Trust classes

Know what a host can see.

Pick a class up front. Declare what the host is left holding. Get placed where that's allowed. CARLOS doesn't choose your posture; it makes you say it out loud.

Where an LLM has written in slop-voice, it is marked with a 🤖That's factor X.

The six classes

Ordered S ≤ A < B < C. The A variants are flavours of A, not grades.

S Stateless Holds no user data at all: a static file tree, or a binary with no persistent user state. There is nothing for a host to see. carlosframework.com · rastrillo.org · carloku.com
A1 Host-blind Keys live on the user's own devices; the instance never holds one that opens user content. The only residue is transport shape: who connects when, object sizes, timing. No content-derived identifiers at rest. Slopbox — padded fixed-size blobs, encrypted filenames
A2 Host-blind, declared residue Content sealed as in A1, plus an enumerated application-level residue that the app publishes in the open. An undeclared plaintext surface is a class violation regardless of intent, because the declaration is what makes the class auditable. Keymail — routing headers · Kass — log timestamps · Eleven — thread membership · Woodstar
A/pub Public by design A host-blind app whose plaintext surfaces are public on purpose, listed one by one. A box hosting public posts learns nothing a browser would not. Woodstar — public posts; blobs and direct messages stay sealed
B Sealed single-tenant Sealed everywhere it rests outside the live process: parked database, replica, blobs. The running instance holds a key in memory while awake, because unattended automation requires plaintext. A cold artifact leak yields nothing; a live-host compromise yields data. an internal finance ledger, one instance per team
C Host-sighted Plaintext at rest as a deliberate, recorded decision: support visibility, SQL over personal data, payments. Confidentiality rests on operator policy and tenant isolation rather than on mathematics, and stated plainly rather than implied quietly. Tito — the defining example

Placement follows the class

Nothing that sees gets placed where nobody is accountable for seeing.

Hosts rank by who controls the box. A workload runs only where the host is trusted enough for its class: C never lands on a shared pool; A can go anywhere, because there's nothing on it to see.

The class belongs to a workload, not a product. An E2EE app with an automation sidecar is two answers: the app is A, the sidecar is B, and each is placed on its own terms.

A declaration names the workload, its class, every plaintext surface, and where the keys live. Then the CARLOS test: publish the database and see what leaks. A leaks its declared residue and nothing more. B's cold copy leaks nothing. C leaks the data, and said so up front.

Examples show classes, not adoption. Nothing is certified against an external standard yet. What auditors get is a declaration they can test, not a paragraph they have to believe.

See who declares what

Every app in the gallery carries its class, or admits it hasn't published one.

Browse the apps The Secure letter