Add ATProto publishing for tip receipts

[Zakiamangal]

Summary

• Every completed tip is now published as a signed com.linkedclaims.claim record on the ATProto network — a verifiable, public receipt
• Fire-and-forget pattern: publishing never blocks or fails the tip itself
• Admin batch endpoint for retrying any failed publishes
• 12 existing test tips already published and verified on the network

Taiga: Story #34

Key choices

Decision	Choice	Why
HTTP client	httpx (direct XRPC calls)	Lightweight, async, no heavy dependencies — the atproto Python lib and TypeScript SDK are overkill for simple createRecord calls
Auth method	App password (server-signed)	User OAuth is future work; app passwords are simpler and sufficient for server-side publishing
Publish pattern	asyncio.create_task fire-and-forget	Tips must never fail due to ATProto errors
Lexicon	com.linkedclaims.claim	The LinkedClaims spec lexicon — each tip maps to a claim with claimType "tip"
Config	Opt-in via env vars	ATProto is disabled by default (empty handle/password); zero impact when not configured

Files changed

New

• backend/atproto_publisher.py — Core module (~130 lines)
  • _get_session(): login via app password, cache JWT for 90 min
  • publish_tip(tip_id, conn): build LinkedClaim record, POST to ATProto, store AT-URI in DB
  • publish_batch(conn, since_hours): retry all unpublished completed tips

Modified

• backend/config.py — Added atproto_handle, atproto_app_password, atproto_service settings + atproto_enabled property
• backend/app.py — Added:
  • _publish_tip_safe() wrapper (catches all exceptions, logs errors)
  • Fire-and-forget publish at 4 tip-completion sites: wallet tip, manual confirm, Stripe webhook, pledge fulfill
  • POST /api/admin/atproto/publish-batch?since_hours=24 admin endpoint
• backend/requirements.txt — Added httpx>=0.27

Claim record shape

{
  "$type": "com.linkedclaims.claim",
  "subject": "https://demos.linkedtrust.us/simpletip",
  "claimType": "tip",
  "object": "dr-amara-hassan",
  "statement": "Tip of $5.00 to Dr. Amara Hassan for https://example.com — Great work!",
  "source": { "uri": "https://example.com", "howKnown": "FIRST_HAND" },
  "confidence": 1.0,
  "effectiveDate": "2026-03-27T17:14:15.319+00:00",
  "createdAt": "2026-03-27T17:14:15.319+00:00"
}

What's NOT in scope

• User OAuth / progressive auth upgrade — future work
• Batch summary claims for high-volume tips — future work
• Payout ATProto publishing — out of scope for this story

Test plan

• Batch publish 12 existing tips — all succeeded
• Verified records on ATProto network via com.atproto.repo.listRecords
• Create new tip via API, verify auto-publish and atproto_uri in DB
• Test with ATProto disabled (empty env vars) — tips work normally
• Test with bad credentials — tips succeed, publish fails silently

🤖 Generated with Claude Code

[gvelez17]

this is very important here - who is tipping, who is receiving the tip.

What is the meaning of node_url, its always the same. that's not an intereting claim.

@Zakiamangal can you put some thought, what does it make sense to claim, just logically, when a tip is done? what is a tip a claim about, in english?

[gvelez17]

needs thought about what a tip means