How a number earns its place in our record.

The pipeline

Stage	What happens	Evidence artifact
Capture	Field workers photograph and report official per-station tally sheets. Offline-capable by design; the cryptographic hash is computed at capture, so the evidence chain starts on the device.	Capture record: image, SHA-256, UTC timestamp, station key (aggregate unit — never voter-level), capturing role.
Verify	Structured tallies are extracted from the sheet (per-country document profiles) and human-confirmed per routing rules.	Extraction record with model/version, confidence, and confirmation state.
Aggregate	Independent totals with real statistics: confidence intervals, finite-population correction, stratification hooks. Uncertainty is published as ranges, never disguised as precision.	Statistical summary with coverage and interval math shown.
Reconcile	Aggregate-level comparison against the official record — always attributed to the electoral authority. Discrepancies carry both values and both sources.	Reconciliation report; official-record snapshot with source URL, retrieval time, content hash.
Preserve	Content credentials (C2PA), manifests, engagement-scoped audit log, custody record; on activation, a bundle any receiving counsel can verify independently.	Evidence bundle: manifest, hash chain, audit slice, verification procedure.

Standing rules

• Provenance on every number. Source, date, and — where a model was involved — the model and version; or a logged N/A. In our 2026 production engagement the automated monitor held this on every run across four days: it never estimated what it could not see.
• Attribution discipline. Official results are always the electoral authority's, cited as such — never presented as our own count.
• No win-calls. We report verified aggregates, uncertainty, coverage, and reconciliation status. During preliminary counts we make no public claims; results are acknowledged only on official proclamation.
• Aggregate-only, architecturally. Polling station, precinct, municipality and up. No voter-level substrate exists in our systems.
• Human accountability. No automated action moves people or publishes conclusions without a logged human approval.
• Rehearsed reachability. No live engagement proceeds until automated monitoring is proven able to read both our platform and the official sources from the real operating environment — a gate we adopted from our own postmortem.

Capability status — stated exactly

Production-proven: the national field-capture and evidence-chain operation; the provenance-or-logged-N/A discipline across a four-day count window; platform health OK on all ~42 automated monitor runs; the capture→structured-report→routing field loop; continuously CI-tested engagement isolation (zero cross-engagement reads across the row-level-security sweep).

Held as a dataset: a 5,101 tally-sheet analyzed, provenance-tagged sample from the 2026 engagement — our living demo set, shown on request.

We maintain this distinction in a claims registry that governs every external sentence we publish, this page included. If a capability's status changes, the registry changes first and the copy follows.