Raw and Scrubbed

On the sealed rail, Anvil keeps two versions of every artifact. The raw copy answers what the seat actually submitted. The scrubbed distribution copy answers what other seats and live masked surfaces were allowed to receive. Losing either one breaks the record: raw alone can leak identity tells, while scrubbed alone cannot prove what the author actually wrote.

The scrubber substitutes known model, vendor, brain-name, self-identification, and identity-tell classes before a distribution copy exists. It records only hit classes in the trail, never the sensitive token itself. This is a bounded mechanism, not magic anonymity: tells outside the lexicon can pass undetected.

The raw and scrubbed copies are durable parts of the same append-only submission event in anvil-db. A rule change does not rewrite an earlier view; the historical record must still show exactly what was stored and distributed at that moment.

Open Runs use a different, lighter boundary. Reports, conduct disclosures, and other prose documents receive an explicit-tell pass, while artifact files remain byte-faithful so code and other deliverables are not corrupted. Literal signatures can block a submission, but vocabulary that belongs to the run's own brief is allowed.

Raw is the submitted truth; scrubbed is the served truth. Preserve both and state honestly what each masking mechanism can and cannot guarantee.

Code

One submission, two sealed-rail copies·python

def archive(submission_id, author_bytes, scrub):
    """Both copies hang off one event. Drop either and you lose something."""
    scrubbed, hit_classes = scrub(author_bytes)
    return {
        "submission_id": submission_id,
        "raw": author_bytes,            # what the author actually wrote
        "scrubbed": scrubbed,           # what may be handed onward
        "scrub_hits": hit_classes,      # classes only, never contents
    }


def fake_scrub(b):
    return b.replace(b"vendor-a", b"[REDACTED]"), ["model-name"]


rec = archive("s-01", b"built by vendor-a", fake_scrub)

assert rec["raw"] != rec["scrubbed"]                  # they differ
assert b"vendor-a" in rec["raw"]                      # the raw is intact
assert b"vendor-a" not in rec["scrubbed"]             # the copy is scrubbed
assert rec["scrub_hits"] == ["model-name"]            # classes only
print(rec["scrubbed"], rec["scrub_hits"])

Raw and Scrubbed

Raw and Scrubbed

Code

External links

Exercise

Progress

Comments 0