Invalidate a hash of a sequence of values given only the first N elements of a sequence? I want to develop a system where before some activity is performed, the user is sent a hash of a sequence of values which will be an inputs to the activity.
The number of possible values is fixed and values are not repeated in the sequence.
This I can do:
After the activity, the actual full sequence is sent to the user, so that the user can validate that the sequence of inputs was the sequence promised by computing the hash themselves.
Caveat:
During the activity, not all of the data from the sequence is consumed. Ideally, I don't want to send ALL of the original sequence to the user. I want to only to send first N elements that were used. Of course I cannot have the values in the sequence somehow discoverable using the hash.
Is this possible?
I see there is something called a Merkle Tree which seems to be able to prove set membership but it is not clear to me if this can prove order as well. Also this seems to be potentially leaky if there is only a limited set of values.
Ok, here's how to generate a commitment to a sequence of values, where it is easy to open the commitment to any initial subsequence.
Here's how it works; suppose the values you are committing to are $M_1, M_2, ..., M_n$.  Then, the committer picks a random value $R$, and with a preimage-resistent hash function, recursively computes the sequence:
$$I_{n} = R$$
$$I_{k} =  \text{Hash}( I_{k+1}, M_{k+1}) \text{ for $k \in \{0, ..., n-1\}$}$$
Then, the commiter publishes the value $I_0$.
Then, when the verifier gets the values $M_1, M_2, ..., M_N$, the committer can prove those are the first $N$ values of the commitment by publishing the vlaue $I_N$.  The verifier can then compute the series of hash functions to verify that the end hash is the same as the commitment.

I see there is something called a Merkle Tree which seems to be able to prove set membership but it is not clear to me if this can prove order as well.

A Merkle tree can verify it; the above suggestion can be viewed as a Merkle tree (just a rather oddly shaped one), optimized for proving the initial sequence.  If you need to prove more general subsets (e.g. the values $M_N$ through $M_N'$), a balanced Merkle tree would be more flexible (but with higher complexity)

Also this seems to be potentially leaky if there is only a limited set of values.

Nope; because $R$ is selected randomly, the verifier cannot test a potential sequence of $M_i$ values based on the commitment.