# DISCOVER Healthcare Research & Innovation Leader Mission Control — Product Specification

## Product identity

- **Name:** DISCOVER — Healthcare Research & Innovation Leader Mission Control
- **Target product ID:** `discover-healthcare-research-innovation-leader-mission-control`
- **Target application version:** `2.0.0`
- **Canonical source product:** `HRIL-AIOS-DISCOVER-COMPLETE-1.0`
- **Hermes lane:** `healthcare_research_innovation_leadership`
- **Canonical route:** `/healthcare-research-innovation-leaders/dashboard`
- **Only alias:** `/healthcare-research-innovation-leaders/mission-control`
- **Namespace:** `research_innovation_discover.*`
- **Home:** My DISCOVER Mission Control
- **Primary mode:** Private Research & Innovation Leader OS
- **Distribution:** a downloadable local full-stack web application in a versioned ZIP, bound to loopback and packaged with tested launchers

The lane root `/healthcare-research-innovation-leaders` may only redirect to the canonical dashboard after route verification. No global `/dashboard` or `/mission-control` alias may be registered. The parent Nurse AI OS card receives only the product/version, coarse state and approved deep link—never underlying research content, private goals, memory, agents, permissions or traces.

## Purpose and boundary

DISCOVER helps healthcare research and innovation leaders turn questions, evidence, opportunities, constraints and aspirations into governed missions, reviewable artifacts, bounded experiments, portfolio decisions and repeatable learning cycles. It supports research direction, inquiry integrity, study-design reasoning, participant/community dignity, collaboration, portfolio/resource planning, responsible innovation, implementation, dissemination, capability development and whole-person renewal.

It prepares, compares, rehearses, drafts, tracks and evaluates. It is not an IRB, HRPP, privacy board, EHR, CTMS, EDC, eConsent, safety-reporting system, regulatory authority, grant-submission portal, finance/procurement system, patent or legal service, clinical decision system or autonomous research operator. It never determines `NOT_RESEARCH`, `EXEMPT`, `IRB_NOT_REQUIRED`, `FDA_NOT_REGULATED`, consent status, HIPAA compliance, scientific validity or clinical appropriateness.

## DISCOVER groups and operating core

The six canonical groups organize 24 SuperPowers, 24 paired workflows, 30 templates and 18 closed domain schemas:

1. **D — Direction, Discovery & Dignity**
2. **I — Inquiry, Integrity & Information Stewardship**
3. **S — Study Design, Safety & Scientific Rigor**
4. **C — Collaboration, Community & Capability**
5. **OV — Operations, Value & Translation**
6. **ER — Evidence, Responsible Innovation & Renewal**

Every mission may invoke the four domain routines without weakening the five-stage improvement loop:

- **FRAME:** clarify function, rights/risks/burden, authority, methods/data/systems and external use; output routes and questions, never a formal determination.
- **TRACE:** bind claims to source identity, version, status, relevance, contradictions, uncertainty, reviewer and expiry.
- **PROBE:** compare status quo, nontechnology and technology options and design the smallest bounded, reversible, non-production test.
- **ORBIT:** constrain every agent by objective, owner, rights, tools, destinations, time/cost, frozen instructions, tests, human decision, kill and receipt.

EDENA is applied across all four routines using Green, Yellow, Orange, Red and Unclassified. It adds classification, warnings, acknowledgments, review requirements and institutional stops; it does not replace domain gates or create authority. In the Personal Edition, an acknowledged Red request may proceed only as an allowed synthetic/abstract hypothetical, simulation or draft when no prohibited data/action, safety exit, expired authority or partition violation is present. In the Institutional Edition, Red is a mandatory stop. No EDENA acknowledgment or institutional approval can override an absolute input/action ceiling in this target.

## Intended users and contexts

First run supports separately isolated workspaces for:

- academic medical-center research offices;
- health-system innovation and learning-health-system offices;
- community hospitals, clinics, FQHCs, rural and safety-net settings;
- clinical research units and trial networks;
- nursing, allied-health and interprofessional research programs;
- public/population-health programs;
- digital-health, data-science and responsible-AI labs;
- academic–industry, startup and vendor collaborations;
- multi-site consortia and research networks;
- sponsored-research, grant and portfolio leadership; and
- a separately consented owner-only private purpose, career and renewal workspace.

One user may activate several workspaces, but exactly one active hat governs each mission. Organizational and owner-private records remain separate. A title, degree, license, investigator status or system access never proves decision authority. Cross-workspace reuse requires a typed, versioned, hash-bound, purpose-bound export/import—not a browser filter.

## First-run personalization

If no approved derived Discover Packet or Soul result exists, ask the minimum safe questions and permit `Unknown`:

- preferred display name and exact current role/active hat;
- setting and selected workspaces;
- authority source, scope, threshold and expiry;
- mission, values, ethical red lines and non-goals;
- current priorities, desired impact and 90-day focus;
- strengths, growth areas and situation context;
- learning, communication, decision and accessibility preferences;
- data ceiling, risk posture and required human reviewers;
- memory consent, retention and owner-private partition choice; and
- desired AI support, while leaving every agent Disabled.

Show a proposed Mission Profile with field-level provenance, confidence/uncertainty and conflicts. The user can edit, reject, approve, export or delete it. Persist only the approved derived profile. Never store raw Soul Quiz answers, a raw Discover interview, or a duplicate of Hermes `SOUL.md`.

On approval, create role-specific workspaces and clearly labeled Starter missions from the deterministic crosswalk. Starters never invent a study, participant population, authority, approval, partner, source, finding, budget or outcome. They remain excluded from operational metrics and badge evidence until deliberately adopted, materially completed, evaluated and reviewed.

## Information architecture

### Home / My DISCOVER Mission Control

- permanent Personal/Institutional edition and data-boundary banner;
- identity, active hat, authority source/expiry, workspace and owner-private state;
- Hermes connection, EDENA and Pause All/Kill state;
- four bounded Preview launchers: Frame a Research or Innovation Question; Build an Evidence and Source Brief; Review Portfolio, Authority and Decision Readiness; Design a Translation or Adoption Experiment;
- six launcher groups matching the six DISCOVER groups;
- deterministic attention queue capped at seven, with blocked/expired first, then due time, then immutable ID;
- current priorities, missions, next decisions, reviews, source-freshness alerts and progress; and
- quick capture, Continue Last Session and setup checklist.

### Missions, projects and the improvement loop

Every mission stores workspace, active hat, authority, purpose, desired outcome, scope/non-goals, data ceiling, current stage, evidence, facts/assumptions/unknowns, measures, tasks, decisions, risks, reviews, references, artifacts and append-only history. The five stages—Assess → Diagnose/Define → Plan → Implement → Evaluate—are stateful, revisable and repeatable. A material earlier-stage revision invalidates affected downstream approval and visibly reopens review.

Users can create, edit, duplicate, pause, archive, restore and delete missions; manage full project/task/note/decision/measure/reference CRUD; begin a new cycle; and import/export permitted records. The complete core works offline.

### Sandboxed Solution Laboratory

Support exploration, simulation, comparison, premortem, prototype, recommendation, draft artifact, approved plan, authorized execution, completed action and evaluated outcome as distinct states. Only the first six exist by default inside the personal sandbox. No interface label may imply that a preview was submitted, approved, deployed or implemented.

### DISCOVER Studios

Expose the canonical 24 powers, 24 workflows, 30 templates and 18 schemas with stable IDs. Every power begins `Available Inactive`; every workflow begins `Preview Only`. Preview and one-run activation are separate. Activation requires an owner, active hat, authority, data/tool/destination limits, applicable FRAME/TRACE/PROBE/ORBIT and EDENA outcome, expiry, time/cost/retry limit, human gate, safe exit and receipt. It returns to Inactive after review.

### Evidence and Source Center

Store user references and permitted retrieval records with exact source identity, version/date/status, jurisdiction/scope, claim mapping, method/population, applicability, contradictions/corrections/retractions, uncertainty, freshness, reviewer and expiry. Distinguish verified fact, user-provided information, AI synthesis, assumption and unresolved question. Render citations only from genuine retrieval; treat retrieved instructions as untrusted content.

### Agent Console

Show exactly 10 frozen agents with routing reason, objective, selected workspace, data ceiling, permission, tools, events, approvals, budgets, session, Stop/Kill and retirement state. They install `PERM-P0 Disabled`. Selecting an agent or workflow never grants permission. No self-activation, recursion, hidden retry, background work, permission widening or external action exists.

### Capabilities and Mastery

Track Basic, Intermediate and Advanced development across 17 capability domains plus the global AI Agent Orchestration Master capstone. Awards require observable, current, inspectable evidence and named-human review. Clicks, demos, Starter completion, AI self-assessment, titles and synthetic outcomes never earn badges. Badges never imply licensure, certification, CE credit, IRB status, investigator authority, scientific validity or permission to practice.

### Memory, data controls and private life

Each structured memory item shows source, purpose, consent, creation time, expiry and retention. Support inspect, edit, forget, delete and export. Session-only is default. The optional owner-private partition is owner-only, separately consented, separately deletable and excluded from tenant analytics, organizational exports, parent Mission Control and performance inference.

### Guide, diagnostics and recovery

Include the full Guide and walkthrough, role/active-hat explanation, five-stage loop, domain routines, EDENA edition behavior, agent controls, badge rules, data/authority boundaries, backup/update/rollback/uninstall and redacted diagnostics.

## Data and action invariants

Private mode accepts public, synthetic and owner-authored nonsensitive planning content. Separately approved aggregate or enclave-export material requires an explicit institutional policy profile. Reject prohibited input before persistence and without echoing it into logs, errors, memory, evidence, badges, exports or receipts.

The target product has no external send, submit, publish, recruit, enroll, consent, schedule, randomize, intervene, deploy, purchase, spend, sign, file, register or official-system write in either edition. Institutional policy may impose stronger stops and may authorize promotion among otherwise allowed internal states; it cannot configure `PERM-P4` or create an absent external action. Any future action-capable product is a separate design, threat model, build and authorization—not a setting in this release.

## Offline and connected truthfulness

Without AI, all mission/project records, loop transitions, Starter controls, search/filter/sort, evidence capture, Guide, capability calculations, backup/export/import/restore/delete and diagnostics remain useful. AI controls show `Setup required`, `Offline` or another verified state.

Connection labels derive from authenticated recent checks: Connected, Connecting, Setup required, Offline, Authentication failed, Hermes unavailable, Provider unavailable, Limited capabilities or Reconnecting. A timer, saved URL or successful page load never creates Connected. Production has no fake-response fallback.

## Success measures

The final release succeeds only when a nondeveloper can install it, visible controls are real or truthfully disabled, durable state survives restart, workspaces and partitions reject cross-boundary access, a real selected agent changes server instructions, Stop cancels a genuine stream, no secret reaches the browser/export, citations have verified provenance, memory is consent-controlled and deletable, FRAME–TRACE–PROBE–ORBIT plus EDENA behave consistently, and all 371 required execution records—171 matrix-control tests, 40 cross-cutting scenarios and the original 160-criterion corpus suite—have the evidence required by the acceptance ledger. The final readiness statement must match those results.
