YouSign the exit once.
You sign it ahead of time: a full withdrawal to your own wallet, in three priority-fee variants. Durable nonces keep them valid until they're needed. Kelvara stores the signed bytes. It can send them, but it can't change a single one.
KelvaraThen Kelvara keeps watch.
It follows the accounts that can change your position: the program's upgrade authority, the Squads multisig behind it, its members, threshold and proposals, and unusual transaction activity. Every reading is stored with its slot and source. A reading that goes stale shows as unknown, never as safe.
Someone with the keysAt 3 a.m., a new admin takes the keys.
Since launch, the vault's code could only change with the team multisig's approval. Tonight that power moves to one wallet nobody announced, and one key can rewrite the vault. The timelock on this vault is 0: a change takes effect the moment it lands, so nobody gets a window to react. Kelvara sees the change once it is final on the blockchain, alerts you and steps in as your rules say.
Kelvara, while you sleepYour exit left before anyone woke up.
Kelvara sent the transaction you signed on Tuesday. Nobody had to approve anything at 3 a.m. When the new key pushes its upgrade at 03:20, your position is already empty. Your team wakes up to the evidence: the admin change, the exit and the block each one landed in.