flags.toml
Operator toggles — every one a bool defaulting to false, every one carrying an owner, a review date and the disposition its review is expected to reach.
crates/vike-config/src/flags.rs is the authority for this file. A flag is a thing an operator
turns on for a run: enable reconciliation, mount live execution, open a control surface, start a
recorder. Unlike a ceiling, settable from the environment is the right property here — that is how
a systemd unit, a container and a one-off shell all express intent, and the blast radius of a wrong
value is a feature that is on or off, not a risk limit that is wrong.
Every flag defaults to false. That is not tidiness: each one gates a live order path, a remote
write surface, a settlement poller or extra I/O, and the safe reading of an absent configuration is
do the smaller thing. Two shapes need the sentence read carefully and say so in their own docs —
poly_redeem_halt is a kill switch, where false means not halted, safe only because the
poller it halts is itself off by default; and preflight_skip and allow_withdraw_keys are safety
overrides, where false is the guarded state.
A truthy typo is an error, not a silent false
The variables these mirror are read elsewhere as the exact string "1", and anything else is
silently false — so VIKE_RECONCILE=true is a run that reconciles nothing and looks completely
normal. This crate's parser accepts "1" and "0" and rejects everything else by name and value.
The one exception is poly_redeem_halt, whose live read is presence-based: the variable existing
halts redemption whatever its value, empty included. Narrowing a kill switch to "1" would silently
stop POLY_REDEEM_HALT= and POLY_REDEEM_HALT=0 from halting anything, and a kill switch that
fails to fire is the worst regression on the list.
Owner, review date, disposition
FLAG_REGISTRY carries a FlagMeta row per field: the field name — identical to the flags.toml
key, which crates/vike-config/tests/flag_registry.rs proves rather than assumes — the environment
variable, an owner, an ISO YYYY-MM-DD review date, and the Disposition that review is expected
to reach. The point is stated flatly in the module header: a flag with no owner is a flag nobody
will ever delete. Every row names the same handle today, because the repository has one maintainer
and inventing team names would be fiction; the field exists so ownership can diverge later without a
schema change.
Disposition has three values.
Keep— genuinely a per-run operator decision: a real-money arm, a kill switch, a safety override.Graduate— not really a per-run decision but how this deployment is set up, usually with non-boolean siblings —*_CADENCE_MS,*_INTERVAL_MS, a policy name — already sitting inconfig.toml.Retire— delete it, with the behaviour it gates becoming unconditional or dropped: the flag exists because something was unproven, and once it is proven, an option nobody should turn off is a branch nobody tests.
flag_registry.rs fails when a field has no row, when a row has no field, when an owner is blank,
when a date is malformed, and — because it drives every row through the real environment and file
layers — when a row's variable is wired to the wrong field. It deliberately does not fail once a
review date has passed: that would turn the calendar into a merge blocker on unrelated PRs, and a
settings crate must not be able to stop a trading fix from shipping.
The flags, by group
Every row below is field / VARIABLE / review date / disposition, from FLAG_REGISTRY.
Reconciliation. reconcile / VIKE_RECONCILE / 2026-11-01 / Graduate — the master gate; off
means no ReconDriver, no thread. reconcile_generate_missing /
VIKE_RECONCILE_GENERATE_MISSING / 2027-02-01 / Graduate. reconcile_balance /
VIKE_RECONCILE_BALANCE / 2027-02-01 / Graduate. The rest of the VIKE_RECONCILE_* family is
config, not flags — cadences, lookbacks and the policy name. See
reconciliation.
Order emulation. oco_cancel_sibling_on_dead_exit /
VIKE_OCO_CANCEL_SIBLING_ON_DEAD_EXIT / 2026-11-01 / Retire — a bracket that half-survives its own
exit is a bug, not a preference.
The headless daemon. tradehub_live / VIKE_TRADEHUB_LIVE / 2026-11-01 / Keep — the field doc
calls it the single largest blast radius on the list, and a real-money arm must stay a deliberate
per-run decision. tradehub_control / VIKE_TRADEHUB_CONTROL / 2026-11-01 / Graduate — the
authenticated control scope; off, a Control-scope peer is refused at the handshake however good its
key. tradehub_allow_public_bind / VIKE_TRADEHUB_ALLOW_PUBLIC_BIND / 2026-11-01 / Keep — a safety
override: that surface's handshake is plaintext and authenticates the connection rather than each
frame, so its confidentiality comes entirely from being unreachable, and the daemon refuses a
non-loopback bind while logging the SSH-tunnel alternative. It is a separate flag rather than an
inference from the address because the mistake it catches is typing an address, and no address can
be its own consent. telegram_control / VIKE_TELEGRAM_CONTROL / 2026-11-01 / Keep — sits under a
Cargo feature as well, so a default build does not compile the module at all. tradehub_record /
VIKE_TRADEHUB_RECORD / 2027-02-01 / Graduate. cancel_orders_on_shutdown /
VIKE_CANCEL_ORDERS_ON_SHUTDOWN / 2026-11-01 / Keep.
cancel_orders_on_shutdown cancels; it never flattens
Off is what has always happened and stays byte-identical: teardown detaches and exits, and your
quotes stay resting at the venue with nothing left running to manage them. That really is what an
operator restarting for a deploy usually wants, which is why the safer-sounding value is not the
default. Positions survive either way. And it can only run on a path that reaches teardown at all —
vike_ops::stop::install_handlers registers SIGTERM/SIGINT onto the daemon's stop flag before
anything else in main, so systemctl stop does run the teardown and does honour the flag. What
bypasses it is a failed handler install (reported as an error at startup), a platform with neither
signals nor a Windows console, or a SIGKILL after the unit's stop deadline.
Polymarket. poly_exec / POLY_EXEC / 2026-11-01 / Graduate — mounts the live execution
client, and inseparably starts the user-WS fill pump, because on that venue every post-acceptance
terminal arrives only on the user channel. poly_reconcile / POLY_RECONCILE / 2026-11-01 /
Graduate — meaningful only alongside poly_exec: reconciling a paper engine against live venue
state makes the two sides different accounts, and under the hybrid policy PositionDrift
auto-applies, folding the live account's position into the paper engine's books. Run
recon-without-exec under quarantine. Then poly_presubmit_register / POLY_PRESUBMIT_REGISTER /
Retire, poly_heartbeat / POLY_HEARTBEAT / Retire, poly_rate_gate / POLY_RATE_GATE / Retire,
poly_chain_watch / POLY_CHAIN_WATCH / Retire (all 2026-11-01), poly_chain_proxy /
POLY_CHAIN_PROXY / 2027-02-01 / Graduate, poly_auto_redeem / POLY_AUTO_REDEEM / 2026-11-01 /
Keep, poly_redeem_halt / POLY_REDEEM_HALT / 2027-02-01 / Keep, and pm_resolve /
VIKE_PM_RESOLVE / 2027-02-01 / Keep.
Per-venue behaviour. hl_outcome / VIKE_HL_OUTCOME / 2027-02-01 / Keep. bybit_fast_exec /
VIKE_BYBIT_FAST_EXEC / 2026-11-01 / Retire. binance_trade_lite_fill /
VIKE_BINANCE_TRADE_LITE_FILL / 2026-11-01 / Retire. hyperliquid_hip3 / HYPERLIQUID_HIP3 /
2027-02-01 / Graduate.
Recorders. record_properties / VIKE_RECORD_PROPERTIES, record_chains /
VIKE_RECORD_CHAINS, record_dvol / VIKE_RECORD_DVOL — all 2027-02-01 / Graduate.
Safety overrides. allow_withdraw_keys / VIKE_ALLOW_WITHDRAW_KEYS / 2027-02-01 / Keep — the
default refusal exists because a key that can move funds off the venue has no business signing
orders. preflight_skip / VIKE_PREFLIGHT_SKIP / 2027-02-01 / Keep — skips the checks that catch a
misconfigured mount before it trades; see startup preflight.
Check the READ column before you set one
Most of these are still read by a library, not by this file
vike_config::CONSUMPTION carries one row per key naming the file and the read that consumes it, or
a written admission that nothing does, and crates/vike-config/tests/settings_are_consumed.rs opens
each claimed consumer and looks. Many flags are still read by a venue adapter or a recorder through
its own environment read, so setting them here does nothing yet — vike-cli config show's READ
column says NO for exactly those and the --json view carries each one's reason. Moving one is
not a line change: it means threading the value from a composition root through
vike_run::NodeConfig and vike_mount::make_engine into the adapter, and a flag living in two
places that disagree would be worse than the state the program is fixing, so the file layer and the
environment read flip together, per flag.
Six boolean-ish things in the tree are deliberately not fields here, each named in the module header so the omission is on the record: the two computed per-venue families keyed by venue rather than by a fixed name, the default-on master of one of them, the Polymarket proxy trio with its fuzzy grammar, the sweep sequential switch that belongs with preferences, the presence-based GUI and screenshot harness, and the test-only self-skip gates.
preferences.toml
Taste and tuning — the two independent log levels, the chart style and the sweep thread bound — the one settings file where nothing is a ceiling and both log levels apply without a restart.
alerts.json
The persisted alert rule set — its schema, its forward-compatibility discipline, where the daemon reads and writes it, and which of its triggers a headless node can actually fire.