3GPP Mapping

How a10y components map to 3GPP TS 23.288 (NWDAF) functional entities — and how Agent Server extends NWDAF into autonomous closed-loop operations.

Component Mapping

3GPP FunctionSpeca10y ComponentRole
DCCF TS 23.288 Vector Data collection, normalization, routing from network functions
ADRF TS 23.288 OpenObserve + Qdrant OpenObserve: raw telemetry storage. Qdrant: analytics results, patterns, embeddings
AnLF TS 23.288 correlation-engine (Claude Code) + Keep Analytics inference, causal reasoning, alert correlation
MTLF TS 23.288 Qdrant + Claude Learning from past incidents via RAG, in-context learning
MFAF TS 23.288 NATS Event-driven messaging framework between all functions
NRF-like TS 23.501 active-inventory Network topology, device registry, service discovery
FM / PM TS 28.532 Keep Fault management, alert lifecycle, remediation workflow execution
Consumer NFs aether-ide / aether-term Analytics consumers, operator interfaces

NWDAF Decomposition

3GPP TS 23.288 defines NWDAF with two logical functions: AnLF (inference) and MTLF (training). In a10y, these are not monolithic — they are distributed across components, with Claude Code as the cognitive core.

Consumers
aether-ide
aether-term
Keep workflows
↕ Analytics output / Action requests
NWDAF
AnLF
Claude Code
MCP + Skills
Keep
Alert correlation
MTLF
Qdrant
Pattern memory
Claude
In-context learning
↕ Data collection / Event subscription
Data
DCCF
Vector
ADRF
OpenObserve
Qdrant
MFAF
NATS

Agent Server: Beyond NWDAF

Standard NWDAF is reactive — it responds to analytics requests from consumer NFs. Agent Server transforms it into an autonomous agent that proactively monitors, reasons, and acts.

Claude Code (AnLF)
← Subscribe
NATS events
Alert triggers, topology changes
→ MCP
OpenObserve
Query logs, metrics, traces
→ MCP
Keep
Get alerts, trigger workflows
→ MCP
Qdrant
Search past incidents
→ MCP
active-inventory
Topology queries, blast radius
→ Skill
/correlate /rca /remediate
Operator-facing workflows
↻ Agent Server
Autonomous loop
Event → Analyze → Decide → Act → Verify

Standard NWDAF

ModeReactive — responds to requests
OutputAnalytics reports to consumer NFs
LoopOpen — human decides and acts
TMF LevelL1–L2

a10y (NWDAF + Agent Server)

ModeAutonomous — event-driven
OutputRCA + remediation actions
LoopClosed — detect, reason, act, verify
TMF LevelL3–L4

Key Insight

In standard 3GPP, AnLF is a passive function that sits behind a service-based interface, waiting for Nnwdaf requests. a10y redefines AnLF as an active agent:

1
NATS subscription replaces polling — the agent is event-driven, not request-driven
2
MCP Servers replace Nnwdaf SBI — Claude Code connects to data sources via typed tool interfaces, not REST APIs
3
Skills replace analytics IDs — operators invoke /correlate or /rca instead of requesting analytics type 01–0F
4
Agent Server closes the loop — AnLF doesn't just report; it reasons, acts via Keep workflows, and verifies via OpenObserve
NWDAF tells you what happened. a10y understands why and fixes it.