rutster/docs/adr/0002-north-star-and-fused-core.md

# ADR-0002 — North star & fused per-call core

- **Status:** Accepted
- **Date:** 2026-06
- **Origin:** [vision-revision](../superpowers/specs/2026-06-26-vision-revision-design.md) §1–4, 6–7
- **Amends:** `README.md`, `docs/ARCHITECTURE.md`, `docs/PORT_PLAN.md` (the founding identity framing)
- **Amended by:** [ADR-0009](0009-spend-gate-honest-rescope.md) — the pillar table's spend-gate
  phrasing ("structurally impossible for a 3-vendor stack") is retired post-0007; see 0009 for
  the gate's precise guarantees (2026-07-03)

## Context

The founding docs anchored rutster to "memory-safe successor to Asterisk." A pressure-test
of that anchor:

1. The PBX category is **already consolidated/eaten** — by UCaaS + Teams Phone. Feature-parity
   with a 1.18M-LOC C monolith is a solo-multi-year death-march into a shrinking market.
2. Asterisk's durable value is its **place in the world** — *the self-hostable engine technical
   builders stand contact centers on* (Vicidial, GOautodial, a thousand integrator builds) —
   *not* its protocols or its channel/bridge/dialplan architecture.
3. AI is actively disrupting telephony (voice agents), opening a self-hostable + AI-native slot
   that no incumbent fills: LiveKit has no contact-center domain; cloud CCaaS isn't
   self-hostable and bolts AI on; Vapi/Retell put your calls/data on their infra; Vicidial/FreePBX
   are Asterisk-era PHP+C.

"Spiritual successor to Asterisk" therefore means successor to its **role**, not its **form**.

## Decision

### 1. North star

rutster is **the open-source engine for building the AI-era contact center** — AI-native, not AI
bolted-on; self-hostable; owning the contact-center domain; memory-safe Rust. It is a
**framework/engine, not a turnkey product** (Asterisk never tried to *be* Five9; it was the thing
people built on). The moment it chases CCaaS GUI-parity, it dies. Asterisk's capability map
(the PORT_PLAN) is a **completeness checklist**, explicitly **not** an architecture template.

### 2. Persona

The 2006 Linux-nerd-who-stood-up-Asterisk-for-an-SMB's modern equivalent: the **CLI/IDE/AI-comfortable
self-hosting technical builder** who runs Claude Code in a terminal, versions everything in git,
and self-hosts on principle. *Not* the no-code admin clicking a flow-designer canvas. This
narrowing is deliberate for an engine, and it liberates the authoring layer — the audience codes
and has an AI pair, so there is no "dumb it down" tax (see §8 of the vision-revision).

### 3. Architecture — fused per-call vertical + composable horizontal platform

The core owns the **per-call vertical** end-to-end as one deterministic, auditable trust domain:

```
carrier SIP trunk ─► media termination (RTP/SRTP + local real-time reflexes)
                        │
                        ├─► clean audio tap ──► external agent brain (STT/LLM/TTS)
                        │
                        └─► in-boundary spend / abuse gate
```

**Horizontal platform** concerns are services *around* the core, independently scaled: number
inventory, billing rollup, analytics, multi-region orchestration, the management API, and the
agent brain itself.

This **replaces the founding three-plane framing**:

- The **control↔media gRPC hop on the per-call hot path** is **removed**. Fusion where fusion
  buys determinism + security + simplicity.
- The **spend gate** and the **agent tap** — which founding docs externalized (a `☁️ Service` and
  the app plane) — are pulled **into** the boundary, because they are **constitutive** of the wedge
  (a runtime can't structurally enforce spend/abuse control or barge-in if the media is elsewhere).
- It is neither monolith nor pure microservices: **fused where fusion buys the wedge; composable
  where independent scaling matters.**

### 4. Pillars re-weighted

| Pillar | Change | Why |
|---|---|---|
| Memory-safety | ▲ stronger | Now **literally true at the wire** once the C SBC edge is dropped ([ADR-0003](0003-sip-rust-native-trunk.md)) |
| Security-as-product | ▲ stronger | The single auditable boundary *is* the moat; compliance (PCI/HIPAA/TCPA) is a buying criterion |
| In-boundary spend / abuse control | ▲ promoted | From "table-stakes service" to **constitutive** — structurally impossible for a 3-vendor stack |
| **Data ownership** | ✦ new | Calls + training data never leave the operator's infra — the self-host wedge *and* the ML-loop fuel |
| WASM plugin sandbox | ▼ demoted | Out of the core story. The agent **tap** is the extension point; ops-simplicity wants one binary. Softly retained as a *candidate* for community call-flow/routing plugins |

## Consequences

- **Positive:** sharper target than a consolidating PBX category; the wedge is a *coherent
  combination* (no-GC determinism + one auditable boundary + ops-simplicity) no one-competitor
  matches; the authoring layer can be powerful (the audience codes + has an AI pair).
- **Negative:** narrows TAM deliberately (an engine, not a product); must hold the line against
  scope creep toward Five9-parity (the GUI-as-pure-API-client discipline is a scope guard); the
  agent brain is necessarily external, so the real-time edge lives in the **local reflexes**
  (VAD/barge-in, jitter, pacing) + the *whole* boundary, not the brain round-trip.

## References

- [ADR-0003](0003-sip-rust-native-trunk.md) — Rust-native trunk SIP (removes the C edge this reframe assumes)
- [ADR-0005](0005-event-bus.md) — Valkey as bus + state store
- [ADR-0006](0006-ingress-posture.md) — WebRTC-first ingress