Standard v1.0First DraftProprietary
The free-to-read proprietary standard for agent-ready codebases.
CARL is a vendor-neutral specification for measuring — and improving — how ready a codebase is for AI-agent-assisted development. Seven maturity levels (0–6), eight capability pillars, machine-checkable by default.
Three components, one framework
The Standard
A vendor-neutral specification, proprietary to Wentzel.ai (all rights
reserved — see License). Evidence-based,
machine-checkable, versioned, and governed by Wentzel.ai. Read it end-to-end
at /docs/spec/v1.0/.
The Scanner & Assessor
The free public Scanner reads any public GitHub repo into a Cloudflare Worker's memory for one request, runs the analysis, and returns a CARL level with pillar scores and remediation — no account, rate-limited. The hosted Assessor app runs the same deterministic engine and is in single-operator lockdown today.
The Tooling
Proprietary reference implementations (all rights reserved) — the
deterministic @wentzel/carl-engine, its in-repo CLI
wrapper (@wentzel/carl-cli, not yet on npm), and the reference
prompts. A GitHub App and badges are milestone-tagged,
forward-looking work.
The seven levels (0–6)
Every CARL assessment assigns exactly one level. Levels 0–4 describe a codebase's agent-readiness today; levels 5–6 are aspirational — beyond what today's AI can deliver.
- L0Manual
Manual
No automation. Builds, tests, and releases are run by hand; the codebase has no machine-readable contract an agent could rely on.
- L1Scripted
Scripted
Repeatable scripts exist (build, lint, deploy), but they are undocumented and assume a human in the driver seat.
- L2Tested
Tested
A meaningful automated test suite gates changes, giving an agent a verifiable signal that an edit did not break behaviour.
- L3Reviewed
Reviewed
Documented invariants, deterministic builds, and review gates let an agent propose changes a human can confidently approve.
- L4Agent-driven
Agent-driven
An agent can take a scoped task and drive it end-to-end — read the contracts, change the code, prove it green, and ship — with a human supervising rather than steering.
- L5Creates a businessBeyond today's AI
Creates a business
Beyond today’s AI. The agent goes from a goal to a launched product: it stands up the codebase, the infrastructure, and the go-to-market, turning an idea into a live, revenue-capable business.
- L6Runs a businessBeyond today's AI
Runs a business
Beyond today’s AI. The top of the ladder. The agent operates the business it created — adapting to the market, managing the books, and steering strategy as conditions drift, with humans setting intent rather than running operations.
The eight pillars
Criteria are grouped into eight capability pillars. Each aggregates to a score so agents and humans can quickly see where a codebase is strong and where it is weak.
- 01Code Quality & Verification
CQV-Strictness and machine-checkability of the code itself — typed contracts, lint gates, and the static guarantees an agent can lean on. - 02Build & Reproducibility
BLD-Deterministic, pinned builds — locked dependencies and pinned runtimes so the same inputs always produce the same artifact. - 03Testing
TST-Automated test coverage and the test tooling that turns "it looks right" into "it is proven green" before a change lands. - 04Observability
OBS-Telemetry and health signals — structured logs, traces, and reachable health endpoints that make runtime behaviour legible. - 05Documentation
DOC-Machine- and human-readable context — README, agent context files (CLAUDE.md/AGENTS.md), and example configuration that state the system’s intent. - 06Delivery & Lifecycle Management
DLM-How code moves to production — managed packaging, deploy cadence, and the lifecycle plumbing that gets a change live. - 07Compliance
CMP-Regulatory and policy posture — compliance addenda and control mappings (SOC 2, HIPAA, ISO 27001, PCI-DSS) appropriate to the domain. - 08Security
SEC-Supply-chain and access hygiene — secret scanning, code ownership, and branch protection that keep the codebase and its pipeline trustworthy.
Privacy, engineered
CARL is a code-scanning tool. When you assess a repository, the source is fetched as a tarball into a Cloudflare Worker isolate's memory for the lifetime of a single request — no persistent disk — and discarded when the request returns. Only the sanitized report — pillar scores, findings, and remediation — is retained. No source code, no file contents, no training data. For stricter environments, the self-hosting guide covers running the engine inside your own network.