Accuracy not guaranteed. Neither is Congress's. At least we're honest about it. Always verify at Congress.gov.

Leg day: Fri → Fri (28d) Recess

VoteChain Evidence Board

Worker Ledger Architecture
Diagram Board

Three Cloudflare Workers with Durable Object ledgers, role-based event routing, hash-chain tamper evidence, and three-gate authentication.

Nodes Synchronized
Node Roles
3
Event Types
7
ACK Signatures
ECDSA
Hash Chain
SHA-256
Storage
Durable Objects

Infrastructure

Three-Node Worker Topology

Browser events flow through a Pages Function router to the appropriate Worker based on event type. Each node only accepts its assigned event types.

Boundary: Worker Node Mesh

Boundary: Public Edge Entry

HTTPS 443 replicate POST

manifest and tally types HTTPS 443

credential ballot STH types HTTPS 443

fraud flag action types HTTPS 443

index hash signature

index hash signature

index hash signature

Edge Boundary
Cloudflare edge ingress · Port 443

Browser Client
Voter browser POC session · HTTPS 443

Pages Function Router
replicate.ts edge routing · Cookie + event dispatch

Worker Boundary
Federal/state/oversight fleet · DO ledger writes · Port 443

Federal Worker
Manifest + tally authority · Hash-chain append

State Worker
Credential + ballot + STH authority · Hash-chain append

Oversight Worker
Fraud review authority · Hash-chain append

Signed ACK Packet
Replication receipt {index, hash, ack_sig} · HTTPS 443

Routing Rules

Role-Based Event Routing

Each event type has a designated originating node. The ORIGINATING_TYPES_MAP determines routing.

Event Type Target Node Purpose
election_manifest_published Federal Election configuration + contest definitions
tally_published Federal Final election results after threshold decrypt
credential_issued State Voter credential issuance record
ewp_ballot_cast State Encrypted ballot cast with nullifier
bb_sth_published State Bulletin board signed tree head snapshot
fraud_flag Oversight Suspected fraud detection event
fraud_flag_action Oversight Fraud case status transition

Tamper Evidence

Durable Object Hash Chain

Each ledger entry's hash depends on the previous entry, creating an append-only tamper-evident chain.

Entry 0
hash = SHA256("" + "\n" + canonical(event₀)) Genesis entry (no predecessor)
Entry 1
hash = SHA256(entry[0].hash + "\n" + canonical(event₁)) Depends on entry 0
Entry n
hash = SHA256(entry[n-1].hash + "\n" + canonical(event_n)) Each entry chains to its predecessor
Tamper-evidence: Modifying any past entry changes its hash, which cascades through all subsequent entries. SQLite storage in Durable Objects ensures single-writer consistency.

Data Flow

Replication Request Flow

Step-by-step sequence from browser POST to signed acknowledgement.

1
Browser POST VCL client sends event to /api/votechain/poc/replicate
2
Turnstile Cookie Check Pages Function validates session cookie (HMAC-SHA256)
3
Route to Worker ORIGINATING_TYPES_MAP[event.type] → target node URL
4
Bearer Auth Worker validates write token in Authorization header
5
DO Append LedgerNode Durable Object appends event, computes hash chain
6
Sign ACK + Return ECDSA sign { index, hash } → return entry + ack to browser

Security

Three-Gate Authentication

Every replication request must pass through three independent authentication layers.

Gate 1
Turnstile
Cloudflare human verification challenge. Sets a session cookie on success.
TURNSTILE_SECRET_KEY
Gate 2
Session Cookie
HMAC-SHA256 signed cookie with expiry. Validated on every request by the Pages Function.
POC_ACCESS_COOKIE_SECRET
Gate 3
Bearer Write Token
Per-node secret token in Authorization header. Worker rejects requests without a valid token.
VOTECHAIN_*_WRITE_TOKEN