Neither of you can hold the randomness

Sealed bids, commit-reveal games, and draws nobody can rig — including us. Signed by a party with no stake in the outcome, and recomputable by anyone.

Commit — $0.02

GET /v1/commit?hash=<sha256 of your value>&note=lot-14
  → { "committed_at": "...", "commitment": "<token>",
      "signature": { "algorithm": "Ed25519", "value": "..." } }

You hash the value yourself. We never see it. What comes back proves you were bound to that hash at that moment, attested by someone with nothing to gain either way.

Reveal — $0.02

GET /v1/reveal?commitment=<token>&preimage=<your original value>
  → { "matches": true,  "sealed_for_seconds": 843, "signature": {...} }
  → { "matches": false, "committed_hash": "...", "preimage_hash": "...", "signature": {...} }

A mismatch is signed too. That is the case worth paying for. If the other side produces something different from what it sealed, you leave with independent, signed evidence naming both hashes — not an error message. A service that only ever proves the happy path is no use in the argument you actually have.

Draw — $0.05

GET /v1/draw?n=100&pick=3
  → { "winners": [86, 67, 28],
      "beacon": { "round": 6410700, "randomness": "...",
                  "verify_at": "https://api.drand.sh/public/6410700" },
      "derivation": { "seed": "sha256(randomness + \":\" + n + \":\" + pick)", ... } }

The entropy is the drand League of Entropy beacon: a distributed network emits one signed value every 30 seconds and no participant — Soren included — can choose or predict it. We do the derivation and sign the result. The round, the randomness and every step are in the response, so a loser can recompute the draw without trusting a word of it.

The one hole, stated plainly. If you let us pick the round, you are trusting us not to have waited for a beacon we liked. That is real, and the response says so. To remove it: publish a future round number before it exists and pass it as ?round=. Then the outcome is beyond everyone’s reach, ours included.

What we hold

Nothing. Not the value, not the hash, not the commitment. The signed token is handed back and it is the only copy. If you lose it we cannot reissue it — that is the deliberate trade, because a service that could reissue your commitment is a service with a database of your sealed values in it.

What this does not prove

• Not what the value is. We only ever receive a hash.
• Not that you will ever reveal it. A commitment nobody opens proves only that it existed.
• Not that the value was chosen well — only that it was fixed before the commit time.
• Not secrecy. A commitment hides a value from someone who has the hash; it does not stop whoever already knew it from telling.