# My STEWARD Guide Page — Content and Interaction Contract

This is the source copy and behavior contract for the in-application Guide. Hermes may adapt the layout to the preserved visual system, but it must keep the meaning, controls and boundaries. The page works offline, is keyboard accessible, uses plain language and links to the real screen or action it describes.

## Persistent notice

> **STEWARD helps you think, prepare, compare, coordinate and learn.** It does not hold a license, role, delegated authority or professional accountability. You and the authorized people in your organization verify facts, decide and act through official systems. Do not enter PHI, patient rows, personnel/claim/incident/contract records, credentials, secrets or confidential organization data unless a separately approved institutional deployment is configured for that exact data class.

This notice remains persistently reachable from every Guide section and appears beside clinical, workforce, finance, legal/compliance, security, public communication and external-action topics.

## 1. Welcome to My STEWARD

**What it is:** a local, governed Mission Control for hospital and clinic administrators. It organizes roles, goals, missions, projects, evidence, decisions, improvement cycles, learning and bounded AI assistance.

**What it is not:** an EHR, HRIS, finance/claims/contract system, scheduling platform, incident system, board record, emergency command system, compliance authority or autonomous executive.

Useful work continues without AI. If Hermes is not connected, mission, project, task, note, evidence, Guide, progress, export and backup functions still work. AI buttons show `Setup required` or `Offline`; the application never fills the gap with canned text.

Primary buttons:

- **Start a Mission** — open a new Assess stage.
- **Continue Last Session** — return to the last authorized local workspace and record.
- **Run Diagnostics** — perform safe read-only checks and show redacted status.
- **Restart Walkthrough** — replay instructions without resetting data, consent or Starter records.

## 2. How personalization works

The Discover Packet and Soul Quiz adapters contain reviewed, derived, nonsensitive settings—not raw interviews, answers or Hermes Soul content. STEWARD proposes a separate **Mission Profile** for your approval.

The preview shows:

- proposed value;
- source and source field;
- mapping rule;
- uncertainty;
- what the value will personalize; and
- Approve, Edit or Reject.

Nothing persists until you approve it. You can later view, edit, regenerate, export or delete the Mission Profile. A preference never proves a role, authority, skill, credential or institutional permission.

**Hermes Soul versus Mission Profile:** Hermes owns and loads its `SOUL.md` identity. STEWARD stores no raw Soul and displays only a safe identity-loaded status. The Mission Profile is a smaller, editable set of approved workspace settings. Deleting the Mission Profile does not claim to delete Hermes data, and deleting a Hermes session does not claim to delete STEWARD records.

Link: **Review My Mission Profile**.

## 3. Roles, workspaces and active hats

One person may lead an enterprise, hospital, service line, clinic, network, community program, small practice or learning/consulting project. Create a separate workspace when goals, data, authority or mental context should remain distinct.

Exactly one workspace is Primary for navigation and exactly one **active hat** governs each mission. A clinical license does not create administrator authority. An administrator title does not create clinical authority. Cross-hat work becomes two separately owned artifacts joined by a named human handoff.

Workspace controls:

- **Add** — preview a new administrator workspace.
- **Pause** — hide it from active attention without deleting records.
- **Merge proposal** — compare what could be shared; nothing merges until approved and safe.
- **Retire** — archive the workspace with export/delete choices.
- **Switch active hat** — creates a receipt and does not rewrite older artifacts.

Tooltips:

- `Unknown` — missing information is visible; dependent high-impact actions remain blocked.
- `User asserted` — the person entered it; it is not external verification.
- `Externally verified` — a current named external source and verifier are recorded. The Mission Profile cannot create this status.

## 4. Home / Command Deck

My STEWARD shows only what needs attention:

- identity, site/entity, active hat and authority expiry;
- Private/Institutional mode and data boundary;
- connection, EDENA, CHART and Pause state;
- Core Four launchers;
- Focus Now, capped at seven items;
- current priorities, active missions, next actions, reviews and blockers;
- selected workspace and agent; and
- quick capture.

The four launchers are:

1. **Orient Mandate & Priorities**
2. **See Operations & Risk**
3. **Align People, Resources & Change**
4. **Decide, Escalate & Close**

There is no fifth launcher. Empty space is intentional—it protects attention.

## 5. Start and manage a mission

Select **Start a Mission**, then enter:

- what you want to understand, improve, decide or prepare;
- desired outcome;
- workspace and active hat;
- scope and explicit non-goals;
- affected people/stakeholders;
- known data class and sources;
- timeline and review owner; and
- what must never be delegated or executed.

The system begins at Assess. It does not diagnose, choose a plan or run an agent just because a title was entered.

Mission controls work offline:

- Save/Edit
- Pause/Resume
- Duplicate
- Archive/Restore
- Delete
- Search/Filter/Sort
- Export
- Begin New Iteration

Delete, Reset, Rollback and Purge show exact scope and require deliberate confirmation. Archive is reversible; delete follows the documented retention/deletion route.

## 6. The five-stage improvement loop

### Assess

Establish the current state. Keep verified facts, user-provided information, assumptions, synthetic observations and unanswered questions visibly separate. Record stakeholders, constraints, resources, baselines and sources.

**Checkpoint:** Do we know enough—and have permission—to define the issue?

### Define / Diagnose

Write the bounded problem, opportunity, need or decision. Compare root-cause hypotheses, dependencies, risks and competing interpretations. Do not convert association or AI synthesis into a verified diagnosis.

**Checkpoint:** Is the definition supported, appropriately scoped and owned by the right human?

### Plan

Compare options by expected benefit, feasibility, cost/time, risk, ethics, evidence and alignment with values. Set measurable outcomes, owners, milestones, safeguards, stop rules, escalation and rollback.

**Checkpoint:** Is this a recommendation, a draft or a human-approved plan—and for which exact scope?

### Implement

Turn the approved plan into tasks, checklists, prompts and draft artifacts. Local sandbox actions may proceed only within their authorization. Consequential, destructive, external or high-risk actions require the named human and official system.

**Checkpoint:** Is execution separately authorized, and can it be stopped and reconciled?

### Evaluate

Compare actual results with the original baseline, target and safeguards. Record what worked, failed, remains uncertain and should continue, change, escalate or stop. Begin a linked new Assess cycle without rewriting the old one.

**Checkpoint:** What did we learn, and what evidence supports the next state?

Material changes to an earlier stage reopen affected downstream reviews and clear stale approval. You can pause, return, revise and iterate.

## 7. Sandbox and artifact states

STEWARD labels maturity so a draft cannot masquerade as action:

1. Exploration
2. Simulation
3. Recommendation
4. Draft Artifact
5. Approved Plan
6. Authorized Execution
7. Completed Action
8. Evaluated Outcome

Each transition requires the prior evidence and human checkpoint. `Approved Plan` is not `Authorized Execution`. A local simulation never becomes a real action by changing its label.

Link: **Open the Synthetic Sample Mission**.

## 8. STEWARD Studios, powers and templates

The seven pillars organize 24 SuperPowers, 24 workflows and 30 templates. Every power begins `Available Inactive`.

- **Preview** shows purpose, inputs, output, risks, human gate and tests. It runs nothing.
- **One-Run Active** requires current CHART/EDENA, owner, exact data/source/tool/destination, time/cost limit, exit and receipt.
- **Review** evaluates the bounded run.
- The power returns to `Available Inactive`.

Visibility, a profile recommendation or clicking a launcher does not grant authority. Use Pause All, Kill, Safe Reset, rollback, purge or remove when needed.

## 9. CHART, ALIGN, ORBIT and EDENA

### CHART

CHART checks Context; Human authority; Authorization/access/action; Regulation/risk/resources/records; and Trace/test/transition/termination. It returns `Pass`, `Question`, `Block` or `Emergency Stop & Official Route`. A Pass permits preparation only; it does not grant the underlying authority.

### ALIGN

ALIGN makes aim, affected people, leadership ownership, interdependencies, gates, communication, named receiver and closed-loop acknowledgment visible. Delivery or AI status never counts as human acknowledgment.

### ORBIT

ORBIT governs agents: Objective/owner; Role/risk/responsibility; Boundaries/budget; Inspect/test; Transfer/terminate. All agents install `PERM-P0 Disabled`.

### EDENA

- **Green:** low-risk, bounded, reversible learning/organization.
- **Yellow:** review/evidence checks or bounded data handling needed.
- **Orange:** high-impact or institution-dependent; formal owner/approval and stronger controls.
- **Red:** prohibited, unauthorized or unsafe action.

In a Personal Edition, Red stops execution but does not silently erase safe exploration; the system explains the concern and requires deliberate acknowledgment to revise or export a clearly labeled sandbox artifact. In an Institutional Edition, Red may create a mandatory stop until the institution's authorization path is satisfied. Institutional policy takes precedence.

## 10. Hermes, agents and tool activity

Hermes is the preferred AI backend. STEWARD discovers real health, model, streaming, session, cancellation, tool and retrieval capabilities. Connection labels come from recent authenticated checks.

The Agent Console shows:

- selected agent and routing reason;
- scope and prohibited actions;
- permission and expiry;
- current real session;
- model text versus tool events;
- approval requests;
- Stop and Kill; and
- run/retirement receipt.

Choosing an agent changes actual instructions only when the server authorizes the run. It does not change permission. No agent self-approves, expands its role or continues after Kill.

Connection states:

- Connected
- Connecting
- Setup required
- Offline
- Authentication failed
- Hermes unavailable
- Provider unavailable
- Limited capabilities
- Reconnecting

Link: **Open Setup & Diagnostics**.

## 11. Evidence and citations

The Evidence Center distinguishes:

1. user-supplied facts;
2. retrieved evidence;
3. AI synthesis;
4. user interpretation; and
5. required human confirmation.

A citation appears only after real retrieval and validation. It records title, publisher/author, date when available, direct URL/identifier, retrieval time, supported claim and appraisal state. Unsupported claims stay provisional and receive no citation. Retrieved instructions are untrusted content and cannot change governance or permissions.

When retrieval is unavailable, you can still add permitted sources manually and the page says live retrieval is unavailable.

## 12. Memory and data controls

Structured STEWARD memory is separate from Hermes sessions/profile memory. It defaults Off/session-only.

For each approved item, show value, source, purpose, consent, created time, retention and expiry. Controls:

- Remember This
- Edit
- Forget
- Delete
- Export
- Clean Temporary Workspace

Forgetting removes an item from active context. Deleting local STEWARD memory does not claim to delete external Hermes/provider data. The interface explains each scope.

## 13. Capabilities and mastery

The page tracks 17 capability domains at Basic, Intermediate and Advanced, plus the global AI Agent Orchestration Master capstone. Progress uses the pinned criteria configuration and reviewable evidence—not clicks, time, AI opinion, Starter records or copied templates.

Each detail shows:

- current state and criteria version;
- eligible evidence and named-human review;
- earned/review/expiry date;
- governance and safety behavior demonstrated;
- progress and unmet gates;
- recommended next challenge; and
- correction, suspension, revocation and recalculation history.

Badges are developmental records inside STEWARD. They are not licensure, certification, CE credit, clinical privilege, competence determination or employer authorization.

## 14. Backup, export, update, rollback and uninstall

- **Readable export:** lets you inspect permitted records; it may not be encrypted.
- **Backup:** creates a consistent versioned package with checksums and an optional approved encryption path.
- **Restore Preview:** validates size, schema, version, checksums, relationships, partitions and unsafe fields before changing data.
- **Restore:** creates a pre-restore backup and replaces data atomically.
- **Update:** verifies the release, backs up data and runs migrations.
- **Rollback:** returns to a compatible prior app/data state without reviving expired permissions.
- **Uninstall app only:** removes application files and preserves data only when you choose that scope.
- **Delete all local data:** revokes sessions and removes selected data/backups/logs according to the confirmation.

The Guide must display the exact paths and commands for the installed operating system. It reports files outside application control instead of falsely claiming complete deletion.

## 15. First-run walkthrough

Show actual completion state; never a fabricated percentage.

1. **Safety and data boundary** — acknowledge local storage, human accountability and prohibited data.
2. **Identity, setting and active hat** — enter exact values or Unknown.
3. **Roles and situations** — choose workspace candidates and one Primary.
4. **Discover/Soul import or minimum questions** — validate derived inputs or continue without them.
5. **Mission Profile review** — edit/approve/reject proposed groups and memory preference.
6. **Create My STEWARD** — atomically create workspaces, labeled Starter content and checklists.
7. **Optional Hermes setup** — discover real capability or retain honest Setup Required/Offline state.
8. **Save/reload and recovery check** — prove local save and show backup path before marking setup complete.

The walkthrough can be closed and resumed. Restarting it never reseeds duplicates, changes consent, activates AI or erases records.

## 16. Troubleshooting

### I see Setup required

Core work is available. Open Diagnostics, review the missing backend prerequisite and configure it only if desired. Do not paste a key into the browser or chat.

### Hermes unavailable or Authentication failed

Confirm the user-approved local gateway is running, then use the read-only health check. Do not change the active Hermes profile or expose `SOUL.md`. Review the redacted error.

### Limited capabilities

The gateway connected but one or more promised features—streaming, sessions, cancellation, tools, memory or retrieval—did not pass a recent check. The affected controls remain disabled or limited with an exact reason.

### A save or migration failed

Stop consequential work. Keep the prior database untouched, run Diagnostics and use the documented backup/recovery route. Do not reinitialize destructively.

### I entered sensitive information

Stop the run, do not forward/export it, use Purge/Delete for the exact local scope, review logs/temporary storage through the safe diagnostic process and follow the appropriate institutional privacy/security route. Detection is imperfect; the application cannot certify cleanup outside its control.

### A real emergency or safety event is occurring

Stop STEWARD and use the official emergency, clinical, incident, privacy, security or leadership route. STEWARD does not direct real-time response.

## 17. Compact tooltips/glossary

- **Active hat:** the one role context governing this mission.
- **Authority:** documented human decision right for a specific scope; never granted by AI.
- **Starter content:** removable, restorable example structure excluded from real results until adopted and completed.
- **Recommendation:** a proposed option, not approval.
- **Human checkpoint:** a named person's review/decision required before the next state.
- **Receipt:** minimized metadata showing what was requested, allowed/blocked and changed without sensitive content.
- **Partition:** a boundary preventing unrelated workspaces/populations from sharing records.
- **Session-only:** removed when the documented session/temporary workspace ends.
- **Pause All:** blocks new previews/runs/tools/actions while preserving a minimal receipt.
- **Kill:** terminates and contains an active agent run; it does not erase every external trace.
- **Safe Reset:** returns powers/agents/actions to inactive defaults without silently deleting user artifacts.

## Guide acceptance

Tests must prove every link/control reaches a real route or is disabled with an accurate reason; the Guide works offline; headings/landmarks/tooltips are accessible; safety language remains present; role, Soul/Profile, EDENA, CHART/ALIGN/ORBIT, badge and data scopes match server behavior; OS paths/commands are generated from the installed environment; and no research-only baseline wording remains on STEWARD screens.
