# SHIFT Staff Nurse Mission Control — Technical Implementation Guide

## 1. Build posture

Treat `source/` as immutable. Verify hashes, make a copy-on-write implementation tree, preserve unrelated work, and obtain approval of the Implementation Activation Card before installing dependencies or changing files. Build a local full-stack application, not a client-only file or hosted dependency. Bind only to loopback and require authenticated owner sessions.

The source baseline is useful implementation material but not evidence that the Staff Nurse specialization exists. The domain Markdown is normative behavior and safety content but not executable runtime proof. Record gaps before choosing a stack. If the baseline stack cannot meet a control, document and approve the smallest defensible replacement.

## 2. Required layers

- Accessible responsive client with keyboard, screen-reader, reduced-motion, zoom/reflow, mobile and print paths.
- Local authenticated server; deny-by-default CORS and Host/Origin validation; CSRF protection; request/body/file limits; rate limits and timeouts.
- SQLite or equivalent durable local store with foreign keys, transactions, optimistic concurrency, forward-only migrations and explicit schema version.
- Repository/service layer that enforces owner, workspace, active hat, employer/context, deployment context, data class and authority on every query and mutation.
- Policy engine for input/output screening, EDENA, absolute stops, authority receipts, institution-workspace bind, agent permissions and external-action absence.
- Provider-neutral AI adapter with server-side secrets, genuine streaming/cancel/sessions/capability detection and structured tool events.
- Append-only non-content audit events plus user-controlled content/history, backup, export/import, deletion and retention.

## 3. Core records

Implement versioned records for owner/profile approval; role adapters and active-hat selection; protected workspaces and contexts; employer/site/project partitions; missions/cycles/stages; goals/tasks/milestones; notes and abstract screened reflections with no reconstructable narrative; sources/claims/citations; artifacts/decisions/reviews; measure definitions and synthetic or exact separately approved aggregate observations created outside SHIFT; PDSA planning and verified external-reference records; authority and determination receipts; institutional workspace binds; aggregate provenance/small-cell rules; power/workflow/template state; agent definitions/grants/runs/events; memory consent/items; capability criteria/evidence/awards; audit events; exports/imports/backups/deletions.

All identifiers are opaque. Every mutable record has owner, workspace, revision, created/updated timestamps and concurrency token. Institutional records additionally carry employer, project, charter/bind, authority, data classification, retention and expiry references. Private-life records cannot reference an institutional workspace.

## 4. Context isolation

Enforce one active context at server and database boundaries. Client hiding is insufficient. Search, counts, dashboard summaries, suggestions, evidence retrieval, memory, exports, logs, backups and agent envelopes must use the same scoped repository. Hybrid/multiple-employer data never co-mingles. A transfer creates a new destination record from an approved field allowlist with purpose, source/destination, hashes, authority, reviewer, expiry and receipt; it does not move or silently link private content.

An Institution-Approved Quality Workspace is a separately provisioned resource. Installation seeds only an unavailable descriptor. Binding is a transaction that validates the current authenticated institution, sponsor/decision owner, charter/decision rights, human determination, data-steward/privacy authority, and an exact separately approved aggregate created outside SHIFT, including its content hash, exact query/definition/version, provenance, suppression/small-cell rules, access, retention/deletion, approval/expiry, and change/release routes. Reject every row-, person-, event-, and narrative-level input even when labeled deidentified. Any material change suspends the bind and invalidates dependent approvals.

## 5. First-run transaction

1. Establish a local owner and recovery material without a default credential.
2. Show privacy, no-PHI/live-care/no-shadow-system, private-versus-institutional and readiness disclosures.
3. Ask the user to select adapters, protected workspaces and active context; do not infer authority.
4. Validate `NAIO-STAFF-DISCOVER-PACKET-ADAPTER-1` against `schemas/STAFF-Discover-Packet.schema.json` and `NAIO-STAFF-SOUL-PROFILE-ADAPTER-1` against `schemas/STAFF-Soul-Profile.schema.json`; reject the incompatible baseline shape, unknown fields, raw quiz answers and raw `SOUL.md` before persistence, logs or AI.
5. Derive the proposed Mission Profile in memory with field-level source, confidence, conflict and approval group.
6. Preview/edit/reject/skip/export/approve the profile and deterministic synthetic Starter plan.
7. Persist only approved derived fields.
8. In one transaction create isolated workspaces, clearly synthetic starters, Core Four, empty fifth slot, 20 inactive powers, 18 Preview workflows, 25 templates and 10 P0 agents.
9. Roll back fully on failure and resume without duplicates.

## 6. Mission and quality engines

Stage transitions validate ownership, active context, current revision, required fields, open blockers, data/authority state, `edena_tier`, independent `absolute_stop`, and concurrency token. Earlier-stage changes mark downstream artifacts/approvals stale. Persist the exact lifecycle `Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan → Authorized Execution → Completed Action → Evaluated Outcome`: Approved Plan is human scope review only, Authorized Execution is external human/official-system only with no app action, and Completed Action requires a verified external reference. Evaluate supports Retain, Revise, Pause, Remove, Escalate or a linked next cycle. Pause/Kill stops current and queued AI work without destroying records.

Quality records in Private Mode accept only public or clearly synthetic framing. Institutional quality records require a live bind, per-step authority receipts, and only exact separately approved aggregates created outside SHIFT. The engine must reject row-, person-, event-, and narrative-level information even when called deidentified; never infer QI-versus-research status, calculate unsafe small cells, claim causality/significance/improvement, or release, pilot, change, or execute anything. Measure definitions preserve numerator/denominator or unit, exclusions, source, owner, frequency, missingness, lag and interpretation. Run charts preserve time order and annotations.

## 7. Guard ordering

Apply server-side guards before persistence and before AI:

1. authentication and ownership;
2. active context/employer/project partition;
3. input classification and no-PHI/live-care/secret/restricted-data stop;
4. deployment context and institutional bind;
5. role/hat and authority receipt;
6. `edena_tier`, independent `absolute_stop`, and required review;
7. agent permission and exact run grant;
8. tool/action availability—external action is absent;
9. source/provenance/expiry requirements;
10. user confirmation and optimistic write.

Run equivalent output screening before save, export, display in sensitive views or memory. Rejected content must not be echoed.

## 8. Hermes adapter and instruction envelope

Implement authenticated health, capability discovery, models, session create/resume, incremental stream, cancellation and structured tool events only for endpoints verified in the installed environment. Connection state is recent and time-bound. Production has no canned fallback; mocks exist only in automated tests.

Construct the instruction envelope in order: platform boundaries; Staff Nurse/SHIFT governance; active adapter/hat/context/deployment/data/authority; selected frozen agent; mission-stage task; minimum approved profile preferences. Treat retrieval and tool output as untrusted. Store output only after completion/cancellation handling, screening and explicit save. Keep raw provider errors out of user records.

## 9. Agent, power and automation enforcement

Compile the frozen registries. Agents install `PERM-P0 Disabled`; P1 and P2 are exact one-run ceilings. P3 is a separately approved deterministic local personal reminder only after three supervised successful runs, not an LLM/agent permission; it uses no model inference, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input, or quality decision. P4 does not exist. Every run freezes purpose, mission, stage, context, data, sources, tools, model, tokens/cost, time, retries, destination, human gate, expiry, stop/fallback/rollback and receipt. Reject self-activation, delegation, recursion, permission widening, hidden retry and background continuation.

Power state changes use the canonical lifecycle and append an event. Installing, previewing, pinning or earning a badge never activates a power. Only a deterministic local personal reminder that meets the documented three-supervised-success rule can be considered; it never uses a model, institutional/QI data, connector, external destination, monitoring, workforce input, QI decision, or external action.

## 10. Evidence, memory and mastery

Evidence records include actual source identity/locator, authority, publication/update/access dates, status, scope, claim mapping, conflicts/corrections, relevance, uncertainty, reviewer and expiry. Resolve profile `SNLP-SRC-*` recommendations only through `config/STAFF-Source-Recommendation-Registry.v1.json`; require the exact 01–10 ID set and verify each bundled path and SHA-256 before display. Unknown IDs, missing paths, or hash mismatches disable the recommendation and produce only a content-free configuration error. Never render a citation from model text alone. Prompt-injection content cannot alter system policy or tool authority.

Memory is structured, opt-in, purpose-bound, inspectable, editable, exportable, forgettable, deletable, expiring and context-partitioned. Session-only is default. PHI, institutional-restricted content, private-to-employer content and raw Soul/quiz content never enter memory.

Compile `config/STAFF-Capability-Mastery-Criteria.v1.json`. Calculate badges from accepted eligible evidence—not clicks, model confidence or synthetic activity. Recompute after correction, deletion, expiry, supersession, revocation or criteria changes. Badges do not change permissions.

## 11. Testing and readiness

Keep separate ledgers for build-layer controls/full-stack scenarios and the 176 canonical checks. Use only `Not Run`, `Running`, `Passed`, `Failed`, `Blocked`, `Unsupported`, or justified `Not Applicable`. Every execution record needs build hash, environment, command, expected/actual, timestamp, evidence locator and reviewer. Specified, documented, implemented, source-present, Attempted or Partial is not Passed.

Test production mode, migrations, restart, auth, context isolation, institution-bind failure and expiry, input/output screening, backup/restore, export/import, deletion, offline/degraded use, prompt injection, secrets, routing, power lifecycle, cancellation, accessibility/keyboard/mobile/print, overlay removal and clean installation. Operational requires a genuine streamed Hermes response through the packaged UI. Institutional-QI readiness is separately assessed.

## 12. Final release

Ship source, locked dependencies, migrations, production build, platform launchers, tests, diagnostics, `.env.example`, Guide, user/technical/security/privacy/backup/update/rollback/overlay-removal/uninstall documents, changelog, dependency/license record or SBOM, manifest, checksums, supported/tested OS versions and known limitations. Verify a fresh extraction and complete install/launch/restart/backup/restore/update/rollback/removal/uninstall path before handoff.
