Identify: how a stranger becomes known to ONE

The decision

ONE asks a stranger for nothing. No email, no password, no company size. A person presses one button, an agent runs one command, and the key that comes out is how they sign in. Who they are is the key. What they sell is asked once, after the key, because by then answering gets them a payment link. Two lanes route them: a person, or an agent. ONE has no sales team, so there is no sales-assisted lane. Sold, at $100, is self-serve. The price of this choice: ONE holds no email, so it cannot write to a stranger who leaves. See Still open.

What we built

The ladder: what is asked, and when

The key press: nothing asked. The page says no request leaves the device between the press and the 24 words (0 requests from the press to the words). VERIFY in DevTools; not run for this record.
Keep: the person writes the 24 words on paper, saves a file, or seals a copy with Touch ID. ONE learns nothing from this.
Sign in: Touch ID signs a one-time challenge. The dev script says "No password. No email." The live page also offers email and password, so say the first only of the key door.
An agent born with npx oneie: a name (default "My Shop") and, optionally, --email. The email only carries the hand-over link.
The call, on dev only: what kind of thing (product, service, subscription, course), then a website or a few words, 500 characters at most.
Hand-over: the person opens one link, makes their own key, presses Own.
Buying Sold: a signed-out visitor meets the sign-in door first (home-chat.ts, the checkout comment). This is the one place ONE needs to know who you are before money moves.

The two lanes

A person: "Get my key", a button that makes the key in the browser (/key, home page).
An agent: npx oneie key new --out key.json --yes-i-accept-plaintext-file --json, or bare npx oneie for key, shop and test sale in one run. No-CLI door: POST /api/auth/agent with {}.
The two agent doors differ. The provision key expires after 90 days and the door is capped at 5 calls a minute per IP. The /api/auth/agent key does not expire (llms.txt, 2026-11-12). Tell an agent which one it holds.

The routing rule, in plain words

Already holds a key on this device: send to /keys or /w. Never offer Generate again; a wrong yes orphans a key (isStranger, stranger.ts:46).
No key, a person: the key press.
No key, an agent: npx oneie. It needs no person to sign up.
Has a key, no product: the call, or products:create.
Has a product, no sale: pay your own link with the test card.
Sale counted: the hand-over link.
Wants to be taught: /sold. For an agent the page says: "Sold is priced for a human. Your human enrols, and you read the same chapters."
No thresholds are invented. ONE has no rep capacity to size a rule to. Revisit after the first ten Sold buyers.

Fit and intent, kept apart

Fit: person or agent, and what they sell (the four kinds in the call).
Intent: how far down the ladder they got. The page already reports it: ui:journey:reach {page, way, stop}, once per stop per way, split into people and agents by the ingest door (journey-track.ts).
High fit, low intent: someone who named a product and never paid their own link. Nudge toward the test sale.
Low fit, high intent: an agent that walks every step for a job ONE does not do. Let them self-serve.

Copy that is final

Microcopy for "why no form": "To be paid, you need a key. Press this."
Under the button: "Made on this device. Nobody else ever sees it."
Button: Get my key. Agent line: npx oneie key new.
The call, heading and lead: "What do you sell?" and "Give me your website."
The call chooser: Product · Service · Subscription · Course. Box: "Your website, or tell me what it is". Button: "Make my link". Under Subscription and Course, say the truth: "For now this makes a one-time link."
Agent signup line: "No form. Your key is how you sign in."
Truth to keep: prod still says "Once your key has an account". A key signs you in, but a shop and an API key come from a workspace made by npx oneie or sign-in. VERIFY how a person's key gets its account on prod.

Segment tags (proposed, not wired) — bare words: person, agent, product, service, subscription, course, keyholder, seller, sold. VERIFY that nothing writes these today.

Receipts

Probed 2026-11-12 with curl -I:

https://one.ie, /key, /get-key, /keys, /signin, /sold, /learn/saas, /llms.txt: 200.
https://one.ie/learn/saas/one/identify: 404 today, until this record is published.
https://pay.one.ie/status: ok, network testnet.

What prod shows: the home page opens "Give your agents financial superpowers" and walks nine stops (Key, Keep, Wallets, Sign in, Make, Sell, Practise, Send, Hand over). I searched the live HTML for six strings from the eight-beat script ("What do you sell", "Tell ONE", "Make my link", "This is an agent making a sale", "To be paid, you need a key", "Show me a demo"). Zero hits.

What is on dev and not shipped: the eight-beat script, the call box and the kind chooser, at commit 90bcc2271 on origin/dev. Everything marked "dev" above is that script. Do not run an ad that sends a stranger to a call box prod does not have.

Measured by ONE and written in llms.txt, not re-run by me: making the key took 66 ms with no network call; a workspace was born in 9 to 13 s (both walked 2026-11-07, oneie@5.7.3).

Still open

No email is captured at the key. The playbook's Identify promises "a tagged contact in your email list or CRM". ONE has none. Nurture, the next stage, has nobody to write to until a person leaves an address. VERIFY what the hand-over --email stores and whether it may be used for follow-up.
The call is on dev, not prod. Ship it before any campaign sends traffic to it.
A website is read into products: VERIFY. one.md says the receivers exist and are not walked end to end. The dev chat has a stand-in line for this.
Every call makes a one-time link, including Subscription and Course.
/get-key returns a shell on first load; the key button renders in the browser. VERIFY by opening it.
The segment tags are a proposal.
"0% fees" conflicts with the brief. This record says: "ONE takes nothing from a sale; the card network takes its fee." The dev copy still says "We take 0%" in beat 4.

Do it yourself