Accuracy not guaranteed. Neither is Congress's. At least we're honest about it. Always verify at Congress.gov.

Leg day: Fri → Fri (28d) Recess

Integration Blueprint

Vote Machine Integration On Raspberry Pi Test Benches

Practical lab wiring model for public working-group elections: booth hardware, trust boundaries, and run-cycle controls.

This is a test-election integration profile, not a certified election deployment profile.

Visual source: /votechain/evidence/pi-integration-board (Mermaid source is embedded directly on this page).

How To Integrate The Vote Machine

  1. Provision each booth Pi with the same signed machine runtime image and pinned runtime config.
  2. Attach fixed booth peripherals: touch display, scanner, receipt printer, UPS, tamper inputs.
  3. Connect booth Pis to isolated polling-place switch on VLAN10 (`10.10.10.0/24`) with no internet route.
  4. Export signed session bundles to transfer station and ingest one-way into VLAN20 airgap services.
  5. Mirror accepted bundles into VLAN30 central verification services for independent reconciliation.
  6. Enforce session close and machine-local reset after every voter interaction.

Pi Topology Diagrams

Boundary: Central Verify (VLAN30)

Boundary: Airgap Core (VLAN20)

Boundary: Controlled Transfer Gate

Boundary: Polling Place Zone (VLAN10)

HTTPS 443 signed bundle export

HTTPS 443 one-way ingest

HTTPS 443 mirror for central verification

Polling Boundary
VLAN10 polling LAN · Ports 22, 443, 9100

Booth Pi 1
Pi 5 vote terminal · Ports 443, 9100

Booth Pi 2
Pi 5 vote terminal · Ports 443, 9100

Booth Pi 3
Pi 5 vote terminal · Ports 443, 9100

Booth Pi 4
Pi 5 vote terminal · Ports 443, 9100

Booth Pi 5
Pi 5 vote terminal · Ports 443, 9100

Ops Pi
Poll worker operations Pi · Ports 443, 1514

Polling Switch
Layer-2 booth uplink switch · Forwards signed bundles

Transfer Boundary
One-way media validation enclave · Port 443 ingress

Export Kiosk Pi
Outbound transfer Pi · Receives bundles on 443

Import Scan Pi
Hash and malware validation Pi · Forwards to ingest on 443

Airgap Boundary
Isolated VLAN20 segment · Ports 443, 1514

Airgap Ingest
Ingress Pi service · Validates and writes events on 443

Airgap Relay
Airgap transport Pi · Relays to ledger replicas on 443

Observer Pi
Monitoring Pi · Watches role drift and ACK anomalies on 1514

Airgap Ledger Cluster
Replicas a1-a3 on Pi hosts · Append-only records on 443

Central Boundary
Verification VLAN30 segment · Ports 443, 1514

Central Ingest
Central intake host · Receives airgap mirror on 443

Central Relay
Central forwarding host · Routes to central ledger on 443

Oversight Monitor
Independent monitor host · Verification alerts on 1514

Central Ledger Cluster
Central replica set · Verification mirror and audit proof on 443

End-to-end topology from polling boundary through central verification.

Boundary: Booth Controller Runtime

Boundary: Booth Peripheral Harness

HDMI0

USB-A

USB-A

USB-A

I2C

GPIO17

eth0 RJ45

GPIO27

Peripheral Boundary
Locally cabled device harness · HDMI, USB, GPIO, Ethernet

Touch Display
Voter interaction display · Ballot UI over HDMI

QR Scanner
Optical scanner peripheral · Reads QR over USB

Receipt Printer
Thermal print peripheral · Receipts over USB

Poll Worker Key
Admin credential token reader · Unlocks ops over USB

UPS HAT
Pi power continuity module · Battery and brownout over I2C

Tamper Switch
Chassis intrusion sensor · Tamper alert over GPIO17

Booth LAN Switch
Local Ethernet access switch · Uplink on RJ45

Security Seal Sensor
Enclosure seal monitor · Seal state over GPIO27

Host Boundary
booth-pi-01 Pi 5 runtime · Ports 443, 9100, SSH 22

Booth Pi Controller
Primary voting control Pi 5 · Session signing and print handoff

Booth Pi peripheral harness.

Boundary: VLAN30 Central Segment

Boundary: VLAN20 Airgap Segment

Boundary: Transfer Gate Segment

Boundary: VLAN10 Polling Segment

HTTPS 443 signed bundle

HTTPS 443 one-way ingest

HTTPS 443 mirror channel

VLAN10 Boundary
Polling-place booth network · Ports 22, 443, 9100, 1514

Booth + Ops Cluster
Six Pi hosts on VLAN10 · Signed bundles and health events

Polling Switch
VLAN10 switch fabric · Local forwarding and uplink policy

Transfer Boundary
Quarantine handoff enclave · One-way ingest on 443

Export Kiosk
Outbound transfer service · Receives bundles from polling switch

Import Scan
Inbound validation service · Hashes and forwards clean bundles

VLAN20 Boundary
Isolated airgap subnet · Ports 443, 1514

Airgap Ingest
Intake Pi service · Validates signatures and writes entries

Airgap Relay
Transfer Pi service · Routes approved events to replicas

Observer Pi
Watchdog Pi service · Monitors ACK keys and role health

Airgap Ledger
Append-only replica set · Signed election events on 443

VLAN30 Boundary
Independent central verify subnet · Ports 443, 1514

Central Ingest
Central intake host · Pulls mirrored records on 443

Central Relay
Central routing host · Forwards mirrored stream to ledger

Oversight Monitor
Audit host service · Alerts from mirrored logs on 1514

Central Ledger
Central replica set · Verification mirror on 443

VLAN boundaries and control-plane flow enforcement.

Physical Wiring Details

  • Booth Pi host: Raspberry Pi 5 (8GB), immutable image, sealed enclosure.
  • Peripherals: HDMI touch, USB scanner, USB receipt printer, poll-worker key, UPS HAT.
  • Tamper channels: GPIO tamper switch + enclosure-open signal to sealed logs.
  • Network: wired Ethernet only for booth machines; no Wi-Fi association in test profile.

Compose Placement

Boundary: Central Runtime Placement

Boundary: Airgap Runtime Placement

Boundary: Polling Runtime Placement

HTTPS 443 signed bundle

HTTPS 443 validated records

HTTPS 443 append events

log stream 1514

HTTPS 443 mirror

HTTPS 443 route

HTTPS 443 write

integrity checks 1514

Polling Runtime Boundary
Booth subnet container placement · Ports 443, 9100, 1514

booth-pi-[1..5]
Voting host group on Pi 5 · machine-api and session-store on 443, 9100

ops-pi
Polling operations host · Health and log shipper on 443, 1514

Airgap Runtime Boundary
VLAN20 isolated deployment zone · Ports 443, 1514

airgap-ingest
Ingest service host · Verifies boundary payloads on 443

airgap-relay
Relay service host · Routes approved records to ledger on 443

airgap-ledger-a1-a2-a3
Ledger replica service group · Append-only records on 443

observer-pi
Monitoring service host · Role and ACK integrity on 1514

Central Runtime Boundary
VLAN30 verification deployment zone · Ports 443, 1514

central-ingest
Mirror intake host · Receives mirrored airgap stream on 443

central-relay
Central routing host · Forwards mirrored stream to ledger on 443

central-ledger-1-2-3
Central ledger replica set · Persists mirrored records on 443

audit-verifier
Independent audit host · Chain integrity and alerts on 1514

Container service placement per execution profile zone.
# Start stack (example test profile)
docker compose down -v --remove-orphans
docker compose up -d --build

# Execute run loop
./scripts/run-mock-election-cycle.py --machines 5 --sessions-per-machine 100 --spoil-rate 0.12 --seed 20260212

Session Loop

Boundary: Central Verify Runtime

Boundary: Airgap Runtime

Boundary: Transfer Runtime

Boundary: Booth Runtime

Boundary: Voter Session

1 present credential

2 cast or challenge and receipt

3 export signed bundle HTTPS 443

4 one-way ingest HTTPS 443

5 mirror for reconcile HTTPS 443

6 audit response HTTPS 443

7 session close and secure reset

Session Boundary
Supervised voter interaction boundary · No direct network ports

Voter Session
In-booth voter interaction · Credential, cast, or challenge

Booth Boundary
Pi 5 voting runtime · Voting app and reset on 443, 9100

Booth Pi Service
Booth controller service · Session signing and secure reset on 443, 9100

Transfer Boundary
Export and scan gateway pair · One-way movement on 443

Transfer Validation Service
Hash and malware gate · Admits signed clean bundles on 443

Airgap Boundary
Isolated ingest service runtime · Validates and writes on 443

Airgap Ingest Ledger
Ingest plus ledger write path · Persists events and emits mirror

Central Boundary
Independent verify host runtime · Reconciliation on 443, 1514

Central Verify Service
Central audit response · Mirror integrity ok or fail on 443

Harness Controller
Mock election runner · 5x100 sessions, residual cache zero

Integrity Monitor
Post-run verification · Detects duplicate vote, rogue ACK, unauthorized role

Per-voter session and reset sequence, end-to-end.

Verification Gates To Keep

  • Machine reset proof after every session with zero residual ballot/credential state.
  • Bundle signature and schema validation at ingest before any ledger write.
  • Relay ACK-key pinning with immediate degradation alert on mismatch.
  • Outbox must drain to zero before run completion.
  • Airgap and central run summaries must match cast/receipt totals.