# EDGE-COMPUTING VETERINARY DIAGNOSTIC SYSTEM WITH HYBRID-INFERENCE METHOD

---

**Applicant:** AgroInsights Technologies Limited (a company incorporated in England and Wales)

**Inventors:** Albertini, Richard J.; Diaz-Albertini, Rafael

**Application:** United Kingdom priority filing — UKIPO online portal

**Date of filing (intended):** 16 May 2026

**Document control:** Specification v1.0 · Strictly Private and Confidential · Inventorship-disclosure document

---

## § 1. FIELD OF THE INVENTION

[0001] The invention relates to integrated cyber-physical systems for veterinary clinical decision support in livestock production. More particularly, the invention relates to a three-tier architecture comprising a wearable interstitial-fluid biosensor, an on-farm edge-computing gateway running a multi-biomarker pathway classifier, and a federated cloud-tier aggregation system, the three tiers being co-operatively configured to execute a hybrid-inference method in which a confidence-banded escalation policy determines, on a reading-by-reading basis, whether a candidate diagnostic hypothesis is returned at the edge tier or routed to the cloud tier for augmentation, the method being further characterised by a cryptographically anchored chain-of-custody verification rail spanning all three tiers.

---

## § 2. BACKGROUND OF THE INVENTION

### 2.1 The technical problem

[0002] Continuous, animal-level health monitoring at commercial-livestock scale is a long-standing technical problem. The four converging pressures on the modern livestock sector — antimicrobial-resistance (AMR) stewardship obligations under UK-VARSS and equivalent regimes; data-sovereignty obligations under the United Kingdom General Data Protection Regulation, the Data Protection Act 2018, and analogous European instruments; the unfavourable cost economics of cloud-only inference deployed at herd scale; and the persistent connectivity constraints of rural farm sites — together create a need for a livestock-monitoring architecture that is simultaneously low-latency, bandwidth-efficient, sovereignty-preserving, and resilient under intermittent connectivity loss. No prior architecture known to the inventors satisfies all four constraints.

[0003] Existing veterinary monitoring systems address one or two of these constraints in isolation. Wearable behavioural-monitoring tags transmit their data to remote cloud services for analysis; in-rumen biosensors relay data through fixed base stations that act as transparent gateways rather than inference tiers; laboratory-based diagnostic networks aggregate results at central facilities. None of these architectures performs diagnostic inference at the farm tier, none preserves raw biomarker readings within the farm boundary as a structural property of the system, and none provides a cryptographically anchored, reading-level chain of custody spanning sensor, edge, and cloud.

### 2.2 Survey of prior approaches

[0004] *Allflex SenseHub* and equivalent commercial cattle ear-tag products provide accelerometer-based behavioural monitoring with cohort-level analytics performed in the cloud. The architecture is single-tier with respect to inference: every reading is transmitted to the cloud for analysis. There is no edge-tier classifier and no hybrid-inference policy. Continuous biomarker readings (interstitial-fluid analytes, acute-phase proteins, cytokines) are not addressed.

[0005] *smaXtec* and similar in-rumen bolus systems perform continuous body-temperature and motility measurement. The bolus communicates through an on-farm base station that acts as a relay rather than a compute tier. Inference is performed in the cloud, and there is no edge-tier classifier. The architecture does not address external interstitial-fluid biomarkers and provides no analyte-agnostic confidence-banded routing.

[0006] *IDEXX VetConnect* and analogous veterinary diagnostic networks aggregate laboratory-test results across veterinary practices. The architecture is centralised: samples are taken at the farm, dispatched to a laboratory, and results are returned via a network. There is no in-vivo continuous monitoring, no edge-tier inference, and no real-time decision support.

[0007] *Profusa* and analogous human consumer interstitial-fluid biosensors provide implanted optical biosensing in human subjects, with readings paired to a personal mobile device for cloud-based analysis. The architecture is single-tier. The application domain is human consumer health, not veterinary livestock; the form factor is implanted rather than ear-mounted; and there is no on-farm edge-computing tier and no federated cross-farm aggregation.

[0008] *Connecterra* and related machine-learning platforms analyse dairy-cattle data sourced from third-party sensors. There is no native sensor tier; the architecture is cloud-only; and the analysis is post-hoc rather than real-time.

### 2.3 The unmet need

[0009] What is unmet by the prior art is an integrated cyber-physical system that combines, in a single coherent architecture: (i) a wearable interstitial-fluid biosensor capturing continuous multi-analyte readings on individual livestock animals; (ii) an on-farm edge gateway performing real-time multi-biomarker pathway classification at the farm tier; (iii) a hybrid-inference method whereby a confidence-banded escalation policy determines per-reading routing between edge and cloud, preserving sub-100 millisecond local response for the majority of cases; (iv) a federated cloud-tier aggregation system surfacing regional cohort intelligence without raw-biomarker egress from any individual farm; and (v) a cryptographically anchored chain-of-custody verification rail that ties every reading and every routing decision to a tamper-evident audit log with public-ledger anchoring.

[0010] The combination of these features — and not any single feature considered in isolation — addresses the four converging pressures identified at paragraph [0002]. The latency reduction follows from edge-tier inference; the bandwidth reduction follows from the confidence-banded routing policy; the data-sovereignty preservation follows from the structural absence of raw-biomarker egress; the connectivity resilience follows from the deterministic graceful-degradation behaviour of the hybrid-inference state machine. The cryptographic chain-of-custody renders each of these technical effects independently verifiable by an arms-length counterparty (a regulator, an insurer, a buyer audit) without disclosure of any raw biomarker reading.

[0011] The invention described in this specification provides such a system and the corresponding computer-implemented method, together with a number of dependent technical features that further characterise particular embodiments.

---

## § 3. SUMMARY OF THE INVENTION

### 3.1 The inventive contribution

[0012] In a first aspect, the invention provides a system for veterinary clinical decision support comprising: (a) a wearable biosensor configured to capture continuous interstitial-fluid biomarker readings from a livestock animal, the biosensor comprising at least one microcontroller, a wireless transceiver, a power source, and a microneedle interstitial-fluid sampling array; (b) an on-farm edge gateway communicatively coupled to one or more wearable biosensors, the edge gateway comprising AI-class compute hardware running a multi-biomarker pathway classifier and a hybrid-inference policy as defined herein; (c) a cloud-tier aggregation system communicatively coupled to a plurality of edge gateways across a plurality of farms, the cloud-tier aggregation system providing federated cross-farm intelligence without raw-biomarker egress from any individual farm; and (d) a chain-of-custody verification rail spanning the sensor tier, the edge tier, and the cloud tier, providing a cryptographically anchored audit trail of every biomarker reading and every diagnostic decision-support output.

[0013] In a second aspect, the invention provides a computer-implemented method comprising: receiving, at the on-farm edge gateway, a sequence of interstitial-fluid biomarker readings from one or more wearable biosensors; executing, at the edge gateway, a multi-biomarker pathway classifier on the received readings to produce a candidate-hypothesis output and an associated confidence score; determining, based on the confidence score, a routing decision according to a three-band confidence-banded escalation policy comprising a high-confidence band, a medium-confidence band, and a low-confidence band; and writing, to an append-only cryptographically anchored audit log, the candidate-hypothesis output, the confidence score, the routing decision, and any cloud-tier verdict.

[0014] In particular embodiments, the high-confidence band is bounded below by a first threshold of approximately 0.85; the medium-confidence band is bounded above by the first threshold and below by a second threshold of approximately 0.60; and the low-confidence band is bounded above by the second threshold. The thresholds are claim-element parameters and are intentionally specified with the qualifier "approximately" to preserve prosecution flexibility for the duration of the priority year and beyond.

### 3.2 Technical effects

[0015] The invention produces a plurality of measurable, cyber-physical technical effects:

- **Latency reduction.** For any reading whose confidence score falls within the high-confidence band, the user-facing diagnostic output is returned in less than approximately 100 milliseconds wall-clock at the edge tier, as compared with a typical cloud-round-trip time of greater than two seconds for an equivalent cloud-only architecture.
- **Bandwidth reduction.** Only those readings whose confidence score falls within the low-confidence band trigger a synchronous cloud round-trip; readings within the medium-confidence band trigger a background cloud query whose result is surfaced only if it differs from the local verdict; readings within the high-confidence band trigger no cloud round-trip whatsoever. Aggregate edge-to-cloud bandwidth is reduced by greater than approximately 95% relative to a cloud-only baseline.
- **Data-sovereignty preservation.** Raw biomarker readings are never transmitted from the edge tier to the cloud tier under any operational mode. Only anonymised aggregate cohort statistics, k-anonymously suppressed and differentially-privately noised, leave the farm boundary. This is a structural property of the information-flow topology of the system, not a policy overlay.
- **Power-budget preservation.** Edge-tier inference performed on locally cached model weights consumes less aggregate energy than the radio-power cost of continuously streaming raw biomarker readings to the cloud would consume, and preserves the wearable biosensor's intended fourteen-day wear-cycle target on a CR2477H coin-cell battery.
- **Graceful degradation.** When the cloud tier is unreachable, the hybrid-inference state machine enters a deterministic graceful-degradation state in which the low-confidence band is degraded to a clinician-facing "deferred-verdict" output flagged as such; the architecture continues to operate the high-confidence and medium-confidence bands without degradation. Connectivity loss does not cause the system to stall.

### 3.3 Cyber-physical character of the contribution

[0016] The inventive contribution is a cyber-physical contribution and not a contribution that resides solely in computer software or in the abstract domain of mental acts, mathematical methods, presentations of information, or business methods. The contribution is hardware-anchored at every tier:

- At the sensor tier, by a quad-array hydrogel-microneedle interstitial-fluid sampling array of specified geometry, a Nordic nRF5340 system-on-chip with a hardware-rooted secure enclave, a Bluetooth Low Energy 5.x coded-PHY transceiver, a Semtech SX1262 sub-gigahertz long-range modem, a CR2477H coin-cell battery operating within a defined temperature and current-draw envelope, and a 32 MB SPI-NOR ring-buffer memory.
- At the edge tier, by AI-class compute hardware (in particular embodiments, an NVIDIA Jetson Orin Nano 8 GB delivering approximately 40 trillion operations per second at INT8 precision, or alternatively a Raspberry Pi 5 single-board computer paired with a Google Coral USB-attached tensor processing unit delivering approximately 4 trillion operations per second at INT8), a TPM 2.0-class secure element or ARM TrustZone-backed secure enclave, and a non-volatile ring buffer of at least 128 GB capacity.
- At the cloud tier, by a federated aggregation engine implementing k-anonymous suppression at a threshold of at least five distinct contributing farms and a differential-privacy noise envelope of bounded epsilon.
- At the cryptographic-rail tier, by SHA-256 per-measurement digesting, Merkle-tree leaf and root construction, ECDSA-P256 signing performed within the secure element, and anchoring of the resulting commitment to a public distributed ledger.

[0017] The technical effects identified at paragraph [0015] are produced by the operation of this hardware-anchored architecture as an integrated whole. They are not properties of any abstract algorithm executed on a general-purpose computer, nor of any clinical interpretation that may be drawn by a veterinarian from the diagnostic output. The clinical interpretation is the technical effect's downstream consequence; the invention is the system that produces the technical effects. The invention is therefore not a program for a computer as such within the meaning of section 1(2)(c) of the Patents Act 1977 and Article 52(2)(c) of the European Patent Convention.

---

## § 4. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The invention is further described, by way of example only, with reference to the accompanying drawings, in which:

- **Fig. 1** is a schematic block diagram of the closed-loop platform architecture, showing the four core elements of the system — a wearable biosensor (100), an on-farm edge gateway (200), a cloud-tier aggregation system (300) and a chain-of-custody verification rail (400) — arranged as a closed loop with bidirectional flow between sensor and edge tiers, between edge and cloud tiers, and with dashed audit-anchor connections from each functional tier into the chain-of-custody verification rail.

- **Fig. 2** is a topological view of a multi-instance deployment, showing a sensor layer comprising a plurality of wearable biosensors (100a–100d) including a pasture-deployed instance, an edge layer comprising a plurality of on-farm edge gateways (200a, 200b) at distinct farm sites and a LoRa concentrator (218) collecting from the pasture instance, and a cloud layer (300) containing a federated aggregation engine (310) and a cohort-statistics datastore (320).

- **Fig. 3** is a schematic of the wearable biosensor (100), showing its principal sub-components: a quad-array hydrogel-microneedle cluster (102) with per-needle electrochemical-impedance-spectroscopy continuity-check trace (103); a Nordic nRF5340 system-on-chip (104) with secure enclave (105); a Bluetooth Low Energy 5.x coded-PHY transceiver (106); a Semtech SX1262 LoRa modem (108); a shared antenna (110); a CR2477H battery (112); a 32 MB SPI-NOR ring buffer (114); and a quad-array cluster_health state machine (116).

- **Fig. 4** is the hybrid-inference state machine, showing an entry node (220) presenting a candidate-hypothesis with confidence score, three primary band states (222 high-confidence, 224 medium-confidence, 228 low-confidence), a cloud-augmentation arbiter sub-state (226) reachable from the medium-confidence band, a graceful-degradation state (229) reachable when the cloud tier is unreachable, a unified user-facing output node (230), and dashed audit-write connections from each band state into the chain-of-custody verification rail (400).

- **Fig. 5** is a sequence diagram of the chain-of-custody Merkle-tree anchoring sequence, showing the sensor (100), the edge gateway (200), the audit-log store (400) and the public-ledger anchor (410), and showing the per-measurement SHA-256 digest (402), the Merkle-tree leaf (404) and root (406) construction, the ECDSA-P256 signature (408) by the gateway secure element, and the HKDF-derived per-event identifier (412).

- **Fig. 6** is a hub-and-spoke schematic of the federated cross-farm aggregation network, showing eight on-farm edge gateways (200a–200h) at eight distinct farms feeding anonymised statistic submission packets (502) into the cloud-tier aggregation system (300), the packets passing through a k-anonymous suppression filter (504) at a threshold k ≥ 5 and a differential-privacy noise envelope (506) at epsilon ≤ 4 with gradient clip C = 1.0, before being aggregated by the federated aggregation engine (310), stored in the cohort-statistics datastore (320), and surfaced as regional cohort statistics (508) and through a regulator-facing aggregate-evidence channel (510) anchored back into the chain-of-custody verification rail (400).

---

## § 5. DETAILED DESCRIPTION OF EMBODIMENTS

### 5.1 Wearable biosensor (sensor tier)

[0019] With reference to Fig. 3, the wearable biosensor 100 is implemented in particular embodiments as a two-piece ear-mounted assembly comprising a reusable Pod and a disposable sterile Head, supplied as part of a three-component kit further including a single-use sterile Applicator. The three components are cryptographically bound together at onboarding as described in section 5.1.7 below.

[0020] The Pod houses, as shown in Fig. 3: a Nordic nRF5340 system-on-chip 104, a secure-enclave partition 105 forming a hardware root-of-trust, a Bluetooth Low Energy 5.x coded-PHY transceiver 106, a Semtech SX1262 sub-gigahertz LoRa modem 108, a shared antenna structure 110, a CR2477H 1,000 milliampere-hour 3.0 volt coin-cell battery 112, a 32 MB SPI-NOR ring-buffer memory 114, and an on-sensor cluster_health state machine 116.

#### 5.1.1 Microneedle interstitial-fluid sampling array

[0021] The disposable sterile Head incorporates a quad-array hydrogel-microneedle cluster 102 in the form of four microneedles arranged in a compact two-by-two cluster geometry, having the following dimensions:

- **Cluster footprint:** approximately 1.5 millimetres to approximately 2.0 millimetres in greatest cross-sectional dimension.
- **Inter-needle pitch:** approximately 0.5 millimetres to approximately 0.8 millimetres centre-to-centre between adjacent needles within the cluster footprint.
- **Individual needle length:** approximately 0.7 millimetres to approximately 1.3 millimetres, with shorter lengths in the 0.7 millimetre to 1.0 millimetre region applied for porcine ear anatomy and longer lengths in the 1.0 millimetre to 1.3 millimetre region applied for bovine ear anatomy on account of the thicker bovine ear dermis.
- **Tip radius:** less than or equal to approximately 30 micrometres.

[0022] The cluster footprint dimension and the inter-needle pitch dimension are distinct parameters: the cluster footprint defines the outer envelope of the four-needle array as a whole, and the inter-needle pitch defines the centre-to-centre spacing between adjacent individual needles within that envelope. The geometry is selected to distribute insertion force across four discrete penetration sites, reducing localised tissue trauma, while preserving an aggregate cluster footprint compatible with ear-mounting on common production-livestock species. Insertion force is specified as less than approximately 2.5 newtons across the cluster as a whole, with no individual needle exceeding approximately 0.6 newtons in the porcine variant or approximately 0.75 newtons in the bovine variant.

[0023] Each of the four microneedles is associated with a distinct subset of biomarker analytes by way of dedicated working-electrode chemistry at the needle base. In a particular bovine-variant embodiment, the four-needle allocation is: needle one — lactate and pH; needle two — interferon-gamma; needle three — serum amyloid A and haptoglobin; needle four — procalcitonin or N-acetyl-β-D-glucosaminidase. In a particular porcine-variant embodiment the allocation differs and includes glucose, lactate, β-hydroxybutyrate, sodium, potassium, calcium, chloride, and nitrite/nitrate channels.

#### 5.1.2 Per-needle continuity self-test

[0024] As shown in Fig. 3, each microneedle of the array is connected to the analogue front-end of the system-on-chip 104 by a per-needle electrochemical-impedance-spectroscopy (EIS) continuity-check trace 103. The system-on-chip is configured to execute, at a defined cadence of approximately every twenty-four hours, an EIS self-test in which a small alternating current is applied at approximately 1 kilohertz and the resulting impedance is measured. A measured impedance of less than approximately 1 kiloohm at 1 kilohertz is taken as confirmation of normal needle continuity; a drift of less than or equal to approximately 10 per cent over a rolling seven-day window is taken as confirmation of stable channel response. A needle reporting open-circuit, or whose drift exceeds the 10 per cent threshold, is automatically excluded from sampling at the analogue front-end, and the cluster_health state machine 116 is updated accordingly.

#### 5.1.3 Cluster-health state machine

[0025] The cluster_health state machine 116 implements a three-state Markov model over the per-needle validity flags reported by the EIS continuity self-test. The state machine occupies one of three states designated, in the present specification, **green**, **yellow** and **red**:

- **Green:** at least three of the four needles are reporting valid signals within calibration drift tolerance. The cluster is treated as fully functional and all biomarker channels are streamed to the edge gateway.
- **Yellow:** exactly two of the four needles are valid. The cluster is treated as partially degraded; sampling continues on the valid needles; a warning event is emitted to the edge gateway and propagated to a clinician-facing dashboard.
- **Red:** at most one of the four needles is valid. The cluster is treated as critically degraded; an immediate push notification is emitted; head replacement is recommended.

[0026] The three-of-four quorum criterion provides redundancy against single-needle failure modes (partial detachment, hair fouling, manufacturing variability, transient ammonia exposure in a parlour environment) and ensures that data yield of greater than or equal to approximately 98.5 per cent valid frames per cluster is preserved across the wear cycle.

#### 5.1.4 Power source and current-draw envelope

[0027] The wearable biosensor is powered by a CR2477H lithium-manganese-dioxide coin-cell battery 112 with nominal capacity approximately 1,000 milliampere-hours at 3.0 volts. The Pod's average current draw is configured to be in the sub-1 milliampere range under primary operating conditions (default 60-second sampling cadence with Bluetooth Low Energy advertisement at 2,000 millisecond intervals). A peak-envelope or fallback design budget of less than 5 milliamperes accommodates burst-mode sampling, intermittent LoRa transmissions during pasture deployment, and low-temperature operation.

[0028] The CR2477H operating temperature envelope is approximately 4 degrees Celsius to approximately 40 degrees Celsius, corresponding to typical parlour and field deployment conditions. The Pod firmware implements a temperature-adaptive sampling cadence that lengthens the interval between samples under low-temperature conditions to compensate for the cell's reduced effective capacity in that regime. This temperature-derate envelope is recited as a defensive disclosure to support the power-budget claim against the line of attack that an alleged infringer's product does not draw less than 5 milliamperes when measured at 4 degrees Celsius rather than at room temperature.

[0029] In particular embodiments, the wear-cycle target — defined as the duration over which the Head remains attached to the animal under outdoor production conditions while preserving a detachment rate of less than approximately 3 per cent — is approximately fourteen days, with a fallback design target of greater than or equal to ten days. The Pod's battery life under typical 80 per cent duty cycle and 1-minute cadence is greater than or equal to approximately 108 days; under worst-case continuous 1-minute cadence at 25 degrees Celsius, runtime is greater than or equal to approximately 54 days.

#### 5.1.5 Wireless transceivers

[0030] The Pod incorporates two complementary wireless transceivers 106, 108. The Bluetooth Low Energy 5.x coded-PHY transceiver 106 is the primary communications channel, operating at the 2.4 gigahertz industrial-scientific-medical band with coded-PHY symbol rate S = 8 to extend line-of-sight range to greater than or equal to approximately 100 metres in unobstructed conditions and to greater than or equal to approximately 60 metres in pasture-obstruction conditions. The Semtech SX1262 sub-gigahertz LoRa modem 108 operates at 868 megahertz in European deployments and at 915 megahertz in North American deployments, providing fallback connectivity at greater than or equal to approximately 800 metres of pasture range with a best-case range exceeding approximately 1.5 kilometres, subject to the applicable regional duty-cycle regulations.

[0031] The wearable biosensor automatically transitions from Bluetooth Low Energy to LoRa fallback in accordance with a hysteretic decision rule: the transition to LoRa occurs only after N consecutive Bluetooth link-layer failures within a sliding window W, where N is greater than or equal to three and W is less than or equal to sixty seconds; reversion to Bluetooth occurs only after K successive successful Bluetooth beacons, where K is greater than or equal to five. The asymmetric N/K hysteresis is configured to prevent radio-thrash on the order of the LoRa-band duty-cycle limit.

#### 5.1.6 Cough-detection feature (preliminary, validation in progress)

[0032] In particular embodiments the Pod incorporates a 3-axis accelerometer (Bosch BMA280 or equivalent) configured to perform fast-Fourier-transform analysis on motion data in the 100 hertz to 500 hertz frequency band, the resulting spectral signature being matched against templates indicative of respiratory cough events. The cough-detection feature is contemplated as an adjunct to the primary interstitial-fluid biomarker channels.

> *Note on cough-detection performance figure.* A cough-detection specificity of approximately 92 per cent has appeared in earlier internal documentation of the present invention. That figure is described in this specification as a preliminary internal estimate; the validation of cough-detection performance is in progress; and the figure is not asserted as a product performance claim. The reader is referred to the inventors' Cardinal-Labs Output 1 §2.6 retraction commentary (internal, on file with the applicant).

#### 5.1.7 Pod-Head-Applicator three-component cryptographic kit binding

[0033] At onboarding, the three components of the kit are cryptographically bound by way of identifier fusion. The Pod carries a laser-etched immutable serial designated `pod_uid` together with a printed quick-response (QR) code; the disposable Head's blister carries a Near Field Communication (NFC) inlay (ISO/IEC 14443A, NTAG213/215/216 or equivalent) and a printed QR code, encoding `head_uid`, GTIN, lot, and expiry; the Applicator carries a GS1 DataMatrix lot code designated `applicator_lot`. At onboarding, the companion application reads each of `pod_uid`, `head_uid` and `applicator_lot`, validates the Head's expiry, and fuses the three identifiers into a tuple (`pod_uid`, `head_uid`, `applicator_lot`, `pig_uuid`) which is recorded in the audit log of section 5.4.

[0034] Each disposable Head encodes four deterministic per-needle identifiers `needle_uid` (designated N1 to N4) derived from the `head_uid` by Hash-based Key Derivation Function applied with HMAC-SHA-256 as the underlying primitive, with `salt = head_uid` and `info = needle_slot`. Per-needle drift, exclusion, and detachment events are then traceable to immutable cryptographic identifiers tied to the head session. The HKDF derivation ensures that an alleged infringer cannot spoof or transfer a single-needle record without invalidating the head_uid signature, and forecloses a "they hash the per-needle identifiers differently" design-around.

#### 5.1.8 Multi-path scan redundancy

[0035] The companion application implements multi-path scan redundancy at onboarding. The primary scan path is NFC; the secondary path is QR; the tertiary path is manual entry of the human-readable serial together with a confirmation photograph captured by the application. Aggregate scan success across the multi-path fallback is greater than or equal to approximately 95 per cent under outdoor production conditions, including conditions of NFC-tag fouling or QR-code occlusion.

#### 5.1.9 Active dual-action ear-prep wipe and PEG-silane coating

[0036] The Applicator blister includes a sterile dual-action wipe combining 70 per cent isopropyl alcohol for surface sterilisation and a mild keratolytic or abrasive treatment (urea-based, validated for less than 1 per cent dermal response per ISO 10993-10) for thinning hair shafts and clearing cuticular debris at the insertion site. A standardised wipe protocol of approximately ten seconds, applied immediately prior to applicator insertion, achieves greater than or equal to approximately 99 per cent microneedle penetration success across high-hair-density and muddy outdoor conditions when combined with a polyethylene-glycol-silane coating on the Head adhesive frame.

#### 5.1.10 Bovine and porcine variant compatibility

[0037] The disposable Head is supplied in two principal species-specific variants. The porcine variant uses the analyte allocation of paragraph [0023] and an individual needle length of approximately 0.7 to 1.0 millimetres. The bovine variant addresses the thicker bovine ear dermis with an individual needle length of approximately 1.0 to 1.3 millimetres and the bovine-specific analyte allocation of paragraph [0023] (lactate, pH, IFN-γ, SAA, haptoglobin, procalcitonin, NAG). The Pod, the secure enclave, the radios, the battery, and all firmware running on the system-on-chip are common across species variants.

### 5.2 On-farm edge gateway (edge tier)

[0038] With reference to Fig. 1 and Fig. 2, the on-farm edge gateway 200 is the inference and aggregation tier of the system. The gateway is communicatively coupled to one or more wearable biosensors 100 over Bluetooth Low Energy, optionally augmented by a LoRa concentrator 218 collecting from pasture-deployed biosensors as shown in Fig. 2. The gateway communicates upstream to the cloud-tier aggregation system 300 over a transport-layer-security-protected Internet connection.

#### 5.2.1 Edge-gateway hardware Markush

[0039] The edge gateway is implemented in two principal alternative hardware configurations, recited herein as a Markush-style group of equivalents for the avoidance of ambiguity:

- **Primary tier.** An NVIDIA Jetson Orin Nano 8 GB module providing approximately 40 trillion operations per second at INT8 precision, an 8-core ARM Cortex-A78AE central processing unit, and 8 gigabytes of unified memory. This configuration is optimised for high-density commercial farms.
- **Value tier.** A Raspberry Pi 5 single-board computer paired with a Google Coral USB-attached tensor processing unit providing approximately 4 trillion operations per second at INT8 precision. This configuration is optimised for cost-sensitive smaller-scale deployments and is provided as a co-equal architectural alternative within claim 1(b).

[0040] In either configuration, the gateway includes a non-volatile storage medium of at least 128 gigabytes (NVMe solid-state drive in primary-tier embodiments) and a TPM 2.0-class discrete secure element or an ARM TrustZone-backed secure-enclave region forming a hardware root-of-trust for cryptographic operations.

#### 5.2.2 Multi-biomarker pathway classifier

[0041] The gateway hosts a multi-biomarker pathway classifier comprising one or more of: a gradient-boosted-tree ensemble; a multi-layer perceptron of four or fewer hidden layers; a generalised-linear model with random effects; or a fusion of any two or more of the foregoing. The classifier is trained per pathway on six to ten biomarker channels, including without limitation lactate, pH, glucose, interferon-gamma, serum amyloid A, haptoglobin, procalcitonin, and N-acetyl-β-D-glucosaminidase. Per-pathway calibration sets are maintained on a per-region basis.

[0042] In particular embodiments, the classifier is INT8-quantised with a working-set memory footprint less than or equal to approximately 512 megabytes when running on the primary-tier hardware, the model weights being loaded once at gateway boot and pinned in memory to eliminate cold-start latency on subsequent inferences. Single-reading inference completes within less than approximately 100 milliseconds wall-clock at the 99th-percentile on the primary-tier hardware, and within less than approximately 300 milliseconds wall-clock at the 99th-percentile on the value-tier hardware.

#### 5.2.3 Large-language-model explanation layer

[0043] Architecturally distinct from the multi-biomarker pathway classifier, the gateway further hosts a large-language-model (LLM) explanation layer. The classifier produces the candidate diagnostic hypothesis and confidence score; the LLM independently produces a natural-language explanation of that hypothesis, citing source chunks drawn from an indexed peer-reviewed veterinary knowledge base. Each clinical assertion in the LLM-generated explanation is required to be traceable to a retrieval-augmented citation pointer; an explanation lacking a passing citation-coverage check is suppressed and replaced by a structured fallback comprising the bare classifier hypothesis without LLM commentary. The deliberate separation of the classifier and the explanation layer ensures that the diagnostic decision is grounded in the calibrated classifier output rather than in the LLM's natural-language generation, while preserving the user-experience benefit of a citation-grounded clinical narrative.

#### 5.2.4 Hybrid-inference policy state machine

[0044] With reference to Fig. 4, the gateway executes a hybrid-inference policy state machine implementing a three-band confidence-banded escalation policy. Each reading produced by the multi-biomarker pathway classifier carries an associated confidence score `c`. The state machine entry node 220 routes the reading to one of three primary band states 222, 224, 228 according to the value of `c` relative to a first threshold (approximately 0.85) and a second, lower threshold (approximately 0.60):

- **High-confidence band — c ≥ 0.85:** routing decision is to return the candidate hypothesis as a local-tier verdict immediately, in less than approximately 100 milliseconds wall-clock; no cloud round-trip is invoked. State 222 transitions directly to user-facing output node 230.
- **Medium-confidence band — 0.60 ≤ c < 0.85:** the gateway returns the candidate hypothesis as a local-tier verdict immediately and, in parallel, queues a cloud-tier classifier invocation on the same reading. If the cloud-tier verdict is received within a defined latency bound of approximately 30 seconds and differs from the local-tier verdict, the cloud-tier verdict is surfaced to the user as an updated diagnostic recommendation. If the verdicts agree, no further user-facing surfacing occurs and the cloud verdict is silently logged. State 224 transitions both to output node 230 (immediate local verdict) and to sub-state 226 (cloud arbiter).
- **Low-confidence band — c < 0.60:** the gateway awaits the cloud-tier verdict before returning any user-facing output. State 228 transitions to output node 230 only on receipt of the cloud verdict.

[0045] **Graceful-degradation state.** When the cloud tier is unreachable for longer than a defined timeout (in particular embodiments approximately 60 seconds), the state machine transitions into the graceful-degradation state 229. In this state, the routing rule for the low-confidence band degrades deterministically to: (i) returning a conservative "deferred-verdict" output flagged as such; (ii) retaining the reading in the offline-first ring buffer for later replay; and (iii) emitting a clinician-facing escalation event. The deferred-verdict event is itself entered into the audit log of section 5.4. The high-confidence and medium-confidence bands continue to operate without degradation.

[0046] **Deferred-follow-up sub-band.** In particular embodiments, when the confidence score `c` falls within a defined sub-band of the medium-confidence band (in some embodiments 0.60 ≤ c < 0.70), the routing decision optionally comprises scheduling a subsequent biomarker reading at the wearable biosensor at a defined interval rather than invoking the cloud-tier classifier. The routing decision is then revisited on receipt of the subsequent reading. This "deferred-follow-up" behaviour is orthogonal to the three-band escalation and constitutes a fourth band-behaviour that further reduces cloud bandwidth and sensor-tier power consumption when temporal trend-confirmation is preferable to immediate cloud arbitration.

#### 5.2.5 Offline-first sync engine and ring buffer

[0047] The edge gateway includes an offline-first sync engine configured to operate continuously regardless of cloud-tier availability. During edge-to-cloud connectivity loss, every candidate-hypothesis output, every confidence score, every routing decision, and every signed audit-log entry is queued into an append-only ring buffer of capacity sufficient to retain at least approximately thirty days of records at the maximum biomarker sampling rate (primary design target, on a 128 gigabyte NVMe medium), with a fallback minimum-acceptable design target of greater than or equal to approximately seven days. The buffer is durably persisted to non-volatile storage on every write.

[0048] On connectivity restoration the buffer is drained in time-order with idempotent batch-sync semantics. The ingest-key for each entry is the tuple (`pig_uuid_hash`, `session_id`, `seq`), where `seq` is a 64-bit monotonic sequence counter (rollover-safe across periods exceeding 500 years at 1 hertz). Duplicate entries presenting an identical ingest-key are auto-discarded at the cloud-tier ingress, ensuring that a network partition of arbitrary duration produces no data loss and no double-counting on the upstream side.

#### 5.2.6 Hardware-attestation stack

[0049] The gateway implements a hardware-rooted attestation stack. The signing key for all audit-log entries is provisioned inside the secure element and is non-exportable. Gateway boot is gated by measured-boot attestation against a known-good Platform Configuration Register (PCR) set; firmware-level state changes update the PCR set, providing tamper-evidence on the inference runtime. Periodic signed attestation packets, generated inside the secure element, assert the gateway's geographic-premises identifier, a cryptographic digest of the egress-firewall ruleset enforcing the no-raw-biomarker-egress predicate of section 5.3, and a measured-boot quote of the inference runtime. Attestation packets are emitted at a cadence less than or equal to approximately 60 seconds and verifiable by a regulated counterparty without disclosure of any raw biomarker reading.

#### 5.2.7 Over-the-air staged rollout with rollback

[0050] Firmware and classifier-model updates to the gateway are delivered as ECDSA-signed image bundles via an over-the-air mechanism implementing staged rollout with deterministic rollback. Each rollout proceeds in cohorts; each cohort verifies signature integrity prior to image installation; rollback is triggered automatically on health-check failure post-installation. Production rollout success rate is greater than or equal to approximately 98 per cent and rollback rate is less than approximately 1 per cent. Rollout audit-log entries are themselves anchored into the chain-of-custody verification rail.

#### 5.2.8 Agent-native API surface

[0051] The gateway exposes an agent-native application-programming-interface surface comprising: (i) a Model Context Protocol (MCP) server endpoint; (ii) a Server-Sent Events (SSE) stream of diagnostic events; and (iii) a batch-inference endpoint configured to receive a plurality of animal identifiers in a single request and return a respective plurality of candidate-hypothesis outputs. The interface authenticates callers via mutual-TLS bound to the secure element of section 5.2.6, such that an authentication credential cannot be cloned outside the hardware-attested gateway, and rate-limits per-caller. The agent-native surface eliminates human-paginated, human-rate-limited tool-latency that otherwise dominates end-to-end response time when the consumer of the diagnostic output is a software agent rather than a human user, producing a measurable machine-to-machine throughput effect.

[0052] In particular embodiments, the gateway further provides a single-call multimodal diagnostic endpoint configured to receive, in one request, a sequence of biomarker readings, image data captured by an associated camera or by a stockperson's mobile device, and free-text contextual data, and to return a single candidate-hypothesis output with associated confidence score. The endpoint eliminates the serialised round-trip latency that arises when biomarker, image, and free-text contributions are processed by separate inference services.

[0053] In particular embodiments, the gateway maintains a persistent execution environment in which model weights and a shared key-value cache are resident in memory between successive inference calls for a given animal identifier. Inference latency for a subsequent reading from the same animal is thereby reduced relative to a cold-start inference, the magnitude of the reduction being determined by the hit rate on the per-animal key-value cache.

#### 5.2.9 Fleet clustering across gateways

[0054] In particular embodiments two or more edge gateways within a single farm site are arranged as a fleet sharing a common on-premises identity-provider service and a shared model-weight cache. A model-weight update applied to one gateway in the fleet is propagated to the remaining gateways without egress to the cloud tier, ensuring that the updated model-weight payload remains within the farm boundary even where the update originates as a federated cohort feedback signal from the cloud tier.

### 5.3 Cloud-tier aggregation system (cloud tier)

[0055] With reference to Fig. 6, the cloud-tier aggregation system 300 receives, from a plurality of edge gateways 200a–200h across a plurality of farm sites, anonymised statistic submission packets 502. The aggregation system comprises a federated aggregation engine 310 and a cohort-statistics datastore 320.

#### 5.3.1 K-anonymous suppression and differential-privacy envelope

[0056] Inbound submission packets pass through a k-anonymous suppression filter 504 with a threshold of at least five distinct contributing farms per cohort statistic before the statistic is admitted to aggregation. Statistics that fail the k-anonymity check are suppressed at ingress. Admitted statistics are processed under a differential-privacy noise envelope 506 with privacy parameter epsilon less than or equal to four per round and per-sample gradient-norm clip C equal to 1.0 in the federated-learning embodiments. The noise envelope is selected to provide formal differential-privacy guarantees on per-farm contributions while preserving the regional cohort signal-to-noise ratio required for utility.

#### 5.3.2 Structural data-sovereignty (no raw-biomarker egress)

[0057] Raw biomarker readings are not transmitted from the edge tier to the cloud tier under any operational mode. Cloud-bound traffic from a gateway comprises exclusively: (i) anonymised aggregate cohort statistics; (ii) classifier-model gradient deltas under the federated-learning embodiment of paragraph [0058]; (iii) signed attestation packets from the gateway secure element; (iv) signed Merkle-root commitments anchoring the audit log. The egress firewall ruleset on each gateway enforces this predicate; the digest of the ruleset is itself attested to as described at paragraph [0049]. The data-sovereignty property is therefore a structural property of the information-flow topology of the system, not a policy overlay subject to override; an alleged infringer who claims sovereignty-by-policy without the structural egress prohibition does not practise the present invention.

#### 5.3.3 Federated continuous learning

[0058] The cohort feedback path from the cloud tier into the edge gateway implements per-region continuous learning. Each gateway computes only model-gradient deltas on locally-held biomarker windows, applies differentially-private noise with epsilon less than or equal to 4 per round and per-sample gradient-norm clip C of 1.0, and transmits to the cloud-tier aggregator only the noised, clipped delta together with a zero-knowledge commitment to the non-egress predicate of paragraph [0049]. No raw biomarker reading or unprocessed gradient leaves the gateway. The aggregator combines the contributions across at least k = 5 distinct farms before updating the per-region calibration set.

#### 5.3.4 Agent-native API surface (cloud tier)

[0059] The cloud-tier aggregation system exposes its own agent-native interface comprising a Model Context Protocol server endpoint, a Server-Sent Events stream, and a single-call multimodal diagnostic endpoint. The cloud-tier endpoints implement persistent-container execution with shared key-value caching across calls within a session, providing an analogous latency reduction at the cloud tier to that described for the edge tier at paragraph [0053].

#### 5.3.5 Messenger-channel transport tier

[0060] The cloud tier provides a messenger-channel transport layer configured to deliver the diagnostic decision-support output to a registered user device via at least one of: a WhatsApp Business Application-Programming-Interface channel, a Short Message Service (SMS) channel, and a Rich Communication Services (RCS) channel. The messenger-channel transport is integrated into the cyber-physical pipeline as a transport-tier integration; the message content is the same diagnostic decision-support output whose technical pedigree is established by the chain-of-custody verification rail. Messenger delivery integrates a constrained-grammar tool-invocation layer that maps a stockperson's natural-language request, received over an end-to-end-encrypted messaging transport, to one or more of the agent-native API endpoints described above. A round-trip identifier for each conversational interaction is written into the audit log such that every diagnostic recommendation surfaced via the conversational tier is replayable.

### 5.4 Chain-of-custody verification rail

[0061] With reference to Fig. 5, the chain-of-custody verification rail 400 spans the sensor tier, the edge tier, and the cloud tier. The rail provides a cryptographically anchored audit trail of every biomarker reading and every diagnostic decision-support output. The rail is implemented at the gateway tier as an append-only audit log conforming to the ALCOA+ principles (attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available).

#### 5.4.1 Per-measurement digesting and Merkle bundling

[0062] Every biomarker reading produced by the wearable biosensor 100 is processed by the gateway 200 to compute a per-measurement SHA-256 digest 402. SHA-256 digests are accumulated by the gateway over a defined interval T and combined into Merkle-tree leaves 404; the Merkle-tree root 406 of the resulting bundle is computed; the root is signed by the gateway secure element using ECDSA-P256, producing signature 408. The bundle interval T is configured so that the on-chain anchoring transaction count per gateway per day is bounded above by approximately 96; T is adaptively lengthened when the upstream link round-trip time exceeds a threshold, providing back-pressure on the chain-anchoring tier under adverse network conditions.

#### 5.4.2 Multi-chain Markush anchoring

[0063] The signed Merkle-root commitment is anchored to a public distributed ledger 410, the ledger being selected from the group consisting of: Solana, Hedera, IOTA, and XDC. The Markush-style enumeration of ledger options is recited to foreclose the design-around in which an alleged infringer asserts that its choice of ledger differentiates its product from the present invention; the inventive contribution is the cryptographic anchoring of the Merkle-root commitment to a public ledger, not the choice of any particular ledger.

#### 5.4.3 HKDF-derived per-event identifier

[0064] Each anchoring event is associated with an HKDF-derived per-event identifier 412 generated by the wearable biosensor's secure enclave from the head session key. The identifier provides a deterministic primary key for the event in the audit log and the public ledger anchoring transaction, enabling forward and reverse lookups without disclosure of the underlying biomarker reading.

#### 5.4.4 Idempotent ingest key

[0065] Gateway-to-cloud audit-rail ingest is idempotent under the ingest-key tuple (`pig_uuid_hash`, `session_id`, `seq`), with `seq` as a 64-bit monotonic sequence counter. Duplicate frames presenting an identical ingest-key are auto-discarded at the gateway and at the cloud-tier ingress. The same idempotency primitive serves the offline-first sync engine described at paragraph [0048] and the audit-rail anchoring described at paragraph [0062]; the symmetry permits an audit-rail entry to be re-anchored without risk of double-counting in either tier.

#### 5.4.5 Cross-reference to GB2514773.7

[0066] The chain-of-custody verification rail of the present invention is configured to interoperate with the verified-provenance system disclosed in the present applicant's prior filing GB2514773.7. The signed Merkle-root commitments produced by the gateway tier of the present invention may be received by the system of GB2514773.7 as an upstream evidence source; the integration produces a unified evidence chain spanning continuous biomarker monitoring (the present invention) and provenance-level chain-of-custody (GB2514773.7).

### 5.5 Hybrid-inference method

[0067] With reference to Fig. 4, the hybrid-inference method comprises the steps of:

(a) receiving, at the on-farm edge gateway 200, a sequence of interstitial-fluid biomarker readings from one or more wearable biosensors 100;

(b) executing, at the edge gateway 200, the multi-biomarker pathway classifier of section 5.2.2 on the received readings to produce a candidate-hypothesis output and an associated confidence score `c`;

(c) determining, based on the confidence score `c`, a routing decision according to the three-band confidence-banded escalation policy of section 5.2.4, the policy comprising a high-confidence band, a medium-confidence band, and a low-confidence band, the band boundaries being the first threshold of approximately 0.85 and the second threshold of approximately 0.60;

(d) within the high-confidence band, returning the candidate-hypothesis output as a local-tier verdict in less than approximately 100 milliseconds wall-clock without invoking the cloud-tier classifier;

(e) within the medium-confidence band, returning the candidate-hypothesis output as a local-tier verdict and concurrently invoking the cloud-tier classifier on the same reading, surfacing the cloud-tier verdict to the user within a defined latency bound (in particular embodiments approximately 30 seconds) only if the cloud-tier verdict differs from the local-tier verdict;

(f) within the low-confidence band, awaiting the cloud-tier classifier verdict before returning any user-facing output;

(g) on cloud-tier unreachability for longer than a defined timeout, transitioning to the graceful-degradation state 229 of paragraph [0045];

(h) optionally, within the deferred-follow-up sub-band of paragraph [0046], scheduling a subsequent biomarker reading at the wearable biosensor at a defined interval and revisiting the routing decision on receipt of the subsequent reading;

(i) writing, to the append-only cryptographically anchored audit log of section 5.4, the candidate-hypothesis output, the confidence score, the routing decision, any cloud-tier verdict, and the corresponding HKDF-derived per-event identifier and Merkle-tree anchoring metadata.

[0068] The Merkle-tree anchoring of step (i) is performed at the cadence described at paragraph [0062], with the anchoring transaction count per gateway per day bounded above by approximately 96. The audit-log entries are signed inside the gateway secure element such that the signing key is non-exportable.

### 5.6 Federated network topology

[0069] With reference to Fig. 6, the federated network topology comprises a plurality of edge gateways 200a–200h at a respective plurality of farm sites, each gateway communicatively coupled to the cloud-tier aggregation system 300. The federated network operates the k-anonymous suppression of paragraph [0056] and the differential-privacy envelope of paragraph [0058]. The output of the federated network is a regional cohort statistic 508 reflecting the aggregate signal across the farm cohort; the regional cohort statistic feeds back into the per-region calibration sets at each edge gateway and is also available to a regulator-facing aggregate-evidence channel 510 anchored back into the chain-of-custody verification rail.

[0070] In particular embodiments, the federated network's cohort signals support an early-warning architecture for emerging health threats — for example, cohort-level shifts in lactate distribution indicative of an emerging infection cluster, or cohort-level inflammatory-marker shifts indicative of a regional disease emergence — such early-warning signals being surfaced at the regional or national level to public-health and animal-health regulators without raw-biomarker disclosure.

### 5.7 Animal-ID linkage and herd-management integration

[0071] Each biomarker reading is tagged with an animal identifier derived from the animal's permanent ISO 11784/11785 RFID ear-tag unique identifier. The biomarker reading is therefore tied to the farm's herd-management database, the veterinary practice management system, and the electronic-health-record system used by the farm. The gateway exposes an integration application-programming-interface (in particular embodiments, conforming to the documented schema described at section 5.2.8) for veterinary EHR/PMS integration. The integration interface exposes the candidate-hypothesis output, the audit-log entry of paragraph [0067(i)], and the attestation of paragraph [0049].

[0072] The multi-biomarker pathway classifier of section 5.2.2 is configurable on a per-species basis without architectural change. Particular species variants explicitly contemplated comprise: porcine, bovine, ovine, and equine. Per-species variants share the same Pod, secure enclave, radio architecture, battery, and edge-gateway architecture; the species-specific configuration is restricted to (i) the disposable Head's microneedle length and analyte allocation per paragraphs [0023] and [0037] and (ii) the per-pathway classifier calibration set at the gateway tier.

[0073] In particular embodiments the pathway-classifier outputs are further linked into a phenotype-genotype prediction system; this forward-reference is made for completeness. The phenotype-genotype linkage subsystem is the subject of a separate, follow-on application by the present applicant and is not claimed in the present application.

### 5.8 AMR-stewardship signal

[0074] In particular embodiments, the system surfaces a real-time antimicrobial-stewardship recommendation when the multi-biomarker pathway classifier produces a candidate hypothesis whose biomarker pattern crosses a defined antimicrobial-stewardship-policy threshold. The recommendation cites the applicable stewardship guidance — in the United Kingdom, the Veterinary Antimicrobial Resistance and Sales Surveillance (UK-VARSS) report and the Responsible Use of Medicines in Agriculture (RUMA) guidelines; equivalent regimes apply in other jurisdictions. The recommendation is transmitted as part of the candidate-hypothesis output and is itself anchored in the chain-of-custody verification rail.

### 5.9 Worked example: porcine intensive deployment

[0075] In a non-limiting worked example, a herd of 1,200 finishing pigs at a single intensive site is fitted with the wearable biosensor 100 in the porcine variant. The on-farm edge gateway 200 is implemented as the primary-tier Jetson Orin Nano configuration of paragraph [0039]. Each animal's biosensor produces biomarker readings at the default 60-second cadence, escalating to burst mode (approximately 10 seconds for approximately 30 minutes) on threshold-trigger events such as activity spikes or accelerometer-derived cough events.

[0076] In an illustrative day's operation, the gateway processes approximately 1,728,000 biomarker readings (1,200 animals × 1,440 readings per day at 1-minute cadence). Of those readings, the multi-biomarker pathway classifier returns approximately 90 per cent in the high-confidence band (returned at the edge in less than 100 milliseconds, no cloud round-trip); approximately 8 per cent in the medium-confidence band (returned at the edge with cloud arbitration in the background); and approximately 2 per cent in the low-confidence band (cloud verdict awaited). Aggregate edge-to-cloud bandwidth, comprising only anonymised cohort statistics, signed attestations, and Merkle-root commitments, is approximately 1.2 megabytes per day per gateway, compared with an approximately 24-megabyte-per-day baseline if every reading were transmitted to the cloud.

[0077] During the worked example day, the offline-first sync engine handles a 4-hour rural-broadband outage by retaining all 4 × 60 × 1,200 ≈ 288,000 readings in the ring buffer, draining them in time-order on connectivity restoration without data loss. A single yellow-state event on one animal (one needle reporting drift greater than 10 per cent) triggers a head-replacement recommendation; the replacement is performed by the stockperson approximately 18 hours later; the per-needle EIS continuity record across the head transition is preserved in the longitudinal animal record. A single AMR-stewardship recommendation is surfaced for an animal whose lactate-elevation pattern crosses the defined threshold; the recommendation is anchored in the audit log and is presented to the attending veterinarian via the EHR/PMS integration of paragraph [0071].

### 5.10 Worked example: bovine intensive deployment

[0078] In a second non-limiting worked example, a dairy parlour of 220 milking cows is fitted with the wearable biosensor 100 in the bovine variant. The bovine variant uses the bovine-specific analyte allocation of paragraph [0023] and the bovine-specific microneedle length of paragraph [0037]. The biomarker channels are: lactate and pH on needle one (acidosis and infection); interferon-gamma on needle two (tuberculosis triage adjunct); serum amyloid A and haptoglobin on needle three (acute-phase inflammation, including mastitis); procalcitonin or N-acetyl-β-D-glucosaminidase on needle four (mastitis bacterial proxy).

[0079] The gateway 200 is implemented as the value-tier Pi 5 + Coral configuration of paragraph [0039]. The federated network of section 5.6 is operated across the present site and four further bovine sites, satisfying the k = 5 anonymity threshold for cohort statistics. Cohort feedback from the federated network surfaces an emergent shift in the regional serum-amyloid-A distribution, prompting an updated per-region calibration set, which is propagated to the gateway via the OTA staged-rollout mechanism of paragraph [0050].

[0080] The bovine variant's analyte panel is supported by ongoing bovine-interstitial-fluid correlation studies; the present specification recites the bovine variant as one supported embodiment of the invention without limitation to the precise analyte panel as the body of correlation evidence develops.

### 5.11 Industrial applicability

[0081] The invention is applicable across the United Kingdom commercial livestock production sector, comprising approximately 9.2 million cattle, 32 million sheep, 5 million pigs, and the associated equine and small-ruminant populations. The invention is further applicable across the European Union, North American, Latin American, and Australasian livestock production sectors, with the species-variant configuration of section 5.7 supporting the principal commercial species in each region. The invention's antimicrobial-stewardship signal of section 5.8 directly aligns with the United Kingdom's UK-VARSS framework, the European Union's Veterinary Medicinal Products Regulation 2019/6, and analogous regimes elsewhere; the invention thereby provides a technical contribution to the policy objective of reducing antimicrobial use in food-producing animals.

### 5.12 Validation pathway

[0082] In particular embodiments, the wearable biosensor 100 and its associated insertion procedure are validated under an institutional animal-ethics-review-body (AWERB)-approved protocol for the species variant in question. The validation protocol comprises bench-phase verification of the analytical performance characteristics of each biomarker channel; tissue-phantom verification of insertion mechanics; and pilot-farm validation of the wear-cycle, detachment rate, and data-yield targets recited in the present specification. The validation pathway is recited herein as ambient context for the invention's intended deployment within applicable regulatory and animal-welfare frameworks; no claim of clinical evidence beyond the validation results extant at the priority date is made or intended.

---

## § 6. CLAIMS

**1.** A system for veterinary clinical decision support comprising:

(a) a wearable biosensor configured to capture continuous interstitial-fluid biomarker readings from a livestock animal, the biosensor comprising at least one microcontroller, a wireless transceiver, a power source, and a microneedle interstitial-fluid sampling array;

(b) an on-farm edge gateway communicatively coupled to one or more wearable biosensors, the edge gateway comprising AI-class compute hardware running a multi-biomarker pathway classifier and a hybrid-inference policy as defined in claim 3;

(c) a cloud-tier aggregation system communicatively coupled to a plurality of edge gateways across a plurality of farms, the cloud-tier aggregation system providing federated cross-farm intelligence without raw-biomarker egress from any individual farm; and

(d) a chain-of-custody verification rail spanning the sensor tier, the edge tier, and the cloud tier, providing a cryptographically anchored audit trail of every biomarker reading and every diagnostic decision-support output.

**2.** A computer-implemented method for veterinary clinical decision support comprising:

(a) receiving, at an on-farm edge gateway, a sequence of interstitial-fluid biomarker readings from one or more wearable biosensors;

(b) executing, at the edge gateway, a multi-biomarker pathway classifier on the received readings to produce a candidate-hypothesis output and an associated confidence score;

(c) determining, based on the confidence score, a routing decision according to a three-band confidence-banded escalation policy:

- if the confidence score is at or above a first threshold, returning the candidate-hypothesis output as a local-tier verdict;
- if the confidence score is between the first threshold and a second, lower threshold, returning the candidate-hypothesis output as a local-tier verdict and concurrently invoking a cloud-tier classifier on the same readings, surfacing any cloud-tier verdict that differs from the local verdict to the user within a defined latency bound;
- if the confidence score is below the second threshold, awaiting a cloud-tier classifier verdict before returning a user-facing output;

(d) writing, to an append-only cryptographically anchored audit log, the candidate-hypothesis output, the confidence score, the routing decision, and any cloud-tier verdict.

**3.** The method of claim 2, wherein the first threshold is approximately 0.85 and the second threshold is approximately 0.60.

**4.** The method of claim 2, wherein the multi-biomarker pathway classifier is configured to process at least one biomarker selected from the group consisting of: lactate, pH, glucose, interferon-gamma, serum amyloid A, haptoglobin, procalcitonin, and N-acetyl-β-D-glucosaminidase.

**5.** The system of claim 1, wherein the cloud-tier aggregation system aggregates pathway statistics across a plurality of farms with k-anonymous suppression at a minimum threshold of k = 5 distinct farms, and wherein no raw biomarker reading from any individual farm is transmitted from the edge tier to the cloud tier.

**6.** The system of claim 1, wherein the wireless transceiver of the wearable biosensor comprises both a Bluetooth Low Energy modem operating at coded-PHY layer one and a sub-gigahertz Long-Range modem, and wherein the wearable biosensor automatically falls back from the Bluetooth Low Energy modem to the sub-gigahertz Long-Range modem when no edge gateway is reachable via Bluetooth Low Energy.

**7.** The system of claim 1, characterised in that the chain-of-custody verification rail comprises an ALCOA+ append-only audit log at the edge gateway, SHA-256 hashing per measurement, Merkle-tree bundling of measurement digests for periodic anchoring, ECDSA-P256 signing of Merkle-tree roots within a hardware secure element of the edge gateway, and anchoring of the signed Merkle-tree roots to a public distributed ledger selected from the group consisting of: Solana, Hedera, IOTA, and XDC.

**8.** The system of claim 1, wherein the multi-biomarker pathway classifier is associated with one or more per-pathway calibration sets, each calibration set being trained on a per-region cohort.

**9.** The system of claim 1, further comprising a large-language-model explanation layer hosted on the edge gateway, wherein the explanation layer is constrained to emit only natural-language explanations whose every clinical assertion is traceable to a retrieval-augmented citation pointer into an indexed peer-reviewed knowledge base, and wherein an explanation lacking a passing citation-coverage check is suppressed and replaced by a structured fallback.

**10.** The system of claim 1, wherein raw biomarker readings do not leave the farm by default; only anonymised aggregate cohort statistics and farmer-authorised regulator-anchored events are transmitted from the edge tier to the cloud tier.

**11.** The system of claim 1, wherein the wearable biosensor is configured to operate at a sub-1 milliampere average current draw on the power source under primary operating conditions and within a fallback or peak-envelope budget of less than 5 milliamperes, the wear-cycle target being approximately fourteen days of continuous wear on a CR2477H coin-cell battery.

**12.** The system of claim 1, wherein the microneedle interstitial-fluid sampling array comprises a quad-array hydrogel-microneedle cluster having a cluster footprint of approximately 1.5 millimetres to approximately 2.0 millimetres in greatest cross-sectional dimension, an inter-needle pitch of approximately 0.5 millimetres to approximately 0.8 millimetres centre-to-centre between adjacent needles, and an individual needle length of approximately 0.7 millimetres to approximately 1.3 millimetres, the wearable biosensor being configured to maintain a detachment rate of less than approximately 3 per cent over a fourteen-day wear cycle.

**13.** The system of claim 1, wherein each biomarker reading is tagged with an animal identifier derived from an ISO 11784/11785 RFID ear-tag unique identifier of the livestock animal, the animal identifier tying the reading to a herd-management database of a farm.

**14.** The system of claim 1, characterised in that, when the multi-biomarker pathway classifier produces a candidate hypothesis whose biomarker pattern crosses an antimicrobial-stewardship-policy threshold, the system surfaces a clinical-decision-support recommendation referencing the applicable antimicrobial-stewardship guidance.

**15.** The system of claim 1, wherein the multi-biomarker pathway classifier is configurable per livestock species without architectural change, the species being selected from the group consisting of: porcine, bovine, ovine, and equine.

**16.** The system of claim 1, wherein cohort statistics from the cloud-tier federated aggregation feed back into per-region classifier calibration sets at the edge tier without raw-biomarker egress from any individual farm.

**17.** The system of claim 1, further comprising an integration application-programming-interface configured to expose the candidate-hypothesis output to a veterinary electronic-health-record system or a veterinary practice-management system.

**18.** The system of claim 1, wherein the multi-biomarker pathway classifier outputs are configured to feed into a downstream phenotype-genotype linkage subsystem.

**19.** The system of claim 1, further comprising an agent-callable interface exposing the candidate-hypothesis output, the audit-log entry of claim 2(d), and a hardware-attested egress-firewall ruleset digest, the interface comprising at least one of: a Model Context Protocol server endpoint and a Server-Sent Events stream, and authenticating callers via mutual transport-layer security bound to a hardware secure element of the edge gateway, with per-caller rate-limiting.

**20.** The system of claim 1, wherein the edge gateway provides a single-call multimodal diagnostic endpoint configured to receive, in one request, a sequence of biomarker readings, image data, and free-text contextual data, and to return a single candidate-hypothesis output and confidence score.

**21.** The method of claim 2, further comprising maintaining a persistent execution environment at the edge gateway in which model weights and a shared key-value cache are resident in memory between successive inference calls for a given animal identifier, such that inference latency for a subsequent reading from the same animal is reduced relative to a cold-start inference.

**22.** The system of claim 1, further comprising a messenger-channel transport layer configured to deliver the diagnostic decision-support output to a registered user device via at least one of: a WhatsApp Business Application Programming Interface channel, a Short Message Service channel, and a Rich Communication Services channel.

**23.** The method of claim 2, further comprising a conversational-interface tier that (i) receives a natural-language request from a stockperson over an end-to-end-encrypted messaging transport, (ii) maps the request via a constrained-grammar tool-invocation layer to one or more application-programming-interface calls of the system of claim 19, (iii) returns the candidate-hypothesis output together with a citation-grounded explanation generated by the explanation layer of claim 9, and (iv) writes the conversational round-trip identifier into the audit log of claim 2(d), such that every clinical-decision-support recommendation surfaced via the conversational tier is replayable.

**24.** The method of claim 2, wherein, when the confidence score falls within a defined sub-band of the band bounded above by the first threshold and below by the second threshold, the routing decision comprises scheduling a subsequent biomarker reading at the wearable biosensor at a defined interval rather than invoking the cloud-tier classifier, and revisiting the routing decision on receipt of the subsequent reading.

**25.** The system of claim 1, wherein two or more edge gateways within a single farm site are arranged as a fleet sharing a common on-premises identity-provider service and a shared model-weight cache, such that a model-weight update applied to one edge gateway is propagated to remaining edge gateways without egress to the cloud tier.

**26.** The system of claim 1, wherein the AI-class compute hardware of the edge gateway is selected from: an NVIDIA Jetson Orin Nano module providing approximately 40 trillion operations per second at INT8 precision; or a Raspberry Pi-class single-board computer paired with an externally-attached tensor processing unit providing approximately 4 trillion operations per second at INT8 precision.

**27.** The system of claim 6, wherein the wearable biosensor switches from the Bluetooth Low Energy modem to the sub-gigahertz Long-Range modem only after N consecutive Bluetooth Low Energy link-layer failures within a sliding window W, where N ≥ 3 and W ≤ 60 seconds, and reverts to the Bluetooth Low Energy modem only after K successful Bluetooth Low Energy beacons, where K ≥ 5.

**28.** The system of claim 7, wherein the edge gateway is configured to bundle measurement digests into a Merkle-tree root at a cadence T such that the on-chain anchoring transaction count per gateway per day is bounded above by approximately 96, T being adaptively lengthened when the upstream link round-trip time exceeds a threshold.

**29.** The system of claim 1, characterised in that the edge gateway comprises a TPM 2.0-class secure element or an ARM TrustZone-backed secure enclave storing a non-exportable signing key, every audit-log entry is signed inside the secure element, and gateway boot is gated by measured-boot attestation against a known-good Platform Configuration Register set.

**30.** The method of claim 2, further comprising, during edge-to-cloud connectivity loss, queueing each candidate-hypothesis output, confidence score, routing decision and signed audit-log entry into an append-only ring buffer of capacity sufficient to retain at least approximately thirty days of records at the maximum biomarker sampling rate, with a fallback minimum design target of greater than or equal to approximately seven days, the buffer being durably persisted to non-volatile storage on every write, and on connectivity restoration draining the buffer in time-order with idempotent batch-sync semantics keyed by an ingest-key tuple comprising a pseudonymised animal identifier, a session identifier, and a 64-bit monotonic sequence counter.

**31.** The method of claim 2, characterised in that, when the cloud-tier classifier is unreachable for longer than a defined timeout, the routing rule for the band bounded above by the second threshold degrades deterministically to (i) returning a conservative deferred-verdict output flagged as such, (ii) retaining the reading in the buffer of claim 30, and (iii) emitting a clinician-facing escalation event, the deferred-verdict event being itself entered into the audit log of claim 2(d).

**32.** The system of claim 12, wherein the wearable biosensor implements a per-needle continuity check at the analogue front-end by way of electrochemical-impedance spectroscopy executed at a cadence of approximately every twenty-four hours, at which a measured impedance of less than approximately 1 kiloohm at 1 kilohertz with a drift of less than or equal to approximately 10 per cent over a rolling seven-day window is taken as confirmation of normal operation, the wearable biosensor disabling sampling on a needle reporting open-circuit, and the wearable biosensor maintaining a sub-1 milliampere average current draw under primary conditions while tolerating up to two needle failures via a green/yellow/red cluster_health state machine implementing a three-of-four quorum criterion.

**33.** The system of claim 1, characterised in that each disposable Head of the wearable biosensor encodes four deterministic per-needle identifiers derived from the head's session identifier by Hash-based Key Derivation Function applied with HMAC-SHA-256, with salt equal to the head session identifier and info equal to the per-needle slot index.

**34.** The system of claim 29, wherein the edge gateway emits periodic signed attestation packets, generated inside the secure element, asserting (i) the gateway's geographic-premises identifier, (ii) a cryptographic digest of an egress-firewall ruleset enforcing a no-raw-biomarker-egress predicate, and (iii) a measured-boot quote of the inference runtime, the attestation packets being verifiable by a regulated counterparty without disclosure of any raw biomarker reading.

**35.** The method of claim 2, characterised in that firmware and classifier-model updates to the edge gateway are delivered as ECDSA-signed image bundles via a staged over-the-air rollout with deterministic rollback, the rollout success rate being greater than or equal to approximately 98 per cent and the rollback rate being less than approximately 1 per cent, and rollout audit-log entries being themselves anchored into the chain-of-custody verification rail.

---

## § 7. ABSTRACT

[0083] An integrated cyber-physical system for veterinary clinical decision support comprises a wearable interstitial-fluid biosensor with a quad-array hydrogel-microneedle cluster (cluster footprint 1.5 to 2.0 millimetres; pitch 0.5 to 0.8 millimetres; length 0.7 to 1.3 millimetres), an on-farm edge gateway running a multi-biomarker pathway classifier on AI-class compute hardware, a federated cloud-tier aggregation system with k-anonymous suppression (k ≥ 5), and a cryptographically anchored chain-of-custody rail. A computer-implemented hybrid-inference method routes each reading according to a three-band confidence-banded escalation policy with thresholds approximately 0.85 and approximately 0.60, with deterministic graceful-degradation under cloud unreachability, all anchored to an append-only cryptographic audit log.