Accuracy not guaranteed. Neither is Congress's. At least we're honest about it. Always verify at Congress.gov.

Leg day: Fri → Fri (28d) Recess

VoteChain Evidence Board

POC Engine Architecture
Diagram Board

The browser-based proof-of-concept engine: 22 modules, a versioned state machine, and a complete voter journey from credential to tally — all running client-side.

Engine Operational
Modules
22
State Version
V2
ECDSA Keys
4
Voter Roll
50,000
Persistence
localStorage

Architecture

Module Dependency Graph

22 TypeScript modules organized in three layers: crypto primitives, core engine, and UI controllers.

Boundary: Edge Replication Layer

Boundary: Cryptography Primitive Layer

Boundary: Core Engine Layer

Boundary: Browser Runtime Layer

HTTPS 443 signed replicate

Browser Boundary
Local voter browser runtime · Outbound HTTPS 443

UI Controller Group
Dashboard, verify, lookup, trust, fraud, tally, manifest views · Drives operator and voter workflows

Voter Journey Orchestrator
Session flow coordinator · Sequences credential, cast, challenge, and tally actions

State Store
PocStateV2 persistence adapter · Reads and writes election state to localStorage

Audit Surface
Browser audit and verification views · Renders proofs, logs, and reconciliation outcomes

Core Boundary
In-browser domain service layer · Runs election logic in-process with no listening ports

Engine Core
State types, encoding, and orchestration modules · Applies deterministic election state transitions

Credential Service
Credential issuance and verification · Validates blind signatures and enrollment records

Ballot Cast Service
Cast and ballot envelope modules · Builds encrypted ballots and cast events

Bulletin Board Service
Merkle and proof handling modules · Appends leaves and verifies inclusion proofs

Replication Client
VCL client and transport modules · Posts signed events to edge on HTTPS 443

Crypto Boundary
Deterministic primitive function layer · Executes cryptographic math in-process

Blind Schnorr Primitive
Credential blinding and signing · Generates unlinkable credential signatures

ECIES Primitive
Ballot key wrapping · Encrypts ballot keys using ECDH and AES-GCM

Shamir Primitive
Threshold share primitive · Splits and recombines election secrets

ECDSA Primitive
Signing and verification · Signs manifests, STH, and VCL acknowledgements

BigInt Arithmetic Primitive
secp256k1 scalar math helper · Performs modular arithmetic for all primitives

Edge Boundary
Cloudflare Pages and Worker ingress · Accepts browser replication on HTTPS 443

Replication Endpoint
/api/votechain/poc/replicate route · Validates request and routes by event type

State Machine

PocStateV2 Schema

Complete state tree persisted in localStorage. All election data lives in a single versioned object.

PocStateV2 version: 2
keys
manifest StoredKeyPair
ewg StoredKeyPair
bb StoredKeyPair
vcl StoredKeyPair
election
election_id string
jurisdiction_id string
contests PocContest[]
trustees + issuers
threshold { t: 2, n: 3 }
shares PocTrusteeShareRecord[]
issuers Array<{ sk, pk }>
issuer_threshold { t, n }
credential + voting
credential PocCredential?
challenges Record<id, ChallengeRecord>
spoiled_ballots PocSpoiledBallotRecord[]
tally PocTally?
audit trail
bb.leaves PocBbLeaf[]
bb.sth_history PocSignedTreeHead[]
vcl.events PocVclEvent[]

Bootstrap

Initialization Sequence

Steps executed when a new POC election is created.

1
Generate 4 ECDSA Keypairs manifest, ewg, bb, vcl

Each key serves a distinct signing role

2
Create Issuers (3) secp256k1 keypairs for blind Schnorr

Threshold t=2, n=3

3
Split Election Secret shamirSplit(secret, 2, 3)

Distribute shares to trustees

4
Build Manifest contests, candidates, voter_roll_size

Signed with manifest key

5
Sign + Publish ECDSA sign manifest payload

Create VCL event: election_manifest_published

6
Persist to localStorage PocStateV2 → JSON → localStorage

State ready for voter operations

End-To-End Flow

Voter Journey: Credential To Tally

The complete lifecycle of a vote through the POC engine, from credential registration to final tally.

1
Register Credential
Generate voter keypair, blind Schnorr issuance from t-of-n issuers
credential.ts
2
Issue Challenge
Server signs a Benaloh challenge with the ewg key
cast.ts
3
Encrypt Ballot
AES-GCM encrypt selections, ECIES wrap key under election PK
ballot.ts + ecies.ts
4
Challenge / Spoil OR Cast
Benaloh: open to verify, then re-encrypt. Or commit to cast.
cast.ts
5
Verify Receipt
Check BB inclusion proof, STH signature, VCL anchor event
verify.ts
6
Tally
Shamir combine shares, ECIES unwrap all ballots, aggregate, sign
tally.ts