# Guide Page Content — My SHIFT Mission Control

> This file is normative copy and interaction guidance for the in-product **Guide** page. Hermes must render it accessibly, keep it available offline, and link relevant sections from first run and contextual tooltips. A build specification or visible button is not proof that the final function works.

## Welcome

**My SHIFT Mission Control** is a private, governed workspace for a staff nurse’s practice learning, quality-improvement development, professional growth, life and recovery, and community or emerging-leadership goals.

It helps you think, learn, organize, rehearse, draft, verify and reflect. It does not replace clinical judgment, the clinical chain, employer policy, a manager, educator, quality sponsor, privacy or research review, a data steward, occupational health, or any other authorized human process. It does not hold a license or assume professional accountability.

Your home is one Command Center with five isolated workspace views—not five disconnected systems:

1. Practice
2. Quality Improvement
3. Professional Growth
4. Life / Recovery
5. Community / Leadership

One mission can use only one active workspace and one context at a time.

## Preparation message

Display before generation or installation begins:

> **Your Staff Nurse AI OS and My SHIFT Mission Control are being prepared.**
>
> This may take several minutes—and a full Hermes build can take several turns—because the system is checking your local setup, preserving the source baseline, resolving your role and workspace structure, and preparing governed mission, learning, quality, recovery and professional-growth pathways.
>
> Your recommended SHIFT powers, workflows and agents will be installed inactive. Agents remain `PERM-P0 Disabled`, tools and external actions remain Off, and no real profile or institutional authority is assumed. Keep this window open. If setup is interrupted, use Resume; do not start a second installation.

Progress must be based on completed checkpoints, not a timer. If progress is Unknown, say so.

## First-run walkthrough

### Step 1 — Read the trust boundary

Confirm these permanent rules:

- Do not enter PHI, patient screenshots, chart material, clinical stories, live-care details, row-, person-, event- or narrative-level workforce/quality information, health narratives, employment-dispute details, confidential institutional content, restricted investigations or reports, passwords, tokens or secret links. These institutional data levels remain prohibited even if labeled deidentified. Health or employment-dispute needs route to an appropriate qualified human or official process without retaining or echoing detail.
- The system does not give live-care direction; decide scope, assignment, delegation, competence, documentation, fitness or employment matters; make QI-versus-research determinations; authorize data or change; or complete official reporting.
- AI output is a draft or hypothesis until you verify it. You remain responsible for judgment, sources, artifacts and actions.
- SHIFT never sends, submits, schedules, purchases, posts, contacts a person, changes an official system or launches change. Authorized Execution is external human/official-system only; SHIFT may retain only a verified external action reference.

**Tooltip — Why so strict?** Personal convenience cannot create clinical, employment, institutional, privacy, research or data authority.

### Step 2 — Choose deployment context

- **Private Personal Mode:** nurse-owned, local, low-sensitivity planning and learning. No institutional quality data or operational project work.
- **Synthetic Preview:** fictional/public material for learning, simulation and prototypes. It is never operational evidence.
- **Institution-Approved Quality Workspace:** a separately provisioned and controlled workspace. It requires current sponsor, charter, role/decision rights, human QI/research determination, protected capacity, change authority, release owner, audit, stop and rollback receipts, plus data-steward receipts for exact separately approved aggregates created outside SHIFT only. Each aggregate receipt binds its exact definition/query/version, suppression rule, approval/expiry, and content hash. Row-, person-, event- and narrative-level institutional data remain prohibited even if labeled deidentified.

Private Personal Mode and an Institution-Approved Quality Workspace never share a storage partition, search index, AI context, export, retention policy or backup scope. A personal preference cannot relax institutional controls.

### Step 3 — Review Discover and Soul-derived fields

The Soul result supplies derived themes—not raw answers and not a personality verdict. The Discover Packet supplies proposed goals, preferences and workspace candidates. Review each group: mission, values, priorities, strengths/growth, goals, work style, workspaces, active context, authority, AI, memory, governance, recommendations, accessibility and uncertainties.

Choose **Approve**, **Edit**, **Reject**, or **Leave Unknown**. There is no blanket approval for authority, memory, agents, tools, institutional workspace binding or external use.

**Tooltip — Derived:** Suggested from an input. It is not fact until you confirm it.

### Step 4 — Choose one Primary workspace

You may keep all five views, but exactly one is Primary. This organizes the home screen; it does not confer authority or erase other parts of life. You can change Primary later through a reviewed profile update.

### Step 5 — Review recommendations

Recommendations are inactive. The first-run screen must show:

- powers/workflows: **Available — Inactive**;
- agents: **Installed — `PERM-P0 Disabled`**;
- tools/connectors/schedules/sharing/external actions: **Off**;
- memory: **Off / session only**;
- optional fifth launcher: **Empty**.

### Step 6 — Seed synthetic starters

Choose **Seed**, **Skip**, or **Review first**. Starters are fictional structures and never count as your accomplishment, mission outcome, professional evidence, badge evidence, competence or institutional work. You can Clear or Restore them without affecting your work.

### Step 7 — Complete a safe first ritual

Choose one low-risk problem: a schedule-cycle plan, generic learning question, private conversation rehearsal, synthetic quality problem frame, professional-growth step or community exploration. Any reflection must be abstract and screened, with no patient, event, coworker, rare-combination or reconstructable narrative. Do not use restricted workplace or live official-process information. Keep the first result to one page and name the human route.

## Command Center map

### Core Four

- **Plan My Shift & Life:** schedule, commute, meals, sleep opportunity, recovery, learning, protected-life item and Plan B. Never patient assignment.
- **Learn, Reflect & Speak Up:** generic learning, abstract screened reflection with no patient, event, coworker, rare-combination or reconstructable narrative, communication rehearsal and human-route preparation.
- **Improve Quality Together:** systems problem framing, authority checks, synthetic process/PDSA/measure learning. It never launches change.
- **Review, Approve & Escalate:** SHIFT Gate showing sources, EDENA, exact human decisions, disclosure, fallback, rollback and next safe action.

The optional fifth launcher stays empty until one bounded power is separately previewed and approved. The home view shows no more than seven attention items.

### Permanent controls

Keep visible: **Privacy**, **Role & Employer**, **Data Boundary**, **Sources & Policy**, **QI / Research**, **History**, **Pause All**, **Safe Reset**, **Correct**, **Export**, **Delete**, **Rollback**, **Remove SHIFT**, and **Full Uninstall**.

**Pause All** stops pending and new AI/overlay work without deleting drafts. **Kill** stops a selected in-flight run. Neither hides partial effects; the activity receipt shows what started, stopped, completed or remains Unknown.

## The five workspace views

### Practice

Use for general learning, current-source verification, abstract screened reflection and private conversation rehearsal. Abstract screened reflection contains no patient, event, coworker, rare-combination or reconstructable narrative. Never use this view for live care, shadow charting, actual patient decisions, scope/assignment/delegation/competence determinations, official reports or event reconstruction.

### Quality Improvement

Use Synthetic Preview for systems-learning practice. Real institutional analysis remains blocked until the separately approved workspace and current authority receipts exist, and then accepts only exact separately approved aggregates created outside SHIFT. No row-, person-, event- or narrative-level institutional data may enter SHIFT, even if labeled deidentified. The system must show this exact artifact lifecycle:

`Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan (human scope review only) → Authorized Execution (external human/official-system only; no app action) → Completed Action (verified external reference only) → Evaluated Outcome`

Every real PDSA Do, pilot, workflow or policy change, spread, release, and execution occurs outside SHIFT through accountable humans and official systems. SHIFT may retain only a verified external action reference. Missing, changed or expired authority or aggregate approval returns the work to Preview. Never score, rank, profile, predict or evaluate a person.

### Professional Growth

Use for learning plans, current credential-path exploration, mentorship preparation and truthful portfolio artifacts. Distinguish **self-authored**, **AI-assisted**, **human-reviewed** and **institution-validated**. AI practice is not competence; a badge is not a credential, license, certification, promotion or authorization.

### Life / Recovery

Use for private schedule-cycle planning, relationships, high-level finances, recovery, Minimum Mode and re-entry. This view is invisible to institutional quality work. The system cannot diagnose burnout, fatigue, impairment, mental health, fitness for duty or safe-driving capacity. If you report immediate risk, the system stops productivity coaching and emphasizes local human, emergency or safe-transport options.

### Community / Leadership

Use for consent-based listening, service exploration, shared-learning and emerging-leadership rehearsal. It cannot borrow an organization’s authority, recruit, promise, survey, provide public health guidance, contact anyone or make a public claim without the appropriate human process.

## Start a Mission

Select **Start a Mission**, then answer only what is needed:

1. What do you want to learn, decide, draft, practice or improve?
2. Which one workspace and operational context apply?
3. What data class is needed? Institutional QI accepts exact separately approved aggregates created outside SHIFT only. If the proposed input is row-, person-, event- or narrative-level, even if labeled deidentified, or if its class is sensitive, restricted or Unknown, stop.
4. What is your authority? Which human owns the real decision?
5. What would success, burden, unintended effects, fallback and stop look like?

Mission Control creates a local draft and shows the five-stage loop.

### 1. Assess

Separate verified facts, your information, synthetic fixtures, assumptions and unresolved questions. Check current sources, constraints, affected people, capacity, role and authority. A model’s confidence is not evidence.

### 2. Diagnose or Define

Define the problem, opportunity or decision without diagnosing people or claiming a root cause. Show contributing factors, dependencies, competing interpretations, missing knowledge and the central human decision.

### 3. Plan

Compare options by benefit, feasibility, time, workload, cost, privacy, fairness, accessibility, reversibility and authority. Choose measures, balancing measures, milestones, review owners, fallback and stop conditions.

### 4. Implement

Inside personal Mission Control, Implement means turn a plan into local tasks, checklists, prompts, rehearsals and draft artifacts. It does not mean real clinical, employment, institutional, financial or community execution. Every real PDSA Do, pilot, workflow or policy change, spread, release, and other consequential action occurs outside SHIFT through accountable humans and official systems; SHIFT may retain only a verified external action reference.

### 5. Evaluate

Compare observed results with the original objective. State what worked, failed, remains uncertain, created burden or should stop. Feed the lesson into a new Assess stage. A preview, click, generated artifact or completed AI run is not an outcome.

Use **Pause**, **Revise**, **Back**, **Start next iteration**, or **Close** at any stage. The loop is repeatable, not a one-way wizard.

## Sandbox states

Every mission and artifact displays one state from this exact lifecycle:

`Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan (human scope review only) → Authorized Execution (external human/official-system only; no app action) → Completed Action (verified external reference only) → Evaluated Outcome`

Personal Mission Control should normally stop at Draft Artifact. Approved Plan records human scope review only and grants no execution permission. Never label a simulation or AI response as institutional work.

## EDENA advisories

EDENA uses two independent stored and displayed fields: `edena_tier` and `absolute_stop`. The tier communicates consequence and review needs:

- **Green:** low-risk local organization or learning with public/synthetic information.
- **Yellow:** uncertainty, sourcing, privacy, professional, workplace or disclosure review is needed.
- **Orange:** consequential or institutional implications require an authorized human before further use.
- **Red:** high consequence or an unresolved boundary requires explicit review and routing; the separate `absolute_stop` field determines whether any continuation is permitted.

In the **Personal Edition**, Red may continue only as a clean fictional/generic sandbox after deliberate acknowledgment when `absolute_stop=false`; it remains blocked from representation as safe, validated or authorized. `absolute_stop=true` always stops processing and cannot be acknowledged away. It applies to PHI, live care, prohibited data or action, illegal activity, and missing nonwaivable authority.

In an **Institutional Edition**, institutional policy, access controls and approval routes take precedence. Red blocks operational progression until the required review is complete, and `absolute_stop=true` can never be waived.

**Tooltip — EDENA is not approval:** A color or tier never certifies clinical safety, legality, policy compliance, quality validity or permission.

## Hermes agents and permissions

SHIFT agent names are a proposed team, not autonomous coworkers. After installation every `SHIFT-AGT-*` is `PERM-P0 Disabled`. P0 means no model call, tool, retrieval, network, credential, memory, schedule, destination, delegation or background work.

P3 is limited to a separately approved deterministic local personal reminder after three supervised successful runs, using only minimum necessary personal reminder fields. It permits no model inference, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input, or quality decision and creates no agent, external-action or institutional authority.

If a future build supports an agent run, it requires a one-run charter with purpose, exact inputs, exclusions, context, data class, source allowlist, permission ceiling, expected artifact, timeout, stop conditions and human reviewer. A permission token is scoped to that single run and cannot be reused. Agents cannot activate themselves, widen scope, approve themselves, call an unapproved agent, send externally or survive Kill.

**Tooltip — Recommendation vs activation:** Seeing an agent or power on a card means “consider this,” not “it is running.”

## Sources, evidence and artifacts

For material claims show exact source, publisher/owner, version/date, retrieved date, authority type, local applicability, supported claim, conflicts, correction status, uncertainty, reviewer and expiry. General professional guidance is not automatically local employer policy.

Before external use, review:

- intended audience and destination;
- sensitive/restricted content and small-cell risk;
- facts, sources, dates, limitations and unresolved claims;
- nurse authorship, AI assistance and disclosure;
- professional/institutional authority;
- accessibility and unintended burden;
- fallback, correction, withdrawal and rollback.

The system must never say an AI artifact is clinically validated, legally authorized, institutionally approved or safe for direct operational use unless exact independent evidence supports that statement.

## Capabilities and mastery

Capability pages recognize observable learning from adopted, evaluated, nonsynthetic missions and reviewed artifacts. Evidence includes the user’s contribution, AI contribution, sources, corrections, minimized process reflection, human review and what the user can now do independently. Private health, schedule, transport, relationship, financial, caregiving, readiness, recovery and whole-life details never enter badge records. The contextual-review policy applies at every level: professional/portfolio, credential/education, employment/institutional, quality/project-outcome, EDENA Yellow/Orange, or otherwise consequential evidence requires a current scope-matched named-human review even when a criterion's unconditional `requires_human_review` flag is false.

The four build-layer mastery labels are **Basic**, **Intermediate**, **Advanced**, and **AI Agent Orchestration Master**. They are developmental Nurse AI OS labels only. They are not clinical credentials, grades, licensure, certification, competence validation, employment qualification or authority. Synthetic starters, button clicks and imported profile traits never earn a badge.

Levels build in order: Intermediate requires current Basic, Advanced requires current Intermediate, and AI Agent Orchestration Master requires current Advanced plus the global capstone. If prerequisite evidence expires, is corrected, deleted, superseded, revoked or conflicted, downstream levels are recalculated rather than preserved by assumption.

## Privacy, memory and exports

Default memory is Off/session-only. A new category needs purpose, fields, context, access, retention, expiry, correction, export, deletion and separate consent. “Forget” removes local context; it cannot promise deletion from a model provider unless the provider confirms it.

Exports are local drafts with provenance and warning labels. Private Life/Recovery records are always excluded from institutional exports. A Quality workspace draft may contain only exact separately approved aggregates created outside SHIFT and their bound governance metadata. Any institutional release occurs outside SHIFT through accountable humans and official systems; SHIFT may retain only a verified external release reference.

## Installation, update and recovery

1. Back up the current Hermes/Nurse AI OS and verify the backup can be read. Keep owner-controlled private data in a private-only backup and each institutional project in its own separately authorized backup; never create a cross-context backup.
2. Verify the downloaded ZIP checksum and inspect the manifest.
3. Extract to a new local folder; do not overwrite the source baseline.
4. Give Hermes `GIVE-THIS-PACKAGE-TO-HERMES.md` and require read-only preflight plus an Activation Card before any mutation.
5. Confirm build-layer identity, target route, local ports, storage paths, supported OS/runtime and whether a real compatible backend exists.
6. Build/test in checkpoints. Resume after interruption; never run two installers.
7. Accept readiness only from packaged runtime evidence. “Build instructions complete” is not “application operational.”
8. Keep backups until install, restart, update, rollback, restore and uninstall tests pass.

For updates, compare source/version/schema/migration and affected permissions. Re-run relevant tests. Rollback restores the last verified checkpoint without deleting unrelated work. **Remove SHIFT** removes the overlay while preserving the compatible foundation; **Full Uninstall** previews everything removed or retained. Report any item that cannot be restored or deleted.

## Quick examples

- **Safe:** “Help me create a private no-PHI schedule-cycle reset with a Plan B.”
- **Safe synthetic QI:** “Using fictional data, help me practice a systems problem frame and list sponsor questions.”
- **Human route required:** “What questions should I ask my educator about a local scope policy?”
- **Stop and route now:** “Tell me what to do for this real patient,” followed by any patient detail.
- **Prohibited:** pasting a patient screenshot, chart excerpt, any event or reconstructable narrative, row- or person-level attendance/performance data, restricted report, or secret, even if the content is labeled deidentified.

## Help and accessibility

All functions must work by keyboard, with visible focus, semantic headings, screen-reader order, sufficient contrast, 200% zoom/reflow, reduced motion, non-color status cues, accessible error summaries, mobile/print views and a Markdown/manual fallback. Ask for the minimum information, allow **Skip**, **Not now**, **Use an example**, **Session only**, and **Ask a human**, and never shame missed goals.

If a control is unavailable, show **Unavailable** and a reason. Do not display fake progress, fake connection, fake sources, fake AI streaming, fake completion or a working-looking button with no safe backend.
