Boundary Check

Publish the reusable contract, not the downstream behavior.

Rusty XR should make downstream XR apps easier to build while keeping product-specific behavior, device artifacts, private research logic, and release ownership outside the public core.

Public Candidates

Plain XR, camera, depth, SDF, hand, interaction, media-layer, and render contracts.
Generic runtime configuration, diagnostic, permission, stream, and manifest models.
Small math, projection, decoding, sampling, validation, and layout helpers.
Public examples authored from synthetic or intentionally public data.

Keep Downstream

App-specific package names, signing data, release payloads, local device paths, and generated captures.
Private scenes, shader behavior, tuning constants, session logic, and product parity details.
Native platform ownership such as Android lifecycle, OpenXR sessions, renderer setup, and permission prompts.
Raw planning notes, raw graphify outputs, and private source paths.

Extraction Gate

Review Checklist

Question	Expected answer before publishing
Can it build without downstream repos?	Yes. Pure crates should compile and test from this repo alone.
Can it be tested with synthetic fixtures?	Yes. Add unit tests for parsing, math, validation, sampling, or payload behavior.
Does it expose app-specific names or behavior?	No. Use generic names and keep product behavior downstream.
Does it need a native framework?	Only in an optional adapter, not in pure contracts.

ADB And Distribution

Normal headset apps, external ADB hosts, and ADB-launched shell helpers are separate privilege and distribution layers. Store-style builds should remain useful without ADB and should not present shell-helper actions, Wi-Fi ADB bootstrap, or arbitrary APK installation as normal app capabilities. See QUEST_DISTRIBUTION_AND_ADB_BOUNDARY.md.