Design §2
What each layer proves
Most arguments about election technology are really arguments about which layer someone thinks is doing the work. The useful column in this table is the third one.
| Layer | Primary function | Typical evidence | What it does not prove | Role here |
|---|---|---|---|---|
| USPS serialized barcode | Postal routing and mailpiece visibility | Postal-originated mailstream scan events, when available | Legal ballot acceptance, voter identity, ballot contents, or complete custody | Transport identifier — linked to the election record, never used as the security credential |
| Election lifecycle token | One-time package authorization and state control | Issuance, intake, review, cure, acceptance, void and reissue events | How the voter voted | The primary election workflow credential |
| Physical chain of custody | Secure handling of envelopes and ballots | Seals, transfer records, dual control, inventory reconciliation, observer logs | Integrity of software or postal telemetry by itself | Required operational control — technology supplements it, never replaces it |
| Signed append-only log | Detectable history of system and custody actions | Signed records, sequence numbers, prior-event hashes, periodic commitments | Physical handling that was never observed or recorded | The canonical system of record for the token lifecycle |
| Batch hash anchoring | Evidence against retroactive log alteration | A signed Merkle-root commitment for a bounded batch of events | Correctness of the original input data | Hardening, added after the core log works |
| Public blockchain | Shared consensus ledger | Publicly replicated records | Ballot secrecy, correctness of off-chain inputs, or lawful election administration | Not used Not used |
The two rows that carry the argument
"Physical chain of custody does not prove the integrity of software or postal telemetry by itself"
And the reverse is equally true, which is the whole point. A perfect cryptographic log tells you the record has not been altered. It cannot tell you the record matches the paper. Only counting the envelopes does that. This is why reconciliation is a first-class part of the system rather than an administrative afterthought — it is the only check that crosses from the digital record to the physical one.
"A public blockchain does not prove ballot secrecy, correctness of off-chain inputs, or lawful election administration"
Every property a blockchain would add here, the signed append-only log plus anchored batch commitments already provides — tamper evidence, ordering, independent verification — without publishing anything.
And the properties it does not provide are exactly the ones that matter. It cannot make a scanner honest. It cannot make an intake clerk's entry correct. Consensus about a wrong input is a durable wrong input, and durability is the last thing you want from an error in a voter's record.
The cost is not neutral either. Public replication of individual lifecycle records is a voter-surveillance dataset that cannot be recalled. This system's anchors are signed hashes held in two independently controlled stores — one of them outside the election authority — which delivers the tamper evidence without the publication. How the anchoring works →
Explicitly out of scope, from the design document's opening line: vote-content capture, vote tabulation, voter-facing proof of selections, public blockchain, cryptocurrency, and mandatory video verification. None of these is a feature deferred to a later phase. They are excluded by design, and the prohibitions page lists them alongside the rest.
The design principle underneath
The postal barcode is an input and a transport signal. The lifecycle token is the election authorization and status credential. The paper ballot remains the secret ballot.
Three sentences, three different jobs, three different identifiers — and the failure mode of almost every proposed alternative is collapsing two of them into one. A single identifier that is both the postal reference and the election credential is a credential printed in plain sight on the outside of an envelope. A single identifier that is both the election credential and the ballot's identity is the machine that proves how someone voted.