Capability status and vision decisions
Rullstâs ambitious ideas are not deleted when an implementation is incomplete. They are kept here with an explicit status and an engineering recommendation. User-facing guides describe what can be used today; this ledger preserves the larger vision without presenting roadmap work as a production capability.
Status is evaluated against the current v13 development source tree (the 13.0.0 prereleases), not against an old changelog entry or marketing description:
- Implemented: a real implementation and focused tests exist; deployment responsibilities may still apply.
- Partial: useful foundations exist, but the advertised end-to-end contract is not complete.
- Experimental: available only behind an explicit experimental/simulator boundary and carries no production guarantee.
- Not implemented: absent or intentionally returns a typed
Unsupportederror instead of simulating success. - Do not promise: the absolute claim is not a technically honest product contract; a narrower engineering goal may still be worthwhile.
The recommendation column is intentionally opinionated. âWorth implementingâ does not mean âput it in Coreâ: several excellent ideas belong in optional, independently tested crates. Ideas that additionally need continuous operations, homologation, or hardware can follow the Maybe SaaS incubation strategy.
Architecture and framework contract
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Runtime-only Core with optional ORM | Implemented in current hardening (keep validating) | Bare rullst-core now defaults to the HTTP/runtime surface without SQLx/ORM; orm and queue-sqlite are independent opt-ins. Studio and Nexus request their database features explicitly, and since 13.0.0-alpha.3 the application umbrella has no default feature either: orm, a driver profile and queue-sqlite are opt-ins. |
| Lifecycle-aware readiness and graceful request drain | Implemented / bounded per process | ApplicationLifecycle holds monotonic startup/ready/draining/stopped state, at most 32 immutable validated required-component bits, fail-closed request admission and a bounded wait for accepted requests. The lifecycle-aware /ready emits only phase/counts and becomes 503 for startup, dependency failure, lock corruption and drain while liveness remains process-only. Server marks ready after binding, begins drain before Axumâs graceful wait, marks startup failure/termination stopped, and exposes a caller-supplied shutdown future for supervisors/tests. Applications still run timeout-protected dependency checks, establish identity/authorization and operate replica, load-balancer, preStop and termination-deadline behavior. |
| One canonical security stack | Partial (composition risk mitigated; high priority) | Core and the extended crate now reuse one CspNonce, so nested header layers do not invalidate renderer output. Ownership is still split: the Server mounts Core CSRF/WAF/headers/PII while rullst-security supplies explicit RASP/DLP/abuse/telemetry layers. Introduce a Core stack contract implemented by the dedicated crate, then deprecate duplicates after parity tests; reversing the dependency directly would create a cycle. |
| Umbrella features for every advertised crate | Implemented in current hardening (keep tested) | The umbrella exposes optional security, iot, base mail and other domain features, restores the oauth/Connect re-export, keeps SMTP separate through mail-smtp, and has focused facade tests including payment-bound Capital/Mail composition. The extended security suite remains nested under security::runtime because its surface intentionally overlaps the Core baseline; CspNonce itself is already one shared type. |
| Static dispatch everywhere | Partial (do not force absolutely) | Preserve generic/static paths for common cases, but runtime provider registries legitimately need dynamic dispatch. Document each intentional dyn Trait boundary instead of pretending it does not exist. |
| A universal environment/configuration policy | Implemented (keep) | The validated environment model and fail-closed production startup use exact RULLST_ENV â legacy APP_ENV â file precedence. New .env, Kubernetes (make:k8s) and billing scaffolds emit/read the canonical name first; retain the alias for existing applications and keep negative configuration tests. |
| Every source file below 500 lines | Partial (worth continuous refactoring) | Keep 500 lines as a design target, not a release fiction. Split production modules by responsibility; large test fixtures can use a looser limit. |
Uniform #[non_exhaustive], fallible builders, and impl Into<String> | Partial (worth completing incrementally) | Finish this during SemVer-reviewed API work. Mechanical mass changes without compatibility review are not worth the risk. |
| âZero lock-inâ or complete automatic ejection | Do not promise (migration tooling is worthwhile) | Standard Axum/SQLx escape hatches and an inspected eject snapshot reduce coupling, but no full-stack framework can guarantee zero migration cost for every optional subsystem. |
| âZero panic/crash-free runtimeâ | Do not promise (the scoped policy is worthwhile) | Enforce typed errors and reject panic!/unwrap/expect in declared production paths. Dependencies, OOM, aborts, and host failures make an absolute runtime guarantee impossible. |
| âZero latency/zero allocation everywhereâ | Do not promise (benchmark instead) | Bounded allocation and latency goals are excellent, but only reproducible per-operation benchmarks should carry numbers. |
| ORM performance versus Diesel and SeaORM | Implemented reproducible bounded harness; no superiority claim | A pinned Criterion target runs five equivalent operations against typed SQLite with one connection per ORM, the same schema/index/100-row seed and identical SQLite policy. CI records Rullst, Diesel and SeaORM under the same commit/runner. The initial local smoke contradicted the historical ânegligible overhead versus Dieselâ claim, which is therefore rejected rather than marketed away. SQLite microbenchmarks do not establish networked database throughput, concurrency, memory, tail latency or full-application performance. |
â100% memory-safe/no unsafe anywhereâ | Do not promise (an unsafe allowlist is worthwhile) | Rust dependencies and the development FFI/hot-swap boundary contain reviewed unsafe. Keep the allowlist tiny, documented with SAFETY, and CI-enforced instead of hiding it. |
| â100% Pure-Rustls for every featureâ | Do not promise (a transport inventory is worthwhile) | Prefer Rustls-backed first-party clients, then inspect the complete feature-specific lockfile. Transitive and optional stacks make a universal brand claim brittle. |
| Static competitor matrix declaring other frameworks lack features | Do not maintain without dated sources | Comparative research can be useful, but ecosystems change quickly and absence claims are easy to get wrong. Prefer a Rullst capability/boundary matrix or a dated, sourced benchmark repository. |
| Framework-wide âproduction-readyâ label | Do not promise as one boolean | Publish stability per crate/capability. Routing can be stable while a live payment provider or hardware integration remains unvalidated. |
ORM and persistence
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| SQLx Active Record, transactions, migrations and relations | Implemented / bounded | Keep the PostgreSQL, MySQL/MariaDB and SQLite matrices. Executor-aware generated operations and explicit transaction handles have commit/rollback evidence; typed morph_to plus morph_many/morph_one cover declared SQLx polymorphic targets without a runtime type registry. Caller-owned raw SQL must use the supplied transaction rather than assuming pool calls are scoped. |
| Compile-time query typing | Implemented / bounded typed path | Generated primitive-field filters require the persisted Rust value type and generated column enums reject unknown columns. Dynamic string-column builders, custom conversions and raw SQL intentionally remain runtime checked; do not describe them as SQLx query!-style live-schema verification. |
| Native relational enum mapping | Implemented / bounded per SQLx profile | #[derive(Enum)] owns one validated label mapping for Serde, string/RullstValue conversion and SQLx encode/decode. Blueprint::native_enum creates and exact-drift-checks a named type on strict-postgres, emits inline ENUM on MySQL/MariaDB, and emits TEXT CHECK on SQLite. SQLx Any PostgreSQL is rejected before DDL because it cannot decode custom types. Adding, removing or reordering variants, deployment ordering and PostgreSQL type removal remain reviewed migration work. |
| Fail-closed model tenant scopes | Implemented / bounded | tenant_column now requires a supported persisted field, denies queries/mutations without with_tenant, binds tenant predicates and rejects cross-tenant instance mutations. Keep unscoped() explicit and require application authorization/database RLS where appropriate. |
| Stable large-table chunk traversal | Implemented / bounded | Use fallible chunk_by_id for ascending keyset traversal over generated i32 IDs; deleting processed rows cannot shift later rows behind an offset. chunk remains offset-based, and neither API claims a server cursor, cross-shard snapshot or immunity to unbounded concurrent inserts. |
| Automatic schema synchronization and destructive migration | Partial | The SQLite AST diff is a useful reviewed scaffold. Do not claim universal type-safe synchronization, autonomous DDL, backup or rollback; add backend-specific plans and approval gates before expanding it. |
| Transactional typed partial updates | v13 prerelease / source admitted in PR #236 | The selected-field merge reads the current scoped row, runs the full save lifecycle in a savepoint, and updates the caller object after success. Audits and managed post-commit effects share that boundary. This changes v12 selected-column SQL behavior and does not provide expected-version conflict rejection. |
| Strictly post-commit hooks/search/cache invalidation | Implemented / bounded process-local contract; durable use is explicit | after_commit, generated committed observers, Redis table-cache invalidation/pub-sub and Scout projections run after direct generated or Orm::transaction commit; rollback drops them and PostCommit distinguishes a failed effect after durable persistence. A raw caller-owned SQLx transaction cannot reveal its later commit decision. These hooks are intentionally not converted to durable events without an application-selected schema/payload/policy. |
| Durable relational transactional outbox | Implemented / bounded opt-in primitive | Outbox::enqueue refuses independent commit and writes an idempotent event with the domain transaction; OutboxMigration supplies reviewed schema registration. PostgreSQL, MySQL, MariaDB and SQLite live matrices cover commit, rollback, duplicate reuse, claim and ACK. SQLite regressions additionally cover conflicting key reuse, stream isolation, exact/unexpired claim tokens, concurrent claim exclusion, lease recovery, bounded retry and dead-letter. Delivery is at least once: consumers must be idempotent, and automatic observer/webhook dispatch, tenant authorization, cleanup, cross-store transactions and distributed operations remain application boundaries. |
| Native external search and Qdrant | Implemented / bounded per adapter | scout-http supplies Meilisearch, Elasticsearch and Algolia projection/search adapters; only Meilisearch has a live service lifecycle. Separately, qdrant supplies bounded dense-vector create/upsert/delete/cosine query operations, deterministic fallback, authenticated protocol fixtures and a digest-pinned live lifecycle. Generated Scout projection durability, hosted-provider certification, arbitrary Qdrant filters/vectors and ANN tuning remain explicit. |
| Native Redis data structures | Implemented / bounded Hash, Set and Sorted Set contract | redis supplies an immutable application namespace, validated inputs, bounded reads, TLS-required remote configuration, redacted ACL credentials and deterministic fallback. A pinned live lifecycle proves hash increments, set membership/scan, sorted ranking, exact structure deletion and namespace isolation. Lists, Streams, Pub/Sub durability, cluster/failover, eviction and tenant authorization are not implied. |
| Typed PostgreSQL pgvector queries | Implemented / bounded feature-gated contract | pgvector plus strict-postgres exposes SQLx-compatible Vector and parameterized L2/cosine/inner-product helpers. A digest-pinned live matrix installs the extension, inserts typed values and executes bounded similarity queries. Embedding policy, ANN index tuning, RAG orchestration, authorization and production topology remain application/deployment work. |
| Polyglot MongoDB, DuckDB, Turso and SurrealDB boundary | Implemented / bounded per adapter, with application-operated document recovery | Keep document, OLAP, SQL and graph capabilities separate, with bounds and deterministic offline modes. MongoDB, SurrealDB and the deterministic store now retain IDs through DocumentInventory; an AES-256-GCM envelope binds key ID/application/collection, caps documents/bytes, compares two source observations, resumes only into an exact subset and verifies the final inventory. The live matrix crosses MongoDBâSurrealDBâMongoDB. Applications must quiesce writers and own key/snapshot durability; this is not online snapshot isolation, a universal Active Record facade, managed backup, replication or a cross-store transaction. |
| Transparent edge replication and latency guarantees | Not implemented | SQLx read replicas can be configured, but Turso synchronization, health/failover and consistency remain vendor/deployment concerns. Benchmark measured topology; never promise â1 msâ universally. |
| Historical ORM roadmap completeness | Fully classified, not fully implemented | All 45 unique former [x] claims were classified for v12: 28 bounded integral contracts/evidence items and 17 partial. The frozen IDs/states remain in the compact historical ledger, and the full claim text remains in the immutable v12 source snapshot. The comparative benchmark is delivered evidence whose first result refuted, rather than confirmed, the historic performance wording. |
Capital and billing vision
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Built-in provider set | Narrowed in v13 | Capital keeps its provider-neutral base, Stripe (supported) and InfinitePay (experimental until validated live; live checkout and callbacks fail closed). The Paddle, Lemon Squeezy, Polar, Razorpay, Mercado Pago, Alipay, Coinbase Commerce and PicPay adapters and the Wise payout adapter were removed to keep the maintained surface reviewable; applications implement other gateways with the provider traits (custom providers). See the migration guide. |
| NFS-e Nacional preparation and issuance | Removed in v13 (possible separate product) | The offline DPS preview and local NFS-e 1.01 preparation were never validated with a real municipality and carried a high maintenance cost. They left the framework in v13; the code remains in Git history and may return as a separate product outside Rullst. Never infer tax authorization from a Rullst receipt. |
| Uniform live support across built-in adapters | Partial (worth a capability matrix) | Publish method-by-method support and provider contract tests. An adapter name must not imply checkout, subscriptions, portal, tax, and webhook support all exist; InfinitePay remains experimental. |
| Shared outbound gateway failure policy | Implemented / bounded | Reviewed live methods use finite connect/request timeouts, disabled redirects and ambient proxies, one-MiB JSON decoding and credential-free HTTPS checkout URL validation. Redacted typed evidence distinguishes permanent, transient and rate-limited failures without automatic mutation retries. Durable provider-forwarded idempotency, backoff/attempt policy, reconciliation, explicit proxy configuration and live acceptance remain application or future adapter work. |
| Axum and Actix signed-webhook middleware | Implemented / bounded, with opt-in shared SQL replay | Both adapters bound the raw body, call one provider-aware verifier before dispatch, restore the exact body, insert a normalized event and enforce the configured replay store. webhook-sql adds immutable bounded shared claims over SQLite/PostgreSQL/MySQL/MariaDB, with restart, contention, drift, capacity and four-protocol live evidence; a stable event claim can share the callerâs relational domain transaction. Middleware payload admission happens before dispatch and therefore is not exactly-once processing. Cross-system effects still require outbox/idempotent-consumer/reconciliation contracts. |
| Subscription handle and grace-period value | Implemented / bounded | SubscriptionHandle<P> validates and redacts its identifier and delegates cancel/pause through an explicit statically dispatched provider (with a global-provider compatibility path). GracePeriod is a fallible half-open Unix-time window capped at 366 days; Billable and its derive can carry a complete optional pair. The application still owns authoritative loading, authorization, trusted time, persistence, entitlement checks, scheduling/retry and provider-specific live behavior. |
Immediate Billable charge | Implemented / bounded for reviewed Stripe Payment Intents | charge_with/charge require integer minor units, normalized currency, explicit provider customer and tokenized payment-method IDs, validated model e-mail and a bounded idempotency key. Stripe forwards that key and confirms off-session; its response must match amount/currency and report succeeded or processing. Exact mock retries are deterministic but carry the distinct non-success Mock status; request/receipt debug views redact identity. Other providers return UnsupportedOperation; mandate/SCA setup, durable idempotency, webhook reconciliation, entitlement changes and live sandbox evidence remain application/deployment work. |
| Stripe metered usage | Implemented / bounded provider-specific API | MeteredBillingProvider uses StripeMeterEvent for the current Stripe Meter Events form contract. It validates positive bounded usage, caps responses, binds provider echoes, redacts identities, forwards a rolling-window identifier and supplies deterministic non-live mocks. Custom adapters without a provider event key report ApplicationOutboxRequired so the application claims its key in a durable outbox. Live-account acceptance, retries, aggregation configuration, reconciliation and entitlements remain external. |
| Coupon application and relative trial extension | Implemented / bounded provider-specific API | CouponCode is bounded/redacted. Stripeâs current expanded-discount update is bound to subscription and coupon; InfinitePay and unreviewed live adapters fail explicitly. TrialExtension makes extend_trial(15) a 1â730-day operation; Stripe protocol fixtures bind the returned subscription/expiration, with an explicit-clock retry path. The host owns authorization, stable command time, serialization, webhook reconciliation, billing-cycle policy and live-account evidence. |
| Shared team/workspace resource quotas | Implemented / bounded, with opt-in durable SQL store | BillingSubject::from_tenant binds shared accounting to trusted tenant context and Billable::quota_request derives the limit from the subscription owner. QuotaGate reserves before executing, suppresses exact replay and compensates ordinary operation failure. quota-sql uses a unique event claim plus conditional counter update; SQLite and live PostgreSQL/MySQL/MariaDB concurrency contracts stop exactly at the shared limit. Applications own membership/authentication, tier persistence and reconciliation, migrations, stale-reservation operations and non-relational adapters. Arbitrary domain writes are atomic only when performed through the same caller-owned SQL transaction. |
| Payment-bound invoice PDF and mail delivery | Partial historical automation; implemented bounded bridge | invoice-pdf validates the compatibility invoice into exact minor units and renders bounded paginated PDF with embedded WinAnsi or a caller-supplied checked font. PaidInvoice requires final Succeeded evidence matching recipient, amount and currency; Mailâs opt-in bridge attaches the PDF, runs pre-flight and sends through the facade or a static driver. Its stable non-secret key is intended for an application-owned outbox. No webhook is inferred, no key is claimed transactionally, provider acceptance/attachment parity vary, and exactly-once delivery is not promised. |
| Durable cross-instance webhook idempotency/replay store | Implemented / bounded relational contract | The opt-in webhook-sql store persists bounded provider-scoped payload digests or stable event keys on SQLite, PostgreSQL, MySQL and MariaDB with immutable capacity/TTL, database-time serialized claims, expiry, restart, contention and fail-closed drift/storage/full-state evidence. Middleware admission is not exactly-once; atomic domain mutation requires the caller-transaction event-key path, and cross-system effects still require an outbox and reconciliation. |
| Static fee, settlement, and tax promises in framework docs | Do not promise | Provider terms and regional availability change. Link to official current terms and document only what the adapter itself implements. |
| âZero-cost invoicingâ | Do not promise | Removing an intermediary fee does not remove certificate, accounting, infrastructure, support, or compliance cost. Preserve cost transparency without advertising zero total cost. |
IoT, edge, and cryptography vision
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
no_std telemetry/frame helpers | Implemented (keep focused) | This is a credible small foundation. Preserve the lightweight, transport-neutral core. |
| Ed25519-signed OTA manifest, firmware hash, and monotonic verification gate | Implemented (foundation only) | Keep negative vectors and anti-rollback tests. The gate is not a firmware installer. |
| Persistent anti-rollback counter, download, flash, bootloader slot selection, rollback, and commit | Partial: store contract implemented; platform path absent | The no_std adapter requires exact monotonic compare-and-set and has restart/retry/conflict tests. A concrete store, download/flash path, bootloader coordination and power-loss/fault-injection evidence remain essential before calling OTA end-to-end. |
| MQTT 5, CoAP, and Sparkplug B transport | Packet helpers implemented; transport not implemented (worth a separate transport crate) | The no_std crate now encodes one bounded MQTT 5 PUBLISH packet and RFC 7252 base requests with protocol/boundary vectors. Connections, TLS/DTLS, acknowledgement/retransmission state, broker/LwM2M/Sparkplug semantics and interoperability remain absent; network runtimes should not bloat the frame crate. |
| Hardware HSM/secure-element backends | Not implemented; simulators are experimental (worth adapter traits, later) | Implement only against named hardware/PKCS#11 interfaces with device tests. Never create home-grown âHSM-likeâ hashing and call it secure. |
| NIST ML-KEM/post-quantum encryption | Not implemented; simulators are experimental (worth later, not home-grown) | Adopt an audited implementation only when a concrete protocol and threat model justify it. A generic âquantum-safeâ badge is not worthwhile. |
| CAN/J1939, LoRaWAN, GPIO/I2C hardware integration | Not implemented or helper-only (worth separate hardware packages) | Preserve the idea, but require target boards, interoperability fixtures, and maintainers for each protocol. |
| Embassy async executor integration | Not implemented (worth implementing after the transport split) | Valuable for embedded ergonomics once the no_std ownership and timer/network abstractions are stable. |
| Actual QEMU/hardware-in-the-loop CI | Not implemented (worth implementing with real runtime code) | Merely compiling a target is not QEMU testing. Add it when there is boot/flash behavior to execute and assert. |
| Aerospace/autonomous-vehicle/defense framework claims | Not implemented (do not place in the web-framework Core) | The idea is ambitious, but safety-critical systems need independent standards, certification, hardware, and governance. Consider a separate future project only after the IoT foundation is mature. |
Connect, real-time, queues, storage, and data
The optional v13 distributed tracing candidate links approved operations across processes through explicit trusted parent context and minimized bounded OTLP export. A standard TLS collector and separate Messaging processes passed acceptance; hosted source/package admission passed in PR #236. Final release admission, collector operations and Studioâs separate ingestion/viewer remain distinct responsibilities.
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| OAuth2/OIDC/social-login providers | Implemented (keep as Connectâs current identity) | Continue issuer, redirect, JWKS rotation, offline-fixture, and negative-token contract testing. |
| Signed local OIDC identity-provider fixture | Implemented / bounded for explicit Axum loopback tests | A validated concrete router binds one registered client and callback, keeps authorization codes expiring/one-shot in a 64-record process-local store, verifies optional S256 PKCE, carries nonce into a deterministic-fixture EdDSA ID token, publishes discovery/JWKS and accepts only issued unexpired bearer tokens at userinfo. A real loopback test drives the production OidcProvider through discovery, authorization, token exchange, JWKS verification and replay rejection. The private signing material and credentials are intentionally public/predictable fixtures. It is not safe to expose, has no interactive login/consent, refresh/device/federation lifecycle, durable state, key rotation or OIDC certification. |
| Server-bound OAuth/OIDC callback challenge | Implemented / bounded for Axum + tower-sessions | begin_oauth_session stores state + PKCE and begin_oidc_session additionally stores nonce for ten minutes. AuthSession reads the callback from the query string, removes and immediately saves the one active challenge before constant-time state validation and returns borrowed ExchangeParams; it does not complete Appleâs response_mode=form_post callback, which the v13 AuthSessionForm reads from a bounded form POST body behind a SameSite=None; Secure challenge cookie; sequential replay, expiry, mismatch, replacement and redacted-debug negatives are tested. The host still owns a durable session store, secure cookie/TLS configuration, account linking, recovery and live-provider conformance. One active challenge per browser session deliberately means a second login invalidates the first. The generic store API is not a distributed compare-and-delete, so simultaneous already-loaded callbacks require idempotent effects or an application atomic-challenge adapter. |
| Credential-safe normalized OAuth profile | Implemented / bounded | ConnectUser::universal_profile() emits only normalized identity fields. Serde on ConnectUser omits access and refresh tokens; applications must use a dedicated encrypted store for credential lifecycle rather than serializing the whole response as a session. |
| Automatic OAuth token refresh | Implemented / bounded process-local coordinator plus optional shared-local encrypted state | RefreshableTokenState validates and redacts access/refresh credentials, lifetime, trusted receipt time and provider user identity. AutoRefreshingSession<P> uses static dispatch, a bounded early-refresh window and one async mutex to prevent overlapping refresh calls; callers waiting behind a successful refresh reuse it. The coordinator retains an unrotated refresh token, adopts a valid rotation, binds the returned user and swaps state only after validation. EncryptedTokenSnapshot supplies a bounded versioned AES-256-GCM envelope whose tag binds an explicit rotation key ID, provider and trusted local-account identity. The opt-in SQLite store persists only a pseudonymous binding digest, generation/key metadata and ciphertext under an immutable quota; serialized transactions and exact-successor CAS reject stale local writers, with restart/contention/corruption evidence. The application still owns the remote-provider lease and losing-call reconciliation, key/directory/backup operations, authorization, multi-host replication, retry/backoff, revocation and reauthentication. Providers without refresh fail explicitly. |
| Explicit corporate proxy for OAuth/OIDC | Implemented / bounded HTTP(S) transport | ReqwestClient accepts an authority-only explicit proxy or separately supplied Basic credentials, disables ambient system-proxy lookup and requires HTTPS for authenticated non-loopback endpoints. A loopback protocol fixture proves routing and proxy authorization. PAC/WPAD, SOCKS, proxy mTLS and production network certification remain deployment/roadmap work. |
| Brokered messaging / old Connect Phase 9 | Partial bounded foundation in rullst-messaging | The separate crate now provides a versioned envelope, bounded idempotent publication, groups, leases, retry/DLQ, explicit purge, deterministic in-memory broker, canonical bounded envelope codec, allowlisted W3C trace context and fixed-schema local SQLite. SQLite can immutably select plaintext or AES-256-GCM header/payload protection with row-bound AAD and bounded rotation; raw-state/restart/tamper/row-swap/two-instance tests are executable. An opt-in static ORM relay publishes committed outbox claims with their stable event key and proves exact replay across the publish-before-ACK crash window. Routing/idempotency metadata remains visible, delivery remains at least once, neither relay nor codec creates an atomic remote transport, and replication plus RabbitMQ, Kafka, NATS/JetStream, SQS/SNS, Google Pub/Sub and Pulsar adapters are not implemented. The optional standalone Redis Streams profile passed source admission in PR #236; it owns fenced group indexes and retains its documented deployment and final-release boundaries. |
| WebSocket pub/sub and SSE | Implemented in Core, not Connect (do not duplicate) | Re-export through a coherent facade if desired; one runtime implementation is better than competing copies. |
| Recoverable server-driven Live UI | v13 prerelease / source admitted in PR #236 | live::recovery adds explicit authenticated scopes, mandatory revalidation, full snapshots, atomic expected-revision application contracts and bounded connection/action/timeout behavior. Actual WebSocket and Chromium tests prove conflict, revocation, disconnect and process-restart recovery without replaying uncertain actions. Applications own persistent domain state, transactional permission checks and HTML escaping. Legacy LiveComponent/make:live remain separate; DOM diffing, broadcast and offline mutation queues are outside this profile. See the recovery guide. |
| Bounded Memory/SQLite/Redis queues with recoverable leases | Implemented / bounded | SQLite and Redis additionally persist dispatch_at timestamps for at most 366 days and never claim them early; Redis server-time promotion has a digest-pinned live contract. Execution is poll-dependent and at-least-once. Continue dead-letter observability, graceful shutdown, and multi-worker fault tests. |
| NATS JetStream, SQS/SNS, and GCP Pub/Sub | Not implemented (worth demand-driven optional adapters) | Define one queue conformance suite first; add providers only when each can pass the same delivery/lease/idempotency semantics. |
| Authenticated tenant-local storage namespace | Implemented / bounded in Core | TenantStorage is constructed from a validated TenantContext, prefixes keys with an immutable canonical tenant root and reuses traversal/symlink protections. An exact local test stores the same logical key under two authenticated tenants without interference. Attachment/media integration, remote bucket policy and cross-backend conformance remain open. |
| Authenticated tenant cache namespace | Implemented / bounded in Core | TenantCache is constructed from a validated TenantContext, validates logical keys, applies an immutable namespace for memory or Redis-backed Core caches and deliberately exposes no global flush. Exact same-key non-interference is tested locally. Redis cluster/failover and application-wide conformance remain open. |
| Authenticated tenant realtime namespace | Implemented / bounded in Core | TenantRealtime and TenantPresence bind shared in-process broadcast/presence managers to validated TenantContext, validate logical channel/event/identity names, cap payloads at 64 KiB and prove that the same room name in two tenants does not interfere. Broader room authorization, distributed transport/liveness and other application integrations remain application/roadmap work. |
| S3 and Cloudflare R2 storage | v13 prerelease / source admitted in PR #236 | Optional Core/facade storage-s3 supports bounded private upload/download, metadata, deletion and temporary GET grants with maintained signing and explicit credentials. Disposable-service signature/restart and extracted-consumer checks pass. Owner-account interoperability, multipart streaming, IAM/bucket operations and final release admission remain separate. See private storage. |
| Upload admission and quarantine contract | Implemented / bounded, storage-agnostic | Core validates bounded in-memory bytes against tenant/name/size/type policy, recognized signatures, MIME/extensions and active-text denial (any leading markup after whitespace, byte-order marks or zero-width characters, or javascript:), produces a randomized tenant quarantine key plus SHA-256, and releases only after a clean scanner verdict. The bundled scanner is deterministic and mock-only. Multipart streaming, sandboxed deep parsing/transcoding, S3/R2 movement, archives and a production malware adapter remain open. |
| Image resize pipeline | Not implemented (worth an optional media crate, not Core) | Media decoding expands attack surface and binary size. Isolate it with strict size/pixel limits and fuzzing. |
| Transparent SQLite/Turso/database replication | Not implemented (do not implement generically in Core) | Integrate vendor-specific replication clients or sidecars. A generic timer that prints âsyncingâ cannot provide consistency semantics. |
| Immutable/zero-copy distributed ledger engine | Not implemented (interesting, but lower priority) | First define the exact consistency, persistence, recovery, and audit use case. The current HMAC audit chain is not a distributed immutable ledger. |
Security, authentication, Studio, and Nexus
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Versioned AES-256-GCM field encryption | Implemented (keep) | Keep envelope versioning, AAD, random nonces, key rotation, and round-trip/negative tests. Key custody remains external. |
| Canonical browser security baseline | Implemented / bounded in Core | apply_security_baseline is the same composition used by Server: it installs the exact application config outside secure headers/CSP nonce, explicit-origin CORS with separate credential opt-in, WAF, double-submit CSRF and optional PII masking in a stable order. Configuration rejects wildcard/path/query/credential/duplicate CORS origins, malformed CSP/SameSite state and unknown COEP policies. COEP remains require-corp by default; an application can deliberately select validated credentialless or unsafe-none behavior after reviewing its media/isolation boundary. In-process HTTP tests prove matching renderer/header nonce, configured COEP, secure CSRF cookie and write denial/acceptance, preflight allowlist and no grant for a foreign origin. Tune policy per application and test the final browser/proxy/TLS deployment; never promise a universal third-party A+ score. |
| âOWASP A+ guaranteedâ | Do not promise | A scanner grade depends on the final page, proxy, cookies, TLS, and deployment. The worthwhile goal is a strict tested baseline, not a badge guarantee. |
| Bounded body-aware WAF/RASP and DLP | Implemented (defense-in-depth) | Keep content-type, streaming, compression, overflow, and header-consistency tests. Never position heuristics as a replacement for parsers, binds, validation, or authorization. |
| Distributed rate limiting | Implemented foundation / external proof pending | rullst-security/redis-rate-limit uses one atomic Redis script, namespace validation, hashed client keys, TTLs and typed fail-closed errors. Empty/mock_* configuration is explicitly process-local and require_distributed() rejects it. Real Redis cross-instance, eviction/failover and trusted-proxy deployment tests remain release work; the legacy no-argument selector stays Unsupported. |
| Deterministic threat assessment and proof of work | Implemented / bounded locally; autonomous AI claim remains partial | Transparent thresholds classify three caller-supplied aggregate patterns and can issue an authenticated, subject-bound, expiring challenge with bounded difficulty/capacity and atomic one-shot verification. Rullst does not collect the aggregates, attribute botnets, block autonomously or share replay state across processes; accessibility, identity, distributed enforcement and DDoS architecture remain host concerns. |
| Route-scoped JSON Schema/OpenAPI body enforcement | Implemented / bounded | JsonSchemaPolicy compiles one JSON Schema 2020-12 document or selected OpenAPI 3.1 component, caps schema bytes/nodes/depth, rejects external references, disables filesystem/network retrieval and uses linear-time regexes. The Axum layer composes exact JSON transport checks and returns a value-free 422 on mismatch. It does not infer schemas from arbitrary routes or replace auth, ownership, domain validation, or query/header/form contracts. |
| Durable tamper-evident audit storage | Partial (worth implementing as a sink interface) | Canonical HMAC sequencing exists. Durable append-only storage, key protection, retention, and independent verification remain application/integration work. |
| Versioned local security-event envelope and spool | Implemented and bounded (v1/local) | LiveSecurityEvent has a frozen six-field v1 contract, a packaged JSON Schema, normalized identifiers/IPs/timestamps, a 2 KiB UTF-8 detail limit, and CEF field escaping. DurableSiemSpool preserves the compatible unsigned SHA-256 format. The opt-in AuthenticatedSiemSpool adds a domain-separated HMAC-SHA256 sequence/predecessor chain, one active plus seven historical named zeroized keys, exact byte/record quotas, restart validation and fail-closed forgery, wrong/missing-key, interior deletion/reordering, symlink, external-change and uncertain-durability behavior. A separately trusted checkpoint is required to detect valid-tail rollback; trusted directory/key custody, permissions, rotation retirement, retention, backup, multi-process exclusion, delivery, retry, acknowledgement, dead-letter handling and external SIEM adapters remain application/operations work. |
| Full normative WebAuthn server | Partial; durable local device lifecycle implemented | The implementation checks the documented ES256/none-attestation ceremony invariants. The opt-in SQLite store adds bounded credential inventory, rename/revocation, restart persistence and atomic counter CAS shared by local processes. Challenge state remains process-local, and an audited library or a full conformance suite is preferable to indefinite custom protocol ownership. |
| TOTP recovery codes | Implemented cryptographic foundation / workflow pending | Security generates subject-bound 80-bit codes, returns plaintext only at enrollment, serializes salted HMAC verifiers, compares in constant time and removes a consumed verifier. The application must encrypt the TOTP secret, persist verifier consumption atomically, rate-limit attempts and own enrollment/recovery UX and audit. |
| TOTP enrollment and Login Jail | Implemented / bounded in-process | MFA secrets contain 160 bits from the OS RNG, verification is constant-time and enrollment can emit a real bounded SVG QR. LoginGuard::record_login_failure_and_wait both records and awaits the progressive tarpit. The host must protect/encrypt the secret and persist/distribute abuse state where required. |
| CLI security evidence tools | Implemented with bounded analyses | SBOM output parses Cargo.lock into CycloneDX 1.5 components with a valid UUID serial number, lockfile checksums and source-aware purls (no license metadata); the doctor parses the real Rust version against MSRV; requested Geiger/SBOM/network checks now fail on findings or incomplete execution, and hooks run all-feature Clippy plus unsafe/IDOR source checks. These are evidence producers, not certification, attestation or static-analysis completeness proofs. |
First-class application JWT service in rullst-auth | Implemented / bounded shared local option | The opt-in jwt feature centralizes issuer/audience, required versioned claims, bounded TTL/scopes, strong HS256 keys, kid rotation and sync/async revocation contracts. Production verification rejects the bundled process-local store. The sqlite profile adds a quota-bound shared local adapter with serialized JTI/session-version mutations, expiry pruning, configuration-drift checks and restart/two-instance evidence. Multi-host replication, database encryption/backup/availability and refresh-token workflows remain deployment/application work. |
| Nexus open-by-default admin | Removed; hardened Nexus is implemented | Keep fail-closed construction, TLS boundary, role/field policy, ownership integration, and rate limits. Production readiness still depends on the host application identity model. |
| Nexus registered-model CRUD and batch actions | Implemented / bounded | #[derive(Nexus)] generates tested metadata for named-field models; primitive widgets are inferred and enum/textarea semantics are explicit. try_build() bounds and validates model, field, primary-key, enum, relation and optional text-tenant metadata. Mutation forms accept at most 256 pairs, bound short/long values to 4/64 KiB, reject unknown/protected fields and parameter pollution, normalize Boolean controls and validate registered enum, JSON, number, date, e-mail and HTTP(S) URL semantics before bound SQL. Sort/search identifiers are registry-allowlisted, batch delete/deactivate is capped at 1,000 selected IDs, and metadata is escaped at HTML boundaries. Tenant-scoped models bind every built-in read/mutation/batch to a trusted Core TenantContext, inject it on create and deny missing context; models without the metadata remain global. with_required_audit couples minimized committed-mutation evidence to the same transaction and fails closed when its fixed schema is unavailable. Deactivation is available only for a writable Boolean is_active/active; external enum reflection, multiline inference, host identity/membership, within-tenant ownership, global/custom-route authorization, database schema/type compatibility and privileges remain host contracts. The same-database audit table is mutable, not append-only/tamper-evident, and host retention/backup/replication/immutable export remain external. |
| Autonomous AI admin that can mutate production data | Not implemented as a safe contract (do not enable by default) | A read-only, explainable assistant is worthwhile. Mutations need explicit human approval, scoped capabilities, audit records, dry-run previews, and rollback. |
| Studio with real telemetry | Implemented with bounded authenticated ingestion and unavailable states | Linux and Windows expose delta-based process CPU alongside RSS, Tokio and local span probes; KPI cards poll the local JSON source. Each separately mounted push-only router binds one producer name/key, accepts only bounded attribute-free v1 spans after exact-body/source HMAC, clock-window and atomic nonce-replay checks, then stores them in bounded process memory. The viewer derives 100 ms slow-label and three-repeat possible-N+1 heuristics without SQL text or bindings. This is not OTLP, durable trace storage, remote Studio access or proof of a defect. The local capability still verifies peer plus local Host, and same-origin Origin on mutations. Queue/revenue/security/AI panels expose only supplied state; unsupported operations, disconnected transports and the absent standalone migration registry fail explicitly. Keep the viewer local by default and never fabricate values for missing sources. |
| Studio data/API/queue/cache/config tools | Implemented with bounded partial surfaces | The SQLx browser uses the applicationâs pool or the shared Server/Artisan database resolver without a SQLite fallback, reads/filters and, behind the unforgeable verified-local request marker, mutates one primitive non-key value or deletes one complete-PK-selected row with exact confirmation. Tables/columns come from inspected allowlisted schema, values are typed/bound, bodies are capped, views cut cell text to 256 characters and search terms to 256 bytes, a key column outside the identifier boundary makes the table read-only, each write commits in a transaction only when exactly one row changed, and live SQLite/PostgreSQL/MySQL/MariaDB matrices cover the contract. Backend-specific types, tenant/RBAC, audit, rollback and shared production access remain outside it. The read-only API reference requires a supplied OpenApi; SSE records method/URI/status/latency without secret-bearing bodies/headers. SQLite removes successful jobs by default or explicitly retains 1â100,000 for the real queue snapshot with atomic pruning and purge; retained payload access/policy belongs to the host. Redis lists at most 1,000 jobs, retries failed jobs and purges failures and dead letters, and custom queue inspection remains capability-specific. Queue retry/purge and flag toggles require the same verified-local marker as database writes, and the flag page reports a missing table instead of creating it from a GET. An explicitly supplied memory or Redis cache returns metadata only; Studio limits display to 100 opaque HMAC identifiers with size/TTL and permits only individual verified-local invalidation. Values, exact keys and bulk flush remain absent; custom cache drivers fail explicitly until they implement inspection. A successful Studio flag toggle immediately invalidates warm DbFeatureDriver caches in the same process through a constant-size epoch; other processes/direct writers remain TTL-bound without application pub/sub. Relational ER metadata uses parameterized lookups and normalized Mermaid identifiers. Environment values are deny-by-default redacted and typed config omits URLs, paths and secrets. |
| Studio automatically stripped from every release with zero overhead | Do not promise | Feature selection and route mounting determine inclusion. Explicit compile features are clearer than relying on a universal debug/release assumption. |
| Threat Radar with external reputation and verified audit feeds | Partial (worth pluggable connectors) | Local counters exist. External intelligence, durable audit verification, and SIEM delivery should appear only when a source is connected and healthy. |
| â100% OWASP coverageâ, âtamper-proofâ, or âzero-leak DLPâ | Do not promise | These absolutes are not provable framework properties. Preserve the controls and publish exact threat-model/test scope. |
| Automatic SOC 2/ISO/FedRAMP certification | Do not implement as a PASS generator | The evidence exporter is worthwhile; certification evaluates the whole organization and deployment. Report only the outcome of real checks: audit --compliance uses NO FINDINGS, FINDINGS, GENERATED, OBSERVED, NOT CHECKED, ERROR and NOT EVALUATED, never PASS. |
AI and mail
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| DeepSeek provider | Implemented | Keep it in the same provider contract and offline mock suite as the other cloud adapters. |
| Mandatory prompt-injection/PII guardrail pipeline | Implemented in the high-level client and built-in provider transports | The versioned deterministic offline corpus fixes implemented injection/jailbreak/PII regressions across built-in transports. Custom low-level providers remain an explicit extension boundary; heuristics and this corpus cannot prove a prompt safe. AdaptiveAiEvaluator<P> now supplies bounded multi-turn evaluation orchestration, but operators still own the domain corpus and exact live-model execution/review. |
| Adaptive AI evaluation | Implemented / bounded runner | A static-dispatch strategy can use one bounded response to choose its next prompt under turn, prompt/response, deadline and cancellation limits. Results distinguish pass, fail and inconclusive and serialize only low-cardinality metadata without raw prompts/responses/provider errors. Deterministic fixtures prove orchestration, not the safety or quality of a live model; the caller-supplied subject label and scenario assertions require operator governance. |
| Tenant-bound RAG orchestration | Implemented / bounded | RagPipeline::answer composes guarded embedding, a static application retriever, Unicode-safe context budgets, guarded generation, source metadata and mandatory secret-minimized audit in one call. It requires trusted TenantContext, rejects cross-tenant tags and unsafe/empty context, and includes a bounded tenant-partitioned process-local cosine retriever. DurableRagAuditTrail adds a synchronized versioned local file with quotas and restart/corruption checks. The separate AuditDeliveryClient can export a caller-minimized event through a bounded HMAC-authenticated envelope with stable event identity, transient retry, cancellation and a bound acknowledgement. Authoritative datastore authorization, durable/external vector adapters, ingestion/deletion, output policy, receiver/outbox operation and live-model evaluation remain application/deployment work. |
| Authenticated AI audit export | Implemented / bounded transport | Cloud delivery requires HTTPS and literal-loopback HTTP(S) is development-only. HMAC-SHA256 authenticates exact JSON bytes plus key/timestamp metadata; event and acknowledgement sizes, retry attempts and cancellation are bounded, and the ACK must repeat the stable event ID. The caller owns event minimization; the receiver owns freshness/signature verification, deduplication, authorization, persistence, retention, key rotation and SIEM availability. |
| Offline mocks for chat, vision, embeddings, and mail transports | Implemented | Keep mocks deterministic and selected only by explicit empty/mock_* credentials; live endpoints must never silently fall back. |
| Reusable and generated durable chat memory | Implemented / bounded choices | StatefulChat<M> and ChatMemory now live in rullst-ai; the bounded offline store is always available and opt-in sql-memory atomically persists tenant-bound exchanges with revision CAS on SQLite/PostgreSQL/MySQL/MariaDB. Live matrices prove the four protocols. cargo rullst make:chat-session remains an application-owned SQLx/Turso-primary model/migration path. Raw-text encryption, ownership inside a tenant, retention/erasure, provider audit, backups and conflict UX remain host contracts; CAS rejects rather than retries a billable provider request. |
| Native JSON Schema structured output on every LLM | Partial (worth capability-typed support) | Separate parseable JSON from provider-enforced schema. Return UnsupportedCapability when native enforcement is unavailable. |
| Machine-readable AI provider capabilities | Implemented / bounded | AiProvider::capabilities() and AiClient::capabilities() report transport support for text, chat, embeddings, vision, JSON/schema, streaming, tools, timeout, retry, and explicit cancellation. The public matrix states model-dependent and unsupported boundaries. |
| Guarded local AI tool dispatch | Implemented / bounded | ToolRegistry::execute requires an exact allowlist, principal authorization, closed bounded JSON, a call budget and audit sink. Destructive/financial approvals are one-use and payload-bound. DurableToolAuditTrail adds bounded synchronized local persistence with restart/corruption checks; it is not a multi-process writer or authenticated external sink. Provider-native tool calling, approver authentication, domain authorization, rotation/retention and distributed delivery remain application/roadmap boundaries. |
| Strict AI egress fetcher | Implemented / opt-in bounded transport | EgressPolicy::strict() denies all hosts until an exact allowlist is configured. EgressFetcher validates HTTPS URL/port and every DNS answer, pins all accepted addresses in a proxy-free client, verifies the connected peer, revalidates manual redirects and bounds deadline/declared and streamed bytes. It does not wrap arbitrary application/provider clients automatically; tenant-aware destination authorization, response schema/content handling and a deterministic successful live-origin contract remain integration work. |
| OpenAI-compatible local/cloud LLM endpoint | Implemented / bounded, capability-declared | OpenAiCompatibleProvider sends the named chat/embedding/vision/response-format shapes. It defaults to chat-only; optional paths are explicitly declared for the configured model. Unauthenticated HTTP is restricted to a literal loopback IP, cloud requires HTTPS/Bearer, offline mode is explicit, responses/images are bounded, and redirects/environment proxies are disabled. This is not automatic model discovery or arbitrary-HTTP compatibility. |
| âAny local LLM over any HTTP APIâ | Do not promise | Ollama and the bounded OpenAI-compatible adapter cover two explicit protocols. Arbitrary APIs still have incompatible authentication, streaming, schema, tool, and error semantics; applications implement AiProvider for those contracts. |
| Autonomous AI self-healing/DevOps changes | Not implemented; the CLI assistant was removed in 13.0.0-alpha.4 (do not auto-apply) | cargo rullst ai (with fix and review) is gone; the development error page offers a read-only prompt and a loopback JSON context (/_rullst/errors/{id}) for the developerâs own assistant. Diagnostics and patches can be valuable, but infrastructure/code mutation needs review, capability scopes, preview, audit, and rollback. |
| Tenant-aware secure mail, typed failover, durable scheduling and expiring tracking tokens | Implemented / bounded | The mandatory pipeline and purpose-bound TTL tokens are real. TenantMailResolver accepts the trusted Core TenantContext directly, validates registration, fails closed on unavailable registry state, and proves context isolation with separate drivers. FailoverDriver distinguishes permanent, transient and rate-limited outcomes, sends only eligible failures to another provider, bounds/redacts HTTP error details and emits structured tracing; its state remains process-local. SQLite/Redis queues preserve tenant envelopes and bounded due times without early claims; unsupported real direct transports fail closed, while offline fixtures may retain schedule metadata. Credentials still live in an application-configured in-process registry; encrypted persistence, rotation and cross-process distribution are not implied. Token payloads are HMAC-authenticated but base64-readable rather than encrypted. |
| Attachment inspection, recipient suppression and delivery observations | Implemented / bounded opt-in controls | AttachmentInspectionGuard fails closed before transport using a static scanner contract; its strict local implementation recognizes bounded safe types and rejects executable magic, spoofing, active PDF/SVG, secrets and unsafe links. SuppressionGuard checks process-local or sqlite shared-local manual/bounce/complaint state; SQLite binds verified provider/event payloads, preserves monotonic reasons and enforces exact quotas across restart/two instances. ObservedMailDriver emits only low-cardinality terminal metadata through a non-failing sink. Provider-specific webhook authentication, antivirus/sandbox/CDR, encrypted or multi-host suppression state, external telemetry and alert operations remain host/deployment work. |
| Direct AWS SES v2 delivery | Implemented / bounded protocol contract | Behind aws-ses, the official AWS SES v2 SDK supplies SigV4 and supports temporary or caller-owned rotating credentials, HTML/text, RFC 8058 and attachments/CID. The adapter enforces field/encoded-size bounds and response binding, with a signed regional loopback contract. Offline and explicit bearer-proxy modes remain visibly distinct. Live-account acceptance, verified identities/domains, sandbox exit, IAM, quotas, reputation and inbox delivery remain external. |
| SendGrid, Postmark, Mailjet, Mailtrap and Azure Communication Services transports | Removed in 13.0 (kept in 12.x) | v13 keeps Resend, AWS SES, SendPulse and SMTP. A configured removed driver fails resolution with a typed error instead of falling back; applications implement other providers with MailDriver (Writing your own mail transport). |
| Safe generated mailables | Implemented / bounded scaffold | The five make:mail variants plus make:mail-invoice and make:mail-dunning validate names, reject traversal/collisions, enable the exact facade features, register modules and escape dynamic HTML. The payment-receipt template never claims tax authorization; dunning exposes D+1/D+3/D+7 without inferring billing state. A materialized project passes Clippy and adversarial rendering/link contracts; delivery credentials, scheduling, entitlement mutation and billing policy remain application/external boundaries. |
| Mailgun, Brevo, MailerSend, Plunk, and Scaleway transports | Not implemented (application-owned adapters) | Applications implement MailDriver as in Writing your own mail transport. An official adapter needs a maintainer and the shared offline/live transport conformance suite; provider count alone is not product quality. |
| âAir-gapped/zero-leak AIâ | Do not promise automatically | Local endpoints can avoid cloud LLM calls, but host networking, logging, model runtime, and telemetry determine the real data boundary. |
CLI, generated applications, and release engineering
| Capability or former claim | Current status | Recommendation and reason |
|---|---|---|
| Stable blueprint IDs and corrected Island/Resource flags | Implemented in current hardening | Keep snapshot tests because generated CLI identifiers are public compatibility surface. The Blank, API and SaaS IDs are stable; `âblueprint lms |
| Installable application (PWA) | Implemented / bounded; Omni shells removed in 13.0.0-alpha.3 | make:pwa writes a web app manifest, placeholder icons, /sw.js and /offline (src/pwa.rs) and a registration script with an update prompt, wired into the starter router and layouts; the worker runs under the default nonce CSP and never stores non-GET, cross-origin, no-store or private responses. --android writes a Bubblewrap twa-manifest.json, and rullst::pwa::AssetLinks serves validated /.well-known/assetlinks.json. A Node contract executes the worker and registration script, and a generated Blank application is compiled and checked for the routesâ headers. rullst.client v1 supplies bounded typed envelopes/version negotiation shared with Wasm, without client authority. The Tauri-based make:omni/omni commands and the native offline-sync feature were removed; Bubblewrap, PWABuilder, signing keys, store review and device testing remain application work. |
| LMS/Academy starter domain foundation | Removed in v13 | The complete Academy scaffold that generated school-scoped curriculum, publication, roles, completion and certificates was replaced by the smaller LMS starter, which became the examples/lms application in 13.0.0-alpha.4. The design and v12 implementation remain in the git history and the stable v12 branch; recommendation: rebuild it as an application or external example only with a maintainer and tests. |
| Academy activity evaluation | Removed in v13 | The complete Academy scaffold that generated server-authoritative activity evaluation was replaced by the smaller LMS starter, which became the examples/lms application in 13.0.0-alpha.4. The design and v12 implementation remain in the git history and the stable v12 branch; recommendation: rebuild it as an application or external example only with a maintainer and tests. |
| Academy spaced-review scheduling | Removed in v13 | The complete Academy scaffold that generated the durable spaced-review queue was replaced by the smaller LMS starter, which became the examples/lms application in 13.0.0-alpha.4. The design and v12 implementation remain in the git history and the stable v12 branch; recommendation: rebuild it as an application or external example only with a maintainer and tests. |
| LMS example (former starter) | Implemented / bounded | Until 13.0.0-alpha.4 --blueprint lms generated it; it is now the examples/lms application, whose offline tests (cargo test -p rullst-lms-example) run in the workspace suite. It covers auth, catalog, course modules and lessons, an accessible player, enrollment, protected lesson playback and owner-bound monotonic/idempotent progress, with a Nexus admin. v13 replaced the earlier complete Academy scaffold and its --lms-modules profiles with this smaller application; quizzes, schools, roles, scoring, automation and notifications are application work. |
| Academy privacy lifecycle foundation | Removed in v13 | The complete Academy scaffold that generated the school-scoped age-band and retention lifecycle was replaced by the smaller LMS starter, which became the examples/lms application in 13.0.0-alpha.4. The design and v12 implementation remain in the git history and the stable v12 branch; recommendation: rebuild it as an application or external example only with a maintainer and tests. |
| mdBook documentation hub | Implemented in current hardening | Keep mdBook build in CI pages deployment; retired legacy internal SSG in favor of industry standard mdBook. |
Parameterized browser RPC through server_function | Implemented / bounded transport | Concrete async free functions return RpcResult<T> and generate both a matching explicit Axum router and Wasm caller over rullst.client v1. The contract limits owned Serde arguments/results and same-origin paths, caps bodies at 256 KiB, correlates responses, rejects media/version/schema drift, forwards the CSRF cookie in a header and exposes only bounded failure codes. Native HTTP/security tests, compile-fail diagnostics, both Wasm compile targets and generated-project verification are executable. Authentication, authorization, tenant policy, application idempotency, actual browser engines and network/provider operation remain separate evidence; island hydration is not completed by this RPC transport. |
| Every generator/blueprint combination compiled in a tempdir | Implemented for the three starters (six blueprints in v12) | Since 13.0.0-alpha.4 the structural matrix validates 10 shapes of the Blank, API and SaaS starters, four representative projects compile with their generated tests, and seven public-CLI profiles cross the database, AI, Redis and polyglot options; the LMS, Blog, ERP and Portfolio applications are workspace examples. The v12 record follows: a structural matrix validates the 18 public v12 shapes across six blueprints, materializes every blueprint, parses extracted templates, and inventories every public command. Eight representative source-tree projects cover all six blueprints, the fixed Active Record + SSR html!/HTMX profile, API, database, hot reload and release. The former 270-case matrix crossed incomplete frontend/ORM labels and is retained only as prerelease history. On approved candidate a6b3bc8a, the packaged-distribution gate installed the extracted CLI and compiled all six default blueprints without monorepo paths. Expand fmt/smoke only where it adds a distinct contract and do not treat provider/deploy commands as offline tests. |
| Generated Auth/JWT/Billing production defaults | Implemented for the audited regressions; still application code | Async Argon2, issuer/audience/strong-secret checks, authenticated billing identity, CORS allowlists, and signed webhooks are foundations; generated apps still need deployment review. |
| SQLx/Turso billing scaffold | Implemented / bounded Stripe integration (the only generated provider) | make:billing --model and SaaS share reversible persistence, authenticated customer/checkout intents, session IDs, account/test-live scope, signed Checkout/subscription events, current-state reconciliation, revision fencing and atomic event/subscription writes. Open sessions resume without new creation. Materialized SQLite/Turso contracts cover changed email, lost responses, ownership, replay/rollback, concurrent stale reads, replacement subscriptions and restart. Route mounting, provider setup, legacy data migration, retention/entitlement policy and live-account sandbox acceptance remain application/deployment work. |
| Fully compliant automatic OpenAPI | Partial (do not claim completeness) | A syntax-derived draft is useful. Full fidelity needs a typed schema/route contract and validation, not regex confidence. |
| TypeScript SDK that eliminates contract breaks | Partial (worth contract tests) | Generation reduces duplication; add serialization golden tests and API compatibility tests instead of promising elimination of drift. |
| Total framework ejection | Partial (keep as migration aid) | Generate an inspectable entry point, list remaining Rullst dependencies, and run cargo check. Do not promise automatic removal of every subsystem. |
| Opt-in Git pre-commit/commit-message installer | Implemented / bounded (CI remains authoritative) | hook:install writes managed format/Clippy/IDOR and Conventional Commit wrappers, finds repository roots from nested directories, supports linked-worktree common metadata, preserves and chains active hooks instead of overwriting them, stages replacements before activation, and fails with typed errors on missing worktrees or backup conflicts. Temporary-repository regressions prove idempotency, executable permissions, preservation and fail-before-mutation behavior. Client-side hooks remain deliberately bypassable and are not a substitute for protected CI. |
| One-click, zero-downtime deployment | Partial (guided deploy is worthwhile) | cargo rullst deploy writes a Dockerfile, compose.yaml and Caddyfile for a Linux VM with Docker or Podman, and deploy:doctor inspects a configuration snapshot offline, but availability, secrets, migrations, rollback, DNS, and cloud credentials remain operator concerns. |
| IDOR scanner that proves authorization | Heuristic (keep as a warning tool) | AST patterns can find omissions, not prove ownership semantics. Pair findings with route-level negative tests. |
| Compliance report that prints unconditional PASS | Removed; evidence-oriented report implemented | This is the correct direction. Keep raw evidence, tool versions, skipped states, and commit digests. |
| Release packaging in dependency order with preflight gates | Implemented and exercised by stable v12 | Keep package-all-before-publish and topological publishing. The v12.0.0 workflow at eb11f892 admitted the protected exact SHA, reproduced and verified the archives, attested the artifacts, published all 16 packages with short-lived Trusted Publishing credentials, verified registry checksums, and created the GitHub release. The earlier redundant external SLSA job produced no evidence and was removed; no project-wide SLSA level is claimed. |
| SLSA Level 3 certification | Not established (do not claim) | Build provenance is worth keeping. Pursue a named SLSA level only after every requirement is independently evaluated for the actual release platform. |
| RustSec/OSV exception governance | Implemented | Keep only unavoidable exceptions, each with owner, compensating control, and expiry; patched findings must block regressions again. |
| Full Kani/Miri/mutation proof of the framework | Not implemented (do not promise) | Scoped harnesses are valuable. Promote stable, deterministic subsets to blocking gates and label exploratory jobs honestly. |
| â100% test coverageâ | Do not promise (measured coverage is worthwhile) | Report the exact commit, features, targets, excluded/generated code, and coverage tool output. Line coverage is not behavioral completeness. |
Suggested sequencing
- Finish 13.0: fixes and documentation only in 13.0.0-rc.1, then the 13.0.0 release evidence (version 12 reached end of life on 16 October 2026).
- Architecture cycle: preserve the new Core/ORM and umbrella feature gates,
consolidate Security, and evolve the bounded
rullst-messagingand remote-storage boundaries through provider-specific conformance evidence. - Demand-backed integrations: durable rate limits/idempotency, S3/R2, and selected message brokers with shared conformance suites.
- High-assurance programs: WebAuthn conformance. Officially homologated NFS-e issuance, if pursued, belongs in a separate product outside Rullst.
- Hardware program: only then expand OTA into real flash/boot lifecycle, MQTT/Embassy, named HSM devices, and audited PQC protocols.
This ordering keeps the extraordinary vision while making the stable surface smaller, testable, and trustworthy.