# DISCOVER Governance, EDENA, and Data Boundaries

## Implementation contract for Hermes

**Canonical product:** DISCOVER — Healthcare Research & Innovation Leader Complete AI OS  
**Program ID:** `HRIL-AIOS-DISCOVER-COMPLETE-1.0`  
**Governing principle:** DISCOVER prepares bounded questions, evidence traces, scenarios, previews, and human-review routes; accountable humans and official systems determine, authorize, execute, and record.  
**Persistent boundary:** planning, sandbox, and preview—not live clinical, participant, research, regulatory, financial, procurement, publication, safety, or production control.  
**Safe installation state:** powers `Available Inactive`; workflows `Preview Only`; agents `PERM-P0 Disabled`; connectors/actions Off.

Implement governance as trusted application logic shared by every form, import, attachment, retrieval, AI prompt/response, tool request/result, artifact transition, export, backup, badge, log, and Hermes handoff. A warning on the Guide page is not enforcement. Client-side checks may improve usability, but all state-changing requests must be rechecked by the trusted local service.

## 1. Frozen product, lane, route, and partition contract

| Contract | Exact canonical value |
|---|---|
| Product | DISCOVER — Healthcare Research & Innovation Leader Complete AI OS |
| Product ID | `HRIL-AIOS-DISCOVER-COMPLETE-1.0` |
| Foundation / overlay | `HRIL-AIOS-LIFE-LEADERSHIP-1.0` / `HRIL-AIOS-DISCOVER-1.0` |
| Lane | `healthcare_research_innovation_leadership` |
| Root | `/healthcare-research-innovation-leaders` |
| Dashboard | `/healthcare-research-innovation-leaders/dashboard` |
| Only alias | `/healthcare-research-innovation-leaders/mission-control` |
| Namespace | `research_innovation_discover.*` |
| Home | My DISCOVER Mission Control |

Do not create global `/dashboard` or `/mission-control` aliases. The lane root may redirect only to its fully qualified dashboard after collision and route verification.

The exact tenant partitions are:

- `research_innovation_discover.tenant.<tenant_id>.governance`
- `research_innovation_discover.tenant.<tenant_id>.portfolio`
- `research_innovation_discover.tenant.<tenant_id>.evidence`
- `research_innovation_discover.tenant.<tenant_id>.sandbox`
- `research_innovation_discover.tenant.<tenant_id>.controls`

The optional private partition is `research_innovation_discover.private.owner.<owner_id>`. References are typed, versioned, partition-bound, and hash-bound. A reference never grants dereference permission. Every cross-partition request must block before lookup or dereference with zero field disclosure.

The parent Nurse AI OS card may receive only product/version, coarse state (`INSTALLED`, `NEEDS_ATTENTION`, `PAUSED`, or `QUARANTINED`), and the verified lane deep link after explicit approval. It receives no study titles, questions, partners, findings, funding/IP information, private goals, schemas, permissions, memory, agents, traces, or underlying records.

## 2. Six canonical DISCOVER pillar modules

Preserve the six source-pack modules and their exact power ranges:

| Module | Exact canonical name | Powers |
|---|---|---|
| D | Direction, Discovery & Dignity | `PWR-01`–`PWR-03` |
| I | Inquiry, Integrity & Information Stewardship | `PWR-04`–`PWR-06` |
| S | Study Design, Safety & Scientific Rigor | `PWR-07`–`PWR-09` |
| C | Collaboration, Community & Capability | `PWR-10`–`PWR-12` |
| OV | Operations, Value & Translation | `PWR-13`–`PWR-18` |
| ER | Evidence, Responsible Innovation & Renewal | `PWR-19`–`PWR-24` |

There are exactly 24 powers, 24 workflows, 30 templates, 18 closed schemas, ten optional agents, ten synthetic fixtures/adapters, and 160 release/runtime criteria. A role dashboard changes presentation and recommended starting points; it never changes these identities or widens authority.

## 3. Composition of DISCOVER controls

The five-stage mission loop, canonical routines, and EDENA have different jobs. Compose them; do not replace one with another.

1. **Identity and context** — select role dashboard and active hat; bind entity/site/project, jurisdiction, authority source/expiry, edition, partition, intended artifact, requested action, and human decision owner.
2. **Prohibited-input screen** — reject `DATA-DX-PROHIBITED` before persistence, indexing, logs, prompt assembly, or agent routing.
3. **EDENA** — classify the mission, artifact, import/export, AI request, tool request, and handoff as `unclassified`, `green`, `yellow`, `orange`, or `red` and apply the edition-specific response.
4. **Assess** — use FRAME to establish purpose, rights/risk/burden, authority, methods/data/systems, external use, and unresolved exceptions; use TRACE to establish exact sources, status, applicability, limits, conflicts, corrections, and expiry.
5. **Diagnose or Define** — retain only permitted possible-pathway labels, expose root assumptions and knowledge gaps, and use PROBE to define the human problem, non-goals, constraints, and alternatives. DISCOVER never determines regulatory, legal, clinical, privacy, or research status.
6. **Plan** — compare status quo, nontechnology, and technology options; define measures, owners, qualified review routes, safeguards, pre-mortem, smallest reversible test, stop/rollback conditions, and evaluation criteria.
7. **Implement** — produce a local, schema-valid, clearly labeled preview or draft. If AI is proposed, ORBIT must freeze and test one bounded run. External action remains absent.
8. **Evaluate** — compare outcomes with the stated objective, record uncertainty/harms/burden/deviations, reconcile any human action to an official reference, correct or retire stale evidence, emit `control_audit_receipt`, and feed learning into the next Assess stage.

The most restrictive result across identity/authority, prohibited-input screening, FRAME, EDENA, data class, partition, source status, agent maximum, ORBIT, destination policy, edition, and institutional policy controls every transition. One control can narrow another; none can widen a stricter boundary.

## 4. FRAME — boundary and authority checkpoint

Preserve the exact canonical routine:

- **F** — intended function and primary purpose;
- **R** — rights, risks, and burden;
- **A** — active hat, authority, and required reviews;
- **M** — methods, intervention, identifiability, and systems touched; and
- **E** — external use, evidence claim, product intent, and unresolved exceptions.

FRAME produces possible routes and questions only. The only permitted pathway statuses are:

- `HUMAN_SUBJECTS_RESEARCH_POSSIBLE`
- `QI_PROGRAM_EVALUATION_POSSIBLE`
- `CLINICAL_CARE_OPERATIONS_POSSIBLE`
- `INNOVATION_PRODUCT_REVIEW_POSSIBLE`
- `MULTIPLE_OR_UNRESOLVED`

It never outputs `NOT_RESEARCH`, `EXEMPT`, `IRB_NOT_REQUIRED`, `FDA_NOT_REGULATED`, `HIPAA_COMPLIANT`, consent status, clinical appropriateness, or any equivalent authoritative conclusion. Missing/conflicting facts, expired authority, unreviewed local policy, or multiple plausible paths require `MULTIPLE_OR_UNRESOLVED`, the missing evidence, and a named authoritative human destination.

## 5. TRACE — evidence and provenance routine

Preserve the exact canonical routine:

- **T** — exact thesis or claim;
- **R** — source identity, version, date, population, methods, and status;
- **A** — relevance, limits, bias, uncertainty, and applicability;
- **C** — contradictions, conflicts, retractions, corrections, and gaps; and
- **E** — bind interpretation, decision, expiry, and human reviewer.

A URL is not evidence by itself. Record publisher, exact title, canonical reference, version/date, retrieved date, authority type, legal status, stability, current-version status, scope, supported claim, limits, conflicts, reviewer, and expiry as separate fields. Draft, proposed, superseded, retracted, corrected, conflicted, unknown, or not-locally-reviewed status remains visible and can block promotion.

Never fabricate a source, citation, quote, consensus, requirement, result, credential, approval, or official outcome. Do not bypass paywalls or copyright restrictions. A polished draft is never an official record.

## 6. PROBE — responsible innovation routine

Preserve the exact canonical routine:

- **P** — human problem and non-goals;
- **R** — rights, risk, burden, equity, privacy, and constraints;
- **O** — status quo, nontechnology, and technology options;
- **B** — smallest bounded, reversible, non-production test; and
- **E** — evaluation, escalation, exit, rollback, and scale/stop ownership.

PROBE supports synthetic or non-production learning. It cannot authorize a live clinical experiment, patient-facing deployment, care A/B test, production feature flag, human-subject interaction, tracking deployment, procurement, commercialization, or automatic winner/scale decision.

## 7. ORBIT — AI-agent control routine

Preserve the exact canonical routine:

- **O** — objective and owner;
- **R** — role, rights, rules, and restricted data;
- **B** — bounded tools, destinations, time, cost, inputs, outputs, and retries;
- **I** — inspect frozen prompt, model, policy, and schema hashes with fixtures; and
- **T** — test, human decision, reconcile, kill/retire, and tamper-evident receipt.

All ten agents install `PERM-P0 Disabled`. ORBIT produces evidence for a separate expiring one-run proposal; it does not activate an agent. No self-activation, self-modification, hidden sub-agent, recursion, hidden retry, schedule, background work, permission widening, production write, or self-approval is allowed.

## 8. EDENA advisory and enforcement model

Classify every governed mission, artifact, import, export, AI request, tool call, and external handoff using the closed values `unclassified`, `green`, `yellow`, `orange`, and `red`. `unclassified` cannot proceed beyond local drafting.

| Tier | Meaning | Minimum response |
|---|---|---|
| **Green** | Low-risk, bounded, reversible work using public, synthetic, or owner-created nonsensitive information | Show AI/draft disclosure and source-verification reminder; ordinary human review before use. |
| **Yellow** | Material professional, academic, organizational, reputational, privacy, equity, resource, or evidence-quality implications | Prominent advisory, named reviewer, explicit review criteria, and confirmation before promotion or handoff. |
| **Orange** | High-impact, sensitive, difficult-to-reverse, cross-functional, aggregate-data-dependent, or institution-dependent work | Confine to sandbox/recommendation; require qualified owner, formal route, enhanced evidence, pre-mortem, fallback, monitoring, and any institutional authorization before promotion. |
| **Red** | Prohibited data/action; emergency or live safety concern; unauthorized, participant-facing, clinical, production, rights-affecting, externally consequential, or extreme-risk request; or institutional mandatory-stop condition | Prominent high-risk warning, concern, safer abstraction, expert/official route, and edition-specific behavior below. Never represent the output as approved, validated, authorized, or safe for direct use. |

EDENA is a risk signal and policy trigger. It does not grant authority, data access, competence, agent permission, institutional approval, research status, clinical validity, or legal sufficiency. Green never overrides FRAME uncertainty or a prohibited action.

### Personal Edition

- Green and Yellow may remain in the owner's sandbox subject to their review requirements.
- Orange may be explored, simulated, compared, or drafted with only allowed D0/D1 inputs. Promotion beyond recommendation requires the named qualified/institutional review.
- Red is never silently suppressed. Show the reason and safer routes. If the request itself is Red but contains no prohibited data, deliberate acknowledgment may open only a clearly labeled synthetic/abstract hypothetical, simulation, or draft.
- Actual `DATA-DX-PROHIBITED` is still rejected before persistence; personal acknowledgment cannot retain it. Offer a cleaned, abstracted, or synthetic restart without echoing unsafe content.
- Connected execution, P3, P4, external release, participant contact, and claims of approval remain blocked. Acknowledgment is not institutional authorization, legal review, clinical validation, IRB/HRO determination, financial approval, IP clearance, or permission to use sensitive data.

### Institutional or Departmental Edition

- Institutional policy, access control, data-use agreements, contracts, audit rules, official systems, qualified approval paths, and deny rules take precedence over personal preferences.
- Yellow requires the configured reviewer/evidence before promotion.
- Orange remains inside the specifically approved sandbox/workflow until the required offices and owners approve the defined next state.
- Red is a mandatory stop. DISCOVER may show the concern and official route, but processing/execution remains blocked until the exact required review or authorization is recorded.
- Even after institutional review, an activity requiring P4, person-level data, production write, participant contact, clinical action, submission, publication, transaction, or another absent capability must leave DISCOVER and occur through the authorized human/official system. The base product never executes it.
- Unsupported enforcement, logging, cancellation, kill, purge, reconciliation, or review capability is a blocker, not a warning.

## 9. Data-class ceiling

| Class | Canonical allowed use | Required enforcement |
|---|---|---|
| `DATA-D0` | Public authoritative sources, synthetic fixtures, and synthetic scenarios | Verify source status and label synthetic content; no inferred permission to act. |
| `DATA-D1` | Approved internal policies, protocols, portfolio metadata, process definitions, and nonsensitive organizational facts | Exact owner/purpose/partition and current authority; prohibit person-level/confidential narrative. |
| `DATA-D2` | Human-approved aggregates or enclave-derived aggregate exports | Require source system, query/version, suppression method and minimum cell size, export approval/owner/date/expiry, and exact export hash. Prepared and approved outside DISCOVER. |
| `DATA-D3-PRIVATE` | Owner-entered life/career/purpose information in `SCH-16` only | Owner-only private partition; no agent, tenant access, parent reference, analytics, training, export, or separate control receipt. |
| `DATA-DX-PROHIBITED` | Direct identifiers, PHI/PII, person-level rows/narratives, credentials/secrets, and other prohibited content | Reject before persistence, echo, indexing, embedding, retrieval, prompt assembly, logging, backup, or export; prove zero retention. |

“Deidentified,” “limited,” “coded,” “anonymous,” “redacted,” or “public” labels do not create ingestion permission. The base lane accepts no row-level person data in either edition. Approved aggregate/enclave exports must be created and approved outside DISCOVER. Small-cell suppression and source/export evidence are mandatory.

### Reject before persistence

Reject:

- direct identifiers, PHI, substantive/direct PII, patient/participant rows, identities, contact/recruitment/screening/consent/scheduling/payment records;
- person-linked biospecimen, genomic, imaging, device, sensor, safety-event, complaint, clinical-note, or raw qualitative narrative/quotation data;
- raw patient, participant, workforce, learner, applicant, source-system, sponsor-confidential, vendor-confidential, contract-confidential, or other confidential free text;
- employee-level, applicant, credentialing, performance, disciplinary, accommodation, labor, or individual scoring records;
- payment/account/bank/payroll/transaction information, credentials, secrets, tokens, vulnerabilities, security-sensitive configuration, or access-control data;
- export-controlled/restricted security data, privileged invention material, unapproved confidential inventions, or uncontrolled model-training data; and
- raw documents accepted merely because a user labels them deidentified or redacted.

Leader-authored D0/D1 planning narrative is allowed only after the prohibited-input screen and may not contain another person's substantive data. Unsafe content must not be echoed into warnings, logs, receipts, analytics, badges, prompts, exports, or support bundles.

The only identifier exception is the canonical opaque platform principal-ID envelope for required `owner_id`, `reviewer_id`, approver IDs, and ACL `principal_id`. These may contain only tenant-local opaque identifiers. They permit no name/contact/profile fields, external dereference, analytics, export, linkage, or identity inference.

## 10. Owner-only whole-life boundary

`PWR-24`, `DSC-WF-24`, `TPL-25`, and `SCH-16 whole_life_private` operate only in `research_innovation_discover.private.owner.<owner_id>` with `active_hat=private_individual`. At runtime require `owner_id == sole ACL principal_id == partition owner suffix` before lookup or persistence.

The owner may review, revise, retain, or delete the record. Store only the private record's canonical content hash and lifecycle timestamps where required. No institutional role, tenant, manager, HR function, research office, parent Nurse AI OS, agent, analytics process, badge rule, training process, export, or cross-partition reference may see the record or infer that it exists.

An optional neutral bridge statement may be created only from exact wording the owner explicitly selects, such as an availability boundary. Never reveal or infer the private reason. Whole-life use is not therapy, diagnosis, crisis support, performance evidence, or an indicator of worth.

## 11. Clinical, participant, safety, and official-system separation

DISCOVER may retain only a nonidentifying official-event reference, accountable office/owner, due window, and coarse state when needed for portfolio awareness. It must reject adverse-event narratives, complaints, clinical notes, and participant-level safety data. It cannot determine seriousness, relatedness, expectedness, urgency, reportability, corrective action, diagnosis, or care.

Emergencies, live clinical concerns, participant-safety issues, complaints, and adverse events stop the lane immediately and route the human to local official procedures. Do not delay the official route to finish a draft or collect more details.

The base product has no action for recruiting, screening, consenting, enrolling, randomizing, intervening, monitoring, contacting, diagnosing, treating, triaging, changing care, writing orders, launching a live pilot, deploying a model/device, adding tracking, sending, publishing, submitting, registering, contracting, sharing data, filing IP, selecting a vendor, procuring, purchasing, spending, paying, pricing, billing, accepting funding, committing resources, assigning authorship, adjudicating conflicts, scoring people, changing employment/credentials, or writing an official system.

## 12. Visible artifact states and human gates

Keep these Mission Control display states visibly distinct:

1. `Exploration`
2. `Simulation`
3. `Recommendation`
4. `Draft Artifact`
5. `Approved Plan`
6. `Authorized Execution`
7. `Completed Action`
8. `Evaluated Outcome`

These display labels do not replace the canonical closed schema `record_state` values. Store an explicit, versioned mapping and validate the canonical record. Do not permit arbitrary state jumps. Changes to facts, scope, data class, active hat, authority, EDENA tier, methods/intervention, owner, source status, destination, or success measures invalidate affected downstream approvals and reopen the appropriate mission stage.

Within DISCOVER, `Authorized Execution` must display **External human/official-system execution required**; it is never an internal action button. `Completed Action` requires a verified nonidentifying official reference supplied after external human action. `Evaluated Outcome` requires comparison with the original objectives/measures and a human decision to continue, revise, escalate, stop, close out, or begin another Assess cycle.

Every preview identifies the named qualified reviewer, exact object/version/hash, decision requested, required authority, evidence, expiry, and discard/rollback path. AI or delivery status never counts as human approval or acknowledgment.

## 13. Role, setting, and situation recipes

The canonical active-hat codes are:

- `research_innovation_executive`
- `principal_investigator`
- `co_investigator`
- `research_administrator`
- `quality_improvement_leader`
- `innovation_sponsor`
- `data_steward`
- `clinical_leader`
- `educator`
- `implementation_lead`
- `community_engagement_lead`
- `funder_partner_representative`

The ten canonical setting recipes are:

1. Academic Medical Center Research Office
2. Health-System Innovation or Learning-Health-System Office
3. Community Hospital, Clinic, FQHC or Rural Setting
4. Clinical Research Unit or Trial Network
5. Nursing, Allied-Health or Interprofessional Research Program
6. Public Health or Population-Health Program
7. Digital Health, Data Science or Responsible-AI Lab
8. Academic–Industry, Startup or Vendor Collaboration
9. Multi-Site Consortium or Research Network
10. Sponsored-Research and Grant Portfolio Leadership

The ten canonical situation recipes are:

1. ambiguous research/QI/clinical/product classification;
2. first-in-setting digital or AI innovation;
3. pediatric, family, or other potentially vulnerable populations;
4. multi-jurisdiction or international collaboration;
5. community concern, complaint, or possible safety issue;
6. retracted/corrected evidence or suspected integrity issue;
7. financially conflicted partner, inventor, or sponsor;
8. pilot not meeting a predeclared safety, burden, or equity guardrail;
9. failed S2 agent evaluation or unexpected data/action delta; and
10. project pause, responsible termination, archival, and learning closeout.

Recipes select questions and Preview workflows only. They never widen data, action, permission, authority, or EDENA ceilings. Preflight must capture setting, active hat, delegated authority, jurisdiction, sponsor/award/product context, local authoritative destinations, data class, accessibility needs, Indigenous/Tribal/community governance where relevant, private-store choice, and review expiry. Conflicts remain blocked/unknown until the qualified local owner supplies evidence.

## 14. Canonical template registry

Preserve all 30 template identifiers and names:

| ID | Exact canonical template name |
|---|---|
| `TPL-01` | Mission & Impact Compass |
| `TPL-02` | Unmet Need & Opportunity Brief |
| `TPL-03` | Portfolio Prioritization and Stop/Continue Matrix |
| `TPL-04` | FRAME Boundary Classification Intake |
| `TPL-05` | TRACE Evidence Provenance Card |
| `TPL-06` | Data, Privacy, Rights and IP Governance Intake |
| `TPL-07` | Study Concept Synopsis |
| `TPL-08` | Design Options, Bias and Validity Canvas |
| `TPL-09` | Feasibility, Burden and Safety Readiness Checklist |
| `TPL-10` | Outcome, Measure and Analysis-Intent Shell |
| `TPL-11` | Participant, Patient and Community Co-Design Plan |
| `TPL-12` | Team RACI, Expertise and Conflict Disclosure Map |
| `TPL-13` | Funding, Grant and Partner Readiness Brief |
| `TPL-14` | Portfolio Milestone, Dependency and Decision Board |
| `TPL-15` | Governance and Submission-Readiness Checklist |
| `TPL-16` | Site, Vendor, Technology and Pilot Readiness Matrix |
| `TPL-17` | PROBE Assumption and Experiment Card |
| `TPL-18` | Value, Economics, Equity and Burden Scenario |
| `TPL-19` | Translation, Commercialization and Scale/Stop Pathway |
| `TPL-20` | Evidence Landscape and Horizon-Scan Map |
| `TPL-21` | Implementation Strategy and Adoption Evaluation Plan |
| `TPL-22` | Dissemination, Publication and Evidence-to-Decision Plan |
| `TPL-23` | ORBIT Agent Charter and One-Run Evaluation Card |
| `TPL-24` | Leadership Capability, Career and Succession Plan |
| `TPL-25` | Private Whole-Life Purpose and Renewal Plan |
| `TPL-26` | Participant Rights and Consent Question Set |
| `TPL-27` | Data Management, Retention and Sharing Plan |
| `TPL-28` | Source, Policy, Registry and Obligation Watch Card |
| `TPL-29` | Decision, Approval, Exception and Escalation Receipt |
| `TPL-30` | After-Action, Learning and Closeout Record |

Templates are local preview structures, not official forms, submissions, determinations, approvals, records, or action authority.

## 15. Canonical schema registry

Preserve all 18 executable closed JSON Schema Draft 2020-12 documents and their source-pack hashes:

| ID | Exact schema name | Canonical SHA-256 |
|---|---|---|
| `SCH-01` | `leader_identity_authority_mission` | `e210c99167db8c2e7758c38163bdff598605c6136f090288b95192e1f3552673` |
| `SCH-02` | `opportunity_boundary_intake` | `453be2143856f0fa354cc14c80d5924a8d871c5d5115612be5f5818b349fbc01` |
| `SCH-03` | `portfolio_decision_orchestration` | `20b14da623893af505e6e7f742e6c75c4981336f5bd62e14efdc516675e529bb` |
| `SCH-04` | `evidence_provenance` | `d8d6dd288778b02f049b97754e70680a7d59480ded897240f630afd688829220` |
| `SCH-05` | `data_rights_governance` | `e63b80f1b1ba8800fc932a4f533feb12e20e29d72bb068b1b7b3863c10dc44e2` |
| `SCH-06` | `study_concept_design` | `e2c4fa743d0f56a914110509be9fe92dd797b8e2c390f4aae541801cd2078729` |
| `SCH-07` | `feasibility_safety_readiness` | `408fa9efa30be8f216410954f72164f56e59cc546b5612356cc012284d77578a` |
| `SCH-08` | `measurement_analysis_intent` | `ff3cc8f3373ff91b66e44478fc37f03634bf55f84fa2a1ff409b8bf2e185fd4b` |
| `SCH-09` | `engagement_collaboration_plan` | `1d2dec179fc59d75582a4f7e9a0c118e4fdffc7b3f17c942bd536b9473abf5d1` |
| `SCH-10` | `funding_partnership_readiness` | `37979afa7a955d613590aa5bbee3b0b91ac729b6f808284391ebd52124c623a8` |
| `SCH-11` | `governance_submission_readiness` | `9a9c0ff07f3adabfbb40476ab9d551c044ce52a8039b1a31c82d071201256012` |
| `SCH-12` | `innovation_validation_experiment` | `aff18048c46057e655488baf7346e2885fc9c03f2e8306adf206ab65b523a097` |
| `SCH-13` | `value_translation_scenario` | `079fa3d17a2d9e996e7163e96fe692619b15747d08b03bcea17247b874964a57` |
| `SCH-14` | `implementation_evaluation` | `c90b8e49da09ea38d40330bde56a12914fdd02d64dd82710db13cc0e2951effd` |
| `SCH-15` | `dissemination_output_plan` | `f9610876ce9a88cd75c258d846b3fca987aed00c193f7581cfef62c38f37f8c5` |
| `SCH-16` | `whole_life_private` | `951e18bc8026cb831a5f03f30d0f8063912005ac39f990a7bbfefe691d610077` |
| `SCH-17` | `agent_charter_trace` | `953e701ca8363f6dab26746e4f1ebdf1bcf81bbc23cde4eb5f07a35614579714` |
| `SCH-18` | `control_audit_receipt` | `7c8b219eb9bf074efde322cc1f7a8030f1bb2ff02b7aafc3c9ecb23a84360f28` |

Do not edit these canonical documents in place. Put application extensions, EDENA state, mission-loop records, personalization, and migration metadata in separate versioned schemas with explicit references. A material canonical change requires a new version, affected-domain retesting, and new receipts.

## 16. Uniform enforcement surfaces

Invoke the same governance service at:

- onboarding, Discover/Soul mapping, role/hat selection, and dashboard switching;
- mission, project, task, note, decision, metric, reflection, and quick-capture forms;
- paste, drag/drop, file upload, attachment extraction, import, restore, and migration;
- search, indexing, embeddings, retrieval, citations, and knowledge-base ingestion;
- AI prompt assembly, responses, streaming, agent routes/overrides, tool arguments/results, connectors, network calls, and Hermes handoffs;
- artifact promotion, approval, external-route staging, completion reconciliation, evaluation, correction, and reopening;
- Markdown/PDF/JSON/report/citation/backup/support-bundle exports;
- dashboards, alerts, badges, capability evidence, analytics, logs, telemetry, and errors; and
- pause, kill, expiry, rollback, purge, delete, reset, removal, update, uninstall, and orphan cleanup.

Imports are data, never executable content. Reject schema drift, unknown fields where schemas are closed, path traversal, active content, malformed archives, oversized payloads, cross-partition references, and hash/version mismatches.

## 17. Safety, security, secrets, and truthful communication

- Bind the local service to verified loopback by default. Protect state-changing endpoints with authentication, authorization, origin checks, anti-CSRF controls, request limits, and secure session handling.
- Keep model/connector secrets in server-side secret storage only—never browser storage, exported profiles, backups, prompts, client bundles, logs, or screenshots.
- Permit unencrypted HTTP only on verified loopback. Remote Hermes/model endpoints require approved TLS, authentication, identity/capability checks, and an explicit network allowlist.
- Optional local HTML uses the same store and policy engine, with no remote scripts, trackers, or shadow database.
- Memory is explicit, consent-controlled, inspectable, correctable, exportable, and deletable. Enforce Do Not Remember categories before prompt assembly and persistence.
- Do not expose chain-of-thought. Show concise source facts, assumptions, uncertainties, decisions, and enforcement reasons.
- Every material statement is labeled verified fact, user-provided information, reported claim, human interpretation, AI-generated draft, assumption, synthetic example, or unresolved question.
- Remove filler, fake warmth, invented urgency, generic praise, unsupported superlatives, and false certainty. Preserve the accountable human's voice and display owner, status, source, limits, dissent, accessibility needs, and next human step.

## 18. Pause, kill, reset, rollback, purge, and uninstall

- **Pause All:** deny new model calls, tools, connectors, agent runs, external actions, and background jobs; local manual drafting may continue with a visible paused state.
- **Kill:** stop the selected/all agents, cancel genuine streams/jobs, revoke temporary credentials/tool grants, close sessions, purge ephemeral state, detect orphans, and report verified status.
- **Safe Reset:** return 24 powers to `Available Inactive`, ten agents to `PERM-P0 Disabled`, workflows to `Preview Only`, connectors/actions Off, and clear transient state without silently deleting user artifacts.
- **Rollback:** restore a verified configuration or local artifact snapshot with a before/after receipt. Never claim software rollback reversed an external human/official-system action.
- **Purge:** delete staged uploads, prompt/context buffers, retrieved chunks, embeddings, caches, temporary credentials, and agent scratch state according to policy, then verify deletion or report failure.
- **DISCOVER-only Uninstall:** preview dependencies/export choices, require confirmation, stop/revoke activity, preserve only explicitly selected permitted artifacts or authorized holds, remove scoped data/configuration, prove other lanes unchanged, verify orphan cleanup, and provide a truthful report.

Failure to confirm cancellation, revocation, purge, rollback, or orphan cleanup must be reported as `partial`, `failed`, `blocked`, or `unsupported`—never success.

## 19. Release and runtime verification

The canonical test inventory is exactly:

- 18 domains `RA-A` through `RA-R`, eight criteria each: `RA-A01`–`RA-R08` (144 criteria); and
- 16 integration criteria: `RA-INT01`–`RA-INT16`.

That total is 160. Every runtime receipt must validate against `SCH-18 control_audit_receipt`, bind the exact criterion/variant/fixture/adapter/environment/schema-bundle hashes, expected and observed action/data deltas, raw-log hash, reviewer/time, predecessor, and before/after object hashes. Call the chain tamper-evident unless the platform independently proves immutability.

Tests must prove at minimum:

1. route/namespace/partition isolation and zero cross-partition disclosure;
2. D0/D1/D2/D3/Prohibited handling across every enforcement surface;
3. FRAME produces only the five possible-pathway statuses and never an institutional determination;
4. EDENA Personal versus Institutional behavior, including safer Red abstraction and mandatory institutional stop;
5. all powers remain inactive, workflows Preview Only, agents P0, and external actions Off after installation;
6. P2/P3 one-run hash, authority, source, permission, expiry, kill, and reconciliation enforcement;
7. no person-level data, participant contact, production write, submission, publication, transaction, procurement, clinical action, or P4 path exists;
8. private whole-life records are owner-only, agent-free, non-exported, and invisible to tenant/parent systems;
9. evidence correction/retraction, source expiry, material change, pause/resume, idempotency, rollback, purge, uninstall, and clean reinstall behave truthfully;
10. keyboard, screen-reader, reflow/zoom, reduced-motion, visible-focus, no-color-only, and Markdown-fallback paths expose the same governance and stop controls; and
11. all 160/160 expected outcomes execute and pass with zero unresolved critical failure before S2 activation.

If any critical enforcement path is failed, blocked, unsupported, decorative, client-only, or untested, return `PARTIAL_QUARANTINED_NOT_ACTIVATED`.
