first commit

docs/VALIDATION.md

@@ -0,0 +1,28 @@
+# RustBox validation
+
+Release source checks:
+
+- one root Cargo package (`Cargo.toml` at repository root);
+- no `backend/` application directory;
+- no separate `frontend/` directory;
+- no `.ts` or `.tsx` source files;
+- no Node/Bun/Next/React build dependency;
+- UI files live under `src/web/` and are embedded into the Rust executable;
+- mail endpoints are configuration-owned; the login request contains only email/password/session preference;
+- authenticated mail routes reuse the resolved session connection profile;
+- CSS is built by Cargo `build.rs` from `src/web/css/manifest.txt`;
+- no CSS gradients and no Unicode pseudo-icons in the browser UI;
+- all UI action icons are served from the embedded SVG sprite;
+- `dev.sh` runs the root Cargo package;
+- native release build outputs `target/release/rustbox`;
+- `UPSTREAM_BASE` records the consumed Oxi backend revision;
+- upstream tooling maps Oxi `backend/` deltas into RustBox's flat paths and never imports Oxi frontend source.
+
+Full release gate on a host with Rust/Cargo and dependency access:
+
+```bash
+cargo fmt --all -- --check
+cargo test --locked
+cargo clippy --locked --all-targets -- -D warnings
+./scripts/build-release.sh
+```