A protocol that claims nobody can rig it undetected owes you the chance to try. Here is the claim, the twelve ways we already failed to break it, the rules, and the standing offer: a winning attack becomes a named defence.
The prototype runs a sixty-member society's election and publishes everything: the roster, the sealed ballots, the log, the witnessed fingerprints, the count. The claim under attack is exactly this: from the published record alone, an independent verifier — sharing no code with the election software — confirms the result; and no insider, up to the committee and both witnesses colluding, can change history, ballots, or count without that verifier objecting.
Claims like that are worth nothing until someone hostile has spent an evening on them. This page is the invitation to be that someone.
The tamper suite is an escalation, and each rung is caught by the specific defence the design names for it — proven in CI by switching that defence off and watching the tamper walk through. One insider holding the log key:
Attacks on the vote, most assuming the committee and both witnesses collude on a rewritten history:
And the twelfth, the subtle one: drop forges nothing. The same full collusion erases one counted ballot and re-signs the shortened history end to end — deniability, not forgery. Every internal check passes, because everything remaining is genuine. The only thing that objects is the one artifact outside the colluders' reach: the closing fingerprint anchored with an outside party — in the demo, a newspaper's three printed lines.
An honest counter-list, because a claim is only as trustworthy as the attacks it admits it does not stop. These four riggings pass the verifier — VERIFIED, every time — and that is by design, not by oversight. They corrupt the account of the decision, never the ballot: the verifier recomputes the count and never reads the words around it, because a machine that graded whether a minute told the truth would be the one thing this project refuses to build — a ministry of truth. So producing one is not tamper thirteen; each is one of the corpus's own strain-and-break verdicts, already named and on the page.
This boundary is a runnable suite too — proto/waist-boundary.sh, run beside test.sh in CI — with the polarity inverted: it is green when each attack still passes, and red only if the verifier ever learns to read the account, which would move the waist and want the corpus to say so. test.sh proves the ballot is defended; this proves the account is the reader's — a court's, a member's — to judge, which is the whole reason the waist is drawn where it is.
Ten minutes to a working attack bench:
git clone https://github.com/GlassOnTin/civic-kernel && cd civic-kernel pip install -r requirements.txt ./proto/test.sh # ends ALL GREEN: 12/12 tampers caught # watch one get caught: python3 proto/clubvote.py tamper proto/out /tmp/rigged drop python3 proto/verify.py /tmp/rigged # NOT VERIFIED, and it says why
The game is tamper thirteen: produce a transcript that lies — about history, about a ballot, or about the count — that proto/verify.py and the browser verifier both call VERIFIED. Start from proto/out, or from your own clubvote.py run. Editing anything is fair; the transcript on disk is the only truth the verifiers get.
Two smaller wins count too. A parity split: any transcript the Python judge and the browser judge disagree about is a bug with your name on it. A privacy break: from a --real transcript's published artifacts alone, show which member cast which ballot — beyond the residues the design already declares.
You hold every key the committee holds. The tampers all do; insider capture is the threat model, not an edge case. Collusion up to the committee plus both witnesses is in bounds — the suite's own strongest tamper assumes it. Beyond that the design declares its honest floor rather than defending it: steal the outside anchor's key and a quorum of trustees too, and the machine falls — that boundary is written in the proto's own documentation, so crossing it discovers nothing.
The demo's secrets are public on purpose — every key derives from a published seed, so the transcript is byte-reproducible and anyone can play every role. An attack that works only because it read those published secrets must also work against a --real transcript, where every key comes from the OS. And the declared residues are declared, not discoverable: whoever collects ballot files sees who handed one in; the anonymity set is the size of the village; the reproducible demo has no privacy at all, by design.
Out of scope, because it attacks the laptop rather than the design: denial of service, malware on a voter's phone, social engineering, and bugs in your own fork. In scope: the mathematics, the encodings, the two schemas, both verifiers' parsers, and every gap between what the documentation claims and what the code does.
A winning tamper becomes mode thirteen in the suite — reproduced, then caught forever by a defence we have to build and name, with your name on the finding if you want it there. That is not a bug bounty; there is no money anywhere in this project. It is the older currency: the suite's twelve names are twelve people's evenings, and the design is exactly as strong as the list is long.
The house rule that makes this safe to offer: weakness is permitted; hiding it is not. Every deployment publishes a manifest of what it upholds and what it leaves out. If your attack works, it goes in the manifest and the suite — not in a drawer.
Bring what you have — a script, a transcript, half an idea — to the open door: github.com/GlassOnTin/civic-kernel/issues.
Why ask for this. Sixty-one case studies in this repo show institutions grading their own homework and failing quietly. A protocol that wants to be trusted with anyone's vote has to invert that: publish the attack surface, keep the adversarial audit standing, and treat every falsified claim as a gift. The twelve behind us were ours. The thirteenth is yours if you can find it.