# DISCOVER Agent Team and Deterministic Routing

## Implementation contract for Hermes

**Canonical product:** DISCOVER — Healthcare Research & Innovation Leader Complete AI OS  
**Program ID:** `HRIL-AIOS-DISCOVER-COMPLETE-1.0`  
**Foundation / overlay:** `HRIL-AIOS-LIFE-LEADERSHIP-1.0` / `HRIL-AIOS-DISCOVER-1.0`  
**Lane:** `healthcare_research_innovation_leadership`  
**Namespace:** `research_innovation_discover.*`  
**Canonical dashboard:** `/healthcare-research-innovation-leaders/dashboard`  
**Only alias:** `/healthcare-research-innovation-leaders/mission-control`  
**Home:** My DISCOVER Mission Control  
**Default agent state:** `PERM-P0 Disabled`

Implement the DISCOVER agent layer as a visible, permissioned research-and-innovation assistance system. It is not an HRO/IRB, EHR, CTMS, EDC, eConsent, safety-reporting, regulatory, grant, finance, procurement, patent, legal, publication, or production-deployment system. It must never substitute for qualified reviewers, institutional offices, study teams, clinicians, participants, community partners, or accountable decision owners.

The local application must remain useful without an AI backend. Missions, projects, workflow forms, evidence records, drafts, reviews, exports, backups, and the Assess–Diagnose/Define–Plan–Implement–Evaluate loop must work locally without AI. Agent controls may become eligible only after a real Hermes or approved OpenAI-compatible backend passes identity, health, capability, governance, streaming, cancellation, and tool-boundary checks. Never substitute canned output, delayed samples, fake tool events, fabricated citations, or simulated agent activity for a missing backend.

## 1. Frozen canonical inventory

Hermes must preserve these release identities rather than renumbering or renaming them:

- 24 powers: `PWR-01`–`PWR-24`, all installed `Available Inactive`;
- 24 workflow inventory IDs: `DSC-WF-01`–`DSC-WF-24`, with canonical headings `WF-01`–`WF-24`, all `Preview Only`;
- 30 templates: `TPL-01`–`TPL-30`;
- 18 closed JSON Schema Draft 2020-12 documents: `SCH-01`–`SCH-18`;
- ten optional agents: `AGT-01`–`AGT-10`, all installed `PERM-P0 Disabled`;
- ten synthetic fixtures/adapters: `FX-01@1.0.0`–`FX-10@1.0.0`; and
- 160 release/runtime criteria: `RA-A01`–`RA-R08` plus `RA-INT01`–`RA-INT16`.

No workflow launcher, role recipe, recommendation, imported profile, EDENA result, research/innovation title, or Hermes prompt activates a power or agent. S2 activation is not successful unless all 160 expected outcomes execute and pass, the frozen identities and hashes match, all powers remain `Available Inactive`, all agents remain `PERM-P0 Disabled`, and external actions remain Off. Otherwise report `PARTIAL_QUARANTINED_NOT_ACTIVATED`.

## 2. Canonical agent registry

Register exactly these ten definitions. Installation gives them no credentials, tools, memory, network, destinations, schedules, recursion, hidden state, background execution, or permission to invoke a model.

| ID | Exact canonical name | Bounded purpose | Installed state | Canonical maximum after separate authorization |
|---|---|---|---|---|
| `AGT-01` | Opportunity & Evidence Scout | Search an approved public/authoritative source allowlist and draft a TRACE evidence landscape with source versions and limits. | `PERM-P0 Disabled` | `PERM-P2` approved read-only source sandbox; no paywall bypass, identity scraping, conclusions, or publication. |
| `AGT-02` | Boundary & Governance Questioner | Apply FRAME to approved metadata and prepare questions/routes for HRO/IRB, QI, clinical, privacy, security, regulatory, and legal owners. | `PERM-P0 Disabled` | `PERM-P2` approved read-only sandbox; never determine status or submit. |
| `AGT-03` | Study Concept & Design Drafting Assistant | Create non-authoritative study-concept and design-option drafts from approved, non-person-level inputs. | `PERM-P0 Disabled` | `PERM-P2` approved read-only sandbox; no protocol approval, sample-size authority, eligibility decision, or launch. |
| `AGT-04` | Methods, Measures & Reproducibility Reviewer | Check definitions, denominators, provenance, pre-specification, bias threats, consistency, corrections, and reproducibility questions. | `PERM-P0 Disabled` | `PERM-P3` institution-approved aggregate/enclave-export sandbox; no row-level analysis or statistical sign-off. |
| `AGT-05` | Participant Burden, Accessibility & Equity Reviewer | Review approved plans for burden, exclusion, access, language, digital divide, missing voices, compensation questions, and feedback-back. | `PERM-P0 Disabled` | `PERM-P2` approved read-only sandbox; no protected-class inference, certification, recruitment, consent, or individual scoring. |
| `AGT-06` | Portfolio, Funding & Dependency Orchestrator | Build aggregate portfolio scenarios, milestone/dependency maps, readiness gaps, and decision briefs. | `PERM-P0 Disabled` | `PERM-P2` approved metadata sandbox; no task assignment, funding submission, resource decision, or official-system write. |
| `AGT-07` | Innovation Experiment & Translation Planner | Use PROBE to draft non-production experiments, evidence thresholds, translation/scale questions, stop rules, and rollback plans. | `PERM-P0 Disabled` | `PERM-P3` institution-approved synthetic sandbox; no production or patient-facing deployment, procurement, or scale action. |
| `AGT-08` | Implementation, Value & Learning Analyst | Build traceable aggregate implementation/value/equity scenarios and balancing-measure questions. | `PERM-P0 Disabled` | `PERM-P3` approved aggregate/enclave-export sandbox; no care/workforce change, financial conclusion, or causal overclaim. |
| `AGT-09` | Human-Voice Dissemination & Integrity Assistant | Draft source-annotated plain-language options, limitations, disclosure/accessibility questions, and apply anti-slop checks. | `PERM-P0 Disabled` | `PERM-P2` approved read-only sandbox; no authorship decision, ghostwriting, confidential disclosure, external send, or publication. |
| `AGT-10` | Independent Agent Auditor & Kill Sentinel | Evaluate frozen agent versions against canonical positive/negative fixtures and prepare violation, kill, rollback, purge, and retirement evidence. | `PERM-P0 Disabled` | `PERM-P2` separate-control-plane read-only; no approval power and no ability to modify the tested agent or its receipts. |

The maximum is an upper bound, not a grant and not a recommendation to grant it. A run may be authorized below the maximum. `AGT-10` must stay on a separate control path, cannot audit itself, cannot approve release, cannot change the tested agent, and cannot modify the tested agent's receipts.

## 3. Permission and edition model

Keep installed state, requested permission, approved permission, canonical maximum, run state, and edition policy as separate fields.

| Level | Exact canonical meaning | Enforcement |
|---|---|---|
| `PERM-P0` | Disabled; installed state for all agents/connectors/actions | No inference, retrieval, tools, network, memory, destinations, model call, or background work. |
| `PERM-P1` | Local render and synthetic/public-source preview with no external write | D0 only; local draft; connector, destination, and external-write lists empty. |
| `PERM-P2` | Human-approved read-only bounded sandbox over exact allowed sources/metadata | One expiring, hash-bound run; no send, submit, publish, contact, official write, or consequential release. |
| `PERM-P3` | Institution-approved one-run sandbox over exact approved aggregates/enclave exports with ORBIT token and zero production writes | Institutional Edition only; exact D2 export evidence, partition, purpose, approver, limits, kill, and reconciliation required. |
| `PERM-P4` | Production, clinical, participant-facing, financial, submission, or external-write authority | **Not implemented in this product.** It cannot be enabled by configuration, prompt, role, plugin, or local acknowledgment. |

The effective permission is the most restrictive result across the agent maximum, human grant, active-hat authority, data class, partition, EDENA classification, Personal/Institutional Edition rule, FRAME result, source status, approved tools/destinations, backend capability, and every applicable deny rule. Missing, expired, unknown, conflicting, or unsupported values reduce permission or block; they never widen it.

Personal Edition cannot grant `PERM-P3`. A personal Red acknowledgment permits only clearly labeled sandbox exploration under the stricter canonical data/action ceiling; it never activates an agent, permits prohibited data, or authorizes external action. Institutional Red is a mandatory stop. EDENA never overrides the absence of `PERM-P4`.

## 4. Canonical agent state machine

Use the canonical `agent_state` values from `SCH-17 agent_charter_trace`:

`disabled → draft_charter → one_run_proposed → one_run_authorized → running → reconciled → disabled`

Also support `killed` and `retired`. A denied, expired, failed, interrupted, or mismatched run must not remain `running`. Invalid transitions fail closed and create a minimum nonsensitive control receipt.

Every proposed run must bind:

- the exact agent/version, model, system prompt, policy, input schema, output schema, input payload, and output-contract hashes;
- one objective, named accountable human owner, non-goals, active hat, authority source, and expiry;
- EDENA tier and explanation, FRAME result, allowed data classes, partition, purpose, and retention;
- exact source, tool, destination, and network allowlists;
- one invocation, zero retries, wall-clock/cost/input/output caps, and an expiring authorization token;
- positive, negative-boundary, authority-expiry, schema, reference-isolation, permission/action, resume, and reconciliation evidence;
- human checkpoints, kill route, final reconciliation owner, purge, rollback, and retirement path.

Any hash, authority, source, data, partition, tool, destination, model, policy, or capability mismatch returns `AGENT_RUN_BLOCKED_HASH_OR_AUTHORITY_MISMATCH`. No agent may approve, score as sole judge, modify, delegate to, reactivate, or retire itself.

## 5. Deterministic routing pipeline

Routing identifies a suggested bounded assistant; it does not execute one. Implement routing in ordinary application code before any model call:

1. Read the selected DISCOVER role dashboard, active hat, authority evidence/expiry, tenant or private partition, mission stage, canonical workflow, desired artifact, requested action, data class, edition, and EDENA tier.
2. Reject `DATA-DX-PROHIBITED` before persistence and reject any attempt to give an agent `DATA-D3-PRIVATE`.
3. Run FRAME where the activity boundary or authority may be uncertain. `MULTIPLE_OR_UNRESOLVED`, expired authority, or missing qualified destination prevents a run.
4. Resolve the exact `DSC-WF-*` selection. Ambiguous free text opens a workflow chooser or human clarification card; a model may not infer a consequential pathway.
5. Use the canonical routing table below. A P0 definition may display as `Suggested — disabled; charter and approval required`, but it is ineligible to run.
6. Apply the agent's canonical maximum, EDENA and edition behavior, data/partition policy, source/tool/destination allowlists, backend health, tests, expiry, and separation-of-duties rules.
7. Display a Routing Card: workflow, power, template/schema, suggested agent, why it matched, alternatives rejected, installed state, requested/maximum/effective permission, EDENA/FRAME results, allowed inputs/tools/destination, limits, human gate, and Stop/Kill controls.
8. Permit an explicit user override only among compatible agents. Require a reason and record both the automatic and chosen routes. An override never changes data, risk, authority, permission, workflow state, or ceiling.
9. Require a new, expiring one-run human authorization. Execute once, stream genuine backend/tool events, reconcile, purge temporary state, revoke the grant, and return to `disabled` unless `retired`.

If no canonical route is eligible, set `route=human_unassigned` and allow the user to continue the workflow manually without AI.

## 6. Canonical workflow-to-agent routing

Names and identifiers in this table are frozen source-pack identities. `Human-first` means the workflow remains fully available as a manual local form but no canonical agent is selected.

| Workflow | Exact canonical workflow name | Power and exact canonical name | Primary template / schema | Suggested route |
|---|---|---|---|---|
| `DSC-WF-01` / `WF-01` | Define My Research & Innovation Mission and 90-Day Focus | `PWR-01` — Mission, Impact & Research Leadership Compass | `TPL-01` / `leader_identity_authority_mission` | Human-first; authority and personal purpose require direct user authorship. |
| `DSC-WF-02` / `WF-02` | Frame an Unmet Need Without Locking in a Solution | `PWR-02` — Unmet Need & Opportunity Framing Studio | `TPL-02` / `opportunity_boundary_intake` | `AGT-01`, only for approved D0/D1 opportunity/evidence questions. |
| `DSC-WF-03` / `WF-03` | Compare Portfolio Options and Prepare a Stop/Continue Decision | `PWR-03` — Portfolio Prioritization & Stop/Continue Navigator | `TPL-03` / `portfolio_decision_orchestration` | `AGT-06`; output is a scenario and human decision queue, never the decision. |
| `DSC-WF-04` / `WF-04` | Route a Research–QI–Clinical–Innovation Boundary Question | `PWR-04` — Research–QI–Clinical–Innovation Boundary Navigator | `TPL-04` / `opportunity_boundary_intake` | `AGT-02`; possible routes only, never a status determination. |
| `DSC-WF-05` / `WF-05` | Build a Reproducible Evidence and Integrity Trace | `PWR-05` — Research Integrity, Reproducibility & Provenance Studio | `TPL-05` / `evidence_provenance` | `AGT-01`; exact source allowlist and TRACE required. |
| `DSC-WF-06` / `WF-06` | Map Data, Privacy, Rights, Retention and IP Questions | `PWR-06` — Data, Privacy, Rights & IP Governance Mapper | `TPL-06` / `data_rights_governance` | `AGT-02`; questions and routes only, no legal or rights conclusion. |
| `DSC-WF-07` / `WF-07` | Draft a Study Concept and Compare Design Options | `PWR-07` — Study Concept & Design Options Architect | `TPL-07` / `study_concept_design` | `AGT-03`; `TPL-08` may support human comparison of bias/validity. |
| `DSC-WF-08` / `WF-08` | Prepare Feasibility, Burden and Safety Readiness Questions | `PWR-08` — Feasibility, Participant Burden & Safety Readiness Lens | `TPL-09` / `feasibility_safety_readiness` | `AGT-05`; never handles a safety narrative or decides feasibility/safety. |
| `DSC-WF-09` / `WF-09` | Define Outcomes, Measures and Analysis Intent Before Results | `PWR-09` — Outcomes, Measures & Analysis-Intent Studio | `TPL-10` / `measurement_analysis_intent` | `AGT-04`; P3 requires an institution-approved aggregate export. |
| `DSC-WF-10` / `WF-10` | Plan Reciprocal Participant, Patient and Community Co-Design | `PWR-10` — Participant, Patient, Community & Workforce Co-Design Planner | `TPL-11` / `engagement_collaboration_plan` | `AGT-05`; planning only, no identities, contact, recruitment, consent, or promises. |
| `DSC-WF-11` / `WF-11` | Design the Team RACI, Expertise, Partnership and Conflict Map | `PWR-11` — Scientific Team, Partnership, RACI & Conflict Navigator | `TPL-12` / `engagement_collaboration_plan` | `AGT-06`; no authorship, conflict, partner, contract, or personnel decision. |
| `DSC-WF-12` / `WF-12` | Prepare a Funding, Grant or Sponsor Readiness Brief | `PWR-12` — Funding, Grant & Sponsor Readiness Studio | `TPL-13` / `funding_partnership_readiness` | `AGT-06`; readiness draft only, no submission, certification, or commitment. |
| `DSC-WF-13` / `WF-13` | Orchestrate Portfolio Milestones, Dependencies and Decision Gates | `PWR-13` — Portfolio Milestone, Dependency & Decision Orchestrator | `TPL-14` / `portfolio_decision_orchestration` | `AGT-06`; no assignment, deadline promise, escalation, or system write. |
| `DSC-WF-14` / `WF-14` | Prepare Governance and Submission Readiness Without Submitting | `PWR-14` — Governance & Submission-Readiness Navigator | `TPL-15` / `governance_submission_readiness` | `AGT-02`; formal reviewers decide; external submission does not exist. |
| `DSC-WF-15` / `WF-15` | Compare Site, Vendor, Technology and Pilot Readiness | `PWR-15` — Site, Vendor, Technology & Pilot Readiness Studio | `TPL-16` / `feasibility_safety_readiness` | `AGT-06`; comparison only, including the no-pilot/no-purchase option. |
| `DSC-WF-16` / `WF-16` | Design a Bounded Non-Production Innovation Experiment | `PWR-16` — Innovation Assumption & Bounded Experiment Lab | `TPL-17` / `innovation_validation_experiment` | `AGT-07`; synthetic/non-production PROBE only. |
| `DSC-WF-17` / `WF-17` | Build Value, Economics, Equity and Burden Scenarios | `PWR-17` — Value, Health-Economics, Equity & Burden Scenario Studio | `TPL-18` / `value_translation_scenario` | `AGT-08`; traceable ranges only, no financial conclusion or action. |
| `DSC-WF-18` / `WF-18` | Map Translation, Commercialization and Scale/Stop Gates | `PWR-18` — Translation, Commercialization & Scale/Stop Pathway Architect | `TPL-19` / `value_translation_scenario` | `AGT-07`; maps formal human gates, never launches or scales. |
| `DSC-WF-19` / `WF-19` | Create an Evidence Landscape and Reproducible Horizon Scan | `PWR-19` — Evidence Landscape, Systematic Search & Horizon-Scan Navigator | `TPL-20` / `evidence_provenance` | `AGT-01`; exact sources, contradictions, corrections, gaps, and expiry visible. |
| `DSC-WF-20` / `WF-20` | Plan Implementation, Adoption Evaluation and Responsible Withdrawal | `PWR-20` — Implementation Science, Adoption & Learning-System Studio | `TPL-21` / `implementation_evaluation` | `AGT-08`; no change to care, staffing, policy, alerts, or performance monitoring. |
| `DSC-WF-21` / `WF-21` | Prepare a Human-Voice Dissemination or Evidence-to-Decision Package | `PWR-21` — Dissemination, Publication & Evidence-to-Decision Studio | `TPL-22` / `dissemination_output_plan` | `AGT-09`; draft only, with provenance, limits, disclosure, and release route. |
| `DSC-WF-22` / `WF-22` | Charter and Evaluate One Bounded AI-Agent Run | `PWR-22` — Responsible AI Use-Case, Agent & Model Governance Command | `TPL-23` / `agent_charter_trace` | Human ORBIT owner charters; `AGT-10` may independently evaluate but never approve or modify. |
| `DSC-WF-23` / `WF-23` | Build My Research Leadership, Capability and Succession Plan | `PWR-23` — Research Leadership, Capability, Career & Succession Builder | `TPL-24` / `leader_identity_authority_mission` | Human-first; no employee scoring, credential claim, promotion, compensation, or surveillance. |
| `DSC-WF-24` / `WF-24` | Create My Private Whole-Life Purpose and Renewal Plan | `PWR-24` — Whole-Life Purpose, Capacity & Renewal Navigator | `TPL-25` / `whole_life_private` | Owner-only and agent-free. Never place `DATA-D3-PRIVATE` in Hermes or agent context. |

Additional canonical templates remain available without changing routing: `TPL-08` Design Options, Bias and Validity Canvas; `TPL-26` Participant Rights and Consent Question Set; `TPL-27` Data Management, Retention and Sharing Plan; `TPL-28` Source, Policy, Registry and Obligation Watch Card; `TPL-29` Decision, Approval, Exception and Escalation Receipt; and `TPL-30` After-Action, Learning and Closeout Record.

## 7. Four prominent launchers and six launcher groups

Preserve the four canonical Preview launchers:

1. **Frame a Research or Innovation Question** → `DSC-WF-04`.
2. **Build an Evidence and Source Brief** → `DSC-WF-19`.
3. **Review Portfolio, Authority, and Decision Readiness** → `DSC-WF-03`.
4. **Design a Translation or Adoption Experiment** → `DSC-WF-16`.

Preserve the six canonical launcher groups:

1. Direction & Portfolio — `DSC-WF-01`, `02`, `03`, `13`.
2. Boundaries & Governance — `DSC-WF-04`, `05`, `06`, `14`.
3. Study & Operational Readiness — `DSC-WF-07`, `08`, `09`, `15`.
4. People, Partners & Resources — `DSC-WF-10`, `11`, `12`, `23`.
5. Innovation, Value & Translation — `DSC-WF-16`, `17`, `18`, `20`.
6. Evidence, Dissemination & Renewal — `DSC-WF-19`, `21`, `22`, `24`.

Every launcher remains `Preview Only`. Opening a launcher does not call a model, activate an agent, create an approval, perform research, contact a person, write an official system, or take an external action.

## 8. Override and multi-agent behavior

Every AI-eligible workflow must offer:

- `Auto — deterministic route`;
- each compatible agent, with disabled/ineligible agents visible but unavailable and a plain-language reason;
- `Continue without AI`; and
- an explicit, reasoned override control.

Selecting a disabled agent opens only its definition, proposed charter, tests, and authorization checklist. An override receipt records the canonical route, chosen route, reason, user/active hat, EDENA tier, data class, edition, permission, and timestamp. It cannot bypass FRAME, EDENA, data/partition policy, agent maximum, source status, approval, backend health, or separation of duties.

Do not make a multi-agent graph the first-run default. A graph is eligible only after each agent has independently passed at the requested permission; each node and edge has a closed input/output contract, owner, data class, budget, expiry, stop/kill path, and human checkpoint; the whole graph is approved; no agent can add an agent/tool/destination/permission; and `AGT-10` remains independent rather than orchestrating. Prefer sequential human-reviewed handoffs. Fan-out, recursive delegation, hidden sub-agents, silent retries, and background continuation are prohibited.

## 9. Runtime transparency and receipts

The Agent Console must show backend health, profile/model without secrets, workflow/power/template/schema, route reason, agent and version, EDENA/FRAME results, active hat/authority expiry, permission/maximum, data class/partition, exact approved sources/tools/destinations, budget/expiry, genuine streaming/tool state, pending human checkpoint, and visible Stop, Cancel, Pause All, Kill, purge, and reconciliation controls.

Do not expose chain-of-thought. Show concise decision summaries, verified source facts, assumptions, unresolved questions, limits, and control reasons.

Every route and run receipt binds the mission/artifact/workflow/power/template/schema IDs; exact agent/config/model/backend hashes; automatic and overridden routes; active hat/authority; edition; EDENA/FRAME/ORBIT evidence; data/source/tool/destination boundaries; input/output hashes rather than sensitive audit copies; start/end/cost/termination; human decisions; before/after hashes; rollback/purge/correction references; and `no_background_work_remaining` verification. A receipt proves a software event, not HRO/IRB status, compliance, validity, safety, publication quality, funding authority, or institutional approval.

## 10. Required verification

Tests must prove at minimum:

1. exactly ten canonical agents install `PERM-P0 Disabled` with the maxima above;
2. all 24 powers remain `Available Inactive`, all 24 workflows remain `Preview Only`, and no launcher calls a model;
3. all 24 canonical workflow routes are deterministic, including the three human-first paths and the special independent-audit boundary for `DSC-WF-22`;
4. overrides cannot widen authority, data, partition, risk, edition, permission, source, tool, destination, or action scope;
5. `DATA-D3-PRIVATE` never reaches an agent and `DATA-DX-PROHIBITED` is rejected before persistence;
6. Personal Edition cannot issue P3 and Institutional Red cannot run;
7. P2/P3 require an expiring one-run token with exact hashes, one invocation, zero retries, and final reconciliation;
8. no agent self-activates, self-approves, self-modifies, recursively delegates, schedules, retries, or continues in the background;
9. `AGT-10` stays independent and cannot alter the tested agent or approve release;
10. offline mode performs no model/tool calls and presents no simulated AI, citations, approvals, or tool events;
11. Stop, Pause All, Kill, expiry, purge, rollback, retirement, resume, and orphan cleanup work across UI and trusted-server paths;
12. all 160 canonical release/runtime criteria have executed passing evidence before S2 activation; and
13. keyboard and screen-reader users can inspect, approve, interrupt, and review every route and agent state.

Activation is blocked if a required control is missing, unsupported, decorative, client-only, or untested on the production path.
