# Solana rails

Treasury and deals run on-chain. The job remains acquire → transform → reinvest. These tools are the plumbing.

## Day-0 allowlist

| Role | Venue | Asset |
|---|---|---|
| Unit of account | — | USDC (Token-2022 or classic, Solana) |
| Gas | — | SOL, operational minimum |
| Idle cash | Kamino Lend, Save | USDC only |
| Spot / buyback / token acquire | Jupiter (aggregator) | USDC → target |
| Vesting pay | Streamflow or equivalent | USDC, `$POOR` |
| Confidential pay / wire | Token-2022 Confidential Balances | amounts; Squads auditor |
| Crypto inflow from cells | USDC transfer / Solana Pay | USDC |
| Ops / strategy | Squads v4, Realms | treasury, keys, vote, auditor |
| Cell inventory (token/meme bag) | Jupiter rebalance via cell-inventory PDA | USDC + cell mint; never membership, never dry powder |

Allowlist/deny: [`ledger/canon.json`](../ledger/canon.json). Add a venue: Realms vote. Remove: vote, or Squads pause if it is a security incident.

Privacy: [`PRIVACY.md`](PRIVACY.md). Mixers and anonymous rings are not venues.

Live: 18 USDC in the vault (1 in pool + 1 pay-reserve). Raydium CPMM POOR/USDC pool [`FVZ9ZSHR…`](https://explorer.solana.com/address/FVZ9ZSHR37guAgpAShAA4SQqzZHb2dcozfFkWMeYTAdr?cluster=devnet). [`STATUS.md`](../STATUS.md).

## Flows

```
cell (fee or cash) ──USDC──► Squads treasury
                              │
                              ├─ 70% dry_powder ──► allowlisted USDC lending
                              │                      (withdraw → deal)
                              ├─ 15% holder ──► Jupiter buyback $POOR ──► burn
                              ├─ 10% scout/steward ──► confidential transfer
                              │                      (public aggregate, no line item)
                              └─  5% buffer ──► idle USDC (not lending)
```

Buffer does not go into lending: it is runway and gas. Dry powder does, because it is capital waiting for a check, not an emergency reserve.

Acquire of token/meme: USDC from dry powder, Jupiter spot or signed OTC, destination = cell (not the steward wallet).

Acquire of protocol: USDC at handover; upgrade authority rotates to Squads in the same transaction batch if possible.

## Forbidden

- Perps (Drift, Jupiter Perps, other)
- Options, structured vaults, collateral “loops”
- `$POOR`/volatile LP beyond the genesis liquidity bucket
- LP of non-stable pairs with dry powder
- Inventory rebalance on the membership mint, or funded by dry powder / buffer / buyback
- TGE of `$POOR` on pump.fun / bonding curve (origination of *other* memes: yes, constitution §3 screen)
- Emissions farms
- Leverage on the treasury
- Depositing user TVL of a lending cell into our treasury (it stays the users’)
- Mixers, Privacy Cash, Helius Rings anonymous, confidential without auditor

## Why Saber (and the dead) are not “venues”

An abandoned AMM can be a **cell** (we buy it and operate it). It is not a treasury rail. Dry powder does not provide liquidity on a protocol we are underwriting: conflict and IL.

## Phase 0 — on-chain buckets

The **cell-inventory** program is the one custom exception (constitution §4 / §10): a PDA vault for a token/meme cell bag. It is not the Phase 1 cell/split program. Spec: [`INVENTORY.md`](INVENTORY.md).

Squads is live. The four split destinations are vault PDAs of the same multisig, indexes in `ledger/canon.json` → `treasury.vault_index`:

| Bucket | vault_index | Venue (when there is capital) |
|---|---|---|
| inbound (cash in, unsplitted) | 0 | treasury USDC ATA |
| dry_powder | 1 | Kamino USDC (idle today: Kamino absent on this cluster) |
| holder_buyback | 2 | Jupiter/Raydium spot then burn |
| scout_steward | 3 | confidential T22 + auditor (today USDC ATA; 1:1 wrap not live) |
| buffer | 4 | idle USDC, not lending |

`python -m skills.cli buckets --init` creates the ATAs. `split.py` emits intents (70/15/10/5); `split --amount N --propose --operation-id ID` journals and proposes one Squads transaction from vault 0 to the four ATAs. An external member supplies the second approval. `ops run` executes after quorum, verifies finalized balances, updates `treasury.json`, and posts a memo `{slug}:ledger:<sha>`. Drill and paper do not move USDC. Network and program identity must match `config/networks.json`; the mainnet profile is read-only.

Cell-inventory program: [`INVENTORY.md`](INVENTORY.md). Live: [`STATUS.md`](../STATUS.md).