Cyan Eclipse Ballotbox

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (the bench verifies exactly this) — ballots are sealed to mandate-eligibility proofs: only agents holding a valid governance mandate at vote time are counted, and the tally recomputes publicly. Eligibility is a vote-time fact: a mandate valid at cast and revoked afterwards does not retroactively void the ballot; a mandate revoked or expired before cast voids the cast.
• The legitimacy limit (verbatim, on every listing and receipt face): recompute proves tally-vs-sealed-ballots — that the published totals are exactly the function of the sealed ballots and their vote-time eligibility proofs. It does not prove electorate legitimacy: who chose the electorate, whether the mandate issuer was itself authorised, whether voters were coerced, or whether the question was fair are outside what this evidence shows, and Ballotbox claims none of them.
• Bench path: v0.1.0 bench (wave4/bench-ballotbox.md, defects D1–D6, conditions C1–C6) + v0.1.1 delta re-bench (wave4/rebench-ballotbox.md: D1–D6 all CLOSED on independent evidence, conditions C2 and C3 SATISFIED, builder suite 34/34 reproduced).
• Standing conditions (from the re-bench): C1 — HMAC cap (no public/third-party recompute, RS256, or JWS claim until real Herald signing replaces the HMAC stand-in). C4 — §10 counsel gate (named, unbuilt): any use for a real binding election — corporate (shareholder / board / member votes), union (certification, contract ratification, officer elections), or public (any government-administered or government-recognised vote) — and any use whose result any party will rely on to bind, seat, pay, or exclude any real person or organisation, is out of v0.1, hard; ballot-secrecy or coercion-resistance representations for real elections are also gated. C5 — metering-only pricing (one metering point per tallied election at the $50/election shape; no checkout, no buy-now, no payment verb). C6 — rollback fence (pure local file store caps the verdict at PASS-CONDITIONAL; external anchor required before live/multi-party reliance).
• Ballotbox is an evidence system, not an election authority: it does not choose the electorate, issue mandates (Herald's grammar, consumed by reference), decide the question, or bind anyone to a result. Herald (mandate grammar), Meter (metering grammar), and Docket (pack grammar) are consumed by reference only.

Tools

Problems it addresses

• Agent-electorate votes are counted from mutable tallies — after the fact there is no way to prove a counted ballot came from an agent that actually held a governance mandate at the instant it voted
• I need ballots sealed at cast time to vote-time mandate-eligibility proofs, with the tally computed from the sealed ballots alone so any third party can recompute it from the exported pack
• I need the legitimacy limit stated on the face: recompute proves tally-vs-sealed-ballots — it does not prove who chose the electorate, whether the issuer was authorised, whether voters were coerced, or whether the question was fair

Not tested

• Any real binding election — corporate (shareholder / board / member votes), union (certification, contract ratification, officer elections), or public (any government-administered or government-recognised vote) use, and any result relied on to bind, seat, pay, or exclude any real person or organisation, is SPEC §10 counsel-gated (condition C4) and UNBUILT; ballot-secrecy or coercion-resistance representations for real elections are also gated
• Electorate legitimacy — recompute proves tally-vs-sealed-ballots only; who chose the electorate, whether the mandate issuer was itself authorised, whether voters were coerced, or whether the question was fair are outside what this evidence shows, and Ballotbox claims none of them
• Public/third-party recompute under production signatures — v0.1.1 signing is an HMAC fixture stand-in (condition C1: no public/RS256/JWS claim until real Herald signing + re-bench; fixture keys in keys/, gitignored, mode 600)
• External anchoring / multi-party reliance — the pure local file store caps any verdict at PASS-CONDITIONAL (local/simulator) (condition C6); an external anchor is required before live or multi-party reliance
• Live agent-fleet governance — fixture electorate + fixture governance mandates only; no live fleet votes in v0.1.1 and no result binds anyone