ratcloud's building blocks, each one working live, in front of you. A feature without an exhibit is not offered; a broken exhibit is seen here, not logged.
Checked · 19 green, 3 red, 3 waiting for a person to try, 2 not built yet
A red light is a promise broken right now. The zoo shows it rather than hiding it, and the card says what is wrong; the green ones still work.
Sign in once at account, and every app knows who you are without asking again.
Who am I, here on the zoo:
Now open a second app on its own address: it should show the same card, with no prompt.
Sign in to record that this worked for you.
The account shim: an app requires rc-auth.php and calls auth_user(). A signed-in browser is silently handed a token for that app; there is no sign-in page per app and no password anywhere.
Someone who is not signed in sees the page, not a bounce to a sign-in screen.
You are a visitor. This whole page loaded without a sign-in.
auth_user() is null for a visitor. The app decides what a visitor sees; the platform never forces a sign-in.
Signing out at account signs you out of every app in this browser.
Sign in first; then this button signs you out of every app at once.
rc_sign_out() sends the browser to account, which ends the one session behind every app's token. No app has to be told.
Change your name and picture at account, and every app shows the new ones.
Sign in to sign the guestbook.
Change your name or picture at account, then reload: your entry changes too. (The robot renames itself to the time of every check, which is how this exhibit checks itself.)
Zoo Robot 18:25@zoo-robot · #11rc_users($ids) turns stored ids into current names and pictures, one call per page. An app keeps ids, never copies of names or pictures.
Any app can search for people by name, including people who have never used it.
Sign in to search for people.
rc_user_search($q) finds people by the start of their username or of any word of their name, across the whole platform.
Pushing to main puts the code live within a minute.
0c1c124a02 by johannes, 77ff74344d by johannes, git push is the deploy. What is running, and since when, is in RC_FACTS/deploy.json, written by root, readable by the app.
main goes live, staging goes to a twin with its own data, and any other branch goes nowhere.
main 0c1c124 · deployed · staging 77ff743 · deployed · build/seal 98461f1 · ignored · This guestbook has 1 signature; the live zoo's has 2, and they are different books.
Push main for live, staging for https://<app>-staging. Each environment has its own RC_DATA, so its own databases; the same code, never the same data.
A mistake in an app's settings file (ratcloud.conf) leaves the old settings running and says what was wrong.
The sample app zoo-broken has not been checked yet.
ratcloud.conf is checked before anything is applied. A bad one refuses the push, in the pusher's terminal and in RC_FACTS/manifest.json; the site keeps running.
An app cannot open another app's files, and it cannot reach the server's own internal network.
Root tries them too, as every app, every hour:
Every app runs as its own unix user in a sandbox, behind a firewall. RC_DATA is the one place it can write; everything else on the box is someone else's.
A change one person makes appears on everyone's open page within a second, without a reload.
Open this page in two tabs and press in one.
Declare a channel in ratcloud.conf; browsers listen with EventSource at /rc/sub/<name>/<id>, the app POSTs to $RC_PUBLISH/pub/<name>/<id>.
A live stream meant for one person can't be read by someone who guesses its name.
Sign in to get a stream of your own.
Add `auth` to a channel in ratcloud.conf, and the app decides who may listen: nginx asks it first, with RC_CHANNEL and RC_CHANNEL_ID.
You can upload a file, see it listed, and download it again unchanged.
Last roundtrip, : 6577 bytes uploaded, listed and downloaded again: matched
Open storage, upload something, and download it again.
storage keeps each person's files (B2-backed) behind their sign-in; an app links to it and never holds storage's keys. The check here uploads random bytes, lists them, downloads them and compares.
An app can save a file into your storage, under its own folder, without ever holding storage's keys.
Sign in to have the zoo save a postcard for you.
rc_app_headers("storage", true) proves to storage which app calls and for whom; storage saves only under Apps / <app>. In bulk: app/begin gives presigned PUTs (200 a call), the bytes go straight to B2, app/commit checks them all at once, app/urls hands out downloads.
A file an app seals for you opens on your devices and nowhere else; the server keeps only what it cannot read.
Sign in to seal a postcard only your devices can open.
The self-check seals a fresh postcard for the robot each time, : 269 bytes in the bucket, none of them its words.
storage's sealing block: rc-crypt.js and rc-seal.js (https://storage.<domain>/seal/v1/) seal in the browser with a key only your devices and your recovery key open; the app's server forwards keyring calls and stores envelopes it cannot read.
A device that never opened your sealed files gets in only with a code typed on one that has, or with your recovery key.
Sign in, seal a postcard (26), then open this page in a private window.
rc-seal.js: seal.request() shows a code, seal.approve(code) on a device that has the key lets the new one in, seal.useStorage() lets storage's window do it with your recovery key; every keyring is checked under the key it guards.
Any app can ask a language model a question without holding a key.
Sign in to ask the model something.
The ai app holds the key; an app calls it with rc_app_headers("ai", true) and gets an answer marked who asked, for whom.
Every question through ai is on your ledger, per app.
Sign in to see what you spent.
ai writes every call to a ledger; GET ?api=usage tells an app what the signed-in person spent today and this week, by app.
An app can send a notification to your phone or browser.
Sign in to be notified.
The push app keeps each person's devices (Web Push); an app asks it to notify someone with rc_app_headers("push", true).
Creating an app gives it an address, a staging twin and a repo to push to.
The dashboard's create form asks root (through its spool) for a new app: a user, both addresses with certificates, and a repo.
Pasting one line into Claude Code lets that machine push; removing it stops it.
The dashboard lists each creator's machines (their ssh keys) with each one's last push; removing one revokes it.
Every exhibit shows the code that makes it work.
Every card has a how link. Try the counter's or the doors': the actual file serving this page, with its sha256.
An app's code is plain files in its checkout; the zoo serves its own exhibits' files as they are on disk, so what you read is what runs.
An app's error log is visible to its creator without a shell.
It appears below within a minute.
2026-10-06T18:15:21+00:00 ratcloud zoo[1681200]: PHP Warning: zoo exhibit 20: a deliberate warning, staging, fb7f6a99 in /srv/apps/zoo/staging/exhibits/20-errors-you-can-read.php on line 26 2026-10-06T18:15:30+00:00 ratcloud zoo[1681200]: PHP Warning: zoo exhibit 20: a deliberate warning, live, 9d2af85f in /srv/apps/zoo/live/exhibits/20-errors-you-can-read.php on line 26 2026-10-06T18:20:23+00:00 ratcloud zoo[1682847]: PHP Warning: zoo exhibit 20: a deliberate warning, live, bafaf2f9 in /srv/apps/zoo/live/exhibits/20-errors-you-can-read.php on line 26 2026-10-06T18:20:25+00:00 ratcloud zoo[1682862]: PHP Warning: zoo exhibit 20: a deliberate warning, staging, da46ba63 in /srv/apps/zoo/staging/exhibits/20-errors-you-can-read.php on line 26 2026-10-06T18:25:24+00:00 ratcloud zoo[1684578]: PHP Warning: zoo exhibit 20: a deliberate warning, live, 5d2a74b1 in /srv/apps/zoo/live/exhibits/20-errors-you-can-read.php on line 26 2026-10-06T18:25:25+00:00 ratcloud zoo[1684578]: PHP Warning: zoo exhibit 20: a deliberate warning, staging, acb55071 in /srv/apps/zoo/staging/exhibits/20-errors-you-can-read.php on line 26
PHP warnings and job output land in RC_FACTS/log.txt within a minute, readable by the app and shown on the creator's dashboard.
An app can run a script every few minutes.
Last tick: , written by the zoo's own five-minute job.
Add `cron = bin/job.php every 5m` to ratcloud.conf: root runs it as the app, never two at once, with its output in RC_FACTS/log.txt.
A model changes your app and shows it running on a preview address, and nothing reaches staging or live until you tap ship.
Last night the builder's robot asked, on the sample app zoo-scratch:
Make GET /ping answer with exactly the text "otter-616b09" (plain text, status 200). Keep everything else as it is.
/ping answered 200 otter-616b09 (has the word)/ping answered 404 not found (without it)/ping answered 404 not found (without it)main: refused6 turns, 6k tokens from the builder's own budget, 2026-10-06T04:25:01+00:00.
The builder app: say what should change; it edits a clone, pushes preview/run-<id> (its key can push nothing else), and the creator reviews the diff and the preview, then ships through root's ship request.
Every self-running exhibit is rechecked on a schedule, and the front page says when.
Checked (took 40.1 s).
The back of house, checked by root :
The zoo is an ordinary app: a five-minute job re-runs its exhibits and stores the results, and root's hourly check of the platform arrives in RC_FACTS/platform.json.
Everything is backed up nightly, a copy leaves the server, and the backup is opened to prove it.
Add `backup_check = <db> <table>` to ratcloud.conf: after each nightly backup root counts that table in the copy and writes it to RC_FACTS/backup.json.
The whole platform can be rebuilt on a fresh machine from the tools repo, one bundle of secrets, and one backup.
Last rehearsal : everything came back. Last one that passed: .
Nothing refers to the machine: a rehearsal restores everything onto a scratch box and checks every app answers. Its verdict reaches each app in RC_FACTS/backup.json.