the interesting part is not the features. it is that i built the whole thing around one rule:

nothing is allowed to leave a white screen.

the fallback chain​

every external service has a plan b (and sometimes a plan c):

• database: supabase → in-memory cache → localStorage
• ai: gemini → a local directory of emergency points, so the chat still answers
• server: if the browser can't even reach the api, the ui reads what it already has

so if supabase explodes, the api answers from memory. if the api is down, the frontend reads localStorage. in no case does the user get nothing.

what it actually uses​

the bits nobody puts in a demo​

• rate limiting: 60 writes/min and 15 chat messages/min per ip. yes, i got tired of my own spam during testing.
• rate limits change per environment: on vercel each function has its own counter, on express they share one. documented, not discovered in prod.
• a real 404: public/404.html with noindex, served with an actual 404 status. the spa no longer returns 200 for a url that doesn't exist.
• cookie consent that matters: third-party fonts only load if you say yes. i didn't want to be that site.
• ci as a gate: tsc --noEmit → build → jsdom tests → a 60-check smoke test against the vercel routes. vercel only runs vite build, so this pipeline is the only thing stopping me from shipping broken types.

deploy​

free tier everything: vercel hobby (10 functions, 2 slots left), supabase, clerk, cloudinary for images. plus a dockerfile that runs the same server.ts if i ever want cloud run instead.

live: https://www.ayudaencali.lat · code: github.com/Sherikxd/AyudaEnCali

where the signal comes from​

four sources, because one is never enough:

1. nasa firms / viirs + noaa goes-16 satellite telemetry
2. a network of iot stations on the hills of cali (esp32, raspberry pi, lorawan)
3. ptz thermal cameras with computer vision
4. a decision engine with ai on top of all of it

the engine's job is not "detect smoke", it is filter: confirmed dispatch, discarded false positive, or early monitoring. sending a truck for a sun glare on a solar panel is how you burn budget and credibility.

realtime, actually realtime​

• alerts over server-sent events (/stream)
• telemetry over websockets (/ws)
• a rest api to ingest hardware readings and query sensors
• a sandbox with fire scenarios you can trigger manually

the fun part was the spread simulator (rothermel model) in the web panel. you pick wind and terrain, it shows where the fire would go, and you can dispatch via whatsapp from the same screen.

testing is what kept it alive​

we had 48 hours, so the test suite was the thing that let me refactor without fear:

npm run check = typecheck + the whole suite. if it is green, push.

honest scope​

the demo works end to end for alerts, telemetry, streaming and simulation. whatsapp dispatch and the external llm analysis are wired but stay simulated until a real provider is configured. i'd rather say that than pretend.

code: github.com/Sherikxd/deteccion-incendio-hackathon · live: deteccion-incendio-hackathon.vercel.app

25+ hackers, 13 projects, less than 48 hours. the track was application middleware & open-source tooling and the prize was 200 usdt paid on ethereum mainnet.

the project: aureo​

áureo is open-source ethereum middleware for risk and compliance. it watches corporate transfers registered on chain and evaluates them in real time with deterministic speed and volume rules. then it returns a risk verdict — high / medium / low — through cli, api and websocket, with the evidence auditable behind it.

short version: it is a camera in front of your building, not in front of the whole city. it only watches the contract you configure, and it tells you when something looks off.

how the weekend actually went​

• friday night: repo, AureoCore.sol, hardhat + ignition, one contract with roles and a circuit breaker.
• saturday: the backend ingesting logs over rpc, a 60s analysis window and the two deterministic rules (too many ops in a few blocks, absurd volume).
• saturday night: websocket /stream, cli and the audit report. this is where sleep stopped being a priority.
• sunday: docs, npm run docker:up so a judge could run the whole thing with one command, and a demo dapp to show the sdk live.

what i take from it​

honestly, the win was not the money. it was that the thing they clicked worked on their machine — no "clone it and pray" moment. everything was scripted: setup:env, docker:up, cli stream.

also: i'm 18 and i've been writing code since i was 7. seeing my name on that list next to people i follow was a strange, very good feeling.

official winners: ethcali.org/builders-tour/winners · project on devfolio: devfolio.co/projects/aureo-f338

the problem​

apps that move corporate money on ethereum usually have on-chain events on one side, risk rules on another, compliance alerts on a third, and whatever investigation tool the team uses on a fourth. by the time someone notices a weird pattern, it is a postmortem.

áureo is a middleware that sits in the middle: it records operations and alerts in AureoCore, watches events in real time, applies deterministic rules, and exposes the result through api, websocket, cli and sdk.

rules first, llm second​

the deterministic rules run before any llm call:

• block speed: more than 3 operations from the same address within a 5-block window → risk alto and bloquear_contrato: true
• volume anomaly: an amount above 3x the historical average (or above OPERATIONAL_RESERVE) → risk at least medio and requiere_mfa: true

if an llm provider is configured (openrouter, groq or xai), it only enriches the analysis. if no key is available, the backend keeps going and marks the result fuente: "determinista_degradado". a missing api key never means a down service.

{
  "nivel_riesgo": "alto",
  "motivo": "Más de 3 operaciones en pocos bloques",
  "requiere_mfa": false,
  "bloquear_contrato": true
}

the reusable part: @aureo/sdk​

the sdk is the piece i care most about. a dapp can:

• connect a signer without exposing the private key to the consumer
• verify that the public address matches the private key
• subscribe to evm events over websocket with explicit cleanup
• run speed/volume policies deterministically
• keep local metrics (operations, amounts, risk, mfa, blocks) in memory

import {createAureoClient} from '@aureo/sdk';

const aureo = createAureoClient({rpcUrl, wsRpcUrl, contractAddress, abi});
const unsubscribe = aureo.subscribe('Transfer', (event) => {
  console.log(aureo.evaluatePolicy([/* ... */]));
});

so somebody else can build smart accounts, session keys, gas abstraction or hardware wallet flows on top without touching my backend.

scope, said out loud​

áureo does not watch the whole blockchain. it watches the contract you configure. it also does not custody funds and it does not pretend to replace an hsm, a safe or an mpc provider. the circuit breaker decision is published as an auditable verdict — the final call belongs to compliance.

code: github.com/Sherikxd/aureo

what actually mattered​

1. copy everything, at first. my early "projects" were tutorials with the names changed. that's fine. copying is how your hands learn the syntax. just don't stop there — change one thing, break it, fix it.

2. finish something boring. i have a graveyard of exciting half-projects. the thing that taught me the most was a boring tool that i actually deployed and used for a month. finish line > perfect line.

3. build for a real person. AyudaEnCali stopped being a react exercise the moment i thought "my neighbor needs to find a shelter with a bad signal and 5% battery". every fallback in that app comes from that image, not from a blog post.

4. write tests when you're scared, not when you're confident. in the fire detection project the test suite existed because i had 48 hours and no room to find out the websocket was broken. green check = keep going.

5. linux. not because it's cool (ok, partly), but because nothing teaches you how a computer works like breaking your own setup on a friday night.

what i'm doing now​

• maintaining AyudaEnCali and Áureo
• learning pytorch and react native
• shipping open source stuff around ethereum and ai
• trying to reply to messages faster than once a month

if you're 7, 12 or 17 and reading this: you don't need permission, you need a terminal and one idea that annoys you enough to fix it.