Add self-custodial Bitcoin tips and weighted forum ranking #87

Closed AtlantisPleb opened this 23h ago 1 comment

Outcome

Let users and agents tip forum posts in sats through the MoneyDevKit path and use verified tips as one bounded ranking signal.

Current behavior

The Phoenix forum supports discussion and moderation, and the treasury stack has proven Bitcoin payments. The port does not yet include the tipping and Bitcoin-weighted ranking promised in episode 231.

Source: docs/episode-triage.md, episodes 231 and 235.

Contract

Let an authenticated account attach a self-custodial payment destination that the forum never controls.
Create a tip intent for a post, settle it through the admitted payment service, and record an idempotent payment receipt.
Show bounded sats totals and payment state without exposing wallet or network secrets.
Use settled, non-refunded tips as one ranking input with age decay, moderation, and anti-manipulation controls.
Prevent self-tips from improving rank and detect circular or automated abuse.
Keep ranking functional when the payment service is unavailable.
Support opt-out, refunds where possible, failed payments, and withdrawal export.

Acceptance criteria

One user or agent can tip a post and the recipient can verify the receipt in a self-custodial wallet.
A retry cannot pay twice or increment ranking twice.
Self-tips, failed tips, and refunded tips do not improve rank.
Moderators can remove abusive content without taking custody of funds.
Public pages reveal no payment destination, channel, node, or account secret.

Verification

Run low-value staging payments and tests for idempotency, failure, refund, self-tip, circular abuse, ranking, privacy, and payment-service outage. Run mix precommit.

Dependencies

Build on the forum port, existing MoneyDevKit payment path, and the project 8 settlement policy. Do not use Spark custody.

AtlantisPleb opened this issue 23h ago
A AtlantisPleb Author 19h ago

Fixed in ed2452a on main. Accounts attach their own Bolt 12, LNURL, or on-chain destination; payment leaves through an admitted MoneyDevKit/LDK service, so the forum never takes custody and stores no seeds, keys, channels, or nodes. Tips are idempotent intents with append-only receipts: retries neither pay nor count twice, outages leave the intent retryable, and failures and refunds carry no ranking weight. Settled tips feed a bounded, 7-day-half-life ranking signal that caps each tip and payer at 25,000 sats and zeroes self-tips, reciprocal tips, and bursts; ranking reads stored aggregates, so it keeps working while the payment service is down. Moderation withdraws ranking weight without touching receipts. Recipients verify settlement themselves through payment hashes on /forum/tips and GET /api/v3/forum/tips/received. Docs: docs/forum-bitcoin-tips.md. Tests cover idempotency, failure, refund, self-tip, circular abuse, ranking, privacy, and payment-service outage.

Written by Devin
closed this as completed 19h ago