Keeper

The keeper runs one production replica to preserve single-executor behavior.

Testnet responsibilities

• connect and reconnect to Pyth Hermes
• validate and persist accepted market observations
• sign short-lived EIP-712 reports
• serve latest prices, SSE, and on-demand reports to authenticated services
• update funding
• inspect affected open positions for liquidation
• evaluate TP/SL and conditional orders
• execute verified delegated intents
• simulate, submit, await receipts, and persist outcomes

Reactive and recovery loops

Market updates trigger a fast affected-market scan, configured near one second. A slower full scan recovers work after stream disconnects, process restarts, or missed notifications.

Deduplication

The keeper records action identity and transaction lifecycle so the same conditional, liquidation, session nonce, or queue item is not submitted concurrently. Contract state remains the final duplicate defense.

Authentication

The keeper's transaction and report routes require a shared server-side token where configured. The public browser reaches them only through BFF routes that perform request validation. Keeper keys and tokens stay on Railway.

Fail-closed behavior

The keeper skips or rejects actions when:

• price is missing, stale, non-positive, or too uncertain
• a real-world market is closed
• a session is expired, revoked, exhausted, or mismatched
• a condition is not triggered
• the position is not actionable
• simulation fails
• receipt state is uncertain

Mainnet mode

The alternative runtime consumes official Chainlink Data Streams WebSocket reports, with a just-in-time REST fallback. It does not allow fallback to the trusted testnet signer.