Provably fair,
and we’ll prove it

I play on a "provably fair" free social casino called No More Beast (play money only). I want you to sanity-check whether their fairness scheme actually stops the house from cheating, and walk me through verifying it myself. Below is the entire scheme, the exact per-game math, and my own current data. Be skeptical.

== THE COMMIT-REVEAL SCHEME ==
1. Before I place a bet, the casino generates a secret "server seed" and shows me ONLY its SHA-256 hash (a commitment). Because the hash is fixed, they can't swap the server seed later without the hash no longer matching.
2. I supply a "client seed" (I can change it any time).
3. Each round has a "nonce" — a counter that increases by 1 for every round played on the same server/client pair.
4. Each round's raw randomness is a float stream built from HMAC blocks:
     block_k = HMAC-SHA256(key = server_seed, message = "client_seed:nonce:k")   for k = 0, 1, 2, ...
   Each 32-byte block is read as eight 4-byte BIG-ENDIAN chunks; each chunk is a uint32 divided by 2^32, giving a float in [0, 1). The stream is block 0's eight floats in order, then block 1's, and so on — a round that needs more than 8 floats keeps consuming into the next block.
5. When I "rotate" my seeds, the casino REVEALS the old server seed. I then verify SHA-256(revealed_server_seed) == the hash I was shown before betting, and re-derive every past round's floats to confirm the outcomes were exactly what the math dictates.

== PER-GAME RULES (exact) ==
Beast Flip: take the first float f0 (stream index 0). I WIN (payout x2) if f0 < 0.495. That is a 49.5% win chance; the missing 0.5% is the stated house edge. The sun/beast side I pick is pure theatre — the mapping is side-symmetric, only f0 < 0.495 decides win or lose.
Mines: 25 tiles indexed 0..24. Start with arr = [0,1,...,24] and take the first 24 floats of the stream (floats[0..23] — that's blocks 0..2). Run a downward Fisher-Yates: for i = 24 down to 1, let j = floor(floats[24 - i] * (i + 1)) and swap arr[i] with arr[j]. (floats[0] is used at i=24, floats[1] at i=23, and so on.) After the loop, the FIRST m entries arr[0..m-1] are the mine ("beast") positions, where m is the beast count I chose for the round.
Blackjack: 6 decks = 312 cards, freshly shuffled every round.
  Shoe: start with arr = [0,1,...,311] and take the first 311 floats of the stream (floats[0..310]). Run the SAME downward Fisher-Yates as Mines but over 312 entries: for i = 311 down to 1, let j = floor(floats[311 - i] * (i + 1)) and swap arr[i] with arr[j]. Cards are then consumed strictly in order from arr[0] upward — a cursor that only moves forward.
  Card encoding: a shoe entry e maps to card = e % 52; rank = card % 13 (0 = Ace, 1..8 = pip 2..9, 9 = ten, 10 = J, 11 = Q, 12 = K); suit = floor(card / 13) (0=spades,1=hearts,2=diamonds,3=clubs). Value: Ace = 11 or 1, a rank of 9..12 (ten/J/Q/K) = 10, otherwise rank + 1. A hand total counts every Ace as 11, then subtracts 10 from the total for each Ace, one at a time, while the total exceeds 21 and an Ace still counts as 11 (that is a "soft" total).
  Deal order: player card, dealer upcard, player card, dealer hole card — arr[0], arr[1], arr[2], arr[3]; the cursor then rests at 4.
  Peek: if the dealer upcard is an Ace or any ten-value card, the dealer immediately checks the hole card. If those two cards total 21 the dealer has blackjack and the round ends at once: a player two-card 21 pushes (bet refunded), anything else loses. No insurance is ever offered.
  Player natural: a two-card 21 on the original hand (no split), when the dealer does NOT have blackjack, pays 3:2 immediately — profit = floor(bet × 3 / 2), so the player gets back bet + floor(bet × 3 / 2).
  Actions: HIT draws the next card (arr[cursor++]); over 21 busts, and exactly 21 auto-stands. STAND ends the hand. DOUBLE is allowed only on the first two cards: it debits one extra bet equal to the hand's stake, draws exactly one card, then the hand stands (or busts). SPLIT is allowed only on the original two-card hand when the two cards have equal VALUE (any two ten-value cards qualify), with no re-splitting: it debits one extra bet equal to the original. On a split, hand A keeps the first-dealt card and immediately draws its second card from the shoe and is played to completion first (double-after-split allowed); then hand B draws its second card and is played. Split aces are special: each ace hand receives exactly one card and then auto-stands, and a 21 made after any split is a plain 21 (pays 1:1), never a blackjack.
  Dealer play: after every player hand is resolved the hole is revealed. If every player hand busted the dealer draws nothing; otherwise the dealer draws cards in order from the shoe until the total is 17 or more, standing on ALL 17s including a soft 17 (S17).
  Settle each hand: a busted hand pays 0. Otherwise compare totals — hand greater than the dealer (or the dealer busts) wins and pays 2× that hand's stake (stake = the bet, or 2× the bet if the hand was doubled); an equal total pushes and refunds the stake; a lower total pays 0.
Beast Blast (rocket crash): take the first float f0 (stream index 0). The crash multiplier is M = max(1.00, floor(min(0.99 / (1 - f0), 5000) × 100) / 100). The rocket's live multiplier grows with elapsed flight time t seconds as m(t) = floor(e^(0.10 × t) × 100) / 100, and the rocket crashes the instant m(t) reaches M. You win stake × (the multiplier you cashed out at) if you cash out before M; otherwise the stake is lost. Because P(M ≥ x) = 0.99 / x, the expected return for cashing out at ANY target x is x × 0.99/x = 0.99 — a flat 99% RTP independent of when you cash out, with the 1% edge living in the instant-bust mass near ×1.00. The crash point is fixed by f0 the instant you bet (committed by the seed hash), so it cannot be moved once you have launched.
Pērkons (6×5 tumble slot): the round consumes the float stream STRICTLY IN ORDER. The grid is 6 columns × 5 rows, indexed col-major (idx = col*5 + row). Initial drop: for each of the 30 cells in col-major order (col 0→5, and within a column row 0 at the top down to row 4), take one float and pick the cell from a single weighted composite table — it resolves to a scatter (Auseklis), a thunder-rune multiplier orb, or one of 9 paying symbols; if the cell is an orb it consumes ONE additional float to pick its integer multiplier value from a weighted table. Evaluate the grid: any paying symbol present 8+ times anywhere (scatter-pays, no lines) pays its tier, all cells of every winning symbol are removed, survivors fall to the bottom of their column, and the emptied top slots refill by drawing new cells in the same order (col 0→5, missing slots top→down). This "tumble" repeats until an evaluation finds no win. In the base game the sum of orb multipliers on the board multiplies the whole tumble-chain win (scatter direct-pays are added at face value, never multiplied). 4+ scatters trigger 15 free spins with a CUMULATIVE total multiplier that new orbs keep adding to; 3 / 4+ scatters seen during free spins retrigger +5 / +10 spins. "Ante" mode pays 1.25× the stake to raise the scatter weight; "Buy" mode pays 100× the stake to force 4–6 scatters on the first drop. Total win is hard-capped at 10,000× the stake. The exact weights and paytable are the sim-locked engine (RTP_VERSION "pk-1", ≈96.3% RTP); with the revealed server seed you replay the identical float stream and reproduce the exact board, every tumble, every free spin, and the payout to the cent.
Le Chat Royale (5×4 collector slot, 12 fixed paylines): the round consumes the float stream STRICTLY IN ORDER. The grid is 5 columns × 4 rows, indexed col-major (idx = col*4 + row). Base drop: for each of the 20 cells in col-major order (col 0→4, within a column row 0 at the top down to row 3), take one float and pick the cell from a single weighted composite table — it resolves to a scatter (L'Invitation), a wild (Monsieur Aristide), a money symbol, or one of 9 paying symbols; a money cell consumes ONE additional float to pick its value from a weighted table. "Buy" mode instead draws 1 float for the scatter count (3/4/5, weighted), then k floats to place the scatters by partial Fisher–Yates, then fills the remaining cells from the composite table with the scatter mass excluded. Evaluate: 12 fixed paylines pay left-to-right for 3+ of a kind (wilds substitute; a leading run of wilds pays its own premium if higher); scatters pay by count anywhere; then, if any wild AND any money symbol are present, every wild "collects" the whole money face-sum once (× wild count × the current ladder multiplier). 3+ scatters trigger free spins (10/15/20 by scatter count) on an FS table; every 4 wilds collected raises L'Ascenseur multiplier ladder (×1→2→3→5→10) and grants +5 spins (hard bound 50). Win is hard-capped at 25,000× stake. AFTER the whole slot resolves, the album card drop is the LAST draw(s): 1 float for occurrence (base 2/56, Royale 3/56), and if it occurs 1 more float for which of 12 cards (weighted) — so the slot outcome is prefix-stable and verifiable without the album. "Royale" mode pays 1.25× stake for a higher scatter weight + drop odds; "Buy" pays 100× stake. The exact weights, paytable, and album economy are the sim-locked engine (RTP_VERSION "lc-1", ≈96.5% RTP incl. album steady-state); with the revealed server seed you replay the identical float stream and reproduce the board, every free spin, the collect, and the card drop to the cent.
Sugar Storm (6×5 scatter-pay candy cascade): the round consumes the float stream STRICTLY IN ORDER. The grid is 6 columns × 5 rows, col-major (idx = col*5 + row). Base drop: 30 cells col-major (col 0→5, within a column row 0 top down to row 4), each a weighted composite draw → a Sun-Seal scatter, a Glaze Drop multiplier, or one of 9 candy symbols; a Glaze cell consumes ONE extra float for its multiplier value (in the base game the ENTRY grid carries zero Glaze weight — Glaze appears only on tumble refills). Evaluate: any symbol appearing 8+ times anywhere pays its tier (scatter-pays, no paylines) and every cell of every winning symbol is removed; survivors fall to the bottom of each column and the emptied top slots refill by drawing new cells in the same col-major order (missing top slots top→down) — this TUMBLE repeats until an evaluation finds no win. At the end of a winning tumble sequence, the SUM of all Glaze multipliers seen during that sequence multiplies its total win. 4+ Sun-Seal scatters award 10 free spins on a bonus table (Glaze on entry too); 3+ scatters during the bonus retrigger +5 spins. "Ante" pays 1.25× stake for a higher scatter weight; "Buy" pays 100× stake to force 4–6 scatters on the entry grid. Total win is hard-capped at 25,000× stake. The exact weights and paytable are the sim-locked engine (RTP_VERSION "ss-1", ≈96.5% RTP); with the revealed server seed you replay the identical float stream and reproduce every board, tumble and free spin to the cent.
Spin Royale (European single-zero roulette): the round consumes exactly ONE float for money — the first float f0 (stream index 0). The winning pocket = min(floor(f0 × 37), 36), a NUMBER in 0..36 (0 is green). Colours: red = {1,3,5,7,9,12,14,16,18,19,21,23,25,27,30,32,34,36}; every other number 1..36 is black; 0 is green. Payouts: a bet covering k pockets pays (36/k − 1) to 1, so a winning bet returns stake × 36/k cents (floor to integer cents) — a straight-up single number covers k=1 and pays 35:1; a split k=2 pays 17:1; corner k=4 pays 8:1; dozen/column k=12 pays 2:1; red/black/odd/even/1-18/19-36 cover k=18 and pay 1:1. Because every bet returns stake × 36/k on a 1/37 chance per pocket, the house edge is EXACTLY 1/37 = 2.7027% on every wager — the single green 0 is the whole edge (no La Partage or En Prison). Floats at stream indices 1..9 drive ONLY the cosmetic ball-and-wheel physics (how many turns, where it clatters); they never touch money — the animation is always solved to land on the pocket f0 already fixed. The engine (RTP_VERSION "rl-1") is sim-locked; with the revealed server seed you recompute f0, the winning pocket, and every bet's payout to the cent.
Honey Falls (16-row peg fall, plinko): the round consumes exactly SIXTEEN floats, one per row. Bounce i goes RIGHT iff float_i ≥ 0.5, else LEFT; the landing pool k = the count of RIGHT bounces (0..16), so pool k lands with probability C(16,k)/65536. The bet pays floor(bet_cents × h_k / 100) where h_k is the printed multiplier (in hundredths) of the chosen waters table (Cosy / Classic / Storm). Every table satisfies Σ C(16,k)·h_k = 6,488,070 exactly, so the RTP is exactly 6,488,070/6,553,600 = 99.000092% on every water — sum the printed pools yourself to check (rounds before 2026-07-10 used tables summing to exactly 6,488,064 = 99.00%). The replay animation re-drops the committed path bit-for-bit.
Beast Hi-Lo (same-screen table, up to 4 seats): each hand consumes exactly FOUR floats. float 0 → the anchor rank = 3 + floor(float0 × 11), a rank in 3..13 (11=J, 12=Q, 13=K); the anchor is never a 2 or an Ace so both calls always have a live outcome. float 1 → anchor suit = floor(float1 × 4) (0=♠, 1=♥, 2=♦, 3=♣ — cosmetic, no effect on money). float 2 → the NEXT rank = 2 + floor(float2 × 13), a rank in 2..14 (14 = Ace). float 3 → next suit (cosmetic). Each seat calls HIGH or LOW; the next card was already fixed by the seed at deal. Resolve per seat: if next rank == anchor rank it is a PUSH and the stake is returned; otherwise HIGH wins when next > anchor and LOW wins when next < anchor. A winning call pays stake × floor(0.99 × 12 / winCount), where winCount is the count of ranks that win the call — for HIGH winCount = 14 − anchorRank, for LOW winCount = anchorRank − 2 — i.e. payout_cents = floor(stake_cents × 1188 / (100 × winCount)). Because a tie is refunded, the expected return on every call is exactly 0.99 — a flat 1% house edge (RTP_VERSION "hl-1", 99% RTP), the same whichever side you take. Every seat at the table resolves against the SAME next card. With the revealed server seed you recompute all four floats, both cards, and each seat's payout to the cent.

== MY CURRENT PAIR (pulled live from my account) ==
server_seed_hash (the commitment I currently hold): (sign in at nomorebeast.com/fair and your live commitment appears here)
client_seed: (your client seed)
rounds played on this pair so far (current nonce): (your current nonce)
(The server seed itself is still secret — it is only revealed after I rotate.)

== WHAT I WANT FROM YOU ==
1. Explain, step by step, how to verify AFTER I rotate: how to compute sha256(revealed_server_seed) and compare it to the commitment above, and how to recompute a round's float stream and the resulting Beast Flip / Mines / Blackjack / Pērkons / Le Chat Royale / Sugar Storm / Spin Royale / Beast Hi-Lo outcome (for Blackjack: the full shoe order, hence every card dealt; for Pērkons: the full board, every tumble, and the free-spin sequence; for Le Chat Royale: the board, the free spins, the money collect, and the album card drawn last; for Spin Royale: the winning pocket from f0 and every bet's payout; for Beast Hi-Lo: the anchor and next cards from the four floats and each seat's payout).
2. Give me a short self-contained script (Python or JavaScript) I can run to do all of the above from the revealed server seed, my client seed, and a nonce.
3. Tell me honestly: does this commit-reveal design actually prevent the casino from re-rolling a result I didn't like? And what does it NOT protect against — for example, does it prove the advertised odds are fair, or only that they didn't tamper after committing?