# SHIFT Staff Nurse Life & Practice Mission Control — Reference Architecture and Data Model

**Target product:** SHIFT — Staff Nurse Life & Practice Mission Control  
**Product ID:** `staff-nurse-life-practice-mission-control`  
**Population lane:** `staff_nurse_life_practice`  
**Canonical dashboard:** `/staff-nurses/dashboard`  
**Home label:** `My SHIFT Mission Control`  
**Canonical namespace:** `snqi_shift.*`  
**Target version:** `2.0.0`  
**Readiness at build-kit assembly:** **Not operational**

The product identity, route, stable build-layer IDs, database schemas, agent catalog and permission vocabulary are implementation decisions. The canonical domain authority remains `NAIO-SNQI-COMPLETE-SHIFT-1.0`, foundation `NAIO-SN-LPEF-1.0` and overlay `NAIO-SNQI-SHIFT-1.0`.

This architecture is a build contract. It becomes evidence only after Hermes completes read-only preflight, presents the Implementation Activation Card, receives explicit approval, implements the target, packages it and executes the acceptance ledger.

## 1. Design commitments

Preserve the five foundation departments, NURSE Compass, Staff Nurse Empowerment Compact, Trust Shield, EDENA tiers, SHIFT Gate, Human Work & Quality Standard, four role adapters, two deployment contexts, Core Four, twenty inactive powers, eighteen workflows, twenty-five templates, 40 foundation checks, 120 overlay checks and 16 integration checks.

The target adds real implementation mechanisms:

1. authenticated loopback application and local credential;
2. durable SQLite data with forward-only migrations;
3. useful offline life, practice, learning, communication, career and quality-preparation work;
4. explicit active owner, role, task hat, employer, deployment context and authority state;
5. physical and logical isolation between Private Personal Mode and every Institution-Approved Quality Workspace;
6. server-side no-PHI, live-care, event, coworker and confidential-data admission guards;
7. durable Assess–Diagnose/Define–Plan–Implement–Evaluate missions and PDSA lineage;
8. current authority, project, QI/research, data, measure, clinical/operational, release and capacity receipts;
9. real Hermes capability discovery, genuine streaming and cancellation;
10. source, policy, provenance and claim-citation integrity;
11. consent-controlled memory and P0-by-default agents;
12. complete controls, recovery, accessible UI and evidence-led readiness.

Non-negotiable qualities:

- The staff nurse remains the clinician, decision-maker, author and steward within verified role and scope.
- The product never becomes a clinical system, shadow record, event file, staffing tool, manager dashboard, surveillance system or competence validator.
- Core work remains useful with AI and network disabled.
- Private life data never enters employer or QI systems, analytics, agents, exports or searches.
- Institutional quality work exists only in a separately provisioned, approved and bound workspace.
- Unknown authority is not permission.
- AI prepares; authorized humans decide and own consequential action.
- Every enabled control is real, reversible where promised and testable.
- Operational status comes only from executed evidence for the final packaged artifact.

## 2. Recommended local architecture

```text
Browser UI
  │ same-origin authenticated API + real streamed events
  ▼
Loopback application server (127.0.0.1 by default)
  ├── authentication, rotating sessions, CSRF, Origin/Host, rate/size limits
  ├── active owner/role/hat/employer/context authorization
  ├── Trust Shield + EDENA + SHIFT Gate + release policy engine
  ├── context router (deny by default)
  │    ├── Private Personal Service → private SQLite store
  │    └── Approved QI Service → one isolated SQLite store per approved workspace
  ├── mission, NURSE Compass, practice, learning and quality services
  ├── Core Four, twenty-power registry and lifecycle coordinator
  ├── source/policy registry, retrieval and claim/citation validator
  ├── AIBackend
  │    ├── Hermes adapter discovered from installed capabilities
  │    └── optional compatible adapter
  ├── agent registry, route preview, exact-run coordinator, Pause and Kill
  ├── consent-controlled structured memory scoped to one store/context
  ├── backup/restore/update/rollback/uninstall services
  └── content-free governance, checkpoint and diagnostic receipts
```

The browser is not a trust boundary. The server validates authentication, active context, role ceiling, employer/project, `SHIFT-DATA-*` class, authority receipts, `edena_tier`, independent `absolute_stop`, SHIFT result, permission, object revision and expiry for every mutation, import, export, retrieval, AI call, agent run, memory operation, approval and cross-record link.

Browser storage may contain only non-secret, non-authoritative display preferences and an ephemeral safe cache. SQLite is the durable source of truth.

### 2.1 Storage isolation decision

Use at least two storage classes:

1. `private-personal.sqlite` for the authenticated nurse's private life/practice records; and
2. one separately encrypted-at-rest-if-configured `qi-<opaque-workspace-id>.sqlite` per institution-approved quality workspace.

A small application registry may hold only opaque store identifiers, product/schema version, last-opened safe label, coarse health state and path reference. It must not contain schedules, readiness, health, relationships, finances, reflections, project measures, names, narratives or source content.

No SQL query, full-text index, cache, AI prompt assembly, memory retrieval, backup, export or agent route may join private and institutional stores. Owner-controlled private backups may include only the private store after exact preview; each institutional backup is separately authorized and contains only one bound institutional store. Switching contexts closes the prior repository handle, clears scoped caches, rotates context nonce and reruns authorization. A workspace bind is a reference boundary, not a data transfer.

## 3. Suggested implementation layout

```text
app/
├── client/
│   ├── index.html
│   ├── assets/
│   └── modules/
├── server/
│   ├── main.*
│   ├── auth/
│   ├── api/
│   ├── domain/
│   │   ├── identity-context/
│   │   ├── life-practice/
│   │   ├── missions/
│   │   ├── learning-communication/
│   │   ├── quality-improvement/
│   │   ├── shift-powers/
│   │   └── capability-evidence/
│   ├── governance/
│   ├── evidence/
│   ├── agents/
│   ├── ai/
│   ├── memory/
│   ├── audit/
│   ├── recovery/
│   └── db/
│       ├── registry/
│       ├── private/
│       ├── institutional/
│       ├── migrations/
│       └── repositories/
├── config/
├── tests/
├── scripts/
├── .env.example
├── package.json
└── lockfile
```

Prefer a supported LTS runtime, locked dependencies and the smallest maintainable local stack. Any departure must appear on the Activation Card with platform, security, migration and test consequences.

## 4. Identity, role, employer and context model

One authenticated local owner has one unified identity and one Staff Nurse Command Center. The owner explicitly selects one role adapter and one task-level hat; the product never infers authority from a title, file, committee, model output or technical access.

Canonical role adapters:

- `direct_care_staff_nurse`
- `unit_champion_preceptor_shared_governance`
- `chartered_staff_nurse_qi_project_lead`
- `hybrid_multiple_employer`

Role ceilings:

- Direct care supports private planning, generic learning, abstract screened reflection with no reconstructable narrative, and preparation only; it cannot authorize QI, policy, workflow, data or release.
- Champion/preceptor/shared governance adds only documented responsibilities and grants no supervisory, disciplinary, staffing, credentialing, competency or ranking authority.
- Chartered QI lead acts only inside current charter and decision rights; it cannot self-authorize data, project classification, live testing, publication, spread or policy/care change.
- Hybrid/multiple-employer mode requires an explicit employer/task hat on each consequential record. Least privilege wins and no cross-employer transfer exists.

### 4.1 Context tree

```text
local_owner
└── unified_identity
    └── My SHIFT Mission Control
        ├── Private Personal Mode
        │   ├── shift-and-life planning
        │   ├── generic learning and readiness
        │   ├── abstract screened reflection with no reconstructable narrative
        │   ├── communication rehearsal
        │   ├── credential/career portfolio
        │   └── health scheduling, recovery, relationships, finances and purpose
        └── Institution-Approved Quality Workspace (zero or more; separately provisioned)
            ├── one organization/employer
            ├── one approved project/charter boundary
            ├── public/synthetic material or exact separately approved aggregates created outside SHIFT only
            ├── current human determination and data/measure receipts
            └── no private-life records or cross-project joins
```

Each request carries:

- `owner_user_id`;
- `deployment_context`;
- `workspace_id` and storage nonce;
- `role_adapter` and `task_hat`;
- `employer_or_personal_context`;
- `project_id` or explicit `none`;
- `purpose`;
- `data_class`;
- `authority_snapshot_id`;
- `policy_snapshot_id`;
- `retention_policy_id`;
- object revision and request nonce.

Missing, stale, expired, changed or conflicting context fails closed for persistence, AI, memory, power activation, project advancement, release and agent execution.

### 4.2 Context-change invalidation

A change in owner, role, hat, employer, workspace, project, charter, determination, data, measure, purpose, source, audience, destination, permission, model, tool or policy invalidates affected:

- workspace binds;
- authority receipts;
- data and measure approvals;
- artifact reviews and release receipts;
- power activation approvals;
- agent charters and one-run tokens;
- memory consent where scope changed;
- AI session context; and
- downstream mission/PDSA stage approvals.

## 5. Data classification and admission

### Closed classes

- `SHIFT-DATA-0` — public, authoritative, nonsensitive information with source, version, applicability, and limits; public status grants no local authority.
- `SHIFT-DATA-1` — clearly fictional scenarios, fixtures, and synthetic QI measures, always labeled and never represented as real.
- `SHIFT-DATA-2` — minimum-needed nurse-authored nonsensitive personal schedule, goals, learning, career, capacity, high-level life planning, and abstract screened reflection after screening and consent; confined to Private Personal Mode.
- `SHIFT-DATA-M` — minimum-necessary sponsor/decision-owner work name, role, and approved work contact, only for routing/accountability in its authorized QI workspace; never measure data or workforce analytics.
- `SHIFT-DATA-A` — exact separately approved aggregate values created outside SHIFT for one named institutional project/purpose, with current sponsor, human determination, steward/privacy, exact query/definition/version, provenance, suppression/small-cell, access, retention/deletion, approval/expiry, release-owner, and content-hash receipts. It contains no row-, person-, event-, or narrative-level information even if called deidentified.
- `SHIFT-DATA-X` — prohibited or unclassified content; reject before persistence, logging, indexing, memory, backup, export, or AI forwarding.

### Prohibited classes

- PHI, patient/family identifiers, chart excerpts, handoffs, screenshots, recordings, patient lists, room-linked or exact-time narratives and rare identifying combinations;
- live clinical observations, medication/device/alarm questions, care plans, patient tasks, actual assignment or delegation details;
- event reports, peer-review/patient-safety work product, investigations, legal claims and incident reconstruction;
- coworker performance, personnel, scheduling, health, disability, discipline, grievance, complaint, inferred trait, narrative or private information;
- private-life data in any institutional context;
- unauthorized employer, vendor, security, quality, research or operational information;
- credentials, tokens, passwords, private keys, bank/payment credentials, government IDs and secret URLs;
- information obtained without authority or supplied for reidentification, surveillance, profiling, ranking, retaliation, discrimination, concealment or falsification.

The labels “deidentified,” “redacted,” “aggregate,” “approved,” “public” or “synthetic” are claims to verify, not permission. Institutional QI accepts only `SHIFT-DATA-A`; row-, person-, event-, and narrative-level information is rejected even when labeled deidentified. On uncertainty, classify as `SHIFT-DATA-X`, reject the body, persist no derived summary, send nothing to AI and write only a content-free boundary receipt.

### Sensitive-input response

1. stop processing;
2. do not quote, summarize or transform the body;
3. prevent persistence, indexing, logs, memory, export and AI forwarding;
4. clear transient buffers where technically possible;
5. show correction/deletion/activity options;
6. route to the authorized clinical, privacy, security, event, quality, research, HR/labor, legal or emergency process;
7. store only classification, control version, timestamp and outcome—not the content.

## 6. Persistent model

Use opaque UUIDs, UTC timestamps, explicit schema versions, foreign keys, optimistic revisions and lifecycle states. Every mutable record contains `owner_user_id`, `deployment_context`, `workspace_id`, `role_context_id`, `purpose`, `data_class`, `retention_policy_id`, `created_at`, `updated_at`, `revision`, archive state and deletion state as applicable.

### 6.1 Platform, identity and context registry

1. `app_meta` — product, application, schema, source-corpus and migration versions.
2. `local_users` — local identity and credential-verifier metadata; never plaintext credentials.
3. `sessions` — hashed token metadata, issue/expiry/rotation/revocation and safe client metadata.
4. `unified_identities` — local display-safe identity anchor.
5. `mission_profiles` — approved derived profile versions; no raw Soul/quiz/interview answers.
6. `profile_field_provenance` — source, derived value, uncertainty, user decision and timestamps.
7. `workspace_registry` — opaque store reference, type, safe label, schema and coarse health only.
8. `role_contexts` — canonical adapter, task hat, employer/personal label, decision ceiling and validity.
9. `authority_rule_profiles` — source, scope, exclusions, verifier, version, expiry and status.
10. `context_switch_receipts` — prior/new context, invalidated items, cache/session reset and human decision.

### 6.2 Mission and work management

11. `missions`, `mission_cycles`, `mission_stages` — Assess, Diagnose/Define, Plan, Implement and Evaluate lineage.
12. `projects`, `goals`, `milestones`, `tasks`, `task_dependencies`, `measures`, `reviews` — structured offline work.
13. `notes`, `decisions`, `assumptions`, `unknowns`, `risks`, `safeguards`, `attachments` — scoped supporting records.
14. `artifacts`, `artifact_versions`, `artifact_reviews` — maturity, authorship, AI contribution, exact-hash review and disclosure.
15. `starter_seed_versions`, `starter_records`, `starter_adoptions` — idempotent synthetic starters and lineage.

### 6.3 Canonical foundation records in the private store

16. `nurse_profiles` — preferred name, role/setting, schedule pattern, capacity, preferences and approved goals.
17. `shift_cycles` — nurse-owned shifts, commute, transitions, fixed commitments and buffer; no assignments.
18. `personal_shift_readiness` — sleep opportunity, meals, transport, personal needs, learning and protected-life item; no fitness determination.
19. `learning_goals` — objective, source, review cadence, human verifier and limits.
20. `credential_education_milestones` — requirement source, due date, evidence status and verifier; never competence certification.
21. `abstract_screened_reflections` — owner reflection limited to abstract screened themes, retention choice, learning and human question; no patient/event/coworker/rare-combination or reconstructable narrative.
22. `human_conversation_briefs` — observable no-PHI facts, uncertainty, goal, questions, route and nurse-edited draft.
23. `career_portfolio_artifacts` — truthful contribution, evidence, review and disclosure status.
24. `whole_life_goals` — mission, health scheduling, relationships, family, finances, community, restoration and protected commitments.
25. `north_stars`, `ninety_day_results`, `capacity_plans`, `minimum_modes`, `reentry_plans`, `support_maps` — NURSE Compass and recovery state.

### 6.4 SHIFT overlay records

Preserve canonical `snqi_shift.*` names and do not duplicate foundation records:

26. `snqi_shift.role_context`
27. `snqi_shift.workspace_bind_receipt`
28. `snqi_shift.quality_project`
29. `snqi_shift.project_authority_receipt`
30. `snqi_shift.qi_research_determination_receipt`
31. `snqi_shift.improvement_opportunity`
32. `snqi_shift.evidence_source`
33. `snqi_shift.data_authority_and_provenance`
34. `snqi_shift.process_map`
35. `snqi_shift.measure_definition`
36. `snqi_shift.pdsa_cycle`
37. `snqi_shift.aggregate_sensemaking_brief`
38. `snqi_shift.release_receipt`
39. `snqi_shift.power_state`
40. `snqi_shift.capacity_burden_review`

Each contains owner, role, employer, context, project, purpose, data class, authority, source/version, human decision, status, created/updated time, expiry, retention, correction history and deletion state.

### 6.5 Institutional project governance records

41. `workspace_provision_receipts` — separately provisioned workspace ID, authenticated owner, isolation proof and incident/removal route.
42. `project_charters` — sponsor, scope, exclusions, staff-nurse role, decision rights, affected teams and expiry.
43. `human_determinations` — authorized QI/EBP/evaluation/research/HRPP/IRB result, conditions, issuer, evidence reference and redetermination triggers; never AI-created authority.
44. `data_use_receipts` — steward/privacy owner, exact separately approved aggregate object created outside SHIFT/content hash, purpose, exact query/definition/version, provenance, access, retention, deletion, approval date and expiry; never a row/person/event/narrative field allowlist.
45. `field_dictionaries` — aggregate definition, source, unit/time grain, numerator/denominator or unit, exclusions, permitted use and restrictions.
46. `small_cell_rules`, `suppression_decisions` — thresholds, combinations, reviewer and release effect.
47. `change_authority_receipts` — clinical and operational owners, exact approved test/change and limits.
48. `release_authority_receipts` — audience, destination, disclosure, privacy/legal/communications review and expiry.
49. `protected_capacity_receipts` — paid/protected time, workload budget, owner, tradeoffs and review.
50. `project_handoffs`, `sustainment_reviews`, `spread_reviews` — accountable owner, version, training, drift, fallback and rollback.

### 6.6 Power, evidence and development records

51. `shift_power_definitions` — frozen Power 1–20 title/order/source hash and build-layer ID.
52. `power_activation_previews`, `power_activation_receipts` — exact context, data, authority, purpose, risk, burden, sources, fallback, expiry and approval hash.
53. `supervised_run_evidence` — three-run evidence for separately reviewed low-risk deterministic automation; never clinical/QI/external action.
54. `workflow_definitions`, `template_definitions` — frozen 18/25 catalogs and source hashes.
55. `capability_domains`, `criteria_versions`, `capability_evidence`, `capability_awards`, `award_corrections` — evidence-based development, not credentialing.
56. `portfolio_contributions`, `authorship_disclosures`, `team_credit_records` — truthful role and shared credit.

### 6.7 Sources, AI, agents and memory

57. `evidence_sources` — title, authority, identifier/URL, version/date, access, applicability, conflict, correction/supersession and status.
58. `claims`, `claim_source_links`, `citation_validations` — exact claim/hash, relationship, limits, reviewer and expiry.
59. `retrieval_runs` — query, filters, provider and reproducibility metadata without prohibited bodies.
60. `ai_connections`, `connection_capabilities` — backend label, authenticated status, discovered features/models and redacted error.
61. `ai_sessions`, `ai_messages`, `stream_events`, `tool_events` — authorized non-sensitive content and actual provider events.
62. `agent_definitions` — frozen catalog; definition is not activation.
63. `agent_charters`, `agent_routes`, `agent_runs`, `approval_requests`, `kill_receipts`, `run_reconciliations` — exact one-run controls.
64. `memory_items`, `memory_revisions`, `memory_consent_receipts` — permitted value, category, purpose, source, context, consent, retention and expiry.
65. `governance_receipts`, `audit_events`, `diagnostic_runs`, `checkpoint_receipts` — append-only redacted metadata, object hashes and results.

## 7. Mission and improvement state model

Every mission is durable, revisable and repeatable:

1. **Assess** — separate verified fact, nurse-provided information, source-backed explanation, assumption and unknown; identify current context, resources, stakeholders and constraints.
2. **Diagnose or Define** — frame the nonclinical problem, opportunity, learning need or decision; identify causes, dependencies, risks and competing interpretations. This is never a patient diagnosis.
3. **Plan** — compare options by benefit, feasibility, time, cost, burden, equity, accessibility, ethics, authority and reversibility; define measures and human gates.
4. **Implement** — create local tasks, rehearsal, drafts, prototypes, checklists, PDSA plans or human handoffs. The application does not itself change care, policy, workflow or an official system.
5. **Evaluate** — compare result with goals/measures; retain adverse, null and partial findings; choose Retain, Revise, Pause, Remove, Escalate or New Assess.

Mission stage states:

`not_started → in_progress → awaiting_human → blocked → completed → reopened → superseded → archived`

A material upstream change invalidates downstream approvals and returns affected work to Preview. Users can pause, branch, reopen, archive, restore, export and delete without AI.

For quality projects, PDSA is nested inside this mission loop and retains exact Plan/Do/Study/Act planning and verified-reference records. “Do” is always an authorized human-owned activity performed outside SHIFT through the appropriate official process. SHIFT never implements or launches the action; it may record only a verified external reference. AI never reports that a real-world test ran based on a plan, approval, or user-interface click.

## 8. Core Four implementation

The opening Command Center pins exactly four launchers. Opening one creates or resumes a local draft; it never invokes AI, activates a power or performs external action implicitly.

1. **Plan My Shift & Life** — Top Three, fixed commitments, commute, sleep opportunity, meals, recovery, learning, protected-life item and Plan B; no assignments.
2. **Learn, Reflect & Speak Up** — general learning, abstract screened reflection with no reconstructable patient/event/coworker narrative, communication rehearsal, scope/delegation questions and a human route.
3. **Improve Quality Together** — synthetic preparation by default; real project view only after current workspace bind and authority receipts; never launches change.
4. **Review, Approve & Escalate** — run EDENA and the SHIFT Gate, display exact unknowns, humans, destinations, fallback, rollback and next safe step.

The fifth position remains empty until one power is separately previewed and approved. All twenty definitions install `Available inactive`. A pinned shortcut is not activation.

## 9. SHIFT power lifecycle

Canonical state machine:

`Available → Previewed → Approved inactive → Active bounded → Paused → Removed`

Each transition binds:

- definition and source hash;
- owner, role, task hat, employer, context and project;
- purpose and expected benefit;
- exact permitted/prohibited inputs and data class;
- sources/policy versions, `edena_tier`, independent `absolute_stop`, and SHIFT result;
- affected people and human owner;
- mode, model/tools and permission ceiling;
- memory and retention;
- burden, accessibility and equity review;
- stop/failure conditions, fallback, expiry, rollback and removal;
- exact content hash and human approval.

No power self-activates, grants authority, changes role, crosses stores, shares data or performs an external action. An expired or materially changed field returns the power to an inactive/preview state.

## 10. Quality-project gate

An institutional project cannot pass generic/synthetic planning until all are current:

1. separate workspace provisioning and isolation proof;
2. authenticated owner, active staff-nurse role and employer;
3. sponsor, charter, scope, exclusions and decision rights;
4. authorized QI/EBP/evaluation/research human determination;
5. data steward/privacy owner and an exact separately approved aggregate created outside SHIFT, bound by content hash, exact query/definition/version and provenance;
6. approved operational definitions, measures, suppression/small-cell/subgroup rules, access, retention/deletion, approval and expiry;
7. clinical and operational change owners;
8. privacy, security, records, release and other required reviews;
9. protected/paid capacity and burden budget;
10. stop, incident, fallback, expiry, disconnection, rollback and removal plan.

Project lane:

`Idea → Human determination → Chartered → Aggregate approved → PDSA preview → External human-approved pilot reference → Study → Sustain / Revise / Pause / Remove`

The pilot state is a reference gate only. Any pilot, care/policy/workflow change, spread, release, or official action occurs outside SHIFT through authorized humans and systems.

Any missing, expired or changed receipt blocks advancement and returns the affected stage to Preview. AI never supplies or signs a receipt.

## 11. Artifact and action states

Persist and display distinct states:

`Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan → Authorized Execution → Completed Action → Evaluated Outcome`

`Approved Plan` means human scope review only and is not execution permission. `Authorized Execution` means external human/official-system action only; the app performs no action. `Completed Action` requires a verified external reference and is never inferred from a click, draft, approval, model output, or unverified claim. The target application has no clinical, staffing, event-report, employer, communications, publishing or official-system write connector. A local export/download may be enabled only after exact review and release checks; the user performs any external transfer.

Material content, audience, destination, context, data, authority, source, model, prompt, tool or version change invalidates approval.

## 12. EDENA and SHIFT Gate runtime

Apply both models server-side; the stricter result wins.

EDENA for the foundation means Evidence, Decision, Employment, Nursing-safety and Authority. Persist two independent fields: `edena_tier` (`unclassified`, `green`, `yellow`, `orange`, or `red`) and Boolean `absolute_stop`:

- **Green:** low-risk private organization and generic/public learning; proceed with nurse review and permitted data.
- **Yellow:** interpretive professional support; show assumptions, source/version, limits and human verification.
- **Orange:** sensitive or consequential preparation; minimize personal data, request no patient details, prepare a human-facing question/brief only when safe and stop before the decision.
- **Red:** high-risk, consequential, prohibited, or potentially harmful. In Personal Mode, a Red item may continue only as a new clean fictional/generic exploration after deliberate acknowledgment when `absolute_stop=false`; the original content is not retained or transformed. In an institutional workspace, Red blocks operational progression until required current human review and authorization are verified.

`absolute_stop=true` hard-blocks regardless of edition, acknowledgment, preference, or EDENA tier. It applies to PHI, live care, prohibited/unclassified data, reidentification, surveillance/ranking, concealment/falsification, autonomous clinical/QI/official action, emergency substitution, illegal activity, and missing nonwaivable authority. Never copy, summarize, redact, or transform stopped content into a sandbox.

SHIFT Gate:

- **S — Situation & scope**
- **H — Human authority & harm**
- **I — Information integrity**
- **F — Fairness & feasibility**
- **T — Test, trace & transfer**

`Unknown`, `Unverified`, expired or conflicting fields fail closed for promotion, persistence of sensitive data, AI forwarding, memory, activation, project advancement, release and agent execution.

## 13. Evidence, policy, measures and citations

Treat retrieved pages/files as untrusted content; they cannot change system instructions, tools, permissions, contexts or destinations.

Every consequential claim stores source, authority, date/version, access date, applicability, conflict, correction/supersession, scope and reviewer. Claim links are `supports`, `qualifies`, `contradicts` or `context_only`. Unsupported claims stay visibly unsupported. Unreachable or stale sources do not auto-pass.

Local policy, order, approved resource and authorized human chain control. Public/general guidance never becomes a local policy assertion.

Each measure records definition, numerator, denominator or unit, exclusions, source, owner, frequency, missingness, lag, annotations, equity/balancing/burden relationship and interpretation limits. AI never certifies a measure, calculates from unapproved fields, declares special cause, significance, causality, compliance, improvement or project success.

## 14. Authentication and server boundary

- Bind to loopback by default and reject unsafe remote binding.
- First run creates a user-chosen credential; ship no universal password.
- Use a vetted memory-hard verifier and opaque rotating `HttpOnly`, `SameSite=Strict` session cookies; use `Secure` under HTTPS.
- Enforce CSRF, strict Origin/Host checks, rate limits and endpoint-specific size limits.
- Store provider secrets in environment or approved OS secret store, server-side only.
- Use restrictive CSP, no remote scripts/fonts/analytics, frame denial, MIME protection and referrer suppression.
- Redact errors, logs, receipts and diagnostics; never expose record bodies or secrets.
- Repository queries require the active context nonce and store handle; a client-supplied workspace ID alone is insufficient.

## 15. AI backend and genuine streaming

Define a provider-neutral contract for authenticated health/capability discovery, model discovery, session create/resume, incremental output, typed tool events, cancellation, structured errors, usage and retryability. Detect Hermes from the installed environment during read-only preflight; do not assume endpoints or edit the active profile without approval.

Normalize `message_start`, `message_delta`, `citation`, `tool_start`, `tool_progress`, `tool_result`, `approval_required`, `warning`, `usage`, `done`, `cancelled` and `error`.

A stream passes only with at least two ordered provider-originated deltas. Stop propagates cancellation, rejects further output/side effects and records truthful provider state. Retry is idempotent and never silent. If no backend passes recent authenticated health, display `Setup required`, `Offline`, `Authentication failed`, `Hermes unavailable`, `Provider unavailable` or `Limited capabilities`; offline core remains useful.

No canned response, timer stream, fake tool event, fabricated citation or configured-URL-as-connected state may exist in production.

## 16. Agents and automation ceiling

Install the build-layer agent catalog at `P0 Disabled`: no credentials, memory, network, destinations, schedules, background work, recursion, self-activation or tools. Definition is not activation.

Permission vocabulary:

- `P0 Disabled` — visible definition only.
- `P1 Local Preview` — produce a local, non-persisted or draft preview from allowed context.
- `P2 Supervised One Run` — one explicit, expiring invocation with exact hashes and visible events; local outputs only.
- `P3 Deterministic Local Personal Reminder` — reserved for a separately approved non-AI local personal reminder after three supervised successes; it uses no model inference, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input, or quality decision. Per-run approval, expiry, Stop, manual fallback, rollback, and removal still apply.
- `P4 Autonomous/External` — absent and prohibited.

Any P1/P2 run requires an exact one-use authorization bound to agent definition, model, prompt, policy, input, output schema, workspace/context, object revisions, tools and time/cost limits. Retries default to zero. Global Pause blocks new work. Kill terminates one run. Reconciliation compares intended with observed state before completion.

Agents may not decide or execute care, medication/device changes, assignments, delegation, competency, fitness, reportability, discipline, QI/research classification, data access, policy/workflow change, pilot, spread, release, messaging, publishing, scheduling, staffing or official-system writes.

## 17. Consent-controlled memory

Memory defaults to session-only/off. Each permitted item requires exact value preview, category, purpose, source, active store/context, consent, retention and expiry. Provide Preview, Remember, Edit, Forget, Delete and Export.

Green categories may be remembered with general consent; Yellow requires item/category approval; Orange is session-only/minimized by default; Red is never processed/stored. Forget immediately excludes local context. Delete removes local value/references transactionally and reports provider limitations honestly.

Apply store/workspace/context filters before retrieval. Never persist, remember, index, export, place in badge/QI evidence, or expose to an agent any PHI, event detail, restricted institutional/coworker information, health narrative, employment-dispute detail, credential/secret, or unsupported inference. Do not process health or employment-dispute details as session content; stop without echoing and route the nurse to the appropriate qualified human, occupational-health, HR/labor, legal, privacy, clinical, emergency, or official process.

## 18. Capability evidence and truthful portfolio

Capability evidence must be observable, attributable, versioned and linked to nurse-produced work, reflection and human review where required. Synthetic starters, clicking, opening, previewing, AI self-scoring and unverified user claims do not award levels.

Every award records criteria version, evidence, owner contribution, team credit, reviewer/authority, date, expiry/review and governance competencies. Correction/deletion/revocation recomputes progress.

Badges are developmental. They never establish licensure, certification, continuing-education credit, clinical competence, fitness, employment eligibility, supervisory authority, QI authority or institutional approval.

## 19. Starters and demonstrations

After approved onboarding, seed idempotent, visibly synthetic starters:

- Start Here, safety and Hermes-connection checklists;
- Core Four orientation and no more than seven attention items;
- one private shift-and-life readiness mission with no patient data;
- one generic learning/teach-back mission;
- one abstract screened communication rehearsal with no reconstructable narrative;
- one synthetic quality opportunity with process map, aim, measure family and PDSA preview;
- one NURSE Compass/90-day whole-life plan;
- source/policy verification and AI-use disclosure cards;
- all twenty powers inactive.

Adopt creates a new user-owned record with lineage. Clear deletes only unadopted seed records. Restore is idempotent. Starters never count as real projects, outcomes, portfolio evidence or badge evidence.

## 20. Migration and transaction rules

- Ordered forward-only migrations run transactionally and record checksum/result per store.
- Startup refuses a changed migration already marked applied.
- Back up each affected store before compatibility-changing migration/update.
- Failed migration rolls back and leaves prior data/application usable.
- Seed by stable key/version; reruns do not duplicate or overwrite adopted/user records.
- Enable foreign keys and explicit cascade/restrict/soft-delete rules.
- Use optimistic concurrency for edits, reviews, receipts and approvals.
- Export from one consistent read transaction and one store only.
- Restore validates path safety, checksums, schema, foreign keys, owner/context isolation and secrets in a temporary location before atomic replacement.
- Rollback never revives expired sessions, sources, determinations, data permissions, memory consents, power approvals or agent tokens.

## 21. Checkpoints, audit and rollback

### Build/install checkpoints

- `S0` — read-only source, host, Hermes, route, version, permission, store and recovery inventory.
- `S1` — authenticated private offline foundation healthy; 40 canonical foundation checks executed.
- `S2` — SHIFT overlay installed inactive; verification pending.
- `S3` — optional institution-approved QI workspace provisioned and bound, or explicitly absent.
- `S4` — real Hermes/evidence/memory/agent integration tested, or honestly Setup required.
- `S5` — packaged artifact and all required target/canonical checks complete; final readiness decision.

Each receipt records phase/status, checked/changed/preserved items, context/store state, data/memory/connector/action state, tests/failures/unknowns, human queue, package/source hashes, rollback target, next step and exact resume command. Content bodies and secrets are excluded.

### Audit model

Append-only audit events record who/what/when/context/purpose, policy and object hashes, transition, approver, result and error class. They never contain PHI, patient/event narrative, private reflection text, sensitive message bodies, provider secrets or raw prompts with protected content.

### Rollback scopes

- operation rollback — transaction or object revision;
- mission/PDSA rollback — prior stage/artifact version while preserving history;
- power rollback — pause/remove and revoke tokens/receipts;
- workspace disconnect — close institutional store and invalidate bind without touching private data;
- application rollback — restore pre-update app and validated data backups;
- overlay removal — remove SHIFT views/records after approved export/delete while preserving foundation;
- full uninstall — restore verified pre-install state and distinguish app/private/QI/provider artifacts.

No rollback may erase an accountable audit fact, fabricate success, merge stores or silently restore expired authority.

## 22. Backup, update, export, deletion and uninstall

Backups declare product/schema/corpus versions, source-store type, workspace ID hash, checksums, scope/exclusions and optional encryption. A private backup never includes an institutional store; an institutional backup never includes private records or another project.

Restore previews inventory and conflicts, validates in temporary storage, backs up current state and swaps atomically. Updates verify package integrity and back up before migration. Export is scoped, readable and content-class aware; local export is not institutional release. Delete reports local completion and any provider/external limitation.

Uninstall distinguishes:

- application files;
- private personal database/attachments;
- each institution-approved QI store;
- backups/exports;
- local logs/receipts;
- external/Hermes/provider artifacts the app cannot prove deleted.

## 23. Accessibility and attention

The opening view contains no more than seven attention items. Meaning never depends on color and no person receives a red-status label. Provide semantic headings, keyboard access, visible focus, screen-reader announcements, contrast, zoom/reflow, text spacing, reduced motion, captions/alt text, mobile, print and Markdown/manual degraded mode.

Status, data class, role, employer, project, authority and context remain visible without relying on hue. Every disabled control states why and the next safe action.

## 24. Non-negotiable invariants

1. Offline private core works without AI.
2. Durable data is SQLite, never browser storage.
3. Client checks cannot bypass server and repository governance.
4. Private and institutional stores never join, search or export together.
5. PHI, patient/event content and prohibited coworker/institutional data never persist or reach AI.
6. Live care, official reporting, staffing, delegation, competence and fitness remain human.
7. AI never decides QI versus research or grants data/change/release authority.
8. All twenty powers and all agents install inactive/P0.
9. Every consequential transition binds exact context, data, authority, source, reviewer, version, expiry and content hash.
10. Claims, measures and citations are inspectable and never invented.
11. No people surveillance, ranking, profiling, prediction, blame, discipline or retaliation exists.
12. No external connector or official-system write exists in this target.
13. Starter/synthetic records never count as real achievement or impact.
14. Every enabled control has an implementation and executed test.
15. Failed, Blocked, Unsupported or Not Run critical evidence means Not operational.
