CARLOS was not designed on a whiteboard. It was extracted: the same shapes kept appearing across a messenger, an email service, a social network, a file store and a training app, until it was obvious they were one thing being rebuilt five times. The Eleven Factors set out what small, sovereign software should promise the people who use it — CARLOS is the shape that keeps those promises in code.
The premise in one line: treat AI as a factory, not a feature. Spend an extravagant machine, at length, to produce a lean artifact — one static binary, no build step, no dependencies, no JavaScript that isn't hand-written. The compute is spent once at the factory. What ships is small forever.
What the letters buy you
Not six buzzwords — six testable promises.
Not running when nobody is using it. Instances spawn on the request that needs them and stop when idle. Most software is used a few hours a week and billed for a hundred and sixty-eight.
Always there when someone knocks. A request for a sleeping instance wakes it and waits a beat — availability is continuous even when execution isn't.
The box is disposable; the data is not. Every database streams to object storage from the first byte. Losing a server costs a restart, not a history.
One static binary with the database compiled in. No container, no runtime, no bundler, no build step. Small enough that one person can read all of it.
Source-available, forkable, and — the part that is usually missing — actually runnable by the person who depends on it. If you can't run it yourself, you don't own it.
Not "we take security seriously". A specific, falsifiable claim: the server holds only ciphertext it cannot open, so publishing the entire database leaks no content. Last in the acronym, first in the architecture — every other letter is shaped around this one.
The one rule
If the server is compromised, the attacker gets nothing.
The server stores and relays opaque ciphertext plus key material it cannot open. It never sees plaintext and never receives a usable private key — private keys live in browsers, and nowhere else. Content is sealed under keys wrapped to each member's public key, so membership is the boundary, enforced by cryptography rather than by a permission check someone can forget to write. Invite links carry a one-time secret in the URL #fragment, which browsers never send to the server.
The test is blunt, and it is the only one that counts: publish the entire database and see what leaks. Built this way, the answer is metadata — who talks to whom, and when — and never content. That residue is real, and worth stating plainly; the point of the architecture is that it is all that is left.
A blind router, one process per person
The front door owns identity. It knows nothing about what is behind it.
A CARLOS deployment is a small router and many instances. The router owns identity, sessions and routing, and knows nothing about what it routes to. An instance owns exactly one person's data and knows nothing about anyone else. They speak over a unix socket, and the socket is the boundary.
Blast radius of one
A panic, a runaway query, or a memory leak in one person's request path takes down one person's process. The next request starts it again. Nobody else notices.
Hibernation
Waking is lazy, sleeping is a sweep, stopping is a drain. A thousand idle people cost one goroutine, and work in flight when an instance winds down still lands.
Parking
An idle instance's database leaves the box for object storage and comes back on the next request — under a single-writer lease where the lock and the manifest are one object, so a takeover can never read a torn state.
Lean by construction
The artifact is small because the rules make it hard to grow.
- One static binary. Pure Go, no cgo, SQLite compiled in. Copy it to a box and run it. Adding a dependency is a decision, not a default.
- No build step, anywhere. Hand-written ES modules served directly. What you read in the repo is what runs in the browser.
- One file, one concern — enforced. A hard line-count cap per module, checked by a test that fails the build. The cap only ratchets down.
- Additive-only migrations. Deploying new code over an old database is always safe — which is what makes a thousand independently-versioned instances tractable.
- Integers for anything that matters. Money, weights, counts. A float never touches a value a person will be held to.
AI as the factory — and as a guest with a name tag
Extravagant machines, spent on lean artifacts.
CARLOS assumes AI wrote most of the code — that is where the productivity comes from — and is arranged so that this is safe rather than merely fast. The discipline is not in the typing; it is in guard rails that survive an author who never gets tired and never pushes back.
- Every session gets its own worktree and its own canary. Nobody builds in the main checkout, and shared hosts only ever run merged code.
- Review happens on something deployed, never on localhost. The gate after every deploy is a headless browser engine failing on any console error.
- Nothing lands untested. The line caps, the schema rules and the crypto invariants are assertions in a suite, not paragraphs in a document — because a paragraph does not fail a build.
Where AI appears in the product rather than the factory, it is opt-in, never required, always disclosed. An agent is an ordinary encrypted member whose device is an operator-run sidecar holding its own key: it decrypts exactly the conversations it was invited to and nothing else. Every path through the system works with the agent switched off.
Machine-authored text is marked 🤖 wherever it surfaces — including on this page.
Open and self-hostable are two different promises
If you can't run it yourself, you don't own it.
Publishing source is the easy half. The half that usually goes missing is that the thing is actually runnable by a person who is not the vendor: no proprietary control plane, no license server, no essential component that only exists in someone else's account. A CARLOS system is one binary and a directory. That is the whole dependency list — which means distribution is copying a file, and handing someone the binary is handing them the product, not a client for it.
Centralised pieces are allowed — push relays, discovery, backup stores — on one condition: they must be glue. Thin, blind, and replaceable. When the central piece falls to a subpoena, a seizure, or a hack, the people inside lose at most some convenience, never a word they said.
Extracted, not invented
The framework is the intersection, not the union — a shape earns its place by appearing more than once.
Eleven Messenger
End-to-end encrypted messaging with no logins and no passwords — just secret invite links. Where the model started.
Keymail
Email, but secure. Instances relay ciphertext and proofs; a compromised server holds nothing readable.
Woodstar
Pre-takeover Twitter on the same model. Source of the module-size discipline and the browser test harness.
Slopbox
An open, end-to-end-encrypted alternative to Dropbox.
Kass
A training app for personal trainers and the people they train. The first system built on CARLOS deliberately rather than by convergence.
Tito
Ticketing for conferences and events, moving onto CARLOS deliberately.
Extraction has started. Rastrillo, the web framework, is a real, adoptable v1 today — filesystem routing, a bootstrap that speaks the platform's activation contract, generated code you can read. The rest is still early: the router, the activator, the parking lease and the object store live inside the applications they were pulled from, extraction still the current work. If that honesty reads oddly on a homepage — good. It is the same trade the architecture makes everywhere: fewer claims, all of them checkable.
The conventions travel ahead of the code, though: the principles, the stack, and the infrastructure shape are distilled into a Claude Code skill, so a new system can start on the model today.