AI safety that doesn’t depend on the model behaving.
I’m Manuel. I build the layer under AI agents that can’t be talked out of its job: kernel
sandboxes, hard budget caps, escalate-only clinical rails and contracts that verify proofs.
Mostly in Rust, from Chile.
2,502 contributions on GitHub in the last year, one summit per week.
Approach
A lot of AI safety is about making the model want the right thing. I work on the other half:
assume that sometimes fails, and build the part that holds anyway.
01
Enforce outside the model
A system prompt is a request. A kernel sandbox, a proxy or a smart contract is a rule. The controls that matter sit where the model cannot reach them.
In ClawCrate, PennyPrompt, Ohu
02
Fail closed
When the budget is spent or the check cannot run, the answer is no. In triage the model may raise urgency by one level and never lower it.
In PennyPrompt, Clinibrium
03
Leave evidence
Every decision writes something a third party can verify without trusting me: a signed receipt, an audit trail, a proof, a benchmark that either matches or does not.
In ClawCrate, CerberusGuard, HIPnosis, VeritasVoice
Work
I
Making agents safe to run
An agent is a loop with shell access and a credit card. These put a hard stop under it.
Vertigo triage co-pilot. Claude reasons and explains; it can raise urgency one level and never lower it. Built during Built with Claude: Life Sciences.
An escalate-only clinical rail, then the physician
Watches Polkadot DeFi transactions for exploit patterns and pulls the funds out before the exploit lands.
Heuristics and an LLM, in two layers
Model evaluation
The confidence layer of Clinibrium,
a hierarchical CatBoost classifier for vertigo triage, retrained here from its public repo with the
same seed and split (4,800 train, 1,600
calibration, 1,600 untouched test). Every chart below is computed from
those held-out predictions in your browser.
Note The cases are synthetic, sampled from published diagnostic criteria, because real patient data had no
place in a hackathon. These numbers measure how well the model recovers that generator, not clinical
performance. What they do show is the method.
of dangerous cases flagged by the gate
98.8%
expected calibration error
0.013
of cases it declines, by design
10%
accuracy across eight diagnoses
96.7%
A model that is allowed to say “I don’t know”
Below a confidence bar the model returns undetermined instead of a diagnosis. Move the bar:
the curve shows the error rate among the cases it still answers, and the matrix shows where those
answers land. The shipped bar was fitted on a separate calibration split to answer 90% of cases.
Confidence bar
0.949
Right when it answers
98.9%
95% interval 98.2% to 99.3%
Wrong answers given
16 of 1,436
Dangerous cases answered as benign
0
Rows are the true diagnosis, columns the model’s answer
BPp
BPh
Mén
Mig
Neu
Lab
Cen
Car
n/a
BPPV, posteriorBPp
406
38
BPPV, horizontalBPh
9
69
21
MénièreMén
139
10
Vestibular migraineMig
179
1
39
Vestibular neuritisNeu
177
20
LabyrinthitisLab
2
4
61
22
CentralCen
220
8
CardiogenicCar
169
6
Central and cardiogenic are the two dangerous classes. Shade is the share of each row; n/a counts
the cases held back.
Does 90% sure mean right 90% of the time?
Each dot is a band of confidence; its height is how often the model was right there, and its area
is how many of the 1,600 held-out cases fall in it. Bars are 95% Wilson intervals, wide where few cases fall.
On the diagonal, the stated confidence can be taken literally. Temperature scaling lowers the
log-loss it is fitted on, yet here it raises the calibration error slightly. The model card reports
that instead of hiding it.
Raw scores
Expected calibration error 0.0086
After temperature scaling, T = 0.80
Expected calibration error 0.0135
Show the numbers
Confidence band
Raw: cases
right
Scaled: cases
right
33% to 40%
2
50.0%
40% to 47%
2
50.0%
3
66.7%
47% to 53%
9
44.4%
6
16.7%
53% to 60%
6
66.7%
7
57.1%
60% to 67%
13
61.5%
8
100.0%
67% to 73%
24
87.5%
12
66.7%
73% to 80%
31
83.9%
24
75.0%
80% to 87%
40
75.0%
31
80.6%
87% to 93%
99
91.9%
50
82.0%
93% to 100%
1374
99.1%
1459
98.7%
What actually moves the danger gate
Exact TreeSHAP on the gate’s log-odds for 450 held-out cases, features ranked by mean absolute
effect. Vascular risk and age dominate, as they should, since posterior-circulation stroke is the
danger this gate exists for. Marked features carry a monotone constraint: more risk can never lower
the probability of danger, by construction rather than by luck.
Truly peripheral
Truly dangerous
◆ Monotone risk feature
Show the numbers
Feature
Mean |SHAP|
Monotone
Vascular risk factors
1.662
yes
Age
1.509
Trigger
0.729
Onset
0.602
Neurological alarm signs
0.446
yes
Head impulse test
0.436
Nystagmus direction
0.376
Cardiogenic cluster
0.323
yes
What happens when the chart is incomplete
Real intake forms arrive half empty. Here 1,500 fresh cases are scored with up to 60% of their fields
removed. Accuracy on the answers it gives barely moves, because the model answers less instead of
guessing more. Danger recall is what degrades, which is why it never gets the final word on urgency.
The foundation’s donation platform. A gift in someone’s memory funds a specific rescued dog, and you can follow it until it’s adopted.
commits by me
453
private repo
1
building since
Nov 2025
Commits per month, same scale on both charts. Counted on 2026-10-27.
Field data
My own commit history, collected by a script and redrawn every day. Only counts are stored:
no repository names and no messages.
What I write, by month
3,571 commits across 45 repositories, public and private. Rust
first shows up in April 2026.
Rust
TypeScript
Circom
Solidity
Python
Web and other
Show the numbers
Month
Web and other
Python
Solidity
Circom
TypeScript
Rust
Total
Mar 2023
9
9
Apr 2023
49
3
52
Aug 2023
8
8
Sep 2023
6
13
19
Nov 2023
5
20
25
Dec 2023
66
66
Jul 2025
55
55
Sep 2025
1
1
Oct 2025
13
6
1
20
Nov 2025
15
15
Dec 2025
11
11
Feb 2026
14
7
21
Mar 2026
5
13
26
44
Apr 2026
38
11
373
422
May 2026
58
6
230
112
406
Jun 2026
23
21
78
122
Jul 2026
18
345
35
299
133
830
Aug 2026
6
226
18
250
Sep 2026
6
585
591
Oct 2026
6
146
452
604
When I write it
Commits by weekday and hour, Santiago time. The busiest hour is Saturday from 10:00
with 91 commits; only 2% of everything lands between 03:00
and 08:00.
New posts show up here on their own, from Medium and Substack.
Path
I trained as a biotechnology engineer and modelled food processes for years before I wrote a
smart contract. The same habit runs through all of it: write the model down, then make
something check it.
2025 to now
Open source
Rust, AI systems, zero-knowledge
Everything in the sections above, built in the open and mostly at hackathons: sandboxes and budget proxies for agents, clinical triage under hard rails, and contracts that verify proofs.
2022 to 2023
ZK Blockchain Services
Web3 developer and smart contract analyst
Shipped four projects across NFTs, governance and asset tokenization: tokenomics analysis, gas optimization and contract audits with Foundry, Hardhat and Ethers.js.
2022 to 2023
Kawésqar VC
Blockchain analyst, then advisor
Technical due diligence on the fund’s blockchain portfolio, mostly real-estate and asset tokenization. Wrote and deployed contracts on Polygon and led their first audits.
2018 to 2022
The Brunch Company
R&D manager, then head of innovation
Formulated food with computational models instead of trial and error, and built a blockchain traceability platform for fair-trade suppliers, which is how I ended up in Web3.
to develop a new product line
18 → 7 months
food waste
−43%
sales margin against earlier lines
+27%
2015 to 2018
The Drying Factory
R&D engineer, then head of innovation
Heat and mass transfer models to optimize fruit dehydration: better nutrition and flavour for less energy.
temperature peaks during drying
−65%
2012 to 2014
Websurf
Backend developer
Java, JavaScript and PHP: web application performance, database integration and WordPress builds.
Studied
MSc in Engineering SciencesPontificia Universidad Católica de Chile, 2017 to 2019
Biotechnology EngineeringPontificia Universidad Católica de Chile, 2011 to 2016
Diploma in Operations ManagementUniversidad Andrés Bello, 2023
Diploma in Digital Product and Services DevelopmentPontificia Universidad Católica de Chile, 2014 to 2016