From a8e77ffb85e0103defd4ee4b40b014c32ffe947e Mon Sep 17 00:00:00 2001
From: Wanjohi <elviswanjohi47@gmail.com>
Date: Wed, 26 Aug 2026 17:49:43 +0300
Subject: [PATCH] chore: add the Rust workspace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This repo holds both languages, so it needs both workspaces. Layout is the same
rule on each side — apps/ for what runs, crates/ and packages/ for what is
shared, split by what a thing is rather than what it is written in.

Members are empty because nothing has moved in yet. Versions are pinned once at
the root so two crates cannot disagree about a dependency.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .gitignore       |  4 ++++
 Cargo.toml       | 33 +++++++++++++++++++++++++++++++++
 crates/README.md | 20 ++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 Cargo.toml
 create mode 100644 crates/README.md

diff --git a/.gitignore b/.gitignore
index 578a29d8..43ba845a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,10 @@ node_modules
 .svelte-kit
 build
 
+# Rust
+/target
+**/*.rs.bk
+
 # OS
 .DS_Store
 Thumbs.db
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 00000000..fc458991
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,33 @@
+# The Rust half of this monorepo. The JS/TS half is `package.json`.
+#
+# Layout, per the same rule on both sides: split by *what a thing is*, not by
+# what language it is written in.
+#
+#   apps/       deployables — a binary someone runs
+#   crates/     shared Rust — a library another crate depends on
+#   packages/   shared JS/TS
+#
+# Members are added as components move in. An empty list is honest: nothing has
+# landed yet.
+
+[workspace]
+resolver = "3"
+members = []
+
+# One pin per dependency, here. A member never writes a version — that is what
+# stops two crates in one tree from disagreeing about tokio.
+[workspace.dependencies]
+anyhow = "1"
+clap = { version = "4", features = ["derive", "env"] }
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+[workspace.package]
+edition = "2024"
+license = "Apache-2.0"
+repository = "https://github.com/nestrilabs/nestri"
diff --git a/crates/README.md b/crates/README.md
new file mode 100644
index 00000000..4adf9f65
--- /dev/null
+++ b/crates/README.md
@@ -0,0 +1,20 @@
+# `crates/`
+
+Shared Rust: a library another crate in this repo depends on. A binary someone
+runs goes in [`apps/`](../apps); shared JS/TS goes in
+[`packages/`](../packages). The split is by *what a thing is*, not by what
+language it is written in — same rule on both sides of the repo.
+
+Empty today. Components move here one at a time as they are opened.
+
+## Two rules
+
+**Every version is pinned in the root `Cargo.toml`.** A member writes
+`tokio.workspace = true` and never a version, so two crates in this tree cannot
+disagree about a dependency.
+
+**Nothing here may depend on anything closed, or name it.** This repo is
+public. A crate that needs a private component is in the wrong repo, and a
+comment explaining *who calls this* wants a category noun — "the caller", "a
+supervising agent" — rather than a name. The requirement is the interesting
+part; who currently satisfies it is not.