# Rullst

> Rullst is a modular, strictly typed Rust framework suite (Tokio, Axum, Tower, SQLx) for full-stack web applications: Active Record ORM, server-rendered html! views with HTMX, authentication, security middleware and the cargo-rullst CLI. This index lists every page of the Rullst book in reading order; llms-full.txt holds their full Markdown.

Full text of every page: https://rullst.github.io/Rullst/llms-full.txt

## Introduction

- [Welcome to Rullst](https://rullst.github.io/Rullst/book/index.html): Because With Rullst, We Rule!
- [Start Here: Your First Idea in Rust](https://rullst.github.io/Rullst/book/start-here.html): You do not need to understand every Rullst crate before writing your first application.
- [Getting Started & Starters](https://rullst.github.io/Rullst/book/1-getting-started.html): Welcome to the Rullst Getting Started guide!
- [Build Times](https://rullst.github.io/Rullst/book/build-times.html): Most of the time spent waiting on a Rullst application is `cargo build` or `cargo rullst dev` rebuilding it after an edit.
- [Database Support](https://rullst.github.io/Rullst/book/database-support.html): Read this page before you choose a database.
- [API Reference & REST Learning Path](https://rullst.github.io/Rullst/book/api-reference.html): There are two different meanings of API in this documentation:
- [Why Rullst?](https://rullst.github.io/Rullst/book/why-Rullst.html): Rullst is an opinionated, Axum-based full-stack framework for teams that want the productivity of a coordinated application platform without hiding Rust's types or the underlying ecosystem.
- [The Rullst Philosophy](https://rullst.github.io/Rullst/book/philosophy.html): Rullst exists to make ambitious software feel possible in Rust without hiding the language, the generated code, or the boundaries that keep an application safe.
- [Simple Capability Status](https://rullst.github.io/Rullst/book/capability-status.html): This is the compact view of Rullst's canonical M1–M41 programme.
- [Maturity Tiers: Core, Extension, Experimental](https://rullst.github.io/Rullst/book/maturity.html): Decision recorded on 8 October 2026 for the v13 line, before `13.0.0-alpha.1`.

## Rullst Cookbook & Tutorials: Level 1: Basic (Foundations & CRUD)

- [Zero to a Complete App (one-hour path)](https://rullst.github.io/Rullst/book/tutorials/zero-to-complete-app.html): What you will build: *Notes*, a small web app where people register, sign in and keep private notes.
- [01. Hello Rullst!](https://rullst.github.io/Rullst/book/tutorials/01-hello-world.html): What you will build: one complete web application with a typed route and server-rendered HTML.
- [REST API Quickstart](https://rullst.github.io/Rullst/book/tutorials/rest-api-quickstart.html): Your result: a typed JSON response you can verify from another terminal.
- [02. CLI Automation & Generators](https://rullst.github.io/Rullst/book/tutorials/02-cli-generators.html): Your goal: generate a small piece of the application, find the resulting files and understand what still needs your code.
- [03. Active Record CRUD Operations](https://rullst.github.io/Rullst/book/tutorials/03-active-record-crud.html): `rullst-orm` derives a typed query builder and persistence methods from a Rust struct.
- [04. Data Mapper & Repository Pattern](https://rullst.github.io/Rullst/book/tutorials/04-repository-pattern.html): For domain-heavy code, Rullst exposes a small `Repository<T>` contract.
- [05. Database Migrations & Seeds](https://rullst.github.io/Rullst/book/tutorials/05-migrations-and-seeds.html): Rullst uses timestamped Rust migration modules for SQLx-primary projects.
- [06. HTMX-oriented Server Rendering](https://rullst.github.io/Rullst/book/tutorials/06-htmx-zero-bundle.html): The Blank and SaaS starters render HTML on the server and use HTMX attributes for targeted requests and fragment swaps.
- [07. Forms & DTO Validation](https://rullst.github.io/Rullst/book/tutorials/07-forms-and-validation.html): Rullst provides `ValidatedForm<T>` and `ValidatedJson<T>` extractors.
- [08. Controllers & Middlewares](https://rullst.github.io/Rullst/book/tutorials/08-routing-and-middlewares.html): Rullst's `Router` wraps Axum's router while preserving explicit Tower middleware composition.
- [09. Environment Config](https://rullst.github.io/Rullst/book/tutorials/09-environment-config.html): Rullst provides a validated runtime environment shared by its subsystems.
- [10. Static Assets & Compression](https://rullst.github.io/Rullst/book/tutorials/10-static-assets-and-compression.html): The standard `Server` serves an existing `static/` directory at `/static`.

## Rullst Cookbook & Tutorials: Level 2: Intermediate (Security, Auth & Real-Time)

- [11. Authentication Scaffolding](https://rullst.github.io/Rullst/book/tutorials/11-authentication-system.html): The authentication generator creates a reviewable starting point for cookie-session login and registration.
- [12. JWT vs Session Auth](https://rullst.github.io/Rullst/book/tutorials/12-jwt-and-session-auth.html): Cookie sessions and bearer JWTs are transport choices with different operational trade-offs.
- [13. RBAC & IDOR Protection](https://rullst.github.io/Rullst/book/tutorials/13-rbac-authorization.html): `rullst-security` provides role, owner, and tenant checks over a trusted `UserContext`.
- [14. RASP Security Layer](https://rullst.github.io/Rullst/book/tutorials/14-rasp-security-layer.html): `rullst-security::rasp` applies bounded heuristic signatures to request targets, non-secret headers, and supported textual bodies.
- [15. Vault & Field Encryption](https://rullst.github.io/Rullst/book/tutorials/15-rullst-vault-encryption.html): Rullst can encrypt `String` and `Option<String>` model fields before they reach the database and decrypt them when a generated ORM query loads the model.
- [16. LiveView Server-Driven UI](https://rullst.github.io/Rullst/book/tutorials/16-liveview-server-driven-ui.html): Build a per-connection Rust component that receives JSON events and sends rendered HTML over WebSockets.
- [17. Real-Time WebSockets & Presence](https://rullst.github.io/Rullst/book/tutorials/17-websockets-realtime-chat.html): Rullst Core provides bounded in-process broadcast channels and presence state.
- [18. Wasm Islands in Pure Rust](https://rullst.github.io/Rullst/book/tutorials/18-wasm-islands-rust.html): Rullst can generate a dual-target Island function: native builds emit a host element with serialized props, while `wasm32-unknown-unknown` builds export a hydration function.
- [19. SaaS Billing with Capital](https://rullst.github.io/Rullst/book/tutorials/19-saas-billing-capital.html): This tutorial creates a checkout adapter boundary and explains how to feed the optional local Studio view without treating it as an accounting system.
- [20. Background Jobs & Task Queues](https://rullst.github.io/Rullst/book/tutorials/20-background-jobs-queues.html): Rullst Core provides named JSON jobs, SQLite and Redis storage drivers, and a bounded-concurrency worker.

## Rullst Cookbook & Tutorials: Level 3: Advanced (Enterprise, AI, IoT & Cloud)

- [21. Explicit Local AI with Ollama](https://rullst.github.io/Rullst/book/tutorials/21-local-ai-ollama.html): Use an explicit `OllamaProvider` when a workload must not fall through to a configured cloud provider.
- [22. RAG Systems & Vector Search](https://rullst.github.io/Rullst/book/tutorials/22-rag-vector-search.html): Rullst provides three deliberately separate vector paths: a deterministic in-memory index in `rullst-ai`, parameterized PostgreSQL `pgvector` queries, and a bounded Qdrant HTTP adapter in…
- [23. Process Telemetry & Prometheus](https://rullst.github.io/Rullst/book/tutorials/23-rullst-radar-prometheus.html): Monitor process uptime, RSS memory, CPU, Tokio scheduler-yield latency, and active tasks using Rullst Radar (`rullst::radar`) and Prometheus (`GET /metrics`).
- [24. Interactive Scalar API Docs](https://rullst.github.io/Rullst/book/tutorials/24-scalar-api-docs.html): Scaffold a Scalar OpenAPI documentation router served at `/docs`.
- [25. Kubernetes Deployment & Probes](https://rullst.github.io/Rullst/book/tutorials/25-kubernetes-deployment.html): `cargo-rullst` can generate a Kubernetes starter set.
- [26. Guided Container Deployment](https://rullst.github.io/Rullst/book/tutorials/26-one-click-paas-deploy.html): `cargo rullst deploy` prepares the files you need to run your application on any Linux server (a virtual machine from any provider, or your own machine) with Docker or Podman.
- [27. Typed Dependency Injection](https://rullst.github.io/Rullst/book/tutorials/27-zero-cost-di.html): Rullst DI uses Rust types as keys and avoids runtime reflection metadata.
- [29. Embedded IoT & Edge Systems](https://rullst.github.io/Rullst/book/tutorials/29-embedded-iot-edge.html): `rullst-iot` provides telemetry/state models and protocol frame builders that compile without `std`.
- [30. Framework Escape Hatch](https://rullst.github.io/Rullst/book/tutorials/30-framework-escape-hatch.html): `eject` generates a minimal Axum/Tokio entry point that can begin a manual migration away from Rullst's server wrapper.

## Rullst Cookbook & Tutorials: Level 4: Operational Guides & Advanced Boundaries

- [31. SaaS Deployment Preparation](https://rullst.github.io/Rullst/book/tutorials/31-end-to-end-saas-aws-gcp.html): This guide prepares a generated SaaS application for a cloud deployment.
- [32. Bounded Security Telemetry](https://rullst.github.io/Rullst/book/tutorials/32-ai-sentinel-soc-dashboard.html): Rullst's honeypot, RASP and Studio security page provide local defense-in-depth signals.
- [33. Auth-Bound Multi-Tenancy](https://rullst.github.io/Rullst/book/tutorials/33-multi-tenant-b2b-saas.html): Rullst Core can select a tenant from a request hint only after application authentication has inserted a trusted `TenantMembership`.
- [34. Live Analytics Dashboard & WebSockets](https://rullst.github.io/Rullst/book/tutorials/34-realtime-dashboard-liveview-websockets.html): Build a per-connection analytics view with `rullst::live`.
- [35. Performance Measurement & Resilient Operation](https://rullst.github.io/Rullst/book/tutorials/35-high-performance-benchmarking.html): Performance is a property of a concrete application, build, host and workload.
- [36. Assisted Framework Upgrades](https://rullst.github.io/Rullst/book/tutorials/36-assisted-framework-upgrades.html): Rullst v12 introduced a bounded upgrade transaction for existing applications.
- [37. Polyglot Persistence](https://rullst.github.io/Rullst/book/polyglot-persistence.html): Rullst keeps explicit relational and specialized persistence contracts.
- [38. Transactional Outbox & Durable Effects](https://rullst.github.io/Rullst/book/tutorials/38-transactional-outbox.html): Use a transactional outbox when a committed database change must eventually produce an external effect even if the application process stops between the two operations.
- [39. Scout Search Providers](https://rullst.github.io/Rullst/book/tutorials/39-scout-search.html): Scout connects a `#[orm(searchable)]` SQLx model to one search backend.
- [41. Tenant-Bound RAG](https://rullst.github.io/Rullst/book/tutorials/41-tenant-bound-rag.html): Rullst's bounded RAG pipeline turns one authenticated question into a guarded embedding, authorized retrieval request, budgeted context, grounded model call, source metadata, and a terminal audit…
- [42. Server-Bound OAuth/OIDC Sessions](https://rullst.github.io/Rullst/book/tutorials/42-server-bound-oauth-sessions.html): Rullst Connect manages the browser-to-provider callback challenge: it generates state and PKCE for OAuth 2.0, adds a nonce for OpenID Connect, keeps those private values on the server and consumes…
- [43. Installable Apps: PWA, Google Play and Microsoft Store](https://rullst.github.io/Rullst/book/tutorials/43-progressive-web-apps.html): A Rullst application is already a web application.
- [45. Accessible Academy Media](https://rullst.github.io/Rullst/book/tutorials/45-accessible-academy-media.html): Rullst's LMS example (`examples/lms`) contains a bounded lesson-presentation foundation for video and audio.
- [48. Signed Local OIDC Testing](https://rullst.github.io/Rullst/book/tutorials/48-local-oidc-testing.html): Rullst Connect includes an explicitly mounted local identity-provider fixture so an application can exercise a cryptographically verified OIDC flow without a third-party account.
- [49. Bounded Brokered Messaging](https://rullst.github.io/Rullst/book/tutorials/49-brokered-messaging.html): This tutorial starts with `rullst-messaging`'s deterministic in-memory broker and then switches the same trait contract to the durable local SQLite adapter.
- [50. Auditable Revisions](https://rullst.github.io/Rullst/book/tutorials/50-auditable-revisions.html): Rullst SQLx models can bind each instance mutation to a validated principal and restore eligible update revisions as a new compensating mutation.
- [51. Supervised Development Auto-Reload](https://rullst.github.io/Rullst/book/tutorials/51-authenticated-hot-reload.html): `cargo rullst dev` and `cargo rullst dash` rebuild and restart a directly linked application when you save.
- [52. Typed Server Functions](https://rullst.github.io/Rullst/book/tutorials/52-typed-server-functions.html): `#[server_function]` lets one concrete async Rust signature describe both the native server implementation and its Wasm caller.

## Guides

- [Architecture Choices: ORM & Frontend](https://rullst.github.io/Rullst/book/architecture-decisions.html): `cargo rullst new` records product capabilities that materially change the generated application.
- [Rullst AI: Developing with Autonomous Agents](https://rullst.github.io/Rullst/book/2-rullst-ai.html): Rullst is designed as an AI-native Rust framework.
- [Rullst Studio: Real-Time Monitoring](https://rullst.github.io/Rullst/book/3-rullst-studio.html): Rullst Studio is a developer-facing Axum dashboard.
- [Rullst Nexus: Explicit Admin CMS](https://rullst.github.io/Rullst/book/4-rullst-nexus.html): Rullst Nexus is a server-rendered administrative CMS for explicitly registered Rullst models.
- [Rullst Capital: SaaS Billing Made Easy](https://rullst.github.io/Rullst/book/5-rullst-capital.html): `rullst-capital` provides provider-neutral billing abstractions, revenue metrics, verified webhook plumbing and two payment-provider adapters: Stripe (supported) and InfinitePay (experimental until…
- [Integrating AI into Rullst](https://rullst.github.io/Rullst/book/6-ai-integration-tutorial.html): `rullst-ai` provides guarded adapters for OpenAI, Anthropic, Gemini, DeepSeek, Ollama, and explicitly configured OpenAI-compatible local/cloud endpoints.
- [Rullst AI Architecture & Local Models](https://rullst.github.io/Rullst/book/7-ai-token-economy-and-local-llms.html): Rullst favors explicit types, conventional file locations, bounded macros and generated `.llms.txt` context.
- [Redis Architecture, Caching & Distributed Queues](https://rullst.github.io/Rullst/book/redis-guide.html): Rullst keeps cache and queue backends explicit.
- [Threat Radar & SOC Master Guide](https://rullst.github.io/Rullst/book/threat-radar-soc-guide.html): Rullst exposes development dashboards for security events in Studio and Nexus.
- [Telemetry & Distributed Tracing](https://rullst.github.io/Rullst/book/telemetry-guide.html): Rullst exposes three related but separate observability surfaces:
- [Production Monitoring Endpoint](https://rullst.github.io/Rullst/book/production-monitoring.html): Rullst Studio's local pages are a development tool: they run only in debug builds, on `127.0.0.1:5555`, and read the local process.
- [Payment Gateways & Financial Infrastructure](https://rullst.github.io/Rullst/book/payment-gateways-guide.html): Rullst Capital (`rullst-capital`) provides typed payment, subscription and webhook contracts with two built-in adapters.
- [Writing Your Own Payment Provider](https://rullst.github.io/Rullst/book/capital-custom-provider.html): Rullst Capital ships two built-in adapters: Stripe (supported) and InfinitePay (experimental until it is validated against a live account).
- [Writing Your Own Mail Transport](https://rullst.github.io/Rullst/book/mail-custom-transport.html): Rullst Mail ships four delivery transports: Resend, AWS SES, SendPulse and SMTP, plus the `log`, `memory` and offline `mock_*` drivers for development and tests.
- [Monorepo Examples & Reference Apps](https://rullst.github.io/Rullst/book/examples.html): The repository examples and CLI starters serve different purposes:
- [Axum/SQLx Interoperability](https://rullst.github.io/Rullst/book/axum-sqlx-migration.html): Rullst builds on Axum, Tokio, Tower and SQLx and preserves direct access to their APIs.
- [GitHub CLI Installation & Safe Login](https://rullst.github.io/Rullst/book/gh-install.html): The GitHub CLI (`gh`) lets a maintainer inspect workflow runs, pull requests, issues, Dependabot state, and Code Scanning alerts from a terminal.

## v13 Preview (in development)

- [Generated Project Instructions & Context](https://rullst.github.io/Rullst/book/project-context.html): Since v13, `cargo rullst new` and `cargo rullst generate:ai-context` write a bounded project inventory and create an application `AGENTS.md` when none exists; existing instructions are preserved.
- [Schema-First Rust & TypeScript APIs](https://rullst.github.io/Rullst/book/typed-api.html): `cargo rullst generate:api` is new in v13 (first published in 13.0.0-alpha.1).
- [Translations and Locales](https://rullst.github.io/Rullst/book/i18n.html): Since 13.0.0-alpha.2, `rullst::i18n` translates an application's interface with catalogs checked at compile time, chooses each visitor's locale from a cookie or `Accept-Language`, and switches locale…
- [Active Sessions and Remote Logout](https://rullst.github.io/Rullst/book/session-management.html): The v13 candidate extends `rullst-auth::recovery::SqlRecoveryStore` with a bounded session inventory, selective sibling logout and logout of all other sessions.
- [Email login](https://rullst.github.io/Rullst/book/email-login.html): `rullst-auth` features `email-login-sqlite` and `email-login-postgres` expose `recovery::email_login::EmailLoginService`.
- [Scoped API tokens](https://rullst.github.io/Rullst/book/api-tokens.html): Auth features `api-tokens-sqlite` and `api-tokens-postgres` expose `recovery::api_tokens::ApiTokenService`.
- [Shared Passkey Ceremony Contract](https://rullst.github.io/Rullst/book/shared-passkey-ceremonies.html): This v13 implementation, published in the 13.0.0-alpha.1 prerelease, passed real-PostgreSQL and Chromium contracts, hosted workspace checks and isolated-archive acceptance in PR #223.
- [Form File Uploads](https://rullst.github.io/Rullst/book/form-uploads.html): `rullst::uploads::Multipart` reads a `multipart/form-data` request, the body a browser sends for a form with a file input, under explicit limits.
- [Private S3/R2 Object Storage](https://rullst.github.io/Rullst/book/private-object-storage.html): The v13 `storage-s3` candidate adds optional AWS S3 and Cloudflare R2 operations to `rullst-core::Storage` and the `rullst` facade.
- [Resumable private multipart uploads](https://rullst.github.io/Rullst/book/private-multipart-uploads.html): The v13 prerelease (13.0.0-alpha.1) adds Core/facade `storage-multipart`.
- [Shared mail suppression](https://rullst.github.io/Rullst/book/shared-mail-suppression.html): Mail's optional `postgres` feature exposes `PostgresSuppressionStore`, `PostgresSuppressionConfig` and `SuppressionKey`; the facade feature is `mail-postgres`.
- [Durable recurring publications](https://rullst.github.io/Rullst/book/recurring-publications.html): The v13 prerelease (13.0.0-alpha.1) adds Messaging `schedules-postgres` and facade `messaging-schedules-postgres`.
- [Durable outgoing webhooks](https://rullst.github.io/Rullst/book/outgoing-webhooks.html): The v13 prerelease (13.0.0-alpha.1) adds Messaging `webhooks` and facade `messaging-webhooks`.
- [Redis Streams Messaging](https://rullst.github.io/Rullst/book/redis-messaging.html): The v13 candidate adds `RedisBroker` to the existing `rullst-messaging` crate.
- [Recoverable Live UI](https://rullst.github.io/Rullst/book/live-recovery.html): The v13 prerelease (13.0.0-alpha.1) adds `rullst::live::recovery` in the existing Core and facade, with no extra feature or browser dependency.
- [Distributed Operation Tracing](https://rullst.github.io/Rullst/book/distributed-tracing.html): The v13 prerelease (13.0.0-alpha.1) extends Core/facade's optional `telemetry` feature with `telemetry::distributed`.
- [Deploy to a Linux VM](https://rullst.github.io/Rullst/book/vm-deployment.html): This page is the shared part of the four provider guides (Hetzner Cloud, DigitalOcean, Oracle Cloud and Google Cloud).
- [Hetzner Cloud](https://rullst.github.io/Rullst/book/deploy-hetzner.html): Hetzner Cloud sells simple virtual machines ("Cloud Servers") in European and some other regions.
- [DigitalOcean](https://rullst.github.io/Rullst/book/deploy-digitalocean.html): DigitalOcean calls its virtual machines "Droplets".
- [Oracle Cloud](https://rullst.github.io/Rullst/book/deploy-oracle-cloud.html): Oracle Cloud Infrastructure (OCI) offers an Always Free tier that includes small virtual machines.
- [Google Cloud](https://rullst.github.io/Rullst/book/deploy-google-cloud.html): This guide runs your app on a Compute Engine virtual machine.
- [Advanced deployment (Nix, Buildah, Quadlet, Kubernetes)](https://rullst.github.io/Rullst/book/advanced-deployment.html): This page is for people who already run servers and want to deploy a Rullst application with a tool the CLI does not know about: Nix, Buildah, Podman Quadlet or Kubernetes.
- [Two-Replica Deployment Acceptance](https://rullst.github.io/Rullst/book/deployment-acceptance.html): This v13 candidate exercises two independent Rullst application processes behind a digest-pinned Caddy proxy and an owned Redis server.
- [Local Deployment Configuration Diagnostic](https://rullst.github.io/Rullst/book/deployment-diagnostic.html): The v13 `deploy:doctor` candidate inspects a bounded local configuration snapshot without starting the application, invoking other programs, contacting a provider or changing files.
- [Privacy & Proportional Age Assurance](https://rullst.github.io/Rullst/book/privacy-age-assurance-roadmap.html): Status: v13 P0, initial age-assurance foundation (first published in the 13.0.0-alpha.1 prerelease on 11 October 2026), reviewed 17 September 2026; persistence, consumer and packaging engineering…
- [Transparent Exam & Parental Supervision](https://rullst.github.io/Rullst/book/supervision.html): Status: v13 candidate, first published in the 13.0.0-alpha.1 prerelease.
- [Exam observation integration](https://rullst.github.io/Rullst/book/supervision-observations.html): v13 candidate, first published in the 13.0.0-alpha.1 prerelease.
- [Private Course Video Integration Candidate](https://rullst.github.io/Rullst/book/managed-video.html): `rullst-media` is an optional v13 candidate, first published in the 13.0.0-alpha.1 prerelease.

## Reference

- [Framework Spec](https://rullst.github.io/Rullst/book/spec.html): This document is the Single Source of Truth (SST) for the Rullst Framework.
- [CLI Reference](https://rullst.github.io/Rullst/book/cli_reference.html): The Command Line Interface (`cargo-rullst`) scaffolds projects, invokes build tools, and provides bounded static-analysis and deployment helpers.
- [Cargo Feature Matrix](https://rullst.github.io/Rullst/book/feature-matrix.html): This page is the public feature contract for the 20 packages in the v13 release inventory: the 16 published 12.x packages plus the `rullst-privacy`, `rullst-supervision`, `rullst-media` and…
- [Compatibility, MSRV & Support Policy](https://rullst.github.io/Rullst/book/compatibility-policy.html): This policy applies to the packages in the release inventory: 16 packages in the v12 line and 20 in v13, which adds `rullst-privacy`, `rullst-supervision`, `rullst-media` and `rullst-labs`.
- [Rullst v12 Stable Release Record](https://rullst.github.io/Rullst/book/v12.html): The `v12` maintenance line released 12.1.2 (tag `v12.1.2`, 28 September 2026 UTC, 27 September in Brasília) with Nexus stored-value escaping, HTML macro caller-binding hygiene, explicit OAuth…
- [Migrating Applications to v12](https://rullst.github.io/Rullst/book/migration-v12.html): Rullst v12 is a coordinated release train of 16 packages.
- [12.0 to 12.1](https://rullst.github.io/Rullst/book/migration-v12-1.html): Version 12.1.1 is published.
- [v5 to v12](https://rullst.github.io/Rullst/book/migration-v5-to-v12.html): Baseline: the repository tag `v5.0.0` and the compatible v5 line.
- [v6 to v12](https://rullst.github.io/Rullst/book/migration-v6-to-v12.html): Baseline: repository source commit `5229132f`, which bumped the facade to `6.0.0`.
- [v11-era Dependencies to v12](https://rullst.github.io/Rullst/book/migration-v11-to-v12.html): There is no repository tag for a `rullst` umbrella v11 release.
- [AI Provider Capability Matrix](https://rullst.github.io/Rullst/book/ai-provider-capabilities.html): This matrix describes the transport paths implemented by the current `rullst-ai` source.
- [Guarded Local AI Tools](https://rullst.github.io/Rullst/book/ai-tool-security.html): `rullst-ai` includes a local tool registry, not provider-native function calling or an autonomous agent runtime.
- [Security Architecture](https://rullst.github.io/Rullst/book/security-architecture.html): `rullst-security` contains composable controls for HTTP applications.
- [Which Security Layer to Use, and When](https://rullst.github.io/Rullst/book/security-layers.html): Rullst has two places for security code, and some of their controls look alike:
- [Security Report (`audit --report`)](https://rullst.github.io/Rullst/book/security-report.html): `cargo rullst audit --report [md|html|json]` (new in 13.0) writes an evidence report about one project: a set of bounded static checks mapped to OWASP ASVS 5.0.0 Level 1, a personal-data inventory…
- [External Audit Kit](https://rullst.github.io/Rullst/book/external-audit-kit.html): This page is for a third-party reviewer or penetration tester.
- [Security Assurance Case](https://rullst.github.io/Rullst/book/assurance-case.html): This page argues why Rullst's security requirements are met, and where they are not.
- [Security Event Schema v1](https://rullst.github.io/Rullst/book/security-event-schema.html): `rullst-security::LiveSecurityEvent` is the bounded event contract rendered by Studio/Nexus and accepted by the process-local security store.
- [CORS Scaffold Security Advisory](https://rullst.github.io/Rullst/book/cors-scaffold-security-advisory.html): `cargo-rullst make:cors` or by blueprints that copied a permissive or reflected CORS policy.
- [Security Advisory Exceptions](https://rullst.github.io/Rullst/book/security-advisory-exceptions.html): Rullst does not treat an ignored scanner finding as remediated.
- [Reproducible Crate Archives](https://rullst.github.io/Rullst/book/reproducible-builds.html): Rullst claims one specific kind of reproducibility: for the same commit and the toolchain pinned in that commit's `rust-toolchain.toml`, `cargo package` produces bit-for-bit identical `.crate`…

## Crates Ecosystem

- [rullst-orm](https://rullst.github.io/Rullst/book/crates/orm.html): 🚀 Visit the Official Website & Documentation Hub 🚀
- [Transactional partial updates](https://rullst.github.io/Rullst/book/transactional-partial-updates.html): Since v13 (first released in 13.0.0-alpha.1), a SQLx model’s typed partial change participates in the model's normal save lifecycle.
- [rullst-connect](https://rullst.github.io/Rullst/book/crates/connect.html): Since 12.1.2 (and in v13), built-in authorization-code URLs explicitly request `response_type=code`.
- [rullst-messaging](https://rullst.github.io/Rullst/book/crates/messaging.html): `rullst-messaging` (Extension tier) is the broker-neutral event boundary for Rullst.
- [rullst-mail](https://rullst.github.io/Rullst/book/crates/mail.html): `rullst-mail` is Rullst's transactional email and mailables engine.
- [12.1 account mail](https://rullst.github.io/Rullst/book/account-mail-v12-1.html): This is an opt-in contract.
- [rullst-auth](https://rullst.github.io/Rullst/book/crates/auth.html): `rullst-auth` provides Argon2id password hashing, versioned AES-GCM cookie sessions, role-based authorization middleware, WebAuthn/passkey ceremony verification, and an opt-in application JWT policy.
- [rullst-core](https://rullst.github.io/Rullst/book/crates/core.html): `rullst-core` contains Rullst's runtime primitives, Axum-compatible routing, state management, health probes, process telemetry, queues, and configuration helpers.
- [rullst-capital](https://rullst.github.io/Rullst/book/crates/capital.html): `rullst-capital` provides a provider-neutral billing base for SaaS and digital commerce in Rust: billing/metering traits, checkout and subscription contracts, entitlements, quotas, revenue analytics…
- [rullst-studio](https://rullst.github.io/Rullst/book/crates/studio.html): `rullst-studio` is the built-in, local-first administration and monitoring dashboard for Rullst.
- [rullst-nexus](https://rullst.github.io/Rullst/book/crates/nexus.html): `rullst-nexus` is a server-rendered administrative panel for models that implement `NexusModel`, either manually or through `#[derive(Nexus)]`.
- [rullst-ai](https://rullst.github.io/Rullst/book/crates/ai.html): `rullst-ai` is a provider-agnostic LLM client with mandatory outbound prompt-injection checks, PII masking, deterministic offline fixtures, JSON mode, explicit JSON Schema output, and a bounded…
- [rullst-security](https://rullst.github.io/Rullst/book/crates/security.html): `rullst-security` provides authenticated field encryption, bounded defensive middleware, local abuse controls, and security telemetry.
- [rullst-iot](https://rullst.github.io/Rullst/book/crates/iot.html): `rullst-iot` provides high-assurance telemetry models, bare-metal `#![no_std]` data structures and packet encoders, and a cryptographically verified Over-The-Air (OTA) firmware update state machine.

## Project & Governance

- [Blueprints Roadmap](https://rullst.github.io/Rullst/book/blueprints_roadmap.html): This document maps the expansion plan for the Rullst Starter Blueprints ecosystem.
- [Dependency Helper & Package Roadmap](https://rullst.github.io/Rullst/book/packages-spec.html): Rullst (v12 and the v13 prerelease line) does not define a runtime `RullstPackage` plugin ABI, execute third-party generators, discover a private package registry, or register routes automatically.
- [Sustainable v12 Maintenance & v13 Priorities](https://rullst.github.io/Rullst/book/v13-priorities.html): The owner prioritizes a maintained, secure stable v12.1 line and useful v13 deliveries over publishing a major version merely to meet September 26.
- [v13 Maintenance Scope & Extension Strategy](https://rullst.github.io/Rullst/book/v13-maintenance-scope.html): Decision adopted on 22 September 2026: concentrate Rullst's investment on secure, productive application development and keep specialized capabilities within explicit maintenance boundaries.
- [v13 Framework References & Comparative Evaluation](https://rullst.github.io/Rullst/book/v13-framework-comparison.html): Planning direction adopted on 23 September 2026.
- [Nexus Application Integration Plan](https://rullst.github.io/Rullst/book/nexus-integration-plan.html): Status: proposed scope, reviewed on 25 September 2026.
- [AI Maintainability & Project-Building Roadmap](https://rullst.github.io/Rullst/book/ai-maintainability-roadmap.html): Rullst aims to be understandable to humans and coding assistants without making model-independent quality claims.
- [Legal & Regulatory Compliance Roadmap](https://rullst.github.io/Rullst/book/legal-compliance-roadmap.html): Status: planned (recorded 2026-10-01) for the v13 feature line.
- [Green Software Roadmap](https://rullst.github.io/Rullst/book/green-software-roadmap.html): Status: planned (recorded 2026-10-01) for the v13 feature line.
- [Efficiency Figures for an App (`green`)](https://rullst.github.io/Rullst/book/green.html): Status: experimental command of the main CLI, `cargo-rullst` (13.0.0-alpha.4 and later; it replaces `cargo rullst footprint`).
- [Rullst Labs Roadmap](https://rullst.github.io/Rullst/book/rullst-labs-roadmap.html): Rullst should make interactive programming exercises, deterministic graders and bounded learning games easier to build without placing untrusted code inside an application server.
- [Labs Runner Contract: Bring Your Own Runner](https://rullst.github.io/Rullst/book/labs-runner-contract.html): `rullst-labs` owns trusted exercises, authorization, encrypted durable jobs, fenced leases, exact grading, cancellation, recovery and retention.
- [Labs First Profile Decision & Threat Model (Removed Runner)](https://rullst.github.io/Rullst/book/labs-first-profile.html): Status: implementation decision for an unpublished experimental candidate.
- [Managed Private Video Roadmap](https://rullst.github.io/Rullst/book/managed-video-roadmap.html): On September 20, 2026 the owner asked about Bunny.net video hosting and a native Rullst integration.
- [Verus Verification Pilot for v13](https://rullst.github.io/Rullst/book/verus-roadmap.html): Status: locally verified v13 candidate, 20 September 2026.
- [SaaS Findings: v12.1 & v13 Triage](https://rullst.github.io/Rullst/book/saas-v12-1-v13-triage.html): The latest examples account-lifecycle proposal adds MAIL-001/RULLST-005.
- [Per-Commit Quality Scorecard](https://rullst.github.io/Rullst/book/quality-scorecard.html): The published v12 source, `eb11f892ae28f076e7a83c38a635316c6ed89028`, received 94/100 (A) in Rust CI run 34895536764.
- [OpenSSF Scorecard Evidence & Improvements](https://rullst.github.io/Rullst/book/openssf-scorecard.html): The public report is separate from Rullst's per-commit quality scorecard.
- [OpenSSF Best Practices: Silver Evidence](https://rullst.github.io/Rullst/book/openssf-best-practices.html): Rullst holds the Silver OpenSSF Best Practices badge (project 13321), granted on 10 October 2026.
- [v12 Stable Release Audit](https://rullst.github.io/Rullst/book/v12-release-audit.html): Status: Rullst `12.0.0` was published on September 15, 2026 from immutable tag `v12.0.0` at commit `eb11f892ae28f076e7a83c38a635316c6ed89028`.
- [v12 Partial Release Recovery](https://rullst.github.io/Rullst/book/release-recovery.html): This runbook covers an interrupted multi-crate publication.
- [Website Maintenance & Privacy Boundaries](https://rullst.github.io/Rullst/book/website-maintenance.html): The public entry points have different deployment sources:
- [Rullst Academy Product Programme](https://rullst.github.io/Rullst/book/rullst-academy.html): Rullst Academy is a web-first platform for learning Rust and Rullst through short explanations, authoritative interactive exercises, review sessions and small practical projects.
- [Maybe SaaS: Product Incubation Strategy](https://rullst.github.io/Rullst/book/maybesaas.html): Some of Rullst's most ambitious ideas need more than another module in a web framework.

## Historical Records

- [Historical Documentation Sources](https://rullst.github.io/Rullst/book/original-documentation-audit.html): Rullst's original ambition and the subsequent audit remain recoverable from immutable source snapshots:
- [Archived v12 Hardening Tracker](https://rullst.github.io/Rullst/book/hardening-status.html): The pre-release tracker has been retired after publication of Rullst 12.0.0.
- [Archived Framework Comparison](https://rullst.github.io/Rullst/book/comparatives.html): The August 27, 2026 comparison is a dated research snapshot.

## Optional

- [Preparing Applications for v13](https://rullst.github.io/Rullst/book/migration-v13.html): The current source is `13.0.0-alpha.4`, a prerelease, not a stable v13 release.
- [Capability Status & Vision Decisions](https://rullst.github.io/Rullst/book/capability-ledger.html): Rullst's ambitious ideas are not deleted when an implementation is incomplete.
- [Rullst Threat Models](https://rullst.github.io/Rullst/book/threat-models.html): These models turn security ambitions into named abuse cases.
- [v12 Security Claims & Evidence](https://rullst.github.io/Rullst/book/v12-security-claims.html): This page is the canonical boundary for security claims made by the Rullst v12 release notes.
- [CI/CD & Security Workflows](https://rullst.github.io/Rullst/book/workflows.html): This document describes what the repository's automation currently executes.
- [Rullst Official Roadmap](https://rullst.github.io/Rullst/book/roadmap.html): Rullst's ambition is an asset.
- [v13 Delivery Plan & Evidence](https://rullst.github.io/Rullst/book/v13-delivery-plan.html): 13.0.0-alpha.4 prepared on October 29, 2026 (not yet published).