Specification · v1.0
CARL — Code Automation Readiness Level
CARL is a vendor-neutral standard for measuring how ready a codebase is for AI-driven workflows. It scores a repository across eight pillars and resolves to a single readiness level on a 0–6 scale. This is the canonical v1.0specification.
The CARL standard is free to read. The specification and methodology on this page are Proprietary — All Rights Reserved. Read it and self-attest your own repository against it — there is no fee and no account. Copying, redistributing, or building derivative tooling from the spec text itself is not licensed; see the license page for the current posture.
The readiness levels (0–6)
Seven rungs. Levels 0–4 describe a codebase's agent-readiness today; levels 5–6 are intentionally beyond today's AI — aspirational rungs where the agent doesn't just work inside a codebase, it creates and runs a business around it.
Level 0 — Manual
No automation. Builds, tests, and releases are run by hand; the codebase has no machine-readable contract an agent could rely on.
Level 1 — Scripted
Repeatable scripts exist (build, lint, deploy), but they are undocumented and assume a human in the driver seat.
Level 2 — Tested
A meaningful automated test suite gates changes, giving an agent a verifiable signal that an edit did not break behaviour.
Level 3 — Reviewed
Documented invariants, deterministic builds, and review gates let an agent propose changes a human can confidently approve.
Level 4 — Agent-driven
An agent can take a scoped task and drive it end-to-end — read the contracts, change the code, prove it green, and ship — with a human supervising rather than steering.
Level 5 — Creates a businessBeyond today's AI
Beyond today’s AI. The agent goes from a goal to a launched product: it stands up the codebase, the infrastructure, and the go-to-market, turning an idea into a live, revenue-capable business.
Level 6 — Runs a businessBeyond today's AI
Beyond today’s AI. The top of the ladder. The agent operates the business it created — adapting to the market, managing the books, and steering strategy as conditions drift, with humans setting intent rather than running operations.
The eight pillars
A repository's level is the aggregate of how it scores across these eight dimensions. They are the same vocabulary the reference scanner reports against, so a level and its evidence always line up.
Code Quality & Verification
Strictness and machine-checkability of the code itself — typed contracts, lint gates, and the static guarantees an agent can lean on.
Build & Reproducibility
Deterministic, pinned builds — locked dependencies and pinned runtimes so the same inputs always produce the same artifact.
Testing
Automated test coverage and the test tooling that turns "it looks right" into "it is proven green" before a change lands.
Observability
Telemetry and health signals — structured logs, traces, and reachable health endpoints that make runtime behaviour legible.
Documentation
Machine- and human-readable context — README, agent context files (CLAUDE.md/AGENTS.md), and example configuration that state the system’s intent.
Delivery & Lifecycle Management
How code moves to production — managed packaging, deploy cadence, and the lifecycle plumbing that gets a change live.
Compliance
Regulatory and policy posture — compliance addenda and control mappings (SOC 2, HIPAA, ISO 27001, PCI-DSS) appropriate to the domain.
Security
Supply-chain and access hygiene — secret scanning, code ownership, and branch protection that keep the codebase and its pipeline trustworthy.
The methodology
CARL is self-attested and adversarial-friendly. You assess your repository against each of the eight pillars, resolve those into a single 0–6 level, then publish both the level and the evidence behind it. The ecosystem — not a central authority — decides whether to trust the claim.
- Score each pillar. For every pillar, gather the deterministic signals (typed contracts, locked builds, tests, telemetry, docs, delivery plumbing, compliance posture, security hygiene).
- Resolve to a level.Map the aggregate to the highest 0–6 rung the evidence actually supports. The two top rungs (5–6) are aspirational and beyond today's AI — they exist to mark the direction of travel, not to be claimed.
- Publish the evidence. State your level and link the evidence. A claim without evidence is just a badge; CARL is designed so anyone can check your work.
The reference implementation of step 1 is the CARL Scanner. The full specification — including the machine-readable criteria catalog — is published in the CARL docs.
License — Free to read
The CARL v1.0 specification and methodology are Proprietary — All Rights Reserved. There is no fee or account required to read the standard and self-attest your own repository against it, but no open-source license is granted to copy, redistribute, or adapt the spec text itself. See pricing for the Scanner and advisory offerings built on top of the standard.