# TEACH Mission Control — Baseline Gap Analysis

## Decision

The preserved Mission Control v2 application is a useful engineering baseline. The Nurse Educator foundation and TEACH corpus are the educator-domain authority. None of them, alone or together, is the completed target application.

Target status: `not_operational_build_required`.

Canonical identity:

- Complete program `NAIO-NEID-COMPLETE-TEACH-1.0`
- Foundation `NAIO-NE-LPEF-1.0`
- Overlay `NAIO-NEID-TEACH-1.0`
- Namespace `neid_teach.*`

The target is `TEACH — Nurse Educator & Instructional Designer Mission Control`, version `2.0.0`, at build-layer route `/nurse-educators-designers/dashboard`.

## What the source already specifies

- Three adapters: Nurse Educator, Instructional Designer, Hybrid or Faculty Developer
- Five foundation departments and NURSE Compass
- One educator Command Center and one EDENA model
- Five protected build workspaces
- Core Four plus empty fifth launcher
- 20 powers, all inactive
- 18 workflows, all Preview
- 24 numbered templates
- Nine foundation records, 11 foundation workflows, and five response formats
- Learner dignity, no-PHI, source/rights, accessibility, academic-integrity, clinical/simulation, release, and recovery boundaries
- 33 foundation + 120 overlay + 16 integration = 169 canonical checks

These are specifications. Their presence in Markdown does not prove runtime enforcement.

## Gap 1 — Functional local product

**Present:** a working generic baseline and detailed educator specifications.  
**Missing:** a completed educator-specific authenticated local UI/API and packaged release.  
**Required:** every styled control works end to end or is disabled with an exact reason; core use remains available without AI.

## Gap 2 — One Command Center and protected workspaces

**Present:** one-dashboard intent and domain sections.  
**Missing:** repository-enforced workspace scopes and active-hat context.  
**Required:** one Command Center with exactly these protected workspaces:

1. Life, Capacity & Career
2. Teaching, Learning Design & Accessibility
3. Assessment, Feedback & Learner Support
4. Clinical, Skills-Lab & Simulation
5. Curriculum, Program Evaluation, Scholarship & Faculty Development

Nested institution/program/course/faculty-development contexts do not create duplicate dashboards. A mission binds one adapter, task hat, workspace, purpose, authority state, and data ceiling.

## Gap 3 — Learner-data exclusion

**Present:** source privacy and student-record warnings.  
**Missing:** server-side admission rejection before persistence, logging, indexing, provider calls, agents, export, and backup.  
**Required:** reject learner/student identity, contact, submissions, grades, evaluations, feedback, advising, accommodations, conduct/integrity, clinical-performance records, recordings, secure assessments, and item-bank payloads. Removing names is not sufficient. Persist only a content-free boundary receipt.

## Gap 4 — Closed data classes

**Present:** prose Green/Yellow/Orange/Red information guidance.  
**Missing:** deterministic closed runtime classification.  
**Required:**

- `TEACH-DATA-0` — public
- `TEACH-DATA-1` — synthetic
- `TEACH-DATA-2` — owner-controlled nonsensitive private
- `TEACH-DATA-M` — minimum institutional routing metadata only
- `TEACH-DATA-C` — exact approved non-person course/curriculum content
- `TEACH-DATA-A` — exact approved aggregate created outside TEACH
- `TEACH-DATA-R` — opaque official-system reference only
- `TEACH-DATA-X` — prohibited or unclassified

The shipped personal workspace admits only 0, 1, and screened 2. C, A, M, and R require a separately provisioned purpose-bound institutional workspace. X is rejected.

## Gap 5 — No-PHI and clinical separation

**Present:** synthetic-only clinical and simulation intent.  
**Missing:** pre-persistence/pre-provider no-PHI guard and negative tests across every ingress.  
**Required:** reject patient identifiers, narratives, chart/handoff material, recordings, rare combinations, event details, and live-care questions without echo. The app never assesses, diagnoses, treats, gives patient-specific direction, determines competence, or substitutes for emergency/clinical routes.

## Gap 6 — Durable offline work management

**Present:** dashboard cards and workflow descriptions.  
**Missing:** complete durable CRUD and state relationships.  
**Required:** create, view, edit, archive, restore, delete, search, filter, sort, reopen, branch, export, import, and evaluate missions, projects, tasks, notes, sources, measures, artifacts, decisions, and approvals without AI.

## Gap 7 — Database and migrations

**Present:** prose record shapes.  
**Missing:** server-owned schema, foreign keys, transactions, migration journal, checksum, backup-before-migration, stable data paths, and integrity checks.  
**Required:** durable local storage; browser storage limited to non-secret ephemeral preferences; migrations execute exactly once and fail closed.

## Gap 8 — Authentication and local security

**Present:** assumed private authenticated workspace.  
**Missing:** owner setup, memory-hard verifier, session rotation/expiry/revocation, CSRF and Origin/Host defenses, loopback-only binding, rate/size limits, secure headers, and server-only secrets.  
**Required:** no default credential, no public binding, and no secret in client assets, browser storage, URL, log, export, diagnostics, evidence, or package.

## Gap 9 — Mission loop and artifact truth

**Present:** NURSE Compass, TEACH Gate, and review concepts.  
**Missing:** durable five-stage cycles, history, invalidation, branch/reopen, and separate artifact/review states.  
**Required:** Assess → Diagnose/Define → Plan → Implement → Evaluate plus exact lifecycle:

`Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan → Authorized Execution → Completed Action → Evaluated Outcome`

Approved Plan is scope review only. Authorized Execution is external human/official-system only, with no app action. Completed Action requires a verified external reference. Awaiting evidence/accessibility/clinical/faculty/institutional review remains a separate state dimension.

## Gap 10 — Role and authority enforcement

**Present:** three clear role adapters.  
**Missing:** request-level active-hat, scope, owner, institution/program/course, and authority enforcement.  
**Required:** title, file access, technical capability, profile, or committee membership never grants authority. Switching role/hat/context/source/audience invalidates incompatible approvals and routing.

## Gap 11 — Core Four and TEACH catalogs

**Present:** exact titles and source behavior.  
**Missing:** executable launchers, catalog registry, state records, exact activation cards, expiry, pause/remove, and rollback.  
**Required:** Core Four exact, fifth empty, 20 powers `Available Inactive`, 18 workflows `Preview Only`, and 24 numbered templates with source-title traceability.

## Gap 12 — Teaching, design, and accessibility workflow

**Present:** outcome alignment, learner variability, active learning, modality, cognitive load, accessibility, and inclusion requirements.  
**Missing:** working artifact forms, source/rights gates, accessibility tests, review queues, and release blocking.  
**Required:** semantic structure, keyboard, screen reader, captions/transcripts, alt text, contrast, zoom/reflow, non-color status, plain language, mobile, print, and accessible-alternative evidence before release.

## Gap 13 — Assessment, feedback, and learner support

**Present:** human grading, criterion evidence, fairness, due process, and no-inference safeguards.  
**Missing:** safe synthetic/generic assessment tools that cannot ingest learner payloads or release decisions.  
**Required:** design and rehearsal only in the shipped personal app. No final grade, evaluation, progression, discipline, accommodation, integrity finding, clinical clearance, prediction, ranking, profiling, or detector-as-proof.

## Gap 14 — Clinical, skills-lab, and simulation

**Present:** synthetic cases, prebriefs, objectives, stop criteria, equipment, facilitation, debriefing, and faculty release.  
**Missing:** enforceable synthetic-only mode, clinical-source verification, human release, recording/media controls, and failure paths.  
**Required:** no real patient or learner-performance data; humans own psychological safety, facilitation, debriefing, competence judgment, and learner use.

## Gap 15 — Curriculum, program evaluation, and aggregate evidence

**Present:** versioned maps and approved aggregate sensemaking.  
**Missing:** a purpose-bound institutional gate and exact object receipts.  
**Required:** personal mode uses public/synthetic framing only. A future institutional workspace may accept `TEACH-DATA-C` or `TEACH-DATA-A` created and separately approved outside TEACH with source, exact definition/query/version, denominator, missingness, provenance, suppression/small-cell rule, approval, expiry, content hash, reviewer, and release owner. No person/row/submission/event/narrative data.

## Gap 16 — Evidence, sources, rights, and citations

**Present:** source registry, copyright, OER, provenance, authorship, and uncertainty rules.  
**Missing:** retrieval adapter, claim-source links, freshness/correction state, citation validation, rights ledger, applicability, reproducible query, and prompt-injection quarantine.  
**Required:** no fabricated/unopened/irrelevant citation, no source laundering, no AI declaration of fair use or legal sufficiency, and no missing evidence converted into assurance.

## Gap 17 — EDENA and TEACH enforcement

**Present:** EDENA tiers and TEACH Gate language.  
**Missing:** deterministic server policy and independent stop state.  
**Required:** EDENA means Educator Decision, Evidence, Nursing-safety, and Authority. Persist independent `edena_tier` and `absolute_stop`. Source Red prohibitions are absolute stops. A non-absolute Personal Red may start only a new clean generic/synthetic sandbox; institutional Red blocks progression; stopped content is never transformed.

## Gap 18 — Real backend streaming

**Present:** prompts addressed to Hermes.  
**Missing:** authenticated capability discovery, normalized provider interface, genuine delta streaming, sessions, cancellation propagation, typed tool events, terminal states, bounded retries, and honest errors.  
**Required:** no canned response, timer stream, fake citation, fake tool event, or simulated connection. Offline/core functions continue when AI is unavailable.

## Gap 19 — Agents and automation

**Present:** preview-first, human-controlled intent.  
**Missing:** frozen 10-agent registry, routing explanation, one-run charter, least-privilege tools, resource limits, live events, Stop/Kill, receipt, and reconciliation.  
**Required:** P0 default; P1/P2 exact one-run support only; P3 deterministic local personal reminder only after three supervised runs, with no model, learner/institutional data, connector, external destination, monitoring, or consequential decision; P4 absent.

## Gap 20 — Personalization and memory

**Present:** activation questions and whole-person goals.  
**Missing:** versioned field provenance, inference/uncertainty, preview/edit/reject/approve, consent, purpose, scope, expiry, inspect, forget, export, and deletion.  
**Required:** never persist raw quiz answers or raw `SOUL.md`. Learner/patient/secure/confidential/prohibited data and unsupported authority inferences never enter memory.

## Gap 21 — Capability and badge evidence

**Present:** eight developmental AI Literacy Passport domains and non-credential warning.  
**Missing:** four-level criteria, evidence eligibility, named review, provenance, correction, expiry, revocation, and next-challenge logic.  
**Required:** observable evaluated work only; no clicks, time, synthetic Starters, AI praise, private-life detail, learner data, or fabricated outcomes. Badges unlock nothing and are not credentials, competence, qualification, credit, authority, or employment evidence.

## Gap 22 — Recovery and lifecycle operations

**Present:** Pause, reset, overlay removal, rollback, and uninstall instructions.  
**Missing:** tested transactional backup/restore, scoped export/import, update/migration rollback, deletion reconciliation, overlay removal, path-safe uninstall, and retained-copy disclosure.  
**Required:** owner-controlled private backups remain private-only; each institutional backup contains one separately authorized store; no cross-context backup.

## Gap 23 — Packaging, platform, and supply chain

**Present:** document distributions and a generic baseline archive.  
**Missing:** reproducible target build, locked dependencies, SBOM/license record, `.env.example`, migrations, launch/stop/diagnostic helpers, safe archive checks, secret scan, release manifest/checksums, and clean-machine results.  
**Required:** label a platform Supported only after the exact final artifact passes complete clean-install, restart, backup/restore, update/rollback, and uninstall testing there.

## Gap 24 — Acceptance evidence and readiness

All execution records begin `Not Run`:

- 216 build-layer controls
- 48 cross-cutting scenarios
- 33 foundation checks
- 120 TEACH overlay tests
- 16 Complete Edition integration checks
- **433 total**

Source presence, generated tests, skipped tests, mocked behavior, and documentation do not count as Passed. Operational requires every applicable core criterion plus a genuine configured backend stream and cancellation through the packaged UI. If offline/core passes but a live backend was unavailable, use `Core operational; AI setup pending`. Otherwise use `Not operational` and list every blocker.

## Release recommendation

Proceed only as a copy-on-write Hermes implementation. Preserve immutable sources, implement the learner-data and no-PHI guards first, prove the offline core and workspace isolation before AI, keep all powers/workflows/agents inactive or Preview by default, and require an independent clean extraction and verifier run before delivering the versioned ZIP.
