# RustBox validation

Release source checks:

- one root Cargo package (`Cargo.toml` at repository root);
- no `backend/` application directory;
- no separate `frontend/` directory;
- no `.ts` or `.tsx` source files;
- no Node/Bun/Next/React build dependency;
- UI files live under `src/web/` and are embedded into the Rust executable;
- mail endpoints are configuration-owned; the login request contains only email/password/session preference;
- authenticated mail routes reuse the resolved session connection profile;
- CSS is built by Cargo `build.rs` from `src/web/css/manifest.txt`;
- no CSS gradients and no Unicode pseudo-icons in the browser UI;
- all UI action icons are served from the embedded SVG sprite;
- `dev.sh` runs the root Cargo package;
- native release build outputs `target/release/rustbox`;
- `UPSTREAM_BASE` records the consumed Oxi backend revision;
- upstream tooling maps Oxi `backend/` deltas into RustBox's flat paths and never imports Oxi frontend source.

Full release gate on a host with Rust/Cargo and dependency access:

```bash
cargo fmt --all -- --check
cargo test --locked
cargo clippy --locked --all-targets -- -D warnings
./scripts/build-release.sh
```