Civic Kernel a thin protocol for public decisions

Cast a ballot

The voter's side of the vote: generate your enrolment secret, seal your choice, challenge the device that sealed it, and build the anonymous ballot file — in your browser. Your secret never leaves this page; nothing you type is sent anywhere — no network request is made except, if you press the button, to fetch the published election files from this same site. The ballot you build is a file: hand it to whoever collects them, then check it landed with the verifier page.

1 · Enrol: make your voting secret

Your device makes two linked numbers. The secret stays with you — it is how you sign anonymously and how you later find your own ballot in the public box. The public key is the only thing the club secretary gets: they certify it onto the member roster without ever seeing the secret, so not even the enrolment office can tell which ballot is yours.

2 · Load the election

Casting needs three published files: the member roster (the anonymity set your ballot hides in), the trustee setup (the key your choice is sealed to), and the log (which decision is open). From them this page rebuilds everything itself — the election key is derived from the trustees' own commitments, never taken on someone's word.

Or drop roster.json, trustees.json and log.jsonl here — or .

3 · Seal and cast

Paste your secret (or use the one you just generated). The page checks you are on the roster, seals your choice to the election key, and shows the sealed envelope before asking whether to cast it — so you may instead demand it open the envelope as a test. A page that meant to cheat cannot tell the test from a real cast.

The reference election is deliberately reproducible, so its "secrets" are public — try against it. In a real election only you hold yours.

What this page cannot protect you from — said plainly

The device itself: a compromised browser could display one choice and seal another — that is exactly what the challenge button is for; check an opened test on a different device, and cast from a clean one if it lies (a public reference implementation of the check is proto/verify.py). Someone watching you cast: the record cannot prove how you voted — there is nothing to show them afterwards — but a shoulder is a shoulder; cast again later, alone: the later ballot counts and the re-vote is invisible. The collector: if you hand or email your ballot file to the committee, the person collecting it sees who sent which file. The published record still never names you, and nobody can read your choice from the file — but the postman knows which sealed envelope was yours. A shadow-mode run accepts this and says so in its manifest; a full deployment uses an anonymous drop.