The warranty on your tape
You run agents; we run the instrument that records them. The warranty covers the instrument: if the tape, the trigger, the re-run or the dispatch misses, the credit is yours. What your agent does stays yours, and the record of every fire becomes the loss history your carrier reads. What you pay for, and who warrants what →
What we warrant is our own act: the tape is written, the trigger fires as declared, the re-run gives the same bytes, the dispatch arrives inside its window. What your agent does is never warranted; it stays yours and your carrier's.
This is our own record, our nine rooms under our own terms. Open /backup/warranty?manifest=<your sha> after a backup to read yours. Sign in.
Our tape · ThetaDriven, our own nine rooms (data/vna/flight-tape.ndjson) · read 2026-10-17.
- The tape is written: every row signed and chained on your machine, re-hashed when it reaches us.
- The trigger fires as declared: the predicate below, over fields the pipeline wrote, at the threshold in your terms.
- A re-run gives the same bytes: the placement recomputes from the commit to the same receipt.
- The dispatch arrives inside the window your terms name, carrying the frozen tape around the fire.
Never warranted: what your agent does, whether its work was good (undecidable, Rice 1953), or your own service level. Those stay yours and your carrier's.
L0 Measure · free · The tape, the rings and the readings. Free and open source (MIT), at any size.
L1 Attest · $20 · The licence seat, per agent-year: the notary-witnessed tape, the loss-history packet a carrier reads, and a service credit when our own act misses.
L2 Hours · UNMEASURED · Expert hours, prepaid at a discount, redeemable whenever you choose. A fire routes them to the provider with grip where it fired.
L3 Compute · UNMEASURED · Compute credits, prepaid at a discount, redeemable whenever you choose. A fire routes them to the re-run and the fix.
Prepaid hours and credits are yours to spend at any time, fire or no fire. A fire only routes what you already bought to the person with grip where it fired; it never pays out a benefit you did not buy. That keeps them a service, not insurance.
The discount is the spread the market earns: providers are paid from hours you redeem, and because the spec is the tape, an hour is priced against the cell it was spent at.
The licence is the only price on record. The L2 and L3 discounts are UNMEASURED until they are set, and none is shown before then.
Fires at 60% off lane on a commit whose drift walk landed against spec rows with verified proofs. Dispatch window 24 hours. Remedy: service credit of one licence-month per miss, plus dispatched engineering.
Terms 03c139eecce72100 · frozen 2026-10-17T17:30:00.000Z, the moment our server first received an archive carrying them, a record your agent did not write.
1397 eligible of 3400 commits on 7704 tape rows, 2026-09-18 to 2026-10-13.
No fire since the terms were frozen.
The same predicate over the rows written before the terms existed. A backtest is a separate record from the live one and the two are never summed into one rate.
- 7496ff1328 · 63% off lane · C106h C102c C105c C101a · 2026-09-30 17:57
- 7496ff1328 · 63% off lane · C106h C102c C105c C101a · 2026-09-30 17:56
- 9389bf7038 · 71% off lane · C182a · 2026-09-29 12:23
- 055ba88250 · 74% off lane · C217 · 2026-09-23 20:24
- 7a0a26c002 · 76% off lane · C84f C102f C97f · 2026-09-21 22:49
- 72e1c80d5c · 62% off lane · C98g C98i C80b C98c C90 C94b C81c C80 C98 C99 C100 C101 · 2026-09-20 05:45
- 8a09a049c8 · 61% off lane · C89d C82c · 2026-09-19 18:12
- a795147627 · 63% off lane · C44 C63 · 2026-09-18 16:48
trigger · UNMEASURED · needs a second recompute of the predicate by someone other than this server; the packet carries row_sha per fire so a carrier can run it
rerun · UNMEASURED · the re-run needs the commit bytes, which stay on the holder's machine (npx thetacog-mcp verify <url> runs it there)
dispatch · UNMEASURED · no dispatch ledger yet (C900): a fire has no recorded dispatch, so a window cannot be met or missed
Every fire, every dispatch and every miss lands in one packet: the exposure, the frozen terms, the predicate, and each fire's row hash so a carrier recomputes it without trusting us. A contractual-liability carrier underwrites a warranty on its claims history, so this record is the one you hand over. Ours: data/vna/warranty-dogfood.json, recomputed by node scripts/vna/warranty.mjs dogfood.
Your standing answers
Readiness: 0 of 10 answered · your AI can still draft: plumber, rings, demolisher, blast, witness · only you: cause, decides, first hour, wording, level and stop
Your readiness check. Ten questions; paste any one into your own AI and let it draft from your repo, or think it through yourself. Every saved answer is yours, and each sits beside the reading that tests it.
In insurance this object is the proposal form.
1. The plumberyour AI can draft
What does the bot do, in one sentence: the tables, routes and cells it owns, the work it may do unattended?
suggestion: its declared envelope (C915)
tested against: the share of its calls that land on its own pole
2. The electricianyour AI can draft
What adjacent work may it need, and who do you call when it does?
suggestion: providers with landed grip at those cells (C903)
tested against: electrician excursions, their distance, and who was called
3. The demolisher and your haltyour AI can draft
What must never run: schema changes, auth or billing roots, secrets, a runaway token loop?
suggestion: the knobs on your envelope (C917)
tested against: halts fired, and how long after the crossing
4. The blast radiusyour AI can draft
The most it can move unattended: the largest single mutation, the model spend per day, the rows changed per minute.
tested against: the largest mutation, spend and row rate actually seen on the tape
5. The causeonly you
What real-world fact says the work succeeded, beyond green tests and the model's own account?
tested against: UNMEASURED by design: the tape holds where the work landed, never why
6. What only a person decidesonly you
Which decisions does no program get to make (Rice, 1953), and who makes each one?
tested against: UNMEASURED by design: whether the work was good is undecidable; the answer names who decides
7. The witnessyour AI can draft
What would you show a stranger, and what does your bot's own log not contain?
suggestion: the notary-witnessed tape (C495)
tested against: witness lag
8. The first houronly you
The trigger fires at 3 a.m.: who is on call, may we dispatch a provider, and where does the bot run if its model provider throttles?
suggestion: the intake bundle (C897)
tested against: the dispatch ledger (MET · MISSED, C898)
9. The wordingonly you
What does your current policy say about AI (CG 40 47 · CG 40 48 · CG 35 08, or your carrier's own form), and what does it exclude?
tested against: nothing on the tape: this is the gap a carrier reads
10. The level, the scope, and the stoponly you
Which level, and what reading would make you stop paying, on what date? Signed: ThetaDriven warrants its own act (the tape written, the trigger as declared, the same bytes on re-run, the dispatch in its window), never your agent or your outcome.
tested against: your own number, read on your own date
not yet saved
Sufficient for: where it landed, re-runnable from the commit: same bytes, same hash.
NOT sufficient for: whether the work was good, which is undecidable (Rice, 1953); nothing here claims it. Rice (1953): no program can decide, in general, whether another program is correct.