@openvtc/trust-tasks 0.26.27 → 0.26.29

package/CHANGELOG.md

@@ -11,6 +11,55 @@ The package versions over **its own API** — what a consumer compiles against
 not over `SPEC.md`. Below 1.0 a breaking change bumps the leading non-zero
 component.
 
+## 0.26.29 — 2026-10-21
+
+
+### Added
+
+- **voting**: Vta/pcs/trustee/read, and trustees read voting/election/show on any board (#855)
+
+A trustee could not run its part of a sealed or tallied-encrypted election on a private board
+  from a client: the trustee tasks take the manifest, which voting/election/show answers only to
+  the community and the auditors there; and a trustee's client, which holds no trustee key, had no
+  way to sign the reads a private board answers only to a trustee.
+
+  - vta/pcs/trustee/read/0.1 (new): the VTA signs voting/trustees/status or voting/election/show
+    as the trustee, addressed to the ballot box — the trustee's counterpart of vta/pcs/voter/read.
+    Its payload is fixed to { community, electionId }; `read` is closed. Gated on pcsTrustee.
+  - voting/election/show answers every trustee the manifest names on any board (CONVENTIONS §4
+    gains its own row; §9.6's "Who reads the ceremony" names both reads).
+  - vta/pcs/trustee/decrypt: `closedAt` is the board's close entry, or for a client that cannot
+    read the board any time at or after the close and not in the future — the election's summary,
+    which the field used to point at, carries no close time.
+
+## 0.26.28 — 2026-10-21
+
+
+### Fixed
+
+- **voting**: Each trustee step on the board is the trustee's signed request (#853)
+
+The board recorded each step of the trustees' ceremony as its payload alone, so nothing on it
+  showed who took a step. A ballot box could enrol or deal in a trustee's name — a polynomial of its
+  own choosing, with matching shares sealed to that trustee's transport key — and every check the
+  community, the trustees and certification run would pass while the ballot box held the election
+  key, able to open sealed ballots before close. The defence was only that the ballot box runs
+  honestly, which VTI-VOT-062 does not let a deployment assume.
+
+  - A new board entry, `trusteeStep` (appended), carries the trustee's `voting/trustees/enrol`,
+    `deal`, `confirm` or `justify` request exactly as the ballot box received it, proof included.
+    The `transportKey`, `dealing`, `confirmation` and `justification` kinds are no longer appended,
+    and a consumer refuses a board holding one.
+  - CONVENTIONS §9.6: whoever replays the ceremony takes a step only when its type, community and
+    election are right, its issuer is the trustee the manifest names at the payload's index, and
+    its proof is the issuer's. A `partials` entry needs no signature: its Chaum–Pedersen proofs
+    already tie it to the trustee's share. `voting/trustees/status` is never evidence of who took a
+    step.
+  - `vtc/elections/show` item 6: the community forms the key itself by replaying the ceremony from
+    the board (open to it on any board), never from `voting/trustees/status`.
+  - `vtc/elections/certify` item 8 states the encrypted levels' recount: ceremony, casts and
+    partials, from the board alone.
+
 ## 0.26.27 — 2026-10-21
 
 

package/dist/_shared/components.d.ts

@@ -388,7 +388,7 @@ export type BlobRef = DigestMultibase;
 /**
  * One leaf of a board. A leaf's hash is the RFC 9162 leaf hash of the JCS canonicalization of this object. Entries carry no time of arrival: the order is the board's, and a timestamp would hand anyone who reads the board the timing the registrar's log would need to pair a ticket with its cast.
  */
-export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry | EncryptedCastEntry | TransportKeyEntry | DealingEntry | ConfirmationEntry | JustificationEntry | ElectionKeyEntry | PartialDecryptionsEntry | UnsealedEntry | SpoiledEntry;
+export type BoardEntry = CastEntry | ReplacementEntry | LifecycleEntry | ResultEntry | EncryptedCastEntry | TransportKeyEntry | DealingEntry | ConfirmationEntry | JustificationEntry | ElectionKeyEntry | PartialDecryptionsEntry | UnsealedEntry | SpoiledEntry | TrusteeStepEntry;
 /**
  * `public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).
  */
@@ -4574,14 +4574,23 @@ export interface EncryptedCastEntry {
     kind: "encryptedCast";
     cast: EncryptedCast;
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface TransportKeyEntry {
     kind: "transportKey";
     transportKey: TransportKey;
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface DealingEntry {
     kind: "dealing";
     dealing: Dealing;
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface ConfirmationEntry {
     kind: "confirmation";
     trustee: TrusteeIndex;
@@ -4590,6 +4599,9 @@ export interface ConfirmationEntry {
      */
     complaints: TrusteeIndex[];
 }
+/**
+ * Not appended: each enrolment, dealing, confirmation and justification is a `trusteeStep` entry carrying the trustee's signed request (CONVENTIONS §9.6). A consumer MUST refuse a board holding this kind.
+ */
 export interface JustificationEntry {
     kind: "justification";
     dealer: TrusteeIndex;
@@ -4621,6 +4633,13 @@ export interface SpoiledEntry {
     kind: "spoiled";
     leafIndex: number;
 }
+/**
+ * One step of the trustees' ceremony — an enrolment, a dealing, a confirmation or a justification — as the trustee's own signed request, so that anyone reading the board can tell who took it (CONVENTIONS §9.6).
+ */
+export interface TrusteeStepEntry {
+    kind: "trusteeStep";
+    request: SignedRequest;
+}
 /**
  * A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.
  */
@@ -9998,6 +10017,11 @@ export interface SigmaProof {
     c: GroupScalar;
     z: GroupScalar;
 }
+/**
+ * A whole Trust Task request document — `id`, `type`, `issuer`, `payload` and every other member, `proof` included — exactly as the ballot box received it, never re-serialised: its proof is taken over its members, and a re-serialised copy does not reliably reproduce them. Typed as an open object so every member survives; CONVENTIONS §9.6 gives the checks that make it a trustee's step.
+ */
+export interface SignedRequest {
+}
 /**
  * One signing-key delegation, as its holder sees it. A delegation confers nothing of its own: it names an identity that already holds whatever standing it holds, and a document signed by the key is authorized by that identity's standing read at execution time.
  */