Keeper overview

The off-chain operator - oracle relay, book management, order settlement, inventory plumbing, and yield routing.

The keeper is an off-chain Rust async bot - the operational layer between on-chain Continuum and the outside world. In v2 its job changed shape: instead of managing external AMM positions, it maintains the protocol’s own venues and the economic loops behind them. Each behavior is an independent task behind an env-var kill switch (default on), so any loop can be disabled without a redeploy; a failure in one task doesn’t crash the others.

There’s a reference implementation in the protocol repo. It’s the canonical operator today; multi-operator support is on the roadmap.

What it runs

Task	Cadence	What it does
Oracle updater	~15s	Pushes the Hermes price + confidence per market (update_risk_state). Closed-market aware: a stale feed (publish time more than 120s old) withholds the push, the on-chain TWAP ages past 300s, mint/redeem freezes itself, and the books float at their standing band until reopen.
Book manager	30s	Re-pins each pool’s base to NAV when drift exceeds the per-market gate (QQQ/SPY/XAU 20bps, VXX 40bps), posting the vol-scaled, skewed bin shape. See Book management.
Inventory plumbing	with book manager	Bidirectional refill: drained asks restock (sweep bids → mint pairs → fund both sides, delta-neutral); bloated asks trim back to 1.5x bids; bid cUSDC above ~$5k sweeps out (idle bids forgo carry).
Commit settler	20s idle / 5s active	Discovers pending committed orders with one filtered getProgramAccounts, provisions inventory (sells first), settles up to 10 per tick, largest first. Settlement is permissionless - the keeper is just the reliable cranker.
Buffer + fee posting	with book manager	Posts each market’s dynamic overcollateralization target (set_buffer_target) and, on markets with fee_mult configured, the vol-informed mint/redeem fee.
Cross-market rebalance	with book manager	Moves collateral from over-target markets to under-target ones. The source’s own floor is enforced on-chain, so a stale plan can only under-move, never over-drain.
Yield router	minutes	Deploys idle collateral to the best lending venue (Kamino / MarginFi / Save / Jupiter Lend, DefiLlama-cached supply APYs); recalls everything and switches when the winning venue changes; harvests land in the treasury vault. On devnet a yield emulator mints real cUSDC at the live top-venue APY through the same harvest instruction, so devnet economics mirror mainnet.
Health	60s	SOL balances (auto-airdrop on devnet), inventory monitoring, dashboard state.

What it deliberately does not do

• Price the venues by hand. Spreads come from a model-free stack (realized-q90 ratchet, slow auto-floor, oracle confidence, per-market static floor - see the keeper concept page). The keeper computes and posts; there is no trained forecasting model and no discretion in the loop.
• Hold custody. Every funds movement is a program instruction with on-chain validation; sources and destinations bind to protocol PDAs and validated token accounts.
• Guarantee liveness for user funds. Committed orders refund unconditionally after their TTL whether or not the keeper is alive; mint/redeem freezes on a stale oracle rather than trusting the keeper’s last word.

Why it’s privileged, and how much

The keeper holds two signing roles: the per-market keeper_authority (oracle pushes, buffer targets, harvests) and the CLP authority (book shapes, inventory plumbing, fee posts). Neither can move user funds to arbitrary destinations. The trust assumptions that remain - the oracle relay on devnet, settlement cranking - are documented per-flow, with the mainnet hardening path (Pyth-direct settlement reads) flagged in the trade flow.

Running one

See Running the keeper for environment variables, kill switches, and tunables. The defaults are the live devnet configuration.