chore: add the Rust workspace

This repo holds both languages, so it needs both workspaces. Layout is the same
rule on each side — apps/ for what runs, crates/ and packages/ for what is
shared, split by what a thing is rather than what it is written in.

Members are empty because nothing has moved in yet. Versions are pinned once at
the root so two crates cannot disagree about a dependency.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -8,6 +8,10 @@ node_modules
 .svelte-kit
 build
 
+# Rust
+/target
+**/*.rs.bk
+
 # OS
 .DS_Store
 Thumbs.db

Cargo.toml

@@ -0,0 +1,33 @@
+# The Rust half of this monorepo. The JS/TS half is `package.json`.
+#
+# Layout, per the same rule on both sides: split by *what a thing is*, not by
+# what language it is written in.
+#
+#   apps/       deployables — a binary someone runs
+#   crates/     shared Rust — a library another crate depends on
+#   packages/   shared JS/TS
+#
+# Members are added as components move in. An empty list is honest: nothing has
+# landed yet.
+
+[workspace]
+resolver = "3"
+members = []
+
+# One pin per dependency, here. A member never writes a version — that is what
+# stops two crates in one tree from disagreeing about tokio.
+[workspace.dependencies]
+anyhow = "1"
+clap = { version = "4", features = ["derive", "env"] }
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+[workspace.package]
+edition = "2024"
+license = "Apache-2.0"
+repository = "https://github.com/nestrilabs/nestri"

crates/README.md

@@ -0,0 +1,20 @@
+# `crates/`
+
+Shared Rust: a library another crate in this repo depends on. A binary someone
+runs goes in [`apps/`](../apps); shared JS/TS goes in
+[`packages/`](../packages). The split is by *what a thing is*, not by what
+language it is written in — same rule on both sides of the repo.
+
+Empty today. Components move here one at a time as they are opened.
+
+## Two rules
+
+**Every version is pinned in the root `Cargo.toml`.** A member writes
+`tokio.workspace = true` and never a version, so two crates in this tree cannot
+disagree about a dependency.
+
+**Nothing here may depend on anything closed, or name it.** This repo is
+public. A crate that needs a private component is in the wrong repo, and a
+comment explaining *who calls this* wants a category noun — "the caller", "a
+supervising agent" — rather than a name. The requirement is the interesting
+part; who currently satisfies it is not.