carlos / movement Public

Download this file

1	# Product
2
3	<!-- impeccable:product-schema 1 -->
4
5	## Platform
6
7	web
8
9	## Users
10
11	**Primary: builders and contributors who are serious about changing how
12	software gets delivered.** Confirmed by Paul, 2026-09-01, as a deliberate
13	combination rather than a choice between two groups — people who would write
14	CARLOS apps or contribute to the framework, *and* people whose contribution is
15	the argument, the accountability, and the shared position rather than code.
16	The signup form asks how someone can help because the answer is genuinely
17	open.
18
19	Their situation: they have arrived from carlosframework.com or a link someone
20	sent, they are deciding whether this is a thing they want to be associated
21	with, and the decision is partly technical and partly ethical. They are being
22	asked to state a position on AI in public-ish terms before they are asked for
23	anything else.
24
25	**Secondary: Paul, as the only reader of what comes in.** He reads the
26	confirmed list and what people wrote about themselves, and decides what to do
27	with it. There is no second admin today.
28
29	## Product Purpose
30
31	Recruit people into the movement around CARLOS by collecting email addresses,
32	while sorting those people by their stance on AI — and doing the sorting
33	*before* the email, so the stance is a considered choice rather than a
34	checkbox after the fact.
35
36	Three positions are offered. All three can sign up and all three are invited
37	to say why they are interested and how they could help. Each gets a different,
38	honest response to the position they picked.
39
40	**The middle group is the target.** People who are curious about AI and
41	ethically sceptical of it are the ones this is built to find. The other two
42	paths exist so that the middle one means something: a form where everybody is
43	welcome equally sorts nobody.
44
45	Success is a confirmed list of people in that middle group who wrote something
46	substantive about themselves — not a large list.
47
48	## Positioning
49
50	**The sorting is the mechanism, and it costs conversions on purpose.** A
51	neighbouring signup page maximises the number of addresses it captures. This
52	one asks a question that will lose it people, tells two of the three groups
53	that they may not be the right fit, and treats a smaller and more considered
54	list as the better outcome. That trade is not a growth tactic with a
55	conscience bolted on; it is the product.
56
57	**CARLOS is the proof, and the ethics is the point — both, and the page says
58	so.** Ruled by Paul, 2026-09-01, against the alternative of leading with one
59	and treating the other as a filter. The claim is that infrastructure built a
60	particular way, by people who thought about why, produces different software —
61	and CARLOS is what that looks like when somebody actually builds it. The
62	tension between the two subjects is the message rather than a problem to be
63	resolved in favour of one.
64
65	## Operating Context
66
67	Someone arrives at a single page, reads a short statement about CARLOS with a
68	link out to carlosframework.com, and is offered three positions on AI. Picking
69	one takes them to that position's own page, where they read a response written
70	specifically to it and find the signup form beneath.
71
72	They give an email address and write something about why they are interested
73	and how they can help. They receive an email and click a link in it, and only
74	then are they on the list. Until they do, nothing about them is counted,
75	exported, or shown to anyone.
76
77	Paul reads the confirmed list and exports it. There is no team, no queue, and
78	no workflow beyond that.
79
80	## Capabilities and Constraints
81
82	**Built and settled** — the full record is
83	`docs/superpowers/specs/2026-09-01-movement-design.md`, whose §1 is the
84	settled-decisions table.
85
86	- One Go binary on the rastrillo framework (Go 1.25, rastrillo v0.23.0, chi,
87	GORM, cgo-free SQLite), server-rendered `html/template`, hand-written ES
88	modules, no bundler and no build step, no CDN. Deployed on CARLOS at
89	`movement.bdj.oncarlos.com`; no custom domain for v1.
90	- Double opt-in. An address is on the list only after a click from inside that
91	inbox, and confirmation happens on a POST so that mail-scanning gateways
92	cannot confirm somebody who never clicked.
93	- Anti-abuse: a proof of work bound to the submitted address, an HMAC-sealed
94	challenge with single-use nonces, a honeypot, and persisted mail budgets.
95	- Every response to the signup form is identical whether an address is
96	unknown, pending, or already confirmed. The page must never become a way to
97	check who is on the list.
98	- Admin is a magic link restricted to an allowlist, and shows confirmed rows
99	only. Pending rows are counted, not displayed.
100	- Transactional email is sent through the CARLOS platform's own facility. No
101	third-party provider.
102
103	**Deliberately not built yet**, each with the trigger that would change that:
104	pushing into mailing-list software (a CARLOS-family mailing list app exists);
105	self-service unsubscribe and deletion (before the first bulk send); changing
106	one's stance after confirming (someone asks).
107
108	**Open, and not to be invented:**
109
110	- **The three stance labels and their URL slugs.** Paul's drafts were "Never
111	AI", "AI curious, ethically skeptical", and "Love AI, never thought about
112	its ethical issues". The third is known to be broken as written: it asks
113	someone to volunteer that they have not thought about something, so the
114	people it describes will pick the middle option instead and pollute the one
115	signal this product exists to isolate. It needs a label that group would own
116	willingly, with the diagnosis living in Paul's reading of the bucket rather
117	than in the words on the button.
118	- **Whether "Movement" is the public name** or only the repository and app
119	name. Not asked, not assumed.
120
121	## Brand Commitments
122
123	- **CARLOS is real and its own positioning is fixed.** carlosframework.com
124	leads with "Lower your costs. Raise your security, resilience, privacy and
125	sovereignty", and describes per-person processes and encrypted databases,
126	with idle apps sleeping into a bucket and waking in milliseconds. A visitor
127	who follows the link meets that page, so nothing here may describe CARLOS in
128	terms it would contradict.
129	- **AI is a guest with a name tag.** The family's authorship doctrine, carried
130	in every sibling's AGENTS.md: 🤖 and 👨 markers, `Co-Authored-By` trailers,
131	published prompt and carbon ledgers, opt-in and disclosed. A page recruiting
132	people on the strength of their AI ethics has to hold itself to it visibly.
133	- **Honesty about what the software can and cannot see.** The house pattern is
134	to state the limits of a privacy claim rather than imply a stronger one. Here
135	the true and narrow claim is that the public surface reveals nothing about
136	who is on the list — not that the list is private from us. The server reads
137	every address.
138	- **House voice**, from the sibling repositories: declarative, specific,
139	unhedged, willing to name what was rejected and why. It does not sell.
140
141	## Evidence on Hand
142
143	- **CARLOS is running in production.** amadan.net itself is served by it, and
144	the console at console.carloku.com is live. This is a real platform, not a
145	proposal.
146	- **Sibling projects exist**: Sheets, Home and Pegamento, in the same family.
147	Most are specifications rather than shipped software today. Describing them
148	as available products would be false.
149	- **carlosframework.com** is quotable in full.
150
151	**Absences that must not be filled in.** There are no testimonials, no named
152	customers, no user counts, no benchmarks, no press, no funding story, and no
153	case studies. There is no existing community, forum or group to invite anyone
154	into. Nothing may imply that other people have already signed up, that the
155	list is large, or that anyone notable is on it.
156
157	**What a signup actually earns**, confirmed by Paul, 2026-09-01: occasional
158	updates on CARLOS. Not early access, not membership of anything, not a date.
159	The page may promise that and nothing more.
160
161	## Product Principles
162
163	1. **A smaller, more considered list beats a larger one.** Every design
164	decision that trades reach for signal is the correct one here, and the
165	sorting question is the first of them.
166	2. **Say the unflattering thing.** Two of the three paths tell people they may
167	not be the right fit. That is the product working, and the copy should not
168	soften it into a welcome.
169	3. **Promise only what exists.** Occasional updates about CARLOS is the whole
170	offer today. There is no community to join yet, and inventing one would be
171	the exact failure this audience is being selected for noticing.
172	4. **State limits rather than imply strength.** Where a privacy or security
173	claim is narrow, say how narrow. The audience is chosen for scepticism.
174	5. **Nobody is told a different story than anybody else.** The response to a
175	submission is the same regardless of who is asking, because the alternative
176	turns a recruitment page into a register of people's political positions.
177
178	## Accessibility & Inclusion
179
180	**Signing up requires JavaScript, and this is a known exclusion.** The proof
181	of work is mandatory and runs in the browser; Paul chose this on 2026-09-01
182	over a fallback that would have let non-JavaScript visitors through, with the
183	trade-off stated. The obligation that follows is honesty at the point of
184	failure: the form renders with its submit disabled and an explanation inside
185	`<noscript>`, and the module enables it once loaded — so a visitor who cannot
186	sign up learns that immediately and from us, rather than meeting a form that
187	looks live and silently does nothing.
188
189	**The honeypot must not catch real people.** It is hidden visually, so it
190	needs `aria-hidden`, `tabindex="-1"`, `autocomplete="off"`, and a field name
191	browsers will not autofill. A screen-reader user or a password manager filling
192	that field would have their signup silently discarded behind a cheerful
193	success page, which is the same "looks live, does nothing" failure the
194	`<noscript>` rule exists to prevent.
195
196	**The proof of work runs in a Worker**, because several hundred thousand
197	hashes on the main thread freezes a low-end phone, and its difficulty is to be
198	calibrated on real mid-range hardware at p95 and p99 rather than on an
199	average — a mean-calibrated challenge hangs for one visitor in a hundred.
200
201	No formal conformance standard has been set for this project. Not asked, not
202	assumed.
203