rutster/docs/adr/0007-trunk-rented-transport.md

ADR-0007 — Trunk/PSTN strategy: rent the transport, no first-party SIP stack

• Status: Accepted
• Date: 2026-06
• Supersedes: ADR-0003 — Rust-native trunk SIP, no SBC shield
• Origin: 2026-06 strategic-relevance review (market + code sanity-check). Re-aims the solo build at the AI-telephony frontier — the reflex/tap/eval loop and the contact-center domain — and off the trunk-SIP rewrite.
• Amends: README.md, docs/ARCHITECTURE.md, docs/PORT_PLAN.md
• Related: ADR-0002 (fused vertical), ADR-0006 (ingress posture), ADR-0001 (the "rent the edge" instinct this re-converges with)

Context

ADR-0003 decided to own trunk SIP and media termination directly in the Rust core (rsip + ezk), dropping the Kamailio + rtpengine shield so the memory-safety thesis would be "literally true at the wire." The argument was internally coherent: under the contact-center scope the device-interop tail collapses to a few documented carriers, so a bounded Rust trunk client looked tractable.

A strategic-relevance review — the goal is staying at the AI-telephony frontier, not shipping a from-scratch protocol stack — stress-tested that bet against the 2026 market and the realities of a solo build. It does not survive:

1. A trunk SIP/media core is the highest-cost, lowest-differentiation square on the board. End-to-end voice-agent latency is ~1,100 ms mouth-to-ear; the media/transport layer is ~80–100 ms of it, and PSTN transport is ~$0.02/min — a rounding error. The perceived-quality battle (turn-taking, barge-in, endpointing) and the buying criteria (integration, reliability, compliance, outcomes) all live above the transport. No buyer in this market has ever purchased on implementation language.
2. There is no production-hardened pure-Rust SIP stack to stand on. ezk-sip is the only credible one and it is single-maintainer / pre-1.0 (bus-factor-1); str0m self-describes as "not for production" for this purpose. Every serious player stands on mature C/Go and puts its own language only at the orchestration edge — LiveKit on Go/Pion, Daily wrapping libwebrtc, jambonz on FreeSWITCH + rtpengine. A solo founder re-fighting 25 years of carrier/NAT/DTMF hardening in a young Rust stack spends the one resource it cannot spare (years) on the layer that pays back least.
3. It steals those years from the actual white space. The differentiation versus LiveKit / Vapi / Pipecat is the contact-center domain (ACD, queues, escalation, CDR, recording, supervisor) plus the reflex loop plus the data-owned eval/containment loop — none of which a trunk-SIP rewrite gets you closer to.

ADR-0003's own sequencing already conceded the point: it put the reflex loop (spearhead steps 1–4) before the trunk (step 5) precisely because the reflexes are "the hard, most-differentiating part." Followed one step further, that logic says: don't make the trunk a first-party build at all.

Decision

rutster owns no SIP stack. Carrier/PSTN reach is rented transport, in three layers — and rutster owns only the top one:

1. Primary (demo, frontier, most users) — rented CPaaS raw-media ingress. Zero SIP in rutster. A CPaaS raw-audio fork (Twilio Media Streams, Telnyx media streaming, or equivalent) delivers the PSTN call's audio (µ-law/PCM) over a WebSocket; call control (answer/originate/hangup) is the provider's REST/Call-Control API. This lands as a media-leg ingress — core-as-server, exactly parallel to the WebRTC ingress in ADR-0006 — resampled to the canonical tap format and fed straight into the reflex loop. Use the raw-audio fork, not managed Voice-AI products (Twilio ConversationRelay et al.) that perform STT/TTS for you and would consume the reflex loop that is rutster's differentiation.
2. Graduation (sovereignty / on-prem customers) — out-of-tree SBC adapter. When PSTN media must stay on the operator's infra, a mature C/Go SBC (Kamailio / FreeSWITCH / drachtio + rtpengine) sits outside the trust boundary and B2BUAs carrier SIP into rutster as clean RTP / tap-format media. The operator operates C; rutster parses none. This is ADR-0006's out-of-tree edge-adapter pattern, applied to trunks.
3. Never — a first-party Rust trunk SIP stack. rsip / ezk stay off the critical path. If a thin Rust SIP UA is ever wanted, it is a discretionary, out-of-tree experiment — never a core dependency or a blocker.

The only things rutster owns in Rust are the call model, the reflex loop, and the agent tap. Everything that touches a carrier is rented (layer 1) or out-of-tree (layer 2).

Topology

  carrier / PSTN          rented or out-of-tree            rutster trust boundary
  ──────────────►   ┌──────────────────────────┐   ┌──────────────────────────────┐
   SIP trunks,      │ layer 1: CPaaS raw-media  │   │ media (RTP/SRTP, str0m)       │
   far-end UAs      │   fork — NO SIP in rutster│──►│  + reflexes (VAD/barge-in,    │
                    │   provider API = control  │   │    jitter, pacing)            │
                    │ layer 2: out-of-tree SBC  │   │  + in-boundary spend/abuse    │
                    │   (C/Go) → clean RTP/tap  │   │  + clean audio tap ──► brain  │
                    └──────────────────────────┘   └──────────────────────────────┘
     SIP lives here — outside rutster, never first-party     no SIP parser, ever

WebRTC ingress (ADR-0006) is unchanged and remains the primary human-participant path; layer 1 adds a phone number without adding SIP.

What this costs (stated so we don't kid ourselves)

• Data-ownership / "terminate media once" dilutes for PSTN in layer 1. A CPaaS-forked PSTN call's audio traverses the provider's infra — the same property rutster criticizes in Vapi/Retell. What survives even in layer 1: WebRTC legs stay on your infra; the brain is self-hostable, so training data and model remain owned even when transport is rented; and layer 2 brings PSTN media back on-prem for buyers who require it. The wedge becomes a graduation, not a day-one guarantee — an honest narrowing the pitch must reflect (README competitor table + wedge bullet 2).
• A CPaaS dependency (billing, availability) for layer-1 PSTN. Mitigation: it is a config seam (provider-agnostic media-leg ingress), and the frontier work (reflexes, tap, brain) is built and demoed entirely on WebRTC, so nothing on the critical path blocks on any provider.

Memory-safety, restated honestly

ADR-0003's headline was "own a fuzzed Rust SIP parser → safe at the wire." ADR-0007's is stronger in one respect and weaker in another, stated plainly: rutster parses no SIP at all. Its entire first-party wire surface is WebRTC/RTP/SRTP (str0m) + the WebSocket tap/ingress protocol — all memory-safe Rust, fuzzed. The carrier-SIP interop tail lives outside the trust boundary (the provider's, or an out-of-tree SBC). The concession vs. 0003: layer 2 reintroduces C — but it is not first-party, not on the per-call hot path inside the boundary, and is widely-deployed, battle-tested infra the operator runs at the edge. rutster removes SIP from its own attack surface entirely rather than rewriting it safely.

Consequences

• Positive: the solo-years redirect from a trunk-SIP rewrite to the white space (contact-center domain + reflex/eval loop + the tap-as-open-protocol); no first-party SIP attack surface; no bus-factor-1 dependency on a young Rust SIP stack; a real phone number becomes a small rented integration, not the riskiest step; first-call still never blocks on SIP.
• Negative: PSTN data-ownership becomes a layer-2 graduation rather than a day-one property (the pitch must be re-scoped honestly); a CPaaS dependency for layer-1 PSTN; the "memory-safe SIP parser" talking point is retired.
• Mitigation: provider-agnostic media-leg ingress at a config seam; the sovereignty wedge is preserved as the out-of-tree SBC path; the frontier is demoed end-to-end on WebRTC regardless of trunk choice.

Relationship to ADR-0001 and ADR-0003

This re-converges with ADR-0001's correct instinct — don't own the interop tail; rent the hardened edge — while keeping ADR-0003's correct instinct — don't front your own media plane with a double-terminating shield. The synthesis: the rented transport delivers clean media straight to the tap/ingress, so there is neither a first-party SIP tail (0001's worry) nor a second in-boundary media termination (0003's worry). 0001 rented an SBC in front of rutster's own media plane; 0007 rents transport that replaces the need for a first-party trunk entirely, with WebRTC + the tap as the media spine.

References

• ADR-0003 — superseded (Rust-native trunk SIP)
• ADR-0001 — the original "rent the edge" instinct this re-converges with
• ADR-0002 — fused per-call vertical (the boundary this re-scopes)
• ADR-0006 — WebRTC-first ingress; out-of-tree edge-adapter pattern (applied here to trunks)