Verifair is our new enrollment lottery, and it is now available on Campus. It runs a weighted, auditable draw on your own capacities and priority rules: a frozen applicant list, a code published before the draw that fixes it, a key nobody chose, results that can be reproduced months later, and a hash-chained audit trail behind every seat you award.
Nothing in your current setup has to change. Verifair sits alongside the Campus modules you already use, and you can leave it aside until your next admissions season.
What Verifair covers
Priority rules follow your policy
Preferences, caps, weights and reserved seats live in a versioned rule set, authored in the admin console rather than deployed. Published revisions never move.
Siblings, residency, staff caps
Returning students are exempt, siblings win seats together, residency is verified before freeze, and a staff cap demotes an application without costing it a place.
Applications and claim review
Search, scoring, withdrawals, duplicate detection across the period, proof documents, validated addresses. Claim review is a separate role with its own queue.
Evaluations and auditions
Sessions with capacity that families book themselves, reminders and attendance, and scores entered singly or in bulk straight into the ranking.
Offers and waitlist
Seat offers with response deadlines, waitlist movement in exact lottery order, and cross-programme matching.
Guardian portal
One-time code sign-in with no school account, so families apply, track status and accept or decline a seat — isolated from every administrative endpoint.
How a single draw runs
Eight steps, in the same order, every time. The engine consumes a frozen projection of the applicants and the rule set; it never re-reads a live application mid-draw.
Freeze. Cut the applicant list, resolve every tier, weight, score and reserve eligibility once, then hash the result with the rule revision that produced it.
Exempt. Returning students leave the pool and their seats come off the available capacity.
Seed. The draw key is derived, never invented: worked out from the sealed list, the run itself, and a value produced in public only after the commitment code went up — dice in the hall, or a signed round from a worldwide randomness beacon.
Key. Every application receives a random key; weighted applications get their better odds from the key itself.
Rank. Applications are ordered by tier, then score, then key, with capped overflow demoted and re-ranked until the order is stable.
Allocate. Reserved buckets and general seats are filled following your reserve and sibling policy.
Waitlist. Everyone who missed a seat keeps their exact lottery position on the waitlist.
Seal. Results, commitment, seed and input hash are written to a hash-chained audit log and published.
Proof, not promises
“Was the list edited afterwards?”, “was the draw computed correctly?” and “did you choose the key?” are three different questions, and Campus answers them separately — years after the season is over, and on paper when a board or an authorizer asks. The third is the one a family who lost actually asks, and the one every other system answers with trust us.
- Integrity check — re-hashes the published results against the hash sealed at execution, detecting any later edit.
- Reproducibility check — re-runs the draw from the recorded seed and frozen input, compared rank by rank against what was published.
- Provenance check — a twelve-character code is published the moment the applicant list is locked, fixing the list, the rules and the draw time. The key needs one more ingredient, and that ingredient does not exist yet. Anyone holding the code can check afterwards that the draw they were shown is the draw that was promised. Keyed on a beacon, the draw can even run itself at the committed moment — so there is no instant in which anyone could see the result and decide whether to go ahead.
- Check it without us — the verification script is published from the draw itself, needs nothing but a standard Python install, and re-computes the ranking on your own machine. Nobody has to take our word for the result, including us.
- Draw certificate — a dated, aggregate-only PDF issued by the server from the run itself. Nothing is typed up afterwards. It is scrupulous about what it does not claim: a draw keyed on dice in a room states in plain words that it cannot prove the operator typed what was rolled.
- Public draw — a live run mode and kiosk display open the draw to families, the digital equivalent of holding it in the school hall.
Verifair does not change anyone’s odds — a weighted lottery is statistically the same however it is implemented. It changes what the school can put on the table months later, when a family, a board or an authorizer asks how a particular result came about.
If you are planning your next admissions season and would like a walkthrough on your own capacities and priority rules, contact us and we will arrange it.
