# Raffle Desk

> Screen a giveaway's entrant list, run a seeded draw anyone can repeat, and announce the winners.
> https://raffle-desk.skillsafe.ai/ - derived from the agent skill @composiohq/raffle-winner-picker
> (ComposioHQ/awesome-claude-skills, path raffle-winner-picker). Runs on gpt-terra.

## What it does

1. The check (free, in the browser). Reads a CSV/TSV export with a header row, a headerless CSV, or
   one entrant per line ("Name <email>", "Name (email)", "@handle"). Flags clusters of rows that need a
   person's judgement: SAME_CONTACT (same email or handle), SAME_MAILBOX (Gmail dot and plus variants of
   one inbox), PLUS_ALIAS (plus-tag variants on other domains), SAME_NAME (one full name under different
   contacts), EXCLUDED (the organiser's exclusion list), LATE (after the deadline, times compared as
   written), NO_TIME, NO_CONTACT, BAD_TICKETS (weighted mode), DISPOSABLE (a short list of throwaway
   domains). Each cluster gets a default action: keep all, keep one, disqualify all, or disqualify some.
2. The draw (free, in the browser). The pool is written as text ("raffle-desk pool v1", then one line per
   entry: row TAB tickets TAB display label) and hashed with SHA-256. For counter = 0, 1, 2, ...:
   h = SHA-256("raffle-desk/v1|" + seed + "|" + beacon + "|" + pool_hash + "|" + counter);
   x = first 13 hex digits of h; reject x >= floor(2^52 / T) * T where T is the total tickets;
   otherwise ticket = x mod T, tickets numbered in pool order; skip a ticket whose holder was already
   drawn. The first N picks are winners, the rest runner-ups. The commitment is SHA-256(seed). The draw
   record (JSON) carries the pool file, seed, beacon, commitment, pool hash and every pick, and the page
   re-runs it to verify.
3. screen (paid). The flagged clusters (only those rows), the settings and the organiser's pasted rules
   go to the model, which returns one decision per cluster, gaps in the rules and checks before the
   draw. The browser rejects decisions for unknown clusters, rows outside a cluster, quotes not found in
   the rules, and any attempt to re-admit an EXCLUDED or LATE entry.
4. announce (paid). Only the draw record's summary and the winners' display labels go to the model,
   which writes a public post, a winner message, a runner-up message, a verification note and a
   checklist. The browser checks that every winner is named exactly, nobody else from the pool is,
   every 16+ character hex string is the commitment, pool hash or seed, the verification note carries
   all three in full, counts are the draw's, and money amounts appear in the stated prize.

The model never picks, ranks or re-draws a winner.

## API contract

POST https://api.skillsafe.ai/v1/app-api/run-stream (or /run) with a bearer token for this app and a JSON
object body: {"task": "screen" | "announce", "facts": "<JSON-encoded string>", "question": "<optional>"}.
The reply is one JSON object. Full field lists, examples and code in eight languages: /api.html

## Sources

- SHA-256: NIST FIPS 180-4, Secure Hash Standard - https://csrc.nist.gov/pubs/fips/180-4/upd1/final
- Gmail ignores dots in the local part: Google, "Dots don't matter in Gmail addresses" -
  https://support.google.com/mail/answer/7436150
- Gmail delivers name+anything@gmail.com to name@gmail.com: Google, "Send emails from a different
  address or alias" - https://support.google.com/mail/answer/12096
- googlemail.com is treated as the same service as gmail.com. This is widely reported but was not
  found on an official Google help page; treat that part of SAME_MAILBOX as a strong hint.
- Source skill: https://github.com/ComposioHQ/awesome-claude-skills/tree/master/raffle-winner-picker

## Limits

A repeatable draw proves the winners follow from the pool and the seed; it does not prove the organiser
did not try several seeds. Publishing the commitment and pool hash first, and adding a beacon value
nobody could know at that time, closes most of that gap. The page does not give legal advice and
does not make a raffle or giveaway legal or compliant. Raffles, lotteries and prize draws are regulated in
many places (paid tickets usually make a draw a licensed lottery), and social platforms have their own
promotion rules; local rules apply. The page shows this reminder at the top and again when weighted tickets
are chosen.