XiliuxSoftware that has to hold up, in Rust
I’m Juan Carlos Isaza. I build post-quantum cryptography and Rust systems for work where being wrong is expensive — and I publish the measurements, including the ones that make me look bad.
Evidence, not adjectives
Anyone can write “rigorous” on a profile. These are three things I measured on my own code and wrote up in full, defect included:
My detector was blind across 1,029 of 6,309 lines — and its three tests stayed green
A bench made only of negatives passes with the right rule and with a blind one: a clean file returns nothing either way. How to build the pair that tells them apart.
I said no data was leaving. On the first good run, two records left
A zero is indistinguishable from a path that never ran. What a positive control is, and why you look for it after the first success, not after the failures.
Quipu — hybrid X25519 + ML-KEM-1024 and Ed25519 + ML-DSA-87
Post-quantum encryption in pure Rust, CNSA 2.0 profile, running in production. AGPL-3.0: the complete source is delivered signed, by email, to anyone who asks.
What I build
Post-quantum cryptography
Hybrid key exchange and signatures (X25519 + ML-KEM-1024, Ed25519 + ML-DSA-87) under the CNSA 2.0 profile, in pure Rust. Migration paths that stay compatible with what you already have deployed.
Systems that ship as one binary
axum + SQLx + SQLite, server-rendered UI, no Node build step. One executable and one database file per install: it runs offline, on the client’s own machine, and it does not rot between visits.
Regulated environments
Software whose failure has a legal cost, not just a technical one: statutory reporting deadlines, audit trails that survive scrutiny, and clinical records handled under Colombia’s Law 1581 as special-category data.
AI integration
LLMs (Claude, GPT, Gemini) wired into a product that already exists, with the boring part done: cost ceilings, retries, failure paths, and an evaluation that does not flatter itself.
How I work
Scope, timeline and a fixed price agreed before anything starts. You talk to the person who writes the code — there is no account manager in between. Delivery includes the source, documentation and initial support.
Questions I get asked
Do you take clients outside Colombia?
Yes. The work is remote and the correspondence can be in English or Spanish. Scope, timeline and a fixed price are agreed before anything starts, and you talk to the person who writes the code — there is no account manager in between.
Do I get the source code?
Yes. Client work is delivered with its source. Quipu is AGPL-3.0 and its complete source is delivered on request, signed with Ed25519 + ML-DSA-87, with no NDA and no cost.
Why is the code no longer on GitHub, crates.io, PyPI or npm?
It was withdrawn in August 2026, on purpose. The work is security software — post-quantum cryptography and clinical records under Colombian data-protection law — and the 2026 registry supply-chain attacks made a public package a liability rather than a shop window. The source did not disappear: it is delivered signed, by email, to whoever asks for it.