docs: establish the credentialed Claim Economy

README.md

@@ -19,9 +19,10 @@ Goal
   -> Assignment
   -> Capsule
   -> Work
-  -> Verification
-  -> Receipt
-  -> Claim
+  -> Producing Claim Factory
+  -> Independent Verification Factory
+  -> Promotion Gate
+  -> Claim + Receipts
 ```
 
 The runtime can change. The evidence contract remains inspectable.
@@ -113,6 +114,7 @@ See [Public and Private Boundaries](docs/BOUNDARIES.md) and
 - [GitGrid](https://github.com/BrandonDucar/dreamnet-git-grid)
 - [Cerberus](https://github.com/BrandonDucar/dreamnet-cerberus)
 - [Temporal Worker](https://github.com/BrandonDucar/dreamnet-temporal)
+- [Claim Factory](https://github.com/BrandonDucar/dreamnet-claim-factory)
 - [ToolGym](https://github.com/BrandonDucar/toolgym)
 - [Memory Weaver](https://github.com/BrandonDucar/memory-weaver)
 - [Proof Drop](https://github.com/BrandonDucar/proof-drop-zabal)

docs/ARCHITECTURE.md

@@ -10,15 +10,21 @@ Goal
   -> DreamLoop
   -> Specialist Work
   -> Verification and Adaptive Quorum
-  -> Claim Factory
-  -> Receipt
+  -> Producing Claim Factory (credentialed workers)
+  -> Independent Verification Factory
+  -> Deterministic Promotion Gate
   -> Security Receipt Router
        | green  -> admit
        | yellow -> quarantine and remediate
+       | orange -> human-led escalation
        | red    -> isolate and open incident
-  -> GitGrid, Proof Drop, and approved memory
+  -> Claim Registry, GitGrid, Proof Drop, and approved memory
 ```
 
+Receipts are emitted across the lifecycle rather than appearing only at the end.
+They bind each factory run, verification attempt, promotion decision, and
+security route to its evidence and policy version.
+
 The runtime is intentionally replaceable. A compatible implementation may use a
 local process, OpenClaw, an agent framework, a Temporal worker, a Cloudflare
 Worker, or another substrate.
@@ -41,6 +47,20 @@ GitGrid repositories store approved events, claims, receipts, snapshots, and
 lineage. Large artifacts remain in approved object storage and are referenced by
 digest.
 
+### Workforce plane
+
+Agent University teaches bounded roles. ToolGym provides practical exams, the
+Security Gauntlet tests adverse conditions, and signed credentials grant a
+worker one role in one factory or Claim City scope. Graduation never grants
+blanket authority.
+
+### Claim economy plane
+
+Producing Claim Factories draft evidence-backed claims. Separately chartered
+Verification Factories reproduce and falsify them. Claim Cities coordinate
+multiple factories inside one domain without becoming a universal truth
+authority.
+
 ### Projection plane
 
 PGLite, Neon, Graphiti, vector indexes, search, and caches provide fast reads.
@@ -50,8 +70,8 @@ copy of organizational knowledge.
 ### Security plane
 
 Cerberus scans an exact artifact before installation or execution. The Receipt
-Router converts its verdict into a durable admit, remediation, or incident
-branch.
+Router converts its verdict into a durable admit, remediation, escalation, or
+incident branch.
 
 ## Invariants
 
@@ -60,9 +80,13 @@ branch.
 - Critical assignments require explicit approval.
 - Successful receipts contain evidence.
 - Claims and receipts remain different objects.
+- A producing Claim Factory cannot verify or promote its own claim.
+- Producer and verifier runs cannot share workers when independence is required.
+- Factory workers require current, scoped University credentials.
+- Claim Cities route work but do not silently promote claims.
 - Runtime state is explicit and restart-safe.
 - Security receipts are bound to an exact digest or commit.
-- Missing, yellow, and red security receipts block execution.
+- Missing, yellow, orange, and red security receipts block execution.
 - Replayed receipts cannot duplicate consequential effects.
 - Private orchestration is not required to validate public artifacts.
 

docs/RECEIPT_ROUTING.md

@@ -7,6 +7,7 @@ branch.
 | --- | --- | --- |
 | Green | Allowed for the scanned digest | Admit |
 | Yellow | Blocked | Quarantine and remediate |
+| Orange | Blocked | Human-led escalation |
 | Red | Blocked | Isolate and open an incident |
 | Missing or unknown | Blocked | Fail closed |
 
@@ -16,6 +17,13 @@ Yellow stops installation and execution, preserves the artifact without running
 it, opens remediation work linked to each finding, expands the relevant
 specialist quorum, and requires a green receipt for a replacement commit.
 
+## Orange
+
+Orange stops installation and execution, preserves the exact artifact and
+receipt, expands review to a human-led specialist quorum, and opens a Proof Drop
+for the contested evidence. It is used when risk is too high for routine
+remediation but the evidence does not yet require full incident containment.
+
 ## Red
 
 Red aborts the assignment, isolates derived output, revokes temporary access,
@@ -41,4 +49,5 @@ An artifact re-enters only when:
 - the new artifact received a green receipt,
 - required reviews and approvals completed,
 - access is reissued with fresh scope,
-- the original yellow or red receipt remains preserved as lineage evidence.
+- the original yellow, orange, or red receipt remains preserved as lineage
+  evidence.

docs/WHITEPAPER.md

@@ -61,8 +61,9 @@ human.
 
 ### Unsafe states change the workflow
 
-A yellow or red security receipt is not a warning attached to otherwise normal
-execution. It routes the assignment into remediation or incident handling.
+A yellow, orange, or red security receipt is not a warning attached to otherwise
+normal execution. It routes the assignment into remediation, human-led
+escalation, or incident handling.
 
 ## 3. Public Operating Model
 
@@ -73,13 +74,17 @@ Goal
   -> DreamLoop
   -> Specialist Work
   -> Verification and Adaptive Quorum
-  -> Claim Factory
-  -> Receipt
+  -> Producing Claim Factory
+  -> Independent Verification Factory
+  -> Deterministic Promotion Gate
   -> Security Receipt Router
-  -> GitGrid and Proof Drop
+  -> Claim Registry, GitGrid, and Proof Drop
   -> Rebuildable Memory Projections
 ```
 
+Receipts bind every meaningful transition in this lifecycle. They are not a
+single report added after the claim already exists.
+
 ### Assignment Envelope
 
 The Assignment Envelope gives one identity to the objective, acceptance
@@ -105,9 +110,40 @@ reviewers may receive different objectives. Disagreement expands the review.
 
 ### Claim Factory
 
-The Claim Factory extracts atomic, durable statements from completed work. Each
-claim records its evidence, confidence basis, dependencies, contradictions, and
-status. It does not erase disputed claims; it preserves their lineage.
+Claim Factories are staffed organizations, not prompt templates. A producing
+factory uses credentialed workers to extract atomic, durable statements from
+completed work and bind evidence, source spans, dependencies, contradictions,
+and lineage.
+
+A producing factory never certifies its own output. A separately chartered
+Verification Factory receives the immutable claim digest, independently
+reproduces or falsifies the evidence, and emits a support, challenge, or
+inconclusive report. Policy rejects shared factory identity, disallowed worker
+overlap, and required model or retrieval lineage overlap.
+
+Only a deterministic promotion gate can move the claim to a verified state.
+Disputed claims remain visible, and consequential domains retain human approval.
+
+### Factory Workers and Agent University
+
+Agents earn factory jobs through Agent University coursework, ToolGym practical
+exams, and the Security Gauntlet. A credential binds one identity to one role,
+policy version, scope, expiry, and competency receipts. Factories validate that
+credential at every run.
+
+Factory failures become new lessons, fixtures, remedial courses, recertification
+requirements, or revocations. The University is therefore the workforce and
+learning engine beneath the Claim Economy, not a side project.
+
+### Claim Cities
+
+A Claim City coordinates several producer factories, independent verifier
+factories, a claim registry, retraction work, Proof Drops, policies, budgets,
+and credentialed labor inside one domain. It routes work but does not become
+another truth authority.
+
+Cross-domain federation transports portable claim envelopes and negotiates
+schema versions while preserving each city's local promotion authority.
 
 ### Receipt
 
@@ -127,6 +163,7 @@ DreamNet uses fail-closed receipt routing:
 | --- | --- | --- |
 | Green | Allowed for the scanned digest | Admit |
 | Yellow | Blocked | Quarantine and remediate |
+| Orange | Blocked | Human-led escalation |
 | Red | Blocked | Isolate and open an incident |
 | Missing or unknown | Blocked | Treat as unverifiable |
 
@@ -135,6 +172,9 @@ Green applies only to the exact scanned commit or artifact digest.
 Yellow creates linked remediation work, expands the relevant specialist quorum,
 and requires a new scan of the replacement artifact.
 
+Orange preserves the artifact and evidence, expands to human-led specialist
+review, and creates an escalation Proof Drop without granting execution.
+
 Red aborts execution, isolates derived output, revokes temporary access,
 preserves evidence, produces an incident Proof Drop, and requires human approval
 before a newly scanned artifact may re-enter.
@@ -223,6 +263,8 @@ The system can preserve:
 
 Agent University and ToolGym can use those records to grant bounded
 capabilities based on reproducible performance rather than self-description.
+Claim Factory failures feed back into University curriculum, practical exams,
+credential expiry, and recertification.
 
 ## 9. Human Authority
 
@@ -263,11 +305,13 @@ bounded, durable, inspectable, and portable.
 
 1. Stabilize Assignment, Capsule, Receipt, and Claim schemas.
 2. Publish the Receipt Router contract and conformance vectors.
-3. Connect Cerberus receipts to durable remediation and incident workflows.
-4. Add GitGrid adapters for approved claims, receipts, and Proof Drops.
-5. Publish ToolGym competency fixtures and independently replayable receipts.
-6. Add reference Temporal workers for bounded research and verification.
-7. Expand interoperability examples across local, cloud, and edge runtimes.
+3. Connect Cerberus receipts to durable remediation, escalation, and incident
+   workflows.
+4. Stabilize credentialed worker, independent factory, and Claim City contracts.
+5. Add GitGrid adapters for approved claims, receipts, and Proof Drops.
+6. Publish ToolGym competency fixtures and independently replayable receipts.
+7. Add reference Temporal workers for bounded research and verification.
+8. Expand interoperability examples across local, cloud, and edge runtimes.
 
 ## 13. Current Public Repositories
 
@@ -276,6 +320,7 @@ bounded, durable, inspectable, and portable.
 - [DreamNet GitGrid](https://github.com/BrandonDucar/dreamnet-git-grid)
 - [DreamNet Cerberus](https://github.com/BrandonDucar/dreamnet-cerberus)
 - [DreamNet Temporal](https://github.com/BrandonDucar/dreamnet-temporal)
+- [DreamNet Claim Factory](https://github.com/BrandonDucar/dreamnet-claim-factory)
 - [ToolGym](https://github.com/BrandonDucar/toolgym)
 - [Memory Weaver](https://github.com/BrandonDucar/memory-weaver)
 - [Proof Drop](https://github.com/BrandonDucar/proof-drop-zabal)