Rust in Peace

Agenda

An agenda, not a lecture outline — you are here to argue back. By the end of the half hour you will be able to:

• Recount how a two-person team crossed from software to law without dropping the toolchain. Explain why a foundation-stewarded language is access-to-justice infrastructure. Trace our process from the law, to a Cucumber feature, to a template, to a signed notation. Dissect one workflow — forming a Nevada LLC — into attorney-gated steps with the shipped code. Defend the claim that a reviewed, repeatable workflow beats a prompt. Map how the rules of professional conduct compile into schema and workflow. Decide whether to open the repository, read the code, and star it.

From software engineers to lawyers who code

We were engineers who got tired of watching routine legal work priced out of reach. So we got licensed — and kept the engineering discipline. A pull request and a contract are closer than either profession likes to admit.

The goal — deterministic workflows from law

The whole method on one slide: a prompt is a wish; a workflow is a contract. Read the law → a Cucumber feature → a template (frontmatter carries a questionnaire and a workflow) → a notation a client signs, after a staff review owned by the matter's directly responsible attorney.

Step 1 — read the law

A Nevada LLC is a creature of statute: NRS Chapter 86 says what the Articles of Organization must contain. We do not paraphrase from memory — our statutes crate scrapes the NRS weekly into Postgres, rendered publicly at .

Step 2 — write the behavior before the code

The first artifact is not Rust — it is a Cucumber feature describing the whole arc in plain language, runnable as a test: a founder intakes, an attorney reviews, signatures land, and the state stamps a filing.

From features/tests/features/nest_formation.feature:

  Scenario: From intake to a stamped Secretary-of-State filing
    When the firm opens the "onboarding__nest" matter for the client
    And the founder answers the formation questionnaire:
      | value                  |
      | Libra                  |
      | libra@example.com      |
      | Bright Star Ventures   |
      | Neon Law Registered Agent |
      | members                |
      | Libra; 1 Main St; Las Vegas; NV; 89101; USA |
      | 2026-07-01             |
    Then the formation reaches the signature wait
    And the persisted packet is the official SoS form carrying the founder's answers
    When the attorney files the Articles with the Nevada Secretary of State
    Then the formation workflow reaches END
    And a filing was recorded with the "Nevada Secretary of State"
    And the founder's seven onboarding answers are on file

Step 3 — the template: a questionnaire and a workflow

The template is one markdown file whose frontmatter is the machine-readable half of our notation format: a questionnaire graph (what we ask) and a workflow graph (what we do). The Nest questionnaire is seven answers, in order.

From notation_templates/united_states/nevada/state/business_associations/entity_formation.md:

questionnaire:
  BEGIN:
    _: client_name
  client_name:
    _: client_email
  client_email:
    _: entity_name
  entity_name:
    _: registered_agent
  registered_agent:
    _: management_structure
  management_structure:
    _: managing_members
  managing_members:
    _: formation_date
  formation_date:
    _: END
  END: {}

And here is the workflow — the LLC formation dissected into small, named, modular steps. Each state is a noun in our glossary; each transition is a signal some handler fires. This graph is the product.

From notation_templates/united_states/nevada/state/business_associations/entity_formation.md:

workflow:
  BEGIN:
    intake_submitted: intake_persisted__organizer
  intake_persisted__organizer:
    articles_rendered: staff_review
  staff_review:
    approved: document_open__articles_pdf
    rejected: END
  document_open__articles_pdf:
    pdf_persisted: sent_for_signature__pending
  sent_for_signature__pending:
    signature_received: filing__nv_sos
    signature_declined: END
  filing__nv_sos:
    filed: END
  END: {}

Step 4 — the attorney gate is a graph invariant

Every workflow must pass through staff_review before anything is signed or filed — not as a policy memo, but as a property checked over the state-machine graph itself with a breadth-first search from BEGIN.

From workflows/src/guardrail.rs:

pub fn staff_review_precedes_signature(spec: &WorkflowSpec) -> Result<(), GateViolation> {
    let begin = StateName::begin();
    if let Some(signature) = reaches_target_without_review(spec, &begin, is_signature_state) {
        return Err(GateViolation {
            fill_state: begin.as_str().to_string(),
            submission_state: signature,
        });
    }
    Ok(())
}

Step 5 — signature is a modular step

sent_for_signature__pending is one state in the graph, and the thing that fires it is a small trait — not a vendor. DocuSign is the shipped implementation; dev and tests run a recording stub, so the step stays testable without an account.

From web/src/signature.rs:

pub trait SignatureProvider: Send + Sync {
    /// Submit the rendered retainer PDF for the given notation, placing
    /// the fields described by `manifest`. Returns a provider-issued id
    /// correlating future events.
    async fn send_for_signature(
        &self,
        notation_id: Uuid,
        pdf: &[u8],
        manifest: &SignatureManifest,
    ) -> Result<SignatureRequestId, SignatureError>;

Because the step is modular it can also be careful. Dispatch is idempotent — a notation that already has an envelope out reuses it, fires nothing, and sends nothing — so a retry can never double-send a client's contract.

From web/src/retainer_walk.rs:

    // Idempotency: this notation already has an envelope out. Reuse the
    // persisted id, fire nothing, send nothing — the post-state is
    // whatever the notation already records.
    if let Some(existing) = notation_row.signature_request_id.clone() {
        return Ok((
            StateName::from(notation_row.state.as_str()),
            crate::signature::SignatureRequestId(existing),
        ));
    }

Why a workflow beats a prompt

You could ask a frontier model to "form me a Nevada LLC" and get something plausible. We built the harness instead, because plausible is not the bar — repeatable is. A prompt's steps are neither repeatable nor modular.

The crates we actually run on

The bill of materials for a real legal-tech product — every line a crate you can pull today:

• HTTP and views — axum, maud, tower / tower-http. Async runtime — tokio, multi-threaded, with graceful shutdown. Database — sea-orm over Postgres, uuid (v7) + chrono for keys and timestamps. Durable execution — restate-sdk. Archive — arrow + parquet. Content — pulldown-cmark. Cloud — google-cloud-storage + reqwest. Identity — jsonwebtoken + oauth2. Tests — testcontainers, fantoccini, cucumber.

Ethics is part of the stack

Lawyers who code still carry the rules of professional conduct, and the engineering answer is the same as it is for memory safety: make the invariant structural, not aspirational.

• Scope is a field, not a vibe. Every engagement is scoped in writing before work starts. The conflict check runs first. Before any matter opens, we query every current and former matter. Referral, without a referral fee. When conflicted out, we refer — with no referral fee.