Intents — Immediate, Gated, Scheduled, Private

How an intent executes: immediately, after your second look, at a chosen time, or privately — and what you can read back afterwards.

Last updated 2026-09-08 · maintained in the Final Wiki

Behaviour marked with the release arrives with the wallet release.

#What an intent is

An intent is one signed instruction to a Final Wallet: call this target with this value and this calldata, by this deadline, paying this fee. It is signed by the holder's transaction key (ML-DSA-87 for PQ wallets) and bound to the wallet's transaction nonce, so it can execute exactly once and only in order. Intents are batched into bundles and carried to the execution chain by the protocol; the holder never pays gas directly.

#Submitting

You submit an intent from your wallet client. It travels encrypted, is identified by its hash, and is either immediate, gated or scheduled by the choice you made when signing. The protocol admits it through a post-quantum quorum and executes it on the chain you named; how it is carried in between is not something a user or an integrator has to know.

Spam is priced, not filtered: every posting pays a small non-refundable floor (USD 0.10) at the write, whether or not the intent ever executes, and a per-wallet posting rate read from Final Chain's terms bounds how many intents one wallet may post in a window.

#Readable before it executes — by whom

Every intent is a record on the state plane before anything runs, and the execution on the target chain has to match that record. Who can read the record is your choice:

By default, the content is encrypted on your device and readable only by you and, once execution is authorised, by the executing service. Outsiders see the target chain, the deadline and the schedule — never your wallet, the recipient or the content — yet they can still verify that what executed is what was admitted.
With the private option, nobody but you can read it until it is due — the operator included. The admitted record still exists, still binds the execution, and is still proved valid on chain; only the reading is yours alone until the moment it runs.

So "readable before it executes" and "only you can read it" are the same guarantee from two sides: the chain always holds the record that execution must match; you decide who, besides you, may read what it says. See Privacy and Oracles.

#The three gates

Immediate (auto-approve). Execution is authorized at submission; the protocol may execute as soon as the bundle is admitted. For automation and for users who have already reviewed the intent in their wallet.

Gated (read-back). Nothing can execute until the holder approves the posted intent with a per-intent approval key; the approval is what lets the protocol read and execute it. Cancel is available until execution. Proven on test: an unapproved intent did not execute during a deliberate hold, executed within minutes of approval.

Scheduled. The intent carries an execute-not-before time enforced by the chain rule, whatever the protocol's services do. Proven on test: a four-minute schedule executed on time. With the release: admission may begin shortly before the schedule — 90 seconds, per target chain — so execution lands in the first block at or after the chosen time, and the holder keeps the right to cancel until that window opens. Scheduled intents lock the assets they will move plus their fee at scheduling time, so execution-time balance failures cannot happen.

#The private option (with the release)

Any intent, immediate or scheduled, can be posted so that the executor's key is released only when execution is due, by the co-signer quorum, by policy. Until then nobody, the operator included, can read the body. Nothing public names the wallet, and postings from one wallet are unlinkable to each other. What becomes public is the execution itself on the target chain, decorrelated from the posting by the delay and by the other legs in the bundle.

#Fees at a glance

Every posting pays a small fixed floor. Scheduling adds a delay component and a per-week component for long horizons; cancelling adds a fixed fee. The private option carries its own published price with tier discounts. Paying in PHI debits locked PHI on the state plane with the native gas sponsored by the protocol. Exact figures: Fees and PHI.

#What you can read back

Status of a posting through the API by its leaf: included (with the wrapper transaction and block), executed, reverted inside a landed bundle, returned, expired, or rejected with the reason (gas drift past the retry budget, or a bundle that already executed with this row taking no effect).
Launch Sale purchases by source chain and sequence: pending, admitted with the PHI amount, delivered.
The wallet's own view in the dashboard, decrypting its own intents with its own keys.

#Failure behaviour

A bundle that is not included is retried; postings stay pending until their deadline.
Gas drift past what the intent's terms or the executor reserve cover is retried a bounded number of times, then rejected with a receipt.
A row that reverts inside an executed bundle is reported as such; it is never retried under the same terms, because the bundle's replay id is consumed.
Cancelled or expired postings drop out; a cancelled gated intent never becomes readable to the protocol.