Capability status and vision decisions
Rullstâs ambitious ideas are not deleted when an implementation is incomplete. They are kept here with an explicit status and an engineering recommendation. User-facing guides describe what can be used today; this ledger preserves the larger vision without presenting roadmap work as a production capability.
Status is evaluated against the current version 12 source tree, not against an old changelog entry or marketing description:
- Implemented: a real implementation and focused tests exist; deployment responsibilities may still apply.
- Partial: useful foundations exist, but the advertised end-to-end contract is not complete.
- Experimental: available only behind an explicit experimental/simulator boundary and carries no production guarantee.
- Not implemented: absent or intentionally returns a typed
Unsupportederror instead of simulating success. - Do not promise: the absolute claim is not a technically honest product contract; a narrower engineering goal may still be worthwhile.
The recommendation column is intentionally opinionated. âWorth implementingâ does not mean âput it in Coreâ: several excellent ideas belong in optional, independently tested crates. Ideas that additionally need continuous operations, homologation, or hardware can follow the Maybe SaaS incubation strategy.
Architecture and framework contract
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Runtime-only Core with optional ORM | Implemented in current hardening (keep validating) | Bare rullst-core now defaults to the HTTP/runtime surface without SQLx/ORM; orm and queue-sqlite are independent opt-ins. Studio and Nexus request their database features explicitly, while the application umbrella keeps orm and queue-sqlite in its default set for ergonomic compatibility. |
| Lifecycle-aware readiness and graceful request drain | Implemented / bounded per process | ApplicationLifecycle holds monotonic startup/ready/draining/stopped state, at most 32 immutable validated required-component bits, fail-closed request admission and a bounded wait for accepted requests. The lifecycle-aware /ready emits only phase/counts and becomes 503 for startup, dependency failure, lock corruption and drain while liveness remains process-only. Server marks ready after binding, begins drain before Axumâs graceful wait, marks startup failure/termination stopped, and exposes a caller-supplied shutdown future for supervisors/tests. Applications still run timeout-protected dependency checks, establish identity/authorization and operate replica, load-balancer, preStop and termination-deadline behavior. |
| One canonical security stack | Partial (composition risk mitigated; high priority) | Core and the extended crate now reuse one CspNonce, so nested header layers do not invalidate renderer output. Ownership is still split: the Server mounts Core CSRF/WAF/headers/PII while rullst-security supplies explicit RASP/DLP/abuse/telemetry layers. Introduce a Core stack contract implemented by the dedicated crate, then deprecate duplicates after parity tests; reversing the dependency directly would create a cycle. |
| Umbrella features for every advertised crate | Implemented in current hardening (keep tested) | The umbrella exposes optional security, iot, base mail and other domain features, restores the oauth/Connect re-export, keeps SMTP separate through mail-smtp, and has focused facade tests including payment-bound Capital/Mail composition. The extended security suite remains nested under security::runtime because its surface intentionally overlaps the Core baseline; CspNonce itself is already one shared type. |
| Static dispatch everywhere | Partial (do not force absolutely) | Preserve generic/static paths for common cases, but runtime provider registries legitimately need dynamic dispatch. Document each intentional dyn Trait boundary instead of pretending it does not exist. |
| A universal environment/configuration policy | Implemented (keep) | The validated environment model and fail-closed production startup use exact RULLST_ENV â legacy APP_ENV â file precedence. New .env, Kubernetes, Foundry and billing scaffolds emit/read the canonical name first; retain the alias for existing applications and keep negative configuration tests. |
| Every source file below 500 lines | Partial (worth continuous refactoring) | Keep 500 lines as a design target, not a release fiction. Split production modules by responsibility; large test fixtures can use a looser limit. |
Uniform #[non_exhaustive], fallible builders, and impl Into<String> | Partial (worth completing incrementally) | Finish this during SemVer-reviewed API work. Mechanical mass changes without compatibility review are not worth the risk. |
| âZero lock-inâ or complete automatic ejection | Do not promise (migration tooling is worthwhile) | Standard Axum/SQLx escape hatches and an inspected eject snapshot reduce coupling, but no full-stack framework can guarantee zero migration cost for every optional subsystem. |
| âZero panic/crash-free runtimeâ | Do not promise (the scoped policy is worthwhile) | Enforce typed errors and reject panic!/unwrap/expect in declared production paths. Dependencies, OOM, aborts, and host failures make an absolute runtime guarantee impossible. |
| âZero latency/zero allocation everywhereâ | Do not promise (benchmark instead) | Bounded allocation and latency goals are excellent, but only reproducible per-operation benchmarks should carry numbers. |
| ORM performance versus Diesel and SeaORM | Implemented reproducible bounded harness; no superiority claim | A pinned Criterion target runs five equivalent operations against typed SQLite with one connection per ORM, the same schema/index/100-row seed and identical SQLite policy. CI records Rullst, Diesel and SeaORM under the same commit/runner. The initial local smoke contradicted the historical ânegligible overhead versus Dieselâ claim, which is therefore rejected rather than marketed away. SQLite microbenchmarks do not establish networked database throughput, concurrency, memory, tail latency or full-application performance. |
â100% memory-safe/no unsafe anywhereâ | Do not promise (an unsafe allowlist is worthwhile) | Rust dependencies and the development FFI/hot-swap boundary contain reviewed unsafe. Keep the allowlist tiny, documented with SAFETY, and CI-enforced instead of hiding it. |
| â100% Pure-Rustls for every featureâ | Do not promise (a transport inventory is worthwhile) | Prefer Rustls-backed first-party clients, then inspect the complete feature-specific lockfile. Transitive and optional stacks make a universal brand claim brittle. |
| Static competitor matrix declaring other frameworks lack features | Do not maintain without dated sources | Comparative research can be useful, but ecosystems change quickly and absence claims are easy to get wrong. Prefer a Rullst capability/boundary matrix or a dated, sourced benchmark repository. |
| Framework-wide âproduction-readyâ label | Do not promise as one boolean | Publish stability per crate/capability. Routing can be stable while live fiscal or hardware integration remains unavailable. |
ORM and persistence
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| SQLx Active Record, transactions, migrations and relations | Implemented / bounded | Keep the PostgreSQL, MySQL/MariaDB and SQLite matrices. Executor-aware generated operations and explicit transaction handles have commit/rollback evidence; typed morph_to plus morph_many/morph_one cover declared SQLx polymorphic targets without a runtime type registry. Caller-owned raw SQL must use the supplied transaction rather than assuming pool calls are scoped. |
| Compile-time query typing | Implemented / bounded typed path | Generated primitive-field filters require the persisted Rust value type and generated column enums reject unknown columns. Dynamic string-column builders, custom conversions and raw SQL intentionally remain runtime checked; do not describe them as SQLx query!-style live-schema verification. |
| Native relational enum mapping | Implemented / bounded per SQLx profile | #[derive(Enum)] owns one validated label mapping for Serde, string/RullstValue conversion and SQLx encode/decode. Blueprint::native_enum creates and exact-drift-checks a named type on strict-postgres, emits inline ENUM on MySQL/MariaDB, and emits TEXT CHECK on SQLite. SQLx Any PostgreSQL is rejected before DDL because it cannot decode custom types. Adding, removing or reordering variants, deployment ordering and PostgreSQL type removal remain reviewed migration work. |
| Fail-closed model tenant scopes | Implemented / bounded | tenant_column now requires a supported persisted field, denies queries/mutations without with_tenant, binds tenant predicates and rejects cross-tenant instance mutations. Keep unscoped() explicit and require application authorization/database RLS where appropriate. |
| Stable large-table chunk traversal | Implemented / bounded | Use fallible chunk_by_id for ascending keyset traversal over generated i32 IDs; deleting processed rows cannot shift later rows behind an offset. chunk remains offset-based, and neither API claims a server cursor, cross-shard snapshot or immunity to unbounded concurrent inserts. |
| Automatic schema synchronization and destructive migration | Partial | The SQLite AST diff is a useful reviewed scaffold. Do not claim universal type-safe synchronization, autonomous DDL, backup or rollback; add backend-specific plans and approval gates before expanding it. |
| Strictly post-commit hooks/search/cache invalidation | Implemented / bounded process-local contract; durable use is explicit | after_commit, generated committed observers, Redis table-cache invalidation/pub-sub and Scout projections run after direct generated or Orm::transaction commit; rollback drops them and PostCommit distinguishes a failed effect after durable persistence. A raw caller-owned SQLx transaction cannot reveal its later commit decision. These hooks are intentionally not converted to durable events without an application-selected schema/payload/policy. |
| Durable relational transactional outbox | Implemented / bounded opt-in primitive | Outbox::enqueue refuses independent commit and writes an idempotent event with the domain transaction; OutboxMigration supplies reviewed schema registration. PostgreSQL, MySQL, MariaDB and SQLite live matrices cover commit, rollback, duplicate reuse, claim and ACK. SQLite regressions additionally cover conflicting key reuse, stream isolation, exact/unexpired claim tokens, concurrent claim exclusion, lease recovery, bounded retry and dead-letter. Delivery is at least once: consumers must be idempotent, and automatic observer/webhook dispatch, tenant authorization, cleanup, cross-store transactions and distributed operations remain application boundaries. |
| Native external search and Qdrant | Implemented / bounded per adapter | scout-http supplies Meilisearch, Elasticsearch and Algolia projection/search adapters; only Meilisearch has a live service lifecycle. Separately, qdrant supplies bounded dense-vector create/upsert/delete/cosine query operations, deterministic fallback, authenticated protocol fixtures and a digest-pinned live lifecycle. Generated Scout projection durability, hosted-provider certification, arbitrary Qdrant filters/vectors and ANN tuning remain explicit. |
| Native Redis data structures | Implemented / bounded Hash, Set and Sorted Set contract | redis supplies an immutable application namespace, validated inputs, bounded reads, TLS-required remote configuration, redacted ACL credentials and deterministic fallback. A pinned live lifecycle proves hash increments, set membership/scan, sorted ranking, exact structure deletion and namespace isolation. Lists, Streams, Pub/Sub durability, cluster/failover, eviction and tenant authorization are not implied. |
| Typed PostgreSQL pgvector queries | Implemented / bounded feature-gated contract | pgvector plus strict-postgres exposes SQLx-compatible Vector and parameterized L2/cosine/inner-product helpers. A digest-pinned live matrix installs the extension, inserts typed values and executes bounded similarity queries. Embedding policy, ANN index tuning, RAG orchestration, authorization and production topology remain application/deployment work. |
| Polyglot MongoDB, DuckDB, Turso and SurrealDB boundary | Implemented / bounded per adapter, with application-operated document recovery | Keep document, OLAP, SQL and graph capabilities separate, with bounds and deterministic offline modes. MongoDB, SurrealDB and the deterministic store now retain IDs through DocumentInventory; an AES-256-GCM envelope binds key ID/application/collection, caps documents/bytes, compares two source observations, resumes only into an exact subset and verifies the final inventory. The live matrix crosses MongoDBâSurrealDBâMongoDB. Applications must quiesce writers and own key/snapshot durability; this is not online snapshot isolation, a universal Active Record facade, managed backup, replication or a cross-store transaction. |
| Transparent edge replication and latency guarantees | Not implemented | SQLx read replicas can be configured, but Turso synchronization, health/failover and consistency remain vendor/deployment concerns. Benchmark measured topology; never promise â1 msâ universally. |
| Historical ORM roadmap completeness | Fully classified, not fully implemented | All 45 unique former [x] claims are individually classified in v12.md: 28 bounded integral contracts/evidence items and 17 partial. The comparative benchmark is delivered evidence whose first result refuted, rather than confirmed, the historic performance wording. Continue from that evidence instead of restoring duplicate/absolute roadmap text. |
Capital, billing, and fiscal vision
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Deterministic offline DPS/NFS-e preview | Implemented (mock only) | It is clearly typed as unauthorized and remains useful for UI/workflow development. |
| Local NFS-e 1.01 preparation | Implemented / bounded | Checksum-pinned official production/restricted artifacts, strict ordinary-service DPS construction, and closed-catalog validation. After hash verification, one known production DPS-series regex receives an exact documented .NET-anchor compatibility normalization; no other source rewrite is allowed. Protected PKCS#12 parsing, enveloped inclusive-C14N/RSA-SHA256 XMLDSig with local independent verification, signed-tpAmb binding, deterministic GZip/Base64 request JSON, strict signed-authorization and structured-rejection parsing, and bounded rustls mTLS client construction complete the local boundary. A single-active-writer HMAC-chained journal synchronizes idempotent prepared/terminal digests, recovers minimized pending descriptors and supports external exact-tip checkpoints without retaining XML, access keys or response messages. This is cryptographic/schema/protocol/local-recovery preparation, not tax authorization or certificate trust. |
| Live NFS-e Nacional issuance with authoritative request/outbox storage, restricted-environment evidence, and SEFIN homologation | Partial; transmission disabled (extraordinary and worth implementing conditionally) | The local command journal is implemented but does not transport, retry, provide a distributed lock or store the actual request. Live issuance still requires deployment-owned outbox/reconciliation, an authorized official test environment, real A1 certificate/emitter and ICP-Brasil lifecycle checks, municipality/contributor parameters, retained official protocol fixtures, independent review and legal/protocol maintenance. Do not rush it into a generic payment adapter or infer authorization from local validity. |
| Alipay RSA2 signing and verification | Not implemented (worth implementing only with real demand/partner access) | Use audited RSA primitives, official canonical parameter rules, replay tests, and provider sandbox contract tests. HMAC fixtures must never masquerade as RSA2. |
| Uniform live support across all advertised gateways | Partial (worth a capability matrix) | Keep the adapters, but publish method-by-method support and provider contract tests. An adapter name must not imply checkout, subscriptions, payouts, portal, tax, and webhook support all exist. |
| Shared outbound gateway failure policy | Implemented / bounded | Reviewed live methods use finite connect/request timeouts, disabled redirects and ambient proxies, one-MiB JSON decoding and credential-free HTTPS checkout URL validation. Redacted typed evidence distinguishes permanent, transient and rate-limited failures without automatic mutation retries. Durable provider-forwarded idempotency, backoff/attempt policy, reconciliation, explicit proxy configuration and live acceptance remain application or future adapter work. |
| Axum and Actix signed-webhook middleware | Implemented / bounded, with opt-in shared SQL replay | Both adapters bound the raw body, call one provider-aware verifier before dispatch, restore the exact body, insert a normalized event and enforce the configured replay store. webhook-sql adds immutable bounded shared claims over SQLite/PostgreSQL/MySQL/MariaDB, with restart, contention, drift, capacity and four-protocol live evidence; a stable event claim can share the callerâs relational domain transaction. Middleware payload admission happens before dispatch and therefore is not exactly-once processing. Cross-system effects still require outbox/idempotent-consumer/reconciliation contracts. |
| Subscription handle and grace-period value | Implemented / bounded | SubscriptionHandle<P> validates and redacts its identifier and delegates cancel/pause through an explicit statically dispatched provider (with a global-provider compatibility path). GracePeriod is a fallible half-open Unix-time window capped at 366 days; Billable and its derive can carry a complete optional pair. The application still owns authoritative loading, authorization, trusted time, persistence, entitlement checks, scheduling/retry and provider-specific live behavior. |
Immediate Billable charge | Implemented / bounded for reviewed Stripe Payment Intents | charge_with/charge require integer minor units, normalized currency, explicit provider customer and tokenized payment-method IDs, validated model e-mail and a bounded idempotency key. Stripe forwards that key and confirms off-session; its response must match amount/currency and report succeeded or processing. Exact mock retries are deterministic but carry the distinct non-success Mock status; request/receipt debug views redact identity. Other providers return UnsupportedOperation; mandate/SCA setup, durable idempotency, webhook reconciliation, entitlement changes and live sandbox evidence remain application/deployment work. |
| Stripe/Lemon Squeezy metered usage | Implemented / bounded provider-specific API | MeteredBillingProvider uses StripeMeterEvent for the current Stripe Meter Events form contract and LemonSqueezyUsageRecord for the current Lemon Squeezy JSON:API relationship/action contract. Both validate positive bounded usage, cap responses, bind provider echoes, redact identities and supply deterministic non-live mocks. Stripe gets a rolling-window identifier; Lemon requires the application to claim its event key in a durable outbox because the reviewed provider request has no equivalent key. Live-account acceptance, retries, aggregation configuration, reconciliation and entitlements remain external. |
| Coupon application and relative trial extension | Implemented / bounded provider-specific API | CouponCode is bounded/redacted. Stripeâs current expanded-discount update is bound to subscription and coupon; Lemon Squeezy and unreviewed live adapters fail explicitly because its discount code belongs to checkout. TrialExtension makes extend_trial(15) a 1â730-day operation; Stripe and Lemon Squeezy protocol fixtures bind the returned subscription/expiration, with an explicit-clock retry path. The host owns authorization, stable command time, serialization, webhook reconciliation, billing-cycle policy and live-account evidence. |
| Shared team/workspace resource quotas | Implemented / bounded, with opt-in durable SQL store | BillingSubject::from_tenant binds shared accounting to trusted tenant context and Billable::quota_request derives the limit from the subscription owner. QuotaGate reserves before executing, suppresses exact replay and compensates ordinary operation failure. quota-sql uses a unique event claim plus conditional counter update; SQLite and live PostgreSQL/MySQL/MariaDB concurrency contracts stop exactly at the shared limit. Applications own membership/authentication, tier persistence and reconciliation, migrations, stale-reservation operations and non-relational adapters. Arbitrary domain writes are atomic only when performed through the same caller-owned SQL transaction. |
| Payment-bound invoice PDF and mail delivery | Partial historical automation; implemented bounded bridge | invoice-pdf validates the compatibility invoice into exact minor units and renders bounded paginated PDF with embedded WinAnsi or a caller-supplied checked font. PaidInvoice requires final Succeeded evidence matching recipient, amount and currency; Mailâs opt-in bridge attaches the PDF, runs pre-flight and sends through the facade or a static driver. Its stable non-secret key is intended for an application-owned outbox. No webhook is inferred, no key is claimed transactionally, provider acceptance/attachment parity vary, and exactly-once delivery is not promised. |
| Durable cross-instance webhook idempotency/replay store | Implemented / bounded relational contract | The opt-in webhook-sql store persists bounded provider-scoped payload digests or stable event keys on SQLite, PostgreSQL, MySQL and MariaDB with immutable capacity/TTL, database-time serialized claims, expiry, restart, contention and fail-closed drift/storage/full-state evidence. Middleware admission is not exactly-once; atomic domain mutation requires the caller-transaction event-key path, and cross-system effects still require an outbox and reconciliation. |
| Static fee, settlement, and tax promises in framework docs | Do not promise | Provider terms and regional availability change. Link to official current terms and document only what the adapter itself implements. |
| âZero-cost invoicingâ | Do not promise | Removing an intermediary fee does not remove certificate, accounting, infrastructure, support, or compliance cost. Preserve cost transparency without advertising zero total cost. |
IoT, edge, and cryptography vision
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
no_std telemetry/frame helpers | Implemented (keep focused) | This is a credible small foundation. Preserve the lightweight, transport-neutral core. |
| Ed25519-signed OTA manifest, firmware hash, and monotonic verification gate | Implemented (foundation only) | Keep negative vectors and anti-rollback tests. The gate is not a firmware installer. |
| Persistent anti-rollback counter, download, flash, bootloader slot selection, rollback, and commit | Partial: store contract implemented; platform path absent | The no_std adapter requires exact monotonic compare-and-set and has restart/retry/conflict tests. A concrete store, download/flash path, bootloader coordination and power-loss/fault-injection evidence remain essential before calling OTA end-to-end. |
| MQTT 5, CoAP, and Sparkplug B transport | Packet helpers implemented; transport not implemented (worth a separate transport crate) | The no_std crate now encodes one bounded MQTT 5 PUBLISH packet and RFC 7252 base requests with protocol/boundary vectors. Connections, TLS/DTLS, acknowledgement/retransmission state, broker/LwM2M/Sparkplug semantics and interoperability remain absent; network runtimes should not bloat the frame crate. |
| Hardware HSM/secure-element backends | Not implemented; simulators are experimental (worth adapter traits, later) | Implement only against named hardware/PKCS#11 interfaces with device tests. Never create home-grown âHSM-likeâ hashing and call it secure. |
| NIST ML-KEM/post-quantum encryption | Not implemented; simulators are experimental (worth later, not home-grown) | Adopt an audited implementation only when a concrete protocol and threat model justify it. A generic âquantum-safeâ badge is not worthwhile. |
| CAN/J1939, LoRaWAN, GPIO/I2C hardware integration | Not implemented or helper-only (worth separate hardware packages) | Preserve the idea, but require target boards, interoperability fixtures, and maintainers for each protocol. |
| Embassy async executor integration | Not implemented (worth implementing after the transport split) | Valuable for embedded ergonomics once the no_std ownership and timer/network abstractions are stable. |
| Actual QEMU/hardware-in-the-loop CI | Not implemented (worth implementing with real runtime code) | Merely compiling a target is not QEMU testing. Add it when there is boot/flash behavior to execute and assert. |
| Aerospace/autonomous-vehicle/defense framework claims | Not implemented (do not place in the web-framework Core) | The idea is ambitious, but safety-critical systems need independent standards, certification, hardware, and governance. Consider a separate future project only after the IoT foundation is mature. |
Connect, real-time, queues, storage, and data
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| OAuth2/OIDC/social-login providers | Implemented (keep as Connectâs current identity) | Continue issuer, redirect, JWKS rotation, offline-fixture, and negative-token contract testing. |
| Signed local OIDC identity-provider fixture | Implemented / bounded for explicit Axum loopback tests | A validated concrete router binds one registered client and callback, keeps authorization codes expiring/one-shot in a 64-record process-local store, verifies optional S256 PKCE, carries nonce into a deterministic-fixture EdDSA ID token, publishes discovery/JWKS and accepts only issued unexpired bearer tokens at userinfo. A real loopback test drives the production OidcProvider through discovery, authorization, token exchange, JWKS verification and replay rejection. The private signing material and credentials are intentionally public/predictable fixtures. It is not safe to expose, has no interactive login/consent, refresh/device/federation lifecycle, durable state, key rotation or OIDC certification. |
| Server-bound OAuth/OIDC callback challenge | Implemented / bounded for Axum + tower-sessions | begin_oauth_session stores state + PKCE and begin_oidc_session additionally stores nonce for ten minutes. AuthSession removes and immediately saves the one active challenge before constant-time state validation and returns borrowed ExchangeParams; sequential replay, expiry, mismatch, replacement and redacted-debug negatives are tested. The host still owns a durable session store, secure cookie/TLS configuration, account linking, recovery and live-provider conformance. One active challenge per browser session deliberately means a second login invalidates the first. The generic store API is not a distributed compare-and-delete, so simultaneous already-loaded callbacks require idempotent effects or an application atomic-challenge adapter. |
| Credential-safe normalized OAuth profile | Implemented / bounded | ConnectUser::universal_profile() emits only normalized identity fields. Serde on ConnectUser omits access and refresh tokens; applications must use a dedicated encrypted store for credential lifecycle rather than serializing the whole response as a session. |
| Automatic OAuth token refresh | Implemented / bounded process-local coordinator plus optional shared-local encrypted state | RefreshableTokenState validates and redacts access/refresh credentials, lifetime, trusted receipt time and provider user identity. AutoRefreshingSession<P> uses static dispatch, a bounded early-refresh window and one async mutex to prevent overlapping refresh calls; callers waiting behind a successful refresh reuse it. The coordinator retains an unrotated refresh token, adopts a valid rotation, binds the returned user and swaps state only after validation. EncryptedTokenSnapshot supplies a bounded versioned AES-256-GCM envelope whose tag binds an explicit rotation key ID, provider and trusted local-account identity. The opt-in SQLite store persists only a pseudonymous binding digest, generation/key metadata and ciphertext under an immutable quota; serialized transactions and exact-successor CAS reject stale local writers, with restart/contention/corruption evidence. The application still owns the remote-provider lease and losing-call reconciliation, key/directory/backup operations, authorization, multi-host replication, retry/backoff, revocation and reauthentication. Providers without refresh fail explicitly. |
| Explicit corporate proxy for OAuth/OIDC | Implemented / bounded HTTP(S) transport | ReqwestClient accepts an authority-only explicit proxy or separately supplied Basic credentials, disables ambient system-proxy lookup and requires HTTPS for authenticated non-loopback endpoints. A loopback protocol fixture proves routing and proxy authorization. PAC/WPAD, SOCKS, proxy mTLS and production network certification remain deployment/roadmap work. |
| Brokered messaging / old Connect Phase 9 | Partial bounded foundation in rullst-messaging | The separate crate now provides a versioned envelope, bounded idempotent publication, groups, leases, retry/DLQ, explicit purge, deterministic in-memory broker, canonical bounded envelope codec, allowlisted W3C trace context and fixed-schema local SQLite. SQLite can immutably select plaintext or AES-256-GCM header/payload protection with row-bound AAD and bounded rotation; raw-state/restart/tamper/row-swap/two-instance tests are executable. An opt-in static ORM relay publishes committed outbox claims with their stable event key and proves exact replay across the publish-before-ACK crash window. Routing/idempotency metadata remains visible, delivery remains at least once, neither relay nor codec creates an atomic remote transport, and replication plus RabbitMQ, Kafka, Redis Streams, NATS/JetStream, SQS/SNS, Google Pub/Sub and Pulsar adapters are not implemented. |
| WebSocket pub/sub and SSE | Implemented in Core, not Connect (do not duplicate) | Re-export through a coherent facade if desired; one runtime implementation is better than competing copies. |
| Bounded Memory/SQLite/Redis queues with recoverable leases | Implemented / bounded | SQLite and Redis additionally persist dispatch_at timestamps for at most 366 days and never claim them early; Redis server-time promotion has a digest-pinned live contract. Execution is poll-dependent and at-least-once. Continue dead-letter observability, graceful shutdown, and multi-worker fault tests. |
| NATS JetStream, SQS/SNS, and GCP Pub/Sub | Not implemented (worth demand-driven optional adapters) | Define one queue conformance suite first; add providers only when each can pass the same delivery/lease/idempotency semantics. |
| Authenticated tenant-local storage namespace | Implemented / bounded in Core | TenantStorage is constructed from a validated TenantContext, prefixes keys with an immutable canonical tenant root and reuses traversal/symlink protections. An exact local test stores the same logical key under two authenticated tenants without interference. Academy attachment/media integration, remote bucket policy and cross-backend conformance remain open. |
| Authenticated tenant cache namespace | Implemented / bounded in Core | TenantCache is constructed from a validated TenantContext, validates logical keys, applies an immutable namespace for memory or Redis-backed Core caches and deliberately exposes no global flush. Exact same-key non-interference is tested locally. Academy cache integration, Redis cluster/failover and application-wide conformance remain open. |
| Authenticated tenant realtime namespace | Implemented / bounded in Core | TenantRealtime and TenantPresence bind shared in-process broadcast/presence managers to validated TenantContext, validate logical channel/event/identity names, cap payloads at 64 KiB and prove that the same room name in two tenants does not interfere. The Academy notification scaffold composes an owner/admin-authorized tenant/user subscription and best-effort post-commit projection. Broader room authorization, distributed transport/liveness and other application integrations remain application/roadmap work. |
| S3 and Cloudflare R2 storage | Not implemented (worth optional remote-storage crates) | Useful and commercially relevant. Use official/signed clients, path/key constraints, multipart and retry semantics, and deterministic mocks; do not put fake success in the local facade. |
| Upload admission and quarantine contract | Implemented / bounded, storage-agnostic | Core validates bounded in-memory bytes against tenant/name/size/type policy, recognized signatures, MIME/extensions and active-text denial, produces a randomized tenant quarantine key plus SHA-256, and releases only after a clean scanner verdict. The bundled scanner is deterministic and mock-only. Multipart streaming, sandboxed deep parsing/transcoding, S3/R2 movement, archives and a production malware adapter remain open. |
| Image resize pipeline | Not implemented (worth an optional media crate, not Core) | Media decoding expands attack surface and binary size. Isolate it with strict size/pixel limits and fuzzing. |
| Transparent SQLite/Turso/database replication | Not implemented (do not implement generically in Core) | Integrate vendor-specific replication clients or sidecars. A generic timer that prints âsyncingâ cannot provide consistency semantics. |
| Immutable/zero-copy distributed ledger engine | Not implemented (interesting, but lower priority) | First define the exact consistency, persistence, recovery, and audit use case. The current HMAC audit chain is not a distributed immutable ledger. |
Security, authentication, Studio, and Nexus
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Versioned AES-256-GCM field encryption | Implemented (keep) | Keep envelope versioning, AAD, random nonces, key rotation, and round-trip/negative tests. Key custody remains external. |
| Canonical browser security baseline | Implemented / bounded in Core | apply_security_baseline is the same composition used by Server: it installs the exact application config outside secure headers/CSP nonce, explicit-origin CORS with separate credential opt-in, WAF, double-submit CSRF and optional PII masking in a stable order. Configuration rejects wildcard/path/query/credential/duplicate CORS origins and malformed CSP/SameSite state. In-process HTTP tests prove matching renderer/header nonce, secure CSRF cookie and write denial/acceptance, preflight allowlist and no grant for a foreign origin. Tune policy per application and test the final browser/proxy/TLS deployment; never promise a universal third-party A+ score. |
| âOWASP A+ guaranteedâ | Do not promise | A scanner grade depends on the final page, proxy, cookies, TLS, and deployment. The worthwhile goal is a strict tested baseline, not a badge guarantee. |
| Bounded body-aware WAF/RASP and DLP | Implemented (defense-in-depth) | Keep content-type, streaming, compression, overflow, and header-consistency tests. Never position heuristics as a replacement for parsers, binds, validation, or authorization. |
| Distributed rate limiting | Implemented foundation / external proof pending | rullst-security/redis-rate-limit uses one atomic Redis script, namespace validation, hashed client keys, TTLs and typed fail-closed errors. Empty/mock_* configuration is explicitly process-local and require_distributed() rejects it. Real Redis cross-instance, eviction/failover and trusted-proxy deployment tests remain release work; the legacy no-argument selector stays Unsupported. |
| Deterministic threat assessment and proof of work | Implemented / bounded locally; autonomous AI claim remains partial | Transparent thresholds classify three caller-supplied aggregate patterns and can issue an authenticated, subject-bound, expiring challenge with bounded difficulty/capacity and atomic one-shot verification. Rullst does not collect the aggregates, attribute botnets, block autonomously or share replay state across processes; accessibility, identity, distributed enforcement and DDoS architecture remain host concerns. |
| Route-scoped JSON Schema/OpenAPI body enforcement | Implemented / bounded | JsonSchemaPolicy compiles one JSON Schema 2020-12 document or selected OpenAPI 3.1 component, caps schema bytes/nodes/depth, rejects external references, disables filesystem/network retrieval and uses linear-time regexes. The Axum layer composes exact JSON transport checks and returns a value-free 422 on mismatch. It does not infer schemas from arbitrary routes or replace auth, ownership, domain validation, or query/header/form contracts. |
| Durable tamper-evident audit storage | Partial (worth implementing as a sink interface) | Canonical HMAC sequencing exists. Durable append-only storage, key protection, retention, and independent verification remain application/integration work. |
| Versioned local security-event envelope and spool | Implemented and bounded (v1/local) | LiveSecurityEvent has a frozen six-field v1 contract, a packaged JSON Schema, normalized identifiers/IPs/timestamps, a 2 KiB UTF-8 detail limit, and CEF field escaping. DurableSiemSpool preserves the compatible unsigned SHA-256 format. The opt-in AuthenticatedSiemSpool adds a domain-separated HMAC-SHA256 sequence/predecessor chain, one active plus seven historical named zeroized keys, exact byte/record quotas, restart validation and fail-closed forgery, wrong/missing-key, interior deletion/reordering, symlink, external-change and uncertain-durability behavior. A separately trusted checkpoint is required to detect valid-tail rollback; trusted directory/key custody, permissions, rotation retirement, retention, backup, multi-process exclusion, delivery, retry, acknowledgement, dead-letter handling and external SIEM adapters remain application/operations work. |
| Full normative WebAuthn server | Partial; durable local device lifecycle implemented | The implementation checks the documented ES256/none-attestation ceremony invariants. The opt-in SQLite store adds bounded credential inventory, rename/revocation, restart persistence and atomic counter CAS shared by local processes. Challenge state remains process-local, and an audited library or a full conformance suite is preferable to indefinite custom protocol ownership. |
| TOTP recovery codes | Implemented cryptographic foundation / workflow pending | Security generates subject-bound 80-bit codes, returns plaintext only at enrollment, serializes salted HMAC verifiers, compares in constant time and removes a consumed verifier. The application must encrypt the TOTP secret, persist verifier consumption atomically, rate-limit attempts and own enrollment/recovery UX and audit. |
| TOTP enrollment and Login Jail | Implemented / bounded in-process | MFA secrets contain 160 bits from the OS RNG, verification is constant-time and enrollment can emit a real bounded SVG QR. LoginGuard::record_login_failure_and_wait both records and awaits the progressive tarpit. The host must protect/encrypt the secret and persist/distribute abuse state where required. |
| CLI security evidence tools | Implemented with bounded analyses | SBOM output parses Cargo metadata into CycloneDX 1.5 fields with a valid UUID; the doctor parses the real Rust version against MSRV; requested Geiger/SBOM/network checks now fail on findings or incomplete execution, and hooks run all-feature Clippy plus unsafe/IDOR source checks. These are evidence producers, not certification, attestation or static-analysis completeness proofs. |
First-class application JWT service in rullst-auth | Implemented / bounded shared local option | The opt-in jwt feature centralizes issuer/audience, required versioned claims, bounded TTL/scopes, strong HS256 keys, kid rotation and sync/async revocation contracts. Production verification rejects the bundled process-local store. The sqlite profile adds a quota-bound shared local adapter with serialized JTI/session-version mutations, expiry pruning, configuration-drift checks and restart/two-instance evidence. Multi-host replication, database encryption/backup/availability and refresh-token workflows remain deployment/application work. |
| Nexus open-by-default admin | Removed; hardened Nexus is implemented | Keep fail-closed construction, TLS boundary, role/field policy, ownership integration, and rate limits. Production readiness still depends on the host application identity model. |
| Nexus registered-model CRUD and batch actions | Implemented / bounded | #[derive(Nexus)] generates tested metadata for named-field models; primitive widgets are inferred and enum/textarea semantics are explicit. try_build() bounds and validates model, field, primary-key, enum, relation and optional text-tenant metadata. Mutation forms accept at most 256 pairs, bound short/long values to 4/64 KiB, reject unknown/protected fields and parameter pollution, normalize Boolean controls and validate registered enum, JSON, number, date, e-mail and HTTP(S) URL semantics before bound SQL. Sort/search identifiers are registry-allowlisted, batch delete/deactivate is capped at 1,000 selected IDs, and metadata is escaped at HTML boundaries. Tenant-scoped models bind every built-in read/mutation/batch to a trusted Core TenantContext, inject it on create and deny missing context; models without the metadata remain global. with_required_audit couples minimized committed-mutation evidence to the same transaction and fails closed when its fixed schema is unavailable. Deactivation is available only for a writable Boolean is_active/active; external enum reflection, multiline inference, host identity/membership, within-tenant ownership, global/custom-route authorization, database schema/type compatibility and privileges remain host contracts. The same-database audit table is mutable, not append-only/tamper-evident, and host retention/backup/replication/immutable export remain external. |
| Autonomous AI admin that can mutate production data | Not implemented as a safe contract (do not enable by default) | A read-only, explainable assistant is worthwhile. Mutations need explicit human approval, scoped capabilities, audit records, dry-run previews, and rollback. |
| Studio with real telemetry | Implemented with bounded authenticated ingestion and unavailable states | Linux and Windows expose delta-based process CPU alongside RSS, Tokio and local span probes; KPI cards poll the local JSON source. Each separately mounted push-only router binds one producer name/key, accepts only bounded attribute-free v1 spans after exact-body/source HMAC, clock-window and atomic nonce-replay checks, then stores them in bounded process memory. The viewer derives 100 ms slow-label and three-repeat possible-N+1 heuristics without SQL text or bindings. This is not OTLP, durable trace storage, remote Studio access or proof of a defect. The local capability still verifies peer plus local Host, and same-origin Origin on mutations. Queue/revenue/security/AI panels expose only supplied state; unsupported operations, disconnected transports and the absent standalone migration registry fail explicitly. Keep the viewer local by default and never fabricate values for missing sources. |
| Studio data/API/queue/cache/config tools | Implemented with bounded partial surfaces | The SQLx browser reads/filters and, behind the unforgeable verified-local request marker, mutates one primitive non-key value or deletes one complete-PK-selected row with exact confirmation. Tables/columns come from inspected allowlisted schema, values are typed/bound, bodies are capped, exactly one row must change, and live SQLite/PostgreSQL/MySQL/MariaDB matrices cover the contract. Backend-specific types, tenant/RBAC, audit, rollback and shared production access remain outside it. Swagger requires a supplied OpenApi; SSE records method/URI/status/latency without secret-bearing bodies/headers. SQLite removes successful jobs by default or explicitly retains 1â100,000 for the real queue snapshot with atomic pruning and purge; retained payload access/policy belongs to the host, and Redis/custom queue inspection remains capability-specific. An explicitly supplied memory or Redis cache returns metadata only; Studio limits display to 100 opaque HMAC identifiers with size/TTL and permits only individual verified-local invalidation. Values, exact keys and bulk flush remain absent; custom cache drivers fail explicitly until they implement inspection. A successful Studio flag toggle immediately invalidates warm DbFeatureDriver caches in the same process through a constant-size epoch; other processes/direct writers remain TTL-bound without application pub/sub. Relational ER metadata uses parameterized lookups and normalized Mermaid identifiers. Environment values are deny-by-default redacted and typed config omits URLs, paths and secrets. |
| Studio automatically stripped from every release with zero overhead | Do not promise | Feature selection and route mounting determine inclusion. Explicit compile features are clearer than relying on a universal debug/release assumption. |
| Threat Radar with external reputation and verified audit feeds | Partial (worth pluggable connectors) | Local counters exist. External intelligence, durable audit verification, and SIEM delivery should appear only when a source is connected and healthy. |
| â100% OWASP coverageâ, âtamper-proofâ, or âzero-leak DLPâ | Do not promise | These absolutes are not provable framework properties. Preserve the controls and publish exact threat-model/test scope. |
| Automatic SOC 2/ISO/FedRAMP certification | Do not implement as a PASS generator | The evidence exporter is worthwhile; certification evaluates the whole organization and deployment. Emit PASS, FAIL, SKIPPED, or NOT_EVALUATED from real checks only. |
AI and mail
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| DeepSeek provider | Implemented | Keep it in the same provider contract and offline mock suite as the other cloud adapters. |
| Mandatory prompt-injection/PII guardrail pipeline | Implemented in the high-level client and built-in provider transports | The versioned deterministic offline corpus fixes implemented injection/jailbreak/PII regressions across built-in transports. Custom low-level providers remain an explicit extension boundary; heuristics and this corpus cannot prove a prompt safe. AdaptiveAiEvaluator<P> now supplies bounded multi-turn evaluation orchestration, but operators still own the domain corpus and exact live-model execution/review. |
| Adaptive AI evaluation | Implemented / bounded runner | A static-dispatch strategy can use one bounded response to choose its next prompt under turn, prompt/response, deadline and cancellation limits. Results distinguish pass, fail and inconclusive and serialize only low-cardinality metadata without raw prompts/responses/provider errors. Deterministic fixtures prove orchestration, not the safety or quality of a live model; the caller-supplied subject label and scenario assertions require operator governance. |
| Tenant-bound RAG orchestration | Implemented / bounded | RagPipeline::answer composes guarded embedding, a static application retriever, Unicode-safe context budgets, guarded generation, source metadata and mandatory secret-minimized audit in one call. It requires trusted TenantContext, rejects cross-tenant tags and unsafe/empty context, and includes a bounded tenant-partitioned process-local cosine retriever. DurableRagAuditTrail adds a synchronized versioned local file with quotas and restart/corruption checks. The separate AuditDeliveryClient can export a caller-minimized event through a bounded HMAC-authenticated envelope with stable event identity, transient retry, cancellation and a bound acknowledgement. Authoritative datastore authorization, durable/external vector adapters, ingestion/deletion, output policy, receiver/outbox operation and live-model evaluation remain application/deployment work. |
| Authenticated AI audit export | Implemented / bounded transport | Cloud delivery requires HTTPS and literal-loopback HTTP(S) is development-only. HMAC-SHA256 authenticates exact JSON bytes plus key/timestamp metadata; event and acknowledgement sizes, retry attempts and cancellation are bounded, and the ACK must repeat the stable event ID. The caller owns event minimization; the receiver owns freshness/signature verification, deduplication, authorization, persistence, retention, key rotation and SIEM availability. |
| Offline mocks for chat, vision, embeddings, and mail transports | Implemented | Keep mocks deterministic and selected only by explicit empty/mock_* credentials; live endpoints must never silently fall back. |
| Reusable and generated durable chat memory | Implemented / bounded choices | StatefulChat<M> and ChatMemory now live in rullst-ai; the bounded offline store is always available and opt-in sql-memory atomically persists tenant-bound exchanges with revision CAS on SQLite/PostgreSQL/MySQL/MariaDB. Live matrices prove the four protocols. cargo rullst make:chat-session remains an application-owned SQLx/Turso-primary model/migration path. Raw-text encryption, ownership inside a tenant, retention/erasure, provider audit, backups and conflict UX remain host contracts; CAS rejects rather than retries a billable provider request. |
| Native JSON Schema structured output on every LLM | Partial (worth capability-typed support) | Separate parseable JSON from provider-enforced schema. Return UnsupportedCapability when native enforcement is unavailable. |
| Machine-readable AI provider capabilities | Implemented / bounded | AiProvider::capabilities() and AiClient::capabilities() report transport support for text, chat, embeddings, vision, JSON/schema, streaming, tools, timeout, retry, and explicit cancellation. The public matrix states model-dependent and unsupported boundaries. |
| Guarded local AI tool dispatch | Implemented / bounded | ToolRegistry::execute requires an exact allowlist, principal authorization, closed bounded JSON, a call budget and audit sink. Destructive/financial approvals are one-use and payload-bound. DurableToolAuditTrail adds bounded synchronized local persistence with restart/corruption checks; it is not a multi-process writer or authenticated external sink. Provider-native tool calling, approver authentication, domain authorization, rotation/retention and distributed delivery remain application/roadmap boundaries. |
| Strict AI egress fetcher | Implemented / opt-in bounded transport | EgressPolicy::strict() denies all hosts until an exact allowlist is configured. EgressFetcher validates HTTPS URL/port and every DNS answer, pins all accepted addresses in a proxy-free client, verifies the connected peer, revalidates manual redirects and bounds deadline/declared and streamed bytes. It does not wrap arbitrary application/provider clients automatically; tenant-aware destination authorization, response schema/content handling and a deterministic successful live-origin contract remain integration work. |
| OpenAI-compatible local/cloud LLM endpoint | Implemented / bounded, capability-declared | OpenAiCompatibleProvider sends the named chat/embedding/vision/response-format shapes. It defaults to chat-only; optional paths are explicitly declared for the configured model. Unauthenticated HTTP is restricted to a literal loopback IP, cloud requires HTTPS/Bearer, offline mode is explicit, responses/images are bounded, and redirects/environment proxies are disabled. This is not automatic model discovery or arbitrary-HTTP compatibility. |
| âAny local LLM over any HTTP APIâ | Do not promise | Ollama and the bounded OpenAI-compatible adapter cover two explicit protocols. Arbitrary APIs still have incompatible authentication, streaming, schema, tool, and error semantics; applications implement AiProvider for those contracts. |
| Autonomous AI self-healing/DevOps changes | Partial recommendation tooling (do not auto-apply by default) | Diagnostics and patches can be valuable, but infrastructure/code mutation needs review, capability scopes, preview, audit, and rollback. |
| Tenant-aware secure mail, typed failover, durable scheduling and expiring tracking tokens | Implemented / bounded | The mandatory pipeline and purpose-bound TTL tokens are real. TenantMailResolver accepts the trusted Core TenantContext directly, validates registration, fails closed on unavailable registry state, and proves context isolation with separate drivers. FailoverDriver distinguishes permanent, transient and rate-limited outcomes, sends only eligible failures to another provider, bounds/redacts HTTP error details and emits structured tracing; its state remains process-local. SQLite/Redis queues preserve tenant envelopes and bounded due times without early claims; unsupported real direct transports fail closed, while offline fixtures may retain schedule metadata. Credentials still live in an application-configured in-process registry; encrypted persistence, rotation and cross-process distribution are not implied. Token payloads are HMAC-authenticated but base64-readable rather than encrypted. |
| Attachment inspection, recipient suppression and delivery observations | Implemented / bounded opt-in controls | AttachmentInspectionGuard fails closed before transport using a static scanner contract; its strict local implementation recognizes bounded safe types and rejects executable magic, spoofing, active PDF/SVG, secrets and unsafe links. SuppressionGuard checks process-local or sqlite shared-local manual/bounce/complaint state; SQLite binds verified provider/event payloads, preserves monotonic reasons and enforces exact quotas across restart/two instances. ObservedMailDriver emits only low-cardinality terminal metadata through a non-failing sink. Provider-specific webhook authentication, antivirus/sandbox/CDR, encrypted or multi-host suppression state, external telemetry and alert operations remain host/deployment work. |
| Direct AWS SES v2 delivery | Implemented / bounded protocol contract | Behind aws-ses, the official AWS SES v2 SDK supplies SigV4 and supports temporary or caller-owned rotating credentials, HTML/text, RFC 8058 and attachments/CID. The adapter enforces field/encoded-size bounds and response binding, with a signed regional loopback contract. Offline and explicit bearer-proxy modes remain visibly distinct. Live-account acceptance, verified identities/domains, sandbox exit, IAM, quotas, reputation and inbox delivery remain external. |
| Safe generated mailables | Implemented / bounded scaffold | The five make:mail variants plus make:mail-invoice and make:mail-dunning validate names, reject traversal/collisions, enable the exact facade features, register modules and escape dynamic HTML. The fiscal constructor consumes typed FiscalResponse provenance and keeps OfflineMock unmistakably unauthorized; dunning exposes D+1/D+3/D+7 without inferring billing state. A materialized project passes Clippy and adversarial rendering/link/provenance contracts; delivery credentials, official authorization, scheduling, entitlement mutation and billing policy remain application/external boundaries. |
| Mailgun, Brevo, MailerSend, Plunk, and Scaleway transports | Not implemented (worth demand-driven adapters) | Add only with maintainers and the shared offline/live transport conformance suite; provider count alone is not product quality. |
| âAir-gapped/zero-leak AIâ | Do not promise automatically | Local endpoints can avoid cloud LLM calls, but host networking, logging, model runtime, and telemetry determine the real data boundary. |
CLI, generated applications, and release engineering
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Stable blueprint IDs and corrected Nix/Buildah/Island/Resource flags | Implemented in current hardening | Keep snapshot tests because generated CLI identifiers are public compatibility surface. |
| Omni desktop/mobile packaging shell | Implemented / bounded experimental web shell with hosted compile matrix; offline foundation opt-in | make:omni deterministically selects platforms, validates backend URL/product/version/application-owned mobile identity, pins Tauri, emits real icon assets and fails on requested setup errors. Its local page has a restrictive origin-specific CSP, exposes no remote IPC and a native callback rejects navigation outside the exact backend origin. The local managed desktop child fails closed on a pre-used port, early exit and timeout. Desktop Linux/macOS/Windows, Android aarch64 APK and iOS simulator gates passed on 755fbd61933bed04369e0eb5de50b11275db5e3d. rullst.client v1 supplies bounded typed envelopes/version negotiation shared with Wasm, without client authority. The native offline-sync feature adds bounded account state, idempotent FIFO proposals, explicit conflicts/resync/recovery/erasure, account-bound authenticated AES-256-GCM snapshots and a static-dispatch push/pull coordinator with request budgets, timeout and cursor-stall checks; it is not automatically mounted by the shell. Keychain/Keystore, atomic platform persistence, browser storage, concrete HTTP/retry/background integration, deep links, push, physical devices, signing, privacy declarations, store acceptance and a rich native UI remain explicit platform/application work. |
| LMS/Academy starter domain foundation | Implemented / bounded scaffold | Generates curriculum, enrollment/progress, immutable publication/pins/rollback, assessments, assignments/rubrics, completion/certificates, roles, leaderboard, automation/outbox/worker/scheduler and notifications. The SSR catalog provides bounded ORM-parameterized title/category filtering and CSP-nonce-compatible, dependency-free auth/catalog/course/player shells with keyboard landmarks and visible focus. Lesson presentation distinguishes video/audio, accepts only HTTPS or same-origin absolute sources, requires a WebVTT caption track for video and a bounded transcript/language for both; materialized SQLite covers unsafe-source rejection, missing metadata, injection-shaped input, HTML escaping and nonce identity. Persisted school membership and course scope bind learning and critical mutations to authenticated UserContext; outbox, derived automation and notification state retain school_id, while tenant cache/realtime projections remain best-effort over database authority. The materialized journey covers cross-school denials across the implemented verticals. This is not a complete product or multi-tenancy claim: attachment/upload/media hosting/transcoding, advanced/localized search, metrics, exports, Nexus, distributed failover, caption/transcript quality and localization, WCAG/browser evidence, PostgreSQL/MySQL isolation and the separately operated Academy remain open. |
| Academy activity evaluation | Implemented / bounded single-choice + matching + typed verticals; broader activity system partial | evaluate_activity uses static dispatch to turn an untrusted submission into an opaque server-authored result; points are absent from submission APIs. Owner-only HTTP accepts one selected option, a complete bounded pair-ID permutation or bounded typed text, deriving learner/activity identity, answers, policy, points, evidence and time from authenticated/server state. Typed comparison trims, optionally lowercases Unicode and stores a policy-bound SHA-256 replay key rather than raw input; NFC/accent/fuzzy semantics are not claimed. record_activity_result transaction-locks exact persisted evaluator configuration, writes an exact-replay bounded attempt, appends ScoreEvent v2, updates the leaderboard and emits strict score_recorded v2. Materialized SQLite rejects cross-user, actor/evidence/policy mismatch, malformed pairs/text and conflicting replay. Retained attempt/digest state remains application privacy data. The separate persisted quiz path and listening/game evaluators remain open. |
| Academy spaced-review scheduling | Implemented / bounded deterministic foundation; adaptive learning partial | An enabled, validated rullst-box-v1 activity policy updates one durable learner/activity review state inside the authoritative score transaction. Passes grow a capped interval/ease, lapses reset repetitions to a bounded retry interval, algorithm drift fails closed and exact activity replay cannot move the due time. Owner-only GET /reviews/due derives learner/time server-side, caps results at 50 and rechecks school membership, course scope and active enrollment. Materialized SQLite proves deterministic pass/lapse transitions, three exercise kinds, replay safety, durable state, future queue ordering and cross-user denial. It is not FSRS/SM-2 compatibility, efficacy validation, personalized pedagogy or speech/listening support; visual review UX, policy migration/experimentation, privacy-product integration and PostgreSQL/MySQL contention remain open. |
| Selectable LMS profiles | Implemented / bounded; broader matrix partial | --lms-modules auth emits fewer than 15 files for identity/session/login/registration, CSRF/headers, authenticated middleware and user Nexus without course or enrollment state. --lms-modules auth,learning emits fewer than 30 files with auth, catalog, enrollment, protected lesson playback and monotonic/idempotent progress, without quiz/gamification/automation/notification files. --lms-modules auth,learning,assessment remains below 40 files and adds owner-only quiz presentation plus server-authoritative, versioned, idempotent grading with a hard attempt limit; it excludes score, leaderboard, achievement, outbox, automation and notification verticals. All three record the selection and materialized projects pass offline Cargo tests. The complete starter remains default. Other combinations and profile hot reload fail explicitly until their dependencies are genuinely detached; realtime and billing are not claimed as selectable modules yet. |
| Academy privacy lifecycle foundation | Implemented / bounded scaffold | Generates minimized age-band policy without birth date, school-scoped versioned retention, purpose-bound guardian consent/revocation and idempotent export/delete request records. A bounded admin/owner sweep schedules durable delete requests. The school-scoped fulfillment protocol adds exact leased claims, abandoned-claim recovery, delayed retry/dead-letter and actor/SHA-256-bound completion; an expired claim already at the hard ten-attempt ceiling is CAS-transitioned to dead-letter rather than reclaimed forever. A supervised static-dispatch executor adds adapter timeout, explicit shutdown and local metrics; its deterministic mock exercises only the protocol and never touches subject data. SQLite proves success/failure transitions, the hard bound, cross-school non-interference, stale-token denial and replay. The scaffold does not supply the product adapter that executes export/deletion/anonymization over application tables, verify a legal guardian, guarantee PII-free application logs or establish legal compliance. |
| mdBook documentation hub | Implemented in current hardening | Keep mdBook build in CI pages deployment; retired legacy internal SSG in favor of industry standard mdBook. |
Parameterized browser RPC through server_function | Implemented / bounded transport | Concrete async free functions return RpcResult<T> and generate both a matching explicit Axum router and Wasm caller over rullst.client v1. The contract limits owned Serde arguments/results and same-origin paths, caps bodies at 256 KiB, correlates responses, rejects media/version/schema drift, forwards the CSRF cookie in a header and exposes only bounded failure codes. Native HTTP/security tests, compile-fail diagnostics, both Wasm compile targets and generated-project verification are executable. Authentication, authorization, tenant policy, application idempotency, actual browser engines and network/provider operation remain separate evidence; island hydration is not completed by this RPC transport. |
| Every generator/blueprint combination compiled in a tempdir | Partial (highest remaining CLI priority) | A structural matrix validates the 18 public v12 shapes across six blueprints, materializes every blueprint, parses extracted templates, and inventories every public command. Representative source-tree projects cover all six blueprints plus detached LMS auth, auth+learning and auth+learning+assessment profiles, the fixed Active Record + SSR html!/HTMX profile, API, database, hot reload and release. The former 270-case matrix crossed incomplete frontend/ORM labels and is retained only as prerelease history. A separate packaged-distribution gate installs the extracted CLI and compiles all six default blueprints without monorepo paths. CI still needs to prove this on the final RC SHA. Expand fmt/smoke only where it adds a distinct contract and do not treat provider/deploy commands as offline tests. |
| Generated Auth/JWT/Billing production defaults | Implemented for the audited regressions; still application code | Async Argon2, issuer/audience/strong-secret checks, authenticated billing identity, CORS allowlists, and signed webhooks are foundations; generated apps still need deployment review. |
| SQLx/Turso billing scaffold | Implemented / bounded scaffold | make:billing --model enables exact umbrella features, generates reversible backend-specific persistence, pricing, authenticated checkout/portal with a required production plan allowlist and mandatory signed-webhook code for Stripe/LemonSqueezy, registers modules and refuses collisions. Materialized SQLite and Turso projects pass Clippy, migrate, persist a normalized event and deny a cross-owner subscription reuse without partially binding the conflicting customer. Route mounting, correct plan configuration, durable provider-event idempotency/reconciliation, live sandbox tests and other gateway adapters remain application/provider work. |
| Fully compliant automatic OpenAPI | Partial (do not claim completeness) | A syntax-derived draft is useful. Full fidelity needs a typed schema/route contract and validation, not regex confidence. |
| TypeScript SDK that eliminates contract breaks | Partial (worth contract tests) | Generation reduces duplication; add serialization golden tests and API compatibility tests instead of promising elimination of drift. |
| Total framework ejection | Partial (keep as migration aid) | Generate an inspectable entry point, list remaining Rullst dependencies, and run cargo check. Do not promise automatic removal of every subsystem. |
| Opt-in Git pre-commit/commit-message installer | Implemented / bounded (CI remains authoritative) | hook:install writes managed format/Clippy/IDOR and Conventional Commit wrappers, finds repository roots from nested directories, supports linked-worktree common metadata, preserves and chains active hooks instead of overwriting them, stages replacements before activation, and fails with typed errors on missing worktrees or backup conflicts. Temporary-repository regressions prove idempotency, executable permissions, preservation and fail-before-mutation behavior. Client-side hooks remain deliberately bypassable and are not a substitute for protected CI. |
| One-click, zero-downtime deployment | Partial (guided deploy is worthwhile) | Manifest/SSH helpers are useful, but availability, secrets, migrations, rollback, DNS, and cloud credentials remain operator concerns. |
| IDOR scanner that proves authorization | Heuristic (keep as a warning tool) | AST patterns can find omissions, not prove ownership semantics. Pair findings with route-level negative tests. |
| Compliance report that prints unconditional PASS | Removed; evidence-oriented report implemented | This is the correct direction. Keep raw evidence, tool versions, skipped states, and commit digests. |
| Release packaging in dependency order with preflight gates | Implemented in workflow; unreleased | Keep package-all-before-publish and topological publishing. The tag job now bundles Cargo metadata/lockfile, governed Cargo Audit output, CycloneDX, bounded compliance evidence, policies, context and checksums, then attests the bundle and packages. Do not call version 12 released until a matching green tag, crates and notes exist. |
| SLSA Level 3 certification | Not established (do not claim) | Build provenance is worth keeping. Pursue a named SLSA level only after every requirement is independently evaluated for the actual release platform. |
| RustSec/OSV exception governance | Implemented | Keep only unavoidable exceptions, each with owner, compensating control, and expiry; patched findings must block regressions again. |
| Full Kani/Miri/mutation proof of the framework | Not implemented (do not promise) | Scoped harnesses are valuable. Promote stable, deterministic subsets to blocking gates and label exploratory jobs honestly. |
| â100% test coverageâ | Do not promise (measured coverage is worthwhile) | Report the exact commit, features, targets, excluded/generated code, and coverage tool output. Line coverage is not behavioral completeness. |
Suggested sequencing
- Finish version 12 hardening: complete the generated-project matrix, workspace tests/Clippy/format, and release evidence.
- Architecture cycle: preserve the new Core/ORM and umbrella feature gates,
consolidate Security, and evolve the bounded
rullst-messagingand remote-storage boundaries through provider-specific conformance evidence. - Demand-backed integrations: durable rate limits/idempotency, S3/R2, and selected message brokers with shared conformance suites.
- High-assurance programs: WebAuthn conformance and, if Brazil is a core market, a dedicated officially homologated NFS-e implementation.
- Hardware program: only then expand OTA into real flash/boot lifecycle, MQTT/Embassy, named HSM devices, and audited PQC protocols.
This ordering keeps the extraordinary vision while making the stable surface smaller, testable, and trustworthy.