# SHIFT Staff Nurse Life & Practice Mission Control — Product Specification

## Product identity

- Product: `SHIFT — Staff Nurse Life & Practice Mission Control`
- Target product ID: `staff-nurse-life-practice-mission-control`
- Target version: `2.0.0`
- Complete source program: `NAIO-SNQI-COMPLETE-SHIFT-1.0`
- Foundation: `NAIO-SN-LPEF-1.0`
- Overlay: `NAIO-SNQI-SHIFT-1.0`
- Build-layer lane: `staff_nurse_life_practice`
- Build-layer route: `/staff-nurses/dashboard`
- Canonical namespace: `snqi_shift.*`
- Home: `My SHIFT Mission Control`
- Default: private synthetic demonstration; no PHI; session-only; Manual/Assist/Preview; all powers inactive
- Distribution target: authenticated loopback-only local full-stack application in a versioned ZIP

The lane, route, home, stable `SHIFT-*` IDs, schemas, agent catalog, and permission vocabulary are build-layer additions. The four canonical program IDs above remain source authority. No global route may collide with another Nurse AI OS role dashboard. A parent Mission Control may receive only product/version, coarse health, and a user-approved deep link—not private life, practice, employer, quality, source, agent, memory, or mastery records.

## Purpose

SHIFT is a governed whole-person workspace for staff nurses to coordinate rotating work, sleep, recovery, family and caregiving, finances, learning, credentials, career direction, relationships, personal goals, communication preparation, general professional reflection, and responsibly bounded quality-improvement contribution. It should increase clarity, recovery capacity, professional voice, systems thinking, source literacy, safe help-seeking, and human-owned follow-through.

It is not an EHR, chart, handoff, patient list, staffing tool, event-reporting system, peer-review system, employee file, productivity monitor, clinical decision system, policy authority, research determination service, credential validator, or autonomous quality platform. It cannot authorize scope, competence, assignment, delegation, care, QI, data use, workflow change, pilot, spread, release, publication, or institutional action.

## Role adapters and protected workspaces

First run asks the user to select one or more adapters. Hermes may not infer authority from a job title:

1. **Direct-Care Staff Nurse** — whole-life coordination, general learning, reflection, communication rehearsal, and systems questions; no QI or institutional authority.
2. **Unit Champion, Preceptor, or Shared-Governance Member** — adds supported education, huddle, and systems-learning preparation; no supervisory, disciplinary, staffing, competency, data, or change authority.
3. **Chartered Staff-Nurse QI Project Lead** — bounded only by a current human-approved charter, decision rights, determination, data-steward receipts for exact separately approved aggregates created outside SHIFT, and a verified external release pathway in a separately provisioned institutional workspace. The role grants no in-app execution authority.
4. **Hybrid or Multiple-Employer** — keeps employers, sites, projects, policies, authority, data, and exports isolated; least privilege wins.

Maintain five protected workspace families:

- **Practice** — general education, abstract screened reflection, communication and escalation preparation. Abstract screened reflection contains no patient, event, coworker, rare-combination or reconstructable narrative and is never live-care output or a shadow record.
- **Quality Improvement** — synthetic/public framing in Private Mode; institutional analysis only in a separately provisioned Institution-Approved Quality Workspace and only from exact separately approved aggregates created outside SHIFT. SHIFT never receives row-, person-, event- or narrative-level institutional data, even if labeled deidentified, and never performs a real QI action.
- **Professional Growth** — credentials, learning, portfolio, career and truthful contribution records.
- **Life & Recovery** — sleep, fatigue, transport, health-support routing, schedule, family, finances, relationships and goals; private by default and never employer/QI evidence.
- **Community & Leadership** — service, advocacy, shared governance and leadership preparation with no invented authority or appropriated voice.

Each mission has exactly one active adapter/hat, employer or personal context, workspace family, deployment context, authority state, and data ceiling. Context switching is explicit. Transfers are typed, field-level, previewed, purpose-bound, approved and receipted. Private-life records never transfer into institutional views or exports. Institutional QI inputs never transfer from another SHIFT context; they may enter only as exact separately approved aggregates created outside SHIFT.

## Two deployment contexts

### Private Personal Mode

Available after installation. Permitted inputs are public, synthetic, and minimum necessary nurse-owned nonsensitive information after screening. All institutional-quality activity remains exploration, rehearsal, synthetic planning, or a question for an authorized human. Every EDENA result stores two independent fields: `edena_tier` and `absolute_stop`. Personal EDENA Red may continue only as a clean fictional/generic sandbox after deliberate acknowledgment when `absolute_stop=false`. `absolute_stop=true` always stops processing and cannot be acknowledged away; it applies to PHI, live care, prohibited data or action, illegal activity, and missing nonwaivable authority.

### Separately provisioned Institution-Approved Quality Workspace

Unavailable by default. Provisioning is outside installation and requires authenticated institutional access plus current receipts for workspace bind, sponsor/decision owner, charter and decision rights, QI-versus-research or other required human determination, change authority, release authority, and each exact separately approved aggregate created outside SHIFT. Each aggregate receipt binds its exact definition/query/version, suppression rule, approval/expiry, and content hash. No row-, person-, event- or narrative-level institutional data may enter SHIFT, even if labeled deidentified. Institutional policy takes precedence. When `edena_tier=Red`, institutional operational progression remains blocked until required review; `absolute_stop=true` is never waivable. Expired or changed authority, employer, project, aggregate, method, population, intervention, audience, destination or scope invalidates the bind and returns affected work to Preview. Every real PDSA Do, pilot, workflow or policy change, spread, release, and execution occurs outside SHIFT through accountable humans and official systems.

## Operating core

### Five foundation departments

1. Shift & Life Command Center
2. Professional Practice, Learning & Readiness Studio
3. Communication, Teamwork & Advocacy Partner
4. Credentials, Career & Knowledge Infrastructure
5. Life Goals, Wellbeing & Financial Orchestration

### NURSE Compass

Use the canonical whole-person rhythm: **Name** the North Star; **Understand** current reality; define **Results** for the next 90 days; identify **Systems and support**; **Evaluate and evolve**. It complements—not replaces—the mission loop.

### Core Four

1. Plan My Shift & Life
2. Learn, Reflect & Speak Up
3. Improve Quality Together
4. Review, Approve & Escalate

The fifth pinned position remains empty until the user separately previews and approves one optional power. No more than five primary launchers may be pinned. Home shows at most seven attention items.

## SHIFT catalog

Expose the exact 20 canonical power titles, 18 workflow titles, and 25 template titles. Stable keys `SHIFT-PWR-01…20`, `SHIFT-WF-01…18`, and `SHIFT-TPL-01…25` are one-to-one build-layer mappings and must never replace the displayed canonical names.

Every power follows:

`Available → Previewed → Approved inactive → Active bounded → Paused → Removed`

Every power installs `Available Inactive`; every workflow installs `Preview Only`; no activation is inherited from setup, a badge, title, profile, prior run, or technical availability. One-run activation freezes purpose, active context, data, sources, human authority, tools, limits, success/burden measures, expiry, stop/fallback/rollback, and exact approval. The run returns to Inactive at completion or expiry.

Permission P3 is limited to a separately approved deterministic local personal reminder after three supervised successful runs, using only minimum necessary personal reminder fields. It permits no model inference, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input, or quality decision and confers no external or institutional action authority.

## Mission loop

Every durable mission supports revisions, history, pauses, branches, reopening and new cycles:

1. **Assess** — collect minimum context; separate verified facts, user statements, observations, sources, assumptions and unknowns; show applicable policy/authority gaps.
2. **Diagnose/Define** — frame the need, opportunity, problem or decision without a clinical diagnosis; identify causes, dependencies, competing interpretations, risk and missing knowledge.
3. **Plan** — compare options by benefit, feasibility, time, cost, workload, equity, ethics, reversibility, policy, authority and values; set outcome/process/balancing measures and review gates.
4. **Implement** — create owned local tasks, questions, rehearsals, drafts, process maps and synthetic prototypes. Real-world action is never an in-app implementation: every real PDSA Do, pilot, workflow or policy change, spread, release, and other consequential or external action occurs outside SHIFT through accountable humans and official systems. SHIFT may retain only a verified external action reference.
5. **Evaluate** — compare results with measures; preserve null, adverse and unintended effects; decide Retain, Revise, Pause, Remove, Escalate or begin a new Assess cycle.

A material upstream, context, authority, data, source or scope change invalidates downstream approvals. Stage controls work without AI.

## Information architecture

- **Home / Command Center:** active hat, workspace, deployment mode, employer/context, authority, data boundary, connection state, North Star, capacity, Core Four, Top Three, minimum step, re-entry plan, attention queue and first-run checklist.
- **Missions & Projects:** mission loop, cycles, tasks, milestones, notes, measures, artifacts, sources, decisions, approvals, history, search/filter/sort, archive/restore/delete.
- **Shift & Life:** readiness, schedule cycle, recovery, safe transport, family/caregiving, personal goals and private-life controls.
- **Practice & Voice:** general learning, source/policy verification, abstract screened reflection with no patient, event, coworker, rare-combination or reconstructable narrative, communication and speak-up rehearsal, and questions for accountable humans.
- **Quality Studio:** synthetic problem frames, process maps, aims, stakeholder maps, PDSA rehearsals, measure definitions, run-chart sensemaking, equity/burden/balancing review, and draft standard-work or handoff proposals. Institutional analysis remains blocked until separately provisioned and then accepts only exact separately approved aggregates created outside SHIFT; all real action remains external.
- **Evidence Center:** source identity, authority, date/status, jurisdiction/scope, claim mapping, conflict/correction, provenance, applicability, uncertainty, reviewer and expiry.
- **SHIFT Library:** 20 powers, 18 workflows, 25 templates, lifecycle state, prerequisites and activation cards.
- **Capabilities & Mastery:** explainable four-level evidence system; never a credential or clinical competence finding.
- **Agent Console:** chosen agent, routing reason, P0/P1/P2 state, exact context/data/tools/limits, live events, pending approvals, Stop/Kill and receipt.
- **Guide:** supplied content, first-run walkthrough, examples and contextual help.
- **Settings & Recovery:** derived profile, roles/contexts, privacy, memory, rules, backup/restore, import/export, Pause All, Safe Reset, overlay removal, rollback and uninstall.

Every element styled as a control must work or be disabled with a truthful reason. Color is never the only status cue.

## Artifact states and external-action truth

Persist and display this exact lifecycle: `Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan (human scope review only) → Authorized Execution (external human/official-system only; no app action) → Completed Action (verified external reference only) → Evaluated Outcome`.

## Data and authority invariants

Reject PHI and patient, event, coworker, rare-combination or reconstructable narrative information before persistence, and never echo rejected content into logs, errors, receipts, search, memory, exports or backups. For institutional QI, accept only exact separately approved aggregates created outside SHIFT, bound to their exact definition/query/version, suppression rule, approval/expiry, and content hash. Reject every row-, person-, event- or narrative-level institutional input even if labeled deidentified. Health narratives and employment-dispute details never persist or enter memory, indexing, export, badge/QI evidence, agent context, or receipts; stop without echoing and route to an appropriate qualified human or official process. Also reject live clinical questions; charting/handoff/task lists; medication/device/triage/deterioration instructions; peer-review, incident, HR, union, investigation or security material; secrets; financial credentials; and unclassified sensitive content.

Never rank, predict, score, monitor or profile patients or staff, or use data for staffing, discipline, compensation, credentialing, surveillance or retaliation. The app cannot determine QI versus EBP versus research; causality; statistical significance; special cause; compliance; competence; fitness; scope; assignment; delegation; policy; or authorization.

## Evidence-based development

Use four build-layer levels: Basic, Intermediate, Advanced, and AI Agent Orchestration Master. Awards require eligible, nonsynthetic, evaluated mission evidence, accurate AI contribution, sources and review when required. The normative contextual-review policy applies at every level: professional/portfolio, credential/education, employment/institutional, quality/project-outcome, EDENA Yellow/Orange, or otherwise consequential evidence requires a current scope-matched named-human review even when a criterion's unconditional `requires_human_review` flag is false. Clicks, time, prompts, synthetic starters, AI praise, self-ratings, private wellbeing data and fabricated outcomes are ineligible. Badges unlock no permission and are not licensure, certification, continuing education, employment validation or clinical competence.

## Offline and connected truth

Offline, the user can manage missions, records, loop stages, templates, evidence metadata, Guide, capability evidence, backup/export/import/restore/delete and diagnostics. AI states derive from recent authenticated health checks: Connected, Connecting, Setup required, Offline, Authentication failed, Hermes unavailable, Provider unavailable, Limited capabilities or Reconnecting. A configured URL, timer, cached response or page load does not prove Connected.

## Success condition

A nondeveloper can install the final release; select an adapter and protected context; approve a derived profile; use a synthetic Starter; complete/save/restart/resume/evaluate/reopen/export/restore/delete a mission without AI; understand every enabled/blocked control; preserve private/institutional isolation; supervise a bounded agent; verify sources; and recover/uninstall. Operational additionally requires a genuine configured Hermes response streamed through the packaged UI, working cancellation and sessions, and all applicable runtime acceptance evidence. Institutional-QI readiness is separately reported and never implied by personal application readiness.
