Metadata-Version: 2.4
Name: govoplan-voting
Version: 0.1.18
Summary: Governed voting, ballot assurance, tally, and certification for GovOPlaN.
Author: GovOPlaN
Requires-Python: >=3.12
Description-Content-Type: text/markdown
Requires-Dist: govoplan-core>=0.1.18
Requires-Dist: govoplan-access>=0.1.18

# GovOPlaN Voting

`govoplan-voting` owns governed ballot definitions, frozen electorate
snapshots, ballot casting and replacement, deterministic tallying, result
certification, challenges, annulment, and provider evidence.

The native `recorded` assurance profile is auditable but not secret: active
ballots are stored so that a result can be reconstructed. Confidential,
secret, and externally certified profiles fail closed unless an explicit
`voting.provider.<provider>` capability is installed. Providers return only
aggregate results and evidence through the public Voting boundary. The bundled
`local_confidential` provider stores cast selections only as Encryption-owned
server-envelope ciphertext in provider-specific shared SQL tables. It is
confidential at rest, but it is not anonymous, secret, coercion-resistant, or
externally certified.

Committee and other modules retain their deliberation or business context and
refer to Voting ballots through the `voting.ballots` capability. Informal
preference and availability collection remains in `govoplan-poll`.

See [the domain and assurance boundary](docs/VOTING_DOMAIN.md) for operations,
security, recovery, and integration details.

POLYAS is the first planned external provider; its bounded operator-assisted
profile and integration prerequisites are documented in
[the POLYAS provider profile](docs/POLYAS_PROVIDER_PROFILE.md). Development of
a native certifiable provider follows the staged, independently evaluated
[certifiable Voting program](docs/CERTIFIABLE_VOTING_PROGRAM.md).
