# STEWARD Discover, Soul and First-Run Personalization Crosswalk

**Contract ID:** `NAIO-STEWARD-PERSONALIZATION-MAP-1.0.0`  
**Target schema:** `schemas/STEWARD-Mission-Profile.schema.json`  
**Input adapters:** `personalization/input-schemas/discover-packet-input.schema.json` and `personalization/input-schemas/soul-profile-input.schema.json`

This contract tells Hermes exactly how to create a proposed Mission Profile. It prevents silent field loss, ordinal workflow mapping, invented identity or authority, and accidental activation. Every mapped value remains a proposal until the user reviews it.

## 1. Processing order and hard boundaries

1. Validate file size, JSON syntax, unsafe keys, exact schema/version, closed fields and content boundary before mapping.
2. Reject raw Discover interviews, transcripts, raw quiz answers, raw `SOUL.md`, secrets and prohibited/restricted records. Do not copy rejected content into logs or an error receipt.
3. Normalize only the two versioned **derived** adapters. Preserve source file checksum, adapter version and JSON pointer; do not retain the raw source after approval unless the user separately elects to keep the derived adapter.
4. Apply the exact rules below to an in-memory proposed profile.
5. If two sources disagree, create two candidates and a conflict notice. Do not pick one based on recency, score or presumed authority.
6. Ask the minimum first-run questions for required fields that remain missing.
7. Show field/approval-group provenance, uncertainty and the effect of approval. Let the user edit, approve or reject each group.
8. Persist one version atomically only after the profile passes closed-schema and semantic validation.
9. Recommendations personalize display and a review queue only. They never activate a power, workflow, agent, tool, connector, memory category or external action.

Source priority is not an automatic winner. A deliberate current user edit supersedes an older approved profile value. Confirmed Discover and Soul values of the same field are peers; disagreement requires resolution. First-run input fills a gap or records the user's resolution. Institutional policy and verified authority are separate and always take precedence over preference.

## 2. Provenance unit

Every user-visible approval group requires a `field_provenance` record containing:

- target JSON pointer;
- source type and safe source reference;
- source JSON pointer;
- stable mapping-rule ID;
- derivation type;
- explicit uncertainty or `null`;
- proposed/approved/rejected status;
- approval time and update time.

Nested authority, memory, governance and recommendation fields should be separately reviewable in the UI even when an export groups their provenance at an object pointer. The semantic validator must show that every approved value is covered by either its exact pointer or a documented parent approval group. A source pointer is a reference to a derived adapter field, not permission to persist raw interview or Soul content.

## 3. Discover Packet adapter mapping

| Source pointer | Target pointer or disposition | Rule | Notes |
|---|---|---|---|
| `/schema`, `/packet_schema_version` | Validate only | `MAP-DISCOVER-VERSION-1` | Only the exact supported version maps. |
| `/generated_at` | Provenance metadata | `MAP-DISCOVER-METADATA-1` | Never treated as user confirmation time. |
| `/mission_statement` | `/mission_statement` | `MAP-DISCOVER-DIRECT-1` | Direct proposal; no mission is inferred when blank. |
| `/core_values` | `/core_values` | `MAP-DISCOVER-DIRECT-1` | Values are self-described derived settings, not personality facts. |
| `/current_priorities` | `/current_priorities` | `MAP-DISCOVER-DIRECT-1` | Global proposals; role allocation requires review. |
| `/goals/short_term` | `/goals/near_term` | `MAP-DISCOVER-GOAL-HORIZON-1` | Exact enum/name translation. |
| `/goals/medium_term` | `/goals/medium_term` | `MAP-DISCOVER-GOAL-HORIZON-1` | Direct proposal. |
| `/goals/long_term` | `/goals/long_term` | `MAP-DISCOVER-GOAL-HORIZON-1` | Direct proposal. |
| `/working_preferences/communication_style` | `/working_preferences/communication_style` | `MAP-DISCOVER-WORKSTYLE-1` | Direct proposal. |
| `/working_preferences/decision_style` | `/working_preferences/decision_style` | `MAP-DISCOVER-WORKSTYLE-1` | Direct proposal. |
| `/working_preferences/learning_preferences` | `/working_preferences/learning_preferences` | `MAP-DISCOVER-WORKSTYLE-1` | Direct proposal. |
| missing cadence/time fields | Ask first run | `MAP-FIRST-RUN-WORKSTYLE-1` | Do not invent cadence or availability. |
| `/role_goals[]/role_id` | Candidate `/role_workspaces[]/workspace_type` | `MAP-DISCOVER-ROLE-CANDIDATE-1` | Use the role table below; ambiguous mappings require selection. |
| `/role_goals[]/goal` | Candidate workspace `/goals[]` | `MAP-DISCOVER-ROLE-GOAL-1` | Keep linked to its source role and do not move it globally without review. |
| `/role_goals[]/success_measure` | Starter-mission candidate, not profile authority | `MAP-DISCOVER-ROLE-MEASURE-1` | Display in starter preview; adopting it requires a separate action. |
| `/role_goals[]/priority` | Workspace `/priority` | `MAP-DISCOVER-ROLE-PRIORITY-1` | Does not establish operational urgency or authority. |
| `/role_goals[]/default_edena` | Starter candidate only | `MAP-DISCOVER-EDENA-CANDIDATE-1` | Reclassify through current content/context; user preference cannot lower policy. |
| `/ai_boundaries/default_autonomy` | `/ai_preferences/default_support` | `MAP-DISCOVER-AI-1` | `suggest_only`, `prepare_only` and `bounded_draft` map identically. |
| `/ai_boundaries/may_support` | `/ai_preferences/may_support` | `MAP-DISCOVER-AI-1` | Preference only. |
| `/ai_boundaries/requires_confirmation` | `/ai_preferences/requires_confirmation` | `MAP-DISCOVER-AI-1` | May be strengthened, never weakened, by policy. |
| `/ai_boundaries/never_delegate` | `/ai_preferences/never_delegate` | `MAP-DISCOVER-AI-1` | Merge with immutable STEWARD prohibitions. |
| missing preferred agents | `/ai_preferences/preferred_agent_ids=[]` | `MAP-DISCOVER-AI-1` | Never guess or activate an agent. |
| `/governance_preferences/risk_tolerance` | `/governance_preferences/risk_tolerance` | `MAP-DISCOVER-GOVERNANCE-1` | Preference is not a risk classification. |
| `/governance_preferences/default_edena` | `/governance_preferences/default_edena` | `MAP-DISCOVER-GOVERNANCE-1` | Advisory default only; current classification controls. |
| `/governance_preferences/default_retention=local_non_sensitive` | `/governance_preferences/default_retention=local_nonsensitive` | `MAP-DISCOVER-RETENTION-ENUM-1` | Exact enum translation. `session_only` maps identically. |
| missing edition/data boundary | Ask first run; default Personal/private | `MAP-FIRST-RUN-GOVERNANCE-1` | Institutional mode cannot be inferred from title. |
| `/recommended_workflow_ids[]` | `/recommended_assets/source_recommendation_ids[]` | `MAP-DISCOVER-LEGACY-WORKFLOW-1` | Preserve as legacy provenance only. Never map `DSC-WF-n` to `WF-n` by number. |
| `/recommended_capability_ids[]` | `/recommended_assets/capability_ids[]` | `MAP-DISCOVER-CAPABILITY-1` | IDs share the supported 17-domain vocabulary; still user-reviewed. |
| `/uncertainties` | `/uncertainties` | `MAP-DISCOVER-DIRECT-1` | Preserve rather than smoothing them away. |
| `/source_provenance` | `field_provenance[].source_ref` | `MAP-DISCOVER-METADATA-1` | Store a bounded safe reference, not raw source content. |
| `/demo` | `/demo` | `MAP-DISCOVER-DEMO-1` | `true` forces Starter/demo labeling and achievement exclusion. |

## 4. Soul Profile adapter mapping

| Source pointer | Target pointer or disposition | Rule | Notes |
|---|---|---|---|
| schema/version/scoring metadata | Validate/provenance only | `MAP-SOUL-VERSION-1` | No score becomes authority or competence. |
| `/completed_at`, `/user_confirmed_at` | Provenance metadata | `MAP-SOUL-METADATA-1` | A null confirmation keeps all fields proposed. |
| `/role_constellation[]` | Candidate `/role_workspaces[]` | `MAP-SOUL-ROLE-CANDIDATE-1` | Apply the role table and authorization enum translation below. |
| constellation `unverified` or `external_unverified` | workspace `unknown` | `MAP-SOUL-AUTH-ENUM-1` | Neither is external verification. |
| constellation `user_asserted` | workspace `user_asserted` | `MAP-SOUL-AUTH-ENUM-1` | Still does not grant permissions. |
| `/core_values` | `/core_values` | `MAP-SOUL-DIRECT-1` | Conflict with Discover requires user resolution. |
| `/mission_and_purpose/mission` | `/mission_statement` | `MAP-SOUL-MISSION-1` | Conflict with Discover requires user resolution. |
| `/mission_and_purpose/guiding_principles` | Candidate `/core_values` | `MAP-SOUL-PRINCIPLES-1` | Keep separately visible before any merge. |
| `/mission_and_purpose/populations` | Situation notes only | `MAP-SOUL-POPULATION-1` | Never infer employer, setting or authority. |
| `/learner_and_developmental_stage` | Candidate `/strengths_and_growth/growth_areas` | `MAP-SOUL-DEVELOPMENT-1` | User must reword/approve; not a competence assessment. |
| `/advanced_studies[]` | Candidate goals and `learning_certification` situation | `MAP-SOUL-STUDY-1` | Preserve status/date as a proposed goal; never claim enrollment or completion. |
| `/working_and_learning_preferences/*` | `/working_preferences/*` | `MAP-SOUL-WORKSTYLE-1` | Direct proposals for the three matching fields. |
| `/presentation_preferences/theme_token` | `/presentation_preferences/theme_token` | `MAP-SOUL-PRESENTATION-1` | Visual choice only. |
| `/presentation_preferences/tone` | `/presentation_preferences/tone` | `MAP-SOUL-PRESENTATION-1` | Never changes safety language or facts. |
| `/role_synergies` | `/situation_context/notes` candidates | `MAP-SOUL-ROLE-DYNAMICS-1` | Preserve as user-reviewable interpretation. |
| `/role_tensions` | `/uncertainties` and situation-note candidates | `MAP-SOUL-ROLE-DYNAMICS-1` | Do not diagnose. |
| `/wellness_limits` | `/working_preferences/time_constraints` | `MAP-SOUL-WELLNESS-1` | Preserve limits; never use them for employment decisions. |
| `/ai_relationship_preferences` | AI-support and dashboard candidates | `MAP-SOUL-AI-RELATIONSHIP-1` | No direct agent selection or activation. |
| `/governance_boundaries/may_support` | `/ai_preferences/may_support` | `MAP-SOUL-GOVERNANCE-1` | Merge only after conflict review. |
| `/governance_boundaries/prepare_only` | `/ai_preferences/requires_confirmation` candidates | `MAP-SOUL-GOVERNANCE-1` | Preserve the stricter interpretation. |
| `/governance_boundaries/requires_confirmation` | `/ai_preferences/requires_confirmation` | `MAP-SOUL-GOVERNANCE-1` | Union with immutable controls. |
| `/governance_boundaries/requires_supervision` | `/ai_preferences/requires_confirmation` candidates | `MAP-SOUL-GOVERNANCE-1` | UI retains the supervision label. |
| `/governance_boundaries/requires_accountable_human_judgment` | `/ai_preferences/never_delegate` candidates | `MAP-SOUL-GOVERNANCE-1` | Human decision boundary remains explicit. |
| `/governance_boundaries/never_delegate` | `/ai_preferences/never_delegate` | `MAP-SOUL-GOVERNANCE-1` | Cannot weaken STEWARD prohibitions. |
| `/governance_boundaries/memory_allowed` | `/memory_preferences/allowed_categories` | `MAP-SOUL-MEMORY-1` | Memory stays disabled until separate explicit consent. |
| `/governance_boundaries/memory_denied` | `/memory_preferences/denied_categories` | `MAP-SOUL-MEMORY-1` | Denials take precedence. |
| `/governance_boundaries/escalation_rules` | Governance display and mission safeguards | `MAP-SOUL-ESCALATION-1` | Does not create an external approval route. |
| `/dashboard_recommendations[]` | Workspace/module candidates | `MAP-SOUL-DASHBOARD-1` | Unknown or out-of-population roles require a separate lane decision. |
| `/uncertainties` | `/uncertainties` | `MAP-SOUL-DIRECT-1` | Preserve. |
| `/source_provenance` | `field_provenance[].source_ref` | `MAP-SOUL-METADATA-1` | Bounded safe reference only. |
| `/demo` | `/demo` | `MAP-SOUL-DEMO-1` | Demo content cannot earn badges or become real evidence. |

## 5. Role-to-workspace candidates

Exactly one approved STEWARD workspace is Primary. These are candidates, not automatic conversions.

| Adapter role ID | STEWARD candidate | Required review |
|---|---|---|
| `hospital-administrator` | `enterprise`, `hospital_facility` or `service_line` | Ask exact entity, site/service, active hat and authority. |
| `clinic-manager` | `clinic_practice` or `multi_site_network` | Ask whether one practice, a site, service or network is in scope. |
| `quality-safety` | Supporting `service_line` or `shared_administrator` | Ask owning function and official-system boundary. |
| `researcher` or `research-innovation` | Supporting `academic_public_nonprofit_community` or `administrator_learner_consultant` | Keep research governance separate; do not import a research population lane. |
| `digital-ai` | Supporting `administrator_learner_consultant` | Digital/AI context only; no agent permission. |
| `entrepreneur` | `independent_small_practice` or `administrator_learner_consultant` | Ask whether it is a real practice, private venture or learning context. |
| `community` | `academic_public_nonprofit_community` | Ask exact constituency and authority. |
| `advanced-studies` | `administrator_learner_consultant` | Learning goal only. |
| `shared-identity` | `shared_administrator` | Requires selection of one Primary operational context. |
| `nurse-manager` | `service_line`, `hospital_facility` or `clinic_practice` only when the person is commissioning the administrator lane | Keep clinical and administrative hats separate. |
| `prelicensure-support`, `staff-nurse`, `advanced-practice`, `nurse-educator`, `medical-resident`, `wellness-manager` | No automatic STEWARD workspace | Offer the appropriate separate product/lane or retain as contextual identity with no cross-population record join. |
| unknown role | No workspace | Show the source label, ask the user and preserve uncertainty. |

`authorization_status=externally_verified` is never derived from either adapter. It requires a separately recorded current external authority source and verifier. The Mission Profile cannot grant it.

## 6. STEWARD recommendation catalog

Legacy `DSC-WF-*` recommendations belong to a different baseline catalog. Preserve their IDs as source provenance only. Use the user's stated goal, setting and current priority to propose one or more target candidates from this table, show the match reason, and require approval. There is no numeric crosswalk.

| Target workflow | Intent | Power | Primary template |
|---|---|---|---|
| `WF-01` | Strategic North Star, Mandate & Ninety-Day Alignment | `PWR-01` | `TPL-05` |
| `WF-02` | Executive Decision, Options, Pre-Mortem & Receipt | `PWR-02` | `TPL-06` |
| `WF-03` | Portfolio, Dependency, Capacity & Benefit Gate | `PWR-03` | `TPL-07` |
| `WF-04` | Board or Committee Brief, Agenda & Action Closure | `PWR-04` | `TPL-08` |
| `WF-05` | Access, Demand, Capacity & Equity Brief | `PWR-05` | `TPL-09` |
| `WF-06` | Flow, Handoff, Constraint & Reversible-Test Lab | `PWR-06` | `TPL-10` |
| `WF-07` | Daily Huddle, Seven Signals, Escalation & Closure | `PWR-07` | `TPL-11` |
| `WF-08` | Hospital, Clinic or Multi-Site Operating-Model Canvas | `PWR-08` | `TPL-12` |
| `WF-09` | Budget, Forecast, Variance & Sensitivity Review | `PWR-09` | `TPL-13` |
| `WF-10` | Aggregate Revenue-Cycle, Denial & Contract Learning Review | `PWR-10` | `TPL-14` |
| `WF-11` | Procurement, Vendor, Asset & Exit Due Diligence | `PWR-11` | `TPL-15` |
| `WF-12` | Workforce Capacity, Workload & Skill-Mix Scenario | `PWR-12` | `TPL-17` |
| `WF-13` | Psychological Safety, Listening Themes & Response Commitments | `PWR-13` | `TPL-18` |
| `WF-14` | Change Impact, Plain-Language Communication, Learning & Adoption Plan | `PWR-14` | `TPL-19` |
| `WF-15` | Leadership Charter, Delegation, Succession & Protected Life | `PWR-15` | `TPL-20` |
| `WF-16` | Quality, Safety, Accreditation & Regulatory Readiness Crosswalk | `PWR-16` | `TPL-21` |
| `WF-17` | Policy, Control, Evidence & Exception Review | `PWR-17` | `TPL-22` |
| `WF-18` | Equity, Accessibility & Community Impact Review | `PWR-18` | `TPL-23` |
| `WF-19` | Synthetic Emergency, Continuity & Downtime Exercise | `PWR-19` | `TPL-24` |
| `WF-20` | Privacy, Cybersecurity & Third-Party Risk Intake | `PWR-20` | `TPL-25` |
| `WF-21` | Incident, Issue, Corrective Action & Closure Governance | `PWR-21` | `TPL-26` |
| `WF-22` | Digital & AI Use-Case Intake, Stage Gate & Retirement Plan | `PWR-22` | `TPL-27` |
| `WF-23` | ORBIT Agent Charter, Permission & Human-Handoff Design | `PWR-23` | `TPL-28` |
| `WF-24` | Agent Evaluation, Run Receipt, Incident & Retirement | `PWR-24` | `TPL-29` |

Every power remains `Available Inactive`; every agent remains `PERM-P0 Disabled`. A profile recommendation only adds a reviewable launcher candidate. Tool IDs remain empty until actual Hermes capability discovery and a separate approved tool contract.

## 7. Agent recommendation by declared task intent

Recommendations use task intent, not personality labels:

- source/version/applicability verification → `AGT-01`;
- executive options, assumptions and scenario brief → `AGT-02`;
- portfolio/dependency/capacity map → `AGT-03`;
- approved aggregate access/flow analysis → `AGT-04`;
- approved financial scenario → `AGT-05`;
- approved workforce aggregate evidence → `AGT-06`;
- quality/policy/control crosswalk → `AGT-07`;
- accessible change/communication draft → `AGT-08`;
- synthetic resilience exercise → `AGT-09`;
- independent agent evaluation/kill evidence → `AGT-10`.

The user can approve an agent as a preferred launcher without granting permission. Actual selection, instructions, data, model/session and tools remain separately governed per run.

### Capability recommendation ID translation

The baseline adapter uses hyphenated IDs; the normative mastery model uses stable underscore IDs. Translate exactly as follows and never infer a badge from a recommendation:

| Mission Profile ID | Criteria-model domain ID |
|---|---|
| `ai-literacy` | `ai_literacy` |
| `prompt-design` | `prompt_design` |
| `evidence-research` | `evidence_informed_research` |
| `critical-thinking` | `critical_thinking` |
| `structured-problem-solving` | `structured_problem_solving` |
| `workflow-design` | `workflow_design` |
| `project-management` | `project_management` |
| `privacy-stewardship` | `data_privacy_stewardship` |
| `ethical-ai` | `ethical_ai_practice` |
| `edena-governance` | `edena_governance` |
| `agent-supervision` | `agent_supervision` |
| `multi-agent` | `multi_agent_orchestration` |
| `knowledge-base` | `knowledge_base_development` |
| `automation-design` | `automation_design` |
| `artifact-creation` | `artifact_creation` |
| `evaluation-qi` | `evaluation_quality_improvement` |
| `role-development` | `role_specific_professional_development` |

A capability recommendation only prioritizes a learning path. Progress starts at zero and is calculated solely from admissible evidence under the pinned criteria version.

## 8. First-run fields that adapters cannot establish

Ask, permit `Unknown`, and keep dependent actions blocked:

- preferred display name;
- exact title, entity/setting, site/service, active hat, authority source/scope/threshold/expiry and human routes;
- exact administrator workspace candidate and Primary choice;
- strengths and growth areas in the user's own words;
- situation type: steady state, transition, turnaround, merger integration, closure/consolidation, crisis, growth, new role, learning or reviewed other;
- cadence and time constraints;
- edition, data boundary and retention consent;
- memory enabled/disabled and allowed/denied categories;
- dashboard density, accessibility and any missing presentation preference;
- desired STEWARD assets and preferred agents as recommendations only; and
- any tool recommendation only after real capability discovery.

## 9. Semantic validation before persistence

The closed JSON Schema is necessary but not sufficient. The server must also prove:

1. exactly one Primary role workspace;
2. `approved` profile and provenance decisions have non-null approval times, while proposed/rejected profiles do not masquerade as approved;
3. every approved user-visible value has exact or parent-group provenance;
4. no duplicate workspace ID/type-label collision, recommendation ID or agent preference;
5. every STEWARD workflow/power/template relationship resolves to the canonical corpus;
6. legacy `DSC-WF-*` values appear only in `source_recommendation_ids`, never target workflow fields;
7. role/workspace and authorization translations follow this contract;
8. one role's goals/recommendations do not silently become another role's records;
9. Demo/Starter content is labeled and excluded from badges, operational analytics and outcome claims;
10. recommendations cause zero activation, model, retrieval, tool, connector or external-action calls;
11. memory remains session-only/Off until separately approved; and
12. raw adapters, raw Soul, prohibited content and secret values are absent from the durable profile, logs and export.

Mapping tests must cover Discover-only, Soul-only, both consistent, both conflicting, neither, unknown role, unsupported version, invalid enum, raw-content rejection, demo handling, profile edit/reject/approve/export/delete and provenance completeness.
