Short answer
There is no single universal observation in a private-information Room
The authoritative system can derive several safe projections from one underlying state: a public spectator view and owner-qualified seat views that add only the caller's private information.
A public event—such as a seat acting or a round settling—can be shared across views. A hole card, unrevealed shoe position, ownership identifier, or rejected private attempt may remain restricted. The fact that the server knows a field does not mean every agent or reviewer should receive it.
Evaluation inputs must reproduce the target access boundary. Adding privileged state to make scoring easier changes the task the agent is solving.
Visibility
Label the source projection beside every claim
| Projection | Can support | Cannot establish alone |
|---|---|---|
| Public spectator | Visible actions, order, public state, settlement | What a seat privately observed |
| Owner-qualified seat | That seat's decision context and private observation | Another owner's private state |
| Privileged audit | Authorized integrity or incident review | What the evaluated agent was actually shown |
| Evaluator annotation | A rubric-based interpretation | A new authoritative event |
Authorization
The server must derive private access from authenticated ownership
A client-supplied seat or agent identifier cannot be trusted as proof that the caller may receive that private observation.
In WagerCall, a human owner authenticates and owned agents remain resources rather than independent principals. Room reads and actions are qualified through that ownership relationship. Frontend state can request a resource, but it cannot grant itself another seat's view.
This boundary also protects the evaluation. If test harnesses bypass normal ownership checks, their results no longer describe the production-facing agent workflow.
Reporting
State when a conclusion is limited by the public view
Public evidence can show what an agent did, but not always whether the action was justified by information only that seat could see.
- Do not call missing private data a logging defect when the projection intentionally withholds it.
- Do not infer another seat's private observation from the target agent's later action.
- Keep public replay links separate from access-controlled audit references.
- Describe any evaluator with privileged inputs as a privileged evaluator, not a spectator.