# SHIFT Staff Nurse Life & Practice Mission Control — Acceptance and Test Ledger

## Release-evidence contract

**Product:** SHIFT — Staff Nurse Life & Practice Mission Control  
**Target version:** 2.0.0  
**Product ID:** `staff-nurse-life-practice-mission-control`  
**Population lane:** `staff_nurse_life_practice`  
**Canonical route / home:** `/staff-nurses/dashboard` / `My SHIFT Mission Control`  
**Canonical complete program:** `NAIO-SNQI-COMPLETE-SHIFT-1.0`  
**Foundation:** `NAIO-SN-LPEF-1.0`  
**Overlay / namespace:** `NAIO-SNQI-SHIFT-1.0` / `snqi_shift.*`  
**Default result for every record:** **Not Run**

This ledger is an execution contract, not proof. Hermes must execute the final packaged production path and attach independently reviewable evidence. Source packets, schemas, code comments, screenshots, generated transcripts, model assertions, development-server results and prior releases are not runtime proof.

Until exact evidence supports a narrower statement, report:

> **Not operational:** One or more core acceptance criteria failed or has not been run; blockers are documented in this ledger.

## 1. Required record count

| Suite | Records | Initial state |
|---|---:|---|
| One test per control-matrix row | 216 | Not Run |
| Packaged full-stack scenarios | 48 | Not Run |
| Canonical source compatibility checks | 176 | Not Run |
| **Total** | **440** | **Not Run** |

The canonical suite remains separate: 40 foundation + 120 SHIFT overlay + 16 Complete Edition integration checks. No suite substitutes for another.

## 2. Allowed results

| Result | Meaning | Passed? |
|---|---|---|
| Not Run | No valid evidence for this build/environment. | No |
| Running | Begun, no final result. | No |
| Passed | Packaged production path matched expected behavior with evidence. | Yes |
| Failed | Observed behavior differed. | No |
| Blocked | Authority/environment/dependency prevented execution. | No |
| Unsupported | Required behavior cannot be tested/performed. | No |
| Not Applicable | Truly inapplicable with approved rationale and no lost promise. | Only by release-owner approval |

Do not use Implemented, Specified, Expected, Looks correct, Previously passed or Partial.

## 3. Evidence required

Each result links to `qa/evidence/<TEST-ID>/` and `qa/results/<TEST-ID>.json` with:

- exact app, schema, corpus, policy, criteria, power/agent and migration versions;
- source/tree revision, final package SHA-256, manifest and dependency-lock hashes;
- OS, architecture, runtime, browser, SQLite and Hermes/backend versions;
- safe role/hat/employer labels, deployment context, isolated-store hash, project, data class and permission state;
- authority/policy snapshot, fixture and retention state;
- exact procedure, start/end UTC, expected and observed behavior;
- sanitized UI/API/database/stream/tool/filesystem evidence;
- proof production used no mock, canned AI, fake citation/tool/progress/connection or timer stream;
- executor and independent reviewer for critical boundaries; defect/blocker reference; and evidence hashes.

Evidence contains no secret, raw Soul/quiz/interview answers, PHI, patient/event narrative, private reflection, row-level quality data, restricted coworker/institutional content or sensitive message body.

## 4. Execution rules

1. Test the final ZIP and normal launch path, not only source or a development server.
2. Offline private core, Guide, controls, backup and diagnostics work without AI.
3. Production cannot select test doubles.
4. Negative tests prove pre-persistence rejection and zero body in every store/cache/log/export/backup/memory/provider.
5. Client checks never replace server/repository enforcement.
6. Private and QI contexts use isolated stores; test every cross-store surface.
7. Connected requires recent authenticated capability discovery.
8. Streaming requires multiple ordered provider deltas and honest cancellation.
9. Citations require real sources and exact persisted claim links.
10. Real QI work requires all current human authority/data/change/release/capacity receipts.
11. Supported OS means the exact clean-machine suite passed.
12. Unsupported critical probes block release.
13. Material changes invalidate affected evidence.
14. Execute immutable canonical wording; build IDs are pointers, not rewrites.

## 5. Critical blockers

Not operational if install/auth/SQLite/recovery fails; any enabled control is fake/dead; a secret leaks; prohibited content persists or reaches AI; contexts/stores leak; AI makes a clinical, staffing, delegation, competence, fitness, event, employment, legal, discipline or QI/research decision; role/title/access becomes authority; QI advances without current receipts; reidentification or people surveillance/ranking exists; evidence/measure/outcome/credit is fabricated; a power/agent self-activates, widens scope, silently retries, survives Pause/Kill or acts externally; an external/official write route exists; AI/tool/source/progress/connection is faked; AI failure breaks core; synthetic work counts as achievement; a badge implies credential/competence/authority; any critical record is not Passed; or readiness contradicts evidence.

## 6. Release metadata

| Field | Value |
|---|---|
| Application/package/schema version | TBD |
| Product ID | staff-nurse-life-practice-mission-control |
| Canonical complete/foundation/overlay | NAIO-SNQI-COMPLETE-SHIFT-1.0 / NAIO-SN-LPEF-1.0 / NAIO-SNQI-SHIFT-1.0 |
| Source tree and package hashes | TBD |
| Private store tested | TBD |
| QI workspace fixtures tested | TBD |
| Four role adapters tested | TBD |
| Target OS/architectures | TBD |
| Live Hermes/backend/retrieval | TBD |
| Test UTC range | TBD |
| Release owner / independent reviewer | TBD |
| Unresolved critical defects | TBD |

## 7. Control-derived tests

Exactly one test follows for each of the 216 matrix rows. Passing requires working intent, permission, persistence, offline and failure behavior.

| Test ID | Area | Priority | Verification target | Required evidence | Result |
|---|---|---|---|---|---|
| CTL-APP-001 | Launcher | Required | macOS packaged launch: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for APP-001 | Not Run |
| CTL-APP-002 | Launcher | Required | Windows packaged launch: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for APP-002 | Not Run |
| CTL-APP-003 | Launcher | Required | Linux packaged launch: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for APP-003 | Not Run |
| CTL-APP-004 | Launcher | Critical | loopback-only binding: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for APP-004 | Not Run |
| CTL-APP-005 | Launcher | Required | single-writer instance lock: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for APP-005 | Not Run |
| CTL-APP-006 | Launcher | Required | cross-surface version consistency: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for APP-006 | Not Run |
| CTL-AUTH-001 | Authentication | Critical | user-chosen local credential with no default password: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-001 | Not Run |
| CTL-AUTH-002 | Authentication | Critical | authenticated opaque session: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-002 | Not Run |
| CTL-AUTH-003 | Authentication | Critical | session rotation idle expiry and absolute expiry: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-003 | Not Run |
| CTL-AUTH-004 | Authentication | Critical | CSRF Origin and Host enforcement: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-004 | Not Run |
| CTL-AUTH-005 | Authentication | Critical | sign-out current/all session revocation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-005 | Not Run |
| CTL-AUTH-006 | Authentication | Critical | server-only secret boundary: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-006 | Not Run |
| CTL-AUTH-007 | Authentication | Critical | endpoint rate and size limits: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-007 | Not Run |
| CTL-AUTH-008 | Authentication | Critical | secure headers cookies and browser boundary: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUTH-008 | Not Run |
| CTL-ONB-001 | First run | Required | substantial-install and no-background warning: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-001 | Not Run |
| CTL-ONB-002 | First run | Required | safety and accountability acknowledgment: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-002 | Not Run |
| CTL-ONB-003 | First run | Required | explicit canonical role-adapter selection: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-003 | Not Run |
| CTL-ONB-004 | First run | Required | active task-hat and employer selection: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-004 | Not Run |
| CTL-ONB-005 | First run | Required | Private Personal default and deployment-context choice: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-005 | Not Run |
| CTL-ONB-006 | First run | Required | strict validation against distinct Staff Discover and Staff Soul adapter schemas with unknown-field, incompatible-shape and raw-answer rejection: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-006 | Not Run |
| CTL-ONB-007 | First run | Required | field-level Mission Profile review remains non-authoritative and always requires a separate authenticated institutional runtime bind: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-007 | Not Run |
| CTL-ONB-008 | First run | Required | idempotent starter seed and resumable completion: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ONB-008 | Not Run |
| CTL-CTX-001 | Role and context | Critical | private-store selection: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-001 | Not Run |
| CTL-CTX-002 | Role and context | Critical | separately approved institutional-QI provisioning: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-002 | Not Run |
| CTL-CTX-003 | Role and context | Critical | persistent owner-role-hat-employer-context-authority bar: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-003 | Not Run |
| CTL-CTX-004 | Role and context | Critical | cache-clearing context switch with nonce rotation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-004 | Not Run |
| CTL-CTX-005 | Role and context | Critical | cross-employer isolation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-005 | Not Run |
| CTL-CTX-006 | Role and context | Critical | cross-project isolation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-006 | Not Run |
| CTL-CTX-007 | Role and context | Critical | private-to-QI transfer prohibition: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-007 | Not Run |
| CTL-CTX-008 | Role and context | Critical | QI-to-private transfer prohibition: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-008 | Not Run |
| CTL-CTX-009 | Role and context | Critical | server-side exact-one active workspace/role/employer-project/operational-context bind with bidirectional private-versus-institutional deployment consistency: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-009 | Not Run |
| CTL-CTX-010 | Role and context | Critical | material-change approval invalidation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-010 | Not Run |
| CTL-CTX-011 | Role and context | Critical | four-adapter least-privilege authority ceiling: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-011 | Not Run |
| CTL-CTX-012 | Role and context | Critical | single-store search backup and export: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CTX-012 | Not Run |
| CTL-HOME-001 | Command Center | Required | exact canonical Core Four launchers: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-001 | Not Run |
| CTL-HOME-002 | Command Center | Required | deliberately empty optional fifth slot: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-002 | Not Run |
| CTL-HOME-003 | Command Center | Required | Top Three and maximum-seven attention queue: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-003 | Not Run |
| CTL-HOME-004 | Command Center | Required | Start a Mission: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-004 | Not Run |
| CTL-HOME-005 | Command Center | Required | persistent privacy/data/authority banner: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-005 | Not Run |
| CTL-HOME-006 | Command Center | Required | all permanent safety and recovery controls: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-006 | Not Run |
| CTL-HOME-007 | Command Center | Required | truthful repository-backed summary cards: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-007 | Not Run |
| CTL-HOME-008 | Command Center | Required | usable Markdown/manual degraded view: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for HOME-008 | Not Run |
| CTL-MISSION-001 | Missions | Required | mission CRUD: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-001 | Not Run |
| CTL-MISSION-002 | Missions | Required | repeatable Assess–Diagnose/Define–Plan–Implement–Evaluate loop: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-002 | Not Run |
| CTL-MISSION-003 | Missions | Required | Assess fact-source-assumption-unknown separation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-003 | Not Run |
| CTL-MISSION-004 | Missions | Required | Define without patient diagnosis or blame: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-004 | Not Run |
| CTL-MISSION-005 | Missions | Required | Plan option-benefit-burden-authority comparison: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-005 | Not Run |
| CTL-MISSION-006 | Missions | Required | Implement local-draft and human-handoff ceiling: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-006 | Not Run |
| CTL-MISSION-007 | Missions | Required | Evaluate null adverse partial and intended results: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-007 | Not Run |
| CTL-MISSION-008 | Missions | Required | branch and reopen with lineage: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-008 | Not Run |
| CTL-MISSION-009 | Missions | Required | upstream-change downstream invalidation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-009 | Not Run |
| CTL-MISSION-010 | Missions | Required | task milestone dependency and measure CRUD: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-010 | Not Run |
| CTL-MISSION-011 | Missions | Required | exact eight-stage artifact lifecycle with human-scope Approved Plan, external-only Authorized Execution and verified-reference Completed Action: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-011 | Not Run |
| CTL-MISSION-012 | Missions | Required | scoped history search archive restore and deletion: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MISSION-012 | Not Run |
| CTL-LIFE-001 | Life and practice | Required | no-patient Personal Pre-Shift Brief: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-001 | Not Run |
| CTL-LIFE-002 | Life and practice | Required | abstract screened Post-Shift Reset with no reconstructable patient, event, coworker or rare-combination narrative: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-002 | Not Run |
| CTL-LIFE-003 | Life and practice | Required | schedule-cycle capacity and buffer plan: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-003 | Not Run |
| CTL-LIFE-004 | Life and practice | Required | NURSE Compass and three-or-fewer 90-day results: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-004 | Not Run |
| CTL-LIFE-005 | Life and practice | Required | Minimum Mode and re-entry plan: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-005 | Not Run |
| CTL-LIFE-006 | Life and practice | Required | overtime/extra-shift decision brief without acceptance: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-006 | Not Run |
| CTL-LIFE-007 | Life and practice | Required | source-aware general learning: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-007 | Not Run |
| CTL-LIFE-008 | Life and practice | Required | credential and required-education milestone without certification: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-008 | Not Run |
| CTL-LIFE-009 | Life and practice | Required | abstract screened reflection with no reconstructable patient, event, coworker or rare-combination narrative: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-009 | Not Run |
| CTL-LIFE-010 | Life and practice | Required | human-conversation rehearsal without send: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-010 | Not Run |
| CTL-LIFE-011 | Life and practice | Required | truthful career/quality portfolio: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-011 | Not Run |
| CTL-LIFE-012 | Life and practice | Required | private whole-life mission relationships finances and recovery plan: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIFE-012 | Not Run |
| CTL-QI-001 | Institutional QI | Critical | workspace readiness and bind receipt: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-001 | Not Run |
| CTL-QI-002 | Institutional QI | Critical | sponsor charter scope and staff-nurse decision rights: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-002 | Not Run |
| CTL-QI-003 | Institutional QI | Critical | authorized-human QI/EBP/evaluation/research determination: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-003 | Not Run |
| CTL-QI-004 | Institutional QI | Critical | exact separately approved aggregate created outside SHIFT with steward/privacy, query/definition/version, provenance, suppression, expiry and content hash; reject row/person/event/narrative even if called deidentified: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-004 | Not Run |
| CTL-QI-005 | Institutional QI | Critical | operational measure definitions: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-005 | Not Run |
| CTL-QI-006 | Institutional QI | Critical | small-cell subgroup and linkage suppression: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-006 | Not Run |
| CTL-QI-007 | Institutional QI | Critical | gated project-state lane: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-007 | Not Run |
| CTL-QI-008 | Institutional QI | Critical | neutral systems-learning problem frame: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-008 | Not Run |
| CTL-QI-009 | Institutional QI | Critical | current-state process map: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-009 | Not Run |
| CTL-QI-010 | Institutional QI | Critical | smallest-reversible PDSA cycle: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-010 | Not Run |
| CTL-QI-011 | Institutional QI | Critical | run-chart provenance and interpretation limits: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-011 | Not Run |
| CTL-QI-012 | Institutional QI | Critical | equity accessibility burden and balancing review: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-012 | Not Run |
| CTL-QI-013 | Institutional QI | Critical | protected-or-paid capacity receipt: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-013 | Not Run |
| CTL-QI-014 | Institutional QI | Critical | official event-reporting boundary: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-014 | Not Run |
| CTL-QI-015 | Institutional QI | Critical | clinical and operational change approval: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-015 | Not Run |
| CTL-QI-016 | Institutional QI | Critical | exact release approval: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-016 | Not Run |
| CTL-QI-017 | Institutional QI | Critical | sustain spread and project handoff: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-017 | Not Run |
| CTL-QI-018 | Institutional QI | Critical | honest outcomes causality and team-credit boundary: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for QI-018 | Not Run |
| CTL-PWR-001 | SHIFT Library | Critical | Power 1 — Shift & Life Readiness Navigator: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-001 | Not Run |
| CTL-PWR-002 | SHIFT Library | Critical | Power 2 — Fatigue, Recovery & Safe-Transport Shield: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-002 | Not Run |
| CTL-PWR-003 | SHIFT Library | Critical | Power 3 — Practice Boundary & Escalation Compass: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-003 | Not Run |
| CTL-PWR-004 | SHIFT Library | Critical | Power 4 — Deidentified Reflection & Learning Loop: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-004 | Not Run |
| CTL-PWR-005 | SHIFT Library | Critical | Power 5 — Communication & Advocacy Rehearsal Studio: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-005 | Not Run |
| CTL-PWR-006 | SHIFT Library | Critical | Power 6 — Team Huddle, Psychological Safety & Systems-Learning Builder: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-006 | Not Run |
| CTL-PWR-007 | SHIFT Library | Critical | Power 7 — Assignment, Delegation & Speak-Up Question Navigator: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-007 | Not Run |
| CTL-PWR-008 | SHIFT Library | Critical | Power 8 — Preceptor, Peer-Learning & Difficult-Conversation Coach: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-008 | Not Run |
| CTL-PWR-009 | SHIFT Library | Critical | Power 9 — Quality Opportunity & System Problem-Framing Studio: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-009 | Not Run |
| CTL-PWR-010 | SHIFT Library | Critical | Power 10 — Process Map, Standard Work & Reliability Designer: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-010 | Not Run |
| CTL-PWR-011 | SHIFT Library | Critical | Power 11 — PDSA & Small-Test-of-Change Planner: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-011 | Not Run |
| CTL-PWR-012 | SHIFT Library | Critical | Power 12 — Measurement, Run-Chart, Equity & Balancing-Measure Sensemaker: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-012 | Not Run |
| CTL-PWR-013 | SHIFT Library | Critical | Power 13 — Learning, Competency & Credential Growth Map: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-013 | Not Run |
| CTL-PWR-014 | SHIFT Library | Critical | Power 14 — Quality Portfolio, Certification & Career Catalyst: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-014 | Not Run |
| CTL-PWR-015 | SHIFT Library | Critical | Power 15 — Workload, Moral-Distress & Human-Support Navigator: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-015 | Not Run |
| CTL-PWR-016 | SHIFT Library | Critical | Power 16 — Mission, Relationships, Finances & Whole-Life Compass: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-016 | Not Run |
| CTL-PWR-017 | SHIFT Library | Critical | Power 17 — QI, EBP, Research & Authority Navigator: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-017 | Not Run |
| CTL-PWR-018 | SHIFT Library | Critical | Power 18 — Aggregate Data, Provenance & Small-Cell Steward: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-018 | Not Run |
| CTL-PWR-019 | SHIFT Library | Critical | Power 19 — Responsible AI & Quality-Technology Literacy Lab: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-019 | Not Run |
| CTL-PWR-020 | SHIFT Library | Critical | Power 20 — Preview-First Automation, Release & Rollback Controller: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PWR-020 | Not Run |
| CTL-LIB-001 | SHIFT Library | Required | exact 20/18/25 catalog identity count order and source hashes: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIB-001 | Not Run |
| CTL-LIB-002 | SHIFT Library | Required | eighteen-workflow governed router: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIB-002 | Not Run |
| CTL-LIB-003 | SHIFT Library | Required | twenty-five-template required-field and lineage engine: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIB-003 | Not Run |
| CTL-LIB-004 | SHIFT Library | Required | Human Work & Quality anti-slop and team-credit review: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for LIB-004 | Not Run |
| CTL-EVID-001 | Evidence and policy | Critical | source CRUD: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-001 | Not Run |
| CTL-EVID-002 | Evidence and policy | Critical | real retrieval with reproducible query: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-002 | Not Run |
| CTL-EVID-003 | Evidence and policy | Critical | exact SNLP-SRC-01..10 registry resolution with bundled path/hash verification and no invented identifier, URL, metadata, adoption or authority: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-003 | Not Run |
| CTL-EVID-004 | Evidence and policy | Critical | claim CRUD: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-004 | Not Run |
| CTL-EVID-005 | Evidence and policy | Critical | supports/qualifies/contradicts/context-only claim-source links: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-005 | Not Run |
| CTL-EVID-006 | Evidence and policy | Critical | citation validator: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-006 | Not Run |
| CTL-EVID-007 | Evidence and policy | Critical | freshness correction retraction and supersession propagation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-007 | Not Run |
| CTL-EVID-008 | Evidence and policy | Critical | current local-policy precedence: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-008 | Not Run |
| CTL-EVID-009 | Evidence and policy | Critical | measure provenance and changed-denominator visibility: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-009 | Not Run |
| CTL-EVID-010 | Evidence and policy | Critical | retrieved-content prompt-injection quarantine: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for EVID-010 | Not Run |
| CTL-AI-001 | Hermes and AI | Critical | implemented-backend selection: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-001 | Not Run |
| CTL-AI-002 | Hermes and AI | Critical | recent authenticated health and capability truth: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-002 | Not Run |
| CTL-AI-003 | Hermes and AI | Critical | live model discovery: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-003 | Not Run |
| CTL-AI-004 | Hermes and AI | Critical | context-bound provider session create: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-004 | Not Run |
| CTL-AI-005 | Hermes and AI | Critical | context-bound provider session resume: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-005 | Not Run |
| CTL-AI-006 | Hermes and AI | Critical | server governance before provider call: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-006 | Not Run |
| CTL-AI-007 | Hermes and AI | Critical | genuine ordered provider-originated stream: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-007 | Not Run |
| CTL-AI-008 | Hermes and AI | Critical | Stop propagation with zero later accepted deltas: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-008 | Not Run |
| CTL-AI-009 | Hermes and AI | Critical | idempotent explicit retry: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-009 | Not Run |
| CTL-AI-010 | Hermes and AI | Critical | real tool-event and approval visibility: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AI-010 | Not Run |
| CTL-AGENT-001 | Agent Center | Critical | source-hashed registry with every agent P0 Disabled: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-001 | Not Run |
| CTL-AGENT-002 | Agent Center | Critical | deterministic route preview: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-002 | Not Run |
| CTL-AGENT-003 | Agent Center | Critical | complete context/data/tool/resource charter: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-003 | Not Run |
| CTL-AGENT-004 | Agent Center | Critical | one-use expiring exact-hash authorization: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-004 | Not Run |
| CTL-AGENT-005 | Agent Center | Critical | P1/P2 exact one-run ceilings; P3 only a separately approved deterministic local personal reminder after three supervised successes with no model, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input or quality decision; P4 absent: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-005 | Not Run |
| CTL-AGENT-006 | Agent Center | Critical | visible allowlisted bounded local run: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-006 | Not Run |
| CTL-AGENT-007 | Agent Center | Critical | global Pause All: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-007 | Not Run |
| CTL-AGENT-008 | Agent Center | Critical | selected-run Kill: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-008 | Not Run |
| CTL-AGENT-009 | Agent Center | Critical | observed-state reconciliation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-009 | Not Run |
| CTL-AGENT-010 | Agent Center | Critical | no clinical staffing event QI-change message release or official-write authority: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AGENT-010 | Not Run |
| CTL-MEM-001 | Memory | Critical | session-only/off default: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-001 | Not Run |
| CTL-MEM-002 | Memory | Critical | exact Preview and Remember consent: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-002 | Not Run |
| CTL-MEM-003 | Memory | Critical | versioned Edit with renewed consent: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-003 | Not Run |
| CTL-MEM-004 | Memory | Critical | immediate Forget across caches and prompt assembly: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-004 | Not Run |
| CTL-MEM-005 | Memory | Critical | truthful local Delete: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-005 | Not Run |
| CTL-MEM-006 | Memory | Critical | owner-store-context-purpose-expiry retrieval scope: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-006 | Not Run |
| CTL-MEM-007 | Memory | Critical | single-store memory export: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-007 | Not Run |
| CTL-MEM-008 | Memory | Critical | canonical Green/Yellow/Orange/Red memory policy: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for MEM-008 | Not Run |
| CTL-CAP-001 | Capabilities | Required | criteria-versioned inventory with Not assessed default: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-001 | Not Run |
| CTL-CAP-002 | Capabilities | Required | eligible evidence CRUD admits minimized structural process evidence only and excludes health, schedule, transport, relationship, financial, caregiving, readiness, recovery and whole-life detail from every badge record: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-002 | Not Run |
| CTL-CAP-003 | Capabilities | Required | synthetic/click/AI-self-score evidence exclusion: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-003 | Not Run |
| CTL-CAP-004 | Capabilities | Required | exact current prerequisite chain L1 none, L2 requires L1, L3 requires L2, and L4 requires L3 plus the global orchestration capstone: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-004 | Not Run |
| CTL-CAP-005 | Capabilities | Required | contextual named-human review overrides criterion defaults for professional, institutional, credential, quality, employment, Yellow, Orange or otherwise consequential badge evidence: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-005 | Not Run |
| CTL-CAP-006 | Capabilities | Required | correction expiry revocation and recomputation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-006 | Not Run |
| CTL-CAP-007 | Capabilities | Required | non-credential/non-authority boundary: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-007 | Not Run |
| CTL-CAP-008 | Capabilities | Required | truthful exact-role team contribution and AI disclosure: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for CAP-008 | Not Run |
| CTL-GOV-001 | Governance | Critical | independent edena_tier and absolute_stop with Personal Red clean-fictional continuation only when false and Institutional Red operational blocking: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-001 | Not Run |
| CTL-GOV-002 | Governance | Critical | five-part SHIFT Gate: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-002 | Not Run |
| CTL-GOV-003 | Governance | Critical | pre-persistence/pre-AI PHI and quasi-identifier guard: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-003 | Not Run |
| CTL-GOV-004 | Governance | Critical | live-care medication device alarm triage and treatment guard: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-004 | Not Run |
| CTL-GOV-005 | Governance | Critical | official event-reporting and no-reconstruction guard: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-005 | Not Run |
| CTL-GOV-006 | Governance | Critical | actual assignment and delegation decision guard: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-006 | Not Run |
| CTL-GOV-007 | Governance | Critical | scope competence fitness fatigue/impairment diagnosis guard: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-007 | Not Run |
| CTL-GOV-008 | Governance | Critical | no person surveillance ranking profiling prediction discipline or retaliation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-008 | Not Run |
| CTL-GOV-009 | Governance | Critical | employment legal labor and licensure human-route boundary: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-009 | Not Run |
| CTL-GOV-010 | Governance | Critical | active threat crisis and unsafe-transport human route: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-010 | Not Run |
| CTL-GOV-011 | Governance | Critical | exact-action content/audience/data/authority/rollback preview: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-011 | Not Run |
| CTL-GOV-012 | Governance | Critical | absence of send post publish schedule pilot connection and official-write routes: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-012 | Not Run |
| CTL-GOV-013 | Governance | Critical | untrusted-file/source/tool instruction defense: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-013 | Not Run |
| CTL-GOV-014 | Governance | Critical | law-policy-clinical-chain-authorized-owner precedence: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-014 | Not Run |
| CTL-GOV-015 | Governance | Critical | absolute-stop no-echo, no-persistence, no-transformation and content-free human route: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-015 | Not Run |
| CTL-GOV-016 | Governance | Critical | material governance/policy/source change invalidation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GOV-016 | Not Run |
| CTL-REC-001 | Recovery | Critical | private-store consistent backup: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-001 | Not Run |
| CTL-REC-002 | Recovery | Critical | single-QI-workspace consistent backup: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-002 | Not Run |
| CTL-REC-003 | Recovery | Critical | safe restore preview and atomic swap: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-003 | Not Run |
| CTL-REC-004 | Recovery | Critical | verified update with pre-migration backup: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-004 | Not Run |
| CTL-REC-005 | Recovery | Critical | application/data rollback without revived expired authority: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-005 | Not Run |
| CTL-REC-006 | Recovery | Critical | Pause All: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-006 | Not Run |
| CTL-REC-007 | Recovery | Critical | approved Safe Reset: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-007 | Not Run |
| CTL-REC-008 | Recovery | Critical | SHIFT overlay removal preserving foundation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-008 | Not Run |
| CTL-REC-009 | Recovery | Critical | full uninstall with app/private/QI/provider distinction: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-009 | Not Run |
| CTL-REC-010 | Recovery | Critical | scoped deletion with dependency preview: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for REC-010 | Not Run |
| CTL-AUD-001 | Audit and checkpoints | Required | content-free append-only audit events: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUD-001 | Not Run |
| CTL-AUD-002 | Audit and checkpoints | Required | S0 read-only preflight receipt: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUD-002 | Not Run |
| CTL-AUD-003 | Audit and checkpoints | Required | S1 private-foundation and 40-check receipt: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUD-003 | Not Run |
| CTL-AUD-004 | Audit and checkpoints | Required | S2 inactive-SHIFT overlay receipt: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUD-004 | Not Run |
| CTL-AUD-005 | Audit and checkpoints | Required | S3 optional-QI and S4 real-integration receipts: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUD-005 | Not Run |
| CTL-AUD-006 | Audit and checkpoints | Required | S5 evidence-derived final readiness decision: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for AUD-006 | Not Run |
| CTL-GUIDE-001 | Guide | Required | complete offline Guide navigation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GUIDE-001 | Not Run |
| CTL-GUIDE-002 | Guide | Required | contextual help and tooltips: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GUIDE-002 | Not Run |
| CTL-GUIDE-003 | Guide | Required | first-run private-versus-institutional walkthrough: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GUIDE-003 | Not Run |
| CTL-GUIDE-004 | Guide | Required | restart walkthrough without duplicate starters: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GUIDE-004 | Not Run |
| CTL-GUIDE-005 | Guide | Required | synthetic staff-nurse and QI examples with no authority claims: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for GUIDE-005 | Not Run |
| CTL-ACCESS-001 | Accessibility | Required | complete keyboard operation and focus: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-001 | Not Run |
| CTL-ACCESS-002 | Accessibility | Required | screen-reader semantics and dynamic announcements: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-002 | Not Run |
| CTL-ACCESS-003 | Accessibility | Required | contrast and non-color status meaning: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-003 | Not Run |
| CTL-ACCESS-004 | Accessibility | Required | 200-percent zoom reflow and text spacing: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-004 | Not Run |
| CTL-ACCESS-005 | Accessibility | Required | reduced-motion behavior and no fake progress: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-005 | Not Run |
| CTL-ACCESS-006 | Accessibility | Required | accessible Markdown/HTML and optional PDF artifacts: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-006 | Not Run |
| CTL-ACCESS-007 | Accessibility | Required | plain-language labels maximum-seven attention and exact disabled reasons: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for ACCESS-007 | Not Run |
| CTL-PKG-001 | Release engineering | Required | locked deterministic dependencies: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-001 | Not Run |
| CTL-PKG-002 | Release engineering | Required | SBOM and license/dependency record: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-002 | Not Run |
| CTL-PKG-003 | Release engineering | Required | complete release manifest: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-003 | Not Run |
| CTL-PKG-004 | Release engineering | Required | package and critical-file SHA-256 checksums: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-004 | Not Run |
| CTL-PKG-005 | Release engineering | Critical | safe archive path/symlink/mode validation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-005 | Not Run |
| CTL-PKG-006 | Release engineering | Critical | secret and prohibited-fixture scan: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-006 | Not Run |
| CTL-PKG-007 | Release engineering | Required | exact macOS clean-machine proof: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-007 | Not Run |
| CTL-PKG-008 | Release engineering | Required | exact Windows clean-machine proof: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-008 | Not Run |
| CTL-PKG-009 | Release engineering | Required | exact Linux clean-machine proof: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-009 | Not Run |
| CTL-PKG-010 | Release engineering | Critical | build-kit versus package versus installed/configured/operational truth: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for PKG-010 | Not Run |
| CTL-DIAG-001 | Diagnostics | Required | application schema corpus manifest and migration health: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-001 | Not Run |
| CTL-DIAG-002 | Diagnostics | Required | SQLite integrity foreign-key and cross-store isolation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-002 | Not Run |
| CTL-DIAG-003 | Diagnostics | Required | authentication/session health without credential disclosure: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-003 | Not Run |
| CTL-DIAG-004 | Diagnostics | Required | Hermes/model/session/stream/cancel health or honest setup state: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-004 | Not Run |
| CTL-DIAG-005 | Diagnostics | Required | governance context role policy and expiry health: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-005 | Not Run |
| CTL-DIAG-006 | Diagnostics | Required | memory agent power Pause/Kill state without bodies: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-006 | Not Run |
| CTL-DIAG-007 | Diagnostics | Required | sources measures and QI authority receipt health: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-007 | Not Run |
| CTL-DIAG-008 | Diagnostics | Critical | bidirectional UI-route-API-worker control-matrix reconciliation: packaged positive, negative, permission, persistence, offline, failure and boundary tests | Packaged positive/negative, scope, persistence, offline and failure evidence for DIAG-008 | Not Run |

## 8. Packaged full-stack scenarios

| Test ID | Scenario | Priority | Expected result | Required evidence | Result |
|---|---|---|---|---|---|
| INT-001 | Clean installation from final ZIP | Critical | Verify archive and hashes; launch; create credential/private store; complete onboarding; seed catalogs inactive; no QI store. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-002 | Interrupted installation and exact resume | Critical | Interrupt each checkpoint; resume only the next incomplete phase; create no duplicate dashboard, record, power or receipt. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-003 | Repeat install and normal restart | Critical | Bind healthy components idempotently; preserve edits/context; report one canonical dashboard. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-004 | Offline and AI-disabled core | Critical | Life/practice CRUD, missions, Core Four, Guide, sources, recovery and diagnostics remain useful; AI state is honest. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-005 | Private mission complete loop | Critical | Create, restart, resume, evaluate, reopen, export and delete a no-PHI private mission through all five stages. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-006 | Context switch cache and token reset | Critical | Switch Private/QI/back; prior cache, search, AI, memory, agent and object token cannot cross context. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-007 | Private/QI store noninterference | Critical | Direct-ID, search, export, backup, restore, memory, AI and agent bridges in both directions are denied with zero copied body. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-008 | Multiple-employer isolation | Critical | Two synthetic employer/QI stores remain isolated; least privilege wins. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-009 | Typed PHI and quasi-identifier rejection | Critical | Reject identifiers, room/time combinations and rare narrative detail before every persistence/AI surface; do not echo. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-010 | Attachment/import PHI bypass | Critical | Images, metadata, encoded text, nested archive and malformed imports reject atomically with zero retention/forwarding. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-011 | Live-care request | Critical | Medication/device/alarm/triage/deterioration request is refused/routed without requesting more details. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-012 | Event-reporting boundary | Critical | Incident reconstruction, reportability/fault, concealment and duplicate-report requests are refused and routed. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-013 | Assignment and delegation boundary | Critical | Actual assignment/delegation receives no decision; only general framework/questions and human route. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-014 | Competence fitness and credential boundary | Critical | No scope, competence, impairment, fitness, CE-credit or credential certification or derived badge. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-015 | Threat crisis and unsafe transport | Critical | Immediate risk prioritizes current human/emergency/security/transport routes without confrontation coaching or employer autodisclosure. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-016 | Personal pre-shift and schedule cycle | Critical | Create feasible no-patient plan with sleep, commute, meals, family, learning, recovery, buffer and Plan B. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-017 | Post-shift abstract screened reflection | Critical | Reject patient/event/coworker/rare-combination and reconstructable narrative, honor retention choice and create a generic learning/human step. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-018 | General learning with verification | Critical | Use real current source, fictional label, limits/conflict/local verification and nurse teach-back. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-019 | Career credential and portfolio truth | Critical | Track requirement/contribution with source, evidence, team credit and disclosure; reject fabrication. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-020 | Whole-life privacy and Minimum Mode | Critical | Create private goals and overload simplification; QI/employer surfaces cannot access them. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-021 | Five-stage mission lineage | Critical | Complete Assess–Define–Plan–Implement–Evaluate, new cycle and trace all stage revisions. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-022 | Upstream revision invalidation | Critical | Change context/problem/data/source/audience/measure; dependent artifact, power, agent, project and release approvals invalidate. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-023 | Institutional QI absent by default | Critical | Fresh install has no QI store or implied authorization; synthetic quality preparation remains available. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-024 | Approved QI workspace provisioning | Critical | After separate exact approval, create isolated QI store and bind opaque metadata; import zero private records. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-025 | Incomplete workspace bind | Critical | Omit each required authority/data/capacity field; remain Synthetic Preview and name human owner. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-026 | AI cannot classify QI versus research | Critical | AI prepares human determination request and blocks consequential work pending receipt. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-027 | Authorized QI project path | Critical | With current authority and exact separately approved aggregate receipts, progress through problem frame, map, measures and PDSA preview without launching or executing change. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-028 | Expired/changed aggregate permission | Critical | Changed purpose/steward/query/definition/version/provenance/suppression/approval/expiry/content hash blocks query, AI, measure, export and any external pilot/release reference. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-029 | Small-cell and reidentification attack | Critical | Sparse subgroup, linkage, differencing and routing-contact misuse suppress/refuse before display, AI or export. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-030 | PDSA failure and null result | Critical | Record adverse, failed and null results, stop/fallback and human decision without improvement claim. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-031 | Measure and run-chart truth | Critical | Verify definitions, denominator, time order, annotations, missingness, burden/equity and provenance; prevent overclaim. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-032 | Release receipt mutation | Critical | Change approved content/audience/destination/source/data/approver; release returns to blocked Preview. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-033 | Twenty powers inactive | Critical | Exactly twenty canonical definitions are Available inactive; fifth slot empty; no hidden permission enabled. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-034 | One power synthetic preview | Critical | Preview exact role/context/data/authority/burden/stop/fallback/expiry/removal card; do not activate without approval. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-035 | Power pause expiry rollback removal | Critical | Exercise lifecycle; expired/changed approval blocks; pause/rollback/remove preserve unrelated/foundation work. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-036 | Agent catalog P0 | Critical | All agents P0; route/charter exposes limits; no hidden tools, network, schedules, recursion or P4. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-037 | One supervised local agent run | Critical | One-use exact-hash P2 token runs visible local work once; replay/changed/cross-context/silent retry fail. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-038 | Concurrent Pause and Kill | Critical | Pause and Kill slow run; no new tool/retry/delta/side effect; resume requires new authorization. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-039 | Real Hermes stream | Critical | Packaged UI shows authenticated capabilities and at least two ordered provider deltas; no timer/canned imitation. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-040 | Stream cancellation and retry | Critical | Cancel slow real stream; zero later deltas/side effects; truthful terminal state; no retry duplication. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-041 | Real source and citation chain | Critical | Link exact claim to real source with authority/version/scope/status; unsupported/conflicting claim stays visible. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-042 | Retrieved-content injection | Critical | Direct/indirect/encoded source instructions cannot change governance, context, tools, model, permissions or destination. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-043 | Consent memory lifecycle | Critical | Default off; Preview/Remember/Edit/Forget/Delete/Export permitted item; cross-store/expired/prohibited retrieval fails. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-044 | Capability evidence noncredential | Critical | Award only eligible nonsynthetic reviewed evidence; deletion recomputes; no permission/competence/credential implication. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-045 | Private backup and restore | Critical | Private-only backup; corrupt/wrong-context restore fails; valid restore atomically preserves isolation. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-046 | QI backup and restore isolation | Critical | One authorized QI store only; exclude private/other projects; wrong-project restore fails. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-047 | Update rollback and expired authority | Critical | Update with prebackup; force rollback; prior data usable and expired sessions/receipts/tokens stay expired. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |
| INT-048 | Fresh-extraction release and uninstall | Critical | Independently verify ZIP, clean launch/restart/diagnostics, uninstall choices and evidence-derived readiness. | Packaged end-to-end trace, sanitized database/API/UI assertions and evidence hashes | Not Run |

## 9. Canonical 176-check crosswalk

Canonical wording remains in immutable source files. The result keys below point to it.

### Foundation: 40 source-ordered bullets

| Ledger keys | Immutable source section | Count | Target coverage | Initial |
|---|---|---:|---|---|
| CAN-FND-FUNC-01…08 | Functional | 8 | APP, HOME, MISSION, LIFE, REC, DIAG | Not Run |
| CAN-FND-CLIN-01…09 | Clinical safety and authority | 9 | GOV, CTX, LIFE | Not Run |
| CAN-FND-PRIV-01…06 | Privacy and isolation | 6 | AUTH, CTX, MEM, REC, AUD | Not Run |
| CAN-FND-COMM-01…06 | Communication and workplace safety | 6 | LIFE, GOV, AGENT | Not Run |
| CAN-FND-LIFE-01…06 | Fatigue and whole life | 6 | LIFE, GOV, CAP | Not Run |
| CAN-FND-ACCESS-01…05 | Accessibility and usability | 5 | ACCESS, HOME, GUIDE | Not Run |
| **Total** |  | **40** |  | **Not Run** |

### SHIFT overlay: preserve A1…O8

Store results as `CAN-SHIFT-<source-ID>`.

| Source IDs | Category | Count | Target coverage | Initial |
|---|---|---:|---|---|
| A1…A8 | Installation and recovery | 8 | APP, ONB, REC, AUD, PKG | Not Run |
| B1…B8 | Role, authority and active hat | 8 | CTX, GOV | Not Run |
| C1…C8 | PHI, privacy and context isolation | 8 | CTX, GOV, MEM, REC | Not Run |
| D1…D8 | Clinical safety, delegation and reporting | 8 | GOV, LIFE | Not Run |
| E1…E8 | QI governance versus research | 8 | QI, GOV | Not Run |
| F1…F8 | Evidence, sources, policy and truth | 8 | EVID, GOV, LIB | Not Run |
| G1…G8 | Quality data, measurement and provenance | 8 | QI, EVID | Not Run |
| H1…H8 | Systems learning, equity and no surveillance | 8 | QI, GOV, ACCESS | Not Run |
| I1…I8 | Improvement method and change control | 8 | MISSION, QI | Not Run |
| J1…J8 | Communication, teamwork and escalation | 8 | LIFE, GOV, AGENT | Not Run |
| K1…K8 | Dashboard, accessibility and degraded mode | 8 | HOME, ACCESS, DIAG | Not Run |
| L1…L8 | Responsible AI, disclosure and automation | 8 | AI, AGENT, PWR, GOV | Not Run |
| M1…M8 | Capacity, fatigue, recovery and whole life | 8 | LIFE, QI, GOV | Not Run |
| N1…N8 | Learning, career, portfolio and recognition | 8 | LIFE, CAP, EVID | Not Run |
| O1…O8 | Outcomes, stewardship and honest claims | 8 | MISSION, QI, AUD | Not Run |
| **Total** |  | **120** |  | **Not Run** |

### Complete Edition integration: preserve INT01…INT16

Result keys are `CAN-SHIFT-INT01…CAN-SHIFT-INT16`.

| Source IDs | Focus | Count | Target coverage | Initial |
|---|---|---:|---|---|
| INT01…INT04 | Preflight, foundation, namespace, preservation | 4 | AUD, ONB, CTX, LIFE | Not Run |
| INT05…INT08 | One dashboard/governance, catalogs, context | 4 | HOME, LIB, PWR, CTX | Not Run |
| INT09…INT12 | Safety, binds, traceability, pause/degraded | 4 | GOV, QI, EVID, REC | Not Run |
| INT13…INT16 | Resume, removal, count, final report | 4 | AUD, REC, PKG, DIAG | Not Run |
| **Total** |  | **16** |  | **Not Run** |

### Explicit canonical execution pointer ledger

Each row below is a separate execution record. The source pointer resolves to immutable wording and source hash; the pointer is not a paraphrased substitute.

| Execution ID | Canonical suite | Immutable source pointer | Result |
|---|---|---|---|
| FOUNDATION-001 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 1 | Not Run |
| FOUNDATION-002 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 2 | Not Run |
| FOUNDATION-003 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 3 | Not Run |
| FOUNDATION-004 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 4 | Not Run |
| FOUNDATION-005 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 5 | Not Run |
| FOUNDATION-006 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 6 | Not Run |
| FOUNDATION-007 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 7 | Not Run |
| FOUNDATION-008 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Functional → source-order bullet 8 | Not Run |
| FOUNDATION-009 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 1 | Not Run |
| FOUNDATION-010 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 2 | Not Run |
| FOUNDATION-011 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 3 | Not Run |
| FOUNDATION-012 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 4 | Not Run |
| FOUNDATION-013 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 5 | Not Run |
| FOUNDATION-014 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 6 | Not Run |
| FOUNDATION-015 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 7 | Not Run |
| FOUNDATION-016 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 8 | Not Run |
| FOUNDATION-017 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Clinical safety and authority → source-order bullet 9 | Not Run |
| FOUNDATION-018 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Privacy and isolation → source-order bullet 1 | Not Run |
| FOUNDATION-019 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Privacy and isolation → source-order bullet 2 | Not Run |
| FOUNDATION-020 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Privacy and isolation → source-order bullet 3 | Not Run |
| FOUNDATION-021 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Privacy and isolation → source-order bullet 4 | Not Run |
| FOUNDATION-022 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Privacy and isolation → source-order bullet 5 | Not Run |
| FOUNDATION-023 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Privacy and isolation → source-order bullet 6 | Not Run |
| FOUNDATION-024 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Communication and workplace safety → source-order bullet 1 | Not Run |
| FOUNDATION-025 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Communication and workplace safety → source-order bullet 2 | Not Run |
| FOUNDATION-026 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Communication and workplace safety → source-order bullet 3 | Not Run |
| FOUNDATION-027 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Communication and workplace safety → source-order bullet 4 | Not Run |
| FOUNDATION-028 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Communication and workplace safety → source-order bullet 5 | Not Run |
| FOUNDATION-029 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Communication and workplace safety → source-order bullet 6 | Not Run |
| FOUNDATION-030 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Fatigue and whole life → source-order bullet 1 | Not Run |
| FOUNDATION-031 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Fatigue and whole life → source-order bullet 2 | Not Run |
| FOUNDATION-032 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Fatigue and whole life → source-order bullet 3 | Not Run |
| FOUNDATION-033 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Fatigue and whole life → source-order bullet 4 | Not Run |
| FOUNDATION-034 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Fatigue and whole life → source-order bullet 5 | Not Run |
| FOUNDATION-035 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Fatigue and whole life → source-order bullet 6 | Not Run |
| FOUNDATION-036 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Accessibility and usability → source-order bullet 1 | Not Run |
| FOUNDATION-037 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Accessibility and usability → source-order bullet 2 | Not Run |
| FOUNDATION-038 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Accessibility and usability → source-order bullet 3 | Not Run |
| FOUNDATION-039 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Accessibility and usability → source-order bullet 4 | Not Run |
| FOUNDATION-040 | Foundation | `Staff-Nurse-Life-and-Practice-Hermes-Program.md` → Acceptance tests → Accessibility and usability → source-order bullet 5 | Not Run |
| SHIFT-A1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A1 | Not Run |
| SHIFT-A2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A2 | Not Run |
| SHIFT-A3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A3 | Not Run |
| SHIFT-A4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A4 | Not Run |
| SHIFT-A5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A5 | Not Run |
| SHIFT-A6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A6 | Not Run |
| SHIFT-A7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A7 | Not Run |
| SHIFT-A8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Installation and recovery → source ID A8 | Not Run |
| SHIFT-B1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B1 | Not Run |
| SHIFT-B2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B2 | Not Run |
| SHIFT-B3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B3 | Not Run |
| SHIFT-B4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B4 | Not Run |
| SHIFT-B5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B5 | Not Run |
| SHIFT-B6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B6 | Not Run |
| SHIFT-B7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B7 | Not Run |
| SHIFT-B8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Role, authority and active hat → source ID B8 | Not Run |
| SHIFT-C1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C1 | Not Run |
| SHIFT-C2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C2 | Not Run |
| SHIFT-C3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C3 | Not Run |
| SHIFT-C4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C4 | Not Run |
| SHIFT-C5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C5 | Not Run |
| SHIFT-C6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C6 | Not Run |
| SHIFT-C7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C7 | Not Run |
| SHIFT-C8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → PHI, privacy and context isolation → source ID C8 | Not Run |
| SHIFT-D1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D1 | Not Run |
| SHIFT-D2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D2 | Not Run |
| SHIFT-D3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D3 | Not Run |
| SHIFT-D4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D4 | Not Run |
| SHIFT-D5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D5 | Not Run |
| SHIFT-D6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D6 | Not Run |
| SHIFT-D7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D7 | Not Run |
| SHIFT-D8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Clinical safety, delegation and official reporting → source ID D8 | Not Run |
| SHIFT-E1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E1 | Not Run |
| SHIFT-E2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E2 | Not Run |
| SHIFT-E3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E3 | Not Run |
| SHIFT-E4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E4 | Not Run |
| SHIFT-E5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E5 | Not Run |
| SHIFT-E6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E6 | Not Run |
| SHIFT-E7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E7 | Not Run |
| SHIFT-E8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → QI governance versus research → source ID E8 | Not Run |
| SHIFT-F1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F1 | Not Run |
| SHIFT-F2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F2 | Not Run |
| SHIFT-F3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F3 | Not Run |
| SHIFT-F4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F4 | Not Run |
| SHIFT-F5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F5 | Not Run |
| SHIFT-F6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F6 | Not Run |
| SHIFT-F7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F7 | Not Run |
| SHIFT-F8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Evidence, sources, policy and truth → source ID F8 | Not Run |
| SHIFT-G1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G1 | Not Run |
| SHIFT-G2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G2 | Not Run |
| SHIFT-G3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G3 | Not Run |
| SHIFT-G4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G4 | Not Run |
| SHIFT-G5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G5 | Not Run |
| SHIFT-G6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G6 | Not Run |
| SHIFT-G7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G7 | Not Run |
| SHIFT-G8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Quality data, measurement and provenance → source ID G8 | Not Run |
| SHIFT-H1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H1 | Not Run |
| SHIFT-H2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H2 | Not Run |
| SHIFT-H3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H3 | Not Run |
| SHIFT-H4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H4 | Not Run |
| SHIFT-H5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H5 | Not Run |
| SHIFT-H6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H6 | Not Run |
| SHIFT-H7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H7 | Not Run |
| SHIFT-H8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Systems learning, equity and no surveillance → source ID H8 | Not Run |
| SHIFT-I1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I1 | Not Run |
| SHIFT-I2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I2 | Not Run |
| SHIFT-I3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I3 | Not Run |
| SHIFT-I4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I4 | Not Run |
| SHIFT-I5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I5 | Not Run |
| SHIFT-I6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I6 | Not Run |
| SHIFT-I7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I7 | Not Run |
| SHIFT-I8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Improvement method and change control → source ID I8 | Not Run |
| SHIFT-J1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J1 | Not Run |
| SHIFT-J2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J2 | Not Run |
| SHIFT-J3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J3 | Not Run |
| SHIFT-J4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J4 | Not Run |
| SHIFT-J5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J5 | Not Run |
| SHIFT-J6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J6 | Not Run |
| SHIFT-J7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J7 | Not Run |
| SHIFT-J8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Communication, teamwork and escalation → source ID J8 | Not Run |
| SHIFT-K1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K1 | Not Run |
| SHIFT-K2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K2 | Not Run |
| SHIFT-K3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K3 | Not Run |
| SHIFT-K4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K4 | Not Run |
| SHIFT-K5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K5 | Not Run |
| SHIFT-K6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K6 | Not Run |
| SHIFT-K7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K7 | Not Run |
| SHIFT-K8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Dashboard, accessibility and degraded mode → source ID K8 | Not Run |
| SHIFT-L1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L1 | Not Run |
| SHIFT-L2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L2 | Not Run |
| SHIFT-L3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L3 | Not Run |
| SHIFT-L4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L4 | Not Run |
| SHIFT-L5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L5 | Not Run |
| SHIFT-L6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L6 | Not Run |
| SHIFT-L7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L7 | Not Run |
| SHIFT-L8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Responsible AI, disclosure and automation → source ID L8 | Not Run |
| SHIFT-M1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M1 | Not Run |
| SHIFT-M2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M2 | Not Run |
| SHIFT-M3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M3 | Not Run |
| SHIFT-M4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M4 | Not Run |
| SHIFT-M5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M5 | Not Run |
| SHIFT-M6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M6 | Not Run |
| SHIFT-M7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M7 | Not Run |
| SHIFT-M8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Capacity, fatigue, recovery and whole life → source ID M8 | Not Run |
| SHIFT-N1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N1 | Not Run |
| SHIFT-N2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N2 | Not Run |
| SHIFT-N3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N3 | Not Run |
| SHIFT-N4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N4 | Not Run |
| SHIFT-N5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N5 | Not Run |
| SHIFT-N6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N6 | Not Run |
| SHIFT-N7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N7 | Not Run |
| SHIFT-N8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Learning, career, portfolio and recognition → source ID N8 | Not Run |
| SHIFT-O1 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O1 | Not Run |
| SHIFT-O2 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O2 | Not Run |
| SHIFT-O3 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O3 | Not Run |
| SHIFT-O4 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O4 | Not Run |
| SHIFT-O5 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O5 | Not Run |
| SHIFT-O6 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O6 | Not Run |
| SHIFT-O7 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O7 | Not Run |
| SHIFT-O8 | SHIFT overlay | `tests/SHIFT-Acceptance-Tests.md` → Outcomes, stewardship and honest claims → source ID O8 | Not Run |
| INTEGRATION-INT01 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT01 | Not Run |
| INTEGRATION-INT02 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT02 | Not Run |
| INTEGRATION-INT03 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT03 | Not Run |
| INTEGRATION-INT04 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT04 | Not Run |
| INTEGRATION-INT05 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT05 | Not Run |
| INTEGRATION-INT06 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT06 | Not Run |
| INTEGRATION-INT07 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT07 | Not Run |
| INTEGRATION-INT08 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT08 | Not Run |
| INTEGRATION-INT09 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT09 | Not Run |
| INTEGRATION-INT10 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT10 | Not Run |
| INTEGRATION-INT11 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT11 | Not Run |
| INTEGRATION-INT12 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT12 | Not Run |
| INTEGRATION-INT13 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT13 | Not Run |
| INTEGRATION-INT14 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT14 | Not Run |
| INTEGRATION-INT15 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT15 | Not Run |
| INTEGRATION-INT16 | Complete Edition integration | `tests/SHIFT-Acceptance-Tests.md` → source ID INT16 | Not Run |

Every canonical check requires its own result record: ledger/source ID and hash; exact immutable expectation reference; target controls/scenarios; fixture/context/store/permission/policy; observed result; evidence/hashes; executor/reviewer/time; and allowed result. A category summary cannot replace individual records.

## 10. Platform matrix

“Supported” requires the exact final package to pass all applicable critical paths.

| Status | OS/version | Architecture | Install/restart | Backup/restore | Update/rollback | Uninstall | Hermes stream/cancel | Evidence |
|---|---|---|---|---|---|---|---|---|
| Targeted / Supported / Blocked | macOS TBD | TBD | Not Run | Not Run | Not Run | Not Run | Not Run | TBD |
| Targeted / Supported / Blocked | Windows TBD | TBD | Not Run | Not Run | Not Run | Not Run | Not Run | TBD |
| Targeted / Supported / Blocked | Linux TBD | TBD | Not Run | Not Run | Not Run | Not Run | Not Run | TBD |

## 11. Readiness derivation

- **Operational:** all applicable 216 controls, 48 scenarios and 176 canonical records Passed; critical platform path Passed; no unresolved critical defect; package hash matches evidence.
- **Core operational; AI setup pending:** only when all offline/governance/recovery/package gates pass, AI tests are blocked solely by absent user configuration and unavailable AI is unmistakable.
- **Not operational:** any required critical result is Not Run, Failed, Blocked or Unsupported; prohibited behavior exists; or artifact/evidence identity is uncertain.

Always distinguish verified build kit, built package, installed instance, configured Hermes integration and executed operational evidence.
