Roadmap
Seven eras, from a shielded pool on Robinhood Chain to private markets in every pocket. Each one ships when the code earns it.
Read the docsPrivate on day one. Stronger every day after.
What you hold in the shielded pool, who you pay, how you split revenue. Hidden by the math itself, so it works on your first transaction. You are not waiting on a crowd to show up.
Every person who shields makes the whole pool harder to read. Privacy here is not a fixed setting you switch on. It grows with the network, and it keeps growing after the code is done.
Built to hide your edge from the crowd, not from the law. Every era below pushes on both halves of that at once.
Every era pushes some mix of these.
The cryptographic core: circuits, contracts, the shielded pool.
How you reach it. CLI first, then web, then an SDK, then mobile.
Growing the crowd. The lever that compounds with every person who joins.
Selective disclosure and auditor-scoped view keys.
$COWL routed through the fee model and the relayer network.
Foundation
The groundwork is real and on chain. Not a diagram.
Shielded pool foundation deployed to testnet, with shield proven end to end.
Note cryptography locked: Poseidon2 over BN254, UltraHonk proofs.
$COWL live on mainnet with a working market and fee revenue.
The join-split circuit and on-chain spend state ship to mainnet.
The Private Ledger
The flagship. Value that lives inside Cowl goes private for the very first user, not the thousandth.
Private send and receive between shielded accounts.
Private revenue-split. Pay your team without the amounts or the recipients going public.
Hidden balances. What sits in your shielded portfolio is yours alone.
Selective disclosure is wired to real view keys.
Compliant Disclosure
Privacy you can defend in a meeting. Show exactly what you choose, to exactly who you choose, and nothing past it.
Auditor-scoped view keys: time-boxed and revocable.
Per-note and per-token disclosure bundles.
Proof you can hand an auditor, scoped exactly how you want it.
The relayer and fixed denominations go live.
The Crowd
The crowd is the asset that compounds. This is the era where we go build it.
Gasless relayer network. A gas payer that is not your own funding wallet.
Fixed-denomination notes, so amounts stop working as fingerprints.
Real onboarding and the first user cohort.
The relayer trade adapter is production-ready.
Private Execution
Touch public liquidity without handing front-runners the trade before it lands.
Relayer trade adapter: shielded funds route out through public liquidity and come back, with MEV and front-run protection.
Batched execution so intents blend at scale.
Front-run protection built into the execution path, not bolted on after the fact.
Relayers decentralize and the shared pool opens.
The Network
Cowl stops being an app and turns into infrastructure other people build on.
Decentralized relayer set, with trust handed off in stages.
Shared multi-asset pool. The crowd becomes everyone shielding, not just $COWL holders.
Cross-chain reach, plus an SDK so any app can embed Cowl privacy.
The protocol is mature enough to carry a mainstream crowd.
Everywhere
The mainstream push. A big deliberate build, saved for last on purpose, because it only pays off once there is a real protocol and a real crowd behind it.
Native mobile app, private by default for holdings and transfers.
Onboarding built for people who do not live in a terminal.
It only ever gets stronger.
Privacy here scales with the number of real people inside the pool. It is not a setting you switch on and forget. It is something the network builds together, and it compounds with every person who joins.
Which means the shield you get on your first day is the weakest it will ever be. Every new person makes it stronger for everyone already inside. Including you.
Value accrues through use, not a supply chart. As the protocol matures, $COWL utility routes through the fee model and the relayer network. The more the pool gets used, the more the token does.