⬛ Provably Fair Verifier

The server draws a secret server_seed and publishes SHA-256(server_seed) together with the hand's nonce. It does this before anyone chooses a client seed, so the seed your entropy will be mixed with is already fixed and public as a hash.

Every seated player may set a client_seed. The table seed is all of them sorted and joined with |. Because the commitment came first, the server cannot redraw its seed to suit the entropy it sees.

Fisher-Yates over 52 cards, where each swap index comes from HMAC-SHA256(key=server_seed, msg=client_seed + ":" + nonce + ":" + i), taking the first 8 bytes big-endian modulo i+1.

The server reveals server_seed and records the deck order it dealt. Both checks below must pass: the seed has to match the commitment, and the shuffle recomputed from it has to be the exact order that was dealt. A matching hash on its own proves only that the seed was not swapped — not which cards came off the deck.