---
id: WF-CMT-MTG-012
title: Apply Certified Secret-Ballot Results
trigger: >-
  The remote certification handler receives results, or staff submit a certified
  result manually.
product_area: committees
module: meetings
revision: 1
status: draft
design_intent: proposed
implementation_evidence: partially-observed
inference: []
source_sha:
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
implements:
  - CAP-CMT-MTG-010
moves:
  - STATE-CMT-MTG-006
crosses:
  - SVC-CMT-MTG-decisions
idempotency: >-
  Certification locates the decision by election reference and ignores an
  already closed result. Appointment consequences reuse their certification
  source reference.
concurrency: >-
  Each certification applies under its decision lock in a separate workspace
  transaction.
hops:
  - 'n': 1
    actor_or_service: Election-certified handler
    action: Validate the versioned batch and individual certified facts.
    anchor: >-
      services-committees:modules/decisions/services/certification/election-certified-events.ts:handleElectionCertifiedEvents
    seam: event
    on_failure: Reject an invalid batch or return failure for an invalid event.
    left_inconsistent: No consequence from rejected data.
    observer: Remote handler execution logs.
    provenance: observed
    source: >-
      services-committees:modules/decisions/services/certification/election-certified-events.ts:handleElectionCertifiedEvents
  - 'n': 2
    actor_or_service: Decisions service
    action: >-
      Find the matching open secret ballot and close it from certified counts,
      using certification as the appointment source.
    anchor: >-
      services-committees:modules/decisions/services/certification/certified-election.ts:applyCertifiedElection
    seam: sync
    on_failure: Return an event failure so the publisher can retry.
    left_inconsistent: The close and consequences remain uncommitted.
    observer: Remote handler execution logs.
    provenance: observed
    source: >-
      services-committees:modules/decisions/services/certification/certified-election.ts:applyCertifiedElection
  - 'n': 3
    actor_or_service: Decisions API
    action: >-
      On manual application verify the supplied election belongs to the
      decision.
    anchor: >-
      services-committees:modules/decisions/services/certification/election-certified-events.ts:applyElectionByHand
    seam: sync
    on_failure: Reject an election mismatch.
    left_inconsistent: No result is applied.
    observer: The operation response.
    provenance: observed
    source: >-
      services-committees:modules/decisions/services/certification/election-certified-events.ts:applyElectionByHand
branches: []
waits: []
evidence:
  - >-
    services-committees at 36129c24:
    modules/decisions/services/certification/*.ts;
    aws/logic/election-certified.lambda.ts; ports/ballot-service.ts
controls:
  - TC-IAM-006
  - TC-AZ-001
  - TC-AZ-002
  - TC-AZ-003
  - TC-AZ-004
  - TC-AZ-006
  - TC-TEN-001
  - TC-TEN-002
  - TC-TEN-003
  - TC-TEN-004
  - TC-SEC-001
  - TC-SEC-004
  - TC-DAT-001
  - TC-DAT-002
  - TC-DAT-003
  - TC-LOG-001
  - TC-LOG-002
  - TC-LOG-003
  - TC-LOG-004
  - TC-LOG-005
  - TC-AVL-004
  - TC-MON-001
  - TC-MON-002
  - TC-PI-001
  - TC-PI-002
  - TC-PI-003
  - TC-PI-004
  - TC-PI-005
  - TC-PRV-001
  - TC-PRV-002
---
# Apply Certified Secret-Ballot Results

## What It Does

The remote certification handler receives results, or staff submit a certified result manually. The receiving code is present, but Surveys & Voting is not implemented and sends no production certifications. The contract describes the receiver and its deterministic consequence path, without claiming a working end-to-end secret ballot.

## The Flow

```mermaid
flowchart TD
  H1["Validate the versioned batch and individual certified facts."]

  H2["Find the matching open secret ballot and close it from certified counts, using certification as the appointmen"]
  H3["On manual application verify the supplied election belongs to the decision."]
  H1 --> H2
  H2 --> H3
```

Validate the versioned batch and individual certified facts. Find the matching open secret ballot and close it from certified counts, using certification as the appointment source. On manual application verify the supplied election belongs to the decision.

## When Something Fails

Reject an invalid batch or return failure for an invalid event. No consequence from rejected data. Return an event failure so the publisher can retry. The close and consequences remain uncommitted. Reject an election mismatch. No result is applied.

## Open Design Questions

The receiving code is present, but Surveys & Voting is not implemented and sends no production certifications. The contract describes the receiver and its deterministic consequence path, without claiming a working end-to-end secret ballot.