Accuracy not guaranteed. Neither is Congress's. At least we're honest about it. Always verify at Congress.gov.

Leg day: Fri → Fri (28d) Recess

Engineering Field Report

Air-Gapped Runtime Demonstration (February 11, 2026)

What was built, what was verified, what failed, and what still has to be proven before real-election deployment.

Status: Ready for public working-group test elections and adversarial drills. Not certified for a binding public election.

This report documents demonstrated capabilities and unresolved certification, legal, and operational requirements.

Deep technical appendix: /votechain/field-report-technical

Visual diagram board and PNG exports: /votechain/evidence/diagram-board

Raspberry Pi integration blueprint: /votechain/pi-integration

Subsystem Evidence Boards

What Was Built

The open-source runtime now includes a full polling-place stack that can run on Raspberry Pi-class hardware with an explicit air-gap boundary and a separate central verification boundary.

  • Polling-place machine API/runtime for casting, challenge, verify, and close workflows.
  • Air-gap anchor plane: ingest, relay, and three replicated air-gap ledger nodes.
  • Central plane: ingest, relay, and three replicated central ledger nodes.
  • Observer services for health, consistency, and outbox-state verification.
  • Hardened Compose topology with strict mode support (no host-exposed service ports).
  • Bearer auth + allow-list controls for machine and ingest boundaries.

How The Demonstration Was Run

  1. Generate mock voter-session data with random spoil behavior.
  2. Run 5 polling-place machines with 100 sessions per machine (500 total sessions).
  3. Reset machine-local state after each voter session.
  4. Ingest each signed bundle into both air-gap and central planes.
  5. Wait for both relay outboxes to drain and verify ledger convergence.

Measured Results

Run Sessions Spoiled Cast Winner Verification
20260211T211648Z 500 59 441 cand_a (226) passed
20260211T211810Z 500 57 443 cand_b (225) passed

Both runs showed zero pending outbox events at completion, matching receipt counts for non-spoiled ballots, and converged index/hash values across all three nodes in each ledger plane.

Run-level derived metrics

Run Spoil rate Cast completion rate Outbox pending at finish Ledger consistency
20260211T211648Z 11.8% (59/500) 88.2% (441/500) 0 matched
20260211T211810Z 11.4% (57/500) 88.6% (443/500) 0 matched

Per-machine sample split (run 20260211T211648Z)

Machine Sessions Spoiled Cast Reset checks passed
machine-1 100 12 88 100/100
machine-2 100 11 89 100/100
machine-3 100 14 86 100/100
machine-4 100 10 90 100/100
machine-5 100 12 88 100/100

Evidence Examples

The excerpts below are representative samples from run artifacts. IDs are shortened and non-essential fields are omitted for readability.

Example: run report summary

{
  "run_id": "20260211T211648Z",
  "machines": 5,
  "sessions_total": 500,
  "spoiled_total": 59,
  "cast_total": 441,
  "receipts_total": 441,
  "airgap_outbox_pending": 0,
  "central_outbox_pending": 0,
  "airgap_nodes_consistent": true,
  "central_nodes_consistent": true
}

Example: duplicate-vote rejection

2026-02-11T21:24:07Z machine-3 vote.reject
reason=NULLIFIER_COLLISION
credential_id=cred_3f1e...
nullifier=nf_7b9d...
session_id=sess_302

Example: rogue ACK-key detection and recovery

2026-02-11T22:01:13Z observer status=DEGRADED
component=relay-airgap issue=ACK_KEY_MISMATCH pending_events=1

2026-02-11T22:03:42Z relay-airgap config_restored=true

2026-02-11T22:03:58Z observer status=HEALTHY
component=relay-airgap pending_events=0

Example: session reset verification

2026-02-11T21:18:52Z machine-1 session=sess_117 reset.check=PASS
residual_ballot_cache=0 residual_receipt_cache=0 residual_credentials=0

2026-02-11T21:19:23Z machine-1 session=sess_118 reset.check=PASS
residual_ballot_cache=0 residual_receipt_cache=0 residual_credentials=0

Adversarial Simulation Outcomes

Duplicate-vote attempts

  • 21 attempts total: 12 allowed check-ins, 6 duplicate check-ins denied, 3 unregistered denied.
  • Forced bypass attempts at the machine API were rejected with nullifier collision errors.
  • No non-nullifier rejection category appeared in the demonstrated run.

Unauthorized node behavior

  • Relay startup blocks invalid node roles outside federal/state/oversight.
  • Runtime ACK-key spoofing produced a pending outbox record and degraded observer status, then recovered after restoring valid relay config.

What We Learned

  • End-to-end session lifecycle is executable at realistic polling-place concurrency.
  • Random spoil handling is preserved through bundle export, ingest, and verification.
  • Machine reset between sessions is operationally viable in automated cycles.
  • Key detection controls for duplicate voting and rogue-node behavior work as designed.
  • Independent audit verification can be automated and signed as part of each cycle run.

What Is Still Missing

  • Election certification or legal authorization in any U.S. jurisdiction.
  • Full independent third-party audit package and formal certification artifacts.
  • Jurisdiction-specific integration with pollbook, chain-of-custody, and canvass procedures.
  • Complete operational readiness for statewide scale and election-night incident response.

Notes Along The Way

  • Initial Compose hardening with fully internal networks blocked host health checks in the demo harness; strict mode was retained as a separate operator profile.
  • Strict profile transitions were reliable only after clean stack resets (`down` then `up`) to avoid stale container-network DNS behavior.
  • The independent audit tool required schema and tolerance updates to accept new run-report fields and post-run ledger growth.
  • Rogue-node simulation scripting required portability fixes to run on both macOS and Linux toolchains.

Next Gate Before Any Real Election Use

  1. External cryptographic/protocol and secure-code audits with public findings.
  2. Jurisdiction-by-jurisdiction legal and procedural mapping with election authorities.
  3. Independent red-team and live failover drills under formal observer oversight.
  4. Certification-track evidence package aligned to federal and state requirements.