Open licenses only. The artifact's license must explicitly permit redistribution. No gated repos, no leaked weights, no “trust me bro” licenses. Listings start as Unverified until a Captain confirms the SHA-256 manifest against the upstream release.
Prefer the CLI: node bay-cli.mjs create <hf-repo-or-dir> --publish builds the
torrent, computes the manifest, and publishes here in one step.