Pivot: ADR-0007 rent-the-trunk + ADR-0008 FOB/green-zone + rutster-trunk rename #3
Reference in New Issue
Block a user
Delete Branch "pivot-and-ui-design"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Strategic pivot from ADR-0003 (Rust-native trunk SIP) to ADR-0007 (rent the trunk transport; no first-party SIP stack) + ADR-0008 (the FOB/green-zone build-vs-reuse doctrine).
What lands
rutster-signaling-sip→rutster-trunk(the old name's reason-for-being was ADR-0003 which is now superseded).Merge instructions (load-bearing)
Use REBASE-MERGE, not squash-merge. This deviates from the AGENTS.md squash default but is justified by the stacking topology: 3 downstream branches (
slice-1-review-fixes,slice-3-realtime-brain-design,slice-3-realtime-brain) carry this pivot's 6 commit SHAs. Rebase-merge preserves those SHAs so all 3 branches see the pivot as already-merged into main with zero rebase pain. Squash would orphan the originals and force conflict-prone rebases across all 3 mid-slice-3.Build verified:
cargo build --all,cargo test --all,cargo clippy -D warnings,cargo fmt --checkall green on the branch.Reviews
Companion strategic reviews filed in
docs/reviews/(onstrategic-reviews-post-pivot-rescorebranch — separate PR):ADR-0007 — Trunk/PSTN strategy: rent the transport, no first-party SIP stack. Supersedes ADR-0003 (Rust-native trunk SIP). The 2026-06 strategic-relevance review stress-tested ADR-0003 against the 2026 market + solo-build realities and it did not survive: a trunk SIP/media core is the highest-cost, lowest-differentiation square on the board (the perceived-quality battle and the buying criteria both live above the transport), and no production-hardened pure-Rust SIP stack exists to stand on (ezk is bus-factor-1 / pre-1.0; str0m self-describes as 'not for production' for SIP). rutster owns no SIP stack. PSTN reach is rented transport in three layers: 1. Primary (demo, most users) — CPaaS raw-media fork (Twilio Media Streams, Telnyx). Media-leg ingress, core-as-server (parallel to WebRTC ingress per ADR-0006). Use the raw-audio fork, *not* managed Voice-AI products that would consume the reflex loop. 2. Graduation (on-prem) — out-of-tree SBC (Kamailio/FreeSWITCH/drachtio + rtpengine) B2BUAs carrier SIP into rutster as clean RTP/tap media, outside the trust boundary. 3. Never — a first-party Rust trunk SIP stack. rsip/ezk stay off the critical path. The only things rutster owns in Rust: the call model, the reflex loop, the agent tap. Everything that touches a carrier is rented (layer 1) or out-of-tree (layer 2). ADR-0008 — The FOB and the green zone: the build-vs-reuse doctrine. Names the boundary criterion implicit across ADRs 0002-0007 as one mechanical rule every contributor (human or agent) applies the same way. - FOB (build in Rust) — admitted only if it passes one of: hot path, security-constitutive, differentiating. Current FOB: media termination (rutster-media on str0m) · real-time reflexes (VAD/barge-in/jitter/pacing) · call model (rutster-call-model) · agent tap (rutster-tap) · spend/abuse gate (rutster-spend) · control API + state/bus trait (rutster). - Green zone (reuse at arm's length) — its own process/container/trust domain, never in the FOB's address space. Admitted when it fails all three FOB tests AND a trusted, actively-maintained project already does it well. Current green zone: Valkey (ADR-0005) · carrier trunk (ADR-0007) · agent brain · reference GUI · object storage · KMS · OTel collector · container supervisor. - 'Actively maintained' is the load-bearing gate: excludes a first-party Rust SIP stack and webrtc-rs; admits Valkey and str0m-for-WebRTC. - When in doubt, default to green zone. The FOB earns its members. Restates the memory-safety pillar precisely: the FOB is 100% memory-safe Rust; the green zone is trusted battle-tested OSS kept outside the boundary — not an over-claim that every byte is Rust. ADR-0003's status is flipped to Superseded with a forward-pointer to ADR-0007. Kept as the historical record of the 'own trunk SIP + media termination in Rust, no SBC shield' plan; reversed under the strategic-relevance review.ADR-0007 (rent the trunk) + ADR-0008 (FOB/green-zone doctrine) propagation into the narrative docs that orient contributors + readers. No code changes. README: - Wedge bullet 2: 'one secure auditable boundary' now lists media + local reflexes + spend + tap + audit (was: trunk termination + media + spend). Adds the honest caveat that PSTN media inside the boundary is the on-prem *graduation* (ADR-0007), not a day-one claim. - 'Is / isn't': 'isn't a TDM/PSTN-hardware PBX — *and not a SIP stack.*' No first-party SIP (ADR-0007). PSTN reach is rented transport. - Memory-safety pillar: 'rutster parses no SIP at all' — entire first-party wire surface is WebRTC/RTP/SRTP + WebSocket tap/ingress, all memory-safe Rust. The carrier-SIP interop tail lives outside the trust boundary. - Spearhead step 5: 'Add a real phone number via rented transport' (was: 'Replace WebRTC ingress with a real PSTN trunk call'). Re-aims at the AI-telephony frontier; no first-party SIP stack. - References: 0007 supersedes 0003 in the highlighted ADR list. ARCHITECTURE: - New 'FOB and the green zone' section after the fused-vertical framing — names the build-vs-reuse doctrine with the FOB member list + green-zone member list, and restates memory-safety precisely ('FOB is 100% memory-safe Rust; the green zone is trusted OSS kept outside the boundary — not an over-claim that every byte is Rust'). - 'Inside the boundary': 'Carrier trunk — rented transport, not first-party' replaces 'Trunk SIP termination — Rust-native.' PSTN audio arrives as a media-leg ingress from a rented CPaaS raw-media fork or an out-of-tree SBC for on-prem sovereignty. - Biggest technical risk: 'No longer the SIP stack — because rutster no longer builds one.' Retires ADR-0003's named schedule risk; redirects to 'the reflex loop itself' (turn-taking, VAD-driven barge-in, jitter, pacing) — which is also the differentiator. PORT_PLAN: - Design rule 4: 'rent it, don't own it' replaces ADR-0003's 'Rust-native trunk SIP, no SBC shield.' ADR-0007 restores the rule's original instinct. - SIP signaling (trunk) row: disposition flipped to 🔌 Rented / out-of-tree. - Outbound registration row: disposition flipped to 🔌 Rented / out-of-tree (handled by the rented transport or out-of-tree SBC; rutster parses no SIP). - Spend/abuse engine row: 'co-located with call origination + the tap inside the boundary' (was: 'co-located with trunk termination'). rutster mediates both the provider call-control API and the brain tap — the brain never holds the wire. - Spearhead step 5: 'Add a real phone number via rented transport.' - Open decisions: SIP line updated to 'Re-decided — ADR-0007.' AGENTS.md: - ADR list: adds 0007 and 0008 with annotations; marks 0003 as superseded by 0007. - Key decisions to respect: prepends the FOB/green-zone doctrine as the *the* build-vs-reuse rule. 'When in doubt, default to green zone — the FOB earns its members, it doesn't collect them. This is why the trunk is rented (ADR-0007) and Valkey reused (ADR-0005), not rebuilt. Don't pull green-zone plumbing into the core.'