Keeps working through any outage
Read and write continues during a network partition; synchronisation catches up when connectivity returns.
The grid goes down.
The chart stays up.
An offline-first, vendor-independent electronic health record. It keeps working through any outage, runs anywhere from a Raspberry Pi to a hospital cluster, and belongs to no vendor.
Architecture & specification phase · AGPL-3.0 · PostgreSQL ≥ 18
Why this exists
There is no vendor in the room. Nothing here is incentivised to keep the hard problems hard — so one thing drives every decision: what actually happens at the point of care, including at 3 a.m. when the network is down.
The mission
Runs anywhere, for anyone
One codebase from a solar-powered clinic to a national network — scaled by configuration, not forks.
Belongs to no one but its users
AGPL-3.0 throughout, commodity hardware, open standards. No proprietary dependency and no lock-in at any layer.
Respects the clinician's time
No workflow may be slower, harder, or more error-prone than its paper-record equivalent.
Founding principles
- Availability over consistency. A clinician can always read locally-relevant records and write new data during a partition.
- Paper-parity is the governing law. No workflow may lose to its paper equivalent in time, steps, or cognitive load.
- The clinical record is append-only. Immutable signed events; corrections reference originals; sync becomes a safe set-union.
- Identity is a claim, never a fact. Never merge — always link; never erase — always overlay. Every error is repairable with a full audit trail.
- One system, every scale. The same software runs from workstation to nation; a node's role is configuration, not a different product.
- Vendor independence is non-negotiable. AGPL-3.0, open standards, commodity hardware. No mandatory cloud, no license keys.
- Safety-critical logic is unbreakable and auditable. Built where whole classes of error are unrepresentable, optimised for reviewer-legibility.
Design at a glance
- Resilience
- Offline-first; every node is write-capable; syncs to its parent when able; degrades to a single standalone workstation.
- Synchronisation
- Append-only event log + causal ordering (hybrid logical clocks); merge becomes set-union plus a small set of clinically-reasoned policies.
- Identity
- A linkage layer over immortal patient IDs; deterministic + probabilistic matching; link / unlink / reattribute / repudiate as auditable events.
- Topology
- Fractal: workstation → department → facility → region → nation, one codebase.
- Foundation
- PostgreSQL ≥ 18; commodity hardware down to Raspberry-Pi class; standard Linux.
- Interoperability
- FHIR as the interface, not a lock-in.
- Licensing
- AGPL-3.0 end to end.
The name
A cairn is a hand-built stack of stones that marks the safe path — needing no power, no network, no infrastructure, standing alone in the wilderness and still doing its job. Cairns are built by accretion, each traveller adding a permanent stone; they are decentralised, raised by many hands across a landscape; and they are found in nearly every culture on earth. So is this system meant to be.
Built by accretion. Raised by many hands.
For the people who have to use these systems and the people who have to keep them running. Clinical realism is valued as highly as code — a well-described failure mode from the front line is a genuine contribution.
Get involved