# DISCOVER Runnable Workflows

Every workflow opens in `Preview Only`, validates allowed input before persistence, creates one primary functional template, validates the closed schema, records unanswered questions and stops at its declared human decision gate. Organizational workflows require an active organizational hat and authority and emit a scope-appropriate `control_audit_receipt`; that receipt is not approval evidence. WF-24 is the explicit owner-private exception: it uses `private_individual`, DATA-D3-PRIVATE and owner self-review with no institutional authority, approval or separate receipt.

## WF-01 — Define My Research & Innovation Mission and 90-Day Focus

**Inventory ID:** `DSC-WF-01`; **Power:** `PWR-01`; **Mode:** Preview Only  
**Template/schema:** `TPL-01` / `leader_identity_authority_mission`  
**Primary safe finish:** Compass preview + authority questions

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-01` draft validated against `leader_identity_authority_mission`; Compass preview + authority questions.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME + TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-01 as a clearly labeled draft; validate `leader_identity_authority_mission` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-02 — Frame an Unmet Need Without Locking in a Solution

**Inventory ID:** `DSC-WF-02`; **Power:** `PWR-02`; **Mode:** Preview Only  
**Template/schema:** `TPL-02` / `opportunity_boundary_intake`  
**Primary safe finish:** Opportunity brief + evidence/burden gaps

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-02` draft validated against `opportunity_boundary_intake`; Opportunity brief + evidence/burden gaps.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-02 as a clearly labeled draft; validate `opportunity_boundary_intake` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-03 — Compare Portfolio Options and Prepare a Stop/Continue Decision

**Inventory ID:** `DSC-WF-03`; **Power:** `PWR-03`; **Mode:** Preview Only  
**Template/schema:** `TPL-03` / `portfolio_decision_orchestration`  
**Primary safe finish:** Scenario ranking + named human decision queue

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-03` draft validated against `portfolio_decision_orchestration`; Scenario ranking + named human decision queue.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME + TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-03 as a clearly labeled draft; validate `portfolio_decision_orchestration` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-04 — Route a Research–QI–Clinical–Innovation Boundary Question

**Inventory ID:** `DSC-WF-04`; **Power:** `PWR-04`; **Mode:** Preview Only  
**Template/schema:** `TPL-04` / `opportunity_boundary_intake`  
**Primary safe finish:** Possible pathways + MULTIPLE_OR_UNRESOLVED where applicable

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-04` draft validated against `opportunity_boundary_intake`; Possible pathways + MULTIPLE_OR_UNRESOLVED where applicable.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-04 as a clearly labeled draft; validate `opportunity_boundary_intake` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-05 — Build a Reproducible Evidence and Integrity Trace

**Inventory ID:** `DSC-WF-05`; **Power:** `PWR-05`; **Mode:** Preview Only  
**Template/schema:** `TPL-05` / `evidence_provenance`  
**Primary safe finish:** Source/interpretation ledger + correction watch

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-05` draft validated against `evidence_provenance`; Source/interpretation ledger + correction watch.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-05 as a clearly labeled draft; validate `evidence_provenance` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-06 — Map Data, Privacy, Rights, Retention and IP Questions

**Inventory ID:** `DSC-WF-06`; **Power:** `PWR-06`; **Mode:** Preview Only  
**Template/schema:** `TPL-06` / `data_rights_governance`  
**Primary safe finish:** Governance map + formal-review blockers

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-06` draft validated against `data_rights_governance`; Governance map + formal-review blockers.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-06 as a clearly labeled draft; validate `data_rights_governance` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-07 — Draft a Study Concept and Compare Design Options

**Inventory ID:** `DSC-WF-07`; **Power:** `PWR-07`; **Mode:** Preview Only  
**Template/schema:** `TPL-07` / `study_concept_design`  
**Primary safe finish:** Non-authoritative synopsis + bias/specialist questions

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-07` draft validated against `study_concept_design`; Non-authoritative synopsis + bias/specialist questions.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-07 as a clearly labeled draft; validate `study_concept_design` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-08 — Prepare Feasibility, Burden and Safety Readiness Questions

**Inventory ID:** `DSC-WF-08`; **Power:** `PWR-08`; **Mode:** Preview Only  
**Template/schema:** `TPL-09` / `feasibility_safety_readiness`  
**Primary safe finish:** Readiness gaps + official safety/oversight routes

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-09` draft validated against `feasibility_safety_readiness`; Readiness gaps + official safety/oversight routes.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-09 as a clearly labeled draft; validate `feasibility_safety_readiness` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-09 — Define Outcomes, Measures and Analysis Intent Before Results

**Inventory ID:** `DSC-WF-09`; **Power:** `PWR-09`; **Mode:** Preview Only  
**Template/schema:** `TPL-10` / `measurement_analysis_intent`  
**Primary safe finish:** Measure dictionary + analysis-intent shell

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-10` draft validated against `measurement_analysis_intent`; Measure dictionary + analysis-intent shell.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-10 as a clearly labeled draft; validate `measurement_analysis_intent` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-10 — Plan Reciprocal Participant, Patient and Community Co-Design

**Inventory ID:** `DSC-WF-10`; **Power:** `PWR-10`; **Mode:** Preview Only  
**Template/schema:** `TPL-11` / `engagement_collaboration_plan`  
**Primary safe finish:** Engagement plan + burden/feedback-back commitments

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-11` draft validated against `engagement_collaboration_plan`; Engagement plan + burden/feedback-back commitments.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-11 as a clearly labeled draft; validate `engagement_collaboration_plan` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-11 — Design the Team RACI, Expertise, Partnership and Conflict Map

**Inventory ID:** `DSC-WF-11`; **Power:** `PWR-11`; **Mode:** Preview Only  
**Template/schema:** `TPL-12` / `engagement_collaboration_plan`  
**Primary safe finish:** Role/decision map + unresolved conflict/contract questions

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-12` draft validated against `engagement_collaboration_plan`; Role/decision map + unresolved conflict/contract questions.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-12 as a clearly labeled draft; validate `engagement_collaboration_plan` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-12 — Prepare a Funding, Grant or Sponsor Readiness Brief

**Inventory ID:** `DSC-WF-12`; **Power:** `PWR-12`; **Mode:** Preview Only  
**Template/schema:** `TPL-13` / `funding_partnership_readiness`  
**Primary safe finish:** Readiness brief + institutional submission queue

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-13` draft validated against `funding_partnership_readiness`; Readiness brief + institutional submission queue.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-13 as a clearly labeled draft; validate `funding_partnership_readiness` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-13 — Orchestrate Portfolio Milestones, Dependencies and Decision Gates

**Inventory ID:** `DSC-WF-13`; **Power:** `PWR-13`; **Mode:** Preview Only  
**Template/schema:** `TPL-14` / `portfolio_decision_orchestration`  
**Primary safe finish:** Aggregate decision board + owner/dependency queue

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-14` draft validated against `portfolio_decision_orchestration`; Aggregate decision board + owner/dependency queue.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-14 as a clearly labeled draft; validate `portfolio_decision_orchestration` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-14 — Prepare Governance and Submission Readiness Without Submitting

**Inventory ID:** `DSC-WF-14`; **Power:** `PWR-14`; **Mode:** Preview Only  
**Template/schema:** `TPL-15` / `governance_submission_readiness`  
**Primary safe finish:** Review matrix + missing-evidence list

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-15` draft validated against `governance_submission_readiness`; Review matrix + missing-evidence list.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-15 as a clearly labeled draft; validate `governance_submission_readiness` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-15 — Compare Site, Vendor, Technology and Pilot Readiness

**Inventory ID:** `DSC-WF-15`; **Power:** `PWR-15`; **Mode:** Preview Only  
**Template/schema:** `TPL-16` / `feasibility_safety_readiness`  
**Primary safe finish:** Readiness matrix + no-pilot/no-purchase option

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-16` draft validated against `feasibility_safety_readiness`; Readiness matrix + no-pilot/no-purchase option.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-16 as a clearly labeled draft; validate `feasibility_safety_readiness` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-16 — Design a Bounded Non-Production Innovation Experiment

**Inventory ID:** `DSC-WF-16`; **Power:** `PWR-16`; **Mode:** Preview Only  
**Template/schema:** `TPL-17` / `innovation_validation_experiment`  
**Primary safe finish:** PROBE experiment card + rollback/stop rules

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-17` draft validated against `innovation_validation_experiment`; PROBE experiment card + rollback/stop rules.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run PROBE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-17 as a clearly labeled draft; validate `innovation_validation_experiment` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-17 — Build Value, Economics, Equity and Burden Scenarios

**Inventory ID:** `DSC-WF-17`; **Power:** `PWR-17`; **Mode:** Preview Only  
**Template/schema:** `TPL-18` / `value_translation_scenario`  
**Primary safe finish:** Traceable scenario ranges + finance/equity questions

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-18` draft validated against `value_translation_scenario`; Traceable scenario ranges + finance/equity questions.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-18 as a clearly labeled draft; validate `value_translation_scenario` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-18 — Map Translation, Commercialization and Scale/Stop Gates

**Inventory ID:** `DSC-WF-18`; **Power:** `PWR-18`; **Mode:** Preview Only  
**Template/schema:** `TPL-19` / `value_translation_scenario`  
**Primary safe finish:** Translation pathway + formal decision gates

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-19` draft validated against `value_translation_scenario`; Translation pathway + formal decision gates.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run PROBE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-19 as a clearly labeled draft; validate `value_translation_scenario` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-19 — Create an Evidence Landscape and Reproducible Horizon Scan

**Inventory ID:** `DSC-WF-19`; **Power:** `PWR-19`; **Mode:** Preview Only  
**Template/schema:** `TPL-20` / `evidence_provenance`  
**Primary safe finish:** Evidence/gap map + update watch

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-20` draft validated against `evidence_provenance`; Evidence/gap map + update watch.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-20 as a clearly labeled draft; validate `evidence_provenance` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-20 — Plan Implementation, Adoption Evaluation and Responsible Withdrawal

**Inventory ID:** `DSC-WF-20`; **Power:** `PWR-20`; **Mode:** Preview Only  
**Template/schema:** `TPL-21` / `implementation_evaluation`  
**Primary safe finish:** Implementation/evaluation plan + balancing/exit measures

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-21` draft validated against `implementation_evaluation`; Implementation/evaluation plan + balancing/exit measures.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-21 as a clearly labeled draft; validate `implementation_evaluation` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-21 — Prepare a Human-Voice Dissemination or Evidence-to-Decision Package

**Inventory ID:** `DSC-WF-21`; **Power:** `PWR-21`; **Mode:** Preview Only  
**Template/schema:** `TPL-22` / `dissemination_output_plan`  
**Primary safe finish:** Source-annotated draft + authorship/disclosure/release queue

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-22` draft validated against `dissemination_output_plan`; Source-annotated draft + authorship/disclosure/release queue.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run TRACE and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-22 as a clearly labeled draft; validate `dissemination_output_plan` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-22 — Charter and Evaluate One Bounded AI-Agent Run

**Inventory ID:** `DSC-WF-22`; **Power:** `PWR-22`; **Mode:** Preview Only  
**Template/schema:** `TPL-23` / `agent_charter_trace`  
**Primary safe finish:** ORBIT charter/test trace; agent remains disabled unless separately authorized

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-23` draft validated against `agent_charter_trace`; ORBIT charter/test trace; agent remains disabled unless separately authorized.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run ORBIT and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-23 as a clearly labeled draft; validate `agent_charter_trace` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-23 — Build My Research Leadership, Capability and Succession Plan

**Inventory ID:** `DSC-WF-23`; **Power:** `PWR-23`; **Mode:** Preview Only  
**Template/schema:** `TPL-24` / `leader_identity_authority_mission`  
**Primary safe finish:** Leadership plan + private/institutional boundary

**Trigger:** The named research/innovation leadership question needs a governed, reviewable preview.  
**Allowed input:** DATA-D0/D1 or an externally prepared, human-approved DATA-D2 aggregate with provenance, suppression and export evidence; never person-level/raw narrative data.  
**Output:** `TPL-24` draft validated against `leader_identity_authority_mission`; Leadership plan + private/institutional boundary.  
**Human gate:** The named accountable domain owner reviews the exact object/version/hash and supplies any approval through the authoritative system.  
**Stop/fallback:** On authority, boundary, data, source, schema, partition or action failure, generate nothing consequential; show the blocker, official human route and discard/rollback option.  
**Receipt:** Emit `control_audit_receipt` with expected/observed state, action and data deltas; it cannot manufacture approval.  
**Expiry:** Earliest of authority, source, approval, data-use, protocol, policy or configured review expiry; expiry forces re-review.

**Steps**

1. Declare owner, active hat, authority source/expiry, intended decision and non-goals.
2. Accept only DATA-D0/D1 or externally prepared approved DATA-D2 aggregate metadata; reject prohibited/person-level input before persistence.
3. Run FRAME and preserve facts, assumptions, unknowns, contradictions, burden/equity questions and official routes.
4. Populate TPL-24 as a clearly labeled draft; validate `leader_identity_authority_mission` and bind source/object hashes.
5. Show named accountable human gate, expiry, correction, discard/rollback and official-system route; emit a tamper-evident receipt and stop.

**Hard stop:** Missing/expired authority, prohibited data, unresolved consequential boundary, stale/retracted/hash-mismatched source, missing approval evidence, cross-partition request or requested action outside the ceiling stops before generation and routes to a named human. External send, submission, publication, spend, deployment, recruitment, consent, enrollment, official write and autonomous decision are absent.

## WF-24 — Create My Private Whole-Life Purpose and Renewal Plan

**Inventory ID:** `DSC-WF-24`; **Power:** `PWR-24`; **Mode:** Preview Only  
**Template/schema:** `TPL-25` / `whole_life_private`  
**Primary safe finish:** Owner-only plan + minimum viable mode

**Trigger:** The owner voluntarily chooses to create or revise a private whole-life purpose, capacity and renewal plan.  
**Allowed input:** DATA-D3-PRIVATE entered by the owner only; active hat `private_individual`; partition exactly `research_innovation_discover.private.owner.<owner_id>`; one-owner ACL.  
**Output:** Owner-only `TPL-25` validated against `whole_life_private`; no organizational view. An optional neutral bridge statement may be created only from exact wording the owner explicitly selects.  
**Human gate:** Owner self-review and owner self-decision only. No employer, tenant, parent lane, manager, HR, research office or institutional approval is required or permitted.  
**Stop/fallback:** Reject organizational routing, organizational/official references, tenant or parent access, analytics, training, agents, institutional export, forced sharing or any attempt to infer performance from use/nonuse. Leave no organizational trace beyond an optional owner-approved neutral bridge statement.  
**Receipt:** No separate receipt is created. The owner-private record stores only content_sha256, created_at and updated_at for owner-local integrity and resume.  
**Existence boundary:** No private-existence trace or institutional trace is created.  
**Expiry:** The owner sets review and delete dates, may delete independently at any time, and alone decides retain, revise, pause or remove.

**Steps**

1. Set the active hat to `private_individual`; create or verify only `research_innovation_discover.private.owner.<owner_id>` with a one-owner ACL; before lookup or persistence enforce `owner_id == sole ACL principal_id == partition owner suffix`.
2. Accept only owner-entered DATA-D3-PRIVATE; reject organizational, tenant, parent-lane, participant, patient, workforce, partner or other-person content and references before persistence.
3. Let the owner privately define values, aspirations, family/community commitments, protected time, capacity, Minimum Viable Leadership Mode, recovery and delete/review dates.
4. Populate TPL-25 and validate `whole_life_private`; bind no tenant, parent, organization, official-system, analytics, training, agent or institutional-export reference.
5. Show the result only to the owner for self-review and self-decision; optionally produce one neutral bridge statement only when the owner explicitly chooses its exact wording.
6. Retain only the private record's own canonical content hash and created/updated/review/delete timestamps, honor the owner-set delete instruction, and stop without a separate receipt, institutional routing, approval, sharing or export.

**Hard stop:** Any organizational authority check, official approval request, tenant/parent/organization reference, mismatch among owner ID, sole ACL principal and partition owner suffix, agent/tool access, analytics/training use, institutional export, separate receipt/private-existence trace or sharing beyond the owner's exact neutral bridge statement is a contract violation. Block before lookup/persistence, disclose nothing, discard the attempted organizational route and return control to the owner.
