# DISCOVER Personalization Mapping Crosswalk

## 1. Purpose and non-authority rule

This contract converts supported, derived Discover Packet and Soul Profile adapters into a proposed `DISCOVER Mission Profile`. It personalizes navigation, wording, learning pathways and a recommendation review queue for a Healthcare Research and Innovation Leader. It does not infer identity, competence, employment, investigator status, delegated authority, research/QI/clinical/product classification, IRB/HRO status, consent, institutional approval, data rights, scientific validity or permission to act.

All mappings are proposals until the user reviews them. Institutional policy, applicable law, valid approvals, current data-use terms, community or sovereign governance, and verified human authority override preference. No personalization value may weaken a hard stop.

## 2. Deterministic transformation order

1. Enforce file-size, depth, unsafe-key, direct-identifier, credential and prohibited-content checks.
2. Validate a supported adapter against the exact closed schema and version.
3. Normalize into a transient proposal; never persist raw interview or quiz material.
4. Map direct fields and enumerate all source conflicts without silently choosing a winner.
5. Propose role-to-workspace candidates and ask the user to select exactly one Primary.
6. Ask first-run questions for missing strengths/growth, situation, cadence, accessibility, authority, edition, data boundary and memory consent.
7. Resolve workflow recommendations only through the pinned DISCOVER catalog relation described in section 7.
8. Show each proposed field group, source, uncertainty and effect. Permit edit, approve or reject.
9. Run JSON Schema plus semantic validation and save one version atomically.
10. Add approved recommendations only to the inactive review queue. Do not activate a workflow, power, agent, tool, connector, memory category or external action.

A deliberate current user edit supersedes an older approved profile value. Confirmed Discover and Soul values for the same field are peers; disagreement requires explicit resolution. First-run input fills gaps or records the user's resolution. Role labels never establish authority.

## 3. Field provenance

Every user-visible approval group records:

- target JSON pointer;
- source type and bounded safe source reference;
- source JSON pointer;
- stable `MAP-*` rule ID;
- derivation type;
- explicit uncertainty or `null`;
- proposed/approved/rejected state; and
- approval and update times.

The semantic validator must show every approved user-visible value is covered by an exact pointer or a documented parent approval group. Nested authority, memory, governance, workspace and recommendation values remain separately reviewable in the UI. Provenance points to a derived adapter field; it is never authorization to retain the raw source.

## 4. Discover Packet adapter mapping

| Source pointer | Target pointer or disposition | Rule | Constraint |
|---|---|---|---|
| `/schema`, `/packet_schema_version` | Validate only | `MAP-DISCOVER-VERSION-1` | Only the exact supported version maps. |
| `/generated_at` | Provenance metadata | `MAP-DISCOVER-METADATA-1` | Never treat it as user confirmation time. |
| `/mission_statement` | `/mission_statement` | `MAP-DISCOVER-DIRECT-1` | Direct proposal; blank remains blank. |
| `/core_values` | `/core_values` | `MAP-DISCOVER-DIRECT-1` | Self-described settings, not personality facts. |
| `/current_priorities` | `/current_priorities` | `MAP-DISCOVER-DIRECT-1` | Global proposals; workspace allocation requires review. |
| `/goals/short_term` | `/goals/near_term` | `MAP-DISCOVER-GOAL-HORIZON-1` | Exact horizon-name translation. |
| `/goals/medium_term` | `/goals/medium_term` | `MAP-DISCOVER-GOAL-HORIZON-1` | Direct proposal. |
| `/goals/long_term` | `/goals/long_term` | `MAP-DISCOVER-GOAL-HORIZON-1` | Direct proposal. |
| `/working_preferences/*` | matching `/working_preferences/*` | `MAP-DISCOVER-WORKSTYLE-1` | Three matching fields only. |
| missing cadence/time fields | Ask first run | `MAP-FIRST-RUN-WORKSTYLE-1` | Never invent availability. |
| `/role_goals[]/role_id` | Candidate `/role_workspaces[]/workspace_type` | `MAP-DISCOVER-ROLE-CANDIDATE-1` | Apply section 6; ambiguous mappings require selection. |
| `/role_goals[]/goal` | Candidate workspace `/goals[]` | `MAP-DISCOVER-ROLE-GOAL-1` | Keep attached to the source role. |
| `/role_goals[]/success_measure` | Starter-mission preview | `MAP-DISCOVER-ROLE-MEASURE-1` | Adoption is a separate confirmed action; no outcome is claimed. |
| `/role_goals[]/priority` | Workspace `/priority` | `MAP-DISCOVER-ROLE-PRIORITY-1` | Does not establish operational urgency or authority. |
| `/role_goals[]/default_edena` | Starter candidate only | `MAP-DISCOVER-EDENA-CANDIDATE-1` | Classify actual content/context; preference cannot lower policy. |
| `/ai_boundaries/default_autonomy` | `/ai_preferences/default_support` | `MAP-DISCOVER-AI-1` | Exact enum copy. |
| `/ai_boundaries/may_support` | `/ai_preferences/may_support` | `MAP-DISCOVER-AI-1` | Preference only. |
| `/ai_boundaries/requires_confirmation` | `/ai_preferences/requires_confirmation` | `MAP-DISCOVER-AI-1` | Policy may strengthen, never weaken it. |
| `/ai_boundaries/never_delegate` | `/ai_preferences/never_delegate` | `MAP-DISCOVER-AI-1` | Union with immutable DISCOVER prohibitions. |
| missing preferred agents | `/ai_preferences/preferred_agent_ids=[]` | `MAP-DISCOVER-AI-1` | Never guess or activate an agent. |
| `/governance_preferences/risk_tolerance` | matching target | `MAP-DISCOVER-GOVERNANCE-1` | Preference is not a risk classification. |
| `/governance_preferences/default_edena` | matching target | `MAP-DISCOVER-GOVERNANCE-1` | Advisory default only. |
| `default_retention=local_non_sensitive` | `default_retention=local_nonsensitive` | `MAP-DISCOVER-RETENTION-ENUM-1` | Exact enum translation; session-only maps identically. |
| missing edition/data boundary | Ask first run; default Personal/private | `MAP-FIRST-RUN-GOVERNANCE-1` | Institutional mode cannot be inferred from title. |
| `/recommended_workflow_ids[]` | `/recommended_assets/source_recommendation_ids[]` | `MAP-DISCOVER-CATALOG-RESOLUTION-1` | Preserve source ID, then resolve exact pinned catalog relation; see section 7. |
| `/recommended_capability_ids[]` | `/recommended_assets/capability_ids[]` | `MAP-DISCOVER-CAPABILITY-1` | Recommendation only; no badge is earned. |
| `/uncertainties` | `/uncertainties` | `MAP-DISCOVER-DIRECT-1` | Preserve rather than smoothing away. |
| `/source_provenance` | `field_provenance[].source_ref` | `MAP-DISCOVER-METADATA-1` | Bounded safe reference, not raw source content. |
| `/demo` | `/demo` | `MAP-DISCOVER-DEMO-1` | Demo forces visible labeling and achievement exclusion. |

## 5. Soul Profile adapter mapping

| Source pointer | Target pointer or disposition | Rule | Constraint |
|---|---|---|---|
| schema/version/scoring metadata | Validate/provenance only | `MAP-SOUL-VERSION-1` | Scores confer no authority or competence. |
| `/completed_at`, `/user_confirmed_at` | Provenance metadata | `MAP-SOUL-METADATA-1` | Null confirmation keeps fields proposed. |
| `/role_constellation[]` | Candidate `/role_workspaces[]` | `MAP-SOUL-ROLE-CANDIDATE-1` | Apply section 6. |
| constellation `unverified` or `external_unverified` | workspace `unknown` | `MAP-SOUL-AUTH-ENUM-1` | Neither is external verification. |
| constellation `user_asserted` | workspace `user_asserted` | `MAP-SOUL-AUTH-ENUM-1` | Still grants no permission. |
| `/core_values` | `/core_values` | `MAP-SOUL-DIRECT-1` | Conflict with Discover requires resolution. |
| `/mission_and_purpose/mission` | `/mission_statement` | `MAP-SOUL-MISSION-1` | Conflict with Discover requires resolution. |
| guiding principles | Candidate `/core_values` | `MAP-SOUL-PRINCIPLES-1` | Show separately before merge. |
| populations | Situation-note candidate | `MAP-SOUL-POPULATION-1` | Never infer a real study population, employer or consent. |
| `/learner_and_developmental_stage` | Candidate growth/strength review | `MAP-SOUL-DEVELOPMENT-1` | User rewords and approves; not competence evidence. |
| `/advanced_studies[]` | Candidate goals and `learning_certification` | `MAP-SOUL-STUDY-1` | Never claim enrollment or completion without user confirmation. |
| working/learning preferences | matching target fields | `MAP-SOUL-WORKSTYLE-1` | Direct proposals for three matching fields. |
| presentation theme/tone | matching target fields | `MAP-SOUL-PRESENTATION-1` | Cannot change facts, controls or warnings. |
| role synergies | Situation-note candidates | `MAP-SOUL-ROLE-DYNAMICS-1` | Reviewable interpretation only. |
| role tensions | Uncertainty/note candidates | `MAP-SOUL-ROLE-DYNAMICS-1` | Do not diagnose. |
| wellness limits | `/working_preferences/time_constraints` | `MAP-SOUL-WELLNESS-1` | Do not expose as an employment record. |
| AI relationship preferences | AI/dashboard candidates | `MAP-SOUL-AI-RELATIONSHIP-1` | No direct agent selection or activation. |
| governance `may_support` | AI may-support proposal | `MAP-SOUL-GOVERNANCE-1` | Merge only after conflict review. |
| governance `prepare_only`, `requires_confirmation`, `requires_supervision` | confirmation/supervision display proposals | `MAP-SOUL-GOVERNANCE-1` | Preserve the stricter interpretation. |
| accountable-human and never-delegate fields | AI never-delegate proposals | `MAP-SOUL-GOVERNANCE-1` | Cannot weaken immutable boundaries. |
| memory allowed/denied | memory category proposals | `MAP-SOUL-MEMORY-1` | Memory remains Off until separate consent; denials win. |
| escalation rules | Safeguard display | `MAP-SOUL-ESCALATION-1` | Does not invent a real escalation route. |
| dashboard recommendations | Workspace/module candidates | `MAP-SOUL-DASHBOARD-1` | Unknown roles require a lane decision. |
| uncertainties/source/demo | matching target/provenance behavior | `MAP-SOUL-DIRECT-1` | Preserve uncertainty; demo earns no evidence. |

## 6. Role-to-workspace candidates

Exactly one approved workspace is Primary. Candidates never prove employment or authority.

| Adapter role | DISCOVER workspace candidate | Required review |
|---|---|---|
| `research-innovation` | Select any one of the first ten setting workspaces | Ask exact setting, portfolio, active hat, jurisdiction, authority and official human routes. |
| `researcher` | `academic_medical_center_research_office`, `clinical_research_unit_trial_network`, `nursing_allied_interprofessional_research` or `research_leader_learner_consultant` | Ask whether the lane is leadership, investigator/study-team, program or learning. |
| `digital-ai` | Supporting `digital_health_data_science_ai_lab` | Context only; no model, data or agent permission. |
| `quality-safety` | Supporting `health_system_innovation_learning_health_system` or `public_population_health_program` | Keep research/QI/clinical/product boundary unresolved until official review. |
| `community` | `community_rural_research` or supporting `public_population_health_program` | Ask constituency, reciprocity and community/sovereign governance; do not infer consent. |
| `entrepreneur` | `academic_industry_startup_vendor_collaboration` or `research_leader_learner_consultant` | Ask venture, conflict, IP, data-use and institutional-boundary questions. |
| `advanced-studies` | `research_leader_learner_consultant` | Learning goal only. |
| `shared-identity` | Ask user; no automatic workspace | Require one Primary operational or private context. |
| healthcare administrator, manager, clinician, educator, resident, student, wellness or other professional role | No automatic DISCOVER setting | Keep as contextual identity or offer the appropriate separate lane; no cross-population record join. |
| unknown role | No workspace | Preserve source label and uncertainty, then ask. |

`authorization_status=externally_verified` can never be derived from either adapter. It requires separate current evidence, a verifier, scope and expiry. The Mission Profile cannot grant it.

## 7. Exact current and source workflow handling

The baseline adapter's `DSC-WF-*` values are canonical inventory IDs in this DISCOVER source pack, while `WF-*` values are current runnable IDs. They are not interchangeable strings. Resolve a source recommendation by exact versioned catalog identity. A valid catalog record must bind all four fields below; missing or duplicate bindings block the recommendation.

| Source inventory ID | Current workflow | Power | Template | Current intent |
|---|---|---|---|---|
| `DSC-WF-01` | `WF-01` | `PWR-01` | `TPL-01` | Research/innovation mission and 90-day focus |
| `DSC-WF-02` | `WF-02` | `PWR-02` | `TPL-02` | Unmet-need framing without solution lock-in |
| `DSC-WF-03` | `WF-03` | `PWR-03` | `TPL-03` | Portfolio options and stop/continue decision |
| `DSC-WF-04` | `WF-04` | `PWR-04` | `TPL-04` | Research–QI–clinical–innovation boundary questions |
| `DSC-WF-05` | `WF-05` | `PWR-05` | `TPL-05` | Reproducible evidence and integrity trace |
| `DSC-WF-06` | `WF-06` | `PWR-06` | `TPL-06` | Data, privacy, rights, retention and IP questions |
| `DSC-WF-07` | `WF-07` | `PWR-07` | `TPL-07` | Study concept and design-option draft |
| `DSC-WF-08` | `WF-08` | `PWR-08` | `TPL-09` | Feasibility, burden and safety-readiness questions |
| `DSC-WF-09` | `WF-09` | `PWR-09` | `TPL-10` | Outcomes, measures and analysis intent before results |
| `DSC-WF-10` | `WF-10` | `PWR-10` | `TPL-11` | Reciprocal participant/patient/community co-design plan |
| `DSC-WF-11` | `WF-11` | `PWR-11` | `TPL-12` | Team, expertise, partnership, RACI and conflict map |
| `DSC-WF-12` | `WF-12` | `PWR-12` | `TPL-13` | Funding, grant or sponsor readiness brief |
| `DSC-WF-13` | `WF-13` | `PWR-13` | `TPL-14` | Portfolio milestones, dependencies and gates |
| `DSC-WF-14` | `WF-14` | `PWR-14` | `TPL-15` | Governance/submission readiness without submission |
| `DSC-WF-15` | `WF-15` | `PWR-15` | `TPL-16` | Site, vendor, technology and pilot readiness |
| `DSC-WF-16` | `WF-16` | `PWR-16` | `TPL-17` | Bounded non-production innovation experiment |
| `DSC-WF-17` | `WF-17` | `PWR-17` | `TPL-18` | Value, economics, equity and burden scenarios |
| `DSC-WF-18` | `WF-18` | `PWR-18` | `TPL-19` | Translation, commercialization and scale/stop gates |
| `DSC-WF-19` | `WF-19` | `PWR-19` | `TPL-20` | Evidence landscape and reproducible horizon scan |
| `DSC-WF-20` | `WF-20` | `PWR-20` | `TPL-21` | Implementation, adoption evaluation and withdrawal |
| `DSC-WF-21` | `WF-21` | `PWR-21` | `TPL-22` | Human-voice dissemination/evidence-to-decision draft |
| `DSC-WF-22` | `WF-22` | `PWR-22` | `TPL-23` | One bounded AI-agent charter/evaluation |
| `DSC-WF-23` | `WF-23` | `PWR-23` | `TPL-24` | Research leadership, capability and succession plan |
| `DSC-WF-24` | `WF-24` | `PWR-24` | `TPL-25` | Private whole-life purpose and renewal plan |

Implementation rules:

- preserve the adapter value in `source_recommendation_ids`;
- query the pinned catalog by exact `inventory_id`, version and content hash;
- copy its declared `workflow_id`, `power_id` and `template_id` only after uniqueness and relationship validation;
- never compute an ID by removing a prefix or matching the number alone;
- keep unresolved, retired or version-mismatched recommendations visible but blocked;
- preserve the exact source/current relation in export and migration receipts; and
- set `activation_state=recommendations_only_inactive` in every recommendation object.

All powers stay **Available Inactive**. All agents stay **PERM-P0 Disabled**. A preferred launcher is not permission. Tool IDs remain empty until actual Hermes capability discovery and a separately approved tool/data/action contract.

## 8. Agent recommendation by declared task intent

- approved public/authoritative source landscape → `AGT-01`;
- boundary questions and human-route preparation → `AGT-02`;
- non-authoritative study/design option drafting → `AGT-03`;
- approved aggregate/enclave-export methods and reproducibility review → `AGT-04`;
- participant burden, accessibility and equity question review → `AGT-05`;
- portfolio, funding and dependency scenarios → `AGT-06`;
- synthetic non-production experiment/translation planning → `AGT-07`;
- approved aggregate implementation/value learning scenarios → `AGT-08`;
- source-annotated plain-language dissemination draft → `AGT-09`;
- independent frozen-agent evaluation, kill and reconciliation evidence → `AGT-10`.

Actual runs separately require current authority, allowed data/source/tool/destination, one-run terms and human checkpoints. Personalization never activates an agent.

## 9. Capability ID translation

The adapters use hyphenated IDs. A versioned mastery model may use underscore IDs. Translate only by an explicit catalog; a recommendation never awards a badge.

| Mission Profile | Criteria-model domain |
|---|---|
| `ai-literacy` | `ai_literacy` |
| `prompt-design` | `prompt_design` |
| `evidence-research` | `evidence_informed_research` |
| `critical-thinking` | `critical_thinking` |
| `structured-problem-solving` | `structured_problem_solving` |
| `workflow-design` | `workflow_design` |
| `project-management` | `project_management` |
| `privacy-stewardship` | `data_privacy_stewardship` |
| `ethical-ai` | `ethical_ai_practice` |
| `edena-governance` | `edena_governance` |
| `agent-supervision` | `agent_supervision` |
| `multi-agent` | `multi_agent_orchestration` |
| `knowledge-base` | `knowledge_base_development` |
| `automation-design` | `automation_design` |
| `artifact-creation` | `artifact_creation` |
| `evaluation-qi` | `evaluation_quality_improvement` |
| `role-development` | `role_specific_professional_development` |

## 10. Semantic validation before persistence

The server must prove:

1. exactly one Primary workspace;
2. approved profiles and provenance have non-null approval times, and proposed/rejected values do not masquerade as approved;
3. every approved user-visible value has exact or documented parent-group provenance;
4. workspace, recommendation and agent IDs are unique where required;
5. every source/current workflow-power-template relation resolves uniquely to the pinned canonical catalog;
6. `DSC-WF-*` appears only as source inventory provenance and `WF-*` only as current runnable recommendations;
7. recommendations make zero model, retrieval, agent, tool, connector, persistence or external-action calls;
8. one workspace's goals, authority, data or evidence never silently enter another workspace;
9. no identity, credential, authority, approval, consent, research status, scientific finding or operational result is inferred;
10. Demo/Starter content is labeled and excluded from badges, analytics, research records and outcome claims;
11. memory remains Off/session-only until separate explicit consent; and
12. raw adapters, prohibited data and secrets are absent from durable profile, logs and exports.

Tests cover Discover-only, Soul-only, both consistent, both conflicting, neither, unknown role, unsupported version, invalid enum, multiple/no Primary, catalog missing/duplicate/version mismatch, raw-content rejection, demo handling, approve/edit/reject/delete/export and provenance completeness.
