Admin Operations

Instructions below use the Anchor program.methods pattern. There are two authority roles:

• Alpha, Neutral, and Defense: the fund authority signer on pause_fund, transfer_authority, and update_fund_params.

• Keystone Core: the portfolio authority signer on pause_portfolio, toggle_emergency, and update_params.

Fee collection: On Alpha, Neutral, and Defense, collect_fees is permissionless (any signer); fees mint to the fund admin’s configured recipient ATA.

User-facing (not admin): migrate_portfolio on Core is called by the user moving their own ksCORE between portfolio IDs; it is not a portfolio-authority admin op.

---

Keystone Core

Program: keystone_core. Replace portfolioId, account PDAs, and coreProgram with your deployment values.

Pause / unpause portfolio

await coreProgram.methods
  .pausePortfolio(portfolioId, true) // true = pause, false = unpause
  .accounts({
    portfolioState,
    authority: portfolioAuthority.publicKey,
  })
  .signers([portfolioAuthority])
  .rpc();

Emergency de-risk (target override)

Shifts allocation targets toward defense-heavy weights. Not the same as pause.

await coreProgram.methods
  .toggleEmergency(portfolioId, true) // true = activate, false = deactivate
  .accounts({
    portfolioState,
    authority: portfolioAuthority.publicKey,
  })
  .signers([portfolioAuthority])
  .rpc();

Update portfolio parameters

Pass null for each optional field you do not want to change. Order and types must match programs/keystone-core/src/lib.rs → update_params.

await coreProgram.methods
  .updateParams(
    portfolioId,
    null, // alpha_target_bps
    null, // neutral_target_bps
    null, // defense_target_bps
    null, // deposit_cap
    null, // rebalance_interval
    null, // drift_threshold_bps
    null, // min_rebalance_usdc
  )
  .accounts({
    portfolioState,
    authority: portfolioAuthority.publicKey,
  })
  .signers([portfolioAuthority])
  .rpc();

---

Alpha, Neutral, and Defense

The following examples use program as the Anchor client for keystone_alpha, keystone_neutral, or keystone_defense as appropriate.

Close Fund

Closes the fund_state PDA and reclaims rent to authority. Admin-only. Uses raw byte validation at data[16..48] to read the stored authority without Anchor deserialization — safe to call even when the struct layout is stale after a program upgrade.

Note: close_fund only closes fund_state. The share_mint PDA is permanent and survives. After closing, initialize_fund can re-create the fund state — share_mint will be reused via init_if_needed.

// Works for Alpha, Neutral, and Defense — identical interface across all three
await program.methods
  .closeFund(new BN(fundId))
  .accounts({
    fundState,
    authority: admin.publicKey,
  })
  .signers([admin])
  .rpc();

To close all funds in one pass, use scripts/devnet/close-funds.ts:

# Close all fund_ids 1, 2, 3 across all three programs
FUND_IDS=1,2,3 PROGRAMS=alpha,neutral,defense npx tsx scripts/devnet/close-funds.ts

# Or target a specific program / fund_id
PROGRAMS=neutral FUND_IDS=2 npx tsx scripts/devnet/close-funds.ts

IDL account key: the main state PDA is passed as fundState in .accounts({ ... }) (Rust field fund_state). Fetch/decoding still uses the generated namespaces fundState, basisFundState, and defenseFundState from the account struct types FundState, BasisFundState, and DefenseFundState.

Pause / Unpause

await program.methods
  .pauseFund(fundId, true) // true = pause, false = unpause
  .accounts({ fundState: fundState, authority: admin.publicKey })
  .rpc();

Transfer Authority

await program.methods
  .transferAuthority(fundId)
  .accounts({
    fundState: fundState,
    currentAuthority: admin.publicKey,
    newAuthority: multisig.publicKey,
  })
  .rpc();

Irreversible. Recommended: single keypair → 3-of-5 multisig at $100k TVL → 5-of-7 at $1M+.

Collect fees (permissionless on funds)

Anyone may submit the transaction; fee shares mint to the fund’s fee-recipient ATA. Pass the correct fundState (state PDA), shareMint, fundAuthority, authorityShares (admin ATA for the share mint), solOracle (Neutral), and caller as required by each program’s IDL.

await program.methods
  .collectFees(fundId)
  .accounts({
    fundState,
    shareMint,
    fundAuthority,
    // Neutral / Defense: fundUsdc; Alpha: varies — use generated IDL types
    authorityShares: adminShareAtaForShareMint,
    solOracle, // Neutral (and others if required by IDL)
    caller: feeCranker.publicKey,
    tokenProgram: TOKEN_PROGRAM_ID,
  })
  .signers([feeCranker])
  .rpc();

---

Keystone Alpha Fund: Lending

Enable Lending

await program.methods
  .enableLending(fundId, true)
  .accounts({
    fundState: fundState,
    marginfiGroup,
    marginfiAccount,
    authority: admin.publicKey,
  })
  .rpc();

Deploy / Withdraw from Lending

// Deploy (amount 0 = deploy max)
await program.methods
  .deployToLending(fundId, amount, reserveBps)
  .accounts({
    fundState: fundState,
    caller,
    fundAuthority: fundAuthority,
    fundUsdc: fundUsdc,
    marginfiProgram,
    marginfiGroup,
    marginfiAccount,
    solBank,
    bankLiquidityFund,
    tokenProgram,
  })
  .rpc();

// Withdraw (amount 0 = withdraw all, admin only)
await program.methods
  .withdrawFromLending(fundId, amount)
  .accounts({
    fundState: fundState,
    caller,
    fundAuthority: fundAuthority,
    fundUsdc: fundUsdc,
    marginfiProgram,
    marginfiGroup,
    marginfiAccount,
    solBank,
    bankLiquidityFund,
    bankLiquidityFundAuthority,
    tokenProgram,
  })
  .rpc();

Update Alpha Fund Params

Pass null for unchanged parameters. Match order to programs/keystone-alpha/src/lib.rs / keystone_alpha.json.

await program.methods
  .updateFundParams(
    new BN(fundId),
    null, // ath_price
    null, // low_pct_of_ath
    null, // high_pct_of_ath
    null, // sol_min_bps
    null, // sol_max_bps
    null, // max_step_bps
    null, // min_rebalance_interval
    null, // management_fee_bps
    null, // deposit_cap
    null, // performance_fee_bps
    null, // rebalancing_fee_bps
    null, // vol_low_threshold_bps
    null, // vol_high_threshold_bps
    null, // drawdown_moderate_bps
    null, // drawdown_severe_bps
    null, // step_mult_normal_bps
    null, // step_mult_low_vol_high_bps
    null, // step_mult_high_vol_dd_bps
    null, // step_mult_bear_bps
    null, // compress_max_low_vol_bps
    null, // compress_max_bear_bps
    null, // compress_min_raise_bear_bps
    null, // cb_drawdown_trigger_bps
    null, // cb_vol_trigger_bps
    null, // cb_step_mult_bps
    null, // cb_skip_vol_bps
    null, // min_rebalance_drift_bps
    null, // regime_hysteresis_obs
    null, // nav_drawdown_guard_bps
    null, // nav_guard_min_sol_bps
    null, // emergency_rebalance_enabled
    null, // auto_lending_enabled
    null, // lending_reserve_bps
  )
  .accounts({ fundState: fundState, authority: admin.publicKey })
  .rpc();

---

Keystone Neutral Fund

Jupiter Perps addresses on BasisFundState

BasisFundState stores jupiter_pool, jupiter_sol_custody, and jupiter_collateral_custody. Every deploy/close/settle instruction checks that the accounts you pass match these on-chain pubkeys.

Important: update_fund_params in the current program does not accept Jupiter pool or custody pubkeys — only the optional fields listed in programs/keystone-neutral/src/lib.rs (through swap_to_jitosol_when_parking). If your deployment needs to set or rotate Jupiter routing keys, use whatever process your deployment uses to write correct values into BasisFundState (e.g. program upgrade, init path, or a future admin instruction). Do not follow outdated examples that pass Jupiter pubkeys as extra arguments to updateFundParams; they will not match the IDL.

Update Neutral Fund Params

Pass null for unchanged parameters. Argument order must match keystone_neutral.json / update_fund_params in programs/keystone-neutral/src/lib.rs (26 optionals ending in swap_to_jitosol_when_parking).

await program.methods
  .updateFundParams(
    new BN(fundId),
    null, // management_fee_bps
    null, // performance_fee_bps
    null, // deposit_cap
    null, // min_settle_interval
    null, // min_health_factor_bps
    null, // target_health_factor_bps
    null, // max_position_bps
    null, // negative_funding_threshold
    null, // max_negative_funding_periods
    null, // min_deploy_amount
    null, // max_swap_slippage_bps
    null, // auto_deploy_enabled
    null, // auto_close_on_negative_funding
    null, // vol_low_threshold_bps
    null, // vol_high_threshold_bps
    null, // size_mult_low_vol_bps
    null, // size_mult_normal_bps
    null, // size_mult_high_vol_bps
    null, // size_mult_extreme_vol_bps
    null, // min_hedge_drift_bps
    null, // auto_settle_enabled
    null, // max_funding_loss_per_period_bps
    null, // position_reduction_step_bps
    null, // nav_drawdown_guard_bps (0 = disabled)
    null, // min_funding_rate_to_deploy (0 = no floor)
    null, // swap_to_jitosol_when_parking
  )
  .accounts({ fundState: fundState, authority: admin.publicKey })
  .rpc();

Enable Self-Healing + Positive-APY Guards

await program.methods
  .updateFundParams(
    new BN(fundId),
    null,
    null,
    null,
    null,
    null,
    null,
    null,
    new BN(-50), // negative_funding_threshold
    2, // max_negative_funding_periods
    null,
    null,
    null,
    true, // auto_close_on_negative_funding
    null,
    null,
    null,
    null,
    null,
    null,
    null,
    null,
    null,
    30, // max_funding_loss_per_period_bps
    null,
    500, // nav_drawdown_guard_bps (5%)
    new BN(100), // min_funding_rate_to_deploy
    null, // swap_to_jitosol_when_parking
  )
  .accounts({ fundState: fundState, authority: admin.publicKey })
  .rpc();

After this, the keeper can drive the automated cycle (settle_funding, emergency_close_position, deploy_reverse, close_reverse, deploy_capital, parking instructions) according to on-chain gates.

Idle USDC in Marginfi: There is no separate unpark_capital instruction. When usdc_in_lending > 0, deploy_capital withdraws from Marginfi in the same transaction before redeploying (when Marginfi accounts are supplied).

Manual Position Management

// Open (admin only) — deposits USDC collateral to Jupiter Perps + opens short
await program.methods
  .openPosition(fundId, collateralUsdc, sizeUsd, acceptablePrice)
  .accounts({
    fundState,
    fundAuthority,
    fundUsdc,
    shareMint,
    solOracle,
    jupiterPerpProgram,
    // Plus Jupiter Perps accounts per IDL (pool, custodies, position, etc.)
    caller: admin.publicKey,
    tokenProgram: TOKEN_PROGRAM_ID,
    systemProgram: SystemProgram.programId,
  })
  .signers([admin])
  .rpc();

// Close (admin or permissionless when auto_close conditions met)
await program.methods
  .closePosition(fundId, acceptablePrice)
  .accounts({
    fundState,
    fundAuthority,
    fundUsdc,
    solOracle,
    jupiterPerpProgram,
    caller,
    tokenProgram: TOKEN_PROGRAM_ID,
  })
  .rpc();

---

Emergency Response

1. Pause — pauseFund / pausePortfolio with paused: true

2. Assess — on-chain state, oracles, integrated protocols

3. Fix — parameter updates or program upgrade

4. Unpause — when safe

---

Troubleshooting

Fund won’t rebalance (Alpha): Check paused, cooldown, circuit breaker, oracle, gas.

Position won’t close (Neutral): Confirm auto_close_on_negative_funding and funding history. Use close_position for an immediate admin close when appropriate.

NAV drawdown guard not triggering: nav_drawdown_guard_bps > 0; guard is evaluated in settle_funding.

deploy_reverse / close_reverse failing: Check position flags, Kamino setup (enable_reverse_basis), balances, and remaining accounts per IDL.

Jupiter account mismatch: On-chain jupiter_pool / custodies in BasisFundState must match the accounts you pass to deploy/close/settle instructions.