Extraction
A bounded, host-minted token that names something about a run without describing it.
DICE compares these and stores them and parses nothing out of them. Every one of them exists so an audit can ask "which runs share this actor?" or "which runs ran under this deployment?" without DICE holding a user object, a session object, or a personalization payload.
The contract a host takes on when it mints one:
It is a pseudonym. Not an email address, not a username, not a phone number, not a customer number, not a name — nothing that identifies a person on its own.
It is not dereferenceable into anything sensitive. Not a URL, not a signed link, not a bearer token, not an API key, not a session cookie value.
It carries no authorization. Holding one grants nothing; DICE never presents it to anything.
It is stable enough to group by and cheap enough to rotate. A host that wants to break the link between a subject and its past runs rotates the token, and the old runs stay grouped among themselves.
What the type can enforce, and what it cannot. Construction bounds the length and restricts the characters to A-Z a-z 0-9 . _ : ~ -, which rules out whitespace, control characters, @, / and \ — so an email address, a URL, a file path and a human name are all rejected outright, and the common shapes of a leaked identifier cannot be stored. It cannot tell a pseudonym from a username, or a random token from a customer number: jdunnam and 55512345 both pass. The last mile of that contract is the host's, and the design note says so in the same words.
toString shows only the first TOKEN_PREVIEW_LENGTH characters, so a token does not spread through logs and exception messages in full. Validation messages never quote the token at all.
Equality is by exact type and token together, so an actor token and a session token that happen to hold the same string are two different references.
EXPERIMENTAL. The shape may still change while extraction runs (DICE #67) land.