does not
+reproduce requirements and is not a substitute for the standard.
+
+## Copyright and authorized access
+
+ISO publications are copyrighted. Obtain ISO 15189 from
+[ISO](https://www.iso.org/standard/76677.html), an ISO national member, or another
+authorized source; see [ISO copyright](https://www.iso.org/copyright.html). Do not ask
+an agent to retrieve, transcribe, summarize clause-by-clause, or store proprietary
+text. Accreditation-body and CAP checklists that quote requirements are separately
+licensed material — do not paste them into shared repositories or prompts.
+
+## Current edition and the closed transition
+
+- [ISO 15189:2022](https://www.iso.org/standard/76677.html) is Edition 4, published
+  December 2022, cancelling and replacing ISO 15189:2012. Confirm on the ISO catalogue
+  page, which refused automated access during this research.
+- The 2022 edition aligns structurally with ISO/IEC 17025:2017 and **incorporates
+  point-of-care testing requirements previously held in ISO 22870**. Do not cite
+  ISO 22870 as a separate current POCT basis without confirming its status.
+- The ILAC-agreed transition for accredited medical laboratories ran to **December
+  2025**. A 2012-based quality system is out of date, not "in transition" — do not
+  build a gap baseline that assumes a future deadline.
+- Record publisher, title, edition, amendments, authorized location, access date,
+  source owner, currency-review date, impact decision, and approval in the controlled
+  source ledger.
+
+## Keep four lanes separate
+
+### 1. ISO 15189 accreditation
+
+An accreditation body grants accreditation for a defined scope of examinations, per
+laboratory and per location, under ISO/IEC 17011. A medical laboratory is
+**accredited**, not "ISO 15189 certified." Since 2026-01-01 the recognition arrangement
+sits with Global Accreditation Cooperation Incorporated; verify current claim and logo
+wording with the accreditation body.
+
+### 2. United States CLIA certification
+
+CLIA certification by CMS is **mandatory** before a US laboratory may accept human
+specimens for testing. It is federal law, not a voluntary quality scheme.
+
+**ISO 15189 accreditation does not satisfy CLIA and cannot replace a CLIA-based
+accreditation.** Deemed status flows only from a CMS-approved accreditation
+organization's program. CMS approves a limited set of accreditation organizations whose
+standards must meet or exceed CLIA requirements, with reapproval every six years or
+more often; read the
+[current AO list](https://www.cms.gov/Regulations-and-Guidance/Legislation/CLIA/Downloads/AOList.pdf)
+rather than relying on a remembered count. The CAP 15189 program is layered on top of
+CAP Laboratory Accreditation Program accreditation rather than offered as a standalone
+substitute — confirm current prerequisites with CAP.
+
+Never let an ISO 15189 readiness output be read as CLIA compliance, deemed status,
+licensure, or an inspection result.
+
+### 3. Other national licensure and inspection regimes
+
+State licensure, national health-authority requirements, and payer conditions of
+participation are separate again, with their own inspection processes and their own
+records. Non-US jurisdictions may make ISO 15189 accreditation mandatory, voluntary, or
+irrelevant. This is an applicability decision for authorized humans.
+
+### 4. IVD device regulation
+
+The performance of an in vitro diagnostic device, and any laboratory-developed test
+regime that applies to it, is regulated separately from laboratory accreditation. EU
+IVDR conformity assessment, notified-body involvement, and performance-study
+requirements are not laboratory accreditation questions. See `references/iso-13485.md`
+and the EU entries in `references/source-ledger.md`.
+
+## Hard boundary
+
+This skill and its files cannot:
+
+- accredit a laboratory, issue or validate an accreditation certificate or schedule,
+  or predict an assessment or inspection outcome;
+- establish CLIA certification, deemed status, licensure, or personnel qualification;
+- decide which scheme, jurisdiction requirement, or payer condition applies;
+- replace the laboratory director, quality manager, authorized signatory,
+  accreditation body, assessor, EQA provider, or competent authority;
+- verify or validate an examination procedure, set biological reference intervals,
+  establish traceability of assigned values, or judge clinical suitability; or
+- infer competence or patient safety from a document title, keyword, template,
+  checklist, or script result.
+
+Use outputs as a list of evidence questions for accountable human review.
+
+## Scope of accreditation is per examination
+
+Each scope item is defined by discipline, the examination or measurand reported, the
+controlled procedure and its issue, and the primary sample type with its acceptance
+requirements. Point-of-care testing performed under the laboratory's responsibility
+belongs in the scope discussion explicitly, including devices operated by clinical
+staff outside the laboratory.
+
+```bash
+PYTHONDONTWRITEBYTECODE=1 python3 scripts/validate_scope_intake.py \
+  /path/to/medical-laboratory-scope-intake.json --standard iso-15189
+```
+
+Copy `assets/templates/medical-laboratory-scope-intake-template.json` outside the skill
+first. The distributed template fails closed by design.
+
+## Process and evidence domains
+
+The `iso-15189` profile carries these domain labels for manifests and gap reports.
+They are workflow topics, not clause references:
+
+`scope-and-impartiality`, `organizational-structure-and-governance`,
+`personnel-competence`, `facilities-and-safety`, `equipment-and-calibration`,
+`metrological-traceability`, `reagents-and-consumables`,
+`externally-provided-products-and-services`, `pre-examination-processes`,
+`examination-methods-verification-and-validation`, `measurement-uncertainty`,
+`validity-of-results-and-external-quality-assessment`, `point-of-care-testing`,
+`post-examination-and-reporting`, `laboratory-information-management`, `complaints`,
+`nonconformity-and-corrective-action`, `risk-management-and-improvement`,
+`internal-audit`, `management-review`, `continuity-and-emergency-preparedness`.
+
+Each domain needs an owner, status, evidence IDs, source/version reference, recorded
+approval, and links to open gaps. Sample **records**, not only procedures.
+
+## Where medical laboratory evidence differs from ISO/IEC 17025
+
+### Pre-examination processes carry disproportionate risk
+
+Most avoidable patient harm originates before the analyser: request content and
+patient identification, collection and identification of the primary sample, transport
+and stability conditions, acceptance and rejection criteria, and handling of
+compromised samples. Sample: rejection records, identification-error events, transport
+excursions, and the resulting investigations — not only the collection manual.
+
+### Post-examination and reporting is clinical communication
+
+Assemble evidence for result review and authorization, reference intervals and
+clinical decision limits with their basis, interpretive comments and who is authorized
+to make them, report content and amendment or retraction handling, and — the item most
+often thin — **critical-result notification with documented read-back and
+timeliness**. Turnaround-time monitoring belongs here too.
+
+### Point-of-care testing is inside the scope
+
+POCT requirements now sit within ISO 15189. Record governance of devices outside the
+laboratory, operator training and authorization, connectivity and result capture into
+the patient record, quality-control regimes, and reconciliation with central
+laboratory methods.
+
+### Verification is the normal case, validation the exception
+
+Most medical laboratories verify commercial IVD examinations for their own setting
+rather than validating a new method. Record which performance characteristics were
+verified against the manufacturer's claims, the acceptance criteria, the data, and the
+authorized approval to report patient results. Laboratory-developed and modified
+procedures need the fuller validation evidence and the applicable regulatory analysis.
+
+### External quality assessment, not just proficiency testing
+
+Record EQA enrolment per scope item, results, evaluation against criteria, and
+investigation of unsatisfactory performance. Where no EQA scheme exists for an
+examination, record the alternative comparison approach and its authorization. An
+unacceptable EQA outcome with no documented investigation is a blocker.
+
+### Metrological traceability of assigned values
+
+For measurands where higher-order reference materials and reference measurement
+procedures exist, record the traceability of assigned values and the resulting
+commutability and comparability limitations. Where no reference system exists, record
+that fact and what the laboratory does about result comparability.
+
+### Risk and continuity are explicit
+
+The 2022 edition treats risk to patients as a running requirement rather than an annex.
+Record identified risks, controls, residual acceptance with authority, and improvement
+actions. Continuity and emergency preparedness — instrument failure, LIS outage,
+reagent supply interruption, facility loss — needs tested arrangements, not a plan
+nobody has exercised.
+
+## Shared checks that apply here
+
+- `scripts/audit_document_records.py` — controlled documents, records, retention basis,
+  and external-source currency. Standard-agnostic.
+- `scripts/check_capa.py` — nonconformity and corrective action with effectiveness
+  evidence before closure.
+- `scripts/check_supplier_controls.py` — reagents, consumables, calibration providers,
+  and referral laboratories, including the referral laboratory's own accreditation or
+  licensure status.
+- `scripts/validate_evidence_manifest.py` and `scripts/gap_analyzer.py` with
+  `--standard iso-15189`.
+
+`scripts/check_traceability.py` and `scripts/check_qmsr_transition.py` are
+device-lifecycle checks and do not apply here.
+
+## Common preparation failures
+
+- Presenting ISO 15189 readiness as CLIA compliance or deemed status.
+- Saying "certified" when the laboratory is accredited.
+- Citing ISO 22870 as the current separate POCT basis, or ISO 15189:2012 as current.
+- POCT devices operating outside the laboratory with no governance, training, or QC
+  evidence in the accreditation scope discussion.
+- Critical-result notification procedures with no notification records or timeliness
+  evidence.
+- Reference intervals adopted from a package insert with no documented basis for the
+  served population.
+- EQA scores filed without investigation of unsatisfactory results.
+- Continuity plans that have never been exercised.
+
+## Sources
+
+- [ISO 15189:2022](https://www.iso.org/standard/76677.html) — catalogue entry
+- [ILAC: ISO 15189:2022 published](https://ilac.org/latest_ilac_news/iso-151892022-for-medical-labs-published/)
+- [CMS CLIA program](https://www.cms.gov/medicare/quality/clinical-laboratory-improvement-amendments)
+- [CLIA accreditation and exemptions](https://www.cms.gov/medicare/quality/clinical-laboratory-improvement-amendments/accreditation-exemptions)
+- [CMS approved accreditation organizations](https://www.cms.gov/Regulations-and-Guidance/Legislation/CLIA/Downloads/AOList.pdf)
+- [CAP 15189 program](https://www.cap.org/laboratory-improvement/accreditation/cap-15189-accreditation-program)
+- `references/source-ledger.md` — dated baseline and provenance limitations
+- `references/assurance-lanes.md` — how accreditation, certification, and regulatory
+  inspection differ

package/skills/iso-standards-readiness/references/iso-17025.md

@@ -0,0 +1,208 @@
+# ISO/IEC 17025 Process Framework (No Standard Text)
+
+Research basis: **2026-07-26**. This reference summarizes a preparation process and
+evidence architecture for testing and calibration laboratory competence work. It does
+not reproduce requirements and is not a substitute for the standard.
+
+## Copyright and authorized access
+
+ISO and IEC publications are copyrighted. Obtain ISO/IEC 17025 from
+[ISO](https://www.iso.org/standard/66912.html), IEC, an ISO national member, or another
+authorized source; see [ISO copyright](https://www.iso.org/copyright.html). Do not ask
+an agent to retrieve, transcribe, summarize clause-by-clause, or store proprietary
+text. Accreditation-body checklists that quote the standard are equally copyrighted and
+are usually licensed only to the accredited laboratory.
+
+## Current edition
+
+- [ISO/IEC 17025:2017](https://www.iso.org/standard/66912.html) is Edition 3. No
+  successor edition was identified at the research basis date — confirm on the ISO
+  catalogue page, which refused automated access during that research.
+- The 2017 edition restructured the 2005 edition around laboratory activities and
+  risk-based thinking. A quality system still organized around the 2005 clause
+  structure is out of date; do not treat a 2005-era manual as a current gap baseline.
+- Record publisher, title, edition, amendments/corrigenda, authorized location, access
+  date, source owner, currency-review date, impact decision, and approval in the
+  controlled source ledger.
+
+## The vocabulary trap: laboratories are accredited, not certified
+
+A laboratory is **accredited** to ISO/IEC 17025 by an accreditation body. It is not
+"ISO 17025 certified," and no certification body issues an ISO/IEC 17025 certificate.
+Writing "certified" in a report, tender response, or quality manual is a substantive
+error that assessors and customers both notice.
+
+- Accreditation bodies operate under ISO/IEC 17011 and are peer-evaluated through the
+  recognition arrangement. Certification bodies operate under ISO/IEC 17021-1. These
+  are different schemes with different scope statements.
+- Since **2026-01-01**, Global Accreditation Cooperation Incorporated has replaced the
+  former ILAC and IAF and operates its own Multilateral Recognition Arrangement.
+  Results and certificates issued under the former ILAC MRA / IAF MLA remain
+  recognized during the transition. Verify current logo, claim, and endorsement wording
+  with the accreditation body before reproducing any of it.
+- ISO/IEC 17025 accreditation is not ISO 9001 certification, not a product approval,
+  not a regulatory authorization, and not a statement that any particular result is
+  correct.
+
+## Hard boundary
+
+This skill and its files cannot:
+
+- accredit a laboratory, issue or validate an accreditation certificate or schedule,
+  or predict an assessment outcome;
+- decide which accreditation scheme, jurisdiction requirement, or customer
+  specification applies;
+- replace the laboratory's technical management, quality manager, authorized signatory,
+  accreditation body, assessor, or proficiency-testing provider;
+- validate a method, compute or approve a measurement uncertainty budget, establish
+  metrological traceability, or judge whether a decision rule is fit for purpose; or
+- infer competence from a document title, keyword, template, checklist, or script
+  result.
+
+Use outputs as a list of evidence questions for accountable human review.
+
+## Scope of accreditation is per activity, not per organization
+
+The accredited scope is defined item by item: field or discipline, method or procedure
+and its issue, the measurand or property determined, and the range with the reported
+uncertainty basis. For calibration laboratories this is normally expressed through
+calibration and measurement capability statements.
+
+Consequences for evidence preparation:
+
+- Work outside the accredited scope must not carry an accreditation claim or
+  endorsement, even at an accredited site under an accredited quality system.
+- A method change, a range extension, a new location, or a new authorized signatory is
+  a scope question, not only an internal change-control question.
+- Subcontracted work has its own rules for customer notification and for the
+  subcontractor's own accreditation status. Record both.
+
+Capture scope items with:
+
+```bash
+PYTHONDONTWRITEBYTECODE=1 python3 scripts/validate_scope_intake.py \
+  /path/to/laboratory-scope-intake.json --standard iso-17025
+```
+
+Copy `assets/templates/laboratory-scope-intake-template.json` outside the skill first.
+The distributed template fails closed by design.
+
+## Process and evidence domains
+
+The `iso-17025` profile carries these domain labels for manifests and gap reports.
+They are workflow topics, not clause references:
+
+`scope-and-impartiality`, `organizational-structure-and-management`,
+`personnel-competence`, `facilities-and-environmental-conditions`,
+`equipment-and-calibration`, `metrological-traceability`,
+`externally-provided-products-and-services`, `review-of-requests-and-contracts`,
+`method-selection-verification-and-validation`, `sampling`, `handling-of-items`,
+`technical-records`, `measurement-uncertainty`,
+`validity-of-results-and-proficiency-testing`, `reporting-and-decision-rules`,
+`complaints`, `nonconforming-work`, `data-and-information-management`,
+`internal-audit`, `management-review`, `corrective-action-and-improvement`.
+
+Each domain needs an owner, status, evidence IDs, source/version reference, recorded
+approval, and links to open gaps. Sample **records**, not only procedures: a procedure
+describing uncertainty evaluation is not evidence that a budget exists for a reported
+measurand.
+
+## The four technical areas that carry most findings
+
+### 1. Metrological traceability
+
+Traceability is a documented, unbroken chain to a stated reference with stated
+uncertainty at each step — not a drawer of calibration certificates. The governing
+policy is **ILAC P10:07/2020** (implementation July 2021, revised for the 2017
+edition); confirm its current designation, since the P/G series numbering may move
+under GLOBAC.
+
+Evidence to assemble per measurement: the stated reference, the calibration provider
+and its accreditation status and scope, certificate identity and date, the uncertainty
+contribution carried forward, interval justification, and intermediate-check records.
+
+### 2. Measurement uncertainty
+
+Record which measurands have evaluated uncertainty, the evaluation basis, the
+contributions included, how uncertainty is reported, and how it interacts with the
+decision rule. An uncertainty budget that exists only in a spreadsheet with no
+controlled revision, owner, or approval is a gap, not evidence.
+
+This skill does not compute uncertainty. For the repo's uncertainty tooling, see the
+`uncertainty-and-units` skill; its outputs still require authorized technical review
+before entering a controlled record.
+
+### 3. Method selection, verification, and validation
+
+Distinguish, per scope item: a standard method used as published, a standard method
+requiring verification of the laboratory's ability to perform it, a modified standard
+method, and a laboratory-developed method. The evidence expected differs in each case.
+Record the performance characteristics evaluated, the acceptance criteria, the data,
+and the authorized approval to put the method into service.
+
+### 4. Decision rules and statements of conformity
+
+If reports state conformity to a specification, the decision rule must be documented,
+agreed with the customer where required, and applied consistently — including how
+measurement uncertainty is treated at the specification limit. The guidance basis is
+**ILAC G8:09/2019**, with JCGM 106:2012 / ISO/IEC Guide 98-4 as the metrological
+companion. Confirm current issues before citing either in a controlled procedure.
+
+Assemble, per scope item that reports conformity: the rule, the agreement record, the
+uncertainty treatment, the report wording, and the authorized signatory.
+
+## Validity of results and proficiency testing
+
+Interlaboratory comparison and proficiency-testing participation is monitoring
+evidence, and a passing result is not a competence conclusion. Record the plan (which
+scope items, what frequency, what provider), each result, the evaluation against
+acceptance criteria, and — most importantly — the investigation and corrective action
+for any questionable or unsatisfactory outcome. An unsatisfactory result with no
+documented investigation is a blocker; treat it as one.
+
+Where the laboratory cannot participate because no scheme exists for a measurand,
+record the alternative approach and its authorization rather than leaving a silence.
+
+## Shared checks that apply here
+
+- `scripts/audit_document_records.py` — controlled documents, technical records,
+  retention basis, and external-source currency. Standard-agnostic.
+- `scripts/check_capa.py` — nonconforming work and corrective action, including
+  effectiveness evidence before closure.
+- `scripts/check_supplier_controls.py` — externally provided products and services,
+  including calibration providers, reference-material suppliers, and subcontracted
+  laboratories.
+- `scripts/validate_evidence_manifest.py` and `scripts/gap_analyzer.py` with
+  `--standard iso-17025` — bounded evidence manifest and domain-level gap view.
+
+`scripts/check_traceability.py` and `scripts/check_qmsr_transition.py` are
+device-lifecycle checks and do not apply to laboratory accreditation work. Note that
+`check_traceability.py` concerns design/risk traceability, **not** metrological
+traceability — the words collide and the check is the wrong tool here.
+
+## Common preparation failures
+
+- Claiming "ISO 17025 certified" instead of accredited, or attaching an accreditation
+  symbol to results outside the accredited scope.
+- Treating calibration certificates as traceability evidence without the uncertainty
+  chain, provider scope, or interval justification.
+- Reporting conformity with no documented decision rule, or a rule that ignores
+  uncertainty at the limit.
+- Verifying a standard method once at introduction and never revisiting it after a
+  method issue, instrument, or personnel change.
+- Recording proficiency-testing scores while leaving unsatisfactory results
+  uninvestigated.
+- Presenting an impartiality statement with no identified risks, no controls, and no
+  review.
+- Filing a document register as the deliverable when no technical records were sampled.
+
+## Sources
+
+- [ISO/IEC 17025:2017](https://www.iso.org/standard/66912.html) — catalogue entry
+- [ISO/IEC 17025 landing page](https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html)
+- [ILAC policy series](https://ilac.org/publications-and-resources/ilac-policy-series/) — P10 traceability policy
+- [GLOBAC launch](https://iaf.nu/en/news/global-accreditation-cooperation-incorporated-launch-unifies-international-accreditation-organisations-and-strengthens-worldwide-trust/)
+- [Specifying use of GLOBAC accreditation](https://ilac.org/latest_ilac_news/iaf-and-ilac-release-information-on-specifying-use-of-globac-accreditation/)
+- `references/source-ledger.md` — dated baseline and provenance limitations
+- `references/assurance-lanes.md` — how this lane differs from certification and
+  regulatory inspection