Roadmap
Seven eras, from a shielded pool on Robinhood Chain to private markets in every pocket. Each one ships when the code earns it, which is why you will not find dates on this page — an era opens when the one before it is done, not when a quarter rolls over.
Private on day one, stronger every day after
What you hold in the shielded pool, who you pay, and how you split revenue are hidden by the math itself, so it works on your first transaction. You are not waiting on a crowd to show up. From there it compounds: every person who shields makes the whole pool harder to read, so the shield keeps growing long after the code for it is done.
The five pillars
Every era below pushes some mix of these. They run the whole length of the project.
| Pillar | What it covers |
|---|---|
| Protocol | The cryptographic core: circuits, contracts, the shielded pool. |
| Surfaces | How you reach it. CLI first, then web, then an SDK, then mobile. |
| Network | Growing the crowd. The lever that compounds with every person who joins. |
| Compliance | Selective disclosure and auditor-scoped view keys. |
| Token | $COWL routed through the fee model and the relayer network. |
The eras
Era 00 — Foundation · The Forge · you are here
The groundwork is real and on chain. Not a diagram.
- Shielded pool foundation deployed to testnet, with shield proven end to end.
- Note cryptography locked: Poseidon2 over BN254, UltraHonk proofs.
- $COWL live on mainnet with a working market and fee revenue.
Surface: CLI
We move on when: The join-split circuit and on-chain spend state ship to mainnet.
Era 01 — The Private Ledger · Under the Cowl
The flagship. Value that lives inside Cowl goes private for the very first user, not the thousandth.
- Private send and receive between shielded accounts.
- Private revenue-split. Pay your team without the amounts or the recipients going public.
- Hidden balances. What sits in your shielded portfolio is yours alone.
Surface: Web app v1
We move on when: Selective disclosure is wired to real view keys.
Era 02 — Compliant Disclosure · Nothing to Hide
Privacy you can defend in a meeting. Show exactly what you choose, to exactly who you choose, and nothing past it.
- Auditor-scoped view keys: time-boxed and revocable.
- Per-note and per-token disclosure bundles.
- Proof you can hand an auditor, scoped exactly how you want it.
Surface: Disclosure console
We move on when: The relayer and fixed denominations go live.
Era 03 — The Crowd · Safety in Numbers
The crowd is the asset that compounds. This is the era where we go build it.
- Gasless relayer network. A gas payer that is not your own funding wallet.
- Fixed-denomination notes, so amounts stop working as fingerprints.
- Real onboarding and the first user cohort.
Surface: Web app as the growth engine
We move on when: The relayer trade adapter is production-ready.
Era 04 — Private Execution · Move Unseen
Touch public liquidity without handing front-runners the trade before it lands.
- Relayer trade adapter: shielded funds route out through public liquidity and come back, with MEV and front-run protection.
- Batched execution so intents blend at scale.
- Front-run protection built into the execution path, not bolted on after the fact.
Surface: Web app trade flow
We move on when: Relayers decentralize and the shared pool opens.
Era 05 — The Network · Many Hoods
Cowl stops being an app and turns into infrastructure other people build on.
- Decentralized relayer set, with trust handed off in stages.
- Shared multi-asset pool. The crowd becomes everyone shielding, not just $COWL holders.
- Cross-chain reach, plus an SDK so any app can embed Cowl privacy.
- Staking and the full $COWL fee routing come online here.
Surface: SDK and developer platform
We move on when: The protocol is mature enough to carry a mainstream crowd.
Era 06 — Everywhere · In Every Pocket
The mainstream push. A big deliberate build, saved for last on purpose, because it only pays off once there is a real protocol and a real crowd behind it.
- Native mobile app, private by default for holdings and transfers.
- Onboarding built for people who do not live in a terminal.
Surface: iOS and Android
It only ever gets stronger
Privacy here scales with the number of real people inside the pool. It is not a setting you switch on and forget — it is something the network builds together, and it compounds with every person who joins. Which means the shield you get on your first day is the weakest it will ever be. Every new person makes it stronger for everyone already inside.