Method

One person, one vote

Government ID verification binds a uniqueness token to a person. A handle is not a franchise. A second account that carries the same token cannot cast a second ballot — including in the share-weighted org example, where weight is applied once.

Where eligibility comes from

• Uniqueness — from ID verification. Raw IDs are never stored. The board never sees the token; the receipt shows a short fingerprint.
• Location — from X About this account (inferred country and city). City and national polls read that field, not a scanned address.
• Shares — from a record-date cap table in the org scope. Only that example is share-weighted.

No results before close

Open elections publish participation — how many ballots or shares have been recorded — and hide the running tally. A live count of choices would turn the ballot into a feed. After close, the aggregate is public, with turnout and whether quorum was met.

Receipts and the board

A ballot writes a SHA-256 commitment of election | choice | nonce. The board stores the hash, a confirmation code, a timestamp, and the weight. The choice stays on the voter's receipt. Looking up the code proves inclusion without opening the vote.

Who may create what

Org and city polls can be drafted in this demo. National and planetary polls require a petition of in-scope, ID-verified accounts plus Civic review. The form simulates that gate rather than pretending a single account can bind a planet.

Why ranking stays out

If For You can promote a question, the election becomes content. Civic has no replies, no quote-posts, no impression score on the charter. Distribution is: you open Civic, or you don't. That is the point.

What this does not solve

A prototype cannot prove coercion resistance on a phone, recover from a compromised device, or stand in for a statute. It can show the product boundary: identity in, ranking out, sealed until close.