Showcase · SoftCloud

YouTube for
Software

Describe what you want. Get a live app at a URL. Share it with the world. AI-generated software as a social platform.

Early Stage · Phase 1 Bootstrap
May 2026 · samschillace/softcloud
The Insight

Every creator
runs a CDN

📹

Video Had This Problem

Before YouTube, sharing video meant hosting files, managing bandwidth, picking codecs. YouTube made it: record, upload, share a link.

💻

Software Has It Now

AI agents generate enormous volumes of small, purpose-built software. But every piece still requires the creator to think about deployment, scaling, security, and infrastructure.

☁️

The Missing Layer

Compute, storage, databases — all commodity and swappable. What doesn't exist is the software layer: the experience, the network effects, the social composability.

That's the equivalent of asking every YouTube creator to run their own CDN. The infrastructure is commodity. The platform layer is the product.

— SoftCloud Design Document, April 2026
The Core Loop

Intent to live app
in one step

The fundamental experience — the "YouTube upload moment" for software:

1

Express Intent

"I need a budget tracker." The creator describes what they want in natural language. No code, no config.

2

Generate

The platform calls the LLM (OpenAI gpt-4o), generates HTML/JS/CSS, and extracts the result. A mock generator works offline for development.

3

Deploy

Files are written to data/apps/{subdomain}/. CSP headers and security policies are injected automatically. The creator never touches infrastructure.

4

Live at a URL

The app is immediately accessible at {name}.softcloud.localhost. No signup required to use it — consumption is just a URL.

5

Share & Fork

Every app lives in a Space (like a YouTube channel). Sharing and forking are built into the data model from day one — not bolted on later.

Architecture

Single binary, six modules, stdlib only

A Go backend compiled from standard library packages — no external dependencies. Designed for swappability at every layer.

🌐

API Server

:8080 — REST endpoints for creating, listing, and retrieving apps

🚀

App Server

:8081 — Subdomain routing, static file serving, CSP injection

🧠

Generator

OpenAI gpt-4o or mock — swappable via interface

model

Data types: App, Space, CSPPolicy, Manifest. Pure structs, no logic beyond CSP rendering.

store

Persistence interface + in-memory implementation. Thread-safe with sync.RWMutex.

gen

Generator interface with OpenAI and Mock implementations. Extracts HTML from markdown code fences.

deploy

Deployer interface + filesystem implementation. Writes files to disk, returns absolute paths.

serve

Subdomain routing via Host header. Injects CSP, X-Frame-Options, X-Content-Type-Options on every response.

api

HTTP server, router, CORS middleware. Wires store + generator + deployer into REST handlers.

Platform DNA

Social from
the first line

SoftCloud is designed to avoid the Vercel trap (runtime first, social later) and the Glitch trap (social without great generation).

Spaces

Every app lives in a Space — the creator's workspace, like a YouTube channel. Spaces are structural, not UI chrome. The data model includes SpaceID on every app from birth.

Forking & Lineage

The platform knows an app's lineage — was it forked from another app? What agent session created it? This enables a remix culture where software builds on software.

Consumption is a URL

Using an app requires nothing: no signup, no install, no SDK. Just a URL. Authentication only when the app itself demands it.

Software Begets Software

Unlike media, software composes. The platform will provide standard idioms for apps to communicate and share data — a composition layer where apps build on apps.

"Worse is better" — Optimize for simplicity and reach over power and control. A constrained but frictionless experience beats a powerful but complex one. RealPlayer had more features; YouTube won.

— Design Principle #1
Security by Default

The platform takes responsibility

Creators don't think about security any more than YouTube creators think about CDN topology. SoftCloud enforces it structurally.

🔒

Subdomain Isolation

Each app runs at its own subdomain — a separate browser origin. localStorage, cookies, and DOM are isolated by the browser itself. Cross-origin fetch blocked by CORS.

🛡️

Content Security Policy

script-src 'self' — no inline scripts, no eval(). frame-src 'none' — no iframes. object-src 'none' — no plugins. Injected on every response.

📋

Runtime Contract

A documented contract specifying what generated apps are allowed to do, what CDNs are whitelisted, and what the security headers enforce. Gaps are documented honestly.

# Security headers injected on every app response: Content-Security-Policy: default-src 'self'; script-src 'self'; ... X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin
Development Velocity

Three days, concept to working backend

17
Commits
14
Features completed
918
Lines of Go source
1035
Lines of Go tests
April 20–23, 2026 · 9 dev-machine sessions · Agent-assisted development (12 of 17 commits via dev-machine)
Go standard library only — zero external dependencies · Test-to-source ratio: 1.13:1
Honest Status

What exists today vs. the vision

Built (Phase 1A)

  • Go module with health endpoint
  • Data model: App, Space, CSPPolicy, Manifest
  • Store interface + in-memory implementation
  • Generator interface + OpenAI + Mock
  • Deployer interface + filesystem impl
  • API server: create, list, get apps
  • App server: subdomain routing + CSP
  • Main.go wiring + Makefile
  • Runtime contract documentation
  • Subdomain isolation spike

Not Yet Built

  • Next.js frontend (specced, not implemented)
  • Persistent storage (in-memory only)
  • Authentication / user accounts
  • App versioning or rollback
  • Content moderation or scanning
  • Inter-app composition layer
  • Discovery, search, trending
  • HTTPS / TLS
  • CI/CD pipeline
  • Server-side app execution
The backend core loop works: POST a prompt, get a live app at a subdomain. Everything above the line is real. Everything below is documented as explicit non-goals for Phase 1.
The Bigger Vision

A platform layer
for agentic code

SoftCloud builds the six layers that sit between generated software and commodity infrastructure:

EXP

Experience Layer

What users see: intent input, app URLs, spaces, sharing, discovery

AGT

Agentic Layer

Intent-to-code generation, lifecycle management, evolution, composition

SVC

Platform Services

Identity, storage, analytics, payments, inter-app plumbing

SAF

Policy & Safety

Moderation, security, compliance, resource limits, runtime monitoring

ABS

Abstraction Layer

Unified interface to backend services — makes infrastructure swappable

RNT

Infrastructure (rented)

Commodity compute, databases, storage, CDN — swappable

Sources & Methodology

How this deck was built

Repository: /home/samschillace/dev/ANext/softcloud

Key source documents:

All quotes are from project source documents. No metrics are fabricated. This is an early-stage project — the "Not Yet Built" list is longer than the "Built" list by design. Phase 1 is about proving the core loop.

Primary contributor: samschillace · Category: Showcase · Generated: May 2026

More Amplifier Stories