The problem
A mailed ballot disappears for a fortnight, and nobody can prove what happened to it
It leaves a kitchen table. It enters the mail. Somewhere in there it is either received, or it isn't. If it comes back rejected, the voter often finds out too late to fix it — and if it never comes back at all, there is frequently no record that says where the trail went cold.
The obvious fix is to track it. The obvious fix is also how ballot secrecy gets destroyed: the moment one identifier can follow a package from a named voter all the way to a counted ballot, you have built the machine that proves how a person voted. That machine is useful to exactly one kind of person, and it is not the voter.
Ballot Trail is the version that refuses to build it. It records the administrative life of a ballot package — an envelope, in custody, moving through lawful process — and it is constructed so that no supported data path can join that record to a ballot's contents. Not by policy. By shape.
Lifecycle side
What this system holds
- An opaque, one-time, election-scoped token
- Its administrative status and custody events
- A restricted postal reference, where lawful
- Signatures, hash chains and batch anchors
Tabulation side
What this system never sees
- Vote selections, of any kind
- Ballot images and cast-vote records
- Any reversible voter-to-ballot mapping
- Anything that could become a receipt
The tabulator receives no voter identity, no lifecycle token, no envelope identifier and no postal reference. The lifecycle system receives no selections. Neither can query the other. How the separation actually works →
Three layers, kept apart on purpose
The postal barcode is not the credential, and the credential is not the ballot
Postal transport
A USPS serialized Intelligent Mail barcode. Useful for mailstream visibility where the authority has lawful access to the data.
What it is not: a secret, a vote credential, or proof of legal receipt. A missing scan can never, on its own, cause a rejection.
Election lifecycle token
256 random bits from a CSPRNG, scoped to one election and one jurisdiction, expiring, and usable exactly once for acceptance.
Stored as a digest, not a value. The raw token exists only long enough to be printed on the outer return envelope.
Tamper-evident log
Every authorised state change, appended and signed, chained per token, and committed in Merkle-rooted batches an auditor can independently verify.
Not a blockchain. Nothing personal is published, and there is no public ledger of individual ballot status.
The rule that does the work
Issued, minus finished, equals still in flight
Every token issued must reconcile to exactly one current state, every day, with an owner and a documented resolution for any package the count cannot explain. It is the same discipline that runs underneath Lockchain — a persistent token for every entity, a single-use token for every movement — pointed at an envelope instead of a dollar.
Working parts
Everything here runs. None of it is a mockup.
The engine is one JavaScript file. Your browser loads the same bytes the build gates import — so the demonstrations on these pages are the implementation, not a picture of it.
The state machine
All twelve states and every permitted transition. Try an illegal one and watch it fail closed and write an exception.
The event ledger
Mint a token, walk a package through its life, and watch the hash chain and Ed25519 signatures form in front of you.
Merkle anchoring
Close a batch, build the tree, pull an inclusion proof — and see the duplicate-leaf ambiguity this spec inherits, and what closes it.
Privacy separation
Dual control, the separation event, and the spend that makes a second acceptance impossible.
Voter status
The coercion-resistant interface — and the far longer list of what it must never show.
Roles & API
Who may write which event, where dual control is mandatory, and the full error model.
Reconciliation
The daily categories, the balance check, and what an unexplained package costs.
Threat model
Eleven threats, the mitigation each one demands, and the prohibitions that are not negotiable.
Verify it yourself
RFC 8032 vectors, a full ledger audit, and a poison run — executed in your browser, not asserted here.
What this is not. It is not a voting system, not a tabulator, and not a way to vote online. It does not replace registration, physical chain of custody, seals, trained staff or lawful audit. It cannot make a barcode a prerequisite for casting a legally valid ballot, and it must never be the reason a lawfully received paper ballot goes uncounted. Adoption is voluntary and controlled by the election authority — elections in the United States are run by states and local jurisdictions, and nothing here assumes otherwise.