2 minutes 15 · narrated · captioned
The film
Every frame is drawn from this app's own facts — the states, the token, the chain, the tree, the separation. Nothing in it is stock footage of a polling place.
Captions are on by default. The full transcript is below, and it is the script the narration was generated from — every clip was transcribed back and checked against it word for word before this shipped.
Jump to
Transcript
A mail ballot leaves a kitchen table. And then, for about two weeks, almost nobody can prove what happened to it.
The obvious fix is to track it. The obvious fix is also, exactly, how a secret ballot gets destroyed.
Because the moment one identifier can follow a package from a named voter all the way to a counted ballot, you have built the machine that proves how a person voted. That machine is useful to precisely one kind of person. It is not the voter.
Ballot Trail is the version that refuses to build it. It tracks the envelope. It never touches the vote.
Three layers, deliberately kept apart. A postal barcode, for mailstream visibility. An election token, for the package. And an append-only audit log, where every record is signed.
The token is two hundred and fifty six random bits. Scoped to one election. Expiring. Usable exactly once for acceptance. It is stored as a digest, never as a value, so a stolen database yields nothing anyone could print.
Every state change is hashed, chained to the one before it, and signed. Edit a record afterwards and the hash no longer matches what the record hashes to. The auditor does not have to take anyone's word.
But a chain does not catch a deletion. So every hour, the log closes a batch, builds a Merkle tree, and signs the root together with the event count. One copy goes to the authority. One copy goes somewhere the authority does not control.
When a package passes validation, two authorised officers separate the ballot from everything that identifies who sent it. Only then is the token spent. And from that moment, there is no field to join on. In either direction. With any key.
The voter sees four things. A status. One sentence. An official next step, if there is one. And a time. No token. No barcode. No history. Nothing they could be made to show somebody.
Every token issued reconciles to exactly one state, every day. Anything the count cannot explain gets an owner and a resolution. Not an explanation afterwards.
Paper stays authoritative. A missing scan can never cost anyone a ballot. And nothing here is a substitute for the law, the officials, or the procedure it was built to support.
It proves the envelope moved. It can never prove how you voted. That is the entire point.
How it was made
Cut to the voice
The narration was rendered first, one clip per line. Each scene is then exactly as long as the line it carries — the picture follows the voice rather than the voice being stretched to fit a picture. Scene lengths run from 5.0 to 14.5 seconds because the sentences do.
One overlapped timeline
Consecutive scenes cross-fade directly into one another. There is no fade to black at any cut, which is what makes a film feel like it has dead air between every scene. A build check scans the finished file for black frames and fails if it finds any.
Every word verified
Text-to-speech drops and slurs words silently. All thirteen clips were transcribed back and diffed against the script. One line came back wrong — "a signed, append-only log" had elided into "assigned append-only log" — so the line was rewritten until the elision was impossible, and re-rendered.
The tail is not eaten
Chaining crossfades shortens a timeline, which is how a closing line gets cut off. Each segment is built longer than its narration by exactly the crossfade duration, and the build fails if the finished film is shorter than the voice it carries.