Roadmap
Public status of each phase of the non-custodial transition. This page is updated as phases move; phase pages have the detailed per-phase status.
Legend
- Planned — designed, not started in production code.
- In progress — code / deploys underway on at least one chain.
- Shipped — default-on for new links or subscriptions.
- Retired — legacy path deleted; no longer applicable.
Status
| Phase | Title | Status |
|---|---|---|
| 0 | Design and audit strategy | Planned |
| 1 | EVM payment-link contracts | Planned |
| 2 | EVM subscriptions (allowance-pull) | Planned |
| 3 | Multi-EVM rollout and keeper redundancy | Planned |
| 4 | Solana (Anchor programs) | Planned |
| 5 | Bitcoin (reduced custody) | Planned |
| 6 | Decentralized keepers (EigenLayer) | Planned (optional) |
| 7 | Retire custody infrastructure | Planned |
Phase summaries
Phase 0 — Design and audit strategy
Freeze the fee/split spec, pick the launch chain (Base), choose the audit vendor, stand up deployer multisigs, and settle on the subscription model. Output: three ADRs and a signed deployer ceremony. No production change.
Phase 1 — EVM payment-link contracts
PaymentLinkFactory, PaymentLinkReceiver (EIP-1167 clone), FeeSplitter. Deterministic CREATE2 addresses replace HD-derived deposit wallets for one-off EVM payments. Launch chain: Base.
Phase 2 — EVM subscriptions (allowance-pull)
SubscriptionHub with public charge(id). Payers sign approve(spender, cap) once; the hub enforces cap, timing, and monotonic lastChargedAt. Keeper replaces the custodial auto-charge processor.
Phase 3 — Multi-EVM rollout and keeper redundancy
Deploy the stack to Ethereum, Arbitrum, Optimism, Polygon. Register Chainlink Automation (and/or Gelato) as a second keeper. Publish SLOs.
Phase 4 — Solana (Anchor programs)
payment_link and subscription Anchor programs. PDA per link; SPL delegate for subscriptions. Deprecate SOL HD derivation and the SOL sweep service for flagged links.
Phase 5 — Bitcoin (reduced custody)
Every new BTC payment link becomes a 2-of-2 taproot multisig (merchant + platform). Pre-signed refund PSBTs. Platform key moves to HSM/MPC. BTC subscriptions remain out of scope until Lightning BOLT12 recurrence matures.
Phase 6 — Decentralized keepers (EigenLayer)
Optional. Only if a concrete trigger justifies the build cost. Today's recommendation: defer.
Phase 7 — Retire custody infrastructure
Delete hd_wallet_seed, WALLET_ENCRYPTION_KEY, and the EVM/SOL sweep code paths. Update TOS, privacy policy, and SOC2 scope. Postmortem published within 30 days of shipping.
How status updates work
- Per-phase status page (under
/docs/non-custodial/phases/) is the authoritative status and gets updated weekly when work is active. - This roadmap page is updated when a phase moves between states.
- Blog post published when a phase ships or meaningfully changes.