@openvtc/trust-tasks 0.26.25 → 0.26.26

package/src/voting/board/read/0.1/payload.ts

@@ -3,7 +3,7 @@
  * Source: specs/voting/board/read/0.1/payload.schema.json
  */
 
-import type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, DigestMultibase, ElectionId, ElectionResult, Ext, Key_VotingV0_1 as Key, LifecycleEntry, Multibase_VotingV0_1 as Multibase, QuestionResult, ReplacementEntry, ResultEntry } from "../../../../_shared/components.js";
+import type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, ConfirmationEntry, Dealing, DealingEntry, DecryptionTarget, DigestMultibase, ElectionId, ElectionKey, ElectionKeyEntry, ElectionResult, ElGamalCiphertext, EncryptedCast, EncryptedCastEntry, Ext, GroupElement, GroupScalar, JustificationEntry, Key_VotingV0_1 as Key, LifecycleEntry, Multibase_VotingV0_1 as Multibase, PartialDecryption, PartialDecryptionsEntry, QuestionResult, ReplacementEntry, ResultEntry, SealedPayload, SealedShare, SigmaProof, SpoiledEntry, TransportKey, TransportKeyEntry, TrusteeIndex, UnsealedEntry } from "../../../../_shared/components.js";
 
 
 /**
@@ -51,7 +51,7 @@ export interface VotingBoardReadResponsePayload {
 }
 
 /** Shared definitions this specification references, re-exported under the names it used to declare them with. */
-export type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, DigestMultibase, ElectionId, ElectionResult, Ext, Key, LifecycleEntry, Multibase, QuestionResult, ReplacementEntry, ResultEntry };
+export type { Answer, Ballot, BoardEntry, BoardHead, Cast, CastEntry, ConfirmationEntry, Dealing, DealingEntry, DecryptionTarget, DigestMultibase, ElectionId, ElectionKey, ElectionKeyEntry, ElectionResult, ElGamalCiphertext, EncryptedCast, EncryptedCastEntry, Ext, GroupElement, GroupScalar, JustificationEntry, Key, LifecycleEntry, Multibase, PartialDecryption, PartialDecryptionsEntry, QuestionResult, ReplacementEntry, ResultEntry, SealedPayload, SealedShare, SigmaProof, SpoiledEntry, TransportKey, TransportKeyEntry, TrusteeIndex, UnsealedEntry };
 
 /** Trust Task type URI. */
 export const TYPE_URI = "https://trusttasks.org/spec/voting/board/read/0.1" as const;
@@ -263,20 +263,203 @@ export const PAYLOAD_SCHEMA = {
               "$ref": "#/$defs/ElectionResult"
             }
           }
+        },
+        {
+          "title": "EncryptedCastEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "cast"
+          ],
+          "properties": {
+            "kind": {
+              "const": "encryptedCast"
+            },
+            "cast": {
+              "$ref": "#/$defs/EncryptedCast"
+            }
+          }
+        },
+        {
+          "title": "TransportKeyEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "transportKey"
+          ],
+          "properties": {
+            "kind": {
+              "const": "transportKey"
+            },
+            "transportKey": {
+              "$ref": "#/$defs/TransportKey"
+            }
+          }
+        },
+        {
+          "title": "DealingEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "dealing"
+          ],
+          "properties": {
+            "kind": {
+              "const": "dealing"
+            },
+            "dealing": {
+              "$ref": "#/$defs/Dealing"
+            }
+          }
+        },
+        {
+          "title": "ConfirmationEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "trustee",
+            "complaints"
+          ],
+          "properties": {
+            "kind": {
+              "const": "confirmation"
+            },
+            "trustee": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "complaints": {
+              "type": "array",
+              "maxItems": 64,
+              "items": {
+                "$ref": "#/$defs/TrusteeIndex"
+              }
+            }
+          }
+        },
+        {
+          "title": "JustificationEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "dealer",
+            "recipient",
+            "share"
+          ],
+          "properties": {
+            "kind": {
+              "const": "justification"
+            },
+            "dealer": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "recipient": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "share": {
+              "$ref": "#/$defs/GroupScalar"
+            }
+          }
+        },
+        {
+          "title": "ElectionKeyEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "electionKey"
+          ],
+          "properties": {
+            "kind": {
+              "const": "electionKey"
+            },
+            "electionKey": {
+              "$ref": "#/$defs/ElectionKey"
+            }
+          }
+        },
+        {
+          "title": "PartialDecryptionsEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "trustee",
+            "partials"
+          ],
+          "properties": {
+            "kind": {
+              "const": "partials"
+            },
+            "trustee": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "partials": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 100000,
+              "items": {
+                "$ref": "#/$defs/PartialDecryption"
+              }
+            }
+          }
+        },
+        {
+          "title": "UnsealedEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "leafIndex",
+            "ballot"
+          ],
+          "properties": {
+            "kind": {
+              "const": "unsealed"
+            },
+            "leafIndex": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "ballot": {
+              "$ref": "#/$defs/Ballot"
+            }
+          }
+        },
+        {
+          "title": "SpoiledEntry",
+          "description": "A sealed cast that did not open, or opened to no valid ballot: not counted (CONVENTIONS §9.7).",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "leafIndex"
+          ],
+          "properties": {
+            "kind": {
+              "const": "spoiled"
+            },
+            "leafIndex": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
         }
       ]
     },
-    "ElectionResult": {
-      "title": "ElectionResult",
-      "description": "An election's result, computable by anyone who can read its board from the board and the registration alone (VTI-VOT-070).",
+    "Ballot": {
+      "title": "Ballot",
+      "description": "An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.",
       "type": "object",
       "additionalProperties": false,
       "required": [
         "electionId",
         "manifestDigest",
-        "ballotsCounted",
-        "questions",
-        "head"
+        "answers"
       ],
       "properties": {
         "electionId": {
@@ -285,51 +468,1050 @@ export const PAYLOAD_SCHEMA = {
         "manifestDigest": {
           "$ref": "#/$defs/DigestMultibase"
         },
-        "ballotsCounted": {
-          "type": "integer",
-          "minimum": 0
+        "answers": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "$ref": "#/$defs/Answer"
+          }
+        }
+      }
+    },
+    "Answer": {
+      "title": "Answer",
+      "description": "The answer to one question. Exactly one member besides `question` is present, matching the question's type, or `abstain` for an optional question left unanswered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "question"
+      ],
+      "minProperties": 2,
+      "maxProperties": 2,
+      "properties": {
+        "question": {
+          "$ref": "#/$defs/Key"
         },
-        "questions": {
+        "choice": {
           "type": "array",
           "items": {
-            "$ref": "#/$defs/QuestionResult"
+            "$ref": "#/$defs/Key"
+          },
+          "uniqueItems": true
+        },
+        "ranking": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Key"
+          },
+          "uniqueItems": true
+        },
+        "scores": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "integer"
           }
         },
-        "head": {
-          "$ref": "#/$defs/BoardHead",
-          "description": "The head of the board as it stood at close: the result counts exactly its entries."
+        "text": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "abstain": {
+          "const": true
         }
       }
     },
-    "BoardHead": {
-      "title": "BoardHead",
-      "description": "A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.",
+    "Key": {
+      "title": "Key",
+      "description": "A question or option key, unique within its manifest or question.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,64}$"
+    },
+    "ElectionId": {
+      "title": "ElectionId",
+      "description": "An election's identifier, unique within its community. A closed alphabet: it appears in the ticket class label `voter/<electionId>` and is framed into every hash a cast is bound to.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,128}$"
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "PartialDecryption": {
+      "title": "PartialDecryption",
+      "description": "Trustee `trustee`'s share of one decryption, `d = x_j·a`, with a Chaum–Pedersen proof against its verification key (CONVENTIONS §9.7).",
       "type": "object",
       "additionalProperties": false,
       "required": [
-        "electionId",
-        "treeSize",
-        "rootHash",
-        "issuedAt"
+        "target",
+        "d",
+        "proof"
       ],
       "properties": {
-        "electionId": {
-          "$ref": "#/$defs/ElectionId"
+        "target": {
+          "$ref": "#/$defs/DecryptionTarget"
         },
-        "treeSize": {
+        "d": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "proof": {
+          "$ref": "#/$defs/SigmaProof"
+        }
+      }
+    },
+    "SigmaProof": {
+      "title": "SigmaProof",
+      "description": "A non-interactive sigma proof as its challenge and response `(c, z)` (Schnorr or Chaum–Pedersen; CONVENTIONS §9.3).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "c",
+        "z"
+      ],
+      "properties": {
+        "c": {
+          "$ref": "#/$defs/GroupScalar"
+        },
+        "z": {
+          "$ref": "#/$defs/GroupScalar"
+        }
+      }
+    },
+    "GroupScalar": {
+      "title": "GroupScalar",
+      "description": "A scalar mod the Ristretto group order: 32 canonical little-endian bytes, multibase base58btc (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "GroupElement": {
+      "title": "GroupElement",
+      "description": "A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "DecryptionTarget": {
+      "title": "DecryptionTarget",
+      "description": "What a partial decryption decrypts: the sealed cast at a board leaf, or the total of one option of one question.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ciphertext"
+      ],
+      "properties": {
+        "leafIndex": {
           "type": "integer",
-          "minimum": 0
+          "minimum": 0,
+          "description": "A sealed cast's board leaf."
         },
-        "rootHash": {
-          "$ref": "#/$defs/DigestMultibase",
-          "description": "The RFC 9162 Merkle tree hash (SHA-256) of the first `treeSize` entries, as a multihash."
+        "question": {
+          "$ref": "#/$defs/Key"
+        },
+        "option": {
+          "$ref": "#/$defs/Key"
+        },
+        "ciphertext": {
+          "$ref": "#/$defs/ElGamalCiphertext"
+        }
+      },
+      "oneOf": [
+        {
+          "required": [
+            "leafIndex"
+          ]
+        },
+        {
+          "required": [
+            "question",
+            "option"
+          ]
+        }
+      ]
+    },
+    "ElGamalCiphertext": {
+      "title": "ElGamalCiphertext",
+      "description": "`(a, b) = (r·G, M + r·Y)` under the election key `Y` (CONVENTIONS §9.2).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "a",
+        "b"
+      ],
+      "properties": {
+        "a": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "b": {
+          "$ref": "#/$defs/GroupElement"
+        }
+      }
+    },
+    "TrusteeIndex": {
+      "title": "TrusteeIndex",
+      "description": "A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 64
+    },
+    "ElectionKey": {
+      "title": "ElectionKey",
+      "description": "The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "qualified",
+        "verification"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "qualified": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/TrusteeIndex"
+          },
+          "description": "The dealers whose dealings the key is formed from."
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "trustee",
+              "key"
+            ],
+            "properties": {
+              "trustee": {
+                "$ref": "#/$defs/TrusteeIndex"
+              },
+              "key": {
+                "$ref": "#/$defs/GroupElement"
+              }
+            }
+          }
+        }
+      }
+    },
+    "Dealing": {
+      "title": "Dealing",
+      "description": "A trustee's contribution to the election key: Feldman commitments to its polynomial, a proof of knowledge of the constant term, and one share per trustee sealed to that trustee's transport key (CONVENTIONS §9.6).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "dealer",
+        "commitments",
+        "pok",
+        "shares"
+      ],
+      "properties": {
+        "dealer": {
+          "$ref": "#/$defs/TrusteeIndex"
+        },
+        "commitments": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/GroupElement"
+          }
+        },
+        "pok": {
+          "$ref": "#/$defs/SigmaProof"
+        },
+        "shares": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/SealedShare"
+          }
+        }
+      }
+    },
+    "SealedShare": {
+      "title": "SealedShare",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "recipient",
+        "share"
+      ],
+      "properties": {
+        "recipient": {
+          "$ref": "#/$defs/TrusteeIndex"
+        },
+        "share": {
+          "$ref": "#/$defs/SealedPayload"
+        }
+      }
+    },
+    "SealedPayload": {
+      "title": "SealedPayload",
+      "description": "Bytes sealed to a key: a random group element encrypted as `kem`, and the bytes under ChaCha20-Poly1305 with a key derived from it, multibase base58btc (CONVENTIONS §9.4).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kem",
+        "body"
+      ],
+      "properties": {
+        "kem": {
+          "$ref": "#/$defs/ElGamalCiphertext"
+        },
+        "body": {
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 131072,
+          "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+        }
+      }
+    },
+    "TransportKey": {
+      "title": "TransportKey",
+      "description": "The group element a trustee's shares are sealed to, with a Schnorr proof of knowledge of its discrete log (CONVENTIONS §9.6).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "trustee",
+        "key",
+        "pok"
+      ],
+      "properties": {
+        "trustee": {
+          "$ref": "#/$defs/TrusteeIndex"
+        },
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "pok": {
+          "$ref": "#/$defs/SigmaProof"
+        }
+      }
+    },
+    "EncryptedCast": {
+      "title": "EncryptedCast",
+      "description": "A cast of a sealed or tallied-encrypted election: exactly one of `sealed` (the Ballot's JCS bytes sealed to the election key) or `encrypted`, with the tag and the attestation over the JCS bytes of whichever is present (CONVENTIONS §3.6, §9.5).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "tag",
+        "attestation"
+      ],
+      "properties": {
+        "sealed": {
+          "$ref": "#/$defs/SealedPayload"
+        },
+        "encrypted": {
+          "$ref": "#/$defs/EncryptedBallot"
+        },
+        "tag": {
+          "$ref": "#/$defs/Multibase"
+        },
+        "attestation": {
+          "$ref": "#/$defs/Multibase"
+        }
+      },
+      "oneOf": [
+        {
+          "required": [
+            "sealed"
+          ]
+        },
+        {
+          "required": [
+            "encrypted"
+          ]
+        }
+      ]
+    },
+    "Multibase": {
+      "title": "Multibase",
+      "description": "A binary value, multibase base58btc over the suite's canonical (compressed) encoding.",
+      "type": "string",
+      "maxLength": 16384,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "EncryptedBallot": {
+      "title": "EncryptedBallot",
+      "description": "A tallied-encrypted ballot: one EncryptedQuestion per manifest question, in the manifest's order. Never decrypted (VTI-VOT-064).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "manifestDigest",
+        "questions"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase"
+        },
+        "questions": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/EncryptedQuestion"
+          }
+        }
+      }
+    },
+    "EncryptedQuestion": {
+      "title": "EncryptedQuestion",
+      "description": "One choice question of a tallied-encrypted ballot: per option, in the manifest's order, an encryption of 0 or 1 with its proof; and a proof that the selections sum to a count the question admits (CONVENTIONS §9.5).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "question",
+        "options",
+        "sumProof"
+      ],
+      "properties": {
+        "question": {
+          "$ref": "#/$defs/Key"
+        },
+        "options": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/EncryptedOption"
+          }
+        },
+        "sumProof": {
+          "$ref": "#/$defs/DisjunctiveProof"
+        }
+      }
+    },
+    "DisjunctiveProof": {
+      "title": "DisjunctiveProof",
+      "description": "A disjunctive proof that a ciphertext encrypts one value of a public list: one `(c, z)` per value, in the list's order (CONVENTIONS §9.3).",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 65,
+      "items": {
+        "$ref": "#/$defs/SigmaProof"
+      }
+    },
+    "EncryptedOption": {
+      "title": "EncryptedOption",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ciphertext",
+        "proof"
+      ],
+      "properties": {
+        "ciphertext": {
+          "$ref": "#/$defs/ElGamalCiphertext"
+        },
+        "proof": {
+          "$ref": "#/$defs/DisjunctiveProof"
+        }
+      }
+    },
+    "ElectionResult": {
+      "title": "ElectionResult",
+      "description": "An election's result, computable by anyone who can read its board from the board and the registration alone (VTI-VOT-070).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "manifestDigest",
+        "ballotsCounted",
+        "questions",
+        "head"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase"
+        },
+        "ballotsCounted": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "questions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/QuestionResult"
+          }
+        },
+        "head": {
+          "$ref": "#/$defs/BoardHead",
+          "description": "The head of the board as it stood at close: the result counts exactly its entries."
+        }
+      }
+    },
+    "BoardHead": {
+      "title": "BoardHead",
+      "description": "A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "treeSize",
+        "rootHash",
+        "issuedAt"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "treeSize": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "rootHash": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The RFC 9162 Merkle tree hash (SHA-256) of the first `treeSize` entries, as a multihash."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "QuestionResult": {
+      "title": "QuestionResult",
+      "description": "One question's totals. `choice`: selections per option. `ranking`: per option, how many ballots placed it at each position (index 0 = first). `score`: per option, the sum and the number of ballots that scored it. `text`: the answers, in board order, withheld (`withheld: true`) below the manifest's `textReleaseThreshold`. `abstained` counts ballots that left the question unanswered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "question",
+        "abstained"
+      ],
+      "properties": {
+        "question": {
+          "$ref": "#/$defs/Key"
+        },
+        "abstained": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "choice": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "integer",
+            "minimum": 0
+          }
+        },
+        "ranking": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        },
+        "score": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "sum",
+              "count"
+            ],
+            "properties": {
+              "sum": {
+                "type": "integer"
+              },
+              "count": {
+                "type": "integer",
+                "minimum": 0
+              }
+            }
+          }
+        },
+        "text": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 4096
+          }
+        },
+        "withheld": {
+          "type": "boolean"
+        }
+      }
+    },
+    "Cast": {
+      "title": "Cast",
+      "description": "A ballot and the PCS attestation that admits it (VTI-VOT-030). `attestation` is the suite's canonical encoding of the attestation made for the election point with the ballot context bound in (CONVENTIONS §3); `tag` repeats its tag so a ballot box can refuse a duplicate before the pairing check.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ballot",
+        "tag",
+        "attestation"
+      ],
+      "properties": {
+        "ballot": {
+          "$ref": "#/$defs/Ballot"
+        },
+        "tag": {
+          "$ref": "#/$defs/Multibase"
+        },
+        "attestation": {
+          "$ref": "#/$defs/Multibase"
+        }
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Voting — Board Read — response payload",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "treeSize",
+        "entries"
+      ],
+      "properties": {
+        "treeSize": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The tree size the page was read against. No entry at or beyond it is returned."
+        },
+        "entries": {
+          "type": "array",
+          "maxItems": 1000,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "index",
+              "entry"
+            ],
+            "properties": {
+              "index": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "entry": {
+                "$ref": "#/$defs/BoardEntry"
+              }
+            }
+          },
+          "description": "Consecutive entries from `from`, in board order."
+        },
+        "next": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "The `from` of the next page. Absent when the page reaches `treeSize`."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "BoardEntry": {
+      "title": "BoardEntry",
+      "description": "One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.",
+      "oneOf": [
+        {
+          "title": "CastEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "cast"
+          ],
+          "properties": {
+            "kind": {
+              "const": "cast"
+            },
+            "cast": {
+              "$ref": "#/$defs/Cast"
+            }
+          }
+        },
+        {
+          "title": "ReplacementEntry",
+          "description": "The cast at `replaces` is no longer counted: a later cast under the same tag is.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "tag",
+            "replaces",
+            "by"
+          ],
+          "properties": {
+            "kind": {
+              "const": "replaced"
+            },
+            "tag": {
+              "$ref": "#/$defs/Multibase"
+            },
+            "replaces": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "by": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        },
+        {
+          "title": "LifecycleEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "at"
+          ],
+          "properties": {
+            "kind": {
+              "enum": [
+                "opened",
+                "closed",
+                "closedEarly",
+                "cancelled"
+              ]
+            },
+            "at": {
+              "type": "string",
+              "format": "date-time"
+            }
+          }
+        },
+        {
+          "title": "ResultEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "result"
+          ],
+          "properties": {
+            "kind": {
+              "const": "result"
+            },
+            "result": {
+              "$ref": "#/$defs/ElectionResult"
+            }
+          }
+        },
+        {
+          "title": "EncryptedCastEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "cast"
+          ],
+          "properties": {
+            "kind": {
+              "const": "encryptedCast"
+            },
+            "cast": {
+              "$ref": "#/$defs/EncryptedCast"
+            }
+          }
+        },
+        {
+          "title": "TransportKeyEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "transportKey"
+          ],
+          "properties": {
+            "kind": {
+              "const": "transportKey"
+            },
+            "transportKey": {
+              "$ref": "#/$defs/TransportKey"
+            }
+          }
+        },
+        {
+          "title": "DealingEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "dealing"
+          ],
+          "properties": {
+            "kind": {
+              "const": "dealing"
+            },
+            "dealing": {
+              "$ref": "#/$defs/Dealing"
+            }
+          }
+        },
+        {
+          "title": "ConfirmationEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "trustee",
+            "complaints"
+          ],
+          "properties": {
+            "kind": {
+              "const": "confirmation"
+            },
+            "trustee": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "complaints": {
+              "type": "array",
+              "maxItems": 64,
+              "items": {
+                "$ref": "#/$defs/TrusteeIndex"
+              }
+            }
+          }
+        },
+        {
+          "title": "JustificationEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "dealer",
+            "recipient",
+            "share"
+          ],
+          "properties": {
+            "kind": {
+              "const": "justification"
+            },
+            "dealer": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "recipient": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "share": {
+              "$ref": "#/$defs/GroupScalar"
+            }
+          }
+        },
+        {
+          "title": "ElectionKeyEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "electionKey"
+          ],
+          "properties": {
+            "kind": {
+              "const": "electionKey"
+            },
+            "electionKey": {
+              "$ref": "#/$defs/ElectionKey"
+            }
+          }
+        },
+        {
+          "title": "PartialDecryptionsEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "trustee",
+            "partials"
+          ],
+          "properties": {
+            "kind": {
+              "const": "partials"
+            },
+            "trustee": {
+              "$ref": "#/$defs/TrusteeIndex"
+            },
+            "partials": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 100000,
+              "items": {
+                "$ref": "#/$defs/PartialDecryption"
+              }
+            }
+          }
+        },
+        {
+          "title": "UnsealedEntry",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "leafIndex",
+            "ballot"
+          ],
+          "properties": {
+            "kind": {
+              "const": "unsealed"
+            },
+            "leafIndex": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "ballot": {
+              "$ref": "#/$defs/Ballot"
+            }
+          }
+        },
+        {
+          "title": "SpoiledEntry",
+          "description": "A sealed cast that did not open, or opened to no valid ballot: not counted (CONVENTIONS §9.7).",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "leafIndex"
+          ],
+          "properties": {
+            "kind": {
+              "const": "spoiled"
+            },
+            "leafIndex": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        }
+      ]
+    },
+    "Ballot": {
+      "title": "Ballot",
+      "description": "An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "manifestDigest",
+        "answers"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase"
+        },
+        "answers": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "$ref": "#/$defs/Answer"
+          }
+        }
+      }
+    },
+    "Answer": {
+      "title": "Answer",
+      "description": "The answer to one question. Exactly one member besides `question` is present, matching the question's type, or `abstain` for an optional question left unanswered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "question"
+      ],
+      "minProperties": 2,
+      "maxProperties": 2,
+      "properties": {
+        "question": {
+          "$ref": "#/$defs/Key"
+        },
+        "choice": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Key"
+          },
+          "uniqueItems": true
+        },
+        "ranking": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Key"
+          },
+          "uniqueItems": true
+        },
+        "scores": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "integer"
+          }
         },
-        "issuedAt": {
+        "text": {
           "type": "string",
-          "format": "date-time"
+          "maxLength": 4096
+        },
+        "abstain": {
+          "const": true
         }
       }
     },
+    "Key": {
+      "title": "Key",
+      "description": "A question or option key, unique within its manifest or question.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,64}$"
+    },
     "ElectionId": {
       "title": "ElectionId",
       "description": "An election's identifier, unique within its community. A closed alphabet: it appears in the ticket class label `voter/<electionId>` and is framed into every hash a cast is bound to.",
@@ -346,107 +1528,282 @@ export const PAYLOAD_SCHEMA = {
         "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
       ]
     },
-    "QuestionResult": {
-      "title": "QuestionResult",
-      "description": "One question's totals. `choice`: selections per option. `ranking`: per option, how many ballots placed it at each position (index 0 = first). `score`: per option, the sum and the number of ballots that scored it. `text`: the answers, in board order, withheld (`withheld: true`) below the manifest's `textReleaseThreshold`. `abstained` counts ballots that left the question unanswered.",
+    "PartialDecryption": {
+      "title": "PartialDecryption",
+      "description": "Trustee `trustee`'s share of one decryption, `d = x_j·a`, with a Chaum–Pedersen proof against its verification key (CONVENTIONS §9.7).",
       "type": "object",
       "additionalProperties": false,
       "required": [
-        "question",
-        "abstained"
+        "target",
+        "d",
+        "proof"
+      ],
+      "properties": {
+        "target": {
+          "$ref": "#/$defs/DecryptionTarget"
+        },
+        "d": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "proof": {
+          "$ref": "#/$defs/SigmaProof"
+        }
+      }
+    },
+    "SigmaProof": {
+      "title": "SigmaProof",
+      "description": "A non-interactive sigma proof as its challenge and response `(c, z)` (Schnorr or Chaum–Pedersen; CONVENTIONS §9.3).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "c",
+        "z"
+      ],
+      "properties": {
+        "c": {
+          "$ref": "#/$defs/GroupScalar"
+        },
+        "z": {
+          "$ref": "#/$defs/GroupScalar"
+        }
+      }
+    },
+    "GroupScalar": {
+      "title": "GroupScalar",
+      "description": "A scalar mod the Ristretto group order: 32 canonical little-endian bytes, multibase base58btc (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "GroupElement": {
+      "title": "GroupElement",
+      "description": "A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "DecryptionTarget": {
+      "title": "DecryptionTarget",
+      "description": "What a partial decryption decrypts: the sealed cast at a board leaf, or the total of one option of one question.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ciphertext"
       ],
       "properties": {
+        "leafIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "A sealed cast's board leaf."
+        },
         "question": {
           "$ref": "#/$defs/Key"
         },
-        "abstained": {
-          "type": "integer",
-          "minimum": 0
+        "option": {
+          "$ref": "#/$defs/Key"
         },
-        "choice": {
-          "type": "object",
-          "propertyNames": {
-            "$ref": "#/$defs/Key"
-          },
-          "additionalProperties": {
-            "type": "integer",
-            "minimum": 0
-          }
+        "ciphertext": {
+          "$ref": "#/$defs/ElGamalCiphertext"
+        }
+      },
+      "oneOf": [
+        {
+          "required": [
+            "leafIndex"
+          ]
         },
-        "ranking": {
-          "type": "object",
-          "propertyNames": {
-            "$ref": "#/$defs/Key"
-          },
-          "additionalProperties": {
-            "type": "array",
-            "items": {
-              "type": "integer",
-              "minimum": 0
-            }
-          }
+        {
+          "required": [
+            "question",
+            "option"
+          ]
+        }
+      ]
+    },
+    "ElGamalCiphertext": {
+      "title": "ElGamalCiphertext",
+      "description": "`(a, b) = (r·G, M + r·Y)` under the election key `Y` (CONVENTIONS §9.2).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "a",
+        "b"
+      ],
+      "properties": {
+        "a": {
+          "$ref": "#/$defs/GroupElement"
         },
-        "score": {
-          "type": "object",
-          "propertyNames": {
-            "$ref": "#/$defs/Key"
+        "b": {
+          "$ref": "#/$defs/GroupElement"
+        }
+      }
+    },
+    "TrusteeIndex": {
+      "title": "TrusteeIndex",
+      "description": "A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 64
+    },
+    "ElectionKey": {
+      "title": "ElectionKey",
+      "description": "The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "qualified",
+        "verification"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "qualified": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/TrusteeIndex"
           },
-          "additionalProperties": {
+          "description": "The dealers whose dealings the key is formed from."
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
             "type": "object",
             "additionalProperties": false,
             "required": [
-              "sum",
-              "count"
+              "trustee",
+              "key"
             ],
             "properties": {
-              "sum": {
-                "type": "integer"
+              "trustee": {
+                "$ref": "#/$defs/TrusteeIndex"
               },
-              "count": {
-                "type": "integer",
-                "minimum": 0
+              "key": {
+                "$ref": "#/$defs/GroupElement"
               }
             }
           }
+        }
+      }
+    },
+    "Dealing": {
+      "title": "Dealing",
+      "description": "A trustee's contribution to the election key: Feldman commitments to its polynomial, a proof of knowledge of the constant term, and one share per trustee sealed to that trustee's transport key (CONVENTIONS §9.6).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "dealer",
+        "commitments",
+        "pok",
+        "shares"
+      ],
+      "properties": {
+        "dealer": {
+          "$ref": "#/$defs/TrusteeIndex"
+        },
+        "commitments": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/GroupElement"
+          }
         },
-        "text": {
+        "pok": {
+          "$ref": "#/$defs/SigmaProof"
+        },
+        "shares": {
           "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
           "items": {
-            "type": "string",
-            "maxLength": 4096
+            "$ref": "#/$defs/SealedShare"
           }
+        }
+      }
+    },
+    "SealedShare": {
+      "title": "SealedShare",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "recipient",
+        "share"
+      ],
+      "properties": {
+        "recipient": {
+          "$ref": "#/$defs/TrusteeIndex"
         },
-        "withheld": {
-          "type": "boolean"
+        "share": {
+          "$ref": "#/$defs/SealedPayload"
         }
       }
     },
-    "Key": {
-      "title": "Key",
-      "description": "A question or option key, unique within its manifest or question.",
-      "type": "string",
-      "pattern": "^[A-Za-z0-9._-]{1,64}$"
+    "SealedPayload": {
+      "title": "SealedPayload",
+      "description": "Bytes sealed to a key: a random group element encrypted as `kem`, and the bytes under ChaCha20-Poly1305 with a key derived from it, multibase base58btc (CONVENTIONS §9.4).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kem",
+        "body"
+      ],
+      "properties": {
+        "kem": {
+          "$ref": "#/$defs/ElGamalCiphertext"
+        },
+        "body": {
+          "type": "string",
+          "minLength": 2,
+          "maxLength": 131072,
+          "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+        }
+      }
     },
-    "Multibase": {
-      "title": "Multibase",
-      "description": "A binary value, multibase base58btc over the suite's canonical (compressed) encoding.",
-      "type": "string",
-      "maxLength": 16384,
-      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    "TransportKey": {
+      "title": "TransportKey",
+      "description": "The group element a trustee's shares are sealed to, with a Schnorr proof of knowledge of its discrete log (CONVENTIONS §9.6).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "trustee",
+        "key",
+        "pok"
+      ],
+      "properties": {
+        "trustee": {
+          "$ref": "#/$defs/TrusteeIndex"
+        },
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "pok": {
+          "$ref": "#/$defs/SigmaProof"
+        }
+      }
     },
-    "Cast": {
-      "title": "Cast",
-      "description": "A ballot and the PCS attestation that admits it (VTI-VOT-030). `attestation` is the suite's canonical encoding of the attestation made for the election point with the ballot context bound in (CONVENTIONS §3); `tag` repeats its tag so a ballot box can refuse a duplicate before the pairing check.",
+    "EncryptedCast": {
+      "title": "EncryptedCast",
+      "description": "A cast of a sealed or tallied-encrypted election: exactly one of `sealed` (the Ballot's JCS bytes sealed to the election key) or `encrypted`, with the tag and the attestation over the JCS bytes of whichever is present (CONVENTIONS §3.6, §9.5).",
       "type": "object",
       "additionalProperties": false,
       "required": [
-        "ballot",
         "tag",
         "attestation"
       ],
       "properties": {
-        "ballot": {
-          "$ref": "#/$defs/Ballot"
+        "sealed": {
+          "$ref": "#/$defs/SealedPayload"
+        },
+        "encrypted": {
+          "$ref": "#/$defs/EncryptedBallot"
         },
         "tag": {
           "$ref": "#/$defs/Multibase"
@@ -454,17 +1811,36 @@ export const PAYLOAD_SCHEMA = {
         "attestation": {
           "$ref": "#/$defs/Multibase"
         }
-      }
+      },
+      "oneOf": [
+        {
+          "required": [
+            "sealed"
+          ]
+        },
+        {
+          "required": [
+            "encrypted"
+          ]
+        }
+      ]
     },
-    "Ballot": {
-      "title": "Ballot",
-      "description": "An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.",
+    "Multibase": {
+      "title": "Multibase",
+      "description": "A binary value, multibase base58btc over the suite's canonical (compressed) encoding.",
+      "type": "string",
+      "maxLength": 16384,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "EncryptedBallot": {
+      "title": "EncryptedBallot",
+      "description": "A tallied-encrypted ballot: one EncryptedQuestion per manifest question, in the manifest's order. Never decrypted (VTI-VOT-064).",
       "type": "object",
       "additionalProperties": false,
       "required": [
         "electionId",
         "manifestDigest",
-        "answers"
+        "questions"
       ],
       "properties": {
         "electionId": {
@@ -473,217 +1849,69 @@ export const PAYLOAD_SCHEMA = {
         "manifestDigest": {
           "$ref": "#/$defs/DigestMultibase"
         },
-        "answers": {
+        "questions": {
           "type": "array",
           "minItems": 1,
-          "maxItems": 128,
-          "items": {
-            "$ref": "#/$defs/Answer"
-          }
-        }
-      }
-    },
-    "Answer": {
-      "title": "Answer",
-      "description": "The answer to one question. Exactly one member besides `question` is present, matching the question's type, or `abstain` for an optional question left unanswered.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "question"
-      ],
-      "minProperties": 2,
-      "maxProperties": 2,
-      "properties": {
-        "question": {
-          "$ref": "#/$defs/Key"
-        },
-        "choice": {
-          "type": "array",
-          "items": {
-            "$ref": "#/$defs/Key"
-          },
-          "uniqueItems": true
-        },
-        "ranking": {
-          "type": "array",
-          "items": {
-            "$ref": "#/$defs/Key"
-          },
-          "uniqueItems": true
-        },
-        "scores": {
-          "type": "object",
-          "propertyNames": {
-            "$ref": "#/$defs/Key"
-          },
-          "additionalProperties": {
-            "type": "integer"
-          }
-        },
-        "text": {
-          "type": "string",
-          "maxLength": 4096
-        },
-        "abstain": {
-          "const": true
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/EncryptedQuestion"
+          }
         }
       }
-    }
-  }
-} as const;
-
-/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
-export const RESPONSE_PAYLOAD_SCHEMA = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$ref": "#/$defs/Response",
-  "$defs": {
-    "Response": {
-      "$anchor": "response",
-      "title": "Voting — Board Read — response payload",
+    },
+    "EncryptedQuestion": {
+      "title": "EncryptedQuestion",
+      "description": "One choice question of a tallied-encrypted ballot: per option, in the manifest's order, an encryption of 0 or 1 with its proof; and a proof that the selections sum to a count the question admits (CONVENTIONS §9.5).",
       "type": "object",
       "additionalProperties": false,
       "required": [
-        "treeSize",
-        "entries"
+        "question",
+        "options",
+        "sumProof"
       ],
       "properties": {
-        "treeSize": {
-          "type": "integer",
-          "minimum": 0,
-          "description": "The tree size the page was read against. No entry at or beyond it is returned."
+        "question": {
+          "$ref": "#/$defs/Key"
         },
-        "entries": {
+        "options": {
           "type": "array",
-          "maxItems": 1000,
+          "minItems": 1,
+          "maxItems": 64,
           "items": {
-            "type": "object",
-            "additionalProperties": false,
-            "required": [
-              "index",
-              "entry"
-            ],
-            "properties": {
-              "index": {
-                "type": "integer",
-                "minimum": 0
-              },
-              "entry": {
-                "$ref": "#/$defs/BoardEntry"
-              }
-            }
-          },
-          "description": "Consecutive entries from `from`, in board order."
-        },
-        "next": {
-          "type": "integer",
-          "minimum": 1,
-          "description": "The `from` of the next page. Absent when the page reaches `treeSize`."
+            "$ref": "#/$defs/EncryptedOption"
+          }
         },
-        "ext": {
-          "$ref": "#/$defs/Ext"
+        "sumProof": {
+          "$ref": "#/$defs/DisjunctiveProof"
         }
       }
     },
-    "Ext": {
-      "title": "Ext",
-      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
-      "type": "object",
-      "minProperties": 1,
-      "additionalProperties": true,
-      "propertyNames": {
-        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+    "DisjunctiveProof": {
+      "title": "DisjunctiveProof",
+      "description": "A disjunctive proof that a ciphertext encrypts one value of a public list: one `(c, z)` per value, in the list's order (CONVENTIONS §9.3).",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 65,
+      "items": {
+        "$ref": "#/$defs/SigmaProof"
       }
     },
-    "BoardEntry": {
-      "title": "BoardEntry",
-      "description": "One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.",
-      "oneOf": [
-        {
-          "title": "CastEntry",
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "kind",
-            "cast"
-          ],
-          "properties": {
-            "kind": {
-              "const": "cast"
-            },
-            "cast": {
-              "$ref": "#/$defs/Cast"
-            }
-          }
-        },
-        {
-          "title": "ReplacementEntry",
-          "description": "The cast at `replaces` is no longer counted: a later cast under the same tag is.",
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "kind",
-            "tag",
-            "replaces",
-            "by"
-          ],
-          "properties": {
-            "kind": {
-              "const": "replaced"
-            },
-            "tag": {
-              "$ref": "#/$defs/Multibase"
-            },
-            "replaces": {
-              "type": "integer",
-              "minimum": 0
-            },
-            "by": {
-              "type": "integer",
-              "minimum": 0
-            }
-          }
-        },
-        {
-          "title": "LifecycleEntry",
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "kind",
-            "at"
-          ],
-          "properties": {
-            "kind": {
-              "enum": [
-                "opened",
-                "closed",
-                "closedEarly",
-                "cancelled"
-              ]
-            },
-            "at": {
-              "type": "string",
-              "format": "date-time"
-            }
-          }
+    "EncryptedOption": {
+      "title": "EncryptedOption",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ciphertext",
+        "proof"
+      ],
+      "properties": {
+        "ciphertext": {
+          "$ref": "#/$defs/ElGamalCiphertext"
         },
-        {
-          "title": "ResultEntry",
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "kind",
-            "result"
-          ],
-          "properties": {
-            "kind": {
-              "const": "result"
-            },
-            "result": {
-              "$ref": "#/$defs/ElectionResult"
-            }
-          }
+        "proof": {
+          "$ref": "#/$defs/DisjunctiveProof"
         }
-      ]
+      }
     },
     "ElectionResult": {
       "title": "ElectionResult",
@@ -749,22 +1977,6 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         }
       }
     },
-    "ElectionId": {
-      "title": "ElectionId",
-      "description": "An election's identifier, unique within its community. A closed alphabet: it appears in the ticket class label `voter/<electionId>` and is framed into every hash a cast is bound to.",
-      "type": "string",
-      "pattern": "^[A-Za-z0-9._-]{1,128}$"
-    },
-    "DigestMultibase": {
-      "title": "DigestMultibase",
-      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
-      "type": "string",
-      "minLength": 16,
-      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
-      "examples": [
-        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
-      ]
-    },
     "QuestionResult": {
       "title": "QuestionResult",
       "description": "One question's totals. `choice`: selections per option. `ranking`: per option, how many ballots placed it at each position (index 0 = first). `score`: per option, the sum and the number of ballots that scored it. `text`: the answers, in board order, withheld (`withheld: true`) below the manifest's `textReleaseThreshold`. `abstained` counts ballots that left the question unanswered.",
@@ -840,19 +2052,6 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
         }
       }
     },
-    "Key": {
-      "title": "Key",
-      "description": "A question or option key, unique within its manifest or question.",
-      "type": "string",
-      "pattern": "^[A-Za-z0-9._-]{1,64}$"
-    },
-    "Multibase": {
-      "title": "Multibase",
-      "description": "A binary value, multibase base58btc over the suite's canonical (compressed) encoding.",
-      "type": "string",
-      "maxLength": 16384,
-      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
-    },
     "Cast": {
       "title": "Cast",
       "description": "A ballot and the PCS attestation that admits it (VTI-VOT-030). `attestation` is the suite's canonical encoding of the attestation made for the election point with the ballot context bound in (CONVENTIONS §3); `tag` repeats its tag so a ballot box can refuse a duplicate before the pairing check.",
@@ -874,79 +2073,6 @@ export const RESPONSE_PAYLOAD_SCHEMA = {
           "$ref": "#/$defs/Multibase"
         }
       }
-    },
-    "Ballot": {
-      "title": "Ballot",
-      "description": "An open ballot: one answer per question of the manifest, in any order. The bytes a cast's proof binds are the RFC 8785 (JCS) canonicalization of this object as received.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "electionId",
-        "manifestDigest",
-        "answers"
-      ],
-      "properties": {
-        "electionId": {
-          "$ref": "#/$defs/ElectionId"
-        },
-        "manifestDigest": {
-          "$ref": "#/$defs/DigestMultibase"
-        },
-        "answers": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 128,
-          "items": {
-            "$ref": "#/$defs/Answer"
-          }
-        }
-      }
-    },
-    "Answer": {
-      "title": "Answer",
-      "description": "The answer to one question. Exactly one member besides `question` is present, matching the question's type, or `abstain` for an optional question left unanswered.",
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "question"
-      ],
-      "minProperties": 2,
-      "maxProperties": 2,
-      "properties": {
-        "question": {
-          "$ref": "#/$defs/Key"
-        },
-        "choice": {
-          "type": "array",
-          "items": {
-            "$ref": "#/$defs/Key"
-          },
-          "uniqueItems": true
-        },
-        "ranking": {
-          "type": "array",
-          "items": {
-            "$ref": "#/$defs/Key"
-          },
-          "uniqueItems": true
-        },
-        "scores": {
-          "type": "object",
-          "propertyNames": {
-            "$ref": "#/$defs/Key"
-          },
-          "additionalProperties": {
-            "type": "integer"
-          }
-        },
-        "text": {
-          "type": "string",
-          "maxLength": 4096
-        },
-        "abstain": {
-          "const": true
-        }
-      }
     }
   }
 } as const;