# SHIFT Staff Nurse Mission Control — User Installation and Recovery Guide

## What this download is

This download is a **build kit for Hermes**. It contains a working dashboard baseline plus complete Staff Nurse and SHIFT build contracts, but it is not yet the finished local application. Hermes must build and test a separate release. This may take many minutes and several visible turns.

SHIFT can help you coordinate shifts and life, protect recovery, learn, use abstract screened reflection with no reconstructable patient/event/coworker narrative, prepare conversations, organize career growth, and explore or support quality improvement within clear authority. It cannot give patient-specific direction, create charting or incident reports, decide assignment/delegation/scope, certify competence, monitor coworkers, determine QI versus research, authorize data or workflow changes, or act in official systems.

## Before starting

- Keep an unchanged copy of the downloaded ZIP in a private folder.
- Use an isolated Hermes implementation workspace.
- Do not prepare or upload PHI, patient stories, chart/handoff material, event details, row/person/event/narrative institutional data even when called deidentified, health narratives, employment-dispute details, peer-review/HR material, restricted employer files, passwords/tokens, financial credentials or secrets. Take health or employment-dispute needs to the appropriate qualified human or official process.
- Decide which role adapter describes the hat you want active. A title never grants authority.
- Treat real institutional QI as unavailable unless your organization separately provisions and authorizes its workspace and supplies an exact separately approved aggregate created outside SHIFT with every required current receipt. Never enter row-, person-, event-, or narrative-level institutional data even when called deidentified.
- Use only an approved derived Soul/Discover profile. Never ask Hermes to display or persist raw quiz answers or raw `SOUL.md`.

## Verify the kit

Extract the ZIP and open a terminal in its root:

```text
python3 tools/verify-build-kit.py --package .
```

Windows may use `py tools\verify-build-kit.py --package .`. Verification proves the build kit's content/provenance; it does not say Hermes has built the target app.

## Begin the Hermes build

Give Hermes the full ZIP and the instruction in `README-FIRST.md`. Hermes should first return a read-only preflight and one Implementation Activation Card. Review:

- exact immutable source and proposed work copy;
- dependencies, licenses and network use;
- local URL, database, backup, log and deletion paths;
- selected adapters, active hat and protected contexts;
- safe data ceiling and prohibited information;
- actual Hermes capabilities detected;
- 20 powers inactive, 18 workflows Preview, 25 templates and all 10 agents P0;
- Institution-Approved QI state, expected to be unavailable unless separately proven;
- tests, clean-install, rollback, overlay removal and uninstall plan;
- blockers and unsupported features.

Choose `APPROVE`, `REVISE` or `CANCEL`. Approval covers only that card. It does not authorize patient data, live-care use, institutional data, profile changes, external actions, quality decisions, pilots/releases, or power/agent activation.

## Follow installation phases

Save S0 through S4 receipts. A receipt should identify actual changes, commands, network/dependencies, data/migrations, exact test evidence, running process IDs, blockers, rollback point and next step. If interrupted, use the exact resume command in `GIVE-THIS-PACKAGE-TO-HERMES.md`. Hermes must reverify and avoid duplicate routes, dashboards, migrations or records.

Do not accept a screenshot, static preview, source tree, “tests written,” development server or simulated AI as completion. The final report must use exactly Operational, Core operational; AI setup pending, or Not operational according to evidence. Personal app readiness and institutional-QI readiness are separate.

## First run of the completed app

1. Confirm the final URL is loopback-only and matches the handoff.
2. Create the local owner and store recovery material privately.
3. Select your role adapter(s), then choose one active hat/context. Do not overstate authority.
4. Review the no-PHI/live-care/no-shadow-system and personal-versus-institutional boundaries.
5. Preview the derived Mission Profile and Starter workspaces. Edit, skip or reject anything inaccurate.
6. Confirm all 20 powers are Inactive, 18 workflows are Preview Only, agents are P0 Disabled, external actions are Off and the fifth launcher is empty.
7. Start one low-risk mission using public, synthetic or nurse-owned nonsensitive information.
8. End with Evaluate, a source/authority check, what remains yours to decide, and a safe next step.

## Safe first missions

Try one of these without patient or employer details:

- “Help me build a seven-day shift, sleep, meals, commute and recovery plan using only my nonsensitive schedule constraints.”
- “Using a fictional unit scenario, help me rehearse a respectful speak-up conversation and list what I should verify in current local policy.”
- “Using synthetic counts only, help me frame a system-level quality opportunity and draft questions for an authorized QI leader. Do not call it QI or research and do not propose a live change.”

## Everyday recovery controls

- **Pause All:** cancel active/queued AI work and prevent new runs while preserving records.
- **Stop/Kill:** terminate the selected stream/run and record an honest receipt.
- **Safe Reset:** preview a return to private synthetic, session-only, disconnected, no-sharing/no-action, Core Four, empty fifth, inactive powers and P0 agents.
- **Correct:** revise a fact/source and mark dependent artifacts, approvals and badges stale.
- **Backup/Export:** preview included data, protect the file and prove restoration.
- **Delete:** show scope/consequences and remove eligible primary and derived records.
- **Overlay removal:** remove SHIFT specialization safely while preserving compatible Staff Nurse foundation data and unrelated work.
- **Rollback:** restore a matched application/database backup after preview.
- **Uninstall:** stop services, choose backup or deletion, remove files/launchers and report anything retained.

## Backup, update and rollback

Before update, stop the app; create a versioned database/configuration backup; export permitted records; record app/schema versions and checksums; and prove restore. An owner-controlled private backup contains only the isolated private store; each institutional backup contains only one separately authorized project store. Never create a cross-context backup. Update only from a verified package. Run migrations exactly once and reconcile record counts. On failure, stop, preserve redacted diagnostics, restore the matched binary and database backup, and record rollback. Never open a newer database using an older binary unless compatibility has been tested and documented.

## Sensitive-data event

Stop immediately. Do not ask AI to repeat, summarize, classify or redact the content. Cancel the run and prevent more persistence/export where possible. Use activity/deletion controls, preserving only non-content incident facts, and follow the authorized employer, privacy, security, clinical or incident process. SHIFT is not the incident authority.

## The benefit—and the responsibility

SHIFT can reduce scattered planning, make recovery and priorities visible, improve how you prepare questions and conversations, support truthful learning/career records, and make quality-system exploration disciplined. Your clinical judgment, verification, professional duties, human relationships, institutional approvals and final actions remain yours. Badges are developmental evidence, not credentials, clinical competence or permission to practice.
