# SHIFT Security, Privacy, Safety, and Quality-Authority Checklist

Hermes must include this checklist in the target release and link every completed item to runtime evidence. Any critical item that is unchecked, Not Run, Failed, Blocked or Unsupported blocks Operational. Documentation is not execution evidence.

## Supply chain and installation

- [ ] Manifest, checksums, pinned source hashes and archive paths are verified before mutation.
- [ ] Immutable inputs remain unchanged and implementation is copy-on-write.
- [ ] Dependencies are locked; licenses/SBOM and vulnerability review are recorded.
- [ ] Final ZIP has one safe root, exact inventory/checksums and no traversal, symlink, duplicate or case/Unicode collision.
- [ ] Clean install, upgrade, restart, backup/restore, rollback, overlay removal and uninstall pass on every claimed OS/version.

## Local service and authentication

- [ ] Service binds only to loopback and validates Host/Origin.
- [ ] First-run owner enrollment, unique install secret, authenticated sessions, expiry/logout and failed-login limits pass.
- [ ] Cookies, CSRF, deny-by-default CORS, security headers, request/file limits, timeouts and rate limits pass.
- [ ] No public share, wildcard bind, unauthenticated API or remote-admin path exists.

## Secrets and diagnostics

- [ ] Provider keys and credentials stay server-side and out of JS/HTML/URLs/browser storage/logs/errors/exports/backups/screenshots.
- [ ] `.env.example` has names only; secret storage/rotation and permissions are documented.
- [ ] Diagnostics are redacted, local, bounded, inspectable and deletable.
- [ ] Production contains no test key, default password, canned answer, fake citation/tool event or mock-provider fallback.

## No-PHI, live-care, and shadow-system boundary

- [ ] Direct identifiers, patient/event/coworker free text, exact timestamps, room links, screenshots, rare combinations and quasi-identifiers stop before persistence and are not echoed.
- [ ] EHR/chart/handoff/patient task/event/peer-review/row-level content cannot enter the personal OS.
- [ ] Live patient, medication, dose, compatibility, device, alarm, triage, deterioration, treatment, assignment, delegation and scope requests stop without soliciting more detail and route to authorized humans/processes.
- [ ] Immediate safety/emergency cues route promptly without diagnosis or productivity coaching.
- [ ] No shadow documentation, unofficial report, live task list, clinical decision, competence or fitness output exists.

## Context and employer isolation

- [ ] Exactly one active hat, employer/personal context, workspace, deployment mode, authority state and data ceiling controls each mission.
- [ ] Practice, QI, Professional Growth, Life/Recovery and Community/Leadership records are repository-partitioned.
- [ ] Hybrid/multiple-employer records cannot leak through search, summaries, suggestions, memory, exports, analytics, agents, cache or backup.
- [ ] Private readiness, fatigue, health, relationship, financial and life data never enter employer/QI views, measures or exports.
- [ ] Health narratives and employment-dispute details never persist, enter memory/index/export/badge/QI/agent context, or appear in receipts; the system stops without echoing and routes to an appropriate qualified human or official process.
- [ ] Transfers are explicit, minimum, field-allowlisted, purpose/source/destination/version/hash/reviewer/expiry bound and receipted.

## Institution-Approved Quality Workspace

- [ ] Installation leaves institutional QI unprovisioned and unavailable.
- [ ] Binding validates authenticated institution, sponsor/decision owner, charter/decision rights, human QI/EBP/research determination, data-steward/privacy receipt, and an exact separately approved aggregate created outside SHIFT with content hash, query/definition/version, provenance, suppression/small-cell rule, access, retention/deletion, approval/expiry, and change/release pathways.
- [ ] AI never classifies a project as QI, EBP, research, evaluation, exempt, approved or IRB-not-required.
- [ ] Missing/expired/changed authority, determination, data, scope, site, population, method, intervention, audience or destination suspends the bind and invalidates dependent approvals.
- [ ] Data use, pilot, workflow/policy/clinical change, standardization, spread, publication and release each require the correct current human approval.

## Data, measurement, equity, and workforce protections

- [ ] Quality inputs are public, clearly synthetic, or an exact separately approved aggregate created outside SHIFT in the bound workspace; row-, person-, event-, and narrative-level inputs are rejected even when labeled deidentified.
- [ ] Every measure stores definition, numerator/denominator or unit, exclusions, source, owner, frequency, missingness, lag and interpretation.
- [ ] Small/sparse cells, risky subgroup combinations, linkage and reidentification are suppressed or routed.
- [ ] Run charts preserve order, baseline, annotations, source and data-quality limits; AI does not invent causality, significance, special cause or improvement.
- [ ] No patient/staff ranking, prediction, monitoring, productivity score, sentiment inference or hidden profiling exists.
- [ ] No data is used for staffing, discipline, credentialing, compensation, performance management, retaliation or blame.
- [ ] Accessibility, equity and burden are reviewed without inferring sensitive traits.

## Sources, communication, and truth

- [ ] Consequential claims map to real source identity, version/date/status, scope/applicability, conflict, uncertainty and owner.
- [ ] Current local policy, orders, official resources and human chain remain controlling.
- [ ] Fabricated/unopened/irrelevant citations, invented statistics, false precision, generic slop, inflated impact and appropriated credit block release.
- [ ] Facts, observations, interpretation, inference, assumption, recommendation, decision and unknown remain distinct.
- [ ] No message, meeting, invitation, report, post, export or release occurs through the app; human handoffs show preview, audience, destination, data class, authority and approval.
- [ ] Artifact states use exactly `Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan → Authorized Execution → Completed Action → Evaluated Outcome`; Approved Plan is human scope review only, Authorized Execution is external human/official-system only with no app action, and Completed Action requires a verified external reference.
- [ ] Speak-up and huddle artifacts use observable no-PHI systems language and never become unofficial performance, event or competency records.

## EDENA, power, agent, and automation controls

- [ ] Every decision stores independent `edena_tier` and `absolute_stop`; Personal Red may continue only as a new clean fictional/generic exploration after deliberate acknowledgment when `absolute_stop=false`, while Institutional Red blocks operational progression until required review/authorization and every absolute stop hard-blocks everywhere.
- [ ] EDENA cannot override prohibited data/action, live safety, missing authority, institutional bind, context partition or agent permission.
- [ ] All 20 powers start Inactive, 18 workflows Preview Only, agents P0, external actions/connectors/schedules/sharing/background work Off and optional fifth launcher empty.
- [ ] One-run grants freeze exact purpose/context/data/source/tool/model/budget/time/retry/destination/expiry/reviewer/stop/fallback/rollback.
- [ ] P1/P2 are the only agent run ceilings; P3 is separately approved deterministic local personal reminder logic only after three supervised successful runs, with no model, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input, or quality decision; P4 is absent.
- [ ] No self-activation, delegation, recursion, permission widening, silent retry or invisible continuation exists.
- [ ] Pause All and Kill cancel real work without false completion.
- [ ] Automation eligibility is limited to approved low-risk local work after three supervised successes and never includes clinical, event, EHR, staffing, surveillance, scoring, QI-decision or external-release actions.

## Hermes, retrieval, memory, and profile

- [ ] Connection state derives from recent authenticated health/capability checks.
- [ ] Genuine streaming, cancellation, retry limits, sessions, structured errors and tool-event separation pass.
- [ ] Raw `SOUL.md` and raw quiz answers are never displayed, copied, persisted, logged or exported; only user-approved minimum derived context is used.
- [ ] Retrieved/tool instructions cannot override governance; prompt/tool/file injection tests pass.
- [ ] Citations appear only from retrieved/validated records with claim mapping and limitations.
- [ ] Memory is opt-in, structured, purpose-bound, inspectable, editable, exportable, forgettable, deletable, expiring and context-isolated.

## Persistence and recovery

- [ ] Transactions, constraints, optimistic concurrency, migrations and restart persistence pass.
- [ ] Backup is consistent, versioned, protected, checksummed and restore-tested; owner-controlled private backups contain only the private store, institutional backups contain one separately authorized project store, and no backup crosses contexts.
- [ ] Import validates schema/version/size/content/ownership/context/duplicates before commit.
- [ ] Corrections mark dependent artifacts, approvals, sources and awards stale.
- [ ] Deletion covers primary/derived content, cache, index, memory, staging and attachments while retaining only lawful non-content audit facts.
- [ ] Safe Reset previews and restores the documented safe state without deleting unrelated work.

## Accessibility, capacity, and humane use

- [ ] Keyboard, focus, landmarks, labels/errors, screen-reader order, contrast, reduced motion, zoom/reflow, mobile and print pass.
- [ ] Meaning never relies on color; synthetic, unknown, stale, blocked and offline states are explicit.
- [ ] No shame, streak pressure, coerced disclosure, deceptive urgency or engagement optimization exists.
- [ ] Plans protect sleep, meals, recovery, commute, health, caregiving, relationships and buffer.
- [ ] Overload produces Minimum Mode, simplification, re-entry and human support; the app does not diagnose fatigue, burnout, impairment or health.
- [ ] QI work shows protected/paid time and does not normalize unpaid off-clock work.

## Release evidence

- [ ] Every visible control works or is disabled with a truthful reason and mapped test.
- [ ] All applicable build-layer control/full-stack tests have execution records.
- [ ] All 40 foundation + 120 SHIFT + 16 integration checks have packaged-runtime evidence.
- [ ] Production, offline, outage, cancellation, restart, clean-install and safe real-Hermes smoke paths are recorded.
- [ ] Final application readiness and institutional-QI readiness are separately truthful and list all blockers.
