# API
`kcode-rust-library-toolchain` validates and publishes a validated `kcode_rust_source::Source`.
Public API: `check(&Source)` and `publish(&Source, token)`. Each call materializes a disposable workspace. Validation runs six stages: fetch, rustfmt, build, Clippy, all-target tests, and documentation tests. Every Cargo command uses the global `cargo --quiet ...` form. Formatting is applied only to the disposable copy, so rustfmt-repairable differences are accepted without changing managed source.
The embedded rootless Podman image includes Rust 1.97, Clippy, rustfmt, and Chromium. Chromium’s nested process sandbox is disabled only inside the hardened validation container. Offline stages run without a network.
Failed commands retain complete captured stdout and stderr without truncation. Publication revalidates, uses Cargo’s token credential provider, and redacts the registry token from complete diagnostics. No operation publishes unless `publish` is explicitly called.