patrickz
Before you start
A chat assistant and a paper or local prototype with two fictional players. No access to private source is required.
Why this lesson exists
The archived card-game case study is useful for a general trust-boundary exercise. No access to its private source is needed.
Do the exercise
Set your boundary
Stay offline for the first version: one pass-and-play round for two fictional players, plus a table of every fact and who may see it (player A, player B, everyone, server only). Add rooms and realtime only after that table is agreed.
Play one offline round
Build an offline pass-and-play round for two fictional players.
Separate public and private state
Define public and private state as separate schemas.
List who may see each fact
Make a table of every fact and who may see it: player A, player B, everyone or server only.
Next sessions, not today
- Rooms and join codes Add rooms and join codes so two devices can share a round.
- Seat tokens Assign each seat an unguessable token.
- Server-side hands Move private-hand creation to the server.
- Realtime updates Add realtime updates for public state, then test with two ordinary browser sessions, not only one developer account.
A prompt to adapt
Replace the bracketed parts with your own details.
Help me model private information in a two-player card game, in a new practice folder or on paper. Stay offline for the first version: one pass-and-play round for two fictional players, plus a table of who may see each fact. No rooms, join codes, seat tokens, server-side hands or realtime updates yet. If code is involved, list the setup commands before changing files. Then work in three checkpoints and, after each, tell me how to check it: 1. An offline pass-and-play round. 2. Public and private state defined as separate schemas. 3. A table of every fact and who may see it: player A, player B, everyone or server only. Then show the exact data each player would receive and confirm neither contains the other hand. My game in one sentence: [rules]. My tool: [a language you know, or paper].
When the first round works, share it and ask:
Write acceptance tests for this offline two-player round. Prove that each player receives only their own hand, one turn action updates public state correctly, a round reset clears both hands, and neither player’s view contains the other hand. Mark which tests will need a server once rooms and realtime updates are added.
Run this experiment
Draw the data returned to each player. Confirm neither response contains the other hand. Add reconnect and round reset without broadening that visibility.
Check your result
Use evidence from your output. A confident explanation from the AI is not enough.
If it isn’t working
A hidden UI element does not protect data already sent to a browser. Private values must stay out of unauthorized responses.
Optional. Progress stays in this browser.
Where this came from
Adapted from an archived project architecture write-up. Its repository is private; this lesson uses only a general practice scenario and requires no private source code. Project coverage.
Prepared September 2026. Tools and interfaces change; use current official setup instructions. Session lengths are estimates.