098814b734
Records the decisions from pressure-testing the four founding docs: - North-star reframe: the engine for the AI-era contact center, not an Asterisk-protocol successor (Asterisk's map = checklist, not template) - Fused per-call vertical + composable horizontal platform (tightens the three-plane model; removes the control<->media hot-path gRPC hop) - Rust-native trunk SIP, IP-allowlisted; drops the Kamailio/rtpengine C shield (reverses ADR-0001, to be formalized as ADR-0003) - Pillars re-weighted: +data-ownership, spend-control promoted to constitutive, WASM demoted out of the core story - Developer-first DX spine (config-as-code, AEL lesson, engine+batteries) - GUI as pure API client (FreePBX model) + k8s declarative/operational split - Sequenced thin-slice first proof + capability ladder For review before applying to README/ARCHITECTURE/PORT_PLAN and writing ADR-0002 (identity) and ADR-0003 (SIP). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RUtgQTo3wHGXP1TixHr4gd
Rutster
A memory-safe, API-first, security-first telephony platform — a spiritual successor to Asterisk for the WebRTC/microservices era, written in Rust.
Not a port of Asterisk. A reimagining that keeps the power — era-bridging breadth, "wire anything to anything," a deep feature library — while dropping the legacy hardware/dead-protocol half and fixing Asterisk's two chronic wounds: memory-safety CVEs and toll fraud, at the design level.
What it is / isn't
- Is: SIP (TLS-only) + WebRTC signaling, a real-time media plane (transcode / mix / DSP), a programmable call model exposed as a REST/gRPC API + event stream, a WASM-sandboxed plugin runtime, and a library of telephony features delivered as isolated services.
- Isn't: A TDM/PSTN-hardware PBX. No DAHDI, no Sangoma/Digium cards, no ISDN/SS7, no IAX2/H.323/SCCP/MGCP/Unistim. PSTN reach is via SIP trunks / SBC only.
Core design pillars
- Memory-safe by construction — Rust everywhere on the hot path; fuzzed, sans-IO protocol parsers. Eliminates the buffer-overflow/RCE CVE class.
- Isolation over in-process modules — extensions run in a WASM sandbox, not as
.sofiles in the daemon's address space. One bad plugin can't crash the box or read another tenant's media. (The Asteriskcore show locksera ends here.) - Secure & deny-by-default — mandatory TLS/SRTP, deny-by-default routing, built-in toll-fraud controls, mTLS gRPC admin (no plaintext AMI), hard multi-tenancy.
- Three planes, scaled independently — control / media / app. The media datapath stays tight; business logic is microservices and plugins around it.
- Observable & declarative — OpenTelemetry call traces across services;
config-as-data, not imperative
.conffiles edited on a box.
Layout
docs/ARCHITECTURE.md— the three-plane model and pillars.docs/PORT_PLAN.md— the spine: every Asterisk subsystem mapped to a disposition (core / plugin / service / edge-FFI / dropped) with rationale.
Status
Scoping. No code yet — the port plan defines the crate/service boundaries that the workspace will be scaffolded from next.
Open decisions
- License — undecided (Asterisk is GPLv2+commercial; rutster's model is TBD).
- SIP stack — FFI to pjproject vs. front with an SBC (Kamailio/drachtio) vs. a long-term pure-Rust stack. See port plan §1.
- WASM runtime —
wasmtimeis the presumptive default (component model).