RULED ✓ — 62% is the floor. Users may blur further; never less. Still spec-only: no pipeline built.
Craftee · floor RULED by Davi · updated 2026-07-12 20:22 WEDT · now
The ruling asks for something that sounds contradictory: a stranger must see unmistakably WHAT you're doing (stretching · exercising · sitting still) while not seeing WHO you are. Blur too little and you've published someone's face. Blur too much and the witness can't honestly attest to anything — and a witness who guesses is worse than no witness.
The finding: uniform blur fails at both jobs at once. Identity lives in high-frequency detail (face, hair, clothing, room). Activity lives in low-frequency shape (silhouette, limb angles, motion over time). So don't blur the picture — destroy the detail band and keep the shape band. Drag the slider and watch the two verdicts diverge.
✓ Ruled by Davi: 62% is the floor — the server's minimum, never less — and people can always turn it up further if they want. The slider below now starts at the floor and only goes one way.
Floor locked at 62% (Davi, 20:1x). The slider cannot go below it — that's the server-enforced minimum. You may always blur yourself further if you want more privacy; the dial only moves one way.
Time bounds are part of the proof — an image alone proves a pose; an image plus "14:02 → 14:23" proves a practice. The witness attests to the act over a duration, never to a person.
Davi ruled: 62% is the minimum, and a person may always turn it up further if they want more privacy. So the control is one-way — it cannot go below the floor, and the floor is enforced server-side, not by a client we'd have to trust.
One honest consequence, built in: past roughly 78% the act itself stops being legible. A person is free to blur that far — it's their privacy — but the interface must tell them plainly that nobody can witness what they cannot see, so that image won't earn the credit. Silently accepting an unwitnessable photo would be the cruel version of this feature: it would look like it worked, and then quietly fail them.
The questions I'd want answered before anyone writes the pipeline:
1. Blur must be enforced server-side, never client-trusted — a client that "promises"
to blur is an unblurred-upload vulnerability wearing a costume.
2. Does the original ever exist? My strong recommendation: the sharp frame is never stored,
never transmitted — blur at capture, discard the original in memory. If the crisp image never leaves
the device, it can never leak.
3. Retention — the witness attests, then what? I'd bin the media the moment the attestation
resolves; keep the verdict and the time bounds, not the picture.
4. Who can re-open it? If an admin can un-blur, then "anonymous" was never true. My read: nobody,
ever, including us.
5. Consent surface — the person must see exactly what a stranger will see, before they send it.
That preview is a design job and I'll build it once the above are ruled.
The anti-cheat frame cuts both ways here: we're tightening the system because we like people. That same care says a practice photo must never become a way to hurt the person who sent it.