> For the complete documentation index, see [llms.txt](https://docs.redacted.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.redacted.money/project/roadmap.md).

# Roadmap

The goal is a single wallet that is private by default, familiar to use and connected to all of crypto.

The tx-less core is live, with one sign-in, proof-authorized actions, relayed execution, sponsored onboarding and chain-only recovery. This page covers where it goes from here.

## Next up

* Relaying moves from one relayer to a network of independent node operators who each put a bond at stake, and every deposit needs a node's approval. The nodes vote on five emergency brakes, holders can back nodes with stake, token holders set the wider rules after the token relaunch (the DAO does until then), and an emergency exit keeps every user's way out open. See [How the node network works](/node-network/node-network.md).
* Home-wallet rescue is coming soon. Accounts will be bound to their owner's wallet from day one, and an upgrade will then let money always find its way home during an incident. It arrives as a public upgrade, with the usual 3 days' notice (see [Upgrades, in the open](/protocol/security.md#upgrades-in-the-open)).
* A private self-check on the Ozone page is coming soon. You will be able to check your own address at [ozone.redacted.gg](https://ozone.redacted.gg) with the check running fully in your browser and, if you choose, create a disclosure report for an exchange.
* Zero-knowledge Proof of Innocence is coming soon. It lets you prove a defined property about your funds, for example that they do not come from known hacks or sanctions lists, without disclosing your history. See [Compliance](/protocol/compliance.md#proof-of-innocence).
* The Reserve and Spending will merge into one private balance. Idle assets rest in the Reserve where privacy is strongest, actions fund themselves with exactly what they need and proceeds flow back after settlement, so you see one number and your positions.
* Privacy indicators will show a live label next to each asset that describes how strong your crowd is, with plain-language reasons. They are computed entirely in your browser from public chain data, which fits the no-database principle, so nobody, including us, ever sees your privacy score.
* You will be able to create, name and switch between separate private accounts, each with its own clean recovery.
* Verifiable releases are coming. The node software and the app will be open source with reproducible builds, every release will be published with its checksum and confirmed through governance, and anyone will be able to check what they run or host their own interface.
* Every node will be able to run its own Ozone instance with a ready-made kit, so the network draws on many independent screening sources.
* Rotation by stake comes with the node network. The active nodes change every day, with stake deciding who holds the 21 places and ready nodes waiting on standby for a free one, so no single node is essential (see [Node rotation](/node-network/node-rotation.md)).
* Every new Rujira product and wallet integration widens what you can do privately, out of the box.

## The road to full decentralization

Redacted hands the network to its community step by step, in the open. Every step is a public governance action that anyone can follow on-chain.

1. The node network goes live. Independent, bonded nodes run relaying, deposit approvals and the safety switches from day one, and governance admits the first operators. Code upgrades wait about 3 days in public, and fees, the wait and bond sizes change only after an on-chain notice.
2. The network opens. Governance opens node admission to anyone who posts the bond, for good, and from then on running a node needs no one's permission.
3. Token holders take over. With the token relaunch, token holders take the launch DAO's role for the bond, fees, the wait, upgrades and screening policy. Staking behind nodes switches on, so where holders stake helps decide which nodes run.
4. The emergency tools retire. The emergency lane for upgrades and the Bōheki brake are retired, so every change to the contract goes through the public 3-day path and every brake sits with the nodes.

![The road to full decentralization. Four public steps, and who runs the nodes, who sets the rules and which emergency tools exist at each step](https://578094165-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSbe8ZmgM8eAZhz3FlmfM%2Fuploads%2Fgit-blob-7d840593ec134b5ec35cf69c187d35579c2da4f5%2Fdecentralization-road.svg?alt=media)

Who decides what along the way is set out in [Who decides what](/protocol/system-overview.md#who-decides-what) and [Governance](/node-network/node-network.md#governance).

## What a private account makes possible

The private account is a foundation, and some features can only be built on it. These are some of the ideas ahead.

* Phantom orders would let you execute a large size without anyone seeing a seller. Your order splits into slices that each trade from a fresh, single-use account and then disappear, so the book shows a slice but nobody holds your full size. In its purest form an order would leave no footprint at all, with no resting interest and nothing on any book until the instant it executes at your price or better. Exchanges keep an iceberg order's hidden size on their own servers, while here the hidden size would exist in exactly one place, your browser.
* Money in a link would let you send anyone on the internet money as a link, in any asset on any chain, with no wallet needed on their side and no gas on either side. They tap the link, claim the money and end up with a private balance of their own.
* Every counterparty, invoice or tip could have its own address that stays valid forever, with everything you receive converging invisibly into one private balance, so your income is no longer a public spreadsheet.
* Disposable accounts would let you touch any new contract, mint or airdrop from an account that never existed before and never will again, funded from a crowd instead of your wallet, so that your main holdings stay invisible and any loss stops at exactly what you loaded.
* Funding from the wallet you already have is coming with the node network. You sign once, send native assets from their home chain and watch them arrive as a private balance, with no new wallet, no gas token to hunt for and no bridges.
* Swaps could run through the crowd. You would enter as one asset on one chain and leave as another native asset on another chain, with the entire anonymity set between the two legs. A public cross-chain swap is one transaction that anyone can follow from end to end, while this one would meet itself only in your browser. In its lightest form it wouldn't even need an account, because the swap would start in your wallet, end at a fresh address and connect the two through nothing but you.

These features would run on the contract exactly as it launches, because they are interface work and add no new trust.

## Where this is heading

Redacted's home is Rujira and THORChain. THORChain natively settles the major chains' real assets, with no bridges or wrapped tokens, and Rujira puts a full DeFi suite on top. Outposts complete the picture. They are Redacted infrastructure deployed directly into other ecosystems, with local reserves and local relayers, so that every chain exchanges with Redacted directly and its entire product landscape comes within private reach.

The map below shows all of crypto connecting into Redacted.

![The endgame map. Redacted sits in the middle, running on Rujira and THORChain, with the chains around it and some of the apps on each chain](https://578094165-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSbe8ZmgM8eAZhz3FlmfM%2Fuploads%2Fgit-blob-7e0da4dd95ebd04acbd21a4ed202463e82af1248%2Fendgame-map.svg?alt=media)

Every chain connects directly into Redacted, each carrying its own product universe. Down the spine runs the special connection, where Redacted lives on Rujira and Rujira settles on THORChain. The result is one private identity and one sign-in across the whole map, without your name on it.

Alongside the protocol grows the Redacted interface, and it develops in stages. First comes a swap page so simple that it barely looks like DeFi. Then comes the full experience, with every product behind one private balance and privacy as the only mode, so an entire class of privacy mistakes has nowhere to happen. Because private mode never needs your wallet to speak THORChain, it works with more wallets than anything else in this ecosystem, and if your wallet can sign a message, it can hold a private account. Finally the engine itself ships as an SDK, so wallets and frontends everywhere can offer the same experience inside their own products. Every integration, swap and user feeds one shared crowd, which means each new door makes every room safer.

Every outpost and every integration flows value back to the base on Rujira.

See [Our story](/project/our-story.md) for where this comes from and [Tokenomics](/project/tokenomics.md) for how value flows home.