The rule

Verified Launch

At most one listing a week, newly verified, shown in a labelled slot beside the catalogue. It is chosen by the rule below from the public receipt ledger, and it is never mixed into search results or the catalogue's order: the launched listing keeps its ordinary place there too.

01One week at a time
A launch week runs from Monday 00:00 UTC to the next Monday 00:00 UTC. The slot shows the launch of the last complete week, so nothing that happens during a week can change its choice while it is running.
02Only a listing's first valid receipt counts
A listing is a candidate for the week in which its first valid receipt was issued. Valid means a pass or a pass with findings, a signature that verifies against the published key and matches the listing's public record, a receipt nobody has revoked, and a signing key nobody has revoked. A listing launches once: a new version or a re-run is never a first receipt.
03It must still be live
A candidate must still hold the active receipt of a public listing when the slot is shown. A listing taken down since is not shown, and nothing is promoted in its place except by the same draw.
04One is drawn, by a hash nobody chooses
Each candidate's key is the SHA-256 of the line verified-launch/v1, a newline, the week's Monday as YYYY-MM-DD, a newline, and the receipt id. The lowest key wins. The maker cannot buy a place in it and the operator cannot order it, and anybody with the ledger can recompute it.
05No candidate, no launch
A week with no candidate has no launch, and the slot shows nothing at all: no empty frame and no promise of one.

Recompute a draw

For each receipt that was a first valid receipt in the week, from the public ledger:

printf 'verified-launch/v1\n%s\n%s' <monday> <receipt-id> | sha256sum

The lowest result is the launch.

What it is not

A ranking or a recommendation. It says a listing is new and verified, and nothing about whether it is better than anything else.
For sale. No payment, subscription or placement changes the draw, because nothing in the draw can be paid for.
A signal anywhere else. Search, sorting and the catalogue grid do not read it; a test fails the build if one starts to.
More than its receipt. What was checked, and what was not, is on the receipt and the listing page, as for any other listing.

How verification works →The receipt ledger →

Verified Launch

01One week at a time

A launch week runs from Monday 00:00 UTC to the next Monday 00:00 UTC. The slot shows the launch of the last complete week, so nothing that happens during a week can change its choice while it is running.

02Only a listing's first valid receipt counts

A listing is a candidate for the week in which its first valid receipt was issued. Valid means a pass or a pass with findings, a signature that verifies against the published key and matches the listing's public record, a receipt nobody has revoked, and a signing key nobody has revoked. A listing launches once: a new version or a re-run is never a first receipt.

03It must still be live

A candidate must still hold the active receipt of a public listing when the slot is shown. A listing taken down since is not shown, and nothing is promoted in its place except by the same draw.

04One is drawn, by a hash nobody chooses

Each candidate's key is the SHA-256 of the line verified-launch/v1, a newline, the week's Monday as YYYY-MM-DD, a newline, and the receipt id. The lowest key wins. The maker cannot buy a place in it and the operator cannot order it, and anybody with the ledger can recompute it.

05No candidate, no launch

A week with no candidate has no launch, and the slot shows nothing at all: no empty frame and no promise of one.

Recompute a draw

For each receipt that was a first valid receipt in the week, from the public ledger:

printf 'verified-launch/v1\n%s\n%s' <monday> <receipt-id> | sha256sum

The lowest result is the launch.

What it is not

A ranking or a recommendation. It says a listing is new and verified, and nothing about whether it is better than anything else.
For sale. No payment, subscription or placement changes the draw, because nothing in the draw can be paid for.
A signal anywhere else. Search, sorting and the catalogue grid do not read it; a test fails the build if one starts to.
More than its receipt. What was checked, and what was not, is on the receipt and the listing page, as for any other listing.