Accuracy & Verification

How accurate is RosaVote at tabulating an election? The counting engine is the shipped stv_tabulate.py (Scottish STV per SSI 2007/42; Meek STV per the New Zealand rules; plus Score and STAR voting for rated ballots). Accuracy here means several separate things, each tested independently and each reproducible by you.

1 · Exact match against OpaVote

The strongest check: on the real NPC At-Large 2025 (37 candidates, 23 seats, 1,279 ballots), RosaVote's Scottish STV count elects the identical winner set as OpaVote's certified count — 23 / 23 winners, quota and all. Because RosaVote reads and writes the same standard BLT ballot format, anyone can reproduce this: download the ballots, run them in OpaVote, OpenSTV, or this codebase's tabulator, and compare. Reproducibility, not a trust-us certificate, is the guarantee.

2 · Regression over 40 real elections

A corpus of 40 real YDSA, NCC, and chapter election ballot files — 6,429 ballots (51,274 weighted) — is counted on every build. These exercise the full variety of real-world BLT files: skipped rankings, overvotes, empty/abstain ballots, ballot weights above one, and races from 2 to 20 candidates. Results:

0 parse or count errors across all 40 files.
Fully deterministic — every election counts to the identical winner set on repeated runs (no hidden randomness in tabulation; candidate display order is shuffled per voter, but that never touches the count).
Every seat filled correctly for every contest.
Score and STAR voting are covered too: 2 score-ballot fixtures count deterministically under both Score (sum of 0–max ratings) and STAR (score-then-automatic-runoff), including the DSA at-large 0/1/2 delegate method with its gender/racial-minority quota reservations.

Scottish and Meek STV agree on most contests and legitimately differ on a few close ones — that's the two methods being genuinely different rules, not an error. Run it yourself: python3 tools/blt_regression.py.

3 · End-to-end replay from remote devices

Tabulating a file is one thing; proving the live voting pipeline records ballots faithfully is another. The replay harness casts an entire real election through the actual voting API — one voting code per ballot, POSTed concurrently from a pool of simulated remote devices — then reads the stored ballots back and counts them. On the NLC Steering (19 candidates, 13 seats) election, 810 / 810 ballots were cast with zero failures (one-code-one-vote held under concurrency), and the result computed from stored ballots matched a direct count of the source file exactly. So the claim/validate/store/tabulate path introduces no error. Throughput measured 48–91 votes/sec (single client, 48 at 40 devices, 91 at 3,220 ballots / 100 devices) — client-bound, since a real electorate is spread across thousands of devices and days rather than one test machine. Run it: python3 tools/replay_election.py <file.blt> --base <host> --token ….

4 · Load / stress test

Alongside accuracy, RosaVote is stress-tested for scale. In the largest run, 3,220 ballots were cast at 100 concurrent simulated devices against the live service: 3,220 / 3,220 recorded, 0 failures, and the stored ballots still tabulated to the correct result. Throughput scaled linearly with concurrency to a peak of 91 votes/sec and stayed client-bound — the single test laptop over the public internet was the bottleneck, not the server. For context, 120,000 members voting over several days averages well under 2 votes/sec, and even a last-hour surge is a small fraction of what one test machine already drove without a single dropped or double-counted ballot. The service also caps instances and serves published results from a frozen cache, so a spike in viewers can never slow voting. This stress run surfaced and fixed one real concurrency bug (a stale per-instance config cache on a freshly created poll), now closed.

What this does and doesn't prove

Proven: the tabulator reproduces OpaVote's result on a real 23-seat election; it counts a wide corpus of real ballots deterministically and without error; and the live vote pipeline stores ballots that tabulate to the same result. All of it is reproducible in software RosaVote doesn't control.

Not claimed: formal government certification (that program is for public-office systems and doesn't apply to an org's internal elections), nor a substitute for an independent security audit before a binding election. The honest, proportionate assurance for this use case is: open-source code + a reproducible recount + a tamper-evident hash chain over every ballot + these regression and replay tests. A losing candidate can recount every ballot themselves — which is a stronger guarantee than any closed certificate.

← Back to RosaVote