Make the draw a commit-reveal at a fixed, confirmed, quorum-agreed height with a public proof (B-73, RND-14 … RND-20, RND-33 … RND-37, DAT-61 … DAT-66, API-25, API-45, AUD-24 … AUD-27, AUD-37, ELC-15, SEC-56, ADR-24, ADR-25)

The seed was the hash of the first block seen after the close, so a miner holding tickets
could withhold blocks until one made them win, the active Electrum server could pick which
real block was used by not announcing another (a failed corroboration even moved the draw to
the next block), and the participant order was the server-only `broadcast_at` with no
tie-break, so nobody could recompute the result.

- Open: every round gets a 32-byte `server_seed`, stored only Fernet-encrypted with the
  master-xprv key (`server_seed_enc`), with its published `server_seed_hash`;
  `draw_confirmations` is copied from round_config. The plaintext column is written only by
  the reveal.
- Entering `drawing` (one transaction, `draw_committed` audit row): participants ordered by
  bet txid, each `draw_position`, `participants_hash` (sha256 of `txid:vout:address\n`
  lines; new `bet_vout`), `draw_height = tip_at_close + 1`. A tip of 0 keeps the round
  `closing` (`draw_baseline_tip_unknown`, once per round). All persisted, so a resumed draw
  reads rather than recomputes (the `_tick` branch itself is B-81).
- `_complete_draw` / `_wait_for_draw_block` replace `_wait_for_next_block`: wait for
  `draw_confirmations` blocks from `draw_height`, then `ElectrumListener.agreed_block_hash`
  asks every server, the active one included, for the header at that exact height (valid
  work, >= 2 other answers, strict majority of all); no agreement means the same height is
  asked again and `draw_header_corroboration_failed` is written once per distinct reported
  hash. `draw_stalled` now counts from the last tip advance, or from when the quorum started
  to fail. Seed = sha256(server_seed || block_hash || participants_hash), index = seed mod n.
- The winner, the seed and the reveal (`server_seed`, `winner_drawn` payload) are written in
  one transaction; a round closing with no participants reveals too. A round opened before
  this change (no commitment) is given a secret as it enters `drawing`.
- `GET /rounds/{id}/proof` (public, 404 `round_not_found`, translated in all 7 languages) and
  the new fields on `GET /rounds/current`; `draw_confirmations` in `/admin/config` and the
  /admin form; `server_seed_hash`/`draw_height` in `/admin/rounds`, never the secret.
- Alembic d3e8b15a7c42 (plain add_column / create_index, expression indexes untouched).
- Docs: the B-73 `*Stato:*`/`*Oggi:*` lines are gone, guides and CLAUDE.md describe the new
  draw. Ambiguities resolved in api.md: the proof's participants also carry `amount_sats`
  (RND-37 lists it); `seed` is decimal in the proof and hex in the audit row, as specified.

Tests changed because the spec changed: ElectrumListener.corroborate_header (asked only the
other servers about the block the active one announced) is replaced by agreed_block_hash and
its quorum tests ported; draw_winner takes the secret and the list fingerprint; the four
_wait_for_next_block scheduler tests are replaced by _wait_for_draw_block ones (fixed height,
confirmations, same-height retry, stall clock). New: test_draw_proof.py recomputes the winner
independently from the public proof, checks the plaintext secret is nowhere in the database,
the API or the log before the reveal, and that a second pass over a `drawing` round yields
the same winner. Mutation-checked: ordering by broadcast_at, an early reveal and asking the
tip instead of the draw height each fail tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/rounds/draw.py

@@ -1,4 +1,5 @@
 import hashlib
+import secrets
 
 # Byte offsets of a standard 80-byte block header: version(4) + prev_block(32) +
 # merkle_root(32) + timestamp(4) + bits(4) + nonce(4).
@@ -68,8 +69,8 @@ def header_meets_its_own_target(header_hex: str) -> bool:
     a real but implausibly low self-chosen difficulty: a server could still declare
     an easy target and grind it out with modest hardware. That residual risk is why
     the draw additionally requires the winning block's header to be corroborated by
-    the *other* configured servers before using it as the seed (see
-    ElectrumListener.corroborate_header and rounds/scheduler.py:_wait_for_next_block)
+    the configured servers at a fixed height before using it as the seed (see
+    ElectrumListener.agreed_block_hash and rounds/scheduler.py:_wait_for_draw_block)
     rather than relying on this check alone.
     """
     header_bytes = bytes.fromhex(header_hex)
@@ -88,12 +89,56 @@ def header_meets_its_own_target(header_hex: str) -> bool:
     return hash_int <= target
 
 
-def draw_winner(participants: list[str], block_hash_hex: str) -> str:
-    """v1 draw algorithm (docs/ciclo-di-vita-del-round.md): seed = block hash as an
-    integer, index = seed mod participant_count, winner = participants[index]. Anyone
-    can recompute and verify it from public data. Deliberately simple/replaceable."""
+def sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def new_server_seed() -> str:
+    """B-73 (RND-34, DAT-64): a round's secret — 32 random bytes from the OS CSPRNG, as
+    64 lowercase hex characters."""
+    return secrets.token_bytes(32).hex()
+
+
+def server_seed_commitment(server_seed_hex: str) -> str:
+    """`server_seed_hash`: sha256 of the secret's 32 bytes, published from the opening of
+    the round so the operator cannot change the secret afterwards (RND-34)."""
+    return sha256_hex(bytes.fromhex(server_seed_hex))
+
+
+def participants_hash(rows: list[tuple[str, int, str]]) -> str:
+    """The fingerprint of the ordered draw list (RND-14): sha256 of one `txid:vout:address`
+    line per participant, in `draw_position` order, each line ending in `\n`, UTF-8. `txid`
+    is the bet transaction's, lowercase hex as explorers show it; `vout` is the output paying
+    the round's pool address, in decimal; `address` is the participant's own."""
+    text = "".join(f"{txid}:{vout}:{address}\n" for txid, vout, address in rows)
+    return sha256_hex(text.encode("utf-8"))
+
+
+def draw_seed(server_seed_hex: str, block_hash_hex: str, participants_hash_hex: str) -> int:
+    """RND-17: sha256 of the secret (32 bytes), the hash of the block at `draw_height` (32
+    bytes, in the order explorers show it) and `participants_hash` (32 bytes), read as an
+    unsigned big-endian integer. Nobody who lacks the secret can predict it, and the
+    operator, who knows the secret, cannot know the block when committing to the list."""
+    digest = hashlib.sha256(
+        bytes.fromhex(server_seed_hex) + bytes.fromhex(block_hash_hex) + bytes.fromhex(participants_hash_hex)
+    ).digest()
+    return int.from_bytes(digest, "big")
+
+
+def draw_index(seed: int, participant_count: int) -> int:
+    """The winner's `draw_position`: seed modulo the number of participants. Every
+    participant holds exactly one position, so odds are equal whatever the amount."""
+    if participant_count <= 0:
+        raise ValueError("no participants to draw from")
+    return seed % participant_count
+
+
+def draw_winner(participants: list[str], server_seed_hex: str, block_hash_hex: str, participants_hash_hex: str) -> str:
+    """The v1 draw algorithm (docs/ciclo-di-vita-del-round.md RND-17), recomputable by anyone
+    from the public proof (GET /rounds/{id}/proof): `participants` are the entries in
+    `draw_position` order, the winner is the one at `draw_index(draw_seed(...), n)`. Deliberately
+    simple and replaceable."""
     if not participants:
         raise ValueError("no participants to draw from")
-    seed = int(block_hash_hex, 16)
-    index = seed % len(participants)
-    return participants[index]
+    seed = draw_seed(server_seed_hex, block_hash_hex, participants_hash_hex)
+    return participants[draw_index(seed, len(participants))]