Publish DreamNet Whitepaper v0.2 and receipt-routing architecture

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 coverage/
+artifacts/ops/cerberus/
 .env
 .env.*
 !.env.example

README.md

@@ -104,11 +104,15 @@ if (!validateReceipt(receipt).valid) {
 - JSON Schemas
 
 See [Public and Private Boundaries](docs/BOUNDARIES.md) and
-[Architecture](docs/ARCHITECTURE.md).
+[Architecture](docs/ARCHITECTURE.md). The complete public model is in the
+[DreamNet Whitepaper](docs/WHITEPAPER.md).
 
 ## Ecosystem
 
 - [DreamLoops](https://github.com/BrandonDucar/dreamloops)
+- [GitGrid](https://github.com/BrandonDucar/dreamnet-git-grid)
+- [Cerberus](https://github.com/BrandonDucar/dreamnet-cerberus)
+- [Temporal Worker](https://github.com/BrandonDucar/dreamnet-temporal)
 - [ToolGym](https://github.com/BrandonDucar/toolgym)
 - [Memory Weaver](https://github.com/BrandonDucar/memory-weaver)
 - [Proof Drop](https://github.com/BrandonDucar/proof-drop-zabal)

docs/ARCHITECTURE.md

@@ -1,28 +1,69 @@
 # Architecture
 
-DreamNet Public Core defines the seam between an objective and verifiable work.
+DreamNet Public Core defines the contract between an objective, durable work,
+and independently inspectable evidence.
 
 ```text
-Objective
+Goal
   -> Assignment Envelope
   -> Capsule
-  -> DreamLoop runtime
-  -> Verification
+  -> DreamLoop
+  -> Specialist Work
+  -> Verification and Adaptive Quorum
+  -> Claim Factory
   -> Receipt
-  -> Claim
-  -> Proof Drop or durable memory
+  -> Security Receipt Router
+       | green  -> admit
+       | yellow -> quarantine and remediate
+       | red    -> isolate and open incident
+  -> GitGrid, Proof Drop, and approved memory
 ```
 
-The runtime is intentionally not prescribed. A compatible implementation can
-use a local process, OpenClaw, an agent framework, a durable workflow engine, a
-Cloudflare Worker, or another substrate.
+The runtime is intentionally replaceable. A compatible implementation may use a
+local process, OpenClaw, an agent framework, a Temporal worker, a Cloudflare
+Worker, or another substrate.
+
+## Planes
+
+### Contract plane
+
+Assignment, Capsule, DreamLoop state, Claim, Receipt, and Proof Drop structures
+remain portable across runtimes.
+
+### Execution plane
+
+Temporal or another durable engine owns task delivery, timers, retries, and
+workflow history. NUC, cloud, and edge workers execute bounded activities.
+
+### Evidence plane
+
+GitGrid repositories store approved events, claims, receipts, snapshots, and
+lineage. Large artifacts remain in approved object storage and are referenced by
+digest.
+
+### Projection plane
+
+PGLite, Neon, Graphiti, vector indexes, search, and caches provide fast reads.
+When the product permits, they are rebuildable projections rather than the only
+copy of organizational knowledge.
+
+### Security plane
+
+Cerberus scans an exact artifact before installation or execution. The Receipt
+Router converts its verdict into a durable admit, remediation, or incident
+branch.
 
 ## Invariants
 
 - Every meaningful job has one assignment ID.
-- Consequential effects use an idempotency key.
-- Critical assignments require approval.
+- Consequential effects use stable idempotency keys.
+- Critical assignments require explicit approval.
 - Successful receipts contain evidence.
-- Claims and receipts are different objects.
+- Claims and receipts remain different objects.
 - Runtime state is explicit and restart-safe.
+- Security receipts are bound to an exact digest or commit.
+- Missing, yellow, and red security receipts block execution.
+- Replayed receipts cannot duplicate consequential effects.
 - Private orchestration is not required to validate public artifacts.
+
+See [DreamNet Whitepaper](WHITEPAPER.md) for the complete public model.

docs/BOUNDARIES.md

@@ -15,6 +15,9 @@ adopt without access to DreamNet's private operating environment:
 - Canonical hashing helpers
 - Local validation
 - Public examples and schemas
+- GitGrid repository contracts and storage rules
+- Cerberus security-receipt formats and routing rules
+- Reference Temporal worker patterns
 
 ## Private Engine
 
@@ -36,7 +39,7 @@ public release by deleting a few known secrets from the private monorepo.
 
 Every extraction must pass:
 
-1. Secret and credential scan
+1. Cerberus scan bound to the exact source commit
 2. License and attribution review
 3. Dependency and vulnerability review
 4. Proprietary-boundary review

docs/RECEIPT_ROUTING.md

@@ -0,0 +1,44 @@
+# Receipt Routing
+
+The Receipt Router turns a content-bound security verdict into a durable workflow
+branch.
+
+| Verdict | Execution | Route |
+| --- | --- | --- |
+| Green | Allowed for the scanned digest | Admit |
+| Yellow | Blocked | Quarantine and remediate |
+| Red | Blocked | Isolate and open an incident |
+| Missing or unknown | Blocked | Fail closed |
+
+## Yellow
+
+Yellow stops installation and execution, preserves the artifact without running
+it, opens remediation work linked to each finding, expands the relevant
+specialist quorum, and requires a green receipt for a replacement commit.
+
+## Red
+
+Red aborts the assignment, isolates derived output, revokes temporary access,
+preserves logs and hashes, creates an incident Proof Drop, alerts the designated
+operator, and requires human approval before re-entry.
+
+## Idempotency
+
+The routing key is:
+
+```text
+receipt digest + policy version
+```
+
+Replaying a receipt returns its existing route decision. It must not create
+duplicate issues, alerts, revocations, Proof Drops, or external effects.
+
+## Re-entry
+
+An artifact re-enters only when:
+
+- remediation produced a new commit or digest,
+- the new artifact received a green receipt,
+- required reviews and approvals completed,
+- access is reissued with fresh scope,
+- the original yellow or red receipt remains preserved as lineage evidence.