From 635b26c330e74b5692a97381d3aec9ea9bd74b77 Mon Sep 17 00:00:00 2001 From: Brandon Ducar Date: Mon, 27 Jul 2026 21:55:26 -0400 Subject: [PATCH] docs: establish credentialed claim economy --- README.md | 8 +++-- docs/ARCHITECTURE.md | 36 +++++++++++++++++---- docs/RECEIPT_ROUTING.md | 11 ++++++- docs/WHITEPAPER.md | 71 +++++++++++++++++++++++++++++++++-------- 4 files changed, 103 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 89fc980..6efee09 100644 --- a/README.md +++ b/README.md @@ -19,9 +19,10 @@ Goal -> Assignment -> Capsule -> Work - -> Verification - -> Receipt - -> Claim + -> Producing Claim Factory + -> Independent Verification Factory + -> Promotion Gate + -> Claim + Receipts ``` The runtime can change. The evidence contract remains inspectable. @@ -113,6 +114,7 @@ See [Public and Private Boundaries](docs/BOUNDARIES.md) and - [GitGrid](https://github.com/BrandonDucar/dreamnet-git-grid) - [Cerberus](https://github.com/BrandonDucar/dreamnet-cerberus) - [Temporal Worker](https://github.com/BrandonDucar/dreamnet-temporal) +- [Claim Factory](https://github.com/BrandonDucar/dreamnet-claim-factory) - [ToolGym](https://github.com/BrandonDucar/toolgym) - [Memory Weaver](https://github.com/BrandonDucar/memory-weaver) - [Proof Drop](https://github.com/BrandonDucar/proof-drop-zabal) diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index f8c8205..5318bc9 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -10,15 +10,21 @@ Goal -> DreamLoop -> Specialist Work -> Verification and Adaptive Quorum - -> Claim Factory - -> Receipt + -> Producing Claim Factory (credentialed workers) + -> Independent Verification Factory + -> Deterministic Promotion Gate -> Security Receipt Router | green -> admit | yellow -> quarantine and remediate + | orange -> human-led escalation | red -> isolate and open incident - -> GitGrid, Proof Drop, and approved memory + -> Claim Registry, GitGrid, Proof Drop, and approved memory ``` +Receipts are emitted across the lifecycle rather than appearing only at the end. +They bind each factory run, verification attempt, promotion decision, and +security route to its evidence and policy version. + The runtime is intentionally replaceable. A compatible implementation may use a local process, OpenClaw, an agent framework, a Temporal worker, a Cloudflare Worker, or another substrate. @@ -41,6 +47,20 @@ GitGrid repositories store approved events, claims, receipts, snapshots, and lineage. Large artifacts remain in approved object storage and are referenced by digest. +### Workforce plane + +Agent University teaches bounded roles. ToolGym provides practical exams, the +Security Gauntlet tests adverse conditions, and signed credentials grant a +worker one role in one factory or Claim City scope. Graduation never grants +blanket authority. + +### Claim economy plane + +Producing Claim Factories draft evidence-backed claims. Separately chartered +Verification Factories reproduce and falsify them. Claim Cities coordinate +multiple factories inside one domain without becoming a universal truth +authority. + ### Projection plane PGLite, Neon, Graphiti, vector indexes, search, and caches provide fast reads. @@ -50,8 +70,8 @@ copy of organizational knowledge. ### Security plane Cerberus scans an exact artifact before installation or execution. The Receipt -Router converts its verdict into a durable admit, remediation, or incident -branch. +Router converts its verdict into a durable admit, remediation, escalation, or +incident branch. ## Invariants @@ -60,9 +80,13 @@ branch. - Critical assignments require explicit approval. - Successful receipts contain evidence. - Claims and receipts remain different objects. +- A producing Claim Factory cannot verify or promote its own claim. +- Producer and verifier runs cannot share workers when independence is required. +- Factory workers require current, scoped University credentials. +- Claim Cities route work but do not silently promote claims. - Runtime state is explicit and restart-safe. - Security receipts are bound to an exact digest or commit. -- Missing, yellow, and red security receipts block execution. +- Missing, yellow, orange, and red security receipts block execution. - Replayed receipts cannot duplicate consequential effects. - Private orchestration is not required to validate public artifacts. diff --git a/docs/RECEIPT_ROUTING.md b/docs/RECEIPT_ROUTING.md index f3b3da4..cf25f79 100644 --- a/docs/RECEIPT_ROUTING.md +++ b/docs/RECEIPT_ROUTING.md @@ -7,6 +7,7 @@ branch. | --- | --- | --- | | Green | Allowed for the scanned digest | Admit | | Yellow | Blocked | Quarantine and remediate | +| Orange | Blocked | Human-led escalation | | Red | Blocked | Isolate and open an incident | | Missing or unknown | Blocked | Fail closed | @@ -16,6 +17,13 @@ Yellow stops installation and execution, preserves the artifact without running it, opens remediation work linked to each finding, expands the relevant specialist quorum, and requires a green receipt for a replacement commit. +## Orange + +Orange stops installation and execution, preserves the exact artifact and +receipt, expands review to a human-led specialist quorum, and opens a Proof Drop +for the contested evidence. It is used when risk is too high for routine +remediation but the evidence does not yet require full incident containment. + ## Red Red aborts the assignment, isolates derived output, revokes temporary access, @@ -41,4 +49,5 @@ An artifact re-enters only when: - the new artifact received a green receipt, - required reviews and approvals completed, - access is reissued with fresh scope, -- the original yellow or red receipt remains preserved as lineage evidence. +- the original yellow, orange, or red receipt remains preserved as lineage + evidence. diff --git a/docs/WHITEPAPER.md b/docs/WHITEPAPER.md index 971c3a8..5fa5040 100644 --- a/docs/WHITEPAPER.md +++ b/docs/WHITEPAPER.md @@ -61,8 +61,9 @@ human. ### Unsafe states change the workflow -A yellow or red security receipt is not a warning attached to otherwise normal -execution. It routes the assignment into remediation or incident handling. +A yellow, orange, or red security receipt is not a warning attached to otherwise +normal execution. It routes the assignment into remediation, human-led +escalation, or incident handling. ## 3. Public Operating Model @@ -73,13 +74,17 @@ Goal -> DreamLoop -> Specialist Work -> Verification and Adaptive Quorum - -> Claim Factory - -> Receipt + -> Producing Claim Factory + -> Independent Verification Factory + -> Deterministic Promotion Gate -> Security Receipt Router - -> GitGrid and Proof Drop + -> Claim Registry, GitGrid, and Proof Drop -> Rebuildable Memory Projections ``` +Receipts bind every meaningful transition in this lifecycle. They are not a +single report added after the claim already exists. + ### Assignment Envelope The Assignment Envelope gives one identity to the objective, acceptance @@ -105,9 +110,40 @@ reviewers may receive different objectives. Disagreement expands the review. ### Claim Factory -The Claim Factory extracts atomic, durable statements from completed work. Each -claim records its evidence, confidence basis, dependencies, contradictions, and -status. It does not erase disputed claims; it preserves their lineage. +Claim Factories are staffed organizations, not prompt templates. A producing +factory uses credentialed workers to extract atomic, durable statements from +completed work and bind evidence, source spans, dependencies, contradictions, +and lineage. + +A producing factory never certifies its own output. A separately chartered +Verification Factory receives the immutable claim digest, independently +reproduces or falsifies the evidence, and emits a support, challenge, or +inconclusive report. Policy rejects shared factory identity, disallowed worker +overlap, and required model or retrieval lineage overlap. + +Only a deterministic promotion gate can move the claim to a verified state. +Disputed claims remain visible, and consequential domains retain human approval. + +### Factory Workers and Agent University + +Agents earn factory jobs through Agent University coursework, ToolGym practical +exams, and the Security Gauntlet. A credential binds one identity to one role, +policy version, scope, expiry, and competency receipts. Factories validate that +credential at every run. + +Factory failures become new lessons, fixtures, remedial courses, recertification +requirements, or revocations. The University is therefore the workforce and +learning engine beneath the Claim Economy, not a side project. + +### Claim Cities + +A Claim City coordinates several producer factories, independent verifier +factories, a claim registry, retraction work, Proof Drops, policies, budgets, +and credentialed labor inside one domain. It routes work but does not become +another truth authority. + +Cross-domain federation transports portable claim envelopes and negotiates +schema versions while preserving each city's local promotion authority. ### Receipt @@ -127,6 +163,7 @@ DreamNet uses fail-closed receipt routing: | --- | --- | --- | | Green | Allowed for the scanned digest | Admit | | Yellow | Blocked | Quarantine and remediate | +| Orange | Blocked | Human-led escalation | | Red | Blocked | Isolate and open an incident | | Missing or unknown | Blocked | Treat as unverifiable | @@ -135,6 +172,9 @@ Green applies only to the exact scanned commit or artifact digest. Yellow creates linked remediation work, expands the relevant specialist quorum, and requires a new scan of the replacement artifact. +Orange preserves the artifact and evidence, expands to human-led specialist +review, and creates an escalation Proof Drop without granting execution. + Red aborts execution, isolates derived output, revokes temporary access, preserves evidence, produces an incident Proof Drop, and requires human approval before a newly scanned artifact may re-enter. @@ -223,6 +263,8 @@ The system can preserve: Agent University and ToolGym can use those records to grant bounded capabilities based on reproducible performance rather than self-description. +Claim Factory failures feed back into University curriculum, practical exams, +credential expiry, and recertification. ## 9. Human Authority @@ -263,11 +305,13 @@ bounded, durable, inspectable, and portable. 1. Stabilize Assignment, Capsule, Receipt, and Claim schemas. 2. Publish the Receipt Router contract and conformance vectors. -3. Connect Cerberus receipts to durable remediation and incident workflows. -4. Add GitGrid adapters for approved claims, receipts, and Proof Drops. -5. Publish ToolGym competency fixtures and independently replayable receipts. -6. Add reference Temporal workers for bounded research and verification. -7. Expand interoperability examples across local, cloud, and edge runtimes. +3. Connect Cerberus receipts to durable remediation, escalation, and incident + workflows. +4. Stabilize credentialed worker, independent factory, and Claim City contracts. +5. Add GitGrid adapters for approved claims, receipts, and Proof Drops. +6. Publish ToolGym competency fixtures and independently replayable receipts. +7. Add reference Temporal workers for bounded research and verification. +8. Expand interoperability examples across local, cloud, and edge runtimes. ## 13. Current Public Repositories @@ -276,6 +320,7 @@ bounded, durable, inspectable, and portable. - [DreamNet GitGrid](https://github.com/BrandonDucar/dreamnet-git-grid) - [DreamNet Cerberus](https://github.com/BrandonDucar/dreamnet-cerberus) - [DreamNet Temporal](https://github.com/BrandonDucar/dreamnet-temporal) +- [DreamNet Claim Factory](https://github.com/BrandonDucar/dreamnet-claim-factory) - [ToolGym](https://github.com/BrandonDucar/toolgym) - [Memory Weaver](https://github.com/BrandonDucar/memory-weaver) - [Proof Drop](https://github.com/BrandonDucar/proof-drop-zabal)