# STAFF / SHIFT Personalization Inputs

This folder defines the reviewable input boundary for **My SHIFT Mission Control**. It contains synthetic examples, not a real staff nurse profile and not proof of employment, assignment, scope, competence, QI authority, data access, project approval, or permission to act.

## Included examples

- `STAFF-Discover-Packet.synthetic.example.json` — fictional `NAIO-STAFF-DISCOVER-PACKET-ADAPTER-1` output governed by `../schemas/STAFF-Discover-Packet.schema.json`.
- `STAFF-Soul-Profile.synthetic.example.json` — fictional `NAIO-STAFF-SOUL-PROFILE-ADAPTER-1` derived result governed by `../schemas/STAFF-Soul-Profile.schema.json`, with no raw quiz answers or raw `SOUL.md` content.
- `STAFF-Mission-Profile.synthetic.example.json` — a proposed, unapproved merge target governed by `../schemas/STAFF-Mission-Profile.schema.json`.

The fixtures are structure examples only. They must never become personal facts, enabled workflows, agent permissions, quality evidence, institutional records, badge evidence, or proof of readiness.

Every derived Mission Profile carries `institutional_runtime_bind_required: true`. A profile is always a non-authoritative candidate configuration—even when it describes an institutional context. It cannot open an institutional workspace or prove authority. A separate authenticated, current, project-bound runtime bind object with human determination, exact aggregate, suppression, retention, decision-rights, release, and expiry receipts is mandatory.

## Target identity

- Product ID: `staff-nurse-life-practice-mission-control`
- Population lane: `staff_nurse_life_practice`
- Route: `/staff-nurses/dashboard`
- Canonical namespace: `snqi_shift.*`
- Home label: **My SHIFT Mission Control**
- Canonical Complete Edition: `NAIO-SNQI-COMPLETE-SHIFT-1.0`

`SHIFT-PWR-01`–`20`, `SHIFT-WF-01`–`18`, `SHIFT-TPL-01`–`25`, and `SHIFT-AGT-01`–`10` are build-layer machine IDs. The immutable source names or numbers remain the authority. These IDs aid routing and cannot widen source behavior.

`SNLP-SRC-01`–`10` are the only permitted build-layer source-recommendation IDs. They resolve through `../config/STAFF-Source-Recommendation-Registry.v1.json` to a bundled path and pinned SHA-256. An unknown ID, missing file, or hash mismatch disables the recommendation and produces only a content-free configuration error. A source recommendation never proves local adoption, current policy, clinical validity, institutional approval, or permission to act.

## Safe import flow

1. Work locally and start with read-only preflight.
2. Accept only the exact Staff versioned adapters and validate them against their distinct closed schemas; never accept the incompatible baseline adapter shape, arbitrary prose, a raw quiz transcript, or raw `SOUL.md`.
3. Reject PHI, patient narratives, chart material, screenshots, live-care details, row/person/event/narrative institutional data even when called deidentified, health narratives, employment-dispute details, restricted institutional information, credentials, secrets, and sensitive message bodies before logging, persistence, or AI forwarding. Route health or employment-dispute needs to the appropriate qualified human or official process without echoing content.
4. Validate structure, size, encoding, known enum values, duplicate IDs, and product compatibility.
5. Render a field-by-field preview showing source, mapping rule, uncertainty, target value, and conflicts.
6. Require the owner to approve, edit, reject, or leave unresolved each approval group.
7. Keep the Mission Profile `proposed` and unused until explicit approval. Unknown authority stays Unknown.
8. Seed only reversible, clearly synthetic starters. Agents remain `PERM-P0 Disabled`, tools are empty, external actions are Off, and recommended powers/workflows are inactive.

## Five isolated workspaces

One person may keep five separate workspaces under one identity:

| Workspace | Safe purpose | Default boundary |
|---|---|---|
| Practice | General learning, abstract screened reflection, source/policy questions, private communication rehearsal | No live care, shadow charting, scope decision, patient/event/coworker/rare-combination or reconstructable narrative, or official reporting |
| Quality Improvement | Systems problem framing, PDSA and measurement learning | Synthetic preview unless separately provisioned and institution-approved; only an exact separately approved aggregate created outside SHIFT; no row, person, event, narrative, or reconstructable data even if called deidentified |
| Professional Growth | Truthful learning, credential planning, portfolio and mentorship preparation | No fabricated competence, credential, authorship, validation, submission, or guarantee |
| Life / Recovery | Schedule-cycle planning, relationships, finances at a high level, minimum/re-entry mode | Private only; never exported or copied into an institutional workspace |
| Community / Leadership | Consent-based service and emerging-leadership exploration | No borrowed authority, contact, public claim, health guidance, or commitment without review |

Every mission has exactly one active workspace and one operational context. A context switch creates a new preview and excludes records from the prior context. Private Personal Mode and an Institution-Approved Quality Workspace are separate stores, permission sets, exports, retention rules, and audit scopes.

## Merge and precedence

1. Non-overridable trust shield, institutional controls, and current law/policy.
2. Current verified human authority and deployment context.
3. Explicit owner edits and approvals.
4. Reviewed Discover-derived fields.
5. Reviewed Soul-derived recommendations.
6. Conservative defaults and visible Unknown values.

No input may infer an employer, unit, role, schedule, health state, fatigue, attitude, competence, scope, project charter, QI-versus-research determination, data permission, protected time, change authority, or release approval. Conflicts stay visible; the system does not average them into a false answer.

## Recommendation contract

Personalization may recommend assets only. Every recommendation object must state:

- `activation_state: recommendations_only_inactive`
- `agent_permission_state: PERM-P0 Disabled`
- `tool_state: disabled`
- `tool_ids: []`

Recommendation is not activation. Agent IDs name possible assistants; they do not create a model call, tool, credential, network route, memory, schedule, destination, or background job.

Every `source_recommendation_id` must resolve to the exact ten-entry source registry. Hermes verifies the bundled path and hash before display, preserves the source's status and limits, and follows current local policy when it is more restrictive.

## Update, export, and deletion

The owner can re-open field review, correct a value, retire a workspace, export a redacted profile, or delete it locally. An update never silently reactivates an asset or changes context. Export excludes raw inputs, private-life data from institutional scope, secrets, restricted information, and unapproved fields. Deletion must distinguish local deletion from any provider retention the local system cannot control.
