Officer & admin guide — publicvoting.org

Your responsibilities

Bootstrap and secure officer accounts (password, optional TOTP)
Choose a procedure pack and governance settings
Register members (dual control when the pack requires it)
Issue bind tokens / QR so voters can attach a device
Create and lifecycle decisions (draft → open → close → tally)
Publish system fingerprint so members can reject look-alikes
Hold tallier key shares safely; run open ceremony after close
Export audit packs and review the append-only log

What you must never do

Cast a member ballot from the officer portal (there is no such path)
Assign a privileged role to yourself
Share long-lived bind tokens publicly or leave them in chat logs
Store all tallier shares on one laptop or in one password manager entry

First hour

From empty instance to verified cast

Follow this path once when standing up a system (demo, hosted, or self-host).

Create the voting system
Pick a stable slug and display name. Choose a procedure pack (e.g. club_basic, board_company). Prefer Apply pack settings so dual control, TOTP, and window defaults land immediately.
Bootstrap the first officer
Email + strong password → session. If the pack requires TOTP, enrol before further mutations. Store recovery codes offline.
Confirm settings & fingerprint
Load current settings. Note the system fingerprint (short form fp XXXX-XXXX-XXXX). Publish it to members so they can reject phishing look-alikes.
Appoint a second officer
When the pack requires two admins before live decisions, appoint officer 2. Dual-control membership needs a different officer to approve proposals.
Membership
Add voters (or propose → approve under dual control). Issue a one-time bind token with short TTL. Share via portal share card / QR (publicvoting://bind?…) out of band — not on a public web page.
Member binds a device
Member confirms fingerprint matches yours. They write down any recovery secret. You should see an active binding — not a portal cast.
Create a decision
Prefer draft when min-argue hours apply. Lifecycle shows when open is allowed. Emergency open only if pack allows — it is permanently logged.
Open the vote window
Opening freezes the roll commitment (eligible set). Late members do not gain a vote on this decision. Arguments/options freeze per policy.
Members cast from devices only
Track inclusion via public pages / trackers. Do not ask members to screenshot their choice in Mode B.
Close, tally, audit
After close, reconstruct ballot key with threshold shares (default 2-of-3). Publish tally. Download audit pack; optionally verify offline with the open-source verifier CLI.

Day-to-day officer operations

Task	Guidance
Policy changes	Edit settings carefully; save only dirty fields. Significant changes should be explained to members and leave a log trail.
Empty opposition	Binary motions: pack policy is banner or block open. Prefer nominating an opposing advocate early.
Emergency open	Use rarely. Logged as emergency / min-argue skipped. Reviewable in the log browser preset.
Recovery lockouts	Failed recoveries may lock a voter. Unlock only after out-of-band identity check.
Cooling-off after recover	Default 24h before cast after phone recovery. Clear only with good reason and dual process if required.
Clerk export	Membership / decisions / outcomes CSV when feature enabled. Public audit chain remains separate.
Chair cast (tie-break)	Procedural officer action after tally when tie_break=chair_cast — not a Mode B ballot.

Security hygiene for officers

Use unique passwords; enable TOTP when available
Revoke sessions on shared or lost devices
Treat bind tokens like one-time passwords
Split tallier shares across people and storage
Never paste ballot private material into tickets or chat
Watch membership spikes and recovery spikes before high-stakes opens

Security model Feature list Architecture