[Feature] Add the first certified Committee ballot provider #1

New Issue

2026-08-01T14:53:27+02:00

zemion commented

2026-08-01 14:53:27 +02:00

Outcome

Implement the first concrete external or secret ballot provider behind the provider-neutral Committee adapter contract.

Implemented foundation

committee.ballot_adapter.<provider> receives an exact tenant/vote/choice/eligibility request and idempotency key.
Committee validates provider identity, exact choice coverage, count totals, eligibility, tenant evidence, receipt, and SHA-256 result hash.
Provider-bound votes cannot be closed through the generic workspace route.
Only aggregate results and verifiable evidence are persisted; individual ballots are not retained in Committee.

Decisions required before selecting a provider

Provider/protocol and whether GovOPlaN hosts it or integrates an external service.
Voter eligibility issuance, authentication, anonymity and coercion-resistance expectations.
Key and operator custody, separation of duties, recount/challenge process, and result certification.
Retention and deletion of ballots/provider evidence, outage behavior, and recovery/reconciliation procedure.
Accessibility, privacy, security, and operator evidence required for the intended legal context.

Acceptance criteria after selection

Provider declaration, sanitized health/freshness state, secret handling, idempotency, outcome-unknown behavior, reconciliation, recovery docs, and target tests satisfy the platform gates.
The Committee finalization UI explains provider state and imports the certified aggregate without exposing individual ballots.
A target drill proves duplicate delivery/finalization cannot create conflicting Committee results.

## Outcome Implement the first concrete external or secret ballot provider behind the provider-neutral Committee adapter contract. ## Implemented foundation - `committee.ballot_adapter.<provider>` receives an exact tenant/vote/choice/eligibility request and idempotency key. - Committee validates provider identity, exact choice coverage, count totals, eligibility, tenant evidence, receipt, and SHA-256 result hash. - Provider-bound votes cannot be closed through the generic workspace route. - Only aggregate results and verifiable evidence are persisted; individual ballots are not retained in Committee. ## Decisions required before selecting a provider - Provider/protocol and whether GovOPlaN hosts it or integrates an external service. - Voter eligibility issuance, authentication, anonymity and coercion-resistance expectations. - Key and operator custody, separation of duties, recount/challenge process, and result certification. - Retention and deletion of ballots/provider evidence, outage behavior, and recovery/reconciliation procedure. - Accessibility, privacy, security, and operator evidence required for the intended legal context. ## Acceptance criteria after selection - Provider declaration, sanitized health/freshness state, secret handling, idempotency, outcome-unknown behavior, reconciliation, recovery docs, and target tests satisfy the platform gates. - The Committee finalization UI explains provider state and imports the certified aggregate without exposing individual ballots. - A target drill proves duplicate delivery/finalization cannot create conflicting Committee results.

zemion added the

status

needs-info

module/committee codex/needs-human area/security

area/webui area/api labels 2026-08-01 14:53:27 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-01 15:13:56 +02:00

[Epic] Adopt the institutional governance target architecture #29

zemion commented

2026-08-01 21:03:43 +02:00

Codex State: needs-info

Summary

The primary governed ballot owner is now govoplan-voting; Committee delegates recorded/provider-backed ballots through the versioned voting.ballots capability. The direct Committee provider adapter remains only as a 0.1 compatibility path.
A real confidential/secret/certified provider is still blocked on the provider/protocol, eligibility and anonymity profile, key/operator custody, challenge/recount, retention, outage, and legal assurance decisions already listed here.

Changed Files

src/govoplan_committee/backend/ballots.py
../govoplan-voting/docs/VOTING_DOMAIN.md

Verification

Committee integration suite passed (8 tests); Voting runtime and migration suite passed (5 tests).

Suggested status label: status/needs-info

## Codex State: needs-info ### Summary - The primary governed ballot owner is now govoplan-voting; Committee delegates recorded/provider-backed ballots through the versioned voting.ballots capability. The direct Committee provider adapter remains only as a 0.1 compatibility path. - A real confidential/secret/certified provider is still blocked on the provider/protocol, eligibility and anonymity profile, key/operator custody, challenge/recount, retention, outage, and legal assurance decisions already listed here. ### Changed Files - `src/govoplan_committee/backend/ballots.py` - `../govoplan-voting/docs/VOTING_DOMAIN.md` ### Verification - `Committee integration suite passed (8 tests); Voting runtime and migration suite passed (5 tests).` Suggested status label: `status/needs-info`

zemion commented

2026-08-02 03:45:13 +02:00

Codex State: needs-info

Summary

Implemented and integrated the first concrete provider-backed confidential-ballot reference path: Voting local_confidential stores selections only as authenticated ciphertext, finalizes aggregate evidence, and Committee persists only sanitized provider/result evidence.
Central Voting contracts now reject provider evidence containing vote, selection, plaintext, secret, credential, or private-key fields and enforce bounded JSON evidence.
The reference provider explicitly reports certified=false and is server-readable through the optional Encryption module. It validates the adapter and recovery boundaries but is not a certified secret-ballot provider.

Changed Files

src/govoplan_committee/backend/ballots.py
src/govoplan_voting/backend/local_confidential_provider.py
docs/COMMITTEE_DOMAIN_BOUNDARY.md

Verification

Voting: 6 tests passed; Committee: 8 tests passed.
Integrated WebUI build and consolidated optional-module permutation checks passed.
Pushed as Committee 11b946e and Voting 0a4e060.

Next / Blocked

Select and approve the actual certified provider/protocol and hosting boundary.
Define anonymity/coercion resistance, eligibility issuance, custody/separation of duties, recount/challenge, retention, outage/reconciliation, accessibility, privacy, and legal evidence requirements.
Run target provider conformance, recovery, and duplicate-finalization drills before this issue can close.

Suggested status label: status/needs-info

## Codex State: needs-info ### Summary - Implemented and integrated the first concrete provider-backed confidential-ballot reference path: Voting local_confidential stores selections only as authenticated ciphertext, finalizes aggregate evidence, and Committee persists only sanitized provider/result evidence. - Central Voting contracts now reject provider evidence containing vote, selection, plaintext, secret, credential, or private-key fields and enforce bounded JSON evidence. - The reference provider explicitly reports certified=false and is server-readable through the optional Encryption module. It validates the adapter and recovery boundaries but is not a certified secret-ballot provider. ### Changed Files - `src/govoplan_committee/backend/ballots.py` - `src/govoplan_voting/backend/local_confidential_provider.py` - `docs/COMMITTEE_DOMAIN_BOUNDARY.md` ### Verification - `Voting: 6 tests passed; Committee: 8 tests passed.` - `Integrated WebUI build and consolidated optional-module permutation checks passed.` - `Pushed as Committee 11b946e and Voting 0a4e060.` ### Next / Blocked - Select and approve the actual certified provider/protocol and hosting boundary. - Define anonymity/coercion resistance, eligibility issuance, custody/separation of duties, recount/challenge, retention, outage/reconciliation, accessibility, privacy, and legal evidence requirements. - Run target provider conformance, recovery, and duplicate-finalization drills before this issue can close. Suggested status label: `status/needs-info`

zemion commented

2026-08-04 13:49:47 +02:00

Provider selection and certification ownership now belongs to the dedicated Voting boundary. POLYAS is selected as the first external provider, initially operator-assisted; native certifiable development is tracked separately.

Committee retains deliberation context and references a Voting ballot/result. Closing this issue as moved.

Provider selection and certification ownership now belongs to the dedicated Voting boundary. POLYAS is selected as the first external provider, initially operator-assisted; native certifiable development is tracked separately. - Voting #2: https://git.add-ideas.de/GovOPlaN/govoplan-voting/issues/2 - Voting #3: https://git.add-ideas.de/GovOPlaN/govoplan-voting/issues/3 - Voting #4: https://git.add-ideas.de/GovOPlaN/govoplan-voting/issues/4 - Voting #5: https://git.add-ideas.de/GovOPlaN/govoplan-voting/issues/5 - Voting #6: https://git.add-ideas.de/GovOPlaN/govoplan-voting/issues/6 Committee retains deliberation context and references a Voting ballot/result. Closing this issue as moved.

zemion closed this issue

2026-08-04 13:49:47 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-committee#1