# 7. The first ninety days

## Weeks 1 to 2: the contract

- Fix the journal entry format (`spec/journal-entry.md`) and the chain rule.
- Stand up the agent-reported capture instruction (`prototypes/agent-reported-capture.md`) for Gmail and Calendar.
- Create one vault per customer with an append lane, and a read-key-only replay.

**Done when:** a real agent session against a test Google account lands in a lane and replays in the app.

## Weeks 3 to 6: the gateway and the processor

- Build the gateway for MCP traffic: copy each `tools/call` and result, plus the upstream request and response where the connector exposes them.
- Build the processor on a timer and on a pending-count threshold (`prototypes/processor-schedule.md`).
- Write the Gmail and Calendar view folders: the inbox, the calendar, the timeline.

**Done when:** a day of real use by one design partner is captured completely and replays.

## Weeks 7 to 10: revert

- Implement `spec/revert-rules.md` for the Gmail and Calendar actions in scope.
- Add the supervised revert: plan, approve, execute through the gateway, journal the result.
- Run a replay drill with each design partner: pick a real session, answer "what did it do, what did it see, what can we put back" in under thirty minutes.

**Done when:** a revert has been executed on a real, non-critical change and journalled.

## Weeks 11 to 13: price and sell

- Convert design partners to paid tiers at the hypothesis prices, and record who refuses and why.
- Offer the irreversibility map to twenty prospects; count how many turn into a review.
- Sign one managed service provider.

**Done when:** five paying customers, one reseller, and a written account of which prices held.

## Team

Two founders: one who can build the gateway and the processor, one who can sell to CISOs and MSPs. A part-time security reviewer from week 6, because the first serious customer will ask for the threat model.