[Feature] Add the first certified Committee ballot provider #1

New Issue

2026-08-01T14:53:27+02:00

zemion commented

2026-08-01 14:53:27 +02:00

Outcome

Implement the first concrete external or secret ballot provider behind the provider-neutral Committee adapter contract.

Implemented foundation

committee.ballot_adapter.<provider> receives an exact tenant/vote/choice/eligibility request and idempotency key.
Committee validates provider identity, exact choice coverage, count totals, eligibility, tenant evidence, receipt, and SHA-256 result hash.
Provider-bound votes cannot be closed through the generic workspace route.
Only aggregate results and verifiable evidence are persisted; individual ballots are not retained in Committee.

Decisions required before selecting a provider

Provider/protocol and whether GovOPlaN hosts it or integrates an external service.
Voter eligibility issuance, authentication, anonymity and coercion-resistance expectations.
Key and operator custody, separation of duties, recount/challenge process, and result certification.
Retention and deletion of ballots/provider evidence, outage behavior, and recovery/reconciliation procedure.
Accessibility, privacy, security, and operator evidence required for the intended legal context.

Acceptance criteria after selection

Provider declaration, sanitized health/freshness state, secret handling, idempotency, outcome-unknown behavior, reconciliation, recovery docs, and target tests satisfy the platform gates.
The Committee finalization UI explains provider state and imports the certified aggregate without exposing individual ballots.
A target drill proves duplicate delivery/finalization cannot create conflicting Committee results.

## Outcome Implement the first concrete external or secret ballot provider behind the provider-neutral Committee adapter contract. ## Implemented foundation - `committee.ballot_adapter.<provider>` receives an exact tenant/vote/choice/eligibility request and idempotency key. - Committee validates provider identity, exact choice coverage, count totals, eligibility, tenant evidence, receipt, and SHA-256 result hash. - Provider-bound votes cannot be closed through the generic workspace route. - Only aggregate results and verifiable evidence are persisted; individual ballots are not retained in Committee. ## Decisions required before selecting a provider - Provider/protocol and whether GovOPlaN hosts it or integrates an external service. - Voter eligibility issuance, authentication, anonymity and coercion-resistance expectations. - Key and operator custody, separation of duties, recount/challenge process, and result certification. - Retention and deletion of ballots/provider evidence, outage behavior, and recovery/reconciliation procedure. - Accessibility, privacy, security, and operator evidence required for the intended legal context. ## Acceptance criteria after selection - Provider declaration, sanitized health/freshness state, secret handling, idempotency, outcome-unknown behavior, reconciliation, recovery docs, and target tests satisfy the platform gates. - The Committee finalization UI explains provider state and imports the certified aggregate without exposing individual ballots. - A target drill proves duplicate delivery/finalization cannot create conflicting Committee results.

zemion added the

status

needs-info

module/committee codex/needs-human area/security

area/webui area/api labels 2026-08-01 14:53:27 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-01 15:13:56 +02:00

[Epic] Adopt the institutional governance target architecture #29

zemion commented

2026-08-01 21:03:43 +02:00

Codex State: needs-info

Summary

The primary governed ballot owner is now govoplan-voting; Committee delegates recorded/provider-backed ballots through the versioned voting.ballots capability. The direct Committee provider adapter remains only as a 0.1 compatibility path.
A real confidential/secret/certified provider is still blocked on the provider/protocol, eligibility and anonymity profile, key/operator custody, challenge/recount, retention, outage, and legal assurance decisions already listed here.

Changed Files

src/govoplan_committee/backend/ballots.py
../govoplan-voting/docs/VOTING_DOMAIN.md

Verification

Committee integration suite passed (8 tests); Voting runtime and migration suite passed (5 tests).

Suggested status label: status/needs-info

## Codex State: needs-info ### Summary - The primary governed ballot owner is now govoplan-voting; Committee delegates recorded/provider-backed ballots through the versioned voting.ballots capability. The direct Committee provider adapter remains only as a 0.1 compatibility path. - A real confidential/secret/certified provider is still blocked on the provider/protocol, eligibility and anonymity profile, key/operator custody, challenge/recount, retention, outage, and legal assurance decisions already listed here. ### Changed Files - `src/govoplan_committee/backend/ballots.py` - `../govoplan-voting/docs/VOTING_DOMAIN.md` ### Verification - `Committee integration suite passed (8 tests); Voting runtime and migration suite passed (5 tests).` Suggested status label: `status/needs-info`

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-committee#1