@openvtc/trust-tasks 0.28.5 → 0.28.7

package/src/vtc/elections/show/0.3/payload.ts

@@ -0,0 +1,1865 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/elections/show/0.3/payload.schema.json
+ */
+
+import type { BoardHead, BoardVisibility, ChoiceQuestion, DigestMultibase, Disclosure, ElectionId, ElectionKey, ElectionResult, Ext, GroupElement, Key_VotingV0_1 as Key, Manifest_VotingV0_3 as Manifest, Multibase_VotingV0_1 as Multibase, Question, QuestionOption, QuestionResult, RankingQuestion, Revote, RollRule, ScoreQuestion, SecrecyLevel, SignedRequest, TextQuestion, TrusteeCeremony, TrusteeIndex, Trustees, VotingParameters } from "../../../../_shared/components.js";
+
+
+/**
+ * An election's state as its registrar holds it: the ballot box's `ElectionState` once the ballot box has registered the election, or, before that, `pendingRegistration` (the community is still delivering the registration) or `registrationRefused` (the ballot box refused it on a later delivery, and only a cancellation clears it). The first six values are the ballot box's `ElectionState` (voting/_shared/0.1).
+ */
+export type RegistrarState =
+  | "registered"
+  | "registration"
+  | "voting"
+  | "closed"
+  | "tallied"
+  | "cancelled"
+  | "pendingRegistration"
+  | "registrationRefused";
+
+/**
+ * A member or an administrator reads one election of the community whole: its manifest, state, voting parameters, disclosure, the board checkpoints the community kept and, once certified, the certified result. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface VTCElectionsShowPayload {
+  electionId: ElectionId;
+  ext?: Ext;
+}
+/**
+ * Success response to vtc/elections/show/0.1: one election, whole.
+ */
+export interface VTCElectionsShowResponsePayload {
+  manifest: Manifest;
+  /**
+   * The SHA-256 multihash of the RFC 8785 (JCS) canonicalization of `manifest`. A ticket request names it, and every cast is bound to it.
+   */
+  manifestDigest: DigestMultibase;
+  state: RegistrarState;
+  /**
+   * The community's voting parameters the election's tickets are issued under (VTI-VOT-020).
+   */
+  parameters: VotingParameters;
+  /**
+   * How the election is run, generated from the manifest and the community's configuration (VTI-VOT-090). Always present: a member reads it before requesting a ticket.
+   */
+  disclosure: Disclosure;
+  /**
+   * The board heads the community has kept, oldest first. Empty until the community has read a head.
+   *
+   * @maxItems 256
+   */
+  checkpoints: Checkpoint[];
+  /**
+   * How many tickets the community has issued for the election. Present only to a caller holding vtc.elections.manage.
+   */
+  ticketsIssued?: number;
+  /**
+   * The key a sealed or tallied-encrypted election's ballots are encrypted under, once its trustees have formed it (CONVENTIONS §9.6).
+   */
+  electionKey?: ElectionKey;
+  certified?: Certification;
+  ext?: Ext;
+  /**
+   * With electionKey: the trustees' signed steps it forms from, through the board's electionKey entry, each exactly as received. A voter's VTA forms the key itself from these (vta/pcs/vote-encrypted/0.4).
+   */
+  ceremony?: TrusteeCeremony;
+}
+/**
+ * A board head the community read from the ballot box and kept, with the ballot box's signed document that carried it. Certification proves the board's final head consistent with every checkpoint, so a ballot box that rewrote its board after a checkpoint is caught.
+ */
+export interface Checkpoint {
+  head: BoardHead;
+  /**
+   * The ballot box's signed voting/board/head `#response` document whose payload carries `head`, kept whole and exactly as received — proof included — so anyone can verify it against the ballot box's DID without trusting the community.
+   */
+  document: {};
+}
+/**
+ * Present once the community has certified the result.
+ */
+export interface Certification {
+  result: ElectionResult;
+  certifiedAt: string;
+  /**
+   * @maxItems 32
+   */
+  auditAttestations: {}[];
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { BoardHead, BoardVisibility, ChoiceQuestion, DigestMultibase, Disclosure, ElectionId, ElectionKey, ElectionResult, Ext, GroupElement, Key, Manifest, Multibase, Question, QuestionOption, QuestionResult, RankingQuestion, Revote, RollRule, ScoreQuestion, SecrecyLevel, SignedRequest, TextQuestion, TrusteeCeremony, TrusteeIndex, Trustees, VotingParameters };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/vtc/elections/show/0.3" as const;
+
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export const EXTENDS: string | null = null;
+
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export const DEPRECATION: string | null = null;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCElectionsShowPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/vtc/elections/show/0.3#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCElectionsShowResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/vtc/elections/show/0.3",
+  "title": "VTC Elections — Show — payload",
+  "description": "A member or an administrator reads one election of the community whole: its manifest, state, voting parameters, disclosure, the board checkpoints the community kept and, once certified, the certified result. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "electionId"
+  ],
+  "properties": {
+    "electionId": {
+      "$ref": "#/$defs/ElectionId"
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext"
+    }
+  },
+  "$defs": {
+    "RegistrarState": {
+      "title": "RegistrarState",
+      "description": "An election's state as its registrar holds it: the ballot box's `ElectionState` once the ballot box has registered the election, or, before that, `pendingRegistration` (the community is still delivering the registration) or `registrationRefused` (the ballot box refused it on a later delivery, and only a cancellation clears it). The first six values are the ballot box's `ElectionState` (voting/_shared/0.1).",
+      "type": "string",
+      "enum": [
+        "registered",
+        "registration",
+        "voting",
+        "closed",
+        "tallied",
+        "cancelled",
+        "pendingRegistration",
+        "registrationRefused"
+      ]
+    },
+    "Checkpoint": {
+      "title": "Checkpoint",
+      "description": "A board head the community read from the ballot box and kept, with the ballot box's signed document that carried it. Certification proves the board's final head consistent with every checkpoint, so a ballot box that rewrote its board after a checkpoint is caught.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "head",
+        "document"
+      ],
+      "properties": {
+        "head": {
+          "$ref": "#/$defs/BoardHead"
+        },
+        "document": {
+          "type": "object",
+          "description": "The ballot box's signed voting/board/head `#response` document whose payload carries `head`, kept whole and exactly as received — proof included — so anyone can verify it against the ballot box's DID without trusting the community."
+        }
+      }
+    },
+    "Certification": {
+      "title": "Certification",
+      "description": "The community's certification of the election's result, as vtc/elections/certify recorded it.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "result",
+        "certifiedAt",
+        "auditAttestations"
+      ],
+      "properties": {
+        "result": {
+          "$ref": "#/$defs/ElectionResult"
+        },
+        "certifiedAt": {
+          "type": "string",
+          "format": "date-time",
+          "maxLength": 64
+        },
+        "auditAttestations": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "type": "object",
+            "description": "A verifiable credential from an auditor the manifest names, as received."
+          }
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Elections — Show — response payload",
+      "description": "Success response to vtc/elections/show/0.1: one election, whole.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "manifest",
+        "manifestDigest",
+        "state",
+        "parameters",
+        "disclosure",
+        "checkpoints"
+      ],
+      "properties": {
+        "manifest": {
+          "$ref": "#/$defs/Manifest"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The SHA-256 multihash of the RFC 8785 (JCS) canonicalization of `manifest`. A ticket request names it, and every cast is bound to it."
+        },
+        "state": {
+          "$ref": "#/$defs/RegistrarState"
+        },
+        "parameters": {
+          "$ref": "#/$defs/VotingParameters",
+          "description": "The community's voting parameters the election's tickets are issued under (VTI-VOT-020)."
+        },
+        "disclosure": {
+          "$ref": "#/$defs/Disclosure",
+          "description": "How the election is run, generated from the manifest and the community's configuration (VTI-VOT-090). Always present: a member reads it before requesting a ticket."
+        },
+        "checkpoints": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/Checkpoint"
+          },
+          "description": "The board heads the community has kept, oldest first. Empty until the community has read a head."
+        },
+        "ticketsIssued": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "How many tickets the community has issued for the election. Present only to a caller holding vtc.elections.manage."
+        },
+        "electionKey": {
+          "$ref": "#/$defs/ElectionKey",
+          "description": "The key a sealed or tallied-encrypted election's ballots are encrypted under, once its trustees have formed it (CONVENTIONS §9.6)."
+        },
+        "certified": {
+          "$ref": "#/$defs/Certification",
+          "description": "Present once the community has certified the result."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        },
+        "ceremony": {
+          "$ref": "#/$defs/TrusteeCeremony",
+          "description": "With electionKey: the trustees' signed steps it forms from, through the board's electionKey entry, each exactly as received. A voter's VTA forms the key itself from these (vta/pcs/vote-encrypted/0.4)."
+        }
+      }
+    },
+    "TrusteeCeremony": {
+      "title": "TrusteeCeremony",
+      "description": "The trustees' ceremony as the board holds it: the `request` of every `trusteeStep` entry, in board order, each exactly as the ballot box received it (CONVENTIONS §9.6). Whoever acts on it verifies each step as its trustee's before taking it; nothing in it is believed for having been passed along.",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 4224,
+      "items": {
+        "$ref": "#/$defs/SignedRequest"
+      }
+    },
+    "SignedRequest": {
+      "title": "SignedRequest",
+      "description": "A whole Trust Task request document — `id`, `type`, `issuer`, `payload` and every other member, `proof` included — exactly as the ballot box received it, never re-serialised: its proof is taken over its members, and a re-serialised copy does not reliably reproduce them. Typed as an open object so every member survives; CONVENTIONS §9.6 gives the checks that make it a trustee's step.",
+      "type": "object",
+      "minProperties": 1
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ElectionKey": {
+      "title": "ElectionKey",
+      "description": "The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "qualified",
+        "verification"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "qualified": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/TrusteeIndex"
+          },
+          "description": "The dealers whose dealings the key is formed from."
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "trustee",
+              "key"
+            ],
+            "properties": {
+              "trustee": {
+                "$ref": "#/$defs/TrusteeIndex"
+              },
+              "key": {
+                "$ref": "#/$defs/GroupElement"
+              }
+            }
+          }
+        }
+      }
+    },
+    "GroupElement": {
+      "title": "GroupElement",
+      "description": "A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "TrusteeIndex": {
+      "title": "TrusteeIndex",
+      "description": "A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 64
+    },
+    "Disclosure": {
+      "title": "Disclosure",
+      "description": "The statement a community publishes, and shows a member before they request a ticket, about how one election is run (VTI-VOT-090). Generated from the election's manifest and the community's configuration, never written by hand.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ballotBox",
+        "ballotBoxOperator",
+        "sameOperator",
+        "boardVisibility",
+        "auditors",
+        "revote",
+        "coercionResistance"
+      ],
+      "properties": {
+        "ballotBox": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The ballot box's DID."
+        },
+        "ballotBoxOperator": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "Who operates the ballot box, as the community names them."
+        },
+        "sameOperator": {
+          "type": "boolean",
+          "description": "Whether the party operating the community's VTC also operates the ballot box."
+        },
+        "trustees": {
+          "$ref": "#/$defs/Trustees"
+        },
+        "boardVisibility": {
+          "$ref": "#/$defs/BoardVisibility"
+        },
+        "auditors": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048
+          },
+          "uniqueItems": true
+        },
+        "revote": {
+          "$ref": "#/$defs/Revote"
+        },
+        "coercionResistance": {
+          "const": false,
+          "description": "Always false: a voter can prove how they voted, so the community cannot protect a member against being made to vote a certain way."
+        }
+      }
+    },
+    "Revote": {
+      "title": "Revote",
+      "description": "What a later, different ballot under one ticket does: `replace` the earlier one, or be refused (`refuse`) (VTI-VOT-041).",
+      "type": "string",
+      "enum": [
+        "replace",
+        "refuse"
+      ]
+    },
+    "BoardVisibility": {
+      "title": "BoardVisibility",
+      "description": "`public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).",
+      "type": "string",
+      "enum": [
+        "public",
+        "private"
+      ]
+    },
+    "Trustees": {
+      "title": "Trustees",
+      "description": "The trustees of a sealed or tallied-encrypted election and the number of them decryption needs (VTI-VOT-062). Neither the community nor the ballot box may be one.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "dids",
+        "threshold"
+      ],
+      "properties": {
+        "dids": {
+          "type": "array",
+          "minItems": 2,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048
+          },
+          "uniqueItems": true
+        },
+        "threshold": {
+          "type": "integer",
+          "minimum": 2
+        }
+      }
+    },
+    "VotingParameters": {
+      "title": "VotingParameters",
+      "description": "The community's published voting parameters: the PCS suite and the voting verification key tickets are issued under (VTI-VOT-020). Distinct from its hidden-vetting helper key.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "suite",
+        "votingKey"
+      ],
+      "properties": {
+        "suite": {
+          "type": "string",
+          "const": "ps-ddh-bls12381"
+        },
+        "votingKey": {
+          "$ref": "#/$defs/Multibase"
+        }
+      }
+    },
+    "Multibase": {
+      "title": "Multibase",
+      "description": "A binary value, multibase base58btc over the suite's canonical (compressed) encoding.",
+      "type": "string",
+      "maxLength": 16384,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "Manifest": {
+      "title": "Manifest",
+      "description": "What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "community",
+        "questions",
+        "secrecy",
+        "roll",
+        "registrationOpensAt",
+        "votingOpensAt",
+        "votingClosesAt",
+        "revote",
+        "board",
+        "ballotBox",
+        "binding",
+        "allowEarlyClose",
+        "resultsBeforeClose",
+        "textReleaseThreshold"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "community": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The community's DID."
+        },
+        "title": {
+          "type": "string",
+          "maxLength": 512
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 8192
+        },
+        "questions": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "$ref": "#/$defs/Question"
+          }
+        },
+        "secrecy": {
+          "$ref": "#/$defs/SecrecyLevel"
+        },
+        "roll": {
+          "$ref": "#/$defs/RollRule"
+        },
+        "registrationOpensAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "votingOpensAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "votingClosesAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "revote": {
+          "$ref": "#/$defs/Revote"
+        },
+        "board": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "visibility",
+            "auditors"
+          ],
+          "properties": {
+            "visibility": {
+              "$ref": "#/$defs/BoardVisibility"
+            },
+            "auditors": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 2048
+              },
+              "uniqueItems": true
+            }
+          }
+        },
+        "ballotBox": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The DID of the voting service that holds the board."
+        },
+        "trustees": {
+          "$ref": "#/$defs/Trustees"
+        },
+        "binding": {
+          "type": "boolean",
+          "description": "Whether the community treats the result as deciding something; creating a binding election takes another administrator's consent (VTI-VOT-081)."
+        },
+        "allowEarlyClose": {
+          "type": "boolean"
+        },
+        "resultsBeforeClose": {
+          "type": "boolean",
+          "description": "Open elections only: whether running totals may be read while voting is open (VTI-VOT-061)."
+        },
+        "textReleaseThreshold": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Counted ballots required before any text answer is disclosed (VTI-VOT-065). At least 1, and SHOULD be at least 10: a written answer can identify its author by what it says or how it is phrased, and the fewer the ballots released together, the easier that is. Where it is below 10, the disclosure a member is shown before they request a ticket MUST say so, and MUST say that a written answer may identify its author (VTI-VOT-090)."
+        }
+      }
+    },
+    "RollRule": {
+      "title": "RollRule",
+      "description": "Who may be issued a ticket (VTI-VOT-021): the community's active members, its active members and the parties `listed` names, or only the parties `listed` names.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "rule"
+      ],
+      "properties": {
+        "rule": {
+          "type": "string",
+          "enum": [
+            "members",
+            "membersAndListed",
+            "listed"
+          ]
+        },
+        "listed": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048,
+            "description": "A DID enfranchised by name."
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "SecrecyLevel": {
+      "title": "SecrecyLevel",
+      "description": "`open`: ballots are recorded on the board as cast. `sealed`: ballots are encrypted to a jointly generated election key and decrypted after voting closes. `talliedEncrypted`: ballots are encrypted and only the totals are ever decrypted (VTI-VOT-060). The encrypted levels are cast with `voting/ballot/cast-encrypted/0.1`, under an election key the trustees generate with `voting/trustees/*` (CONVENTIONS §9).",
+      "type": "string",
+      "enum": [
+        "open",
+        "sealed",
+        "talliedEncrypted"
+      ]
+    },
+    "Question": {
+      "title": "Question",
+      "description": "One question. Tagged union over `type`.",
+      "oneOf": [
+        {
+          "title": "ChoiceQuestion",
+          "description": "Select between `minSelections` and `maxSelections` of `options`. A yes/no/abstain motion is a choice of exactly one of three.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "options",
+            "minSelections",
+            "maxSelections",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "choice"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "options": {
+              "type": "array",
+              "minItems": 2,
+              "maxItems": 256,
+              "items": {
+                "$ref": "#/$defs/QuestionOption"
+              }
+            },
+            "minSelections": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "maxSelections": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "title": "RankingQuestion",
+          "description": "Order `options`; a ballot ranks every option or, when `partial` is true, a prefix of them.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "options",
+            "partial",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "ranking"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "options": {
+              "type": "array",
+              "minItems": 2,
+              "maxItems": 64,
+              "items": {
+                "$ref": "#/$defs/QuestionOption"
+              }
+            },
+            "partial": {
+              "type": "boolean"
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "title": "ScoreQuestion",
+          "description": "Give each option an integer score within [min, max].",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "options",
+            "min",
+            "max",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "score"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "options": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 256,
+              "items": {
+                "$ref": "#/$defs/QuestionOption"
+              }
+            },
+            "min": {
+              "type": "integer"
+            },
+            "max": {
+              "type": "integer"
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "title": "TextQuestion",
+          "description": "Free text of at most `maxLength` characters.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "maxLength",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "text"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "maxLength": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 4096
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        }
+      ]
+    },
+    "Key": {
+      "title": "Key",
+      "description": "A question or option key, unique within its manifest or question.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,64}$"
+    },
+    "QuestionOption": {
+      "title": "QuestionOption",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/Key"
+        },
+        "label": {
+          "type": "string",
+          "maxLength": 512,
+          "description": "Display text. Absent from a manifest registered with a ballot box that holds no question text (VTI-VOT-014)."
+        }
+      }
+    },
+    "ElectionId": {
+      "title": "ElectionId",
+      "description": "An election's identifier, unique within its community. A closed alphabet: it appears in the ticket class label `voter/<electionId>` and is framed into every hash a cast is bound to.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,128}$"
+    },
+    "ElectionResult": {
+      "title": "ElectionResult",
+      "description": "An election's result, computable by anyone who can read its board from the board and the registration alone (VTI-VOT-070).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "manifestDigest",
+        "ballotsCounted",
+        "questions",
+        "head"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase"
+        },
+        "ballotsCounted": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "questions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/QuestionResult"
+          }
+        },
+        "head": {
+          "$ref": "#/$defs/BoardHead",
+          "description": "The head of the board as it stood at close: the result counts exactly its entries."
+        }
+      }
+    },
+    "BoardHead": {
+      "title": "BoardHead",
+      "description": "A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "treeSize",
+        "rootHash",
+        "issuedAt"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "treeSize": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "rootHash": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The RFC 9162 Merkle tree hash (SHA-256) of the first `treeSize` entries, as a multihash."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "QuestionResult": {
+      "title": "QuestionResult",
+      "description": "One question's totals. `choice`: selections per option. `ranking`: per option, how many ballots placed it at each position (index 0 = first). `score`: per option, the sum and the number of ballots that scored it. `text`: the answers, in board order, withheld (`withheld: true`) below the manifest's `textReleaseThreshold`. `abstained` counts ballots that left the question unanswered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "question",
+        "abstained"
+      ],
+      "properties": {
+        "question": {
+          "$ref": "#/$defs/Key"
+        },
+        "abstained": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "choice": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "integer",
+            "minimum": 0
+          }
+        },
+        "ranking": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        },
+        "score": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "sum",
+              "count"
+            ],
+            "properties": {
+              "sum": {
+                "type": "integer"
+              },
+              "count": {
+                "type": "integer",
+                "minimum": 0
+              }
+            }
+          }
+        },
+        "text": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 4096
+          }
+        },
+        "withheld": {
+          "type": "boolean"
+        }
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "RegistrarState": {
+      "title": "RegistrarState",
+      "description": "An election's state as its registrar holds it: the ballot box's `ElectionState` once the ballot box has registered the election, or, before that, `pendingRegistration` (the community is still delivering the registration) or `registrationRefused` (the ballot box refused it on a later delivery, and only a cancellation clears it). The first six values are the ballot box's `ElectionState` (voting/_shared/0.1).",
+      "type": "string",
+      "enum": [
+        "registered",
+        "registration",
+        "voting",
+        "closed",
+        "tallied",
+        "cancelled",
+        "pendingRegistration",
+        "registrationRefused"
+      ]
+    },
+    "Checkpoint": {
+      "title": "Checkpoint",
+      "description": "A board head the community read from the ballot box and kept, with the ballot box's signed document that carried it. Certification proves the board's final head consistent with every checkpoint, so a ballot box that rewrote its board after a checkpoint is caught.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "head",
+        "document"
+      ],
+      "properties": {
+        "head": {
+          "$ref": "#/$defs/BoardHead"
+        },
+        "document": {
+          "type": "object",
+          "description": "The ballot box's signed voting/board/head `#response` document whose payload carries `head`, kept whole and exactly as received — proof included — so anyone can verify it against the ballot box's DID without trusting the community."
+        }
+      }
+    },
+    "Certification": {
+      "title": "Certification",
+      "description": "The community's certification of the election's result, as vtc/elections/certify recorded it.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "result",
+        "certifiedAt",
+        "auditAttestations"
+      ],
+      "properties": {
+        "result": {
+          "$ref": "#/$defs/ElectionResult"
+        },
+        "certifiedAt": {
+          "type": "string",
+          "format": "date-time",
+          "maxLength": 64
+        },
+        "auditAttestations": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "type": "object",
+            "description": "A verifiable credential from an auditor the manifest names, as received."
+          }
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "VTC Elections — Show — response payload",
+      "description": "Success response to vtc/elections/show/0.1: one election, whole.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "manifest",
+        "manifestDigest",
+        "state",
+        "parameters",
+        "disclosure",
+        "checkpoints"
+      ],
+      "properties": {
+        "manifest": {
+          "$ref": "#/$defs/Manifest"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The SHA-256 multihash of the RFC 8785 (JCS) canonicalization of `manifest`. A ticket request names it, and every cast is bound to it."
+        },
+        "state": {
+          "$ref": "#/$defs/RegistrarState"
+        },
+        "parameters": {
+          "$ref": "#/$defs/VotingParameters",
+          "description": "The community's voting parameters the election's tickets are issued under (VTI-VOT-020)."
+        },
+        "disclosure": {
+          "$ref": "#/$defs/Disclosure",
+          "description": "How the election is run, generated from the manifest and the community's configuration (VTI-VOT-090). Always present: a member reads it before requesting a ticket."
+        },
+        "checkpoints": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "$ref": "#/$defs/Checkpoint"
+          },
+          "description": "The board heads the community has kept, oldest first. Empty until the community has read a head."
+        },
+        "ticketsIssued": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "How many tickets the community has issued for the election. Present only to a caller holding vtc.elections.manage."
+        },
+        "electionKey": {
+          "$ref": "#/$defs/ElectionKey",
+          "description": "The key a sealed or tallied-encrypted election's ballots are encrypted under, once its trustees have formed it (CONVENTIONS §9.6)."
+        },
+        "certified": {
+          "$ref": "#/$defs/Certification",
+          "description": "Present once the community has certified the result."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        },
+        "ceremony": {
+          "$ref": "#/$defs/TrusteeCeremony",
+          "description": "With electionKey: the trustees' signed steps it forms from, through the board's electionKey entry, each exactly as received. A voter's VTA forms the key itself from these (vta/pcs/vote-encrypted/0.4)."
+        }
+      }
+    },
+    "TrusteeCeremony": {
+      "title": "TrusteeCeremony",
+      "description": "The trustees' ceremony as the board holds it: the `request` of every `trusteeStep` entry, in board order, each exactly as the ballot box received it (CONVENTIONS §9.6). Whoever acts on it verifies each step as its trustee's before taking it; nothing in it is believed for having been passed along.",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 4224,
+      "items": {
+        "$ref": "#/$defs/SignedRequest"
+      }
+    },
+    "SignedRequest": {
+      "title": "SignedRequest",
+      "description": "A whole Trust Task request document — `id`, `type`, `issuer`, `payload` and every other member, `proof` included — exactly as the ballot box received it, never re-serialised: its proof is taken over its members, and a re-serialised copy does not reliably reproduce them. Typed as an open object so every member survives; CONVENTIONS §9.6 gives the checks that make it a trustee's step.",
+      "type": "object",
+      "minProperties": 1
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "ElectionKey": {
+      "title": "ElectionKey",
+      "description": "The election key and each trustee's public verification key, computed from the qualified dealings (CONVENTIONS §9.6). Anyone can recompute it from the board.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "qualified",
+        "verification"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/GroupElement"
+        },
+        "qualified": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/TrusteeIndex"
+          },
+          "description": "The dealers whose dealings the key is formed from."
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "trustee",
+              "key"
+            ],
+            "properties": {
+              "trustee": {
+                "$ref": "#/$defs/TrusteeIndex"
+              },
+              "key": {
+                "$ref": "#/$defs/GroupElement"
+              }
+            }
+          }
+        }
+      }
+    },
+    "GroupElement": {
+      "title": "GroupElement",
+      "description": "A Ristretto group element: its 32-byte compression, multibase base58btc. Never the identity (CONVENTIONS §9.1).",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "TrusteeIndex": {
+      "title": "TrusteeIndex",
+      "description": "A trustee's index: its position in the manifest's `trustees.dids`, counting from 1.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 64
+    },
+    "Disclosure": {
+      "title": "Disclosure",
+      "description": "The statement a community publishes, and shows a member before they request a ticket, about how one election is run (VTI-VOT-090). Generated from the election's manifest and the community's configuration, never written by hand.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ballotBox",
+        "ballotBoxOperator",
+        "sameOperator",
+        "boardVisibility",
+        "auditors",
+        "revote",
+        "coercionResistance"
+      ],
+      "properties": {
+        "ballotBox": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The ballot box's DID."
+        },
+        "ballotBoxOperator": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "Who operates the ballot box, as the community names them."
+        },
+        "sameOperator": {
+          "type": "boolean",
+          "description": "Whether the party operating the community's VTC also operates the ballot box."
+        },
+        "trustees": {
+          "$ref": "#/$defs/Trustees"
+        },
+        "boardVisibility": {
+          "$ref": "#/$defs/BoardVisibility"
+        },
+        "auditors": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048
+          },
+          "uniqueItems": true
+        },
+        "revote": {
+          "$ref": "#/$defs/Revote"
+        },
+        "coercionResistance": {
+          "const": false,
+          "description": "Always false: a voter can prove how they voted, so the community cannot protect a member against being made to vote a certain way."
+        }
+      }
+    },
+    "Revote": {
+      "title": "Revote",
+      "description": "What a later, different ballot under one ticket does: `replace` the earlier one, or be refused (`refuse`) (VTI-VOT-041).",
+      "type": "string",
+      "enum": [
+        "replace",
+        "refuse"
+      ]
+    },
+    "BoardVisibility": {
+      "title": "BoardVisibility",
+      "description": "`public`: anyone reads the board. `private`: the community, the auditors the manifest names and, for one cast's inclusion, the holder of its receipt (VTI-VOT-052).",
+      "type": "string",
+      "enum": [
+        "public",
+        "private"
+      ]
+    },
+    "Trustees": {
+      "title": "Trustees",
+      "description": "The trustees of a sealed or tallied-encrypted election and the number of them decryption needs (VTI-VOT-062). Neither the community nor the ballot box may be one.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "dids",
+        "threshold"
+      ],
+      "properties": {
+        "dids": {
+          "type": "array",
+          "minItems": 2,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048
+          },
+          "uniqueItems": true
+        },
+        "threshold": {
+          "type": "integer",
+          "minimum": 2
+        }
+      }
+    },
+    "VotingParameters": {
+      "title": "VotingParameters",
+      "description": "The community's published voting parameters: the PCS suite and the voting verification key tickets are issued under (VTI-VOT-020). Distinct from its hidden-vetting helper key.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "suite",
+        "votingKey"
+      ],
+      "properties": {
+        "suite": {
+          "type": "string",
+          "const": "ps-ddh-bls12381"
+        },
+        "votingKey": {
+          "$ref": "#/$defs/Multibase"
+        }
+      }
+    },
+    "Multibase": {
+      "title": "Multibase",
+      "description": "A binary value, multibase base58btc over the suite's canonical (compressed) encoding.",
+      "type": "string",
+      "maxLength": 16384,
+      "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$"
+    },
+    "DigestMultibase": {
+      "title": "DigestMultibase",
+      "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
+      "type": "string",
+      "minLength": 16,
+      "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$",
+      "examples": [
+        "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
+      ]
+    },
+    "Manifest": {
+      "title": "Manifest",
+      "description": "What an election asks and how it is decided (VTI-VOT-010). Its digest (`manifestDigest`) is the SHA-256 multihash of its RFC 8785 (JCS) canonicalization, and every cast is bound to it (VTI-VOT-011).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "community",
+        "questions",
+        "secrecy",
+        "roll",
+        "registrationOpensAt",
+        "votingOpensAt",
+        "votingClosesAt",
+        "revote",
+        "board",
+        "ballotBox",
+        "binding",
+        "allowEarlyClose",
+        "resultsBeforeClose",
+        "textReleaseThreshold"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "community": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The community's DID."
+        },
+        "title": {
+          "type": "string",
+          "maxLength": 512
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 8192
+        },
+        "questions": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "$ref": "#/$defs/Question"
+          }
+        },
+        "secrecy": {
+          "$ref": "#/$defs/SecrecyLevel"
+        },
+        "roll": {
+          "$ref": "#/$defs/RollRule"
+        },
+        "registrationOpensAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "votingOpensAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "votingClosesAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "revote": {
+          "$ref": "#/$defs/Revote"
+        },
+        "board": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "visibility",
+            "auditors"
+          ],
+          "properties": {
+            "visibility": {
+              "$ref": "#/$defs/BoardVisibility"
+            },
+            "auditors": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 2048
+              },
+              "uniqueItems": true
+            }
+          }
+        },
+        "ballotBox": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "description": "The DID of the voting service that holds the board."
+        },
+        "trustees": {
+          "$ref": "#/$defs/Trustees"
+        },
+        "binding": {
+          "type": "boolean",
+          "description": "Whether the community treats the result as deciding something; creating a binding election takes another administrator's consent (VTI-VOT-081)."
+        },
+        "allowEarlyClose": {
+          "type": "boolean"
+        },
+        "resultsBeforeClose": {
+          "type": "boolean",
+          "description": "Open elections only: whether running totals may be read while voting is open (VTI-VOT-061)."
+        },
+        "textReleaseThreshold": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Counted ballots required before any text answer is disclosed (VTI-VOT-065). At least 1, and SHOULD be at least 10: a written answer can identify its author by what it says or how it is phrased, and the fewer the ballots released together, the easier that is. Where it is below 10, the disclosure a member is shown before they request a ticket MUST say so, and MUST say that a written answer may identify its author (VTI-VOT-090)."
+        }
+      }
+    },
+    "RollRule": {
+      "title": "RollRule",
+      "description": "Who may be issued a ticket (VTI-VOT-021): the community's active members, its active members and the parties `listed` names, or only the parties `listed` names.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "rule"
+      ],
+      "properties": {
+        "rule": {
+          "type": "string",
+          "enum": [
+            "members",
+            "membersAndListed",
+            "listed"
+          ]
+        },
+        "listed": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048,
+            "description": "A DID enfranchised by name."
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "SecrecyLevel": {
+      "title": "SecrecyLevel",
+      "description": "`open`: ballots are recorded on the board as cast. `sealed`: ballots are encrypted to a jointly generated election key and decrypted after voting closes. `talliedEncrypted`: ballots are encrypted and only the totals are ever decrypted (VTI-VOT-060). The encrypted levels are cast with `voting/ballot/cast-encrypted/0.1`, under an election key the trustees generate with `voting/trustees/*` (CONVENTIONS §9).",
+      "type": "string",
+      "enum": [
+        "open",
+        "sealed",
+        "talliedEncrypted"
+      ]
+    },
+    "Question": {
+      "title": "Question",
+      "description": "One question. Tagged union over `type`.",
+      "oneOf": [
+        {
+          "title": "ChoiceQuestion",
+          "description": "Select between `minSelections` and `maxSelections` of `options`. A yes/no/abstain motion is a choice of exactly one of three.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "options",
+            "minSelections",
+            "maxSelections",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "choice"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "options": {
+              "type": "array",
+              "minItems": 2,
+              "maxItems": 256,
+              "items": {
+                "$ref": "#/$defs/QuestionOption"
+              }
+            },
+            "minSelections": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "maxSelections": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "title": "RankingQuestion",
+          "description": "Order `options`; a ballot ranks every option or, when `partial` is true, a prefix of them.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "options",
+            "partial",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "ranking"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "options": {
+              "type": "array",
+              "minItems": 2,
+              "maxItems": 64,
+              "items": {
+                "$ref": "#/$defs/QuestionOption"
+              }
+            },
+            "partial": {
+              "type": "boolean"
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "title": "ScoreQuestion",
+          "description": "Give each option an integer score within [min, max].",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "options",
+            "min",
+            "max",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "score"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "options": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 256,
+              "items": {
+                "$ref": "#/$defs/QuestionOption"
+              }
+            },
+            "min": {
+              "type": "integer"
+            },
+            "max": {
+              "type": "integer"
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "title": "TextQuestion",
+          "description": "Free text of at most `maxLength` characters.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "key",
+            "type",
+            "maxLength",
+            "optional"
+          ],
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/Key"
+            },
+            "type": {
+              "const": "text"
+            },
+            "text": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "maxLength": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 4096
+            },
+            "optional": {
+              "type": "boolean"
+            }
+          }
+        }
+      ]
+    },
+    "Key": {
+      "title": "Key",
+      "description": "A question or option key, unique within its manifest or question.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,64}$"
+    },
+    "QuestionOption": {
+      "title": "QuestionOption",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key"
+      ],
+      "properties": {
+        "key": {
+          "$ref": "#/$defs/Key"
+        },
+        "label": {
+          "type": "string",
+          "maxLength": 512,
+          "description": "Display text. Absent from a manifest registered with a ballot box that holds no question text (VTI-VOT-014)."
+        }
+      }
+    },
+    "ElectionId": {
+      "title": "ElectionId",
+      "description": "An election's identifier, unique within its community. A closed alphabet: it appears in the ticket class label `voter/<electionId>` and is framed into every hash a cast is bound to.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9._-]{1,128}$"
+    },
+    "ElectionResult": {
+      "title": "ElectionResult",
+      "description": "An election's result, computable by anyone who can read its board from the board and the registration alone (VTI-VOT-070).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "manifestDigest",
+        "ballotsCounted",
+        "questions",
+        "head"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "manifestDigest": {
+          "$ref": "#/$defs/DigestMultibase"
+        },
+        "ballotsCounted": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "questions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/QuestionResult"
+          }
+        },
+        "head": {
+          "$ref": "#/$defs/BoardHead",
+          "description": "The head of the board as it stood at close: the result counts exactly its entries."
+        }
+      }
+    },
+    "BoardHead": {
+      "title": "BoardHead",
+      "description": "A board's tree head (RFC 9162 §2.1). A head is signed by being carried in a document the ballot box signs; whoever keeps a head keeps that whole document.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "electionId",
+        "treeSize",
+        "rootHash",
+        "issuedAt"
+      ],
+      "properties": {
+        "electionId": {
+          "$ref": "#/$defs/ElectionId"
+        },
+        "treeSize": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "rootHash": {
+          "$ref": "#/$defs/DigestMultibase",
+          "description": "The RFC 9162 Merkle tree hash (SHA-256) of the first `treeSize` entries, as a multihash."
+        },
+        "issuedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "QuestionResult": {
+      "title": "QuestionResult",
+      "description": "One question's totals. `choice`: selections per option. `ranking`: per option, how many ballots placed it at each position (index 0 = first). `score`: per option, the sum and the number of ballots that scored it. `text`: the answers, in board order, withheld (`withheld: true`) below the manifest's `textReleaseThreshold`. `abstained` counts ballots that left the question unanswered.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "question",
+        "abstained"
+      ],
+      "properties": {
+        "question": {
+          "$ref": "#/$defs/Key"
+        },
+        "abstained": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "choice": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "integer",
+            "minimum": 0
+          }
+        },
+        "ranking": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        },
+        "score": {
+          "type": "object",
+          "propertyNames": {
+            "$ref": "#/$defs/Key"
+          },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "sum",
+              "count"
+            ],
+            "properties": {
+              "sum": {
+                "type": "integer"
+              },
+              "count": {
+                "type": "integer",
+                "minimum": 0
+              }
+            }
+          }
+        },
+        "text": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 4096
+          }
+        },
+        "withheld": {
+          "type": "boolean"
+        }
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: false,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;