Tendril

Notes from the build

A leaderboard you can't fake

Tendril is a farming game you play by writing a program. A leaderboard for that is only worth reading if nobody can type in a score. So the server never takes your word for one. This post walks through what it does instead, and says plainly what it can and can't prove.

The server plays your game again

Your program runs on your own computer. The game writes down every move it makes as a short row: [tick, bot, action, …]. When you submit, that list of moves is all you send. There is no score field in the request, and a request with any field the server doesn't know about is turned away.

The server builds the challenge farm itself, from the seed it stored when the challenge was created, and replays your moves on it using the same rules code the game uses. The score you see is whatever that replay produces. Every move is checked as it goes: its tick has to be in range and in order, and the action has to be legal at that moment. A bot that is still busy, a tile you don't own or coins you don't have make the replay throw, and the whole submission is rejected. Nothing is partly accepted.

This works because the rules are deterministic. They use whole-number maths only, draw randomness from seeded streams, and never read a clock or touch the network. Given the same seed and the same moves, any machine gets the same farm, tick for tick. The submission also carries a rules version, and a mismatch is refused rather than guessed at.

How a submission is checked Your computer sends moves and optionally a program. The server replays the moves on a farm built from its own seed and rejects illegal logs. If a program was sent, a separate function runs it and its log must hash to the same value as the submitted log. Passing entries go on the board; the replay stays sealed until the challenge closes. Your computerruns your program,records the moves Server replayits own seed, same rules,every move checked Boardscore comes fromthe replay moveslegal illegal: whole log rejected 422 rejected program (optional) Source checkseparate function runs the program;its log must hash to the same value match: tokens counted
A submission is moves, plus optionally the program. The replay decides the score; the source check decides whether a program is attached to it.

Sealed replays

Every accepted entry stores its moves, and anyone can watch the replay of a finished run. But not while the challenge is open. Until a daily or weekly challenge closes, its replays are sealed: asking for one returns a 403, whoever is asking, unless it is your own. That stops the obvious shortcut of reading the leader's moves and submitting them as yours. Duels are the one exception: once you have posted your own run on a duel, you can watch the other player's, so you can race their ghost.

Repeats are refused

Each entry has a fingerprint, the SHA-256 of its list of moves. Send the exact same log twice and the second is refused with a 409. You keep at most three entries per challenge, your best for each of the three medals (Wealth, Speed and Brevity), and there is a daily cap on how many submissions one account can make.

A log that exactly matches somebody else's is not refused, but it also can't beat theirs. Identical runs share a rank, and the player who submitted first is listed first. Copying a run can at most tie it, and with replays sealed you can't see one to copy.

The source check

A legal log shows a farm was played by the rules. It doesn't show how the moves were produced. To get a Brevity medal, which ranks programs by how few tokens they use, you attach your Sprout program, and the server checks it.

The server sends the program, the challenge's seed and its length to a separate function that does nothing else. That function runs the program on the challenge farm under a fixed budget and answers with a token count and the hash of the log the program produced. The main server compares that hash with the hash of the log you submitted. They must match exactly. If they don't, the entry is rejected and nothing is stored. The token count is made by the server, never by your game, and a request that includes its own token count is refused.

The program is kept private unless you tick "publish" and the challenge has closed. Published programs then appear on the leaderboard, where anyone can read how a medal was won.

What this does not prove

The server proves two things. A run is legal under the rules, so the score is real. And, if a program is attached, that the program really produced that run. It does not prove a person wrote the program. Anyone can have an assistant or a model write one, and the server has no way to tell. The "human" or "model" tag on an entry is a label the player sets themselves, and model-written entries get their own board filter rather than a pretence of being caught.

One smaller caveat: a Wealth or Speed entry does not need a program, so on those medals the server vouches for the log, not for how it was made.

Try to break it

The rules, the replay code and the checker are all in the open repository. If you find a way to post a score the rules wouldn't give, we want to know. Season 1 starts on 1 December, rated play is already live, and the rules are here.