# MODULE COMPLETION MATRIX

**BB2G Election Command** — 2026-08-15.

> **Generated from `assets/registry.mjs`.** Every mark in the 68-row table below is
> *derived* by a printed rule, not typed by hand, so no mark can be more generous
> than the data supports.
> `sha256(assets/registry.mjs)` = `b4a80c1724e5f1de08392b3aa7ed33d418c9939408fcafed8a83dbd6a1042e42`

---

## Read this first

The blueprint gives the rule this document exists to obey:

> "Claude cannot mark: **Module 17 — COMPLETE** because `/ballot-chain-of-custody`
> renders." … **"No green checkmark should be given for a stub."**

So, stated before the tables rather than after them:

**Zero of the 68 domain modules are complete. Zero are implemented.**

What this build actually ships is a foundation:

- a working **LockChain Core** — canonical events, four separately-reported
  integrity layers, an append-only ledger with no mutating method, signed
  checkpoints, inclusion proofs, and the evidence-ladder guard — **18/18 gate
  checks passing, 8 of them poison runs**;
- a working **authority resolution + source currency + Copilot abstention**
  engine — **14/14 gate checks passing, 2 of them poison runs in opposite
  directions**;
- a **canonical module registry** of 68 modules with their workflows, data
  objects, domain events, acceptance gates and shared-service dependencies.

What this build is **not**:

- It is not a deployed county system. `electioncommand.bornbetween2generals.com`
  returns no certificate over HTTPS and `404` over HTTP; nothing is live there.
- There is **no database**, no schema, no migration, no API endpoint, no session,
  no role assignment and no authorization test anywhere in this repository.
- No module has a test of its own. `test/` contains exactly two files, both
  gating shared engines, neither gating a module.
- Nothing has been integrated with, or even contacted, any real jurisdiction.

A reader who wants one sentence: **the spine is real and gated; the sixty-eight
modules are paperwork.** Good paperwork — checkable, versioned, generated from
data — but paperwork.

---

## Legend

| Mark | Meaning |
|---|---|
| `✓` | **Built and gated.** A file exists and a named test asserts the behaviour, including at least one poison run where the property can be poisoned. Never issued without pointing at both. |
| `◐` | **Specified.** A written, checkable target exists in `assets/registry.mjs`. Nothing is implemented. |
| `—` | **Not started.** No specification and no code. |
| `n/a` | **Not applicable** to this module, per its declared shared-service dependencies. |

`n/a` is used only where the registry itself says the service is not consumed —
`Offline` for the 40 modules that are not field surfaces, `Currency` for the 56 that
depend on no external authority. It is never used to hide a gap.

---

## The eleven dimensions

Taken from the blueprint's own list of what "complete" must mean, and carried in
`COMPLETION_DIMENSIONS` so the columns and the definitions cannot drift.

| # | Column | A `✓` requires |
|---:|---|---|
| 1 | **UI** | Every workflow in the module is reachable and operable in the role surfaces that own it, with real error states — not a rendering route. |
| 2 | **API** | Documented endpoints for every workflow, with validation, idempotency and versioned request/response contracts. |
| 3 | **DB** | Database model and migrations for the module’s primary objects, including correction links rather than in-place edits of history. |
| 4 | **AuthZ** | RBAC + ABAC permissions with jurisdiction scope, least privilege, and authorization tests that prove denial as well as access. |
| 5 | **Audit** | Domain events emitted to LockChain with canonical hashing, signed receipts and independent verification material. |
| 6 | **Offline** | Defined offline behaviour: encrypted local queue, idempotent replay, honest sync state, and a locally-saved state that can never be mistaken for a server acknowledgement. May be N/A where the module is not a field surface. |
| 7 | **Security** | Security tests, secret and key handling, logging of security events, and no unauthorized control channel to any voting system. |
| 8 | **Accessibility** | WCAG 2.2 conformance for the web and kiosk-like surfaces, including the mobile and hybrid application guidance. |
| 9 | **Currency** | Source dependencies registered with section-level dates, supersession and stale-source warnings, with human review. May be N/A where the module depends on no external authority. |
| 10 | **Tests** | Workflow tests, authorization tests and security tests that fail loudly; a stub earns no green checkmark. |
| 11 | **Docs** | Operational documentation including backup/recovery treatment, retention treatment and operational acceptance. |

---

## Part 1 — The shared foundation (this is where the ✓ marks are)

The blueprint's build order puts the foundation first: *"sixty modules built before
shared authorization, evidence and event architecture are mature simply produces
sixty places that later have to be rewritten."* This is the state of those ten
shared services.

| Shared service | State | Evidence you can point at |
|---|---|---|
| **LockChain Ledger Core** | `✓` built & gated | `assets/lockchain.mjs` (709 lines) + `assets/crypto.mjs` (386 lines). `node test/engine.mjs` → **18/18 passed**. |
| **Jurisdiction Rules Engine** | `✓` built & gated | `assets/authority.mjs` (283 lines), `resolve()` / `appliesTo()` / `specificity()`. `node test/gate-authority.mjs` → **7 AUTHORITY RESOLUTION checks passing**, incl. two opposed poison runs. |
| **Election Knowledge Currency Engine** | `✓` built & gated | `assets/authority.mjs`, `checkCurrency()` / `sectionState()` / `certificationView()`. **4 SOURCE CURRENCY checks passing**, incl. the 2020-deadline trap. |
| **AI Election Copilot** (abstention rule only) | `✓` built & gated | `assets/authority.mjs`, `copilotAnswer()` + `COPILOT_REQUIRED_FIELDS`. **3 ABSTENTION checks passing**. This is the *refusal* half only — there is no retrieval, no model, no index. |
| **Offline Sync Core** | `◐` partial | `SYNC_STATES` + `syncTone()` in `assets/lockchain.mjs` are built and gated (*"a held sync state can never share a tone with a confirmed one"*). The encrypted local queue, idempotent replay, conflict handling and server acknowledgement **do not exist**. |
| **Evidence Core** | `—` not started | `payload_hash` and `attachment_manifest_hash` exist as event fields. No vault, no derivatives, no legal hold, no classification. |
| **Identity & Authorization Core** | `—` not started | An event refuses to exist without an `actor_id` (gated). That is the whole of it. No MFA, no RBAC, no ABAC, no device trust. |
| **Notifications & Escalation Core** | `—` not started | — |
| **Reporting & Document Core** | `—` not started | — |
| **Observability & Security Core** | `—` not started | — |

**Four of ten shared services are built and gated. One is partial. Five have not
been started.** The four that exist are the four the blueprint puts first, which is
the right order — but four is not ten, and ten is what sixty-eight thin domain
modules were supposed to sit on.

### The gate output, as actually run

```
$ node test/engine.mjs
LOCKCHAIN CORE
  ok   a clean ledger passes all four layers
  ok   POISON layer 1 · an edited event breaks RECORD integrity only
  ok   POISON layer 2 · a removed event breaks SEQUENCE integrity
  ok   POISON layer 2 · a reordered pair breaks SEQUENCE integrity
  ok   POISON layer 3 · an unregistered signer breaks SIGNER integrity
  ok   POISON layer 3 · a forged signature breaks SIGNER integrity
  ok   POISON layer 3 · THE DUPLICATE-LEAF COLLISION — a lied-about event_count is caught
  ok   POISON layer 4 · deleting a committed event breaks RETENTION integrity

DOCTRINE
  ok   a correction APPENDS and never edits the original
  ok   the Ledger exposes NO mutating method
  ok   a machine may not assert ALLEGATION, EVIDENCE, FINDING or CONCLUSION
  ok   a machine narrative using a conclusion word is REFUSED, and names the word
  ok   scanMachineText calibrates BOTH ways
  ok   a held sync state can never share a tone with a confirmed one
  ok   an event refuses to exist without an accountable actor
  ok   an inclusion proof verifies standalone against the signed root
  ok   describeLimits refuses the word "immutable" and states the truth boundary
  ok   a verification result never claims truth

18/18 passed
```

```
$ node test/gate-authority.mjs
AUTHORITY RESOLUTION
  ok   POISON A · a federal framework does NOT outrank controlling state law on PROCEDURE
  ok   POISON B · controlling state law does NOT make the framework irrelevant on CYBERSECURITY
  ok   the sort never uses issuer altitude — only specificity, then binding force
  ok   a superseded instrument is excluded and SAYS SO
  ok   an instrument not yet effective is excluded
  ok   an out-of-scope instrument does not leak across jurisdictions
  ok   resolution refuses to run without a jurisdiction

ABSTENTION
  ok   no controlling authority on a procedural question ⇒ the Copilot ABSTAINS
  ok   a RETRIEVED-but-unverified source ⇒ the Copilot still ABSTAINS
  ok   a good answer carries every required field and the "do not infer" guardrail

SOURCE CURRENCY
  ok   THE 2020-DEADLINE TRAP · a page that fetches fine can still be STALE per section
  ok   a successful fetch is RETRIEVED, never VERIFIED — only a named human promotes it
  ok   an old verification goes STALE on its own
  ok   certification counts are MEASUREMENTS with a timestamp, never constants

14/14 passed
```

And, run separately against the shipped `assets/crypto.mjs` for this audit:

```
  ok   RFC 8032 §7.1 TEST 1  pubkey=true signature=true verify=true poison-rejected=true
  ok   RFC 8032 §7.1 TEST 2  pubkey=true signature=true verify=true poison-rejected=true
  ok   RFC 8032 §7.1 TEST 3  pubkey=true signature=true verify=true poison-rejected=true

3/3 RFC 8032 §7.1 vectors passed against assets/crypto.mjs
```

**32 gate checks pass in this repository. None of them is a module test.**

---

## Part 2 — The 68 domain modules

### How each mark is derived

The rule is code, printed here so the table can be checked against it:

```js
ui            = module.workflows.length ? ◐ : —   // workflows + role surface named
api           = —                                 // no endpoint contract exists anywhere
db            = module.objects.length   ? ◐ : —   // objects named; no model, no migration
authz         = —                                 // role surfaces listed; no permission model, no denial test
audit         = module.events.length    ? ◐ : —   // domain events named; none emitted
offline       = module.services.includes("offline")  ? ◐ : n/a
security      = module.caution          ? ◐ : —   // the boundary is written down; untested
accessibility = module.id === "14"      ? ◐ : —   // only the accessibility module specifies any
currency      = module.services.includes("currency") ? ◐ : n/a
tests         = —                                 // no module has a test
docs          = ◐                                 // specified in MODULE_REGISTRY.md; no operational docs
```

**No branch of that rule can produce `✓`.** That is deliberate: a `✓` must point at a
file *and* a passing test, and no module has either.

### Election Command

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **01** | Master Election Command Center | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **02** | Election Calendar & Milestones | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **03** | Jurisdiction Configuration Engine | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **04** | Election Readiness Score | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **05** | Election-Day Operations Console | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **06** | After-Action Command Center | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Polling-Place Operations

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **07** | Polling-Place Opening | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **08** | Polling-Place Closing | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **09** | Poll Worker Management | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **10** | Poll Worker Training | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **11** | Polling-Place Checklist | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **12** | Supply & Inventory Management | ◐ | — | ◐ | — | ◐ | ◐ | — | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **13** | Wait-Time / Capacity Monitoring | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **14** | Accessibility Compliance | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | ◐ | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Ballot Operations

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **15** | Ballot Inventory | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **16** | Ballot Transfer | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **17** | Ballot Chain of Custody | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **18** | Mail-Ballot Workflow | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **19** | Provisional-Ballot Workflow | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **20** | Ballot Reconciliation | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **21** | Ballot Storage & Retention | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Equipment & Technology

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **22** | Voting Equipment Registry | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **23** | Equipment Testing | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **24** | Logic & Accuracy Documentation | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **25** | Equipment Seal Tracking | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **26** | Device Configuration Registry | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **27** | Maintenance / Failure Tracking | ◐ | — | ◐ | — | ◐ | ◐ | — | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **28** | Certified-System Reference Center | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Evidence & Auditability

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **29** | Evidence Vault | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **30** | Immutable Audit Log | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **31** | Evidence Provenance | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **32** | Photo / Video Evidence Capture | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **33** | Document Authentication | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **34** | Audit Workspace | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **35** | Evidence Export / Legal Package Generator | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

> **Naming note on 30.** The row carries the blueprint's own name so the mapping
> back to the source document is unambiguous. It is not the product-facing name.
> `test/engine.mjs` fails the build if the word "immutable" reaches a user-facing
> string; product surfaces call this the **Tamper-Evident Audit Log**. See
> `MODULE_REGISTRY.md` § "One naming note that has to be recorded".

### Incident & Safety

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **36** | Incident Intake | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **37** | Incident Triage | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **38** | Incident Escalation | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **39** | Physical Security | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **40** | Emergency Response | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **41** | Threat / Safety Reporting | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **42** | Election Worker Safety | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Cybersecurity

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **43** | Election Cyber Command | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **44** | Asset Inventory | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **45** | Network / System Risk Registry | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **46** | Vulnerability Management | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **47** | Access-Control Monitoring | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **48** | Cyber Incident Response | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **49** | Backup / Recovery / Continuity | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Intelligence / Review

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **50** | Election Anomaly Review | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **51** | Cross-Jurisdiction Pattern Engine | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **52** | Timeline Correlation | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **53** | Relationship / Entity Mapping | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **54** | Human Review & Disposition | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Records & Compliance

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **55** | Public Records Repository | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **56** | FOIA / Public Records Request Manager | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **57** | Statute & Regulation Library | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **58** | Retention Rules Engine | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **59** | Policy / Procedure Management | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **60** | Compliance Evidence Generator | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | ◐ | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Beyond the Sixty

| ID | Module | UI | API | DB | AuthZ | Audit | Offline | Security | Access. | Currency | Tests | Docs | Status |
|---|---|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|---|
| **61** | Observer Management | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **62** | Warehouse Logistics | ◐ | — | ◐ | — | ◐ | ◐ | — | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **63** | Election Communications | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **64** | Facility Acquisition | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **65** | Courier Operations | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **66** | Election Scenario Exercises | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **67** | MDM Fleet Management | ◐ | — | ◐ | — | ◐ | ◐ | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |
| **68** | Vendor Assurance | ◐ | — | ◐ | — | ◐ | n/a | ◐ | — | n/a | — | ◐ | SPECIFIED — NOT IMPLEMENTED |

### Column tallies across all 68 modules

| Column | `✓` built & gated | `◐` specified | `—` not started | `n/a` |
|---|---:|---:|---:|---:|
| UI | **0** | 68 | 0 | 0 |
| API | **0** | 0 | 68 | 0 |
| DB | **0** | 68 | 0 | 0 |
| AuthZ | **0** | 0 | 68 | 0 |
| Audit | **0** | 68 | 0 | 0 |
| Offline | **0** | 28 | 0 | 40 |
| Security | **0** | 65 | 3 | 0 |
| Accessibility | **0** | 1 | 67 | 0 |
| Currency | **0** | 12 | 0 | 56 |
| Tests | **0** | 0 | 68 | 0 |
| Docs | **0** | 68 | 0 | 0 |

**0 of 748 cells carry a `✓`.** Every module's status is
`SPECIFIED — NOT IMPLEMENTED`. There is no COMPLETE row and no BLOCKED row, because a row cannot be
blocked on a dependency before anyone has started it.

---

## What would have to be true to move a row to COMPLETE

Take module **17 — Ballot Chain of Custody**, the blueprint's own example and the
strongest first-pilot candidate. To move its row from `SPECIFIED — NOT IMPLEMENTED` to `COMPLETE`,
all eleven of these would have to become true, each pointing at a file and a passing
test:

1. **UI** — the five workflows in the registry are reachable and operable in the
   `worker`, `manager` and `county` surfaces, with real error states, and the offline
   states render distinguishably. A route that renders is not a UI.
2. **API** — versioned endpoints for every one of those workflows, with validation,
   idempotency keys (a courier will retry), and a documented request/response
   contract.
3. **DB** — a schema and migrations for `CustodyEvent`, `Seal`, `Custodian`,
   `TransferOrder` and the rest, in which a correction is a **new row linked by
   `corrects_event_id`** and a historical row is never updated in place.
4. **AuthZ** — RBAC + ABAC with jurisdiction scope, and **authorization tests that
   prove denial**, not just access. A test that only proves the allowed user can act
   proves nothing about the ones who should not.
5. **Audit** — every custody event actually emitted into LockChain: canonical hash,
   chained `previous_event_hash`, a signed checkpoint covering it, and independent
   verification material a third party can run without the application. The engine
   for this exists today; nothing calls it.
6. **Offline** — an encrypted local queue that survives a dead battery, idempotent
   replay that does not double-post a transfer, and a UI in which "saved on this
   device" can never be mistaken for "received by county command."
7. **Security** — key material outside the application database, security tests, and
   a demonstrated **absence** of any control channel to a voting system.
8. **Accessibility** — WCAG 2.2 conformance measured on the rendered page at the
   smallest text and both luminance extremes, on the actual managed tablet.
9. **Currency** — every procedural dependency registered with section-level effective
   dates, supersession and stale-source warnings, promoted to VERIFIED only by a
   named human. `n/a` here only if the module genuinely depends on no external
   authority.
10. **Tests** — workflow, authorization and security tests that **have been seen to
    fail**. A gate nobody has watched fail is not known to be a gate.
11. **Docs** — operational documentation including backup/recovery treatment,
    retention treatment, and a written operational acceptance.

### And before any row can be a candidate at all

Five things block **every** row equally, and none is a module problem:

- **Five of the ten shared services do not exist.** Evidence Core, Identity &
  Authorization Core, Notifications, Reporting and Observability. A module cannot
  have a green AuthZ column when there is no authorization system.
- **There is no persistence layer of any kind.** No DB column can go green until
  one exists.
- **There is no deployment.** `electioncommand.bornbetween2generals.com` has no
  certificate and returns `404` over HTTP.
- **The repository audit is not closed.** Three trees on this machine claim the name
  "Election Command" and six older election trees have never been read. Marking a
  module complete here while an older tree already implements it would be exactly
  the duplication the blueprint exists to prevent. See `VERSION_RECONCILIATION.md` §4.
- **The provenance gate is owed.** `assets/crypto.mjs` claims a
  `test/gate-provenance.mjs` that does not exist. Until it does, drift from the
  upstream `ballot-trail` engine will not be caught automatically.

The blueprint asks for production acceptance to require a security assessment,
authorization testing, an offline exercise, a disaster exercise, a restore test,
accessibility testing, a records-retention review, a public-records review,
chain-of-custody procedural approval, training, a managed-device policy, a
key-management test and an incident-response test. **None of the thirteen has been
performed.** They are listed here so nobody has to discover them later.

---

## Regenerating this file

```sh
node scripts/docs-matrix.mjs     # rewrites this file
```

This matrix is generated by walking `assets/registry.mjs` and applying the printed
derivation rule. When a module is genuinely built, the rule changes to consult real
build state — and the change to the rule is the reviewable artefact, not the mark.
A mark that can be typed by hand is a mark that can be wished into existence.