Implementable protocols for the build. Strategy lives in CLARK-COMMONS.md §23 (the trust ladder); this file is what ClaudeCode enforces in code and what the public threat-model page is rendered from. Principles: smallest possible attack surface, smallest possible blast radius, verifiability over assurance, and a published plan for failure.
Class A — Public corpus (budget documents, summaries, issues, aggregate results, logs): public by definition. Integrity is the only concern: source PDFs are hashed on ingest (SHA-256 recorded), and rendered numbers carry citations back to hashed sources so tampering is detectable.
Class B — civic.db (votes, statements, paper batches, moderation log): pseudonymous. Votes reference participant IDs, never contact info. Treated as confidential-but-survivable: a leak must not be able to deanonymize anyone by itself.
Class C — identity.db (contacts, verification tier, channel addresses): the crown jewels and the only store whose breach harms individuals. Everything in §3–§5 exists to keep Class C small, encrypted, separate, and boring.
Standing rule: collect the minimum. No birthdates, no SSNs, no precise addresses beyond what a tier method requires; verification artifacts (e.g., postcard codes) are deleted after confirmation, not retained.
Never logged anywhere: identity↔vote joins, magic-link tokens, SMS message bodies beyond parse results, verification artifacts. IP addresses only in short-retention (14-day) security logs for rate limiting and abuse response, then dropped. Public append-only logs (moderation, corrections, AI cost) contain no personal data by construction. Admin actions (settles, batch entries, config changes) are logged with operator ID — the operator is watched too.
Nightly encrypted backups; civic.db and identity.db go to separate destinations with separate credentials, so no single compromised backup store reunites them. Corpus and code are public — their backup is the repo and the archive. Quarterly restore drill (part of the seasonal rhythm): prove the backups actually restore, time it, note it in the ops log.
Single-admin model, stated honestly. Hardware-key 2FA on everything that matters: VPS provider, registrar, DNS, Twilio, email sender, repo. No shared credentials ever. Admin UI reachable only over authenticated session with the same 2FA; no long-lived admin cookies. A written envelope procedure (sealed credentials for a designated successor) so the bus-factor of one degrades softly, like everything else.
/.well-known/security.txt with a real contact; plain-language safe-harbor statement (good-faith research will be thanked, not threatened); acknowledged within 72 hours; fix-or-explain within 30 days; reporter credited on the corrections log if they wish. Standing public invitation to Henderson State and Ouachita CS programs to audit as coursework — findings published either way (CLARK-COMMONS.md §23.3).
What counts as an incident: any unauthorized access to Class B or C, any integrity failure in published numbers, any sustained outage of the vote gate during an open issue window. Commitments: affected individuals notified directly if Class C is touched; a public plain-language post-mortem within 7 days for any incident, on the corrections log; no silent fixes. The first incident handled this way builds more trust than zero incidents claimed.
Dependency minimalism as policy: every package justified in a comment in package.json; prefer stdlib and boring choices; lockfile pinned; monthly dependency review in the Monday batch (security advisories first). OS patches automatic for security channel. The fewer moving parts, the fewer CVEs apply — smallness is the patch strategy.
No SLA — per NEVER.md, no promises with clocks. Instead: degrade-soft design. The public site is served from pre-rendered content and survives the app process dying; voting windows are days long, so hours of downtime never disenfranchise; paper never goes down. State this plainly on the threat-model page: the system is built so that its failures are boring.
For a public-by-design system, confidentiality protects little — tampering is the attack. The activity log is therefore the system's true security core, and it must be trustworthy against everyone, including the operator.
13.1 Append-only, hash-chained. Every state change is a log entry: votes (pseudonymous ID), issue opens/closes, ingestions (with document SHA-256), publishes, config changes, moderation actions, corrections, settles, admin actions with operator ID. Each entry contains the hash of the previous entry — a tamper-evident chain where any retroactive edit breaks every hash after it, visibly. No deletes, no updates; mistakes are corrected by new entries that reference the old.
13.2 External anchoring — the watcher is watched. The chain's head hash is published on a schedule (nightly) to places the operator does not control: the public site, the public git repo, and at least one independent witness (e.g., an archived snapshot). Once anchored, not even the operator can rewrite history without the world's copies disagreeing with his. This is the log's answer to "why should we trust the guy running it": you don't have to.
13.3 The automated watchdog (nightly, results public).
13.4 Everyone is the watchdog. The repo ships a verification tool (verify.js): anyone can download the public log, verify the chain against the anchored heads, and recount the published aggregates themselves. Henderson students, political rivals, journalists, the county's own staff — the more adversarial the verifier, the better the system looks when it holds. Same move as open books: don't request trust, hand out the recount tool.
13.5 The public log is coarsened — the deanonymization caveat. Precise per-vote timestamps in a public log enable timing correlation in a small county ("I saw her on her phone at 2:14"). The internal log keeps full fidelity under the hash chain; the public log exports vote events aggregated to coarse buckets (hourly or daily) with tier/channel counts, honoring the same under-20 range floor as every other surface. Integrity transparency never becomes a side door around participant privacy.