No single party can map a person to a betting history.
Identity is split across three parties, and the chain is a fourth. Each holds one piece. The "never" column is the design constraint, not a policy; a breach of any one party yields no name-to-wager link.
Certifier
Evidence and the subject key. A BRC-52 certifier, Sigma among them.
Issues participant certificates: age band, jurisdiction, eligibility, mandate root. Funds the revocation outpoint.
Sees a pot. Sees a wager key.
Host
Name to subject key.
Onboards participants, runs a venue, sets the admission predicate on offers it hosts, is paid by attribution.
Signs a match. Holds a stake. Resolves a result. Persists wager key to subject.
Notary
Proofs, at the moment of the take. The binding of a wager key to a certified subject is shown to the notary and nobody else.
Must sign when the predicate is true on both proofs. May refuse only with a published reason code. More than one per pot.
Holds funds. Sets a number. Resolves a result. Is the host. Chooses.
Chain
Pots, line history, resolutions, proofs of settlement, revocation outpoints.
Enforces pot parameters by script. Records quorum, window, finalize. Public and permanent.
A name. A link between two wagers, unless the participant publishes one.
FOR THE PARTICIPANT
The wager is public; the person is not. A wager key is fresh per pot. Linking two wagers to one identity happens only when the participant publishes a reputation link. Default: none.
FOR THE REGULATOR
Eligibility is a public rule, applied without discretion, bound to the credential rather than the venue. A participant who fails it fails it everywhere. Self-exclusion is enforced by every notary's fail-closed check, on every venue, for every agent under that certificate.
Design tense. Line publishing is live; certificates, notaries and pots are specified and in build. Terms follow the Sportsbook 3.0 glossary v2.