> ## Documentation Index
> Fetch the complete documentation index at: https://continuum-ec12e897.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Keeper overview

> The off-chain operator - oracle relay, book management, order settlement, inventory plumbing, and yield routing.

The keeper is an off-chain Rust async bot - the operational layer between on-chain Continuum and the outside world. In v2 its job changed shape: instead of managing external AMM positions, it maintains the protocol's **own venues** and the economic loops behind them. Each behavior is an independent task behind an env-var kill switch (default on), so any loop can be disabled without a redeploy; a failure in one task doesn't crash the others.

There's a [reference implementation](https://github.com/continuum-markets/continuum/tree/main/keeper) in the protocol repo. It's the canonical operator today; multi-operator support is on the [roadmap](/markets/roadmap).

## What it runs

| Task                       | Cadence              | What it does                                                                                                                                                                                                                                                                                                                                                                    |
| -------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Oracle updater**         | \~15s                | Pushes the Hermes price + confidence per market (`update_risk_state`). Closed-market aware: a stale feed (publish time more than 120s old) withholds the push, the on-chain TWAP ages past 300s, mint/redeem freezes itself, and the books float at their standing band until reopen.                                                                                           |
| **Book manager**           | 30s                  | Re-pins each pool's base to NAV when drift exceeds the per-market gate (QQQ/SPY/XAU 20bps, VXX 40bps), posting the vol-scaled, skewed bin shape. See [Book management](/keeper/book-management).                                                                                                                                                                                |
| **Inventory plumbing**     | with book manager    | Bidirectional refill: drained asks restock (sweep bids → mint pairs → fund both sides, delta-neutral); bloated asks trim back to 1.5x bids; bid cUSDC above \~\$5k sweeps out (idle bids forgo carry).                                                                                                                                                                          |
| **Commit settler**         | 20s idle / 5s active | Discovers pending committed orders with one filtered `getProgramAccounts`, provisions inventory (sells first), settles up to 10 per tick, largest first. Settlement is permissionless - the keeper is just the reliable cranker.                                                                                                                                                |
| **Buffer + fee posting**   | with book manager    | Posts each market's dynamic overcollateralization target (`set_buffer_target`) and, on markets with `fee_mult` configured, the vol-informed mint/redeem fee.                                                                                                                                                                                                                    |
| **Cross-market rebalance** | with book manager    | Moves collateral from over-target markets to under-target ones. The source's own floor is enforced on-chain, so a stale plan can only under-move, never over-drain.                                                                                                                                                                                                             |
| **Yield router**           | minutes              | Deploys idle collateral to the best lending venue (Kamino / MarginFi / Save / Jupiter Lend, DefiLlama-cached supply APYs); recalls everything and switches when the winning venue changes; harvests land in the treasury vault. On devnet a yield emulator mints real cUSDC at the live top-venue APY through the same harvest instruction, so devnet economics mirror mainnet. |
| **Health**                 | 60s                  | SOL balances (auto-airdrop on devnet), inventory monitoring, dashboard state.                                                                                                                                                                                                                                                                                                   |

## What it deliberately does not do

* **Price the venues by hand.** Spreads come from a model-free stack (realized-q90 ratchet, slow auto-floor, oracle confidence, per-market static floor - see [the keeper concept page](/concepts/keeper)). The keeper computes and posts; there is no trained forecasting model and no discretion in the loop.
* **Hold custody.** Every funds movement is a program instruction with on-chain validation; sources and destinations bind to protocol PDAs and validated token accounts.
* **Guarantee liveness for user funds.** Committed orders refund unconditionally after their TTL whether or not the keeper is alive; mint/redeem freezes on a stale oracle rather than trusting the keeper's last word.

## Why it's privileged, and how much

The keeper holds two signing roles: the per-market `keeper_authority` (oracle pushes, buffer targets, harvests) and the CLP authority (book shapes, inventory plumbing, fee posts). Neither can move user funds to arbitrary destinations. The trust assumptions that remain - the oracle relay on devnet, settlement cranking - are documented per-flow, with the mainnet hardening path (Pyth-direct settlement reads) flagged in [the trade flow](/flows/trade).

## Running one

See [Running the keeper](/keeper/running) for environment variables, kill switches, and tunables. The defaults are the live devnet configuration.