📜 SubMilli Cryptographic Duel Protocol
Zero-trust commit-reveal architecture & millisecond cryptographic integrity for competitive web esports.
1. Anti-Peeking Commit Phase
Zero-Knowledge Proof
When a player selects Rock, Paper, Scissors, or an Odds/Evens number, the browser generates an unguessable
128-bit cryptographically secure pseudorandom salt (nonce)
using the Web Crypto API:
Only the 64-character hexadecimal digest is broadcast across the WebSocket. Because SHA-256 is a one-way collision-resistant function, neither the opponent's client nor the Cloudflare Worker relay can inspect, calculate, or front-run the selection before mutual lock-in.
2. Mutual Reveal & Peer Verification
Cryptographic LockstepOnce both commitments arrive inside the room's Cloudflare Durable Object, each client is granted permission to broadcast its plaintext move and secret nonce. Both browsers execute independent client-side verification:
If a player attempts to alter their move after seeing the opponent's commitment, the hashes will fail to match. The duel engine immediately flags the round as fraudulent, aborts the room state, and voids telemetry.
3. Live Forensic Ledger & CSV Export
Audit TrailEvery round outcome appends to the immutable forensic ledger below the arena. Each entry permanently documents:
- Sequential round index & arena mode (RPS vs ODEV)
- Plaintext moves and mutual SHA-256 cryptographic hashes
- Sub-second UTC ISO timestamp verification stamps
Competitors can download the full match audit via the Export CSV button for dispute arbitration or historical tracking.
4. SubMilli Discord Telemetry Pipeline
Zero-Loss DispatchUpon match settlement (First-to-5), the host client structures a tamper-proof audit payload and transmits it directly to the SubMilliLabs Discord tournament channel using:
The native browser keepalive: true flag ensures the underlying
TCP socket completes payload delivery at the OS network level even if a competitor rage-quits or closes
their browser tab the microsecond the victory banner appears.