fecho is a T1 desk: it builds, it never signs.

The claims below are about the agent's reachable tool surface — the four WASM plugins and the host tool set. That is the surface a chat message can touch.

• No tool the agent can call holds, reads, or derives key material.
• No tool the agent can call submits a transaction. The refund builder returns unsigned bytes and their sha256; a human wallet is the only thing that can turn those bytes into a payment.
• No tool the agent can call accepts a destination address. A refund can only return to the wallet the chain already recorded as the sender of the payment being refunded.
• The refund builder is gated by the host's approval mechanism and capped in config. Chat text cannot satisfy the gate.

One thing in this repository does sign and send: tools/payer/, the test customer used in docs/MONEY_LOOP.md. It is a host-side development binary in its own workspace — not a plugin, not installed, not registered, and not reachable from a chat message. It reads a keypair path given on its command line and holds none. It is called out here rather than left for a reader to find, because a signing binary in the tree of a project whose central claim is "the agent cannot sign" is exactly the thing a reviewer should check.

Under total compromise of the model, the worst available outcome is a wrong sentence in a chat message, not a wrong transaction. See docs/attacks/ for the tested version of that claim.

Nothing secret belongs in this repository, and nothing secret is in it. Key material, API keys, and channel tokens live in the operator's ZeroClaw config, which encrypts secret values at rest, and in keypair files outside the repository tree. .gitignore blocks keypairs, .env files, and PEM files from the first commit.

The wallet addresses, the mint, and the durable nonce account in config/config.snippet.toml and the docs are public identifiers by design. They are not secrets, and treating them as such would make the setup harder to reproduce for no gain. The Pix key and the merchant fields are left as <angle bracket> placeholders because they are yours, not because they are secret.

If you find a way to make the desk move money it should not, or to extract anything from its config or workspace that it should not surrender, open an issue with a reproduction. Attacks against the invariants above are the most useful thing anyone can send us: the whole design rests on them being structural rather than aspirational.

If a finding involves live funds, say so in the issue title and leave out the amounts; we will follow up privately.