carl.wentzel.ai/app is the hosted CARL assessor app. It runs the deterministic @wentzel/carl-engine: the same engine the reference scanner uses, against a GitHub repository and returns a CARL level with pillar scores, findings, and remediation. The assessment runs entirely in the Cloudflare Worker's memory for the lifetime of a single request: the repository is fetched as a tarball, scored in-memory, and discarded when the request returns. The source never hits durable storage, only the sanitized report does.

What it does

1. You provide a repository by URL after signing in.
2. CARL fetches the repository as a GitHub tarball directly into the Cloudflare Worker's memory: no disk, no separate container.
3. The deterministic engine runs over every CARL v1.0 criterion that applies to the detected stack, pillar by pillar.
4. The Worker writes a sanitized report to the database: repository name, commit hash, pillar scores, findings, remediation. No code. No file contents. No training data.
5. The request returns; the repository bytes are discarded with the isolate.
6. You see the report: the resolved CARL level, per-pillar scores, and the failing criteria with sanitized evidence and remediation.

The report

The report page renders the assessment on a print-friendly layout:

• The level. The single 0–6 rung the evidence resolves to, with the pillar scores that produced it.
• Pillar breakdown. Each of the eight pillars with its score, so you can see which dimension is holding the level back.
• Failing criteria. Every failed criterion, grouped by pillar, with a sanitized (structure-only) evidence summary and the remediation that closes it.
• Save as PDF. The page is styled for print, so your browser's "Save as PDF" produces a clean shareable document: no separate export service needed.

Trend lines, percentile comparison, and a pillar radar chart are planned enhancements, not yet in the shipped report.

Privacy

Full privacy architecture in Private-repo assessment.

Pricing

The CARL standard is always free to read (it is proprietary, all rights reserved: see License), and the public reference scanner offers free, rate-limited demo scans today. The hosted assessor is in single-operator lockdown for now; open access, history, deep AI-assisted analysis, and team features are later-milestone work. See the pricing page for the four offerings (the free standard, the Scanner, CARL Monitor, and Advisory), each priced on its own. CARL Monitor tracks your CARL level over time and arrives in Phase 3; request access through the Builder form.

Related

• The CLI: the in-repo @wentzel/carl-cli for local and CI use (not yet published to npm).
• Reading your report: walking through a finished CARL report.
• Private-repo assessment: how the in-memory, ephemeral-isolate architecture is designed to handle authenticated private repositories.