This thread continues the discussion from Confidential Transactions.
That earlier thread preserves five months of exploration, criticism, and several directions I later abandoned. I am leaving it intact as design history, but closing it because too many superseded claims and partial results are mixed together. This thread starts from the evidence that exists now.
The public project
Proofnote is now the public project and repository for APNT—Aggregated Private Note Transfer:
Everything in the public repository is MIT-licensed. It publishes protocol specifications, relation and covenant sources, proof artifacts, frozen verifier descriptors, independent checkers, and examples designed to fail when their evidence is changed.
What Phase 3 set out to demonstrate
The funding proposal did not promise finished private money. It funded the foundation:
- transparent BCH entering a covenant-bound import flow;
- deterministic note commitments and test vectors;
- ML-KEM encrypted recovery;
- beaconless transaction-output binding;
- wallet-side verification of recovered private-note candidates;
- non-custodial signing and chain verification;
- research-scale aggregation;
- a chain-backed private-note design and conservation-proof roadmap.
The central question is whether ordinary BCH UTXOs can remain authoritative single-use state while ownership, value, and payment linkage stay private.
What can be checked today
An earlier live Chipnet import settlement is recorded at:
8510edd3b26e85aaf401d32873cdd035cd3f0cfe0a233f682597145a1bfea6f4
The public evidence documents its transaction structure and provides a raw Electrum verification recipe that does not depend on Proofnote software.
The public repository also lets you:
- verify a released Groth16 proof;
- change committed evidence and watch the proof fail;
- run the same verifier directly in a browser;
- reproduce verification from a clean checkout;
- follow the proof’s public values into an exact BCH transaction projection;
- execute the released settlement covenant locally in a BCH 2026 CashVM;
- inspect the claim and non-claim attached to every example.
Start with the Proofnote Learn path.
Two directions changed from the original proposal
First, the delivered proof backend is SP1 with a Groth16 wrap, not the originally proposed STARK/hash path.
APNT’s note commitment uses SHA-256. The SP1 direction was chosen to prove the relation the protocol actually uses rather than substituting a native hash from another VM and quietly changing the statement. SP1 is the first acceptance backend, not a permanent protocol identity.
Second, APNT v0 does not use Pedersen commitments.
The current construction uses equal-value backing cells and BCH outpoints as single-use state. BCH consensus supplies double-spend prevention. The private relation proves exact conservation by counting those cells.
That choice has an honest cost: cells quantize value and make transfers more expensive. A shielded pool may have a substantial economic advantage. Proofnote publishes that tradeoff rather than claiming the cell construction dominates every alternative.
The current research boundary
Established at prototype scale:
- import into private-note evidence;
- exact conservation in the private relation;
- real proof authentication;
- ML-KEM Recovery V1;
- point-in-time wallet acceptance.
Not yet established:
- durable wallet recording and persistence;
- reorg-safe lifecycle state;
- private-path spendability;
- successive private ownership;
- production privacy;
- achieved anonymity.
The current public proof-bound CashVM lab is local. It uses an explicitly synthetic terminal-verdict token and does not execute the complete production authenticated-verifier graph. It does not claim funding, signing, broadcast, chain inclusion, spendability, or a private payment.
The next decisive experiment is successive ownership: Bob privately transfers an accepted note to Charles, and Charles independently recovers and accepts it.
What I would like reviewed
- Does the UTXO-backed cell model buy enough distributed state and consensus-native double-spend protection to justify its quantization and fee costs?
- Can a shielded pool on BCH avoid a globally contended covenant, persistent public partitions, and an authority over state progression?
- Is privacy from the public—but not from a delegated prover—an acceptable intermediate boundary if it is stated plainly?
- Which evidence is still missing before “proof-bound spend” should be treated as more than a local construction?
This remains Chipnet research, not a production privacy product. The demonstrated anonymity set is research-scale. Public transaction shape, counts, fees, timing, BCH metadata, and category lineage remain correlation surfaces.
Phase 3 is funded through campaign #143, ending at block 966421, approximately August 30. The work is public regardless of the funding outcome because a privacy design nobody can falsify is not ready to be trusted.
Critique is welcome here.