Cold War spies worked under watch with a short list of field rules, the "Moscow rules". Anyone keeping a surprise works under watch too.
Need to KnowKeep a surprise under wraps until the reveal
Say what the surprise is and how many days you have. Put everyone who knows into three rings, tune in the shared channels that could give it away, and watch the fuse. Then get a field briefing: every leak with a plug, briefs for the people who need one, six field rules, a check of your cover story and a countdown.
1 The surprise
2 Who knows
One person per line, as Name or Name - note. Up to 12 per ring, 80 characters a line.
The page's flags
3 Tune in the leaks
Tick every channel you share with the person kept in the dark.
The fuse
The loudness bars are the page's own playful estimate, not a measurement: a channel the mark meets every day without looking starts loud, a longer fuse (over 45 days) gives each channel one more bar, and the last two days take one away. The plan rates each leak for your surprise.
4 Draw up the plan
One run threat-models the secret: a leak for every channel you ticked (and up to two from your worries) with a risk level and a plug, briefs for the people the page flagged, six field rules, a check of your cover story, a countdown that ends on the reveal day and what to do if the mark gets suspicious.
The verdict is a fixed rule on the high-risk leaks: lockdown for 3 or more, patch the leaks for 1 or 2, airtight for none.
5 Case files
How the free side works
The rings are drawn straight from your lines. The flags are plain rules in your browser: a note with a word such as son, daughter, niece, kid or toddler, or an age under 13, flags a child in the know; "lives with", housemate or roommate flags someone close to the mark; the same name in two rings is flagged; ten or more people make a big circle, and more than 60 days make a long fuse. The dial shows the channels you ticked with the page's loudness guess, and the fuse burns from today to the reveal.
A returned plan is checked against your form: the verdict against the rule, a leak for every ticked channel and none for an unticked one, briefs for every flagged person with the ring you gave them, six field rules, cover holes only when you gave a cover, a countdown inside your days that ends on the reveal day with no weekday or clock time, the word limits, no he or she, and no internal field names in the text.