Keeps working through any outage
Read and write continues during a network partition; synchronisation catches up when connectivity returns.
The grid
goes down.
The chart
stays up.
An offline-first, vendor-independent electronic health record. It keeps working through any outage, runs anywhere from a Raspberry Pi to a hospital cluster, and belongs to no vendor.
Specification complete · prototypes proving it works · AGPL-3.0 · PostgreSQL ≥ 18
- Sync proven over a real satellite link
- A first node federating with its neighbours
- Safety layer tested against a hostile AI agent
Why this exists
There is no vendor in the room. Nothing here is incentivised to keep the hard problems hard — so one thing drives every decision: what actually happens at the point of care, including at 3 a.m. when the network is down.
The mission
Runs anywhere, for anyone
One codebase from a solar-powered clinic to a national network — scaled by configuration, not forks.
Belongs to no one but its users
AGPL-3.0 throughout, commodity hardware, open standards. No proprietary dependency and no lock-in at any layer.
Respects the clinician's time
No workflow may be slower, harder, or more error-prone than its paper-record equivalent.
From the front line
Cairn is designed against real failure modes, not abstractions. Three that anyone who has worked a ward or a clinic will recognise.
-
“Allergy: penicillin — rash, 1974.” Nobody can confirm it, so everyone prescribes around it for fifty years.
Cairn carries the label and the cephalexin and amoxicillin this same patient has tolerated since — side by side, nothing hidden, nothing silently blocked. The clinician sees the whole picture and makes the call, exactly as they would with the paper notes open in front of them.
Acknowledged uncertainty · paper-parity -
Same patient, two records — one the ED opened at 3 a.m., one the clinic made last year under a slightly different spelling of the name.
Cairn never silently merges them and never quietly deletes one. It links them as a claim that can be reviewed — and unlinked just as easily if it’s wrong — every step on an audit trail, with no data lost either way.
Identity is a claim, never a fact -
Mid-progress-note, the connection drops — or the whole hospital system goes down for the afternoon.
The note was saved to durable local storage the instant it was typed, and reading and writing carry on through the outage. When the link returns, everything syncs back on its own. Nothing waits on a server that isn’t there.
Availability over consistency
For the people who run the service
The same decisions that protect the clinician also protect the budget, the data, and the duty to keep the service running.
Runs on hardware you already own
No licence fees, no per-seat pricing, no mandatory cloud. The same software runs from a Raspberry Pi in a rural clinic to a hospital cluster — on commodity hardware you control.
Your data is yours — and stays portable
Built on open standards, with no proprietary layer to license and no vendor to ask permission. The full record exports in an open format; changing your mind never means losing it or paying to leave.
Care continues through any outage
A failed internet link, a downed intranet, or a single isolated machine doesn’t stop care. Business continuity isn’t a bolt-on here — it’s the first thing the architecture was built to guarantee.
A complete, permanent audit trail
Nothing is ever silently overwritten or erased. Every entry is signed, and corrections are layered over the original — so the full medico-legal history of who recorded what, and when, stays intact.
Where it is today: the architecture is complete, and the hardest parts are already working in prototype — synchronisation proven over a real satellite link, a first node federating with its neighbours, and the safety layer tested against a deliberately hostile AI agent. It is not a product you can install yet, and this page won’t pretend otherwise. Read the specification →
Founding principles
-
Availability over consistency
A clinician can always read the records that matter and write new data — even with the network down.
-
Paper-parity is the governing law
No workflow may lose to its paper equivalent in time, steps, or cognitive load.
-
The clinical record is append-only
Every entry is permanent and signed; corrections are layered over the original, never written in its place — just as medico-legal notes already work on paper.
-
Identity is a claim, never a fact
Never merge — always link; never erase — always overlay. Every error is repairable with a full audit trail.
-
One system, every scale
The same software runs from workstation to nation; a node's role is configuration, not a different product.
-
Vendor independence is non-negotiable
AGPL-3.0, open standards, commodity hardware. No mandatory cloud, no license keys.
-
Safety-critical logic is unbreakable and auditable
The few components that could corrupt a record or mix up patients are built so those mistakes can’t happen — and kept small enough to audit line by line.
Design at a glance
- Resilience
- Offline-first; every node is write-capable; syncs to its parent when able; degrades to a single standalone workstation.
- Synchronisation
- Append-only event log + causal ordering (hybrid logical clocks); merge becomes set-union plus a small set of clinically-reasoned policies.
- Identity
- A linkage layer over immortal patient IDs; deterministic + probabilistic matching; link / unlink / reattribute / repudiate as auditable events.
- Topology
- Fractal: workstation → department → facility → region → nation, one codebase.
- Foundation
- PostgreSQL ≥ 18; commodity hardware down to Raspberry-Pi class; standard Linux.
- Interoperability
- FHIR as the interface, not a lock-in.
- Licensing
- AGPL-3.0 end to end.
The name
A cairn is a hand-built stack of stones that marks the safe path — needing no power, no network, no infrastructure, standing alone in the wilderness and still doing its job. Cairns are built by accretion, each traveller adding a permanent stone; they are decentralised, raised by many hands across a landscape; and they are found in nearly every culture on earth. So is this system meant to be.
Built by accretion. Raised by many hands.
For the people who have to use these systems and the people who have to keep them running. Clinical realism is valued as highly as code — a well-described failure mode from the front line is a genuine contribution.
Get involved