Skip to content
Hybrid GraphRAG Wiki & Architecture

System Overview & Architecture

Executive Summary

The Hybrid GraphRAG platform is an enterprise-grade Life Sciences artificial intelligence architecture engineered for Computer System Validation (CSV), Computer Software Assurance (CSA), Quality Management Systems (QMS), and Asset/CMMS Governance.

The system enforces strict compliance with international regulatory standards:

  • United States FDA 21 CFR Part 11 (Electronic Records and Electronic Signatures)
  • European Union EudraLex Volume 4, Annex 11 (Computerised Systems)
  • ISPE GAMP 5 Second Edition (Risk-Based Approach to Compliant GxP Computerized Systems)
  • International Organization for Standardization ISO 13485:2016 (Medical Devices Quality Management Systems)
  • United States FDA Quality Management System Regulation (QMSR, 21 CFR Part 820)
  • ALCOA+ Data Integrity Principles (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available)

Architectural Blueprint

+---------------------------------------------------------------------------------------+
|                            CLIENT ACCESS & CONSOLIDATED SUITE                         |
|                                                                                       |
| GxPChat Unified Application (Next.js 16 + React 19 + Tailwind v4 + shadcn/ui)         |
|   |-- AI Assistant Console (/)                                                        |
|   |-- Enterprise QMS (/qms)                                                           |
|   |-- Physical Asset Management (/assets)                                             |
|   |-- IT Help Desk & GxP Service Desk (/helpdesk)                                     |
|   |-- IT Computer System Validation (/validation)                                     |
|   `-- GxP Backup, Disaster Recovery & SOP Qualification (/backup-restore)             |
+-------------------------------------------+-------------------------------------------+
                                            |
                                            v
+---------------------------------------------------------------------------------------+
|                                  API GATEWAY & PROTOCOLS                              |
|                                                                                       |
| FastAPI Backend Service (:8090)                                                       |
|   |-- FastMCP Server (Server-Sent Events: /mcp/sse)                                   |
|   |-- Reverse Proxy Integration from GxPChat                                          |
|   `-- REST API Endpoints (/api/agents/*, /api/storage/*, /api/demos/*)                |
+-------------------------------------------+-------------------------------------------+
                                            |
                                            v
+---------------------------------------------------------------------------------------+
|                              MULTI-AGENT ORCHESTRATION LAYER                          |
|                                                                                       |
| Lead CSV Orchestrator (Virtual Quality Board)                                         |
|   |-- 23 Specialized Pydantic AI Agents (Dependency Injection: GxpAgentDeps)         |
|   |-- Autonomous Squad Missions (Missions 1 through 8)                                |
|   `-- EvidenceGate Pre-Flight Verification & Live Supersession Checking               |
+-------------------------------------------+-------------------------------------------+
                                            |
                                            v
+---------------------------------------------------------------------------------------+
|                                3-DATABASE DIVISION OF LABOR                           |
|                                                                                       |
|   +--------------------------+  +--------------------------+  +---------------------+ |
|   |        POSTGRESQL        |  |          QDRANT          |  |      MEMGRAPH       | |
|   | Canonical Relational SoR |  |  Semantic Vector Search  |  | Structural KG C++   | |
|   | 21 CFR Part 11 Triggers  |  |  Dense + Sparse Splade   |  | Multi-Hop Paths     | |
|   | Immutable Audit Ledger   |  |  Sub-5ms ANN Latency     |  | Deep Traversal      | |
|   | Port: 5434               |  |  Port: 6335              |  | Port: 7688/Lab:3006 | |
|   +--------------------------+  +--------------------------+  +---------------------+ |
+---------------------------------------------------------------------------------------+
                                            |
                                            v
+---------------------------------------------------------------------------------------+
|                        STORAGE, OBSERVABILITY & MICROSERVICES                         |
|                                                                                       |
|   +--------------------------+  +--------------------------+  +---------------------+ |
|   |        RUSTFS S3         |  |    LANGFUSE V4 STACK     |  |    DOCX SERVICE     | |
|   | S3-Compatible Storage    |  | Web + Worker + ClickHouse|  | ASP.NET Core API    | |
|   | File Drop Watcher Engine |  | Redis + MinIO + Tracing  |  | Formal Word Exports | |
|   | Port: 9120 / UI: 9121    |  | Port: 3001               |  | Port: 5055          | |
|   +--------------------------+  +--------------------------+  +---------------------+ |
+---------------------------------------------------------------------------------------+

Core Architectural Pillars

1. Three-Database Division of Labor

The platform avoids the compromises of single-database architectures by enforcing a strict division of labor across three specialized database engines:

  • PostgreSQL 16: Functions as the authoritative System of Record (SoR) and regulatory ledger. Enforces 21 CFR Part 11 append-only immutability via database triggers that physically reject UPDATE and DELETE operations on audit trails, signatures, and backup execution tables.
  • Qdrant Vector Database (v1.13.4): Executes dense and sparse vector similarity matching with sub-5 millisecond retrieval latency. Employs prefetching and Reciprocal Rank Fusion (RRF) to retrieve mathematically relevant text chunks across controlled document vaults.
  • Memgraph MAGE (In-Memory Graph Database): Models relational linkages as a Labeled Property Graph (LPG). Executes multi-hop Cypher queries to evaluate ripple-effect impacts across User Requirements, Functional Specifications, Risk Assessments, Assets, and Deviations.

2. Zero-Trust EvidenceGate

Retrieved vector and graph candidates are not injected blindly into large language model context windows. Instead, all candidates pass through the zero-trust EvidenceGate engine:

  • Verifies that referenced chunk hashes match the live PostgreSQL canonical record.
  • Asserts that the document status is currently effective and has not been superseded or withdrawn.
  • Validates the presence of valid 21 CFR Part 11 cryptographic digital signatures.
  • Drops invalid or unverified chunks prior to model prompt assembly.

3. Specialized Pydantic AI Agent Architecture

Rather than relying on a general-purpose conversational agent, the platform deploys 23 purpose-built Pydantic AI agents coordinated by a Lead CSV Orchestrator. Each agent:

  • Is scoped to a single regulatory or technical responsibility (for example, Traceability, Risk Assessment, Deviation Root Cause Analysis, or Disaster Recovery).
  • Receives strongly typed runtime dependencies via RunContext[GxpAgentDeps].
  • Employs strict Pydantic output validation to ensure that all generated deliverables conform to required data contracts.
  • Connects to frontend interfaces through Model Context Protocol (FastMCP) Server-Sent Events.

4. Consolidated User Application (GxPChat)

All operational applications are united within GxPChat, a Next.js 16 web suite offering:

  • Natural language conversational assistant with smart autocomplete triggers (# action commands and @ entity mentions).
  • Enterprise Quality Management System (QMS) with dual Operational and Auditor Inspection modes.
  • Physical Asset and Metrology Management across 202 enterprise instruments and skids.
  • IT Service Desk with dual-track segregation of standard IT tickets from GxP incidents.
  • Computer System Validation hub with live V-Model matrix, CSA risk calculator, and test execution modals.
  • GxP Backup and Disaster Recovery console governing SOP-IT-018 automated cloud backups and SOP-IT-019 manual dual-custody executions.