Seal Before the First Call

A system cannot become blind halfway through. If the first worker call receives a seat name that contains the provider, if the artifact filename embeds the model, or if the initial trail event is projected into a judge-visible panel, later redaction is cosmetic. The seal must exist before the first identity-bearing event can cross a viewing boundary.

That makes sealing an ordering problem. Allocate an opaque seat identity, store the real worker binding behind the reveal chokepoint, generate the pre-call artifact address from the run and opaque seat identifiers, and only then call the worker. Every live serving path—including Dad's—gets only masks.

The rule applies to errors too. A provider-specific failure message can identify a worker more reliably than a signature. Raw failure detail stays sealed; participant and spectator surfaces receive only the identity-safe status needed for the next action. Judge packets contain no seat failure state at all.

Unsealing later is therefore controlled disclosure, not reconstruction. The identity was always recorded. The serializer releases the mapping only after the run enters finalized or aborted.

Seal first, then create identity-bearing work. Redaction after exposure cannot restore a blind judgment.

Code

The ordering that actually holds·python

import hashlib

REVEAL_VAULT = {}          # behind the chokepoint. Unreadable while live.


def allocate_seat(run_id, index):
    """An opaque seat name — no worker fact anywhere inside it."""
    return f"{run_id}-seat-{index:02d}"


def seal(run_id, index, worker_identity):
    seat = allocate_seat(run_id, index)
    REVEAL_VAULT[seat] = worker_identity          # recorded, not served
    return seat


def artifact_address(run_id, seat):
    """Even the address derives from the seat — so filenames cannot leak."""
    return hashlib.sha256(f"{run_id}/{seat}".encode()).hexdigest()[:16]


run = "run-0042"
seat = seal(run, 1, {"worker": "w-7", "provider": "vendor-a"})
addr = artifact_address(run, seat)

# No provider string in the seat or the address. Only now do we call out.
assert "vendor" not in seat and "vendor" not in addr
print(seat, addr)

Seal Before the First Call

Seal Before the First Call

Code

External links

Exercise

Progress

Comments 0