The town never sends its own totals. It sends small check-ins while it is open, the server applies its rules to each one, and every number on the board is added up by the server from what it accepted.
1Browser → server
Join
When the mayor opts in, the server issues a town ID and a secret key. The key stays in that browser. A bot check and a per-IP limit stop mass sign-ups.
town_id: t_8f3k…
key: kept in this browser
2Every 10 minutes
Check in
While the town is open, it sends only what happened since the last check-in: residents raised or gone home, new blocks, the agent kind and a hashed session ID. Each one is numbered and signed with the key.
seq 212 · 3 events
signed HMAC-SHA256
3Server
Apply the rules
Bad signature, skipped number or impossible pace: rejected. Everything else is stored as events. Totals are never taken from the browser.
accepted → events
rejected → log + strike
4Server → site
Count & rank
The server adds up blocks, residents raised and longest shift from accepted events, then ranks towns on the wired or hand-raised board. Postcard pictures wait for review.
Signed and in orderEach check-in carries the next sequence number and a signature made with the town key. A wrong signature or a skipped number is rejected.
Totals come from the serverThe browser sends events, never “I have 1,208 raised.” Editing local storage changes nothing on the board.
A believable paceCaps per town: about 30 residents raised per check-in, 300 a day, 20 new blocks a day. Over the cap, the extra events are dropped and the town gets a strike.
Time has to add upA shift only lasts as long as the check-ins covering it. A gap of more than 20 minutes ends it, so “longest shift” can’t be typed in.
One session counts onceWired residents carry a hashed session ID; the same ID raised twice in a town counts once. Residents raised by hand go to the hand-raised board.
No time travelEvent times must fall between the previous check-in and now, with 5 minutes of slack for clock drift.
Three strikes3 rejected check-ins in a day flags the town: it leaves the rankings until the site owner clears it.
What a town shows on the board
VerifiedAt least 24 hours and 6 accepted check-ins, no open flags. Ranked.
PendingNew town still building history. Listed at the bottom, not ranked yet.
FlaggedFailed the rules or was reported. Hidden from the boards; the mayor sees why in their town.
What this can’t stopThe game runs in the browser and its code is readable, so someone determined could script fake check-ins at a believable pace. These rules stop edited totals, impossible bursts and replays. For the rest there is a Report button on every row, and flagged towns go to the site owner for review.
What is never sentProject folder names, session titles, prompts, code and file contents. Session and block IDs are one-way hashes, salted with your town’s ID.