gift-link — policy & limits

The one label

gift-link — severity inform, blurs nothing, default setting ignore. It is a descriptive marker, not a content warning. Subscribing to it should never hide anything from you; at most it adds a small marker.

What the label claims

This link carried an unlock token when this service saw it.

That is the whole claim, and it is a statement about a URL at a moment in time. It is not a promise that the article is still readable. Publishers expire and revoke gift tokens, and nothing here re-checks one after it is first seen — so a labeled link may well be paywalled by the time you click it. The label records an observation, not a guarantee.

A post gets the label when one of its links — either the embed card or a link in the text — points at a publisher on the list below and carries that publisher's unlock token in the URL. The decision is made by reading the URL, not by guessing.

What the label does not claim

It says nothing about the person who posted. It is not a judgment that sharing the link was generous, or wrong, or against a publisher's terms. It does not mark the post as good or bad. The value is deliberately descriptive: it names something true about the URL and stops there, because this labels other people's posts and a label that editorialized about them would be a different and much heavier thing.

Publishers covered

The New York Times, The Wall Street Journal, The Washington Post, The Athletic, The Atlantic, Bloomberg, The Economist, the Financial Times, The New Yorker, the Los Angeles Times, and Business Insider. A link to any other site is never labeled, whatever its query string looks like.

This labels strangers, and that is a change

An earlier version of this service labeled only its own project's output, which made it safe and also made it pointless — it restated what the post already showed. This one labels anyone's post. The safety comes from a different place: the claim is a checkable fact about a URL rather than an assessment of a person, so the failure mode is a stale token rather than a mislabeled human. Anyone can verify a label by reading the link it points at.

Getting a label removed

Ask — reply to @bisks.net — and the post comes out of the set. There's no review board and no appeal process to navigate, and no reason is needed. If you'd rather your posts were never labeled at all, say so and the account goes on a permanent skip list.

Ways this is not a complete labeler

Coverage is best-effort. Finding posts means searching for recent links to each publisher every few minutes, because a labeler on a stateless Worker can't hold a firehose connection open. Search indexing lags and drops things, so some gift links are never seen. An unlabeled post means "not seen" — never "checked and found no token."
Labels do not expire when tokens do. A label is a dated observation and stays put; the token it describes may not. See the claim above.
No label stream. A canonical labeler serves com.atproto.label.subscribeLabels over a long-lived websocket. This runs on a stateless Cloudflare Worker with no standing connections (a deliberate repo-wide constraint), so it serves queryLabels only. Clients that query see every label; consumers that only ingest the stream see nothing. The subscribe endpoint answers and closes cleanly rather than hanging, so a subscriber finds out immediately instead of timing out.
No moderation reports. It declares no report reason types and accepts no reports. It emits one descriptive label and does nothing else.
No negations. Removal happens by dropping the subject, not by publishing a neg label.
The set is capped. It holds a bounded number of labeled posts; past that, the oldest fall off and stop being labeled.

Signatures

Labels are signed for real, P-256 / ES256, over the dag-cbor encoding of the label without its signature field, normalized to the low-S form atproto requires. The public half lives in the labeler account's DID document as #atproto_label, so anyone can verify a label came from this service.