Ops Monitor
Three layers in a fixed order over the operational surface: signers, governance, the served frontend, and the RPC feeds your contracts read.
The layer contract
Reflex owns every CRITICAL on plain event subscription and calldata decoding, with no model in the path. Instinct scores per-signer baselines. Cognition explains and correlates, grounded in evidence the layers beneath produced, and never sets severity. Inverting that order is the failure mode this design refuses.
Layer 1: 18 unconditional rules
Every id below is always-critical when it fires. No threshold, no model, no tuning: a Safe delegatecall is never benign, and that is a rule rather than an inference.
- SAFE_DELEGATECALL
- SAFE_OWNER_ADDED
- SAFE_OWNER_REMOVED
- SAFE_THRESHOLD_CHANGED
- SAFE_MODULE_ENABLED
- SAFE_MODULE_DISABLED
- SAFE_GUARD_CHANGED
- OWNERSHIP_TRANSFERRED
- PROXY_UPGRADED
- PROXY_ADMIN_CHANGED
- BEACON_UPGRADED
- ROLE_GRANTED
- ROLE_REVOKED
- ROLE_ADMIN_CHANGED
- TIMELOCK_DELAY_CHANGED
- TIMELOCK_DELAY_SET
- TIMELOCK_OP_CANCELLED
- TIMELOCK_TX_CANCELLED
Layer 2: six measured baseline features
Per-signer statistical baselines, in maths simple enough to replay line by line. A single deviating feature stays quiet; severity needs several to agree. There is no device fingerprinting in this product, and this list is the whole of it.
- time-of-day
- inter-signature-latency
- signing-velocity
- transaction-origin
- gas-price
- target-novelty
The served surface
Chain-agnostic, because DNS and JavaScript do not care which VM your contracts run on. This is the module that covers the CoW Swap class and the half of Bybit that made the calldata invisible.
- DNS_RECORDS_CHANGED
- JS_BUNDLE_CHANGED
- NEW_TLS_CERTIFICATE
RPC quorum
N independent providers are asked for the same block hash and the same key state reads, and divergence or staleness is an alert. The analysis is a pure function over provider readings, so it is tested without a network. This is the KelpDAO vector: the attacker changed what the contract was told.
- eth_call
- eth_getBalance
- eth_getStorageAt
Governance semantics
Every proposal is decoded to its calls and simulated on a forked node before the vote closes, then classified by what it EXECUTES rather than what its title claims.
- proxy-upgrade
- proxy-admin-change
- ownership-transfer
- role-grant
- timelock-delay-change
- collateral-or-market-registration
Where the boundary sits.
In the same type as everything above it, and paired with the control that covers it. This is the part your auditor reads first.
Put Ops Monitor on your perimeter.
Engine-level detail and the full catalogue are provisioned with your engagement, alongside the console your team works in.