
# User Installation Guide

1. Keep the original ZIP unchanged.
2. Verify its SHA-256 sidecar.
3. Extract a private working copy.
4. Run the embedded verifier.
5. Give the entire directory to Hermes and use `README-FIRST.md`.
6. Wait for read-only preflight and review the Activation Card.
7. Approve, revise, or cancel the exact card. Approval does not authorize patient data, clinical work, institutional context, connectors, messages, external actions, memory, or agents.
8. Keep S0–S4 receipts; installation may take multiple visible turns.
9. Use only fictional, public, or screened low-sensitivity content for first-run tests.
10. Accept only the evidence-based final readiness report.

Before first use, confirm the Activation Card names the exact protected application-data path and permission model. Hermes must prove owner-only effective access on your operating system. Store backup keys separately from backups, and do not accept an unencrypted backup fallback. If the platform cannot meet these controls, keep backup unavailable and treat security readiness as blocked.

Begin with the Core Four and preview no more than one ROUNDS power in the first week. Use Pause All whenever content, supervision, state, or destination is uncertain.
