Roadmap
Seven eras, from a shielded pool on Robinhood Chain to private markets in every pocket. Each one ships when the code earns it, which is why you will not find dates on this page — an era opens when the work behind it is done, not when a quarter rolls over.
Execution order is not list order
Eras 03 and 04 shipped ahead of 02, and that was deliberate. The relayer and the trade adapter are what make the pool worth being inside, and the crowd compounds from the day it starts. Disclosure tooling gets better the more there is to disclose, so it waits for the thing it describes. The numbers are a map of the build, not a queue anybody has to stand in.
Private on day one, stronger every day after
What you hold in the shielded pool, who you pay, and how you split revenue are hidden by the math itself, so it works on your first transaction. You are not waiting on a crowd to show up. From there it compounds: every person who shields makes the whole pool harder to read, so the shield keeps growing long after the code for it is done.
The five pillars
Every era below pushes some mix of these. They run the whole length of the project.
| Pillar | What it covers |
|---|---|
| Protocol | The cryptographic core: circuits, contracts, the shielded pool. |
| Surfaces | How you reach it. CLI first, then web, then an SDK, then mobile. |
| Network | Growing the crowd. The lever that compounds with every person who joins. |
| Compliance | Selective disclosure and auditor-scoped view keys. |
| Token | $COWL routed through the fee model and the relayer network. |
The eras
Era 00 — Foundation · The Forge · shipped
The groundwork is real and on chain. Not a diagram.
- The full private flow — shield, private send, private trade, unshield — live on Robinhood Chain, mainnet and testnet both.
- Note cryptography locked: Poseidon2 over BN254, UltraHonk proofs.
- Mainnet trades fill against the chain's live Uniswap V3; $COWL trades there with a working market and fee revenue.
- One immutable mainnet release. Deployed once, never redeployed, and the addresses are final.
Surface: CLI
Era 01 — The Private Ledger · Under the Cowl · shipped
Everything the terminal does, one screen away from everyone. The protocol stopped living in a terminal.
- Private send, receive, shield, unshield and swap from the web app. No install, no toolchain.
- Proofs generated in your own browser. The site is a static export with no server behind it.
- Shielded keys derived from a wallet signature, so one wallet opens the same book on any machine.
- A visual shielded portfolio, read from your keys rather than from an API.
Surface: app.cowlprotocol.com
Era 02 — Compliant Disclosure · Nothing to Hide · open · you are here
Privacy you can defend in a meeting. Show exactly what you choose, to exactly who you choose, and nothing past it.
- Auditor-scoped view keys: time-boxed and revocable.
- Per-note and per-token disclosure bundles.
- Proof you can hand an auditor, scoped exactly how you want it.
Surface: Disclosure console
Where it stands: This is the open era. Read-only view keys already ship in the CLI; the scoping and the console are what land here.
Era 03 — The Crowd · Safety in Numbers · shipped
The crowd is the asset that compounds, and it took priority over the eras numbered before it.
- Gasless relayer network, live on mainnet and testnet, and the default door on every spend.
- Shared denomination sizes, so amounts stop working as fingerprints.
- Self-paid as a first-class alternative on every surface, so a relayer is never a chokepoint.
- The first cohort onboarded through a private airdrop, delivered by private send with no deposit trace.
Surface: Web app as the growth engine
Era 04 — Private Execution · Move Unseen · shipped
Touch public liquidity without handing front-runners the trade before it lands.
- Atomic trade adapter: shielded funds route out through public liquidity and come back inside one transaction.
- Quotes scan every fee tier and take the best executable fill.
- Token-to-token pairs auto-route through native as two private legs, so nothing has to unshield in between.
- Front-run protection built into the execution path: there is no pending order to read.
Surface: Web app and CLI trade flow
Era 05 — The Network · Many Hoods · ahead
Cowl stops being an app and turns into infrastructure other people build on.
- Decentralized relayer set, with trust handed off in stages.
- Cross-chain reach, plus an SDK so any app can embed Cowl privacy.
- An agent-facing surface, so automation can trade under keys it never holds.
- The full $COWL fee routing comes online here.
Surface: SDK and developer platform
Era 06 — Everywhere · In Every Pocket · ahead
The mainstream push. A big deliberate build, saved for last on purpose, because it only pays off once there is a real protocol and a real crowd behind it.
- Native mobile app, private by default for holdings and transfers.
- On-device proving, so the phone is a full participant rather than a viewer.
- Onboarding built for people who do not live in a terminal.
Surface: iOS and Android
It only ever gets stronger
Privacy here scales with the number of real people inside the pool. It is not a setting you switch on and forget — it is something the network builds together, and it compounds with every person who joins. Which means the shield you get on your first day is the weakest it will ever be. Every new person makes it stronger for everyone already inside.