Pre-Directive technical evidence · preserved for provenance
A bounded Hermes-based implementation candidate created before NIN–NAIO Master Directive v1.1. Its receipts remain inspectable; its older vocabulary no longer defines the canonical architecture.
Download the historical architecture statement Inspect machine evidence Download signature
Canonical definition
Nurse AI OS is the governed professional environment in which nursing applications, agents, models, knowledge, memory, tools, and workflows operate. Florence-X is the orchestration and execution control plane. EDENA is the governance and assurance control plane. Authorized humans remain accountable.
Hermes currently provides a provisional, replaceable agent and memory substrate. OpenClaw is a provisional, replaceable tool-execution binding where implemented. Models and tools are replaceable utilities—not the product, authority, or accountable clinician.
The historical Harness tested one Hermes-native control approach. Nurse AI OS does not mechanically enforce every Florence-X or EDENA requirement across ChatGPT, Claude, Hermes, OpenClaw, or other hosts today.
Read it by role
Directive v1.1 semantics
| Dimension | Values | Meaning |
|---|---|---|
| Risk tier | Green · Yellow · Orange · Red-P · Red-E | Consequence, review, prohibition, and exceptional controlled use. Red-P is prohibited; Red-E requires explicit authorization and assurance. |
| Data class | D0 · D1 · D2 · D3 · D4 | Public/synthetic through restricted critical data. The public Community experience is D0/D1 only. |
| Action mode | Observe · Draft · Recommend · Prepare Action · Act With Approval · Constrained Autonomy | How a capability may act after scope and risk are set. Unrestricted Autonomy is prohibited. |
Invariants: risk never grants authority; action mode never lowers risk; data sensitivity never disappears; ambiguity moves risk upward and authority downward; a downstream configuration may narrow but never restore a denied capability.
Evidence retained—not generalized
| Control | Historical scoped evidence |
|---|---|
| Capability registry | Content-hash-verified manifests; unknown and unmanifested capabilities blocked in the tested source. |
| Monotonic compiler | Tests showed a downstream layer could not re-grant authority removed upstream. |
| Runtime hook | The plugin loaded through Hermes's plugin manager in an isolated temporary home. |
| Redlines | Synthetic MRN and credential-field cases blocked without logging argument values. |
| Human approval | An external side-effect class returned Hermes's native approval directive. |
| Provenance | A SHA-256 sequence chain detected mutation, deletion, and reordering. |
| Restart safety | Side effects returned to review; only bounded idempotent read-only work could resume. |
Dataset naio-edena-runtime-core · version 2026.07.13.1 · SHA-256 c8259d32dd85842c95f674050db930c25cfb264874e92a1bb8668bd31da1d223
Known · Assumed · Unknown · Recommended · Decide
The source executed in the tested canary; Hermes loaded the plugin; 46 unit tests and eight synthetic trajectories passed; the release evidence was signed with the existing trust anchor.
The host operator remains trusted; Hermes behavior remains consistent with the tested version; any institution adds identity, endpoint, network, retention, procurement, labor, legal, privacy, and incident-response controls.
Institutional concurrency, broad adversarial error rates, usability burden, council acceptability, organization-specific requirements, and complete input/output mediation remain unestablished.
Treat the artifact as historical implementation evidence. Use public or synthetic data in an isolated profile; reassess after any model, tool, manifest, policy, connector, or host change.
Any promotion, integration, or new implementation requires current Directive semantics, exact scope, evidence, authorization, rollback, and accountable human ownership. Historical founder approval is not current institutional authorization.
Primary sources · historical evidence context