Cash-Like Privacy on Bitcoin Cash: First Explicit Packet-Plane Milestone
TL;DR
A live Chipnet transaction has accepted the first on-chain private-payment packet layout for this BCH confidential transaction protocol.
Txid:
https://chipnet.chaingraph.cash/tx/1fb716d7640fe821589a12389ebf4e2f9ff3d507a0081524f929ea3549054950
The important part: the intended private payment amount was 9,987,000 sats, but the public chain does not show a visible 9,987,000 sat recipient payment. It also does not show an ordinary visible BCH change output.
Instead, the chain shows:
- one Plane A private state continuation output
- twelve Plane B recipient recovery packet outputs
- sender change retained inside the Plane A private state continuation output
- no ordinary visible BCH change output
- no fallback to the earlier compact carrier path
This does not mean the full privacy system is finished. It does not yet claim full end-to-end post-quantum privacy, final wallet recovery, or proof-bearing covenant enforcement.
But it is a real on-chain milestone: the intended private-payment layout can now land on Chipnet without falling back to ordinary visible change or the earlier compact carrier path.
What happened
The accepted transaction has 13 outputs:
- output 0: Plane A private state continuation output
- outputs 1 through 12: Plane B recipient recovery packet outputs
- recipient packet profile:
ml-kem-768-12x128 - sender change retained inside the Plane A private state continuation output
- no ordinary visible BCH change output
- no fallback to the earlier compact carrier path
The transaction was accepted on Chipnet with a size of 2400 bytes and a 10,000 sat fee.
That matters because the public transaction does not look like an ordinary payment where the recipient amount is visible as a normal BCH output.
What Plane A and Plane B mean
The easiest way to understand the transaction is to split it into two roles.
Plane A is the private state continuation output. In this milestone transaction, output 0 is Plane A. It carries the next private protocol state and retains sender change, avoiding an ordinary visible BCH change output. This is the part of the transaction that keeps the private payment system moving forward without exposing the sender’s remaining value as conventional public change.
Plane B is the recipient recovery packet set. In this milestone transaction, outputs 1 through 12 are Plane B. These outputs carry the fixed ML-KEM-era recovery packet material the recipient wallet will later use to discover and recover the private payment.
So the public transaction does not have the usual structure:
“recipient payment output plus sender change output.”
Instead, it has:
“one private state continuation output plus a fixed recipient recovery packet set.”
That distinction is important. Plane A keeps the state transition moving forward. Plane B gives the recipient a packet set to recover against with wallet secrets. Public observers can see the layout, token commitments, and BCH values, but they do not see a normal visible recipient payment output or an ordinary visible BCH change output.
The accepted transaction demonstrates the on-chain packet layout. Final receiver discovery, recovery, and wallet reconciliation remain next engineering work.
Public value vs private value
The public chain sees this arithmetic:
20,000,000 sats input = 19,978,000 sats Plane A + 12,000 sats recovery packet outputs + 10,000 sats fee
But the operator-intended private payment amount was:
9,987,000 sats
There is no visible 9,987,000 sat recipient output on-chain.
That is the important privacy milestone: the visible BCH values are not the same thing as the actual intended private payment amount. The public chain sees the private-payment packet layout and token commitments. The actual payment meaning is carried inside the protocol state transition rather than exposed as a normal visible recipient payment.
An important detail here is how change is handled.
In an ordinary BCH transaction, leftover value often appears as a separate visible change output. That can be a privacy leak, because observers can often distinguish payment output from change output and use that distinction to reconstruct user activity.
This transaction avoids that pattern.
There is no ordinary visible BCH change output. Instead, sender change is retained inside Plane A, the private state continuation output. Plane B remains the recipient recovery packet set: twelve uniform packet outputs carrying the ML-KEM-era recipient recovery material.
So the public transaction does not say:
“here is the recipient payment, and here is the sender change.”
It says something closer to:
“here is the next private state continuation, plus a fixed recipient recovery packet set.”
That is a key part of the privacy direction. Public observers can still see the transaction graph, the input, the output count, token commitments, and visible BCH amounts. But they do not get a conventional visible recipient output or a conventional visible change output that directly reveals the payment split.
Why this matters
This is the first accepted explicit packet-plane shell for the ML-KEM-era path.
It demonstrates that the transaction can be shaped as:
- one Plane A private state continuation output
- twelve Plane B recipient recovery packet outputs
- no ordinary visible BCH change output
- sender change retained inside Plane A
- Plane B reserved for the twelve recipient recovery packet outputs
- no fallback to the earlier compact carrier path
That is a major step toward the target architecture: private value moving through authenticated protocol state rather than through publicly meaningful BCH payment outputs.
What this does not claim yet
This is still R&D, and the truth boundary matters.
This milestone does not yet claim:
- full end-to-end post-quantum privacy
- production-ready confidential transactions
- final wallet reconciliation or receiver recovery
- final proof-bearing covenant enforcement on this path
- aggregation or coordinator-based privacy
The transaction proves the explicit packet-plane on-chain layout. It does not by itself prove that the whole final privacy protocol is complete.
Why I’m excited
This is the first time the intended ML-KEM packet-plane layout has made it onto Chipnet in the form the current protocol direction requires.
This milestone shows the explicit packet-plane layout (13 outputs) can be accepted on-chain without falling back to ordinary visible change or the earlier compact carrier path.
That is real progress toward cash-like BCH privacy: hiding the actual intended private payment amount inside protected protocol state while keeping the transaction self-custodied and visible enough to be audited on-chain.
Appendix: evidence data
The accepted packet-plane attempt was recorded as:
{
"version": 1,
"generatedAt": "2026-04-27T19:00:51.406Z",
"attemptKind": "explicit-packet-plane-path",
"attemptStage": "broadcast-observed",
"profileId": "bob",
"stateFilePath": "/tmp/bcloak-live-profiles.json",
"signedArtifactIdHex": "1fb716d7640fe821589a12389ebf4e2f9ff3d507a0081524f929ea3549054950",
"selectedFundingOutpoint": {
"txidHex": "676ed5dd9a72949a59cd7c523d8e50279dc13c5084f2f949bbba7d85a540db77",
"vout": 0
},
"outputCount": 13,
"outputLayoutSummary": "output0=PlaneA, outputs1..12=PlaneB packet outputs",
"planeAIndex": 0,
"planeBRange": {
"start": 1,
"end": 12
},
"recipientPacketCount": 12,
"recipientPacketProfile": "ml-kem-768-12x128",
"transparentChangeAbsent": true,
"compactCarrierFallbackAbsent": true,
"residueState": "privately-folded",
"txidHex": "1fb716d7640fe821589a12389ebf4e2f9ff3d507a0081524f929ea3549054950"
}
The live transaction facts were:
{
"network": "chipnet",
"txid": "1fb716d7640fe821589a12389ebf4e2f9ff3d507a0081524f929ea3549054950",
"version": 2,
"sizeBytes": 2400,
"feeSats": 10000,
"input": {
"outpoint": "676ed5dd9a72949a59cd7c523d8e50279dc13c5084f2f949bbba7d85a540db77:0",
"valueSats": 20000000
},
"outputs": {
"count": 13,
"planeA": {
"index": 0,
"valueSats": 19978000,
"scriptHex": "51",
"tokenNftCapability": "mutable"
},
"planeB": {
"range": "1..12",
"count": 12,
"valueSatsEach": 1000,
"totalValueSats": 12000,
"scriptHex": "51",
"tokenNftCapability": "none",
"recipientPacketProfile": "ml-kem-768-12x128"
}
},
"planeModel": {
"planeA": {
"outputIndex": 0,
"role": "private state continuation output",
"currentMilestoneFunction": "carries the next private protocol state and retains sender change at the current shell level"
},
"planeB": {
"outputRange": "1..12",
"role": "recipient recovery packet set",
"currentMilestoneFunction": "carries the fixed ML-KEM-era recipient recovery packet material",
"packetProfile": "ml-kem-768-12x128"
}
},
"changeHandling": {
"ordinaryVisibleBchChangeOutputPresent": false,
"senderChangeHandling": "retained-inside-plane-a-private-state-continuation-output",
"publicChangeClassification": "no conventional visible BCH change output"
},
"publicArithmetic": {
"inputSats": 20000000,
"planeASats": 19978000,
"planeBRecoveryPacketSats": 12000,
"feeSats": 10000
},
"operatorIntendedPrivatePaymentSats": 9987000,
"visibleRecipientOutputForIntendedAmount": false,
"ordinaryVisibleBchChangeOutputAbsent": true,
"fallbackToEarlierCompactCarrierPathAbsent": true
}
Next steps toward full confidentiality
The next work is to move from an accepted packet-plane layout toward the full confidential transaction architecture.
Near-term work:
- receiver discovery and recovery from Plane B recipient recovery packet outputs
- proof-bearing continuation spend validation
- covenant/state-cell enforcement of the private transition rules
- clearer evidence tooling for comparing public chain values against intended private payment semantics
The key point is that this milestone proves the explicit packet-plane layout can land on-chain. The next stage is making that layout fully recoverable, enforceable, and spendable as a complete confidential payment path.