feat: ship RFQ-only with Connect and migrate from public ladder

- New bots are RFQ-only (`book_enabled = false`) and refuse Start without a maker credential; Connect registers the wallet with Textile and writes `rfq-api.key`.
- Add `stitch connect --config <path>` for CLI-only operators to enroll without the panel; moves enroll logic into a shared module so panel and CLI use the same protocol.
- Extract enroll protocol from panel HTTP handler into `src/enroll.rs` so both panel and CLI share the same wire types, signature, config patch, and corridor selection.
- Add Legacy card to Settings to toggle `book_enabled` on migrated bots; card is collapsed by default, reads config, and refuses the switch when a side lacks both spread and size.
- Add `migrate-book-to-rfq.md` guide covering both panel and standalone CLI paths; explains what changes in config (spreads/liquidity carry over, ttl/refresh/max-orders stop applying, TWAP and lean reach limit-taker leg only), how to verify from logs, and rollback via Legacy card.
- Update `stitch init` to point at `stitch connect` rather than the panel; install guides now include Connect before Approve.
- Update all install guides (panel, Docker, Linux, macOS, Windows, server) with Connect steps; update example configs and docker-compose.example.yml to show per-bot directories.
- Drop RFQ beta gates (`enable-rfq-beta`, `enable-rfq`); corridor mode stays `RFQ_BETA` until Limit is deleted, but stitch config sees no change.
- Add container-entrypoint.sh support for `STITCH_RFQ_API_KEY` environment variable; systemd service gets ImportCredential for optional `rfq-api.key`.
- Update `stitch.service` with detailed comments on loading optional `rfq-api.key` via ImportCredential; clarifies why it must be optional and where it lives.
- Update Cargo.toml description to reflect RFQ firm quoting and optional limit-order filling.
- Update README and SKILL.md to clarify new-bot RFQ-only flow and that Connect is required before Start.
- Clarify in ADVANCED.md that TWAP and lean apply only to public ladder and limit-taker leg, not RFQ; add ops section covering production cutover steps and inventory when both channels are on.

Author: bnolens

.claude/skills/stitch/SKILL.md

@@ -5,9 +5,10 @@ description: Operate Stitch, the Textile operator bot — start, stop, restart,
 
 # Operate Stitch
 
-Stitch is the Textile operator bot: per-pool market making. New installs use the
-**Stitch panel** (Docker web UI). This skill operates an existing layout and, if
-nothing is set up yet, installs the panel only — bot config happens in the browser.
+Stitch is the Textile operator bot: per-pool Swap quoting via RFQ. New installs
+use the **Stitch panel** (Docker web UI). This skill operates an existing layout
+and, if nothing is set up yet, installs the panel only — bot config happens in
+the browser. New bots need **Connect** on Settings before Start.
 
 ## Always start here
 
@@ -95,7 +96,8 @@ see [Not installed yet](#not-installed-yet).
 - After any change to pricing or sizing (spreads, liquidity, feed), run a
   `--dry-run` before going live again.
 - Don't start live operation or install a service without the operator's
-  explicit go-ahead.
+  explicit go-ahead. A new RFQ-only bot also needs Connect on Settings first
+  — Start without a maker key quotes nothing.
 
 ## Start
 

.codex/skills/stitch/SKILL.md

@@ -7,9 +7,10 @@ metadata:
 
 # Operate Stitch
 
-Stitch is the Textile operator bot: per-pool market making. New installs use the
-**Stitch panel** (Docker web UI). This skill operates an existing layout and, if
-nothing is set up yet, installs the panel only — bot config happens in the browser.
+Stitch is the Textile operator bot: per-pool Swap quoting via RFQ. New installs
+use the **Stitch panel** (Docker web UI). This skill operates an existing layout
+and, if nothing is set up yet, installs the panel only — bot config happens in
+the browser. New bots need **Connect** on Settings before Start.
 
 ## Always start here
 
@@ -96,7 +97,8 @@ see [Not installed yet](#not-installed-yet).
 - After any change to pricing or sizing (spreads, liquidity, feed), run a
   `--dry-run` before going live again.
 - Don't start live operation or install a service without the operator's
-  explicit go-ahead.
+  explicit go-ahead. A new RFQ-only bot also needs Connect on Settings first
+  — Start without a maker key quotes nothing.
 
 ## Start
 

.textile-monorepo-source

@@ -1 +1 @@
-bf58a6cebce223a65e6633df6b70136c7d6bfd63
+f72f0ba3b80e50d26117c3e5a7779614de9552a1

.textile-stitch-release-version

@@ -1 +1 @@
-0.1.212
+0.1.213

Cargo.lock

@@ -1,8 +1,8 @@
 [package]
 name = "stitch-bot"
-version = "0.1.212"
+version = "0.1.213"
 edition = "2021"
-description = "Stitch — Textile filler-network operator bot; market-makes the filler order book with signed UniswapX limit orders."
+description = "Stitch — Textile filler-network operator bot; quotes Swap via RFQ firm quotes and optionally fills resting limit orders."
 license = "AGPL-3.0-or-later"
 repository = "https://github.com/textile-protocol/textile-stitch"
 homepage = "https://github.com/textile-protocol/textile-stitch"

Cargo.toml

@@ -9,14 +9,15 @@
 Stitch is the Textile operator bot for filler-network market making. It runs
 as a single binary named `stitch`.
 
-Stitch does one job for each configured pool by default, plus an optional
-second:
+Stitch quotes Swap by default, plus an optional second job:
 
-- **Market making**: keep live buy and sell quotes for a configured
-  soft-asset/stablecoin pair.
+- **Swap quoting (RFQ)**: answer venue quote requests with firm, taker-bound
+  orders for a configured soft-asset/stablecoin pair. Connect the bot to
+  Textile before going live — a new bot will not Start without that. Connect
+  from the panel's Settings, or with `stitch connect` on the CLI.
 - **Limit-order taking** (opt-in): fill traders' resting limit orders on-chain
   when their price is at or beyond your own quote, priced by the same spreads
-  as your market making.
+  as your Swap quotes.
 
 ## Contents
 
@@ -53,11 +54,12 @@ No Docker and no terminal. [Download the release for your OS](https://github.com
   entry). For a headless server, prefer Option 2.
 
 In the browser: sign in with the password you created, **Add a bot**, pick a
-corridor, paste your operator wallet key, approve allowances, dry-run, then
-Start. Use **Start at login** in Settings if you want the panel (and any bots
-left running) to come back after a reboot — login starts stay in the tray and
-skip the control window. Quit Stitch from the menu / tray / window to stop the
-panel. For unattended 24/7 quoting on a server, use Option 2.
+corridor, paste your operator wallet key, approve allowances, then **Connect**
+the bot to Textile on Settings before Start. Use **Start at login** in Settings
+if you want the panel (and any bots left running) to come back after a reboot
+— login starts stay in the tray and skip the control window. Quit Stitch from
+the menu / tray / window to stop the panel. For unattended 24/7 quoting on a
+server, use Option 2.
 
 ### Option 2 — Server / Docker
 
@@ -109,6 +111,11 @@ Everything else — custom reverse proxy, building from source — is in
 - [Manual install — Windows](docs/install-windows.md)
 - [Manual install — Linux](docs/install-linux.md) — includes the systemd service setup.
 
+Already running a bot on the public ladder?
+[Migrating from the public ladder to Swap (RFQ)](docs/migrate-book-to-rfq.md)
+covers both the panel and the
+[standalone CLI](docs/migrate-book-to-rfq.md#standalone-cli).
+
 ### Install with an AI agent
 
 Your coding agent installs the Stitch panel and opens the web UI. You finish
@@ -154,15 +161,18 @@ The full copyable prompt is in [AI_INSTALL_PROMPT.md](docs/AI_INSTALL_PROMPT.md)
 </details>
 
 Running the binary directly without the panel? `stitch init` writes `stitch.toml`,
-`stitch.env` and an owner-only `stitch.key` for a chosen corridor. The per-OS
-guides cover it.
+`stitch.env` and an owner-only `stitch.key` for a chosen corridor, then
+`stitch connect` registers the wallet with Textile so the bot can quote Swap.
+The per-OS guides cover both.
 
 ## How It Works
 
-Stitch reads `stitch.toml`, polls your configured price feed, signs UniswapX
-limit orders, and posts those signed orders to the Textile indexer. The wallet
-private key is read from `STITCH_PRIVATE_KEY_FILE`, or from `STITCH_PRIVATE_KEY`
-for compatibility. If both are set, `STITCH_PRIVATE_KEY_FILE` takes precedence.
+Stitch reads `stitch.toml`, polls your configured price feed, and answers Swap
+quote requests with firm, taker-bound UniswapX limit orders signed against the
+operator wallet. Connect in the panel registers the maker and writes
+`rfq-api.key`. The wallet private key is read from `STITCH_PRIVATE_KEY_FILE`,
+or from `STITCH_PRIVATE_KEY` for compatibility. If both are set,
+`STITCH_PRIVATE_KEY_FILE` takes precedence.
 
 ### Signer / wallet backend
 
@@ -200,13 +210,19 @@ manual `[signer]` fields below are for CLI and server operators editing
 The operator wallet still needs a little native gas for Permit2 approvals
 (`stitch approve`) no matter which signer you use.
 
-For market making, each configured pool can have:
+For Swap quoting, each configured pool can have:
 
 - a **buy side**, where Stitch spends the stable/debt asset to buy the
   soft/collateral asset below the feed price;
 - a **sell side**, where Stitch spends the soft/collateral asset to sell above
   the feed price.
 
+RFQ prices those quotes off the latest feed print plus your configured
+spreads, capped by your liquidity — no TWAP smoothing and no inventory lean.
+TWAP and lean apply to the public ladder and, when it's on, the limit-order
+taker leg. TTL, refresh, and max-orders are ladder-only (`book_enabled`). New
+bots ship with the book off.
+
 With `limit_taker_enabled = true` on a pool, Stitch also checks the corridor's
 resting trader limit orders every tick and fills the profitable ones on-chain:
 a trader selling the soft asset fills at or below your bid, a trader buying it
@@ -246,6 +262,7 @@ indexer_url = "https://api.textilecredit.com"
 permit2 = "0x000000000022D473030F116dDEE9F6B43aC78BA3"
 reactor = "0x0000000000000000000000000000000000000000"
 tick_interval_secs = 5
+book_enabled = false
 
 [feed]
 url = "https://your-feed.example/cngn-usdt"

README.md

@@ -24,6 +24,18 @@ if [ -n "${STITCH_PRIVATE_KEY:-}" ]; then
   unset STITCH_PRIVATE_KEY
 fi
 
+# The maker credential from `stitch connect`. A new bot quotes Swap over RFQ and
+# rests no public ladder, so without this it starts and serves nothing. Filed the
+# same way as the wallet key rather than left in the environment, which
+# `docker inspect` and /proc expose. Only the default `[rfq].api_key_env` name is
+# handled here; a custom one is the operator's to pass.
+if [ -n "${STITCH_RFQ_API_KEY:-}" ]; then
+  rfq_key_path="${runtime_dir}/rfq-api.key"
+  printf '%s\n' "${STITCH_RFQ_API_KEY}" > "${rfq_key_path}"
+  export STITCH_RFQ_API_KEY_FILE="${rfq_key_path}"
+  unset STITCH_RFQ_API_KEY
+fi
+
 # MPC-wallet credentials (only one signer is used at a time; whichever the
 # config selects). Each secret env var, if present, is written to a 0600 file and
 # the matching *_FILE var is exported, same as the local key above. The Turnkey

deploy/container-entrypoint.sh

@@ -8,8 +8,11 @@
 #   sudo mkdir -p /etc/stitch-bot
 #   sudo cp stitch.toml /etc/stitch-bot/stitch.toml
 #   sudo cp stitch.key  /etc/stitch-bot/stitch.key   # holds the private key, chmod 600
+#   sudo mkdir -p /etc/credstore && sudo chmod 700 /etc/credstore
+#   sudo cp rfq-api.key /etc/credstore/rfq-api.key   # maker credential from `stitch connect`, chmod 600
+#                                                    # (optional: without it the bot runs, minus RFQ)
 #   sudo cp stitch.env  /etc/stitch-bot/stitch.env   # non-secret env, e.g. RUST_LOG
-#   sudo chmod 600 /etc/stitch-bot/stitch.key
+#   sudo chmod 600 /etc/stitch-bot/stitch.key /etc/credstore/rfq-api.key
 #   sudo cp stitch.service /etc/systemd/system/
 #   sudo systemctl daemon-reload
 #   sudo systemctl enable --now stitch
@@ -48,6 +51,26 @@ Type=simple
 EnvironmentFile=/etc/stitch-bot/stitch.env
 LoadCredential=stitch.key:/etc/stitch-bot/stitch.key
 Environment=STITCH_PRIVATE_KEY_FILE=%d/stitch.key
+# The maker credential `stitch connect` writes. A new bot quotes Swap over RFQ
+# and rests no public ladder, so without this it starts and serves nothing.
+# It has to come through LoadCredential for the same reason the wallet key does:
+# DynamicUser=yes runs as a transient UID that cannot read a root-owned 0600 file
+# under /etc, so the bot's "rfq-api.key next to stitch.toml" fallback never
+# resolves here.
+#
+# ImportCredential=, not LoadCredential=, because this one is optional. A
+# LoadCredential= source that does not exist fails the unit before ExecStart,
+# which would strand every bot that legitimately has no maker key: one still
+# waiting on `stitch connect`, or a limit-taker-only bot that never needs one.
+# ImportCredential= simply stages nothing when there is no match, and the bot
+# then logs that the maker key is missing, skips the responder, and runs its
+# other legs. (An empty `SetCredential=rfq-api.key:` is NOT the way to do this —
+# systemd rejects an empty value outright: "Invalid syntax, ignoring".)
+#
+# ImportCredential= reads the credential store, so this key lives in
+# /etc/credstore rather than beside the config.
+ImportCredential=rfq-api.key
+Environment=STITCH_RFQ_API_KEY_FILE=%d/rfq-api.key
 ExecStart=/usr/local/bin/stitch --config /etc/stitch-bot/stitch.toml
 # The bot traps SIGTERM and exits cleanly after the current tick.
 Restart=always

deploy/stitch.service

@@ -1,15 +1,28 @@
 # Run two Stitch bots side by side, each with its own config and wallet key.
 #
 # One container = one bot = one signer = one corridor. To add more, copy a
-# service block, point it at another stitch.<name>.toml + key, and give it a
+# service block, point it at another bots/<name> directory, and give it a
 # unique container_name.
 #
+# One directory per bot, not one shared folder of stitch.<name>.toml files:
+# `stitch connect` writes `rfq-api.key` next to the config it was given, so two
+# bots sharing a directory would overwrite each other's maker credential.
+#
 # Copy this file to docker-compose.yml (or run it directly with
 # `docker compose -f docker-compose.example.yml ...`) and adjust the paths.
 #
-# Prereqs in this directory (see docs/install-docker.md):
-#   - stitch.bot1.toml, stitch.bot2.toml   copy from stitch.example.toml
-#   - stitch.bot1.key,  stitch.bot2.key    one wallet per bot, chmod 600
+# Prereqs (see docs/install-docker.md):
+#   - bots/bot1/stitch.toml, bots/bot2/stitch.toml   copy from stitch.example.toml
+#   - bots/bot1/stitch.key,  bots/bot2/stitch.key    one wallet per bot, chmod 600
+#   - the container runs as uid 1000 and a bind mount keeps host ownership:
+#       sudo chown -R 1000 ./bots      # Linux only; Docker Desktop maps this for you
+#
+# Connect each bot to Textile before its first start. New bots quote Swap over
+# RFQ and rest no public ladder, so without a maker credential a container
+# starts and serves nothing. This writes bots/<name>/rfq-api.key, which the bot
+# picks up from beside its config on every later run:
+#   docker compose -f docker-compose.example.yml run --rm bot1 \
+#     stitch connect --config /home/stitch/run/stitch.toml
 #
 # Approve Permit2 once per bot before the first live start:
 #   docker compose -f docker-compose.example.yml run --rm bot1 \
@@ -37,12 +50,12 @@ services:
     <<: *stitch
     container_name: stitch-bot1
     volumes:
-      - ./stitch.bot1.toml:/home/stitch/run/stitch.toml:ro
-      - ./stitch.bot1.key:/home/stitch/run/stitch.key:ro
+      # The whole bot directory, writable: `stitch connect` rewrites stitch.toml
+      # and drops rfq-api.key beside it, and both have to survive the container.
+      - ./bots/bot1:/home/stitch/run
 
   bot2:
     <<: *stitch
     container_name: stitch-bot2
     volumes:
-      - ./stitch.bot2.toml:/home/stitch/run/stitch.toml:ro
-      - ./stitch.bot2.key:/home/stitch/run/stitch.key:ro
+      - ./bots/bot2:/home/stitch/run