feat: add confidential ballot reference provider

2026-08-02 03:41:01 +02:00
parent c176c5cfcb
commit 0a4e06077d
10 changed files with 1505 additions and 44 deletions
@@ -8,8 +8,11 @@ The native `recorded` assurance profile is auditable but not secret: active
 ballots are stored so that a result can be reconstructed. Confidential,
 secret, and externally certified profiles fail closed unless an explicit
 `voting.provider.<provider>` capability is installed. Providers return only
-aggregate results and evidence; raw secret ballots and provider credentials
-do not enter the Voting database.
+aggregate results and evidence through the public Voting boundary. The bundled
+`local_confidential` provider stores cast selections only as Encryption-owned
+server-envelope ciphertext in provider-specific shared SQL tables. It is
+confidential at rest, but it is not anonymous, secret, coercion-resistant, or
+externally certified.

 Committee and other modules retain their deliberation or business context and
 refer to Voting ballots through the `voting.ballots` capability. Informal