# SHIFT Staff Nurse Life & Practice Mission Control — Hermes Final Handoff Report

> **Template status:** Reporting contract only. Replace every `TBD` with executed evidence or an explicit blocker. Remove instructions before release. Never include secrets, raw Soul/quiz/interview material, PHI, patient/event narrative, chart/handoff content, private reflection text, row-level quality data, restricted coworker/institutional content or sensitive message bodies.

## 1. Executive outcome

| Field | Final value |
|---|---|
| Product | SHIFT — Staff Nurse Life & Practice Mission Control |
| Product ID | staff-nurse-life-practice-mission-control |
| Canonical route / home | /staff-nurses/dashboard / My SHIFT Mission Control |
| Canonical complete program | NAIO-SNQI-COMPLETE-SHIFT-1.0 |
| Foundation / overlay | NAIO-SN-LPEF-1.0 / NAIO-SNQI-SHIFT-1.0 |
| Namespace / lane | snqi_shift.* / staff_nurse_life_practice |
| Released version | TBD |
| Release UTC | TBD |
| Package readiness | TBD — Operational / Core operational; AI setup pending / Not operational |
| Private offline-core gate | TBD — Passed / Failed / Blocked |
| Clinical/privacy/context gate | TBD — Passed / Failed / Blocked |
| Optional institutional-QI gate | Not provisioned / Passed for named approved fixture / Failed / Blocked |
| Real Hermes stream/cancel | TBD — Passed / Failed / Blocked / Not Run |
| Control completeness | TBD — 216/216 Passed or blocker summary |
| Full-stack scenarios | TBD — 48/48 Passed or blocker summary |
| Canonical compatibility | TBD — 176/176 Passed or blocker summary |
| Critical blockers remaining | TBD |

### Plain-language outcome

TBD — State what the nurse can safely do now, which context is installed, what still needs configuration/authorized-human review and what is blocked. Do not say operational, production-ready, secure, compliant, institutionally approved, clinically safe, quality-approved or competence-validating unless the exact narrow claim has executed evidence.

### Permanent user-facing boundary

TBD — Confirm the UI states that AI organizes, drafts, researches and rehearses; the nurse retains judgment/accountability; patient care and official reporting stay in approved systems; authorized humans own quality, data, policy, release and clinical decisions; private life data is never employer/QI analytics; and badges are not credentials, competence, fitness or authority.

## 2. Artifact identity and integrity

| Item | Value |
|---|---|
| Build-kit path/hash | TBD |
| Built application package path | TBD |
| Package filename/size/SHA-256 | TBD |
| Release manifest path/hash | TBD |
| Checksums path/hash | TBD |
| Source revision/tree hash | TBD |
| Canonical source hash verification | TBD |
| Database schema/migration range | TBD |
| Dependency lock path/hash | TBD |
| SBOM/dependency record | TBD |
| Signature | TBD / Not used |

Integrity results:

- manifest ↔ archive reconciliation: TBD
- path traversal, duplicate entry, absolute path, symlink and unsafe mode checks: TBD
- version consistency across UI/API/database/VERSION/manifest: TBD
- secret and prohibited-fixture scan: TBD
- independent build-kit/package validator command and result: TBD
- evidence path/hashes: TBD

## 3. Packaged versus installed truth

| State | Evidence/result |
|---|---|
| Build kit verified | TBD |
| Target application built | TBD |
| Final ZIP independently verified | TBD |
| Local application installed | TBD |
| Private database initialized | TBD |
| Hermes configured/authenticated | TBD |
| Real stream/cancel passed | TBD |
| Institution-approved QI workspace provisioned | No / Yes — exact approved workspace / TBD |
| All release tests executed | TBD |
| Operational status derived | TBD |

Do not collapse these states into “installed” or “working.”

## 4. Supported and targeted platforms

Use **Supported** only when the complete clean-machine suite passed for this exact package.

| Status | OS/version | Architecture | Runtime/browser | Clean install | Restart | Backup/restore | Update/rollback | Uninstall | Evidence |
|---|---|---|---|---|---|---|---|---|---|
| TBD | macOS TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
| TBD | Windows TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
| TBD | Linux TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |

Untested/unsupported limitations: TBD

## 5. Installation, launch and duration

### Prerequisites

- OS/architecture: TBD
- runtime/package manager/browser: TBD
- disk space: TBD
- local dependencies: TBD
- optional Hermes prerequisite/profile: TBD

### First installation

Exact launcher/command:

    TBD

Observed sequence:

1. package integrity and read-only host/Hermes preflight: TBD
2. loopback binding and local app directories: TBD
3. user-chosen credential/session: TBD
4. private database initialization/migrations: TBD
5. safety acknowledgment, role/hat/employer and Private Personal context: TBD
6. field-level personalization preview/apply: TBD
7. Core Four and synthetic starters; all twenty powers inactive: TBD
8. Hermes capability discovery without unapproved profile edit: TBD
9. diagnostics and setup completion: TBD

Duration:

- minimum / typical / maximum: TBD
- long-running steps and truthful progress signals: TBD
- no-background behavior and exact resume command: TBD

### Normal launch/stop/diagnostics

- launch: `TBD`
- local URL/interface/port: TBD
- stop: `TBD`
- diagnostics: `TBD`

## 6. Product identity and canonical preservation

| Requirement | Executed result/evidence |
|---|---|
| One Staff Nurse Life & Practice Command Center | TBD |
| Five foundation departments | TBD |
| NURSE Compass | TBD |
| Four role adapters and least privilege | TBD |
| Private and institution-approved contexts distinct | TBD |
| Core Four exact; fifth empty by default | TBD |
| Twenty exact powers Available inactive | TBD |
| Eighteen workflows and twenty-five templates | TBD |
| One EDENA model with independent `edena_tier` / `absolute_stop`, Trust Shield and SHIFT Gate | TBD |
| Canonical `snqi_shift.*` extension without duplicate foundation | TBD |
| Permanent privacy/recovery controls | TBD |

Deviations from immutable source, rationale, risk and affected checks: TBD / None

## 7. Role, employer and context isolation

### Active private context

| Field | Value |
|---|---|
| Authenticated owner safe ID | TBD |
| Role adapter / task hat | TBD |
| Employer or Personal/none | TBD |
| Authority status | TBD |
| Private store safe ID/hash/path | TBD |
| Data class ceiling | TBD |
| Memory mode | TBD |

### Institutional QI workspaces

List each separately; do not include project data bodies.

| Safe workspace ID | Organization/project safe label | Role/hat | Bind state/expiry | Human determination | Data/measure authority | Change/release authority | Store/hash | Result |
|---|---|---|---|---|---|---|---|---|
| TBD / None | TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |

Isolation evidence:

- separate database/store handles: TBD
- context nonce/cache reset: TBD
- cross-private/QI denial at API/repository/search/memory/AI/agent/export/backup: TBD
- cross-employer/project denial: TBD
- transfer of private records into institutional store: must be zero — TBD
- evidence paths/hashes: TBD

## 8. Local architecture and data

| Component | Implemented choice/version/evidence |
|---|---|
| Client | TBD |
| Loopback server | TBD |
| Authentication/session | TBD |
| Registry/private/QI stores | TBD |
| SQLite driver/version | TBD |
| Repository/transaction model | TBD |
| Migrations | TBD |
| Governance/admission engine | TBD |
| Evidence/retrieval | TBD |
| AIBackend/Hermes adapter | TBD |
| Agent coordinator | TBD |
| Structured memory | TBD |
| Recovery/update | TBD |

Data locations:

| Data class | Path/location | Protection | Backup inclusion |
|---|---|---|---|
| Application files | TBD | TBD | TBD |
| Registry | TBD | Opaque references/coarse state only | TBD |
| Private database/attachments | TBD | TBD | Private backup only |
| Each QI database/attachments | TBD | TBD | Its own authorized backup only |
| Logs/audit/checkpoints | TBD | Redacted/content-free | TBD |
| Secret references | TBD | No value in package/client | No values |
| Exports/backups | TBD | Scoped/labeled | N/A |

Confirm browser storage contains no durable record or secret: TBD

Deviations from `STAFF-Architecture-and-Data-Model.md`: TBD / None

## 9. Governance and prohibited-data proof

Canonical artifact lifecycle verified: `Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan → Authorized Execution → Completed Action → Evaluated Outcome`. `Approved Plan` is human scope review only; `Authorized Execution` is external human/official-system only with no app action; `Completed Action` requires a verified external reference.

| Gate | Result/evidence |
|---|---|
| EDENA `edena_tier` plus independent `absolute_stop`, including Personal and Institutional Red behavior | TBD |
| SHIFT Gate S/H/I/F/T | TBD |
| PHI/direct/quasi-identifier pre-persistence rejection | TBD |
| Zero body in DB/files/cache/log/export/backup/memory/AI | TBD |
| Live-care refusal and no-extra-detail route | TBD |
| Official event/reporting boundary | TBD |
| Assignment/delegation/competence/fitness ceiling | TBD |
| No surveillance/ranking/profiling/prediction | TBD |
| Threat/crisis/transport human routes | TBD |
| Untrusted-source prompt-injection defense | TBD |
| Canonical artifact states and external-only Authorized Execution / verified-reference Completed Action | TBD |
| No external/official write surface | TBD |

Unresolved human-verification items: TBD

## 10. Quality workspace authority

If no institutional workspace was provisioned, state `Not provisioned; synthetic preparation only` throughout.

| Required receipt/control | State, owner, version, expiry, evidence |
|---|---|
| Workspace provisioning/isolation | TBD |
| Sponsor, charter, scope, decision rights | TBD |
| QI/EBP/evaluation/research human determination | TBD |
| Data steward/privacy owner; exact separately approved aggregate created outside SHIFT; content hash; query/definition/version; provenance; approval/expiry | TBD |
| Measures, suppression and small-cell/subgroup rules; row/person/event/narrative rejection even when called deidentified | TBD |
| Clinical/operational change owners | TBD |
| Privacy/records/legal/release owners | TBD |
| Protected/paid capacity | TBD |
| Stop/fallback/rollback/removal | TBD |

Confirm AI never supplied or signed authority and any missing/changed receipt returned the project to Preview: TBD

## 11. Hermes and AI backend

| Field | Value |
|---|---|
| Safe profile identifier | TBD |
| Hermes version/address/start method | TBD |
| Authenticated health UTC/result | TBD |
| Capability/model discovery | TBD |
| Selected API surface/model and reason | TBD |
| Active profile edited | No / Yes after exact approved preview |
| Profile backup/diff/rollback | TBD / Not applicable |
| Optional compatible backend | TBD / Not configured |

Environment variable names only: TBD

Confirm no secret in client, browser, URL, log, diagnostics, export, evidence, package or VCS: TBD

### Real streamed response

| Field | Value |
|---|---|
| Test ID | INT-039 / TBD |
| Backend/model | TBD |
| Context/data class | TBD |
| Provider-originated deltas | TBD — at least two |
| Typed events | TBD |
| First delta / terminal UTC | TBD |
| Sanitized trace/hash | TBD |
| Result | TBD |

Confirm no timer/prewritten/post-hoc imitation: TBD

### Cancellation, retry and tools

| Check | Result/evidence |
|---|---|
| Slow stream and Stop propagation | TBD |
| Accepted deltas/side effects after Stop | TBD — both zero |
| Truthful terminal state | TBD |
| Idempotent explicit retry | TBD |
| Session create/resume isolation | TBD |
| Real tool-event visibility | TBD |
| Unknown tool blocked | TBD |

## 12. Powers, agents and memory

### Powers

- definition/source hashes: TBD
- exact count/title/order: TBD — must be 20
- initial states: TBD — all Available inactive
- active/previewed/paused/removed powers at handoff: TBD
- fifth launcher state: TBD
- lifecycle, expiry, rollback and no-self-activation evidence: TBD

### Agents

- catalog/hash: TBD
- all default P0: TBD
- route/charter/one-use token evidence: TBD
- P3 separately approved deterministic local personal reminder only after three supervised successful runs; no model, institutional/QI data, connector, external destination, monitoring, staffing/surveillance input or quality decision: TBD
- Pause All/Kill/reconciliation evidence: TBD
- P4/external/professional-authority surface absent: TBD
- supervised real run evidence or honest Not configured state: TBD

### Memory

- default/session-only state: TBD
- Preview/Remember/Edit/Forget/Delete/Export: TBD
- store/context/purpose/expiry enforcement: TBD
- prohibited-category rejection: TBD
- health narrative and employment-dispute detail absent from persistence/memory/index/export/badge/QI/agent context, with qualified-human route: TBD
- Hermes/provider deletion limitations shown: TBD

## 13. Evidence, measures and capability growth

| Area | Result/evidence |
|---|---|
| Source registry and real retrieval | TBD |
| Claim-source relationship/citation validator | TBD |
| Freshness/correction/conflict propagation | TBD |
| Local-policy precedence | TBD |
| Measure definition/provenance/missingness | TBD |
| Small-cell/reidentification controls | TBD |
| Anti-slop and honest outcomes/team credit | TBD |
| Capability criteria/evidence/reviewer | TBD |
| Synthetic/click/AI-self-score exclusion | TBD |
| Noncredential/nonauthority copy and export | TBD |

## 14. Backup, restore, update, rollback and removal

| Function | Exact command/UI | Executed result | Evidence |
|---|---|---|---|
| Scoped readable export | TBD | TBD | TBD |
| Owner-controlled private-only backup | TBD | TBD | TBD |
| One separately authorized QI-store-only backup | TBD / N/A | TBD | TBD |
| Restore preview and atomic swap | TBD | TBD | TBD |
| Update/prebackup/migration | TBD | TBD | TBD |
| Application rollback | TBD | TBD | TBD |
| Pause All | TBD | TBD | TBD |
| Safe Reset | TBD | TBD | TBD |
| SHIFT overlay removal | TBD | TBD | TBD |
| Full uninstall | TBD | TBD | TBD |
| Scoped local deletion | TBD | TBD | TBD |

Confirm rollback did not revive expired sessions, receipts, consents or agent tokens: TBD

## 15. Accessibility, Guide and degraded mode

| Requirement | Result/evidence |
|---|---|
| Keyboard and visible focus | TBD |
| Screen-reader semantics/status | TBD |
| Contrast and non-color meaning | TBD |
| Zoom/reflow/text spacing | TBD |
| Reduced motion | TBD |
| Accessible exports | TBD |
| Maximum-seven attention | TBD |
| Complete offline Guide/walkthrough | TBD |
| Markdown/manual degraded mode | TBD |

## 16. Test summary

| Suite | Passed | Failed | Blocked | Unsupported | Not Run | Total |
|---|---:|---:|---:|---:|---:|---:|
| Control-derived | TBD | TBD | TBD | TBD | TBD | 216 |
| Full-stack | TBD | TBD | TBD | TBD | TBD | 48 |
| Foundation canonical | TBD | TBD | TBD | TBD | TBD | 40 |
| SHIFT overlay canonical | TBD | TBD | TBD | TBD | TBD | 120 |
| Integration canonical | TBD | TBD | TBD | TBD | TBD | 16 |
| **Total** | TBD | TBD | TBD | TBD | TBD | **440** |

Critical failures/blockers with defect IDs, owners and retest plan: TBD

## 17. Final decisions and next safe action

| Decision | Value |
|---|---|
| Final readiness | TBD |
| Exact evidence supporting it | TBD |
| Known limitations | TBD |
| Unavailable controls/capabilities | TBD |
| Human approvals still required | TBD |
| Data/memory/connector/action state | TBD |
| Powers/agents active | TBD |
| Review/expiry dates | TBD |
| Next safe action | TBD |

### Final statement

TBD — Use only one:

- **Operational:** all applicable critical gates and 440 records Passed for the exact package and declared supported platform(s), with no critical blocker.
- **Core operational; AI setup pending:** offline core/governance/recovery/package Passed; AI is visibly unavailable solely because the owner has not configured it.
- **Not operational:** one or more required critical checks Failed, Blocked, Unsupported or Not Run.

### Owner handoff acknowledgment

- package and checksum received: TBD
- safe installation and restart demonstrated: TBD
- context separation understood: TBD
- no-PHI/live-care/event boundaries understood: TBD
- QI authority requirements understood: TBD
- Pause/Reset/Backup/Restore/Removal/Uninstall demonstrated: TBD
- limitations and next safe action accepted: TBD
- owner/release engineer/reviewer/date: TBD

**Operational:** All acceptance criteria passed, including a genuine end-to-end streamed response through the downloaded application.

**Core operational; AI setup pending:** All offline/core acceptance criteria passed, but a live configured backend was not available for the genuine-streaming acceptance test.

**Not operational:** One or more core acceptance criteria failed; list each blocker.
