How do you form a group nobody can admit they’re in?

你如何组建一个没人敢承认自己身在其中的群体？

Arun invoiced a design agency ₹1,20,000 in January. It’s August. He is in a 4,000-member designers’ Discord. He could post the agency’s name right now and warn everyone. He won’t, and you already know why: the freelancer who publicly names a client stops getting briefs. He’d pay for it alone, and everyone else would benefit. Arun 在一月份向一家设计代理公司开具了 12 万卢比的发票。现在已经是八月了。他身处一个拥有 4000 名成员的设计师 Discord 群组中。他现在就可以把这家公司的名字发出来警告所有人。但他不会，原因你已经知道了：公开点名客户的自由职业者将不再收到工作邀约。他会独自承担后果，而其他人则坐享其成。

Here’s the part that makes it a systems problem rather than a sad story. Three other people in that same Discord are owed money by that same agency. None of them knows. Each one is running the same arithmetic Arun is, arriving at the same answer, and saying nothing. Four people who together have real leverage. Individually, none of them can afford the first move. 这就是为什么这不仅仅是一个悲伤的故事，而是一个系统性问题的原因。在同一个 Discord 群组里，还有另外三个人也被同一家代理公司拖欠了款项。他们彼此并不知情。每个人都在做着和 Arun 一样的算术题，得出同样的结论，然后保持沉默。这四个人加在一起拥有真正的筹码，但单打独斗时，他们谁也承担不起率先发难的代价。

I built an agent for this over a hackathon weekend. The interesting part wasn’t the AI. It was that every obvious solution destroys the thing you’re trying to protect. 我在一个黑客马拉松周末为这个问题构建了一个代理程序。有趣的部分不在于人工智能，而在于每一个显而易见的解决方案都会摧毁你试图保护的东西。

The obvious version, and why it dies: “Just make a private channel for victims of bad clients.” To join, you say who burned you. Now the group knows. One screenshot and Arun is on a list. “Okay, collect reports centrally and only reveal at a threshold.” Better. This is roughly how Callisto Vault handles assault reports, and it’s a good pattern. But it reveals the group to its own members at the threshold. Four people now know each other’s names and amounts. Four times the leak surface, arriving exactly when things get tense. 显而易见的版本及其失败原因：“为受害客户建立一个私密频道。”要加入，你得说出是谁坑了你。现在群组知道了。一张截图，Arun 就上了黑名单。“好吧，集中收集报告，达到阈值后再披露。”这更好一些。这大致是 Callisto Vault 处理侵权报告的方式，是一个很好的模式。但它在达到阈值时会将群组成员暴露给彼此。四个人现在知道了对方的名字和金额。泄露风险增加了四倍，而且正是在局势最紧张的时候。

The requirement I ended up with was stricter than I expected: Nobody is exposed. Not to the channel, not to the accused, and not to each other — not even after it works. Which sounds impossible, because how do four people coordinate if they can’t know who they are? They don’t. The agent knows. Nobody else does. 我最终确定的需求比预想的更严格：没有人会被暴露。不对频道暴露，不对被指控方暴露，也不对彼此暴露——即使在事情解决后也是如此。这听起来不可能，因为如果四个人不知道对方是谁，他们怎么协调？他们不需要知道。代理程序知道就行了，其他人都不需要知道。

The public board that can’t name the client: Here’s what actually appears in the Discord: 无法点名客户的公共看板：以下是 Discord 中实际显示的内容：

PICKET · matter #1 > “invoiced in January, still chasing in August” ₹50k–2L · 180d+ overdue 🟩⬜⬜⬜ 1/4 joined [ JOIN ] PICKET · 事项 #1 > “一月开票，八月仍在追讨” 5万–20万卢比 · 逾期 180 天以上 🟩⬜⬜⬜ 1/4 已加入 [ 加入 ]

One sentence Arun wrote himself. An amount band, not his figure. A counter. The agency’s name is nowhere on it, in any state, ever. That’s the whole trick, and it’s easy to misread as “we’re being cautious”. It isn’t caution. The accused agency might be in that Discord. The board has to be safe to read for the very person it’s about. So the board can’t tell you who it is. 这是 Arun 自己写的一句话。一个金额区间，而不是他的具体数字。一个计数器。代理公司的名字在任何状态下都不会出现在上面。这就是全部的诀窍，人们很容易将其误读为“我们很谨慎”。这并非谨慎。被指控的代理公司可能就在那个 Discord 群里。这个看板必须让被指控者本人阅读起来也是安全的。所以，看板不能告诉你它是谁。

Which raises the obvious problem: how does a real fellow-victim recognise it? They don’t recognise it. They guess. And then they prove it. You tap JOIN, and the agent DMs you the intake steps: email us, and name the client yourself. That’s the admission test. Not a password, not an invite code. It’s the one thing only someone in the same situation would know. Get it right and your pip fills. Get it wrong and your claim is held, sealed, and nobody is told anything. Crucially you don’t learn whether you guessed right, so nobody can use the system to fish for the name. 这就引出了一个显而易见的问题：真正的受害者如何识别它？他们不需要识别。他们去猜。然后去证明。你点击“加入”，代理程序会私信你接入步骤：给我们发邮件，并亲自说出客户的名字。这就是准入测试。不是密码，也不是邀请码。这是只有处于同样处境的人才会知道的一件事。猜对了，你的进度条就会填满。猜错了，你的申诉会被封存，没人会被告知任何信息。关键在于，你不会知道自己是否猜对了，所以没人能利用这个系统来套取名字。

The column I refused to write: When you tap JOIN, the bot knows your Discord identity. When you email, it knows your address. Storing discord_id → claimant_id would be one line and would make a dozen features easier. That line is the entire attack surface. One leaked table and every claimant is public. So the bot never says who tapped, and the join reply is written to be impossible to personalise. 我拒绝撰写的专栏：当你点击“加入”时，机器人知道你的 Discord 身份。当你发邮件时，它知道你的地址。存储 discord_id 到 claimant_id 的映射只需要一行代码，会让十几个功能实现起来更容易。但那一行代码就是整个攻击面。一旦表格泄露，所有申诉人都会被公开。所以机器人从不透露是谁点击了加入，且加入回复被设计为无法个性化。

Negotiating for people you never introduce: At four matching claims, one email goes to the agency: four documented claims, the combined total, the age of the oldest. No names. The agency offers 60%. And this is where the design either holds or collapses. The tempting move is a group thread: “they’ve offered 60%, what do we all think?” Convenient, and it hands everyone’s identity to everyone else at the worst possible moment. Instead each claimant gets their own sealed email: For your claim it means: ₹72,000 (60% of your ₹1,20,000). Their slice. Their decision. Three accept, one refuses. Three claims settle, one stays open independently. Nobody was outvoted, because there was never a vote. The client is told “3 of 4 accepted”, not which three. They still don’t know each other. That’s not a limitation of the build. That’s the product. 为从未谋面的人进行谈判：当有四项匹配的申诉时，一封邮件会发给代理公司：包含四项记录在案的申诉、总金额以及最长逾期时间。没有名字。代理公司提出支付 60%。这就是设计成败的关键。诱人的做法是建立一个群聊：“他们提议支付 60%，大家怎么看？”这很方便，但在最糟糕的时刻将每个人的身份暴露给了其他人。相反，每个申诉人都会收到一封独立的密封邮件：对于你的申诉，这意味着：7.2 万卢比（你 12 万卢比的 60%）。这是他们自己的份额，他们自己的决定。三人接受，一人拒绝。三项申诉达成和解，一项独立继续。没有人被少数服从多数，因为根本没有投票。客户只会被告知“4 人中有 3 人接受”，而不是哪 3 人。他们依然互不相识。这不是构建上的局限，这正是产品的核心。

Two problems I didn’t see coming: Who decides admission? Matching “that media agency in Andheri, the blueprint one” to Blueprint Media Pvt. Ltd. is exactly what an LLM is good at. So my first version asked the model: does this claim belong? That makes a hallucination-prone component the doorman for a group of people trying to stay hidden. The fix is one word. The model is never asked “should this be let in?”, only “which of these existing things does it look like, if any?” Admission is then if key != matter.canonical_key. I tested it with “Blueprint Constructions”. Same first word, different company. Returns None. Not because the prompt asks nicely, but because the comparison happens in Python. Same rule everywhere: the model can read a messy claim, read the attached invoice, classify a reply. It cannot let anyone in, move any state, or put a number in an outgoing email. When the client writes “sixty percent”, the 60 is only used because code checks that number literally appears in their own sentence. 我没预料到的两个问题：谁来决定准入？将“安泰里那家媒体代理公司，蓝图那家”匹配到 Blueprint Media Pvt. Ltd. 正是 LLM 的强项。所以我最初的版本问模型：这个申诉属于这里吗？这让一个容易产生幻觉的组件成为了试图保持隐匿的群体的守门人。解决方法只有一个词。模型永远不会被问“应该让它进来吗？”，只会问“它看起来像这些现有事项中的哪一个（如果有的话）？”准入条件是 key != matter.canonical_key。我用“Blueprint Constructions”测试过。第一个词相同，公司不同。返回 None。不是因为提示词写得好，而是因为比较是在 Python 中完成的。到处都是同样的规则：模型可以阅读混乱的申诉、阅读附件发票、分类回复。它不能让任何人进入、不能移动任何状态，也不能在发出的邮件中填入数字。当客户写下“百分之六十”时，60 这个数字被使用，仅仅是因为代码检查到该数字确实出现在了他们自己的句子中。

Why should the agency believe any of this? Their reasonable reply to “four people are owed money” is: prove it isn’t one person with four inboxes and a good afternoon. I reached for a hash chain first. It proves nothing. I control the whole thing and can rebuild it in a second with any timestamps I want. It’s a diary that catches you erasing a page, written by the person holding the pen. 代理公司为什么要相信这一切？他们对“四个人被欠钱”的合理回应是：证明这不是一个人用四个邮箱在一下午编造出来的。我首先想到的是哈希链。但这证明不了什么。我控制着整个系统，可以在一秒钟内用任何我想要的时间戳重建它。这就像是一本日记，虽然能抓到你撕掉一页的行为，但它本身就是由握笔的人写的。