# STAFF / SHIFT Capability and Badge Evidence Model

## Binding build-layer contract

**Normative configuration:** `config/STAFF-Capability-Mastery-Criteria.v1.json`  
**Product:** `staff-nurse-life-practice-mission-control`  
**Lane:** `staff_nurse_life_practice`  
**Canonical source namespace:** `snqi_shift.*`

The capability catalog, `CAP-*` identifiers, four mastery levels, evidence schema, badge calculations, and award events are build-layer additions. They are not part of the legacy `NAIO-SN-LPEF-1.0`, `NAIO-SNQI-SHIFT-1.0`, or `NAIO-SNQI-COMPLETE-SHIFT-1.0` source inventories. They must never be represented as a professional-board, employer, school, quality-office, credentialing, or clinical assessment system.

The versioned JSON file is normative. This human-readable contract explains it but cannot silently weaken, add to, or override its criteria. Application code must load and validate the pinned configuration rather than duplicating award rules in UI components or prompts.

## 1. What a capability badge means

A STAFF / SHIFT badge means only:

> Current, permitted evidence shows that the nurse performed the stated governed activity inside this workspace and satisfied the pinned build-layer criteria and review requirements.

It is **not**:

- nursing licensure, certification, continuing-education credit, course credit, or a professional credential;
- proof of clinical knowledge, skill, competency, readiness, fitness for duty, scope, privilege, delegation authority, or permission to practice;
- employer authorization, promotion evidence, performance rating, personnel decision, assignment authority, disciplinary finding, or permission to represent a unit or institution;
- QI, EBP, program-evaluation, or research determination, sponsor approval, IRB/HRPP decision, data permission, clinical/operational change approval, publication/release approval, or permission to launch/spread a project;
- proof that an artifact is clinically validated, institutionally approved, secure, compliant, effective, causal, generalizable, or safe for direct operational use; or
- a permission token for an agent, tool, connector, dataset, automation, external action, or official system.

Show this disclaimer on the Capabilities page, every badge detail, every review screen, every export/share preview, and the Level 4 capstone. Do not use board seals, employer marks, credential abbreviations, “licensed,” “certified,” “clinically validated,” “QI approved,” or similar authority-signaling language.

Badges unlock **no authority or capability**. Agent state, data permission, role/hat, project charter, QI/research determination, institutional bind, EDENA/SHIFT Gate, external-action state, and tool permission are independently governed and fail closed.

## 2. Four build-layer mastery levels

### Level 1 — Basic

The nurse completes one adopted, evaluated, nonsynthetic, low-risk mission and produces observable evidence that they used the capability with the required data/source checks, important limits, nurse contribution, AI contribution, and next independent step. A named-human review is required whenever the artifact or context is professional, institutional, public, credential-related, clinical-adjacent, quality-related, financially consequential, or otherwise Yellow/Orange; the normative configuration may require review more broadly.

### Level 2 — Intermediate

The nurse applies the capability across at least two distinct eligible real missions, independently adapts the method, handles a meaningful correction/conflict/limitation/failure, and receives a valid named-human review. Basic must remain current.

### Level 3 — Advanced

The nurse applies the capability across at least three distinct eligible real missions; designs, evaluates, and improves a reusable governed method; compares outcomes, accessibility, equity, workload/burden, nurse agency, and unintended effects; documents safe reuse, stop/fallback/removal conditions; and receives an independent named-human review. Intermediate must remain current.

### Level 4 — AI Agent Orchestration Master

Advanced must remain current. The nurse satisfies the domain's Level 4 criterion **and** the global orchestration capstone. The capstone uses only frozen P1/P2 agents, permitted nonsensitive inputs or an exact separately approved aggregate created outside SHIFT, visible deterministic routing, strict budgets/retry/expiry limits, independent verification, Stop/Kill and recovery evidence, complete Evaluate, and accountable-human review.

“Master” describes governed AI-agent orchestration in this sandbox only. It does not mean mastery of nursing, bedside care, quality science, leadership, education, informatics, research, or institutional operations.

P3 is only a separately approved deterministic local personal reminder after three supervised successful runs, with no model inference, institutional/QI data, connector, external destination, monitoring, or quality decision. It is not a model/agent permission and cannot satisfy an orchestration criterion. P4 and every clinical, patient-facing, event-reporting, staffing, personnel, production, official-system, quality-change, release, or external-action permission are absent.

The normative configuration contains four observable criteria per domain—one for each level—and nine global capstone criteria: 68 domain criteria plus nine capstone criteria, 77 total. All required criteria are conjunctive. The engine must not average away a missing safety, data, authority, review, or recovery gate.

The normative JSON also contains `contextual_human_review_policy`. Each criterion's `requires_human_review` Boolean is only an **unconditional minimum**: `false` never means review is waived. The engine must still require a current, scope-matched named-human process review for professional or portfolio evidence, credential or required-education evidence, employment or institutional context, quality-improvement or project-outcome evidence, EDENA Yellow or Orange, and any otherwise consequential artifact or claim. EDENA Red remains governed by its separate stop/review route. A user preference, AI recommendation, synthetic activity, or prior review for another scope cannot waive this policy.

Every level and criterion also carries an exact `prerequisite_level`: Basic has none; Intermediate requires current Basic; Advanced requires current Intermediate; and AI Agent Orchestration Master requires current Advanced plus the global capstone. Expiry, deletion, correction, revocation or conflict in a prerequisite triggers downstream recalculation rather than leaving a higher badge standing by inference.

## 3. Seventeen activity domains

| ID | Capability | Staff-nurse / SHIFT emphasis |
|---|---|---|
| `CAP-01` | AI literacy | Explain model limits, false fluency, automation bias, disclosure, deliberate nonuse, and why AI never replaces nursing judgment or authorized humans. |
| `CAP-02` | Prompt design | Frame minimum-necessary, no-PHI requests with explicit situation, aim, permitted facts, limits, uncertainty, human review, and next nurse action. |
| `CAP-03` | Evidence-informed research | Map claims to real current sources, authority, local applicability, version, conflicts/corrections, uncertainty, and expiry without inventing evidence. |
| `CAP-04` | Critical thinking | Distinguish observable fact, nurse statement, explanation, inference, recommendation, unknown, and accountable-human decision; challenge false certainty and causality. |
| `CAP-05` | Structured problem-solving | Use a repeatable Assess–Define–Plan–Implement–Evaluate loop while preserving SHIFT Gate, stop conditions, human routes, and next-cycle learning. |
| `CAP-06` | Workflow design | Map manual-first triggers, permitted inputs, owners, approvals, outputs, failures, fallback, rollback, removal, and receipts without creating shadow clinical or official systems. |
| `CAP-07` | Project management | Produce structural evidence of humane priorities, owners, milestones, workload/burden budget, protected-or-paid-time check, fallback and human-support route, measures, Minimum Mode and re-entry—without storing private-life details as evidence. |
| `CAP-08` | Data and privacy stewardship | Enforce no PHI, no identifiable narrative, personal/institutional/employer/project isolation, minimization, exact separately approved aggregate QI data created outside SHIFT, small-cell protection, retention, and deletion. |
| `CAP-09` | Ethical AI practice | Preserve nurse voice, team credit, fairness, accessibility, transparency, disclosure, dignity, no surveillance, no fabrication, and no authority inflation. |
| `CAP-10` | EDENA and SHIFT governance | Apply independent `edena_tier` and `absolute_stop` plus Situation/Human authority/Information/Fairness/Test gates, hard stops, and human escalation. |
| `CAP-11` | Agent supervision | Select, charter, constrain, inspect, stop/kill, independently verify, correct, reconcile, purge, and retire one bounded P1/P2 agent. |
| `CAP-12` | Multi-agent orchestration | Plan bounded dependencies, separation of duties, handoffs, permissions, independent checks, failure recovery, reconciliation, and receipts across P1/P2 agents. |
| `CAP-13` | Knowledge-base development | Curate versioned public/approved generic sources, claim links, scope, local adoption status, conflicts, freshness, access, and retirement without ingesting prohibited content. |
| `CAP-14` | Automation design | Design and test synthetic/manual low-risk workflows with exact gates, burden checks, fallback, rollback, and honest eligibility; P3 remains deterministic local personal reminder-only with no model, institutional/QI data, connector, external destination, monitoring or quality decision. |
| `CAP-15` | Artifact creation | Produce accessible, human-voice, source-linked private drafts, briefs, prototypes, learning plans, conversation rehearsals, or portfolio artifacts with limits and AI disclosure. |
| `CAP-16` | Evaluation and quality improvement | Evaluate process/outcome, balancing, equity, accessibility, burden, missingness, unintended effects, and next decision using public/synthetic information or exact separately approved aggregates created outside SHIFT only. |
| `CAP-17` | Staff nurse practice and quality contribution | Build truthful reviewed structural evidence of general professional learning, communication preparation, career growth, systems thinking, bounded quality contribution, leadership, workload-boundary checks, fallback/support planning, and safe technology stewardship without private-life content. |

These domains assess activities in Mission Control. They deliberately exclude bedside performance, patient outcomes attributable to the nurse, clinical reasoning for real care, medication/device use, charting/handoff, assignment/delegation decisions, scope, competence, fitness, official reporting, or employment standing.

## 4. Eligible evidence

Evidence is eligible only when all of the following are true:

- it is linked to an adopted, completed, evaluated, **nonsynthetic** mission and exact cycle/revision;
- the mission is low-risk and within the nurse's verified active role/hat, employer or Personal context, deployment mode, and authority ceiling;
- the underlying work uses only permitted nurse-owned nonsensitive information, public/approved generic sources, or an exact separately approved aggregate created outside SHIFT inside the correct institutional project partition;
- it is a recognized evidence type, such as an evaluated mission, reviewed artifact, source audit, correction record, governance receipt, minimized process reflection with no private-life detail, accessibility/equity review, supervised P1/P2 run receipt, aggregate-method review, or verified project-process outcome;
- it identifies the nurse's own contribution, AI/agent contribution, edits, disclosure, source/data checks, uncertainty, human decisions, and what the nurse can now do independently;
- it is attributable, dated, inspectable through a permitted locator, integrity-hashed, current, purpose-bound, and mapped to exact criterion IDs;
- every required review is completed by an appropriate named human with an explicit qualification basis and no blocking conflict; and
- it has no unresolved privacy, integrity, source, authority, role, context, data, small-cell, correction, deletion, expiry, or review conflict.

An eligible evidence record stores only minimized metadata:

- immutable evidence ID/version and exact criteria/model version;
- candidate, workspace, lane, mission/cycle, context, and permitted partition IDs;
- evidence type, artifact/event locator, and integrity hash;
- source/provenance type, `SHIFT-DATA-*` class, `edena_tier`, independent `absolute_stop`, SHIFT Gate state, active role/hat, and institutional-receipt references when applicable;
- observed/submitted/reviewed/expiry dates;
- nurse contribution, AI/agent contribution and disclosure, limitations, uncertainty, and next independent step;
- reviewer identity/authority assertion, verification state, decision, rationale, limitations, conflict, and attestation hash; and
- correction, supersession, revocation, deletion, and recalculation state.

Do not copy an underlying sensitive artifact into the badge ledger. Use a permitted locator and hash only when retention of that locator is allowed.

## 5. Evidence that never earns a badge

Exclude:

- clicks, checked boxes, page views, launches, streaks, prompt/conversation counts, time in app, or output volume;
- synthetic Starters, demonstrations, walkthroughs, tutorials, copied examples, unchanged templates, or fictional exercises presented as real work;
- AI praise, AI self-assessment, AI-generated scoring, model confidence, or an AI decision about mastery;
- a title, license, degree, credential, committee seat, platform access, affiliation, seniority, or self-asserted authority used as performance evidence;
- self-review, anonymous/shared reviewer accounts, invented reviewers, or unverified human-review claims;
- duplicated evidence counted as distinct work, unreviewed-required evidence, or deleted/expired/superseded/revoked/conflicted evidence;
- fabricated sources, experience, hours, role, team contribution, measure, outcome, improvement, causality, approval, competence, or impact;
- PHI, patient/family/event narratives, charts, handoffs, event reports, peer-review/patient-safety material, row-level or person-level data, small cells, or reidentification risk;
- coworker/employee performance, personnel, health, disability, accommodation, discipline, grievance, attendance, productivity, sentiment, private, inferred, or narrative information;
- confidential employer, legal, research, vendor, contract, security, source-system, or proprietary content outside the exact permitted evidence boundary;
- the nurse's private readiness, health, fatigue, impairment, moral-distress narrative, relationships, finances, mission, recovery details, family/caregiving details, or whole-life outcomes;
- any health narrative or employment-dispute detail; these never persist or enter memory, indexing, export, badge/QI evidence, agent context, or receipts and must be routed to an appropriate qualified human or official process;
- live-care, medication/device, assignment/delegation, documentation/handoff, event-reporting, staffing, surveillance, discipline, or official-system activity;
- an external action, public release, production automation, or unauthorized institutional pilot/change; and
- QI data other than public/synthetic information or metadata for an exact separately approved aggregate created outside SHIFT.

A real private capacity/recovery mission may support a capability only through minimized structural evidence—for example, that the nurse used a burden budget, protected-time check, fallback, human-support route, and evaluation. The ledger must not store schedule, health, relationship, financial, readiness, or private-life content. Private wellbeing outcomes never become institutional or badge analytics.

A synthetic test may demonstrate that a control was tested, but it cannot by itself satisfy a criterion, mission minimum, badge level, or Level 4 capstone. A real mission may include a deliberately synthetic failure fixture for safety testing; eligibility comes from the real governed mission and its human-reviewed process, not the fixture.

## 6. Institutional-QI evidence boundary

Institutional quality evidence is eligible only when:

- the workspace is separately provisioned and has a current bind for the exact organization/project;
- role/hat, sponsor, charter/decision rights, QI/research determination, data steward/privacy owner, measure definitions, small-cell rule, clinical/operational change owners, protected/paid capacity, release owner, retention/deletion, and expiry are current;
- the badge record references only the permitted project-process artifact and exact separately approved `SHIFT-DATA-A` aggregate hash/receipt for an aggregate created outside SHIFT;
- no private personal record, employer-sensitive person information, event narrative, or row-level data crosses into the evidence ledger; and
- review confirms the nurse's governed contribution without claiming project authorization, clinical competence, causal effect, institutional approval, or improvement success.

An institutional artifact may demonstrate source verification, process mapping, aggregate-measure stewardship, burden/equity review, or evaluation discipline. It never proves that the nurse may launch, change, spread, publish, represent the organization, access future data, or direct others.

## 7. Named-human review

Automated validation may say a submission is structurally complete. It cannot approve, reject, renew, restore, revoke, or award mastery. A generative model may help produce a clearly labeled evidence summary but cannot serve as reviewer or decision maker.

Each human review records:

- real reviewer identity or authenticated institutional principal;
- relationship to the nurse and actual qualification basis for the exact process/evidence reviewed;
- conflict declaration and any independence requirement;
- exact criteria, evidence versions/hashes, data/context boundary, and limitations reviewed;
- decision: accepted, needs revision, or rejected;
- rationale, conditions, date, optional expiry, and attestation hash; and
- whether the identity/authority is authenticated, attached as permitted evidence, or only nurse-asserted and awaiting verification.

Rules:

1. The nurse cannot review their own evidence.
2. An AI, anonymous committee, shared account, or invented persona cannot review.
3. A job title, license, degree, seniority, or organizational affiliation is insufficient without a relevant qualification basis.
4. Any institutional-QI evidence requires an appropriate current human review inside the authorized governance path.
5. Intermediate and Advanced require named-human review; Advanced requires an independent reviewer.
6. Level 4 requires at least one role/process reviewer and one independent governance-and-safety reviewer. Neither may be the candidate or the agent under review.
7. A material correction, data/source/authority change, expired receipt, or blocking conflict invalidates affected approval and reopens review.
8. An appeal uses a different qualified human and preserves the original decision in history.

Review confirms only the pinned capability criteria. It does not confer competence, license, CE, credential, job status, project/data/change authority, or institutional validation.

## 8. Evidence states and implementable records

Evidence state:

`draft → submitted → under_review → accepted | needs_revision | rejected → expired | superseded | revoked | deleted`

Badge state:

`not_started | in_progress | review_pending | earned | suspended | expired | revoked`

Use append-only events plus deterministic materialized current state. At minimum implement:

- `capability_models` — immutable criteria version/hash and lifecycle;
- `capability_evidence` — minimized evidence metadata/version/state;
- `capability_evidence_criteria` — explicit evidence-to-criterion mappings;
- `capability_reviews` and `capability_review_evidence` — reviewer decision and exact covered evidence;
- `capability_events` — append-only award/correction/expiry/revocation/recalculation events;
- `criterion_current_state`, `capability_current_state`, and `capstone_current_state` — deterministic current results and unmet gates.

Every record carries owner, workspace, lane, role/hat, context, partition, schema/criteria version, timestamps, revision, and deletion/retention state. A cross-workspace, cross-employer, cross-project, or private-to-institutional evidence reference fails before lookup/dereference with zero field disclosure.

## 9. Deterministic award algorithm

For each domain and requested level:

1. Load the exact active normative configuration and verify its package hash/version.
2. Select only candidate-owned evidence in the permitted workspace/context/partition.
3. Exclude synthetic, starter, deleted, withdrawn, expired, superseded, revoked, duplicated, prohibited, conflicted, stale-revision, and unreviewed-required evidence.
4. Verify required fields, locator permission, integrity hash, evidence type, data/EDENA/SHIFT/role gates, source/aggregate receipts, and criterion mapping.
5. Verify every required named-human review, qualification, conflict, independence, and expiry rule.
6. Confirm every criterion for the level; do not average or substitute evidence quantity for a missing criterion.
7. Confirm prerequisite level, distinct-mission minimum, and distinct-evidence requirements. One underlying event counts once even when mapped to several criteria.
8. For Level 4, require the domain L4 criterion and every global orchestration capstone criterion.
9. Write an explainable award event with criteria version/hash, evidence/review IDs and hashes, exclusion reasons, computation time, and current authority/data state.
10. Recompute after correction, deletion, expiry, supersession, revocation, criteria migration, or source/data/authority/review conflict. Downgrade visibly with reason.

Progress is:

```text
100 × satisfied required criteria ÷ total required criteria
```

Display prerequisite, mission minimum, review, governance, evidence-currency, and capstone gates separately. A 100% criterion count with an unmet review or authority gate is `review_pending`, not earned. Do not use an AI-generated percentage.

For each domain show capability, current level/state, criteria version, accepted evidence, excluded evidence and reason, date earned/reviewed/expiring, progress, unmet gates, governance/safety behaviors, reviewer state, and recommended next safe challenge.

## 10. Global P1/P2 orchestration capstone

Level 4 requires one real, low-risk, adopted, evaluated, nonsynthetic mission that:

1. starts with a nurse-authored objective, non-goals, success, burden, accessibility, independence, and stop measures;
2. uses at least two frozen `SHIFT-AGT-*` agents, or one bounded agent plus the independent `SHIFT-AGT-10` auditor, only at P1/P2;
3. binds exact role/hat/context, data class, source or approved-aggregate object, tools, destinations (empty), prompt/model/policy/schema hashes, time/cost/token limits, one invocation, zero hidden retries, expiry, human gates, Stop/Kill, fallback, purge, and rollback;
4. records deterministic routing rationale and keeps agent roles/outputs/handoffs visibly distinct;
5. rejects an unauthorized handoff, recursion, permission widening, context crossing, prohibited input, or background continuation;
6. demonstrates real cancellation or an intentionally tested safe failure/recovery path without false completion;
7. independently verifies consequential claims/artifacts and preserves conflicts, limitations, and unknowns;
8. completes Evaluate with outcome, process, equity, accessibility, burden, nurse agency, unintended effects, and continue/revise/pause/stop/new-cycle decision;
9. includes a complete activity/AI-use receipt and minimized process reflection—with no private-life detail—explaining what the nurse did, what agents did, what humans decided, corrections/disclosure, and what the nurse can now do independently; and
10. receives valid role/process and independent governance/safety human reviews without implying clinical competence, institutional approval, QI authorization, or external permission.

The capstone cannot use PHI, live care, patient/event/coworker/person-level data, health narrative, employment-dispute detail, restricted employer material, private wellbeing/whole-life data, a public or official release, external action, real clinical/QI execution, P3 model/agent work, P4, or synthetic-only activity. If `SHIFT-DATA-A` aggregate evidence is used, the aggregate must have been created and separately approved outside SHIFT and all institutional bind, determination, stewardship, exact query/definition/version, provenance, suppression, retention/deletion, approval/expiry, content-hash, and review receipts must be current.

## 11. Correction, deletion, expiry, and revocation

Evidence/review changes are append-only events. A corrected artifact creates a new version linked to the prior one; it never overwrites what a reviewer saw. A material correction requires new review.

On evidence/review addition, correction, withdrawal, deletion, expiry, authority/data/source change, governance reclassification, or criteria migration:

1. rebuild the current eligible evidence set from immutable events;
2. remove invalid/superseded records from current calculations while preserving minimum nonsensitive history;
3. recalculate affected criteria, levels, and capstone dependencies;
4. suspend, downgrade, expire, or revoke a badge when requirements no longer hold; and
5. create a before/after receipt with affected IDs, reason, actor, time, and recovery/appeal route.

Permitted deletion removes payload/locator and leaves only the minimum nonsensitive tombstone/integrity receipt needed to explain recalculation. A badge revocation is an evidence-ledger correction—not a licensure, employment, discipline, credential, competence, or professional-standing decision. Restoration is never automatic; it requires current eligible evidence and new required review.

## 12. Suggested next challenges

Generate challenges deterministically from unmet criteria and nurse-approved goals in this order: blocking safety/data/integrity correction; expired prerequisite/review; unmet prior level; first unmet criterion in configuration order; distinct-mission/evidence minimum; required human review; renewal; then next level/capstone.

Challenges must be low-risk, accessible, feasible, reversible, manual-first, and compatible with verified role/hat/data authority. They include a human route and may be dismissed, deferred, or deleted without penalty. Never recommend a patient-care task, event-reporting action, person evaluation, unapproved QI activity/data access, off-clock improvement work, or external action merely to earn a badge.

## 13. Portable export

Export only an owner-approved, checksummed local JSON evidence bundle containing product/schema/criteria versions, noncredential disclaimer, badge states, criterion results, permitted minimized evidence metadata/hashes, review assertions and verification state, limitations, expiry/revocation history, and export time.

Exclude PHI; patient/event/coworker/person data; health narratives and employment-dispute details; private readiness, recovery, relationship, financial, mission, or whole-life content; restricted employer/institutional content; secrets; unsafe prompts/tool traces; and underlying `SHIFT-DATA-A` aggregates unless a separate authorized release explicitly permits them. An export remains a private evidence statement, not an employer or institutional credential.

Do not claim Open Badges or another external standard unless the exact standard version, schema, signing, privacy, conformance, and interoperability tests pass. Otherwise label the export `staff_shift_portable_evidence` and retain the full disclaimer.
