feat(rfq): add durable provider state machine

Cargo.toml

@@ -8,6 +8,7 @@ members = [
     "crates/deadcat-iroh",
     "crates/deadcat-node",
     "crates/deadcat-cli",
+    "crates/deadcat-rfq-provider",
 ]
 
 [workspace.package]
@@ -41,6 +42,7 @@ deadcat-contracts = { path = "crates/deadcat-contracts" }
 deadcat-client = { path = "crates/deadcat-client" }
 deadcat-rpc = { path = "crates/deadcat-rpc" }
 deadcat-iroh = { path = "crates/deadcat-iroh" }
+deadcat-rfq-provider = { path = "crates/deadcat-rfq-provider" }
 
 # The CLI and Rust libraries must remain on the exact same smplx release.
 # smplx 0.0.9 caps simplicityhl at 0.6.x; Cargo.lock pins the newest

README.md

@@ -28,9 +28,14 @@ packets remain in `docs/` as explicitly marked historical records.
 direction: the planned initial venue is a separate noncustodial liquidity
 service, with a client-side router responsible for quote validation and
 transaction construction. A future AMM or decentralized limit-order book can
-implement the same venue boundary. The RFQ service remains separate from
-`deadcat-node`; future AMM and DLOB protocols are not implemented by this
-repository today.
+implement the same venue boundary. [ADR 0007](docs/adr/0007-rfq-provider-state-machine.md)
+defines the provider's durable reservation and commit-before-sign boundary.
+The transport-free provider state core is implemented, while its wallet,
+pricing, transaction validator, signer adapter, remote service, and relay
+layers remain future work. Until the validator and signer adapter land, the
+safety-critical commit and signed-result transitions are intentionally
+crate-internal. The RFQ provider remains separate from `deadcat-node`; future
+AMM and DLOB protocols are not implemented by this repository today.
 
 ## Assurance
 

crates/deadcat-rfq-provider/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "deadcat-rfq-provider"
+description = "Durable inventory reservation and signing state for a noncustodial Deadcat RFQ provider."
+version.workspace = true
+edition.workspace = true
+publish.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+elements.workspace = true
+postcard.workspace = true
+redb.workspace = true
+serde.workspace = true
+sha2.workspace = true
+thiserror.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true

crates/deadcat-rfq-provider/src/lib.rs

@@ -0,0 +1,31 @@
+//! Transport-free durable state for a noncustodial RFQ provider.
+//!
+//! This crate owns neither networking nor wallet keys. Its job is narrower:
+//! make inventory allocation and the provider's signing point of no return
+//! durable and auditable. The required ordering is:
+//!
+//! `validate -> commit exact payload -> sign -> persist signed bytes -> release`
+//!
+//! Only an uncommitted reservation can expire or be cancelled. Once a signing
+//! payload is committed, every reserved outpoint remains retired even across
+//! expiry, process restart, signer ambiguity, mempool eviction, or reorg.
+//!
+//! This first state-only layer does not yet expose the commit or signed-result
+//! transitions outside the crate. A later concrete transaction validator and
+//! signer adapter must be the only producers of those transition inputs.
+
+mod model;
+mod store;
+
+pub use model::{
+    AuditEntry, AuditEvent, Clock, FeePolicy, FeePolicyViolation, FeeSizeMetric, IdempotencyKey,
+    InventoryItem, InventoryState, InventoryView, MAX_RESERVATION_INPUTS, MAX_SETTLEMENT_BYTES,
+    ModelError, OwnerId, ProviderId, ProviderIdentity, QuoteCommitment, RecoveryAction,
+    ReleaseReason, ReservationAccess, ReservationId, ReservationPlan, ReservationState,
+    ReservationView, SignedArtifact, SignedArtifactDigest, SigningCommitment, SigningJob,
+    TransactionFee, UnixMillis,
+};
+pub use store::{
+    CommitOutcome, MAX_EXPIRATION_BATCH, ProviderError, ReservationBook, ReserveOutcome,
+    SCHEMA_VERSION, SignedOutcome,
+};