Architecture

Every production contract is immutable: no owner, no proxy, no upgrade path. A versioned factory deploys complete stacks and emits full code-hash evidence, so what you verified is what runs.

The pieces

• ConfidentialBallotCore — adapter-owned; each host constructs its own. Holds the committed ballot rules, enforces eligibility and sequence/replacement law, runs the encrypted accounting, requests the tally, and finalizes the verdict from Gateway evidence. Every persistent Nox ACL grant targets the core itself — never a viewer.
• Eligibility strategies — public eligibility and first-cast weight only: IVotesSnapshotStrategy (token voting power at a snapshot) and MerkleWeightedAllowlistStrategy (a domain-separated weighted allowlist; each leaf binds chain, host, snapshot, voter, and weight).
• SafeConfidentialVotingModule — immutably bound to one Safe, one core, and the official MultiSendCallOnly. Registration is Safe-only; execution is permissionless, exact, and execute-once with rollback-safe retry.
• ConfidentialGovernor — composes OpenZeppelin Governor with every plaintext cast route disabled. Truthful detailed states (TallyPending, Withheld, …) alongside the standard enum; Passed proposals queue through a real TimelockController.
• Factory — publishes contract/rules version 1, pins the reviewed creation-code hashes, revalidates every shared dependency's runtime hash before CREATE, and emits complete address + code-hash evidence per deployment.

Verified behavior

The local gate behind these docs: 119 Forge tests, a stateful invariant profile of 960,000 modeled calls (one effective weight per voter, floor monotonicity, finalize-once, execute-once, exact action binding), a released-stack proof-negative matrix (wrong signer, domain, handle, encoding, replay — all reject independently), and 33/33 consecutive released Docker-stack cases including Runner restart and JetStream redelivery recovery.