Accuracy not guaranteed. Neither is Congress's. At least we're honest about it. Always verify at Congress.gov.

Leg day: Fri → Fri (28d) Recess

VoteChain Evidence Board

Fraud Detection Lifecycle
Diagram Board

How fraud cases are detected, tracked through a structured state machine, and anchored on the VCL with cryptographic signatures for permanent auditability.

Controls Verified
Statuses
7
Actions
7
Anchor
VCL
Signatures
ECDSA
Node
Oversight

Lifecycle

Fraud Case State Machine

Each fraud case follows a structured path from detection through investigation to resolution. Actions transition between statuses.

Boundary: Action Policy Layer

Boundary: Oversight Fraud Runtime

take_case

start_investigation

escalate

resolve_cleared

resolve_confirmed_fraud

resolve_system_error

status unchanged

Oversight Boundary
Oversight worker + DO · Ports 443, 1514

pending_review
Newly detected fraud case · Awaits reviewer assignment

triaged
Reviewer-owned case · Priority and scope confirmed

investigating
Active investigation · Collecting evidence and testing hypotheses

escalated
High-risk escalation · Routed to elevated oversight

resolved_cleared
Cleared resolution · Closed as non-fraud

resolved_confirmed_fraud
Confirmed fraud · Closed with fraud evidence

resolved_system_error
System issue · Closed as platform or harness defect

Action Boundary
nextStatusByAction policy map · Constrains transitions · Port 443

note action
Informational audit · Appends note without status change

Transitions

Action to Status Mapping

The nextStatusByAction map defines valid transitions. Actions not in the map leave the status unchanged.

Action To Status
take_case triaged
start_investigation investigating
escalate escalated
resolve_cleared resolved_cleared
resolve_confirmed_fraud resolved_confirmed_fraud
resolve_system_error resolved_system_error
note unchanged

Audit Trail

VCL Fraud Events

Both fraud_flag and fraud_flag_action events are recorded on the VCL, signed with the VCL key, and replicated to the oversight node.

fraud_flag 2026-02-11T21:16:48Z
flag_type duplicate_nullifier
severity high
nullifier 0x3a7f...c2d1
kid vcl-key-001
sig ECDSA signature (base64url)
fraud_flag_action 2026-02-11T21:20:12Z
action take_case
from_status pending_review
to_status triaged
reviewer_id oversight-reviewer-1
sig ECDSA signature (base64url)
fraud_flag_action 2026-02-11T21:35:00Z
action resolve_cleared
from_status investigating
to_status resolved_cleared
note "Duplicate detection triggered by test harness"
sig ECDSA signature (base64url)
All fraud events are replicated to the oversight node via ORIGINATING_TYPES_MAP. The oversight Worker's Durable Object ledger maintains an independent, hash-chained record of all fraud activity.

Field Test

Security Controls Tested

Six controls exercised during the air-gapped field test demonstration.

Duplicate Check-in
6 blocked / 21 attempts
Same voter credential presented twice — rejected at nullifier check
Unregistered Voter
3 blocked / 21 attempts
Invalid credential signature — blind Schnorr verification fails
API Nullifier Defense
PASS
Direct API bypass attempts rejected at nullifier derivation check
Rogue Relay
PASS
Invalid relay role rejected at node startup validation
ACK-Key Spoof
DETECTED + RECOVERED
Observer degraded then recovered within one monitoring interval
Random Spoils
59 / 57 spoiled
Benaloh challenge rate preserved across both test runs

Provenance

Evidence Accumulation Chain

Each fraud case accumulates signed evidence from detection through resolution, creating a complete provenance trail.

1
Detection

Automated check triggers fraud flag (e.g., duplicate nullifier, signature mismatch)

2
Flag Payload

flag_type, severity, evidence_strength, nullifier, election context

VCL event: fraud_flag (signed with VCL key)
3
Reviewer Actions

Each take_case, investigate, note, escalate adds a signed action record

VCL event: fraud_flag_action (signed)
4
Resolution

Final status + reason_code + note, signed and anchored on oversight ledger

PocFraudCaseActionRecord with from/to status