AI Market Maker v6.2.5

Release Date: September 5, 2026 Tags: MARKET-MAKING, PRICE-MODE, LIQUIDITY, POOL, SECURITY, AUDIT-TRAIL, ADMIN, SETTINGS, DATABASE, COMPLIANCE, BUG-FIXES

Overview

Follow external could not read a price at all on most installs, and nothing said so.

v6.2.4 made a following market able to reach its reference. This release is the half before that. The reference was read through the platform's licensed trading connection, which needs an active exchange provider and that provider's API key and secret in the environment. Reading a public ticker needs neither, and a platform running its own ecosystem markets has no reason to hold spot credentials — so on those installs the fetch returned nothing, for ever, at a log level nothing writes to disk, while the market generated its own prices behind a badge that read Follow external. The feed is keyless now.

Mirror is a fourth price mode, for a market that has to track its reference rather than lean toward it: the reference becomes the market's published price, quotes are real pool liquidity around it, and it stops quoting when the feed goes stale.

The pool's money is the platform's now, whoever operates it. Deposits come from the Super Admin's wallet and withdrawals — including the payout a delete makes — go back to it. They used to use the wallet of whichever admin clicked.

Beside Ecosystem 6.5.0's shard tier, the maker runs on a door and can be split per shard. A market maker places orders and owns no book, so it belongs on a door — never inside a shard — and on a door its quotes reach the shard that owns each symbol, its cancels reach the same shard, and its fills come back to it. ECO_MAKER_SHARD_ID runs one maker process per shard, each quoting its shard's symbols — and maker 0 also quoting everything no shard owns. Off unless set; nothing changes on an install without shards. Requires Ecosystem v6.5.0 as well as Core 6.7.6, and the whole of this release does, not only this feature: the maker's engine now loads the shard router that ships with that Ecosystem release whether or not you split it, and on an earlier Ecosystem the engine does not load at all. The shard map itself is only read once ECO_MAKER_SHARD_ID is set.

Read Upgrade Notes before you update. If you run any market on Follow external or Hybrid you need to check whether it was ever tracking at all, two settings did not do what the screen said they did, and if a delegated admin ever funded a pool from a personal wallet you need to decide where that seed should land.

Requires Core v6.7.6: the fresh Super Admin read the pool doors and the balance card depend on is a Core change — getSuperAdmin learned a fresh option — and the guarantee in Upgrade Notes holds only on that Core or later.

Update Instructions

pnpm updator

Restart the backend afterwards.

This release adds a value to a database column. pnpm updator applies it. Mirror cannot be saved on a market until it has run, and the failure if you skip it is a rejected save rather than anything silent.

Core v6.7.6's update also deletes the notification rows the maker's pool account (ai-market-maker@pool.invalid) had accumulated — every fill wrote one for an account nobody can sign in to. Nothing else of that account's is touched; the details are in the Core notes.

Highlights

Why Follow external was never going to look like tracking

Worth stating with numbers, because the mode has been read as a peg since it shipped and it is not one.

At the settings that ship — 2% daily volatility, correlation strength 50 — the tether closes half of any gap to the reference in about 33 hours, while the market's own random walk covers roughly ±1.5% a day. Put a market 0.5% away from its reference and leave it a day: the tether brings it to about 0.3%, and the market's own noise has moved it several times that distance in the same period, in whichever direction it happened to go. The lean is real and it is measurable. It is also an order of magnitude quieter than the movement it is competing with, which is why a chart on Follow external looks like a market doing its own thing rather than one following an exchange.

That is not a defect in the tether — it is what a drift toward a reference is, and its cap is what stops a mis-mapped symbol dragging a market anywhere it likes. But it is not what an operator means when they ask for a market that follows Binance, and until now there was no mode that meant that. Mirror is the other answer: it does not lean toward the reference, it is the reference.

What the keyless feed is and is not

It is read-only by construction. Nothing in it is given credentials, so nothing in it can place, cancel or move anything — the worst a mis-configured reference venue can produce is a wrong number, which the existing implausible-reference guard already contains, and never a wrong trade. That is also why the venue list is not limited to the exchanges your platform is licensed to trade on: this is about where a price is read, not where an order goes.

If you do have a licensed provider configured, it is still tried first. That is deliberate — the reference and the book your platform actually fills on should be the same one.

Upgrade Notes

Your following markets may never have tracked anything — check them

If you run Follow external or Hybrid and you do not have an exchange provider enabled with APP_<PROVIDER>_API_KEY and APP_<PROVIDER>_API_SECRET set, those markets have been generating their own prices this whole time. Every screen said Follow external, because the badge is printed from the setting rather than from anything the market was doing.

• Fixed the reference feed to read public prices without credentials, so those markets begin tracking on the next restart.

After updating, open each following market's Configuration tab and look at the tether line. It now names the venue and prints the live reference price, or tells you exactly why there isn't one. A market that has been running autonomously has a price history that owes nothing to the asset it names — decide whether you want it to converge from where it is, or to reset it to the reference with Mirror.

Mirror pins real liquidity to 100%

The one setting Mirror takes out of your hands, and the setting that makes the mode mean what its name says. Anything below 100% would have a market that copies a public reference also printing bot-to-bot trades at that reference — fabricated volume wearing a real price, which is a worse artifact than either half on its own.

• Added Mirror as a price mode. It requires an external symbol, and it will not quote at all without a fresh reference.

A Mirror market's reported volume comes from real customers only. If nobody trades it, its 24-hour volume is zero and that figure is now the truth rather than a fault.

Correlation strength of zero was running at fifty

The slider goes down to 0, and 0 is how you switch the tether off. The engine read a stored zero as absent and substituted the shipped default, so a market you had deliberately untethered was following at half strength while every screen showed 0.

• Fixed the parse, for correlation strength and for bias strength, which had the same fault and the same meaning for zero.

If you ever set either of these to zero, re-check that market's behaviour — it was not doing what you told it.

"Enable AI Trading" could not switch real liquidity off

Settings are stored as text, so a switch saved as off arrives as the string "false", and the engine compared it against a boolean. The master switch therefore could not turn real liquidity off. The risk layer had already been corrected for this; the engine's own reader had not.

• Fixed the engine to read the three global switches through the typed settings helpers.

If you have ever switched AI trading off and expected quoting to stop, check your markets and your pool balances.

A new setting chooses where reference prices come from

Settings → Trading → Reference Price Venue, shipping as Binance, with OKX, Bybit, KuCoin, Bitget, Gate.io, MEXC, Kraken, Coinbase and XT alongside it.

• Added the setting. It is only consulted when you have no licensed provider configured; if you do, that provider is still the reference.

The pool's money moves through the platform's wallet, whoever operates it

Every pool movement — a deposit, a withdrawal, and the payout a delete makes — is now taken from and paid into the Super Admin's wallet: the oldest user holding the Super Admin role, the same account the maker's fees already land in. It used to be the wallet of whichever admin clicked. A delegated admin holding the pool permission could therefore fund the house's inventory from a personal wallet and take it back out with the P&L, and anyone holding the delete-market permission — which says nothing about money — was paid the pool's whole balance for deleting it.

If you are the Super Admin and the only admin who has ever touched a pool, nothing changes for you: the same wallet moves, and the only new facts are fields that all name you — operatorId and houseWalletOwnerId in the ledger row's metadata, and houseWalletOwnerId on the history entry beside adminId.

• Changed the deposit to debit the Super Admin's wallet, and the withdrawal and the delete payout to credit it, on both venues: the ECO wallet for an ecosystem market, the FUTURES wallet for a futures market. The DEPOSIT and WITHDRAW history entries keep adminId — who acted — and gain houseWalletOwnerId — whose wallet the money moved through; the two differ whenever a delegated admin operates the pool. The delete payout writes no history entry — the market's history goes with it — and is recorded on the ledger row only. The wallet-ledger rows behind a deposit, a withdrawal and the legs of a delete payout are written under the Super Admin's account, so they appear in that account's transaction history rather than the acting admin's; each carries operatorId — the admin who acted — and houseWalletOwnerId in its metadata.
• Changed the balance card on the Pool tab to show the platform wallet — the Super Admin's — on the venue's wallet type, because that is the balance a deposit is checked against: the ECO wallet on an ecosystem market, the FUTURES wallet on a futures market. It used to read the caller's ECO wallet whatever the venue, so on a futures market it printed a balance the deposit never checked. On an install with no Super Admin the card refuses on load with the same sentence the doors use.
• Changed the doors and the card to read the Super Admin from the row rather than from the five-minute cache the fee path uses, so a Super Admin deleted or demoted a moment earlier — a soft delete that leaves the account's wallets live — is not paid a pool's balance before that cache expires.

If a delegated admin funded a pool from a personal wallet on your install, that seed comes back to the platform wallet on withdrawal, not to them. Withdraw the pool before you update if that matters to you; after the update, settle it between the two accounts by hand. Nothing already in a pool moves on its own.

An install with no Super Admin user is refused at all three doors. The money would have nowhere to go, and the caller's wallet is not a fallback — that fallback is the defect this closes. The refusal is The platform has no Super Admin; the pool's money has nowhere to go, at every door and on the balance card; create the Super Admin and retry. A delete of an empty market still goes through, since it moves nothing, and a refused delete of a funded one leaves the maker running with its quotes on the book: the wallet is resolved before the maker is stopped or its orders cancelled.

Two other sentences changed with the wallet: a deposit larger than the balance now says The platform's {currency} wallet holds …, but the deposit is … rather than You have …, and a platform account with no ECO wallet in that currency that cannot be created is refused with a sentence that names the Super Admin's account and says that funding your own wallet does not help.

If several users hold the Super Admin role, the oldest is the wallet. That is the rule fees have always used, and the pool follows it rather than inventing a second one.

Added

One market maker per shard

Requires Ecosystem v6.5.0 — the whole of this release does, not only this feature: the maker's engine loads the shard router that ships with that Ecosystem release whether or not you split it, and the shard map itself is only read once ECO_MAKER_SHARD_ID is set. A maker on a door needs nothing new to place beside the shard tier: its quotes already reach the owning shard by symbol. What it needed to work there is the paragraph below. What this adds is the ability to run several makers, one per shard, when one process quoting the whole venue becomes the ceiling — a refinement of where it runs, not of whether it runs. Until then leave it unset.

Three things were built for the tier Ecosystem 6.5.0 ships beside this note and would have gone wrong the first day a shard ran, all inside unreleased code: the maker's own cancel wrote its terminal status and evicted the quote from the local engine, neither of which reaches a shard, so a quote marked cancelled stayed fillable on the shard through every retirement path, including the one that exists because a stale quote is an arbitrage; a door owning the whole venue had no maker driver at all, so nothing would have quoted until somebody pressed START; and a fill on a shard never reported back to the maker, so its tracked orders never advanced. All three are done, and only the last is entirely someone else's: the cancel goes to the shard and a refusal leaves the tracking row open to be retried; the supervisor arms on a door as it does on the matcher (Core 6.7.6's), and the maker's own half of that rule is here — neither its engine nor its five-second ownership check now reads a door's follower matcher as a reason to stay idle, so on an earlier maker a door stays idle whatever the core does; the shard's fill events feed the maker's fill accounting (Ecosystem 6.5.0's) — the other reason both releases are required.

• Added ECO_MAKER_SHARD_ID: the shard whose symbols this process's maker quotes. Maker 0 also quotes every symbol no shard owns — which during a canary is most of the venue, and always every futures market — so N makers means ids 0 to N-1, and there must be a maker 0. A value set to anything but a whole number inside the shard count refuses to start the engine rather than reading as 0, because a mistyped id reading as 0 would quote the whole remainder beside the real maker 0; left blank it reads as unset, the single whole-venue maker.
• Added a lease per maker shard: the engine lease row becomes engine-shard-<id> and the Redis key gains the same suffix, so N makers hold N leases at once. That is the point, and it is also why the switch is stop first, then start: the old single maker and a new per-shard one do not exclude each other, and the overlap is double-quoted for as long as both are up. Confirm the engine row is gone or expired before the first per-shard maker starts.
• The roster is filtered at both places a market is started — the load and the five-second reconciler — so a market another maker owns is never restarted, stopped or paused from here; and never by refusing inside a market's own start, which START in the admin console reads as a failure and answers by writing PAUSED to every bot on the market.

Mirror — the reference is the price

• Added a fourth price mode. Mirror publishes the reference price as this market's own, re-read every fifteen seconds, and quotes real pool liquidity around it. It has no random walk, no bias, no narrative phase and no containment band, because it invents nothing for those to act on.
• Added a hard stop on a stale reference: a Mirror market that has lost its feed holds its last true price and refuses to quote until the feed returns. A market with no price of its own must not rest two-sided orders around a number the real market has already moved away from — that mispriced side is exactly what an arbitrageur takes.
• Changed the volatility auto-pause to not apply to a Mirror market. A mirror of a 12%/day asset realises 12%/day by design, and pausing it for that would be pausing it for working.

The external symbol is a list you pick from

• Added a searchable symbol picker in place of the free-text box. Every way of typing that field wrong used to fail identically and silently — a typo, the wrong separator, or a pair the venue does not carry all produced a market that read Follow external on every screen and tracked nothing.
• Added free-text entry as a fallback, reachable only when the venue itself cannot be reached, so a network fault cannot make a market unconfigurable.

Changed

The Configuration tab explains the range you are actually editing

• Changed the Price Configuration card to print the explanation that matches the mode. It always showed the autonomous reading — the range as a hard box the engine holds price inside — while the sentence correcting it for a following market sat two cards further down. That is what teaches an operator that the range must be zeroed for a market to follow, and zeroing it does nothing: the leash contributes no drift through the inner four-fifths of the band, and the band already travels with the reference.

Controls that do nothing on a Mirror market are hidden

• Changed the correlation-strength slider and the real-liquidity slider to disappear on Mirror rather than sit there greyed out. A disabled control still reads as a knob the market has, and an operator who moves one and sees nothing happen has been told something false.

The Pool tab and the delete dialog say whose wallet it is

• Changed the Pool tab's balance card from Your Wallet Balance to Platform wallet balance, explained as The Super Admin's wallet. Every pool deposit is taken from it and every withdrawal is paid back into it, whoever operates this market. The deposit card reads Moves funds from the platform's wallet into the pool and the withdraw card Returns funds from the pool to the platform's wallet. The delete card and its confirmation dialog now say Whatever the pool still holds is paid out to the platform's wallet (the Super Admin's), not to yours — the dialog used to say only Withdraw the pool first. A refusal the server makes is shown in the server's own sentence; only a request that never reached the server reads The platform wallet balances could not be read. Seven strings, seeded into every catalogue in English until translated.

A dead feed says which kind of dead

• Changed every reference-price failure to carry its reason. Six unrelated causes — no provider configured, missing credentials, a provider back-off, a typo, a pair the venue does not list, a network fault — returned the same empty result at debug level, so they were indistinguishable from each other and from a healthy feed. The Configuration tab now prints the sentence, and the log warns on a ten-minute throttle instead of never.

Fixed

A pair typed in lower case saved cleanly and never resolved

• Fixed the mode save to store the symbol it validated. It checked the uppercased form against the venue's market list and then wrote your raw text; the price lookup keys on the exact symbol, so trx/usdt passed validation, produced a success message and a Follow external badge, and missed on every fetch afterwards. Rows already saved that way start working on the next restart with no migration.

The screen that answers "is this following?" was grading your target price

• Fixed the market detail screen to judge the tether against the market's own price rather than the target price you typed. Both directions of that were wrong and both were reachable: a target left near the reference printed a small error and a green tracking verdict while the price sat somewhere else entirely, and a target left far from it printed a fixed error that never moved however well the market was converging.

Symbol validation could not see the venue's market list

• Fixed the check that refuses an unlisted external symbol. It was gated on a non-empty market list — correctly, so an unreachable venue cannot block a configuration change — but the list could only be read through the credentialed connection, so on an install without one it was always empty and the check never ran.

Two payout doors paid the admin who clicked

• Fixed the pool withdrawal to credit the platform's wallet. It credited the calling admin's, so edit.ai.market_maker.pool — a permission to drain a pool for maintenance — was also a permission to be paid its balance.
• Fixed the delete-market payout, which runs under delete.ai.market_maker.market and not the pool permission at all, to credit the platform's wallet. It paid the clicking admin both currencies of whatever the pool still held, and nothing on the screen said so.

A note on what this feature is and is not

Unchanged from v6.2.4, and worth repeating beside Mirror.

This addon generates market activity. Mirror narrows what is generated — the price is a real public price and no bot-to-bot trade is printed — but a Mirror market is still a market whose depth your platform posted, and the counterparty to a customer's fill is still your pool.

Whether that is appropriate is a question about your licence, your jurisdiction and what you have told your customers, and it is not one this release answers. What this release does answer is the narrower one: an operator who selects a mode that says it follows an exchange now gets a market that follows an exchange, or an explicit statement of why it does not.