Voting & quorum governance
Some governance decisions should not rest with an administrator. On System9, voting is a native entity primitive, not an application feature: entities cast ballots, and the outcome is a verifiable, secret tally that no single cell can forge or read. It maps onto real oversight topologies where an upper tier verifies signed attestations without ever seeing an individual vote.
In one paragraph
Ballots are homomorphically encrypted so the tally is computed without decrypting any single vote; blind signatures and zero-knowledge proofs preserve secrecy and correctness; a threshold ceremony requires a quorum to decrypt the result; and independent cells verify the tally by consensus, so compromising one cell reveals nothing and changes nothing.
The mechanism
| Element | What it provides |
|---|---|
| Voter eligibility | Eligibility lives in the agent fabric: who may vote is a governed property, not a caller-supplied claim. |
| Election contract | An election is governed by an entity contract, so its rules, roles, and lifecycle are the same signed contract model used elsewhere. |
| Homomorphic tally | Ballots are encrypted so the tally is computed over ciphertext: the count is produced without decrypting any individual vote. |
| Blind signatures + ZK proofs | Blind signatures and zero-knowledge ballot proofs preserve secrecy (who voted how is hidden) and correctness (a ballot is well-formed and counted once). |
| Threshold decryption ceremony | Revealing the result requires a quorum to cooperate in a decryption ceremony: no single holder can open it. |
| Consensus verification | Independent cells verify the tally by consensus, so a compromised cell cannot alter the outcome unnoticed. |
From ballot to verified result
A vote is encrypted before it leaves the voter, counted while still encrypted, opened only by a quorum, and the final tally is checked by cells that did not run the election.
*Figure: a secret ballot no single cell controls. Eligibility is governed in the agent fabric; a ballot is homomorphically encrypted, blind-signed, and carries a zero-knowledge proof; the tally is computed over ciphertext without decrypting any vote; a threshold ceremony requires a quorum to open the result; and independent cells verify the tally by consensus before it is certified.
Table equivalent
| Stage | Mechanism | Property preserved |
|---|---|---|
| Admit | Voter eligibility (agent fabric) | Only eligible entities vote |
| Cast | Homomorphic encryption + blind signature + ZK proof | Secrecy and correctness |
| Count | Homomorphic tally over ciphertext | No individual vote is decrypted |
| Open | Threshold decryption ceremony | Quorum required; no single opener |
| Verify | Consensus across independent cells | One cell cannot alter the outcome |
Why it is different
- The count never decrypts a vote. A homomorphic tally means the result is produced from ciphertext, the platform can prove how many without learning who.
- No single cell is trusted with the outcome. Threshold decryption plus consensus verification means compromising one cell reveals nothing and changes nothing.
- It reuses the platform's own primitives. Eligibility is an agent-fabric property and the election is an entity contract, voting is governance expressed in the same building blocks as everything else, not a bespoke module.
Across the deployment matrix
- Single-cell, an election runs within one cell; the cryptographic construction holds, but consensus verification is strongest with peers.
- Multi-cell, independent cells verify the tally, which is where the "no single cell controls it" property is realized.
- Sovereign / air-gapped, the ceremony and verification are cell-local cryptography with no external authority in the path.
- Cloud-enabled, identical; the mechanism does not depend on a hosted service.
Related
- Agent Governance: population, spending, and contracts alongside voting.
- Alignment, the refusal gate on a single action.
- Signing & Cryptography, the cryptographic system the ballot construction rests on.