sequenceDiagram
    autonumber
    participant U as User
    participant C as Client / AI Agent
    participant I as Identity Provider
    participant A as Resource Auth Server
    participant R as Resource (MCP Server)

    U->>I: Single sign-on
    I-->>C: ID Token
    C->>I: Token exchange (ID Token + target resource)
    Note over I: Enterprise admin policy evaluated here
    I-->>C: ID-JAG
    C->>A: JWT authorization grant (ID-JAG)
    A-->>C: Scoped access token
    C->>R: Request with access token

The user is never redirected through a per-server consent screen, and the enterprise sees and governs every grant.

• Thread contention. A single-threaded game loop with a custom SynchronizationContext, so async/await works with zero locks, zero concurrent collections, and no data races possible in game code.
• Timers. A three-layer hierarchical timer wheel, 4,096 slots per layer, O(1) insert and cancel.
• Multi-threaded serialization. Parallel world saves: chunked fan-out across workers, pre-sized per-worker heaps, longest-processing-time scheduling. A 10M-entity, 1.7 GB world saves in ~78 ms across 24 cores.
• Pathfinding. Bitmap A* over prebaked per-chunk walkability bitmaps, 2–5× faster in steady state.
• Wire protocol. A zero-allocation binary protocol built on Span<byte>, stackalloc, and function-pointer handlers.
• Low-level networking. IORingGroup, zero-copy socket I/O unifying io_uring, Windows Registered I/O, and kqueue behind one submission/completion interface.
• Source generation. SerializationGenerator, a Roslyn generator emitting versioned serialization across ~4,200 types.

Telling a real Pokémon from a forged one was a hard and genuinely fun problem: decide, from bytes alone, whether a legitimate process produced this record. That's the question device attestation and token issuance ask, and I got to meet it first in a place where being wrong cost nothing.

In 2008 I went looking for a way to tell whether a rare event Pokémon was genuine, and found that there wasn't one. My research led me to SCV, a UCLA PhD student who took his handle from his field, several complex variables. The community he was part of had already established that the games' randomness was predictable, and he taught me the mathematics behind it: how one seed correlates a dozen traits that look independent. Those findings were scattered across forum threads and nobody had assembled them. Twenty-five days after I wrote down what a checker would have to prove, I shipped the first one, posting as Sabresite. It read save files people already had on their own cartridges, it needed no knowledge from the person running it, and it was the first program that could tell you whether a Pokémon was real.

SCV and I founded Project Pokémon in 2009 to keep the work going, and it's still running seventeen years later. What came out of that community is the part worth pointing at. PKHeX is the save editor and legality checker almost everyone uses now, and it validates against the Events Gallery, the preservation archive we started. PokeFinder predicts the games' RNG on real hardware, so you can obtain a specific Pokémon by just playing. Gen 5 shipped with a Mersenne Twister and 64-bit seeds in place of the generator everyone had characterized.

Legality checking also stopped being a hobbyist concern. The 2023 World Championships disqualified players for hacked Pokémon after full storage checks, and an analysis of 850+ competitive rental teams found roughly 17% of Worlds teams carrying them. The fields those checks read are event flags and met data, which are two of the rules I wrote down in that June 2008 post.

I care about this for the same reason I like protocol work. Event Pokémon were being sold to people who had no way to know what they were buying, and the fix wasn't a rule. It was making authenticity checkable by anyone, for free. That was the goal in the first post I ever wrote about it, in June 2008: "At least now everyone can get a legit shiny US event pokemon for free." I'm a preservationist, a completionist, and I don't believe money should be a barrier to something you love.

How you prove a save-file record is genuine when nothing about it is documented. Two independent fingerprints, and a forgery has to survive both.

The PRNG. A legitimate Pokémon's traits aren't independent of each other. Nature, gender, ability, shininess, and its six hidden stats all fall out of a single seed. Edit any one of them and the correlation breaks, even though every individual value still looks perfectly ordinary. Nothing about this is visible in the game.

Trash data. The game writes names into fixed-size buffers and doesn't clear what was there before, so every record carries residue. Which residue depends on how that Pokémon came to exist, which is why a Pal Park transfer looks different from a Mystery Gift. Once the community had established what that residue should look like for each origin, the checker could use it as a second fingerprint. Forgers don't reproduce it, because nothing tells them it's there.

I believe we were the first to document that combination: a statistical check plus a structural one, each catching what the other misses.

The rest was rules, and there were a lot of them. Encounter type against location and level, ability against evolution stage, EV totals, bred-only moves on Pokémon that were never bred, met dates, Pal Park transfers cross-checked against the ball they were caught in, and whether a Drifloon was caught on a Friday, because Fridays are the only day it appears. Authenticity checking turns out to mean modeling the entire world the artifact came from, which is also true of the identity work.