rutster/docs/adr/0002-north-star-and-fused-core.md

ADR-0002 — North star & fused per-call core

• Status: Accepted
• Date: 2026-06
• Origin: vision-revision §1–4, 6–7
• Amends: README.md, docs/ARCHITECTURE.md, docs/PORT_PLAN.md (the founding identity framing)
• Amended by: ADR-0009 — the pillar table's spend-gate phrasing ("structurally impossible for a 3-vendor stack") is retired post-0007; see 0009 for the gate's precise guarantees (2026-07-03)

Context

The founding docs anchored rutster to "memory-safe successor to Asterisk." A pressure-test of that anchor:

1. The PBX category is already consolidated/eaten — by UCaaS + Teams Phone. Feature-parity with a 1.18M-LOC C monolith is a solo-multi-year death-march into a shrinking market.
2. Asterisk's durable value is its place in the world — the self-hostable engine technical builders stand contact centers on (Vicidial, GOautodial, a thousand integrator builds) — not its protocols or its channel/bridge/dialplan architecture.
3. AI is actively disrupting telephony (voice agents), opening a self-hostable + AI-native slot that no incumbent fills: LiveKit has no contact-center domain; cloud CCaaS isn't self-hostable and bolts AI on; Vapi/Retell put your calls/data on their infra; Vicidial/FreePBX are Asterisk-era PHP+C.

"Spiritual successor to Asterisk" therefore means successor to its role, not its form.

Decision

1. North star

rutster is the open-source engine for building the AI-era contact center — AI-native, not AI bolted-on; self-hostable; owning the contact-center domain; memory-safe Rust. It is a framework/engine, not a turnkey product (Asterisk never tried to be Five9; it was the thing people built on). The moment it chases CCaaS GUI-parity, it dies. Asterisk's capability map (the PORT_PLAN) is a completeness checklist, explicitly not an architecture template.

2. Persona

The 2006 Linux-nerd-who-stood-up-Asterisk-for-an-SMB's modern equivalent: the CLI/IDE/AI-comfortable self-hosting technical builder who runs Claude Code in a terminal, versions everything in git, and self-hosts on principle. Not the no-code admin clicking a flow-designer canvas. This narrowing is deliberate for an engine, and it liberates the authoring layer — the audience codes and has an AI pair, so there is no "dumb it down" tax (see §8 of the vision-revision).

3. Architecture — fused per-call vertical + composable horizontal platform

The core owns the per-call vertical end-to-end as one deterministic, auditable trust domain:

carrier SIP trunk ─► media termination (RTP/SRTP + local real-time reflexes)
                        │
                        ├─► clean audio tap ──► external agent brain (STT/LLM/TTS)
                        │
                        └─► in-boundary spend / abuse gate

Horizontal platform concerns are services around the core, independently scaled: number inventory, billing rollup, analytics, multi-region orchestration, the management API, and the agent brain itself.

This replaces the founding three-plane framing:

• The control↔media gRPC hop on the per-call hot path is removed. Fusion where fusion buys determinism + security + simplicity.
• The spend gate and the agent tap — which founding docs externalized (a ☁️ Service and the app plane) — are pulled into the boundary, because they are constitutive of the wedge (a runtime can't structurally enforce spend/abuse control or barge-in if the media is elsewhere).
• It is neither monolith nor pure microservices: fused where fusion buys the wedge; composable where independent scaling matters.

4. Pillars re-weighted

Pillar	Change	Why
Memory-safety	▲ stronger	Now literally true at the wire once the C SBC edge is dropped (ADR-0003)
Security-as-product	▲ stronger	The single auditable boundary is the moat; compliance (PCI/HIPAA/TCPA) is a buying criterion
In-boundary spend / abuse control	▲ promoted	From "table-stakes service" to constitutive — structurally impossible for a 3-vendor stack
Data ownership	✦ new	Calls + training data never leave the operator's infra — the self-host wedge and the ML-loop fuel
WASM plugin sandbox	▼ demoted	Out of the core story. The agent tap is the extension point; ops-simplicity wants one binary. Softly retained as a candidate for community call-flow/routing plugins

Consequences

• Positive: sharper target than a consolidating PBX category; the wedge is a coherent combination (no-GC determinism + one auditable boundary + ops-simplicity) no one-competitor matches; the authoring layer can be powerful (the audience codes + has an AI pair).
• Negative: narrows TAM deliberately (an engine, not a product); must hold the line against scope creep toward Five9-parity (the GUI-as-pure-API-client discipline is a scope guard); the agent brain is necessarily external, so the real-time edge lives in the local reflexes (VAD/barge-in, jitter, pacing) + the whole boundary, not the brain round-trip.

References

• ADR-0003 — Rust-native trunk SIP (removes the C edge this reframe assumes)
• ADR-0005 — Valkey as bus + state store
• ADR-0006 — WebRTC-first ingress