The ERM engagement
Sold whole, never in pieces.
An ERM engagement is one chain, from capture to archive. Each step rests on the one before it, so no step is sold on its own: a hash without a verification record proves nothing, and a verified figure without reconciliation answers nothing.
The chain
Five steps, in this order
Hash at capture
Every tally-sheet image is hashed at the moment of capture. The hash travels with the artifact and is recomputed at every later step.
Per-country tally-sheet verification
Each tally sheet is verified against that country's own acta format and human-confirmed. Automated extraction is simulation-proven, not production-proven; it is never the sole basis for a published figure.
Human-confirmed · production-proven Automated extraction · simulation-proven
Independent aggregation
Totals are aggregated from verified records only, published with stated confidence intervals and a finite-population correction applied to the sampled frame.
Audit-reconciliation against the official record
Verified figures are reconciled line by line against the official record. Every unmatched line is resolved or logged as N/A with a reason; no line is dropped.
Evidence page and final report
The exhibit and the report are frozen and archived. Nothing is edited after the freeze; a correction is issued as a new, logged artifact.
Deliverables
What is handed over
| Deliverable | Form | Frozen |
|---|---|---|
| Verification records | Per-station record, human-confirmed, hash-linked to its capture | At freeze |
| Aggregation report | Totals, confidence intervals, finite-population correction method note | At freeze |
| Reconciliation report | Line-by-line deltas against the official record, with the full N/A log | At freeze |
| Evidence page | Public exhibit, hash-addressed, verifiable offline | At publication |
| Final report | Final report plus the erm_evidence/1 evidence bundle | T+30d |
Who buys
Any lawful principal, on the same published terms
Scope, refusal conditions, and price do not change with the principal. A party legal team and an election office buy the identical engagement.
- Party legal team
- Observer mission
- Media consortium
- Election management body, via subcontract
Operational gates
Gates the engagement cannot pass without
Gate 01
Reachability rehearsal
Official-source reachability is rehearsed at least two weeks before the contest, against the real endpoint.
Gate 02
Restorable monitoring
Monitors are proven restorable from backup, not merely proven to be running.
Gate 03
Credential rotation at close
Every credential issued for the engagement is rotated when the engagement closes, and the rotation is logged.
Gate 04
Written postmortem
A written postmortem is delivered whether or not anything failed, and it names what we would not repeat.
What we refuse
Work we decline, in writing, before the contract
- Voter-facing anything — no app, no page, no notification aimed at voters.
- Individual-level data — the smallest unit we handle is an aggregate unit.
- Partisan analysis of any kind, for any principal.
- Win-calls, projections, or a figure presented as a result before certification.
- “Just the OCR” — extraction sold without verification and reconciliation.
- Characterizing political actors, their intent, or their conduct.
Basis · engagement terms §2 — scope integrity
Timeline
T−8 weeks to T+30 days
T is the contest date. Dates before T are gates; dates after T are artifacts.
- T−8 weeksContract signed, scope and refusal conditions frozen.
- T−6 weeksTenant provisioned, country packs loaded, protocol version fixed.
- T−4 weeksCapture and chain of custody rehearsed against the client's own field structure.
- T−2 weeksOfficial-source reachability rehearsed; monitors proven restorable.
- T−1 weekCredentials issued, dry run completed, escalation path published to the client.
- T−0Contest day: capture, hash at capture, custody events logged as they occur.
- T+1 to 3 daysTally-sheet verification and independent aggregation with stated intervals.
- T+7 daysAudit-reconciliation against the official record, with the full N/A log.
- T+14 daysEvidence page published, hash-addressed and verifiable offline.
- T+30 daysFinal report frozen and archived, credentials rotated, written postmortem delivered.
Request an engagement
Tell us the contest, the date, and the artifact you need. We reply with scope, refusal conditions, and a price against the published floor.