The office looking at itself. Everything below is recorded by the office in the ordinary course; none of it is disclosed to anyone.
X2
No deployment exposes this
The office's log names who asked for a token and when. That is a
participation list — the object §3.7 spends a page keeping out of anyone
else's hands, because the absence of an entry is conclusive
evidence that a citizen did not vote, which is exactly what an enforcer of
a boycott needs. It is on screen here so the difference between what the
office knows and what it says can be seen at once, and nowhere else.
A deployment has no such switch: it signs as soon as it has validated, and the reservation exists for concurrency rather than for deliberation. Checking the eligibility of an identifier and recording its release are two steps, and without an atomic claim between them two concurrent requests for one citizen can both pass — producing two tokens, with nothing in the published artefacts to show it. The switch holds that real state open long enough to be looked at.
| reserved | blinded value |
|---|
Releasing writes the commitment and then signs, in that order and not one moment earlier: a commitment written at validation would make the pause visible to anyone counting and overstate the tokens that exist. Cancelling clears the claim, which a citizen otherwise carries for ever with nothing published and no token.
§3.2: the two failures that arise before the office knows who it is speaking to must be reported identically. Otherwise anyone able to spell an identifier could submit an unsigned request and learn from the answer whether that citizen holds a certificate and sits on the register — the token endpoint would become a register lookup service, which nothing in the design intends and to which no citizen consented. Rows where the two columns differ are the boundary doing its work.
| identifier | recorded by the office | disclosed to the requester |
|---|
Published as tokens are released, as commitments rather than identifiers. The count lets anyone check that accepted ballots do not outnumber the tokens issued; the commitments let one voter, and only that voter, establish whether a token was released in their name. A plaintext register would have to surrender one of those.
| entry | commitment hash([id, opening]) |
|---|---|
| … | |
—