The Hand That Signs

The sentence is nine words long. Send five tokens to the address pasted just below.

The chat answers, and it does not send anything. It has read the balance, found the chain and written the whole transfer out as one plain line: five tokens, from here, to there, this much to move them. Then it hands over a link that does nothing by itself, works once, and expires.

The keys were made on a laptop, offline, long before any of this, and the chat has never seen them. The server has never seen them either. That was the first rule and it has not bent once. The thing that moves the money is not the thing that talks about moving it.

So the talking half is easy. A person in a chat window can ask, and so can a coding agent in a terminal, and each gets the same answer and the same link.

The asking was never the hard part.

The link opens on a page with one line on it, the same line the chat wrote, and under it a single button that needs no explaining. A finger goes on the sensor.

The key wakes inside the browser, on the machine in front of the person, and it signs. The transfer goes out. A hash comes back and travels home to the chat, which writes one more line under the first.

Five tokens, there, with the hash.

Nothing in the chat gained the power to move money, and the money moved anyway.

The power was never in the chat. It was in the finger, and the chat only learned how to ask.

Nine words. One touch.

Where the metaphor stops being true

The opening scene is constructed. Nobody has sent a token this way. Every sentence in the telling above is the want, told in the present tense, and the sections below say how much of it the code already carries.

What is real today, read off the code:

• wallet:send exists (packages/sdk/src/receivers.ts, entry "wallet:send"). Its own summary says it never signs and that no private key crosses its boundary. The caller signs and broadcasts, then passes the hash as paymentTx.
• one wallet send <to> --amount <n> --payment-tx <hash> exists (packages/cli/src/wallet.ts). --payment-tx is a required option, so the CLI never signs either.
• wallet_send is an MCP tool (surfaces: { mcp: true }), the same receiver. Claude Code reaches the reads — wallet_get, wallet_portfolio, wallet_transactions — and wallet_invoice today. For a send it needs a hash it already has.
• one wallet keygen makes keys offline across Sui, EVM, Solana and Bitcoin. one wallet register sends public addresses only.
• human:notify suspends a run on a person and human:resolve resumes it (CLAUDE.md § Workflow step kinds).

What is NOT WIRED, and the telling leans on it:

• No signer reaches the person's touch. There is no wallet:propose receiver, no one-use send link and no /send/<token> page. Nothing builds an unsigned transfer.
• The claim ceremony is not wired. text/agent-handover.md § 3 marks the passkey-and-vault ceremony [NOT WIRED — cycle required] and /join has no claim UI (register item 1). A touch that unlocks a key in the browser rests on exactly that.
• CLI-made keys are not behind a passkey. one wallet keygen writes a file and one wallet new seals a passphrase vault. A link can unlock a key only if that key moved into the passkey vault, or the page reads the same sealed vault. Which of the two is the open question, and text/sovereign-wallet-plan.md § 7 (one wallet or two) decides it.
• A coding agent that holds the key could sign without a touch. The telling does not say the agent cannot hold a key. It says the agent is not asked to. Whether a coding agent may sign inside a spend ceiling is a decision, and it is the person's.
• The ONE token has no path. A comment in one.ie/web/src/lib/resolvers/wallet.ts records that a faucet dispenses SUI, never ONE, and the gateway mint has never been armed. "Any token the person holds" is true only for the tokens the four chains can sign for.
• Per-chain browser signing is unbuilt. Sui, EVM, Solana and Bitcoin each need their own signer in the page. The first slice is likely Sui plus one EVM chain, on testnet.

Locked words. The telling uses group, people and agents, signal and path in their locked senses. Link is not a locked word and names no entity. Touch is the person's consent, not a verb of the six.

The family this story generates

Sentences that would be false if shipped

• "Chat can send your tokens." It cannot. Chat proposes. A person signs.
• "Claude Code can already move your tokens." It reads balances and records a hash it was given. It has no signer.
• "Send from any wallet you set up with the CLI." Those keys are in a file or a passphrase vault, not behind a fingerprint.
• "Send ONE, SUI or ETH from chat." The ONE mint is not armed.
• "The server never sees your key, so it is safe." That is the property. It is not the proof. The proof is a testnet send that a probe ran, from a link, with a fingerprint.
• "Done." A hash recorded is not a transfer settled. wallet:send verifies settlement through the pay link, and the receipt names the stage where it stopped.