# DISCOVER Mission Control — Baseline Gap Report

## Decision

The bundled DISCOVER Nurse AI OS Mission Control v2.0.0 is approved as a **visual, interaction, governance-language and browser-state reference**. The canonical Healthcare Research & Innovation Leader DISCOVER corpus is approved as the **domain, schema, workflow, agent and release-assurance source**. Neither is the completed target application.

The baseline is a genuine offline static application, not a screenshot. The domain pack is a deep governed specification, not executable full-stack software. The Functional Build Master Prompt requires an authenticated local application with SQLite, migrations, structured CRUD, starters, a real Hermes adapter, genuine streaming, evidence retrieval/citation validation, consent-controlled memory, bounded agent routing, cross-role isolation and reproducible packaging/testing. Those capabilities are not present as one tested runtime.

Until every critical gate passes, the required readiness statement is:

> **Not operational:** One or more core acceptance criteria failed or has not been run; blockers are documented in the acceptance ledger.

Do not use **Core operational; AI setup pending** after merely reskinning or wrapping the static baseline. Multiple offline/core requirements—not only AI—are missing.

## Inspected sources

### Functional build contract

- Workspace source: `upload/01-Mission-Control-Functional-Build-Master-Prompt.md`
- SHA-256 verified during the DISCOVER build-kit source audit: `ce884cfc6345cc93a6baec0852cf44feb44d859234ef1dc2b5ac2138df18ebe2`
- Contract areas: offline core, starters, reproducibility, personalization, IA, state, backend, Hermes/Soul boundaries, genuine streaming, agents, memory, evidence, authentication, governance, complete controls, badges, capability states, recovery and executed acceptance evidence.

### Dashboard baseline

- Workspace source: `deliverables/DISCOVER-Nurse-AI-OS-Mission-Control-v2.0.0/`
- Original ZIP: `deliverables/DISCOVER-Nurse-AI-OS-Mission-Control-v2.0.0.zip`
- SHA-256 verified during the DISCOVER build-kit source audit: `69a4dd86659b41136ce9ceb2ceb52512ab567637ab0be29fdc6f6ab6573223c1`
- Architecture: static HTML/CSS/JavaScript plus an optional read-only Node loopback server.
- Persistence: browser `localStorage`, filtered by mission retention choice.
- Hermes behavior: generate reviewed Markdown, copy/download, and open Hermes separately.

### Healthcare Research & Innovation Leader corpus

- Workspace source: `deliverables/Healthcare-Research-and-Innovation-Leader-DISCOVER-SuperPowers-Pack-v1.0/`
- Complete source archive: `deliverables/Healthcare-Research-and-Innovation-Leader-Complete-AI-OS-with-DISCOVER-SuperPowers-Package-v1.0.zip`
- Domain: a standalone research and innovation leadership lane.
- Stable content: six DISCOVER groups, 24 powers, 24 runnable workflows, 30 fillable preview templates, 18 closed JSON Schemas, ten bounded agents, FRAME–TRACE–PROBE–ORBIT operating gates, ten canonical fixtures and a 160-criterion release-assurance corpus (A–R × 8 plus 16 integrations).
- Canonical schema bundle SHA-256 declared by the corpus: `27d4f63a0705593b33183c5051aa650fc62328ef5c3b9965b5cf2bdaaf804e4b`.

No completed personal Discover Packet or approved derived Soul Quiz result is assumed for this generic build. Synthetic inputs must remain labeled and never become personal facts, authority, credentials, institutional approvals, study status or project results.

## What is genuinely functional in the browser baseline

### Launch and presentation

- Portable HTML launch and platform helper scripts exist.
- The optional Node server binds to loopback and serves static release files.
- The UI is colorful, responsive and role-aware.
- Existing baseline QA records 43 DOM/governance checks and 29 browser/visual checks.
- Guide, privacy, security, backup/restore and uninstall language provide a useful editorial baseline.

### Personalization and roles

- The first-run preparation message and safety walkthrough are present.
- Safety acknowledgment is required before onboarding completion.
- Versioned Discover Packet and derived Soul Profile JSON adapters validate, preview and require Apply.
- Raw provisional quiz answers are not retained by the browser adapter.
- Seventeen role recipes are represented, with one Primary role and optional Supporting, Emerging or Contextual roles.

### Mission loop

- Users can create, select, edit and delete missions.
- A mission belongs to one role dashboard and has status and retention metadata.
- Assess, Define, Plan, Implement and Evaluate stages retain notes/outcomes.
- Stage review requires content, proceeds in order and reopens downstream work after material upstream change.
- Artifact maturity advances through visible gates; material purpose/role/EDENA changes invalidate stale approval attestations.
- Evaluate can feed a lesson into a new Assess iteration.
- Session-only missions are not retained; explicitly retained non-sensitive missions persist in the same browser origin.

### Governance, handoffs and capabilities

- EDENA states and acknowledgment behavior are visible.
- Institutional mode is honestly called a preview, not tamper-resistant enforcement.
- Simple client-side identifier/secret warnings exist.
- Mission/workflow handoffs generate Markdown locally; Copy/Download is distinguished from Send/Execute.
- No network request fabricates an AI response.
- Capability evidence can be added/deleted and progress recalculates without counting obvious duplicates.
- Profile export/restore uses validation; synthetic sample work is excluded from achievement evidence.

## Limitations inside those functional areas

- Browser `localStorage` is unencrypted, capacity-limited, origin-specific and not transactionally durable.
- Direct-file and loopback modes use different origins and can create divergent copies.
- Dashboard IDs organize views but do not enforce tenant, role, project, study or private-owner isolation.
- Mission archive is an editable state, not a recovery browser with soft-delete restore.
- Mission search, filter, sort and complete structured project/task/measure/review entities are absent.
- Template cards are informational; they do not instantiate the research corpus's closed structured artifacts.
- Capability evidence lacks full edit, correction, expiry, review and revocation lifecycle.
- Client-side pattern matching is not de-identification, DLP, malware scanning or institutional privacy control.
- Browser developer tools can bypass local presentation logic.
- The walkthrough progress is not dependency, migration, indexing or model-connection progress.

## Research corpus strengths that must survive implementation

- Clear research/QI/clinical/innovation ambiguity handling through FRAME without manufacturing a determination.
- TRACE source/version/status/claim/limit/expiry discipline.
- PROBE's smallest reversible non-production experiment and explicit exit/rollback.
- ORBIT's one-run, exact-hash, one-invocation, zero-retry-by-default model.
- DATA-D0/D1/D2 limits and required aggregate-export evidence for D2.
- Rejection of person-level participant/patient/workforce data before persistence.
- Tenant governance/portfolio/evidence/sandbox/controls partitions and separate whole-life private owner partition.
- Exact authority source, active-hat scope, expiry, object hashes and human gates.
- No recruitment, consent, clinical action, official submission, publication, procurement, contracting or production deployment.
- Tamper-evident receipts that do not falsely claim immutable or institutionally authoritative records.

These strengths exist primarily as Markdown specifications, embedded schema documents and expected tests. They must be compiled, executed and verified in the built runtime.

## Required implementation gaps

### 1. Structured offline CRUD

**Present:** mission records with five free-text stages.  
**Missing:** projects, goals, milestones, tasks/subtasks/dependencies, measures, reviews, notes, decisions, assumptions, unknowns, risks, safeguards, attachments, history, archive/restore, duplication, search/filter/sort and relationship enforcement.  
**Required:** server-validated repositories and accessible UI; every core action works without AI.

### 2. Research and innovation pipeline

**Present:** 24 workflow and 30 template specifications.  
**Missing:** executable structured opportunity intake, FRAME review, portfolio, study concept/design, feasibility, measures/analysis intent, engagement, funding readiness, submission readiness, bounded experiment, value/translation, implementation, dissemination and closeout records.  
**Required:** instantiate each template into its canonical closed schema, validate on every create/update/import/export/migration, and preserve DRAFT/PREVIEW/NOT OFFICIAL labels.

### 3. SQLite and migrations

**Present:** browser storage only.  
**Missing:** database, foreign keys, transactions, migration checksums, backup-before-migration, failure rollback, idempotent seed, stable data path, integrity check and atomic restore.  
**Required:** implement the model in `DISCOVER-Architecture-and-Data-Model.md`; browser storage is not durable source of truth.

### 4. Starter lifecycle

**Present:** manually loadable synthetic baseline example.  
**Missing:** research-lane starter workspace, Start Here/Hermes checklists, FRAME/TRACE/PROBE starter artifacts, starter labels, Adopt/Clear/Restore and seed versioning.  
**Required:** safe synthetic idempotent starters, excluded from analytics/badges until adopted and genuinely completed.

### 5. Mission Profile provenance

**Present:** strict import preview/apply/clear.  
**Missing:** field-level source, original reference, derived value, uncertainty, approve/reject state, timestamps, editing, version history and deletion receipt.  
**Required:** separate application Mission Profile; no raw Soul or raw quiz/interview persistence.

### 6. Authentication and secrets

**Present:** no auth and no server secrets; static server accepts reads.  
**Missing:** local credential, memory-hard verifier, rotating session, CSRF, Origin/Host, rate/size limits, expiry/revocation, server-only provider keys and safe configuration.  
**Required:** loopback by default; no secrets in client, URLs, logs, exports, QA or source.

### 7. Real AIBackend and Hermes adapter

**Present:** manual handoff only; CSP disallows connections.  
**Missing:** authenticated health/capability/model discovery, session create/resume, normalized provider interface, real Hermes calls, optional compatible adapter, errors and usage.  
**Required:** same-origin authenticated proxy; show Setup Required/Offline unless a recent genuine check passes.

### 8. Genuine streaming and cancellation

**Present:** none.  
**Missing:** provider-originated deltas, ordered event protocol, tool visibility, approval events, Stop/cancel propagation, reconnect/resume and duplicate prevention.  
**Required:** no timer-animated or chunked canned output. Test slow real streams and cancellation.

### 9. Evidence retrieval and citations

**Present:** user-authored source notes and domain TRACE specification.  
**Missing:** retrieval provider, source registry runtime, version/retraction checking, claim-source relationships, citation validator, reproducible search trace and prompt-injection boundary.  
**Required:** real sources only, exact link status, unsupported claim marking and no fabricated citations.

### 10. Research/QI/clinical/innovation boundary enforcement

**Present:** strong FRAME prose and closed-schema enums.  
**Missing:** server policy service shared by every screen/agent, named route configuration, expiry enforcement and executed negative tests.  
**Required:** ambiguity stays `multiple_or_unresolved`; never create legal/regulatory/IRB/clinical determinations.

### 11. Participant, institutional and data boundaries

**Present:** explicit corpus ceiling.  
**Missing:** pre-persistence server rejection, zero-retention proof, D2 export-evidence validator, partition-scoped repositories, approved bridge control and negative cross-join tests.  
**Required:** no participant/patient/workforce rows or narratives; no implicit tenant/role/project/study/private joins.

### 12. Agent registry, routing and control

**Present:** ten proposed agent definitions at P0 in prose/schema.  
**Missing:** executable registry, route plan preview, permission checks, one-run token, exact-hash validation, streaming tool events, Pause/Kill, reconciliation, purge and independent audit separation.  
**Required:** P0 default; P4 absent; no external writes; no self-activation, hidden work, recursion or silent retry.

### 13. Consent-controlled memory

**Present:** no structured memory service.  
**Missing:** preview/remember/edit/forget/delete/export, purpose/category/consent/expiry, scoped retrieval, provider-memory truthfulness and cleanup.  
**Required:** off by default; prohibited categories rejected; local and Hermes/provider deletion distinguished.

### 14. Uniform governance

**Present:** client EDENA and corpus FRAME/TRACE/PROBE/ORBIT.  
**Missing:** one server engine applied uniformly to missions, templates, evidence, AI, agents, memory, imports, exports and approvals.  
**Required:** Unclassified/Unknown fails closed for consequential transitions. Personal advisory and institutional enforcement remain visibly distinct.

### 15. Capability evidence and badges

**Present:** manual browser evidence and four levels.  
**Missing:** correction/review/expiry/revocation, criteria versioning, reviewer requirements and research-specific proof.  
**Required:** observable eligible work; never licensure, certification, research authorization, IRB status, authorship or institutional approval.

### 16. Backup, update, rollback and deletion

**Present:** JSON profile backup and documentation.  
**Missing:** consistent SQLite backup, optional encryption, checksum/version manifest, temporary restore validation, atomic swap, pre-update backup, rollback, full local deletion verification and OS-level clean tests.  
**Required:** explicit application/data separation and honest external-artifact limitations.

### 17. Reproducible build and platform evidence

**Present:** self-contained static release.  
**Missing:** declared runtime/dependencies, lockfile, reproducible install/build commands, SBOM, secret scan, clean-machine macOS/Windows/Linux evidence and release manifest tying all versions/hashes together.  
**Required:** supported means tested on exact packaged artifact; otherwise label Targeted.

### 18. Complete interactivity and diagnostics

**Present:** functional subset of browser controls.  
**Missing:** implementation and test record for every visible control; application/database/Hermes/model/stream/memory/tool/retrieval state; read-only redacted diagnostics.  
**Required:** no enabled dead button, placeholder, no-op, fake launch or capability inferred from configuration alone.

## Domain-specific non-negotiable blockers

Any of these forces **Not operational**:

- a person-level or raw narrative participant/patient/workforce record persists or reaches AI;
- the product determines research/QI/IRB/consent/HIPAA/FDA/clinical status;
- a cross-tenant, cross-role, cross-project/study or private-owner join occurs without a valid bridge;
- D2 data is accepted without current aggregate-export evidence;
- a retracted/expired source silently supports a current claim;
- a citation is fabricated or not linked to the claim;
- a study artifact is presented as a protocol approval, official submission or authorization;
- a participant, clinical, publication, funding, vendor, contract, IP, procurement or deployment action exists;
- an agent starts above P0, runs without exact one-run authorization, exceeds one invocation, retries silently, writes externally or survives Kill;
- a starter/synthetic record counts as real outcome or mastery evidence;
- an authority, approval, consent, source, bridge or token expiry is ignored; or
- readiness is asserted without the executed acceptance ledger.

## Implementation sequence

1. S0: immutable source verification, route/identity collision scan, dependency/architecture decision and Activation Card.
2. S1: authenticated server, SQLite schema/migrations, core CRUD, partitions, import preview, starters and backup/restore.
3. S2: 18-schema extraction/compilation, research pipeline, FRAME/TRACE/PROBE governance, D0/D1/D2 enforcement and evidence center.
4. S3: AIBackend, real Hermes capability discovery, genuine stream/cancel, memory, agent route preview and ORBIT one-run control.
5. S4: accessibility, diagnostics, release packaging, clean-machine platform tests, negative governance/security tests and handoff evidence.

The build kit itself completes none of these runtime gates. All matrix controls remain `required_not_implemented` and all acceptance tests remain `Not Run` until Hermes produces and tests the application.
