feat: default new bots to RFQ-only behind a fleet flag

- Add `book_enabled` root config key (default true) to switch between public ladder and RFQ-only modes
- Introduce `panel.toml` fleet-wide flags file read from `{bots_dir}/panel.toml` with `[experimental] rfq_default` gate
- Stamp fresh configs as RFQ-only when fleet flag is set or an existing bot already has RFQ-only enabled
- Skip public ladder quoting when `book_enabled = false`; RFQ responder, spreads, and liquidity sizing remain active
- Make `rfq_panel_unlocked()` true for either the old `rfq_panel` or new `rfq_default` gate token
- Add `rfq_default_unlocked()` to check the exact `"enable-rfq"` token per-config
- Update Connect (enroll) to turn off the public ladder when RFQ-default is active and write RFQ-only settings
- Remove ladder-sizing validation from Connect; zero max orders no longer errors on Reconnect
- Add corridor switch logic to preserve RFQ-only mode when switching to a new venue
- Update panel UI to show `rfqDefaultUnlocked` and `bookEnabled` settings, add migrate nudge copy
- Update example configs and docs to reflect the new modes

Author: bnolens

.textile-monorepo-source

@@ -1 +1 @@
-022496c45a1c72d4b72de17587a35696fc9c0de8
+826269357f22f9d96a200f4ffb234cba974f46ae

.textile-stitch-release-version

@@ -1 +1 @@
-0.1.201
+0.1.202

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "stitch-bot"
-version = "0.1.201"
+version = "0.1.202"
 edition = "2021"
 description = "Stitch — Textile filler-network operator bot; market-makes the filler order book with signed UniswapX limit orders."
 license = "AGPL-3.0-or-later"

Cargo.toml

@@ -0,0 +1,10 @@
+# Fleet flags for the Stitch panel. Copy this file next to the per-bot
+# folders as `{bots_dir}/panel.toml` and restart the panel.
+#
+# Tokens are exact. A typo fails closed — the feature stays off.
+
+[experimental]
+# RFQ as the default quoting mode: new bots start RFQ-only, existing
+# public-ladder bots see a migrate nudge, and Connect writes RFQ-only.
+# The Settings RFQ card unlocks for every bot in this fleet.
+rfq_default = "enable-rfq"

panel.example.toml

@@ -63,10 +63,14 @@ pub struct Config {
     /// set `provider = "turnkey" | "mpcvault"` to sign via an MPC wallet.
     #[serde(default)]
     pub signer: Option<crate::signer::SignerConfig>,
-    /// RFQ responder (dual-run pilot). Omitted → the responder never spawns and
-    /// nothing else changes. See [`RfqConfig`].
+    /// RFQ responder. Omitted → the responder never spawns. See [`RfqConfig`].
     #[serde(default)]
     pub rfq: Option<RfqConfig>,
+    /// Post resting orders on the public ladder. Default true (historical).
+    /// Set false for RFQ-only: the bot answers private quotes and does not
+    /// rest orders on the book. Spreads and liquidity still size RFQ.
+    #[serde(default = "default_true")]
+    pub book_enabled: bool,
     /// Raw experimental gates. Values are uninterpreted strings on purpose:
     /// each consumer matches its own exact token, so a typo fails closed
     /// instead of enabling something adjacent.
@@ -75,6 +79,10 @@ pub struct Config {
     pub pools: Vec<PoolConfig>,
 }
 
+fn default_true() -> bool {
+    true
+}
+
 /// The `[rfq]` block: connection details for the venue's maker quote stream.
 /// The maker API key is NOT here — it comes from the environment variable
 /// named by `api_key_env`, mirroring how the wallet key stays out of the file.
@@ -140,12 +148,24 @@ pub struct ExperimentalConfig {
     /// anything else (or omitted) keeps the card hidden.
     #[serde(default)]
     pub rfq_panel: Option<String>,
+    /// RFQ-as-default rollout. Exact token [`RFQ_DEFAULT_GATE`] only. When
+    /// set (here or in the fleet `panel.toml`), new bots start RFQ-only,
+    /// book bots see a migrate-to-RFQ nudge, and Connect writes RFQ-only.
+    #[serde(default)]
+    pub rfq_default: Option<String>,
 }
 
 /// The one token that unlocks the panel's RFQ beta card. Exact, case-sensitive
 /// match — anything else (including a different case) fails closed.
 pub const RFQ_PANEL_GATE: &str = "enable-rfq-beta";
 
+/// The one token that turns RFQ into the default quoting mode. Exact match.
+pub const RFQ_DEFAULT_GATE: &str = "enable-rfq";
+
+/// Filename for the fleet-wide flag, dropped next to the per-bot folders
+/// (`{bots_dir}/panel.toml`). Same `[experimental]` keys as a bot config.
+pub const PANEL_FLAGS_FILE: &str = "panel.toml";
+
 #[derive(Debug, Clone, Deserialize)]
 pub struct FeedConfig {
     /// HTTP endpoint returning `{ price, timestamp }`.
@@ -551,19 +571,29 @@ impl Config {
     }
 
     /// True when the RFQ responder should run: the master switch is on and
-    /// there is at least one pool to quote. Anything less is a no-op — the
-    /// ladder never changes either way.
+    /// there is at least one pool to quote. The public ladder is a separate
+    /// switch ([`Self::book_enabled`]).
     pub fn rfq_active(&self) -> bool {
         self.rfq.as_ref().is_some_and(|r| r.enabled) && !self.pools.is_empty()
     }
 
-    /// True only for the exact [`RFQ_PANEL_GATE`] token. Read-only surface for
-    /// the panel; nothing in the bot keys off it.
+    /// True only for the exact [`RFQ_PANEL_GATE`] or [`RFQ_DEFAULT_GATE`]
+    /// token. Read-only surface for the panel; nothing in the bot keys off it.
     pub fn rfq_panel_unlocked(&self) -> bool {
+        self.rfq_default_unlocked()
+            || self
+                .experimental
+                .as_ref()
+                .and_then(|e| e.rfq_panel.as_deref())
+                == Some(RFQ_PANEL_GATE)
+    }
+
+    /// True only for the exact [`RFQ_DEFAULT_GATE`] token on this config.
+    pub fn rfq_default_unlocked(&self) -> bool {
         self.experimental
             .as_ref()
-            .and_then(|e| e.rfq_panel.as_deref())
-            == Some(RFQ_PANEL_GATE)
+            .and_then(|e| e.rfq_default.as_deref())
+            == Some(RFQ_DEFAULT_GATE)
     }
 
     fn validate(&self) -> anyhow::Result<()> {
@@ -696,6 +726,34 @@ impl Config {
     }
 }
 
+/// True when `toml` sets `[experimental] rfq_default` to the exact gate token.
+/// Used for a fleet `panel.toml` that is not a full bot config.
+pub fn toml_has_rfq_default_gate(toml: &str) -> bool {
+    let Ok(value) = toml::from_str::<toml::Value>(toml) else {
+        return false;
+    };
+    value
+        .get("experimental")
+        .and_then(|e| e.get("rfq_default"))
+        .and_then(|v| v.as_str())
+        == Some(RFQ_DEFAULT_GATE)
+}
+
+/// Fleet-wide RFQ-default switch: `{dir}/panel.toml` with the exact token.
+pub fn rfq_default_flag_in_dir(dir: &std::path::Path) -> bool {
+    let path = dir.join(PANEL_FLAGS_FILE);
+    std::fs::read_to_string(path)
+        .ok()
+        .is_some_and(|text| toml_has_rfq_default_gate(&text))
+}
+
+/// Stamp a fresh corridor template as RFQ-only: fleet flag, or this bot
+/// already left the public ladder / carries the per-bot token.
+pub fn rfq_default_preset_applies(cfg: Option<&Config>, bots_dir: &std::path::Path) -> bool {
+    rfq_default_flag_in_dir(bots_dir)
+        || cfg.is_some_and(|c| !c.book_enabled || c.rfq_default_unlocked())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -992,6 +1050,14 @@ mod tests {
         assert!(!cfg.rfq_active());
         assert!(!cfg.rfq_panel_unlocked());
         assert!(cfg.pools.iter().all(|p| p.rfq_corridor.is_none()));
+        let book = EXAMPLE
+            .find("# book_enabled = false")
+            .expect("example must document book_enabled");
+        let feed = EXAMPLE.find("\n[feed]\n").expect("example has [feed]");
+        assert!(
+            book < feed,
+            "book_enabled must be a root key, before [feed] — after [[pools]] it is ignored"
+        );
     }
 
     #[test]
@@ -1011,6 +1077,75 @@ mod tests {
         assert!(Config::from_toml(&toml).unwrap().rfq_panel_unlocked());
     }
 
+    #[test]
+    fn book_enabled_defaults_on_and_can_be_turned_off() {
+        let cfg = Config::from_toml(LEAN_POOL_BASE).unwrap();
+        assert!(cfg.book_enabled, "omitted book_enabled must stay on");
+
+        // Root-level key — appending after [[pools]] would land on the pool.
+        let off = LEAN_POOL_BASE.replace(
+            "tick_interval_secs = 5",
+            "tick_interval_secs = 5\nbook_enabled = false",
+        );
+        assert!(!Config::from_toml(&off).unwrap().book_enabled);
+    }
+
+    #[test]
+    fn rfq_default_gate_only_opens_on_the_exact_token() {
+        let cfg = Config::from_toml(LEAN_POOL_BASE).unwrap();
+        assert!(!cfg.rfq_default_unlocked());
+        assert!(!cfg.rfq_panel_unlocked());
+
+        for wrong in ["true", "1", "enable-rfq-beta", "ENABLE-RFQ"] {
+            let toml = format!("{LEAN_POOL_BASE}\n[experimental]\nrfq_default = \"{wrong}\"\n");
+            let cfg = Config::from_toml(&toml).unwrap();
+            assert!(!cfg.rfq_default_unlocked(), "{wrong:?} must not unlock");
+        }
+
+        let toml = format!("{LEAN_POOL_BASE}\n[experimental]\nrfq_default = \"enable-rfq\"\n");
+        let cfg = Config::from_toml(&toml).unwrap();
+        assert!(cfg.rfq_default_unlocked());
+        assert!(
+            cfg.rfq_panel_unlocked(),
+            "the default gate also unlocks the RFQ card"
+        );
+    }
+
+    #[test]
+    fn a_panel_toml_is_not_a_bot_config_but_still_trips_the_gate() {
+        assert!(!toml_has_rfq_default_gate(""));
+        assert!(!toml_has_rfq_default_gate(
+            "[experimental]\nrfq_panel = \"enable-rfq-beta\"\n"
+        ));
+        assert!(toml_has_rfq_default_gate(
+            "[experimental]\nrfq_default = \"enable-rfq\"\n"
+        ));
+    }
+
+    #[test]
+    fn rfq_default_preset_applies_for_fleet_or_an_already_rfq_only_bot() {
+        let empty = std::env::temp_dir().join("stitch-rfq-preset-applies-empty");
+        let _ = std::fs::create_dir_all(&empty);
+        let book = Config::from_toml(LEAN_POOL_BASE).unwrap();
+        assert!(!rfq_default_preset_applies(Some(&book), &empty));
+
+        let off = LEAN_POOL_BASE.replace(
+            "tick_interval_secs = 5",
+            "tick_interval_secs = 5\nbook_enabled = false",
+        );
+        let rfq_only = Config::from_toml(&off).unwrap();
+        assert!(rfq_default_preset_applies(Some(&rfq_only), &empty));
+
+        let fleet = std::env::temp_dir().join("stitch-rfq-preset-applies-fleet");
+        let _ = std::fs::create_dir_all(&fleet);
+        std::fs::write(
+            fleet.join(PANEL_FLAGS_FILE),
+            "[experimental]\nrfq_default = \"enable-rfq\"\n",
+        )
+        .unwrap();
+        assert!(rfq_default_preset_applies(Some(&book), &fleet));
+    }
+
     const RFQ_BLOCK: &str = r#"
         [rfq]
         enabled = true

src/config.rs

@@ -344,6 +344,24 @@ fn run_init(dir: Option<String>) -> anyhow::Result<()> {
     let paths = setup::write_config(&target, corridor, &key)?;
     key.zeroize();
 
+    // Same fleet flag the panel reads: `{dir}/panel.toml` or a parent
+    // `panel.toml` (bots-dir / bot-dir layouts).
+    let flag_dir = paths
+        .dir
+        .parent()
+        .filter(|p| stitch_bot::config::rfq_default_flag_in_dir(p))
+        .map(|p| p.to_path_buf())
+        .or_else(|| {
+            stitch_bot::config::rfq_default_flag_in_dir(&paths.dir).then(|| paths.dir.clone())
+        });
+    if flag_dir.is_some() {
+        let current = std::fs::read_to_string(&paths.toml)?;
+        let next = setup::apply_rfq_default_preset(&current)?;
+        setup::write_toml_atomic(&paths.toml, &next)?;
+        println!("RFQ-default is on — this bot will not rest orders on the public book.");
+        println!("Connect it to Textile (Stitch panel → Settings → RFQ) before going live.");
+    }
+
     println!("\nConfig written to {}", paths.dir.display());
     println!("  {}", paths.toml.display());
     println!("  {}", paths.env.display());
@@ -484,9 +502,13 @@ async fn run(config_path: String, dry_run: bool) -> anyhow::Result<()> {
         dry_run,
     };
 
-    // RFQ responder (dual-run pilot): spawned only when `[rfq].enabled`.
-    // It runs beside the ladder on its own cadence and WebSocket; with the
-    // config off this is a no-op and every tick below behaves exactly as before.
+    if !cfg.book_enabled {
+        info!("public ladder off — this bot will not rest orders on the book");
+    }
+
+    // RFQ responder: spawned only when `[rfq].enabled`. With the config
+    // off this is a no-op. The public ladder is a separate `book_enabled`
+    // switch.
     let rfq_task = stitch_bot::rfq::maybe_spawn(
         &cfg,
         signer.clone(),
@@ -706,53 +728,58 @@ async fn run(config_path: String, dry_run: bool) -> anyhow::Result<()> {
 
             let mut posted_bid = 0usize;
             let mut posted_ask = 0usize;
-            for side in [Side::Bid, Side::Ask] {
-                let price_override = match lean {
-                    Some((LeanMode::Live, decision)) => {
-                        let lean_price = match side {
-                            Side::Bid => decision.bid,
-                            Side::Ask => decision.ask,
-                        };
-                        match lean_price {
-                            Some(price) => Some(price),
-                            // The lean pulled this side (critical inventory or
-                            // a fair jump): stop reposting and let the live
-                            // orders age out through their TTL.
-                            None => continue,
-                        }
-                    }
-                    _ => None,
-                };
-                let outcome = quote_side(
-                    &ctx,
-                    &mut state,
-                    &mut budgets,
-                    pool,
-                    &pair,
-                    debt,
-                    collateral,
-                    side,
-                    mid,
-                    price_override,
-                    guard,
-                    now,
-                )
-                .await;
-                match outcome {
-                    // The nonce ledger could not be persisted; never post on a
-                    // stale ledger. Skip the rest of this pool's tick.
-                    SideOutcome::AbortPool => continue 'pools,
-                    SideOutcome::Done { posted, fills } => {
-                        if fills > 0 {
-                            // Orders of ours filled since the last post: the
-                            // inventory moved, so re-read the share next tick.
-                            if let Some(lean_state) = lean_states.get_mut(&pair) {
-                                lean_state.note_fill(now);
+            // RFQ-only (`book_enabled = false`): do not rest orders on the
+            // public book. Spreads and liquidity still size the RFQ responder;
+            // the taker/closer legs below are unchanged.
+            if cfg.book_enabled {
+                for side in [Side::Bid, Side::Ask] {
+                    let price_override = match lean {
+                        Some((LeanMode::Live, decision)) => {
+                            let lean_price = match side {
+                                Side::Bid => decision.bid,
+                                Side::Ask => decision.ask,
+                            };
+                            match lean_price {
+                                Some(price) => Some(price),
+                                // The lean pulled this side (critical inventory or
+                                // a fair jump): stop reposting and let the live
+                                // orders age out through their TTL.
+                                None => continue,
                             }
                         }
-                        match side {
-                            Side::Bid => posted_bid = posted,
-                            Side::Ask => posted_ask = posted,
+                        _ => None,
+                    };
+                    let outcome = quote_side(
+                        &ctx,
+                        &mut state,
+                        &mut budgets,
+                        pool,
+                        &pair,
+                        debt,
+                        collateral,
+                        side,
+                        mid,
+                        price_override,
+                        guard,
+                        now,
+                    )
+                    .await;
+                    match outcome {
+                        // The nonce ledger could not be persisted; never post on a
+                        // stale ledger. Skip the rest of this pool's tick.
+                        SideOutcome::AbortPool => continue 'pools,
+                        SideOutcome::Done { posted, fills } => {
+                            if fills > 0 {
+                                // Orders of ours filled since the last post: the
+                                // inventory moved, so re-read the share next tick.
+                                if let Some(lean_state) = lean_states.get_mut(&pair) {
+                                    lean_state.note_fill(now);
+                                }
+                            }
+                            match side {
+                                Side::Bid => posted_bid = posted,
+                                Side::Ask => posted_ask = posted,
+                            }
                         }
                     }
                 }