Roadmap

Now · Winnow in Lean 4

Winnow has been rewritten in Lean 4, in the public winnow-lean repository. Version 0.9 on TestFlight compiles the wallet and its screens from Lean to native code and draws them with standard iOS controls. There is no Swift in it. It installs over the App Store’s Swift app and keeps the wallet, receive labels and iCloud backup. Saved people, Signers and multisig accounts from the Swift app are set aside on the phone, not deleted, and start empty: pair the Ledger again under Settings → Signers.

The newest build is 0.9.5 (30 October 2026). Its Xcode project is generated from a Lean description of the app, which refuses a capability, such as Face ID, Bluetooth, background checks or iCloud, that lacks its usage text or entitlement. External TestFlight review was requested for 0.9.4. The framework drawn out of Winnow is LeanNative; its open issues are on the research page.

Multisig is a Taproot script-path k-of-n account. Create an account picks who signs: this phone, a Ledger paired under Settings → Signers, and keys someone sent. An optional recovery path lets fewer signers, or a separate key, spend a coin that has not moved for a chosen delay. MuSig2 accounts and Bitcoin Core cosigners were removed in 0.8.13. On 26 October 2026 a Ledger Nano X co-signed a mainnet 2-of-2 spend.

Recovery words restore the wallet, not shared accounts. Keep a backup file or the iCloud backup for those; what a backup cannot restore lists the rest.

A known limit being worked on: the phone’s key in shared accounts, and on its person card, is the everyday wallet’s BIP86 account key, so co-signers can see the personal wallet’s history.

Make the core easier to use and maintain

Remove redundant code and tests, shorten the guides, and make recovery limits explicit. Keep focused checks for cryptography, hostile inputs, and recovery failures.

The recording and screenshots on this site come from the Lean app's CI: each build of the site fetches the newest successful run's journey media from winnow-lean's main, and falls back to reference media from the Swift app only when that fetch fails. Those journeys complement lower-level tests; they do not establish every failure case. Inspect the recording and its source →

Earlier proposals · Not scheduled

Recover through interruptions

Outcome: understandable recovery after an interrupted sync or payment. Ready when: restart, disconnect, fee replacement, stale backup, network switching, and chain-reorganization cases leave the screen, stored wallet, and peer-observed payment in agreement. Measure bandwidth, memory, and battery use on supported iPhones.

Broader beta

Outcome: a defined feature set with usable instructions. Ready when: new users complete everyday payments and recovery from those instructions, supported devices are defined, and reproducible critical findings have regression coverage. Pre-release builds use TestFlight.

Independent security review

Outcome: an inspectable review of a specific release. Ready when: blocking findings are fixed and verified, with the reviewed revision, exercised flows, and remaining limits published. A version number is not a security conclusion.

Research and earlier proposals

Research at Winnow covers Winnow Rescue, P2MR, existing hardware wallets, Silent Payments, and thresholds and timelocks. Each project records its motivation, current evidence, and next experiment. The native Swift curve work there is set aside: the Swift app stayed on libsecp256k1, and the wallet has since moved to Lean. The first-pass record distinguishes protocol fixtures and recovery models from later wallet work. The additional proposals below retain their own status; research does not make them supported features or automatic upgrades.

An optional P2WSH Safe · Earlier proposal

A separate, opt-in storage choice. It must demonstrate creation, receiving, backup, restoration on another installation, and withdrawal, including fresh change, exposure tracking, and refusal of damaged or incomplete backups. Limitations must be clear before funding. This proposal does not provide full post-quantum signing.

Signing devices and independent cosigners

A Ledger Nano X is a supported signer and has co-signed a mainnet spend. The hardware-wallet research section describes the earlier simulator evidence. Independent professional-cosigner arrangements remain separate proposals.

Prove compatibility with the exact script, derivation, receiving address, signing exchange, and recovery process. Hardware evidence must identify the model, firmware, coordinator, and tested revision. Define who controls keys and backups, who can spend without the owner, and what happens when approval is refused or unavailable.

Winnow has no verified professional-cosigner or lending integration. Trusts, inheritance, and collateral arrangements need legal authority and key access to agree; Bitcoin only checks signatures. In a borrower–lender–key-agent 2-of-3, the lender and key agent could spend without the borrower. A label or signed statement cannot enforce repayment, succession, delay, or protection from coercion.

Tor and I2P

The app bundles no Tor or I2P client. It can route peer connections through Tor and I2P gateways the user runs on their own Tailscale network (gateway setup); without them it connects directly. Embedded Tor was removed in 0.7.1; its code and license inventory remain on the archive branch. Returning it requires review of the integration and dependencies, no silent direct fallback, and physical-iPhone checks across foreground, background, failure, and explicit off states.

The earlier I2P proposal called for a feasibility study: measure reliable tunnel startup, cold and warm starts, battery, bandwidth, and app-size cost for a foreground-only wallet. Tailscale gateway routing now covers the user-controlled external router; an embedded router remains unscheduled. The archived decision record supplies background; #164 records the decision not to pursue it.

Future network rules

The P2MR research section describes the renewed investigation. P2MR research needs actual network enforcement, interoperability, recovery behavior, and a complete opt-in migration path before it becomes a release plan. A patched test network or prototype is not evidence of deployment on Bitcoin. No activation date is implied.