For visitors who'd rather read than walk.
# Contested local vote — verifiable count, private voter, no false choice
You're the secretary of an HOA board. Last spring's vote almost
ended in a recount fight, and the next contested vote is six weeks
away.
The hook on Merkle Trust's landing arrives in your language: the
count must be verifiable; the voter must remain private; today's
tools force you to choose. You should not have to choose.
Nothing to type, nothing to commit to. The walk plays itself from
here.
The walk is the test drive — no install required. Synthetic ballots,
24-hour expiry, never a real voter's data. Real votes run on the
association's own hardware.
Four real install paths exist when you decide to act. For an HOA or
local-civic body running periodic contested votes, the order is:
Subscribe to a regional operator. A civic-compliance operator
runs the chain on infrastructure under whatever state association
rules apply. The board configures the eligibility roll and director
keys; the operator handles the scaffolding. The path most HOAs take
because the board does not run servers.
Paste the markdown into your LLM. Card files plus documentation
into Claude or another LLM you trust. Lightest path.
Clone GarrisonNode from GitHub. Self-install on the association's
own laptop. The deepest sovereignty path; appropriate when the
board has technical capacity and the by-laws permit on-prem voting
infrastructure.
Join the mesh. GitHub install plus mesh anchoring with peer
associations and, optionally, an external public-record verifier
the by-laws designate. The deepest path.
The walk continues without committing.
A sandboxed Merkle Trust loads with a synthetic election: Sycamore
Ridge HOA, fence-replacement assessment, March 2026. The voting
secretary on the desk animation places the materials on the count
table.
Two hundred forty-four cast ballots, each a hash of contents
bound to a voter credential, with no link visible to anyone.
Three proxies.
Eight spoiled ballots — each marked-spoiled at the moment of
spoiling, with a reason sealed alongside.
The eligibility roll, sealed at notice-of-meeting and immutable
since.
The board's five director verification keys, each tied to a
named director.
The walk takes the recount-defense walkthrough — the one that costs
sleep. The walkthrough plays as a member-meeting transcript. A
losing voter demands a recount. To demonstrate verification, the
panel asks you to step through the verification flow as if you were
that voter.
The card displays the verification record as the meeting minutes
would log it:
```
═══════════════════════════════════════════════
RECOUNT REQUEST · SYCAMORE RIDGE HOA
Fence-replacement assessment · March 2026
═══════════════════════════════════════════════
REQUESTING MEMBER
"I want to verify the count without
anyone seeing how I voted."
SYSTEM RESPONSE
- Eligibility: roll sealed at notice
of meeting. 244 cast / 247 eligible.
Verifiable against the sealed roll.
- Tally: signed by 3 of 5 directors,
each signature time-stamped, each
public key on the by-laws record.
- Privacy: each ballot is a commitment
to its contents. The contents
aggregate; the voter's choice does
not link back to the voter.
- The requesting member can verify the
count. They cannot reveal anyone's
individual vote — including their own.
═══════════════════════════════════════════════
```
The voting secretary lifts the seal on the tally; the ticker streams
the verification of each ballot's commitment against the eligibility
roll; the recount completes. The losing voter sees the count is
right; the privacy of every ballot — including theirs — held.
Each ballot is a cryptographic seal of the ballot's contents bound
to a voter credential through a commitment scheme. The contents
aggregate when the tally runs; the voter's individual choice never
links back to the voter, not even for the voter themselves.
The tally is signed by 3 of 5 directors. Three director
signatures are required to seal the tally. Five named directors hold
the keys; any three of them — collectively, in real time, in front
of the assembled membership — can produce a tally that the chain
treats as the official result. No single director can seal a tally
alone.
The eligibility roll was sealed at notice-of-meeting and cannot be
edited after. A roll change between the notice and the close of
voting requires a new notice and a new vote. The system enforces
this by anchoring the roll at notice-of-meeting time.
The "Anchored here" link resolves to a real receipt: a real merkle
root, a real timestamp, a one-line explanation.
The .md button at the bottom puts a structured summary of this
verifiable-but-private pattern into your tag-along bundle —
including the recount-record slab verbatim. If you would like a
critical reviewer to read it and ask questions a board attorney
might ask, the comment field carries one to your own claude.ai
session — with the full prompt shown to you before it sends.
Run the tally ceremony. Three of five directors must sign the tally
for it to seal. This is a real public ceremony — the directors are
not props.
The voting secretary collects each director's signed acknowledgment
in turn. Real crypto.subtle.digest runs in your browser when each
director signs — the directors' keys are session-real, the signatures
are session-real, the tally root is session-real. When the third
signature lands, the tally seals. The progress bar reads "done —
244 ballots tallied, 3 of 5 director signatures verified, new anchor
at " followed by the first eight hex characters of the root.
The output: the count is sealed. The privacy of every ballot held.
Here is today's proof — verifiable by any member, by any title
company, by any state-association observer.
Three ways to leave, no pressure either way.
Whichever direction the walk takes from here, you take a signed
package with you — yours to keep, downloaded directly when you
finish. The package contains the manifest, the certificate of
registration, the architecture docs, the verification scripts
(verify.sh and verify.py, stdlib only), a claude_prompt.md for
independent audit, the JSON schemas, and a DISCLAIMERS.md.
A second file rides along with the cert: a recovery seed. Twelve
words written into a file with a self-protecting preamble — if it
ever ends up pasted into an LLM by accident, the preamble tells the
LLM to STOP and warn the user. Daily access uses the cert; the seed
is the fire exit.
The most useful close for an HOA secretary is to take the partner
kit too. The state HOA association meets in June, and the materials
are ready for the agenda.
<!-- finish_text -->
That was the simulated path through Carmen's recount defense and
tally ceremony. The real version runs against your own association's
roll, your own ballots, your own board's signing keys. The
verification URL becomes the URL on every notice-of-meeting from now
on — verification is the default expectation, not a fight.