The six letters
Cost-efficient, Available, Replicated, Lightweight, Open, Secure. Six promises, and under each one the machinery that produces it. If a claim here has no machinery under it, it should not be on the page.
Where an LLM has written in slop-voice, it is marked with a 🤖That's factor X.
Six outcomes, each with the mechanism that produces it. If a claim here has no machinery under it, it should not be on the page.
Conventional deployments buy capacity for the peak and pay for it around the clock. A CARLOS fleet is sized to concurrent use, not to how many accounts exist: idle tenants hibernate to a bucket, and a box carries as many sleeping tenants as it has disk to list them.
mechanism: hibernate to object storage · wake on the request that needs it · metered in cpu-core-hours, GB-hours and instance-hours, so the bill follows what actually ran
The cheapest watt is the one never drawn. Because an idle app runs no process at all (not a scaled-down container, not a warm pool, nothing), the energy floor under a CARLOS deployment is set by concurrent usage rather than by headcount. Fewer boxes for the same product is the whole of the mechanism, and it is measurable on your own bill.
mechanism: no process while idle · fleet sized to concurrent use · one static binary with no runtime to keep warm
This one is specific and testable rather than reassuring: publish the entire database and see what leaks. Built this way the answer is metadata (who talked to whom, and when) and never content. The residue is real and worth stating plainly; the point of the architecture is that it is all that is left.
mechanism: the server stores ciphertext plus key material it cannot open · private keys live in browsers and nowhere else
One person's process serves one person's data. A panic, a runaway query or a memory leak in someone's request path takes down their process; the next request starts it again, and nobody else notices. Underneath, routes carry several health-checked upstreams and box state snapshots to object storage every five minutes.
mechanism: blast radius of one · multi-upstream routes with in-request retry · five-minute snapshots · auto-recovery alarms on every instance
Centralised pieces are allowed (push relays, discovery, backup stores) on one condition: they must be glue. Thin, blind, replaceable. When the central piece falls to a subpoena, a seizure or a hack, the people inside lose some convenience and never a word they said.
mechanism: membership enforced by cryptography rather than a permission check · invite secrets ride in the URL fragment, which browsers never send to a server
Data residency stops being a contract clause and becomes a placement decision. The deployment is yours: your cloud account, your bucket, your regions. An app can be pinned to a region because the fleet is a list of boxes you own, and a workload is only ever placed on a host trusted enough to hold what it holds.
mechanism: one binary, a bucket and DNS is the entire dependency list · placement gated on declared trust class, not on capacity alone
Not running when nobody is using it. Most software is used a few hours a week and billed for a hundred and sixty-eight.
An instance with no traffic stops, and its database leaves the box for a bucket. What remains is a few objects, no process and no memory.
Nothing polls to keep an app alive. A sweep retires the idle; work still in flight when an instance winds down lands before it goes.
Sleeping tenants are entries in a list, not processes. Capacity is bought for the people using the product right now.
Usage is accrued per account in cpu-core-hours, GB-hours and instance-hours, and reconciled against the cloud bill — so the number you are charged names the machinery that produced it.
Always there when someone knocks. Availability is continuous even when execution isn't.
The caller does not get an error and does not get a cold-start page. The connection is held while the instance comes back, and then it is answered.
The edge round-robins across live upstreams and retries within the same request when one refuses a connection, so losing a box is not losing a route.
The registry — routes, instances, the shape of the deployment — is written to object storage on a timer, so a replacement box can be brought up from the bucket rather than from memory.
Auto-recovery alarms are armed on every box in the fleet, in each box's own region.
The box is disposable; the data is not. Losing a server costs a restart, not a history.
Replication is not a nightly job that might have run. It is continuous, and it starts when the database does.
An idle database leaves for the bucket under a single-writer lease where the lock and the manifest are the same object — so a takeover can never read a torn state.
The digest covers every column that describes a route, so a snapshot cannot silently drop the part of the deployment you would need on the way back up.
Because every wake from hibernation already pulls a database out of a bucket, the restore path is exercised continuously rather than rehearsed once a year.
The artifact is small because the rules make it hard to grow. Small enough that one person can read all of it.
Pure Go, no cgo, SQLite linked into the process, and nothing else to install alongside it: no container, no runtime, no bundler. Copy it to a box and run it.
Hand-written ES modules are served directly. What you read in the repository is what runs in the browser.
A hard line-count cap per module, checked by a test that fails the build. The cap only ever ratchets down.
Deploying new code over an old database is always safe, which is what makes a thousand independently-versioned instances tractable in the first place.
The dependency list is short enough to read in a sitting, and every entry on it had to argue its way in.
Open is not a licence badge. It is whether the person who depends on the software can actually run it, with no vendor in the loop.
There is no license server, no phone-home, and no essential component that exists only in somebody else's account. Nothing about running it yourself is a degraded mode.
Rastrillo, the Claude Code skill and the source of this site are public repositories you can read right now. The platform's own repository is not public yet. That is worth stating on the page that claims every other claim is checkable.
That is not a summary of the dependency list. That is the dependency list.
Handing someone the binary hands them the product, not a client for it.
Push relays, discovery and backup stores may exist on one condition: thin, blind and replaceable. When the central piece falls, the people inside lose convenience, never content.
Last in the acronym, first in the architecture. Every other letter is shaped around this one.
It stores opaque bytes plus key material wrapped to each member's public key. It never sees plaintext and never receives a usable private key.
There is no copy on the server to seize, subpoena or leak, because there was never a path by which one could arrive.
Access is decided by whether content was sealed to your key, not by a permission check somebody can forget to write.
A one-time secret after the # is never transmitted to the server by any browser, so an invite link is not a server-side credential.
The framework does not pick your posture. It makes you name it, publish it, and accept where that lets the workload run.
CARLOS does not choose your security posture. It makes you declare it, in one published letter, and refuses to place a workload on a host not trusted enough to hold it. The trust classes, S to C →
The framework is the intersection, not the union. A shape earns its place by appearing more than once.
CARLOS was extracted rather than invented. Five systems arrived at the same architecture independently — a messenger, an email service, a social network, a file store and a training app — and The Eleven Factors had already set out what small, sovereign software should promise the people who use it. CARLOS is the shape that keeps those promises in code.
Extraction is real and it is unfinished, which is worth saying on a homepage rather than in a footnote. Rastrillo, the web framework that gives a CARLOS app its shape, is adoptable today at v0.6.0: filesystem routing, a manifest system, a component vocabulary, fingerprinted assets, a development watch loop, and a bootstrap that speaks the platform's activation contract. The deployment substrate underneath it runs the fleet on the apps page. Other pieces still live inside the applications they were pulled from.
The conventions travel ahead of the code: the principles, the stack and the infrastructure shape are distilled into a Claude Code skill, so a new system can start on the model today.
The apps the letters were extracted from, and the ones adopting them.