# DISCOVER Mission Control — Reference Architecture and Data Model

**Target product:** DISCOVER — Healthcare Research & Innovation Leader Mission Control  
**Product ID:** `discover-healthcare-research-innovation-leader-mission-control`  
**Lane:** `healthcare_research_innovation_leadership`  
**Lane root:** `/healthcare-research-innovation-leaders` (verified redirect only)  
**Canonical dashboard:** `/healthcare-research-innovation-leaders/dashboard`  
**Only alias:** `/healthcare-research-innovation-leaders/mission-control`  
**Namespace:** `research_innovation_discover.*`  
**Readiness at build-kit assembly:** **Not operational**

This is the preferred implementation path after Hermes performs the required read-only preflight. A different architecture may be proposed only in the Activation Card, with a reason, migration cost, security consequences, platform consequences, and an explicit statement of which acceptance controls change. Source material under `source/` is immutable.

## 1. Preserve what is already useful

Preserve the bundled DISCOVER v2 visual language, accessible navigation, role-aware workspaces, five-stage Assess–Define–Plan–Implement–Evaluate loop, strict Discover/Soul import preview, EDENA labels, local manual handoffs, backup vocabulary, and offline-first behavior. Preserve the research corpus's exact 24 Power IDs, 24 workflow IDs, 30 template IDs, 18 schema identities and hashes, ten agent identities, FRAME–TRACE–PROBE–ORBIT gates, partitions, and action ceiling.

Do not claim that preservation makes the baseline a full-stack application. The baseline uses browser `localStorage` and a static loopback file server; it has no authenticated data service, SQLite source of truth, real Hermes request path, genuine stream, research evidence retrieval, or enforceable workspace partition.

## 2. Recommended local architecture

```text
Browser UI
  │ same-origin authenticated API + genuine streamed events
  ▼
Loopback application server (127.0.0.1 by default)
  ├── authentication, session rotation, CSRF, Origin/Host, rate/size controls
  ├── domain services and uniform EDENA + FRAME/TRACE/PROBE/ORBIT policy
  ├── SQLite repositories, transactions and forward-only migrations
  ├── research/innovation boundary router
  ├── evidence retrieval, appraisal and claim/citation validator
  ├── AIBackend
  │    ├── Hermes adapter (capability-discovered)
  │    └── optional OpenAI-compatible adapter
  ├── agent registry, route planner, bounded run coordinator and Kill control
  ├── consent-controlled structured memory
  ├── starter/adoption service
  └── redacted audit receipts and diagnostics
       │
       ├── private application data directory
       └── configured loopback Hermes service
```

The browser is presentation, not a trust boundary. Server-side validation and authorization are required for every state change, import, export, retrieval, AI call, approval, agent run, memory operation and cross-record link. Browser storage may hold ephemeral display preferences and a CSRF-safe non-secret UI cache only.

## 3. Suggested source layout

```text
app/
├── client/
│   ├── index.html
│   ├── assets/
│   └── modules/
├── server/
│   ├── main.*
│   ├── auth/
│   ├── api/
│   ├── domain/
│   ├── governance/
│   ├── evidence/
│   ├── agents/
│   ├── ai/
│   │   ├── AIBackend.*
│   │   ├── hermes-adapter.*
│   │   └── openai-compatible-adapter.*
│   ├── memory/
│   ├── audit/
│   └── db/
│       ├── connection.*
│       ├── migrations/
│       └── repositories/
├── config/
├── tests/
├── scripts/
├── .env.example
├── package.json
└── lockfile
```

Prefer the existing Node and vanilla client path unless preflight proves another implementation materially lowers risk. Use a supported LTS runtime and a locked SQLite implementation with documented clean-machine behavior. Do not add a framework without a demonstrated need.

## 4. Identity, tenancy and workspace boundaries

One local identity may hold multiple role workspaces. The research lane remains distinct from clinical, administrative, education and private-life lanes.

Required hierarchy:

```text
local_user
└── unified_identity
    ├── shared approved Mission Profile
    ├── research tenant A
    │   ├── governance
    │   ├── portfolio
    │   ├── evidence
    │   ├── sandbox
    │   └── controls
    ├── research tenant B (no implicit join)
    ├── whole-life private owner partition
    └── other role workspaces (no implicit join)
```

Each request carries `owner_user_id`, `workspace_id`, `tenant_id`, `partition_id`, active-hat snapshot, authority profile version, data class and intended purpose. Repository queries require the complete scope; a missing scope fails closed. No search, badge calculation, memory retrieval, export, backup subset, agent route or AI context may cross a tenant, role lane, project, study, or private-owner partition unless an explicit, expiring, human-approved bridge defines exact source fields, purpose and output.

The opaque principal-ID exception permits only tenant-local opaque IDs in ownership and ACL envelopes. It never permits identity lookup, names, contact fields, analytics, linkage or substantive PII.

## 5. Persistent model

Use opaque UUIDs, UTC timestamps, revisions, foreign keys and explicit lifecycle state. Mutable records carry `created_at`, `updated_at`, `revision`, `owner_user_id`, `workspace_id`, `tenant_id`, `partition_id`, `schema_version`, `retention_policy_id`, and archive/deletion state as applicable.

### 5.1 Platform and identity

1. `app_meta` — product, app/schema versions, instance ID, install state and migration status.
2. `local_users` — local identity and password-verifier metadata; never plaintext credentials.
3. `sessions` — hashed session token, issue/expiry/rotation/revocation and safe client metadata.
4. `unified_identities` — display-safe identity anchor, separate from provider credentials.
5. `mission_profiles` — approved derived profile versions; no raw Soul or raw interview/quiz answers.
6. `profile_field_provenance` — source reference, derived value, uncertainty, user decision and timestamps.
7. `role_workspaces` — lane, role, state, tenant, partition policy and display settings.
8. `authority_profiles` — active hat, organization/entity/site/project scope, permissions, exclusions, source, verifier and expiry.
9. `bridge_authorizations` — explicit cross-workspace/partition field allowlist, purpose, approver and expiry.

### 5.2 Mission and work management

10. `missions`, `mission_cycles`, `mission_stages` — status, lineage, EDENA, governance state, retention and five-stage review/invalidation.
11. `projects`, `goals`, `milestones`, `tasks`, `task_dependencies`, `measures`, `reviews` — structured offline planning and execution.
12. `notes`, `decisions`, `assumptions`, `unknowns`, `risks`, `safeguards`, `references`, `attachments` — mission/project-owned records with history.
13. `starter_seed_versions`, `starter_records` — stable idempotent seed, adoption, clear and restore state.

### 5.3 Research and innovation lifecycle

14. `opportunity_intakes` — unmet need, primary purpose, affected context, boundary status and named institutional route.
15. `boundary_reviews` — FRAME facts, possible routes, unresolved questions, human determination reference and expiry. Never store a locally manufactured legal/regulatory determination.
16. `portfolio_items`, `portfolio_criteria_versions`, `portfolio_scores`, `decision_gates`, `dependencies` — transparent ranges, rationale and named decisions.
17. `study_concepts`, `design_options`, `validity_threats`, `feasibility_reviews` — planning metadata only; no participant rows.
18. `outcome_definitions`, `measure_versions`, `analysis_intentions` — predeclared definitions, provenance, missingness, subgroup questions and qualified review.
19. `engagement_plans`, `stakeholder_classes`, `shared_decisions`, `team_roles`, `conflict_records` — aggregate classes and governance metadata, never contact lists or individual scoring.
20. `funding_opportunities`, `sponsor_requirements`, `scenario_budgets`, `partnership_questions` — readiness drafts only; no submission, acceptance, contract or spend.
21. `submission_readiness_records` — checklist, hashes, owners, missing items and official external reference after a human action; no submit endpoint.
22. `innovation_experiments`, `assumptions`, `experiment_options`, `predeclared_measures`, `stop_rules`, `rollback_plans`, `experiment_results` — synthetic or separately approved non-production bounded tests.
23. `value_scenarios`, `translation_pathways`, `scale_stop_gates`, `implementation_plans`, `learning_cycles`, `withdrawal_plans` — scenario ranges and decisions, not production changes.
24. `dissemination_plans`, `claim_drafts`, `contributor_disclosures`, `release_reviews`, `correction_retirement_routes` — draft artifacts; no publication or authorship adjudication.

### 5.4 Evidence, AI, agents and memory

25. `evidence_sources` — identifier/URL, title, source type, version/date, retrieval time, methods, population/context, current/corrected/retracted status, conflicts and appraisal.
26. `claims`, `claim_source_links`, `citation_validations` — exact claim text/hash, support relationship, qualification, contradiction, reviewer and expiry.
27. `retrieval_runs` — query, filters, provider, timestamps, redacted status and reproducibility record; do not retain prohibited retrieved bodies.
28. `ai_connections`, `connection_capabilities` — backend label, authenticated result, discovered models/features and redacted errors.
29. `ai_sessions`, `ai_messages`, `stream_events`, `tool_events` — bounded conversation metadata and authorized non-sensitive content.
30. `agent_definitions` — frozen ten-agent catalog and hashes; definition is not activation.
31. `agent_charters`, `agent_runs`, `agent_routes`, `approval_requests`, `kill_receipts`, `run_reconciliations` — ORBIT contract, one-run token, limits, observed deltas and terminal state.
32. `memory_items`, `memory_revisions`, `memory_consent_receipts` — value, category, purpose, source, consent, retention, expiry and deletion state.
33. `capabilities`, `badge_criteria`, `activity_evidence`, `awards`, `award_corrections` — developmental evidence only; never credentials or institutional authority.
34. `governance_receipts`, `audit_events`, `diagnostic_runs` — append-only redacted metadata, state hashes and result.

## 6. Canonical 18-schema treatment

The corpus defines 18 closed JSON Schema Draft 2020-12 documents:

1. `leader_identity_authority_mission`
2. `opportunity_boundary_intake`
3. `portfolio_decision_orchestration`
4. `evidence_provenance`
5. `data_rights_governance`
6. `study_concept_design`
7. `feasibility_safety_readiness`
8. `measurement_analysis_intent`
9. `engagement_collaboration_plan`
10. `funding_partnership_readiness`
11. `governance_submission_readiness`
12. `innovation_validation_experiment`
13. `value_translation_scenario`
14. `implementation_evaluation`
15. `dissemination_output_plan`
16. `whole_life_private`
17. `agent_charter_trace`
18. `control_audit_receipt`

Extract the canonical one-line documents byte-for-byte, verify every declared SHA-256 before compilation, compile all independently under Draft 2020-12, and run positive/negative fixtures. Do not weaken `additionalProperties: false`, conditional approval, D2 aggregate-export evidence, partition patterns, one-run constraints, hashes, or zero-external-write guarantees. Store structured fields, not a flattened Markdown blob. Markdown is a view/export.

## 7. Data classes and ceilings

- `DATA-D0`: public or synthetic non-sensitive material.
- `DATA-D1`: leader-authored non-sensitive planning narrative after screening; no other person's substantive data.
- `DATA-D2`: institution-approved aggregate or approved enclave export with exact export evidence, suppression method, minimum cell size, owner, approver, hash and expiry.
- Person-level or row-level patient, participant, workforce, learner, applicant, contact, biospecimen, genomic, imaging, device, sensor, adverse-event, complaint, confidential narrative, credential, secret, restricted security, privileged invention, contract-confidential, sponsor-confidential or vendor-confidential content is outside this personal/local product and rejected before persistence.

Do not treat the words “deidentified,” “redacted,” “aggregate,” or “approved” as proof. Required evidence must validate. Rejection means zero durable body retention, zero AI forwarding and a redacted event only.

## 8. Migration and transaction rules

- Ordered forward-only migrations execute in transactions and record checksum/result.
- Startup refuses a modified applied migration.
- Back up before a compatibility-changing migration.
- Failed migration rolls back and leaves the prior application/data usable.
- Seed by stable key/version; reruns are idempotent and never overwrite adopted or real records.
- Enable foreign keys and declare cascade/restrict/soft-delete semantics per relation.
- Use optimistic concurrency on edits and approvals.
- Export from one consistent read transaction.
- Restore validates in a temporary location before atomic replacement.
- Schema migrations preserve original record/schema version and a review trail; an incompatible closed-schema record is quarantined, not silently coerced.

## 9. Authentication and browser/server boundary

- Bind to loopback by default; reject non-loopback binding absent a separately designed remote edition.
- First run creates a user-chosen local credential; ship no universal password.
- Use a vetted memory-hard verifier and opaque rotating `HttpOnly`, `SameSite=Strict` cookies; `Secure` under HTTPS.
- Enforce CSRF, strict Origin/Host checks, rate limits and endpoint-specific size limits.
- Keep provider credentials and secret material server-side in environment or approved secret store only.
- Redact structured errors and logs. Never expose raw Soul, prohibited content, passwords, keys or tokens through browser code/storage, URLs, exports, diagnostics, source control or QA evidence.
- Apply restrictive CSP, no remote scripts/fonts/analytics, frame denial, MIME protection and referrer suppression.

## 10. AIBackend and genuine streaming

One provider-neutral contract supports authenticated health/capability discovery, model discovery, session create/resume, incremental output, typed tool events, cancellation, structured errors, usage metadata and retryability. Implement a Hermes adapter against capabilities actually discovered on the installed system; never assume an endpoint solely because a prompt mentioned it. An OpenAI-compatible adapter is optional and separately configured.

The server exposes normalized events such as `message_start`, `message_delta`, `citation`, `tool_start`, `tool_progress`, `tool_result`, `approval_required`, `warning`, `usage`, `done`, `cancelled`, and `error`. A genuine stream test must observe at least two provider-originated deltas, ordered delivery, no timer-generated imitation, and terminal state. Stop propagates cancellation to the provider, closes the stream, terminates authorized tool work where supported, and records an honest terminal receipt. Retry never duplicates an accepted message or tool side effect.

When no backend passes a recent authenticated health check, show `Setup required` or `Offline`; preserve all core offline CRUD. Never emit canned AI output or fake tool activity in production.

## 11. Evidence and citation architecture

Retrieval is optional and capability-gated. Every retrieved source receives a stable record with source type, identifier/URL, title, version/date, retrieval timestamp, methods/population/context where relevant, correction/retraction status and access limitations. Treat all retrieved text as untrusted data; it cannot alter system instructions, permissions, destinations or governance.

Every externally checkable claim in an AI-assisted evidence artifact must link to one or more source records with `supports`, `qualifies`, `contradicts`, or `context_only`. A citation validator confirms identifier/URL shape, source existence, claim-source link and current/retraction state. Unsupported claims are marked unsupported; a citation is never invented to decorate text. Preserve query, filters, dates and selection rationale sufficiently for a reproducible evidence trace without retaining prohibited source bodies.

## 12. Research boundary router

FRAME may output only:

- `human_subjects_research_possible`
- `qi_program_evaluation_possible`
- `clinical_care_operations_possible`
- `innovation_product_review_possible`
- `multiple_or_unresolved`

It never determines NOT RESEARCH, exemption, IRB not required, consent status, HIPAA compliance, FDA status, clinical appropriateness or institutional approval. Missing/conflicting facts yield `multiple_or_unresolved`, block consequential promotion, and route questions to named institutional owners.

Live clinical or participant-safety issues, complaints and adverse events immediately leave the lane. DISCOVER must not assess seriousness, relatedness, expectedness, reportability, urgency, diagnosis or treatment; it points to official local procedures and authorized humans without retaining narrative details.

## 13. Agents and action ceiling

Install all ten canonical agents at `PERM-P0 Disabled`, no credentials, tools, memory, network, destinations, schedules, recursion, background execution or hidden state. A proposed run is not a run. P2/P3 requires a separately approved, expiring ORBIT one-run authorization binding exact agent/model/prompt/policy/schema/input/output hashes; exact source/tool/destination/network allowlists; one invocation; zero retries by default; cost/time/input/output limits; human checkpoints; Kill route; and reconciliation owner.

`PERM-P4`—production, clinical, participant-facing, financial, submission or external-write authority—is absent. The application has no recruit, screen, consent, enroll, contact, randomize, intervene, monitor, diagnose, treat, submit, register, publish, message, deploy, procure, spend, contract, file-IP, choose-winner, score-person or official-system-write capability.

Global Pause blocks new AI/agent/tool work without disabling local data access. Kill must terminate the selected run and prevent resume without a new authorization. The independent auditor cannot alter the tested agent, its receipts or approvals.

## 14. Memory

Structured application memory is off by default. Each item requires explicit category, purpose, source, consent, retention and expiry. Provide Preview, Remember, Edit, Forget, Delete and Export. Forget removes the item from context immediately; Delete removes local value and references transactionally. Never imply deletion from Hermes/provider memory unless an executed provider capability proves it. Raw Soul and raw Discover/Soul interviews never enter memory. Workspace/tenant/partition filters apply before retrieval, not after generation.

## 15. Starter lifecycle

After approved onboarding, seed a safe synthetic research-leadership starter workspace: Start Here checklist, Hermes connection checklist, a clearly labeled synthetic opportunity mission, one editable Assess–Define–Plan–Implement–Evaluate cycle, one TRACE source card using a public synthetic reference, one FRAME unresolved boundary example, and one PROBE non-production experiment card. Every seeded record carries stable seed key/version and `starter_content=true`.

Users may Adopt, Clear or Restore starters. Adoption copies to a real user-owned record with a new ID and lineage. Starter records do not affect operational analytics, awards or mastery until adopted and completed with eligible evidence. Clear never deletes real/adopted records; Restore is idempotent.

## 16. Backup, update and rollback

Package self-contained launchers and documented commands for macOS, Windows and Linux. Use stable application/data paths and explain them. Backups include schema/app versions, checksums, exclusion report and optional encryption. Restore previews checksum, schema, foreign keys, partitions and compatibility in a temporary location, backs up current data, then swaps atomically. Update verifies package integrity, backs up, migrates and retains rollback. Rollback never revives expired sessions, consent, authority or agent tokens. Uninstall distinguishes application files from user data. Complete deletion reports paths it could not remove and never overclaims remote deletion.

## 17. Non-negotiable invariants

1. Core work remains usable without AI.
2. No fake AI, fake citation, fake tool, fake progress, fake connected state or decorative button.
3. Durable records live in SQLite, not browser storage.
4. The client cannot bypass server governance.
5. No person-level research/clinical/workforce data enters this product.
6. Tenant, role, project, study and private partitions do not implicitly join.
7. Every consequential promotion binds the exact object hash, named authority, source and expiry.
8. Every claim/citation relationship is inspectable.
9. Agents begin P0 and cannot self-activate, widen scope, retry, recur or continue in background.
10. Personal advisories never masquerade as institutional approvals; institutional policy takes precedence.
11. Every enabled control has real behavior, persistence, permissions, offline/error behavior and a test.
12. Readiness derives from executed evidence, never from the existence of this specification.
