From hearing about it to your stop

A team running an unattended production database / internal-API worker: a tool-calling AI agent that changes real rows while nobody watches, and that needs a record it did not write itself and a warranty on our act.

13 steps, each with what you do, where you do it, and what is not built yet. A step with a gold edge has something missing; it says what.

1. You hear about it

You see a link in a README, a reply, a post, the book-club newsletter or the Marketplace listing, never a cold pitch.
You read the one sentence that is a count you can check against your own bill or your own tape.
You look for the catch: what is free, what is paid, and what is warranted.

Where: / · /backup/warrant

Next: the Marketplace listing

Not built yet: No channel is declared for the deployed-agent buyer in particular: the newsletter, /brief and the talk do not link to /backup/warrant or the Marketplace.

2. You install the extension

You open the Marketplace listing (thetadriven.thetacog-mcp) and read "How the warranty works": free to measure, the licence for the attestation.
You install it from the Marketplace, or install the bumped .vsix by hand (Extensions → … → Install from VSIX).
You reload the window and open your own repo, the one your agent works in, as the workspace folder.

Where: /install

Next, in the sidebar: the ThetaCog icon in the activity bar

3. You open the sidebar for the first time

You click the ThetaCog icon and see every card grey, each with its own "not run" and the command that would run it.
You run the first walk and read where it landed, or UNMEASURED with the reason.
You run it twice and check the bytes match.
You see the badge: ten standing answers open.

Next, in the sidebar: Your standing answers, question 1: the plumber

4. You declare what the bot owns

You name the plumber: the tables, routes and cells your bot owns and may change unattended.
You name the electrician: the adjacent work it may need, and who you call when it does.
You name the demolisher: what must never run (schema changes, auth or billing roots, secrets, a runaway token loop).
You let your own AI draft these three from your repo with the copy-the-prompt button, then you check them.

Next, in the sidebar: question 3: what your halt does

Not built yet: The eviction counter (C720) is not built, so a real run reads the demolisher ring UNMEASURED.

Not built yet: C918 (the deployed bot named first on the page) is open.

5. You wire your halt

You choose, per ring, what your halt does: log and continue, pause for dispatch, or halt.
You set how far the bot may step outside its own lane before your halt acts.
You wire the halt into your own wrapper, on your machine, before the call leaves your box.

Next, in the sidebar: the tape: every row your bot writes, signed

Not built yet: The halt is yours by design: nothing here stops your agent. C917 (the envelope carries your halt knobs per deployed job) is open.

6. Your bot writes the tape

You let the bot run; every deployed row lands on the tape, signed under the robot's own key.
You check the tape is valid on your disk: each row links to the one before it.
You buy the second key that countersigns, so a stranger can recompute the receipt without trusting you or us.

Where: /notarise

Next: the sidebar's Back up button (vna.backupTape)

Not built yet: The hosted notary drain is dormant for any repo but ours (C97f, C99b).

Not built yet: C916 (excursion_started goes through the same notary ingest) is open.

7. You back it up to a third party

You press Back up in the sidebar: the archive goes up named by the sha256 of its own bytes.
You land on /backup with your manifest, and the site re-hashes the bytes and refuses a mismatch.
You buy back any missing history with licences, so the backup covers the full scope.

Where: /backup

Next: /backup/adherence

Not built yet: A chat "/steer back up my tape" has no door; only the sidebar button works.

8. You read your record

You open your record on /backup/adherence: where each action landed, in lane or off, against the lane you declared.
You read the semantic vega: how far each landing sat from your declaration, recomputed from your own archive.
You read the curve: the tail, and what one more month of the same work would cost.

Where: /backup/adherence · /backup/curve

Next: /backup/warranty

Not built yet: C907 and C908a (deployer first on "your record") are open.

9. You give your standing answers

You open the ten questions in the sidebar or on /backup/warranty: your readiness check, and in insurance the proposal form.
You paste the five your AI can draft into your own AI, then check what it wrote.
You answer the five only you hold: what success means, what only a person decides, the first hour, your policy wording, your stop.
You watch the readiness line climb to ten of ten, and the badge clear.

Where: /backup/warranty · /backup

Next: /backup/warranty

Not built yet: The reading beside each answer is computed but shown nowhere yet (C930).

Not built yet: The account copy waits on the standing_answers migration (a YOUR-ACT).

10. You pick a level and buy it

You read the four levels: L0 measure (free), L1 attest (the licence), L2 plus prepaid expert hours, L3 plus prepaid compute.
You buy the licence on /notarise; the key comes back to the extension by itself.
You know prepaid hours are yours to spend at any time, fire or no fire.

Where: /backup/warranty · /notarise · /pricing

Next: /backup/warranty

Not built yet: L2 and L3 carry no price yet; only the licence (L1) is on sale.

11. A trigger fires, and someone is sent

You see the trigger fire on the predicate you declared, never on a threshold we typed.
You open the intake bundle: the fire and the rows around it, ready to hand to whoever you dispatch.
You click "Open as a spec row" to hand it to your own agent, or dispatch a provider.
You watch the dispatch ledger: opened, arrived, MET or MISSED against the window.

Where: /backup/warranty · /backup/market

Next: /backup/warranty

Not built yet: The dispatch ledger reads UNMEASURED until its table is applied (the C898 migration).

Not built yet: Who pays a dispatched provider, and how, has no row.

Not built yet: The plan's SIMULATED dispatch window and payout ledger are red (C932).

12. You hand your loss history to a carrier

You download the loss-history packet from /backup/warranty: the fires, the dispatches, the frozen terms.
You hand it to your broker with your standing answers, against the AI exclusions in your current forms.
You let the carrier recompute it from the archive without trusting you or us.

Where: /backup/warranty · /backup/market

Next: /backup/warranty

Not built yet: The packet is a download you attach by hand; nothing sends it to a broker.

Not built yet: No row tracks the carrier, broker and design-partner pipeline itself.

13. You renew, or you stop

You read your own number on the date you set in standing answer ten.
You keep paying if the reading holds, and stop if it crossed your stop rule.
You answer your carrier's renewal with the same standing answers and the newest packet.

Where: /backup/warranty

Not built yet: Your stop rule is text you write; nothing reads it back on its date or reminds you.

Everything not built yet, in one list

1. You hear about it: No channel is declared for the deployed-agent buyer in particular: the newsletter, /brief and the talk do not link to /backup/warrant or the Marketplace.
4. You declare what the bot owns: The eviction counter (C720) is not built, so a real run reads the demolisher ring UNMEASURED.
4. You declare what the bot owns: C918 (the deployed bot named first on the page) is open.
5. You wire your halt: The halt is yours by design: nothing here stops your agent. C917 (the envelope carries your halt knobs per deployed job) is open.
6. Your bot writes the tape: The hosted notary drain is dormant for any repo but ours (C97f, C99b).
6. Your bot writes the tape: C916 (excursion_started goes through the same notary ingest) is open.
7. You back it up to a third party: A chat "/steer back up my tape" has no door; only the sidebar button works.
8. You read your record: C907 and C908a (deployer first on "your record") are open.
9. You give your standing answers: The reading beside each answer is computed but shown nowhere yet (C930).
9. You give your standing answers: The account copy waits on the standing_answers migration (a YOUR-ACT).
10. You pick a level and buy it: L2 and L3 carry no price yet; only the licence (L1) is on sale.
11. A trigger fires, and someone is sent: The dispatch ledger reads UNMEASURED until its table is applied (the C898 migration).
11. A trigger fires, and someone is sent: Who pays a dispatched provider, and how, has no row.
11. A trigger fires, and someone is sent: The plan's SIMULATED dispatch window and payout ledger are red (C932).
12. You hand your loss history to a carrier: The packet is a download you attach by hand; nothing sends it to a broker.
12. You hand your loss history to a carrier: No row tracks the carrier, broker and design-partner pipeline itself.
13. You renew, or you stop: Your stop rule is text you write; nothing reads it back on its date or reminds you.

Sufficient for: where it landed, re-runnable from the commit: same bytes, same hash.

NOT sufficient for: whether the work was good, which is undecidable (Rice, 1953); nothing here claims it. Rice (1953): no program can decide, in general, whether another program is correct.