Caribbein — Engineering
For the geeks.
The technical page. What runs, what is mid-rebuild, and what is not built yet — written for anyone doing due diligence on us: an engineer thinking about joining, an investor's technical friend, a provider asking where their data lives.
Everything below is checkable, most of it from this very tab. When we say view source, we mean it.
The estate, in one picture
Four layers, drawn in roles rather than product names. Every node carries a status dot — including the ones that admit nothing is there yet. Open a layer to see its internals.
Plan and book across — islands. No account exists until a request is actually sent.
The same marketplace, built to serve residents first — local discovery, in French and English.
Restaurateurs, captains, villa managers, coaches — each signs into an operating system shaped for their trade.
No social login anywhere. Sign-in is a phone number and a one-time code.
Static pages served by a plain Node http server. No framework, no build step, no runtime dependencies.
A single HTML file carrying the whole consumer experience — catalogue, maps, trip planning — with a live provider directory behind it.
An installable web app — the marketplace's twin, with the same phone-plus-code sign-in.
— named systems for providers. — is rebuilt on the new shared shell; the rest still run on the platform it replaces.
The shared shell owns everything common — chrome, theme, EN/FR, command palette, error log, master-detail, bulk actions, undo, virtualization, offline state, density, shortcuts, print. Per-OS configuration is the only per-OS frontend code.
One operational database. A schema per OS, and row-level security from the first table — not retrofitted.
A hard split between public and private. Listing photos are public by design; identity documents live in private storage and are only ever reached through short-lived signed URLs.
Every schema change is a numbered migration, and CI replays the full history from zero on every build.
Not processing yet. In beta, the concierge connects guest and provider, and payment settles directly with the provider. Card rails come after launch.
One-time codes and provider notifications over SMS and WhatsApp.
A standard public tile provider draws the maps.
Web push to installed apps, with a CI guard that proves the fleet degrades gracefully when push is unavailable.
Transactional mail for confirmations and correspondence, from our own domain. No marketing automation suite.
A zero-dependency front door
The strongest claim on this page is also the easiest to check: open view source on www.caribbein.fr. Everything below is verifiable from this tab in about ten seconds.
- www.caribbein.fr is served by a plain Node http server. No framework, no build step, no runtime npm dependencies.
- The launch page is a single HTML file — inline CSS, inline JS, self-hosted woff2 with a Google Fonts fallback. So is this one.
- Its scroll film is transform-only, driven off the section's own scroll progress rather than wheel events — trackpads, scrollbars and keyboards all behave identically.
- It degrades on purpose. No JavaScript, a small screen or prefers-reduced-motion all get a static, stacked page that still carries the whole argument.
- Standard security headers ride every response, including a content-security policy. We describe the posture here and let your dev tools print the details.
Don't take our word for it
Your browser already recorded every network request this page made. The button below only prints that record — we never touch it.
Expected result: this site, plus at most the two Google Fonts hosts from the fallback. Anything else in that table would be a bug — tell us.
One shell, nineteen operating systems
The honest arc: we built fast, one vertical at a time, and let each OS teach us what providers actually share. Then we started again — one shared shell, and a rebuild of every OS on top of it. We are mid-flight on that rebuild, and would rather show you the flight than pretend it has landed.
Underneath: Postgres with a schema per OS, and row-level security from the first table. — guards fail the build in CI: a legacy-name ban, the parity ledger, shell integrity, driver boundary, migration replay, job heartbeats, push degradation, i18n coverage, guided-tour coverage, and the clearance gate. The story behind each one: Ten guards, ten scars.
Adding an OS is five steps: register the slug, copy a config, add the API router, seed data, write the migration with its row-level-security policies. Every dashboard then ships through the same — quality gates — bilingual coverage, a visible error log, a command palette, theme discipline — and a guided tour that must update in the same commit as any UI change.
The number engineers tend to respect: the database driver went from — lines to — in the rewrite. The behaviour it lost was behaviour nothing used.
Status, plainly: — OS is rebuilt on the shell today. The rest still run on the platform being replaced. That is the honest sentence; the diagram above says the same with dots.
Row-level security, illustrated: one table, the same query, two providers, two different worlds — enforced by the database itself, not by app code remembering to filter.
Things we deliberately do not run
- No React on the front door The landing pages are plain HTML and CSS. A page whose job is to load fast and read well does not need a component runtime.
- No edge provider in front of the origin Self-hosted by design — requests reach our server, not a rented cache. The one exception a source-viewer will find: the Google Fonts fallback.
- No social login Phone plus one-time code, for everyone. No password table to breach, no identity graph handed to a third party.
- No third-party error tracking Errors land in our own error log — the same one every provider can open from their dashboard.
- Exactly one analytics vendor And the marketplace's own counting is cookieless. We can name every place a request leaves our origin.
- No consumer-facing AI in the marketplace We do not put a chatbot between you and a person on your island. AI does heavy lifting in our tooling — cataloguing, quality control, translation drafts — and stays out of the product you touch.
How nine thousand providers got catalogued
The least guessable part of the operation, and the proof the marketplace is not a scrape.
- Tourism board first. The island's official list outranks every aggregator, every time.
- First-party enrichment, venue by venue — phone, hours, site, socials — from the venue's own published surfaces, not a reseller's copy of them.
- An explicit image-rights model instead of hotlinking whatever loads: imagery as the venue publishes it, formalised when the venue joins as a provider.
- Quality-control verdict passes run over photos and records before anything publishes.
- — ingest and enrichment scripts behind it, run island by island.
Measured — against the same public directory the marketplace reads. On top of it sits the hand-curated launch shelf: — listings, — with the venue's own photo. Every figure on this page loads from geek-facts.json — open it, or re-derive it yourself with probe.mjs.
The ingest pipeline — a flow, not a topology, which is why it gets its own small figure.
Data and privacy, plainly
Written for a provider or a parent as much as for an engineer.
- Public by design: a listing — the name, photos and hours a business already publishes to be found. Never public: your requests, your conversations, your documents.
- Identity documents sit in private storage and are reached only through short-lived signed URLs. Never public, never inline.
- The consent and data-request machinery is real — export and erasure exist as working flows, not as a mailbox promise.
- A data-protection impact assessment covers minors' data in the education and sports systems.
- The formal texts: privacy policy (RGPD art. 13/14) and legal notice (LCEN art. 6-III).
Accessibility and performance
- prefers-reduced-motion is honoured everywhere there is motion — including on this page.
- The front door works with JavaScript off. So does this page, right down to the diagram — every layer simply renders open.
- Skip link, keyboard navigation, labelled controls. The diagram's layers are real buttons; Tab and Enter work.
- EN/FR coverage is scanned automatically rather than spot-checked — on this page and across the OS fleet.
What is not built yet
- The replatform One OS across. Eighteen to go.
- Payments Not processing in beta. The concierge connects you; you settle with the provider.
- Some named systems Not yet on the platform. The ecosystem tiles on the launch page mark exactly which.
- The Games Open October 1.
This section shrinks. The dots above go green one at a time, and the page carries a probe date so you can hold us to it.
Things that broke
Post-mortems are the fastest way to judge an engineering culture, so here are ours — the process failures, not the attack surface.
- The dashboard that lied about its data source An internal dashboard claimed its figures refreshed automatically from our documentation vault. An audit found the refresh had never run once — the numbers were hand-maintained and merely looked automated. We rebuilt the pipeline, and every number we publish now carries a probe date. The dated geek-facts.json behind this page is that lesson, institutionalised.
- The test rig that cried wolf Our own screenshot rig once reported every venue photo on a demo missing. The site was fine — the rig was silently blocking the very requests the photos rode in on. Since then, no failure is believed until a second, independent method reproduces it.
More will join this list. That is what shipping looks like.
Two hard questions
The ones due diligence always gets to, answered before you ask.
- What happens if the founder gets hit by a boat? Today, Caribbein is one founder and a heavily documented estate. We will not pretend an org chart we do not have. The mitigation is how everything is built: decisions land in a written log, every rebuild carries a state file a stranger could resume from, and the replatform's whole point is that an OS is defined by a config, not by whoever built it. It is still a real risk. We name it, and the first specialist hires are how it retires.
- What stops you becoming the thing you replaced? Structure, not promises: one flat — commission, published on the front page; the OS fleet costs providers nothing; and — of every commission is reinvested on the island it came from. Extracting more would mean changing the deal in public.
Colophon
- Type: Recoleta for display, Fraunces for the italic serif, Geist and Geist Mono in the product UI, Hanken Grotesk in the film. This page sets Fraunces and Inter.
- Thirty island flag palettes drive the brand system; the mark is the étoile de mer.
- Elsewhere on the estate, diagrams are generated by a build script and never hand-edited. The two figures on this page are the exception — hand-drawn, because here they are the argument.
- No AI-generated imagery anywhere on this page. A technical credibility page illustrated with generated art would undermine itself.
- For terminal people, this page also exists as plain text: geek.txt. The numbers: geek-facts.json. The probe that made them: probe.mjs.