packaging: group the workspace into the three prospective repos

.dockerignore

@@ -15,13 +15,13 @@ target/
 data/
 
 # Backtest tooling output: large JSON fixtures + Python venv state.
-# Re-collected on demand via `tools/backtest-collect/backtest_collect.py`.
-tools/backtest-collect/fixtures-*.json
-tools/baseline-latency/data/
-tools/**/__pycache__/
-tools/**/*.pyc
+# Re-collected on demand via `shepherd/tools/backtest-collect/backtest_collect.py`.
+shepherd/tools/backtest-collect/fixtures-*.json
+shepherd/tools/baseline-latency/data/
+shepherd/tools/**/__pycache__/
+shepherd/tools/**/*.pyc
 
-# NOTE: `modules/fixtures/*-bomb` are listed in the workspace
+# NOTE: `*/modules/fixtures/*-bomb` are listed in the workspace
 # `Cargo.toml`, so excluding them breaks `cargo build` ("failed to
 # load manifest for workspace member"). They're tiny crates and the
 # Dockerfile doesn't COPY them to the runtime stage, so the
@@ -30,10 +30,11 @@ tools/**/*.pyc
 # Local-only configs. The production `engine.toml` is supplied at
 # runtime via a bind-mount (`/etc/shepherd/engine.toml`).
 engine.toml
-engine.e2e.toml
-engine.load.toml
-engine.m2.toml
-engine.m3.toml
+shepherd/engine.toml
+shepherd/engine.e2e.toml
+shepherd/engine.load.toml
+shepherd/engine.m2.toml
+shepherd/engine.m3.toml
 
 # Git + GitHub metadata.
 /.git/

.github/workflows/ci.yml

@@ -159,7 +159,7 @@ jobs:
   # Blocking zero-leak gate: host-layer crate graphs stay venue-free, the
   # runtime Rust sources carry no charter symbol and no privileged router
   # field, and nexum:host names no foreign WIT package and resolves as a
-  # leaf (scripts/check-venue-agnostic.sh).
+  # leaf (nexum/scripts/check-venue-agnostic.sh).
   venue-agnostic:
     name: venue-agnostic
     runs-on: ubuntu-latest
@@ -169,10 +169,10 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: wasm-tools,ripgrep
-      - run: ./scripts/check-venue-agnostic.sh
+      - run: ./nexum/scripts/check-venue-agnostic.sh
 
   # Blocking orderbook-only gate: the CoW venue crate carries no
-  # composable symbol (scripts/check-cow-orderbook-only.sh).
+  # composable symbol (shepherd/scripts/check-cow-orderbook-only.sh).
   cow-orderbook-only:
     name: cow-orderbook-only
     runs-on: ubuntu-latest
@@ -181,4 +181,4 @@ jobs:
       - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
           tool: ripgrep
-      - run: ./scripts/check-cow-orderbook-only.sh
+      - run: ./shepherd/scripts/check-cow-orderbook-only.sh

.github/workflows/docker.yml

@@ -73,7 +73,7 @@ jobs:
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./shepherd/Dockerfile
           # Push on every non-PR event; PR builds are local-only smoke.
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.gitignore

@@ -33,19 +33,20 @@ skills-lock.json
 # Engine runtime state (default state_dir from engine.toml).
 data/
 # Shipped crate data slices are source, not runtime state: keep them.
-!crates/*/data/
-!crates/*/data/**
+!*/crates/*/data/
+!*/crates/*/data/**
 
 # E2E automation: rendered configs with embedded RPC keys + script state
 # never get committed.
 *.local.toml
-scripts/.state
-scripts/.env
+shepherd/scripts/.state
+shepherd/scripts/.env
 
 # Operator-supplied engine config (carries paid RPC URLs / API keys).
 # The committed siblings `engine.example.toml`, `engine.docker.toml`,
 # and `engine.{m2,m3,e2e,load}.toml` are placeholder templates.
 /engine.toml
+/shepherd/engine.toml
 
 # Generated reports under e2e-reports/ (operator commits the filled-in ones
 # manually via `git add -f`).

Cargo.toml

@@ -1,42 +1,42 @@
 [workspace]
 members = [
-    "crates/composable-cow",
-    "crates/cow-venue",
-    "crates/nexum-cli",
-    "crates/nexum-launch",
-    "crates/nexum-module-macros",
-    "crates/nexum-runtime",
-    "crates/nexum-sdk",
-    "crates/nexum-sdk-test",
-    "crates/nexum-status-body",
-    "crates/nexum-tasks",
-    "crates/nexum-world",
-    "crates/no-std-probe",
-    "crates/shepherd",
-    "crates/shepherd-backtest",
-    "crates/videre-host",
-    "crates/videre-macros",
-    "crates/videre-sdk",
-    "crates/videre-test",
-    "modules/ethflow-watcher",
-    "modules/example",
-    "modules/examples/balance-tracker",
-    "modules/examples/echo-client",
-    "modules/examples/echo-keeper",
-    "modules/examples/echo-venue",
-    "modules/examples/http-probe",
-    "modules/examples/price-alert",
-    "modules/examples/stop-loss",
-    "modules/fixtures/clock-reader",
-    "modules/fixtures/flaky-bomb",
-    "modules/fixtures/flaky-venue",
-    "modules/fixtures/fuel-bomb",
-    "modules/fixtures/memory-bomb",
-    "modules/fixtures/panic-bomb",
-    "modules/fixtures/slow-host",
-    "modules/twap-monitor",
-    "tools/load-gen",
-    "tools/orderbook-mock",
+    "nexum/crates/nexum-cli",
+    "nexum/crates/nexum-launch",
+    "nexum/crates/nexum-module-macros",
+    "nexum/crates/nexum-runtime",
+    "nexum/crates/nexum-sdk",
+    "nexum/crates/nexum-sdk-test",
+    "nexum/crates/nexum-status-body",
+    "nexum/crates/nexum-tasks",
+    "nexum/crates/nexum-world",
+    "nexum/modules/example",
+    "nexum/modules/examples/balance-tracker",
+    "nexum/modules/examples/http-probe",
+    "nexum/modules/examples/price-alert",
+    "nexum/modules/fixtures/clock-reader",
+    "nexum/modules/fixtures/flaky-bomb",
+    "nexum/modules/fixtures/fuel-bomb",
+    "nexum/modules/fixtures/memory-bomb",
+    "nexum/modules/fixtures/panic-bomb",
+    "nexum/modules/fixtures/slow-host",
+    "videre/crates/no-std-probe",
+    "videre/crates/videre-host",
+    "videre/crates/videre-macros",
+    "videre/crates/videre-sdk",
+    "videre/crates/videre-test",
+    "videre/modules/examples/echo-client",
+    "videre/modules/examples/echo-keeper",
+    "videre/modules/examples/echo-venue",
+    "videre/modules/fixtures/flaky-venue",
+    "shepherd/crates/composable-cow",
+    "shepherd/crates/cow-venue",
+    "shepherd/crates/shepherd",
+    "shepherd/crates/shepherd-backtest",
+    "shepherd/modules/ethflow-watcher",
+    "shepherd/modules/examples/stop-loss",
+    "shepherd/modules/twap-monitor",
+    "shepherd/tools/load-gen",
+    "shepherd/tools/orderbook-mock",
 ]
 resolver = "2"
 

justfile

@@ -24,7 +24,7 @@ build: build-engine build-module
 # module's module.toml — without it the engine prints the 0.1-compat
 # deprecation warning and proceeds with empty capabilities/config.
 run: build-module build-engine
-    cargo run -p nexum-cli -- target/wasm32-wasip2/release/example.wasm modules/example/module.toml
+    cargo run -p nexum-cli -- target/wasm32-wasip2/release/example.wasm nexum/modules/example/module.toml
 
 # Run host engine unit tests
 test:
@@ -44,7 +44,7 @@ build-m2:
 # --pretty-logs keeps the runbook-friendly human-readable formatter;
 # production deploys omit the flag and emit JSON.
 run-m2: build-m2 build-cow-venue build-engine
-    cargo run -p shepherd -- --engine-config engine.m2.toml --pretty-logs
+    cargo run -p shepherd -- --engine-config shepherd/engine.m2.toml --pretty-logs
 
 # Build the M3 example modules (price-alert + balance-tracker + stop-loss)
 # for wasm32-wasip2.
@@ -58,7 +58,7 @@ build-m3:
 # --pretty-logs keeps the runbook-friendly human-readable formatter;
 # production deploys omit the flag and emit JSON.
 run-m3: build-m3 build-cow-venue build-engine
-    cargo run -p shepherd -- --engine-config engine.m3.toml --pretty-logs
+    cargo run -p shepherd -- --engine-config shepherd/engine.m3.toml --pretty-logs
 
 # Build the http-probe example module (wasi:http fetch + allowlist
 # denial demo) for wasm32-wasip2.
@@ -75,18 +75,18 @@ build-e2e: build-m2 build-m3
 # downstream `jq` filter can mine submitted/dropped/backoff markers
 # for the e2e report. See `docs/operations/e2e-testnet-runbook.md`.
 run-e2e: build-e2e build-cow-venue build-engine
-    cargo run -p shepherd -- --engine-config engine.e2e.toml
+    cargo run -p shepherd -- --engine-config shepherd/engine.e2e.toml
 
 # Zero-leak gate: host-layer crate graphs, runtime charter-symbol and
 # router-field scans, and the nexum:host WIT leaf and foreign-namespace
 # scans. Blocking in CI.
 check-venue-agnostic:
-    ./scripts/check-venue-agnostic.sh
+    ./nexum/scripts/check-venue-agnostic.sh
 
 # Orderbook-only gate: the CoW venue crate carries no composable
 # symbol. Blocking in CI.
 check-cow-orderbook-only:
-    ./scripts/check-cow-orderbook-only.sh
+    ./shepherd/scripts/check-cow-orderbook-only.sh
 
 # Check the entire workspace
 check:

crates/nexum-runtime/examples/embed.rs → nexum/crates/nexum-runtime/examples/embed.rs

@@ -29,7 +29,7 @@ async fn main() -> anyhow::Result<()> {
     let cfg = EngineConfig {
         modules: vec![ModuleEntry {
             path: "target/wasm32-wasip2/release/example.wasm".into(),
-            manifest: Some("modules/example/module.toml".into()),
+            manifest: Some("nexum/modules/example/module.toml".into()),
         }],
         ..EngineConfig::default()
     };

crates/nexum-runtime/src/builder.rs → nexum/crates/nexum-runtime/src/builder.rs

@@ -802,7 +802,9 @@ mod tests {
             .parent()
             .expect("crates dir")
             .parent()
-            .expect("repo root")
+            .expect("nexum root")
+            .parent()
+            .expect("workspace root")
             .join("target/wasm32-wasip2/release/price_alert.wasm");
         if !wasm.exists() {
             eprintln!(
@@ -927,7 +929,9 @@ every_n_blocks = "1"
             .parent()
             .expect("crates dir")
             .parent()
-            .expect("repo root")
+            .expect("nexum root")
+            .parent()
+            .expect("workspace root")
             .join("target/wasm32-wasip2/release/example.wasm");
         if !wasm.exists() {
             eprintln!(

crates/nexum-runtime/src/supervisor/tests.rs → nexum/crates/nexum-runtime/src/supervisor/tests.rs

@@ -251,12 +251,15 @@ async fn run_drains_reconnect_tasks_cleanly_on_shutdown() {
 /// Path to the pre-built example WASM component. Tests that need it
 /// call `example_wasm_or_skip()` which skips gracefully if absent.
 fn example_wasm() -> PathBuf {
-    // CARGO_MANIFEST_DIR → crates/nexum-runtime
+    // CARGO_MANIFEST_DIR → nexum/crates/nexum-runtime; three parents up
+    // is the workspace root carrying `target/`.
     Path::new(env!("CARGO_MANIFEST_DIR"))
         .parent()
         .unwrap()
         .parent()
         .unwrap()
+        .parent()
+        .unwrap()
         .join("target/wasm32-wasip2/release/example.wasm")
 }
 
@@ -557,6 +560,8 @@ fn module_wasm(module_name: &str) -> PathBuf {
         .unwrap()
         .parent()
         .unwrap()
+        .parent()
+        .unwrap()
         .join(format!("target/wasm32-wasip2/release/{artifact}.wasm"))
 }
 

crates/nexum-runtime/src/test_utils/harness.rs → nexum/crates/nexum-runtime/src/test_utils/harness.rs

@@ -297,7 +297,8 @@ mod tests {
         let wasm = Path::new(env!("CARGO_MANIFEST_DIR"))
             .parent()
             .and_then(Path::parent)
-            .expect("repo root")
+            .and_then(Path::parent)
+            .expect("workspace root")
             .join("target/wasm32-wasip2/release")
             .join(file);
         if wasm.exists() {

Dockerfile → shepherd/Dockerfile

@@ -122,18 +122,18 @@ COPY --from=build /src/target/wasm32-wasip2/release/*.wasm /opt/shepherd/modules
 # Module manifests (the `module.toml` next to each cdylib crate). The
 # engine resolves capability declarations + chain subscriptions from
 # these at supervisor boot.
-COPY --from=build /src/modules/twap-monitor/module.toml    /opt/shepherd/manifests/twap-monitor.toml
-COPY --from=build /src/modules/ethflow-watcher/module.toml /opt/shepherd/manifests/ethflow-watcher.toml
-COPY --from=build /src/modules/examples/price-alert/module.toml     /opt/shepherd/manifests/price-alert.toml
-COPY --from=build /src/modules/examples/balance-tracker/module.toml /opt/shepherd/manifests/balance-tracker.toml
-COPY --from=build /src/modules/examples/stop-loss/module.toml       /opt/shepherd/manifests/stop-loss.toml
+COPY --from=build /src/shepherd/modules/twap-monitor/module.toml    /opt/shepherd/manifests/twap-monitor.toml
+COPY --from=build /src/shepherd/modules/ethflow-watcher/module.toml /opt/shepherd/manifests/ethflow-watcher.toml
+COPY --from=build /src/nexum/modules/examples/price-alert/module.toml     /opt/shepherd/manifests/price-alert.toml
+COPY --from=build /src/nexum/modules/examples/balance-tracker/module.toml /opt/shepherd/manifests/balance-tracker.toml
+COPY --from=build /src/shepherd/modules/examples/stop-loss/module.toml       /opt/shepherd/manifests/stop-loss.toml
 
 # The bundled cow venue adapter's manifests; installed via the
 # engine.toml [[adapters]] stanza, never compiled into the engine.
 # One manifest per chain: mainnet (cow-venue.toml) and Sepolia
 # (cow-venue.sepolia.toml); pick the one matching the run's chain.
-COPY --from=build /src/crates/cow-venue/module.toml                 /opt/shepherd/manifests/cow-venue.toml
-COPY --from=build /src/crates/cow-venue/module.sepolia.toml         /opt/shepherd/manifests/cow-venue.sepolia.toml
+COPY --from=build /src/shepherd/crates/cow-venue/module.toml                 /opt/shepherd/manifests/cow-venue.toml
+COPY --from=build /src/shepherd/crates/cow-venue/module.sepolia.toml         /opt/shepherd/manifests/cow-venue.sepolia.toml
 
 # Drop privileges. The engine never needs root at runtime: it only
 # reads /etc/shepherd/engine.toml, writes to /var/lib/shepherd, and

crates/composable-cow/Cargo.toml → shepherd/crates/composable-cow/Cargo.toml

@@ -18,11 +18,11 @@ alloy-primitives.workspace = true
 alloy-sol-types.workspace = true
 borsh.workspace = true
 cowprotocol = { version = "0.2.0", default-features = false }
-nexum-sdk = { path = "../nexum-sdk" }
+nexum-sdk = { path = "../../../nexum/crates/nexum-sdk" }
 # `sweep` slice: the keeper run over the typed CoW client on the
 # `videre:venue/client` seam.
 cow-venue = { path = "../cow-venue", features = ["client", "assembly"], optional = true }
-videre-sdk = { path = "../videre-sdk", optional = true }
+videre-sdk = { path = "../../../videre/crates/videre-sdk", optional = true }
 tracing = { workspace = true, optional = true }
 
 [features]
@@ -32,7 +32,7 @@ sweep = ["dep:cow-venue", "dep:videre-sdk", "dep:tracing"]
 
 [dev-dependencies]
 proptest.workspace = true
-nexum-sdk-test = { path = "../nexum-sdk-test" }
+nexum-sdk-test = { path = "../../../nexum/crates/nexum-sdk-test" }
 
 [[test]]
 name = "sweep"

crates/cow-venue/Cargo.toml → shepherd/crates/cow-venue/Cargo.toml

@@ -23,12 +23,12 @@ workspace = true
 borsh = { workspace = true, optional = true }
 # Source of the `IntentBody` derive and trait the version enum implements,
 # and the typed intent client the `client` slice binds to the CoW venue.
-videre-sdk = { path = "../videre-sdk", optional = true }
+videre-sdk = { path = "../../../videre/crates/videre-sdk", optional = true }
 # `client` slice only: the keeper `RetryAction` the generated
 # classification table maps each errorType to. The TOML parse happens in
 # `build.rs`, so serde/toml/thiserror are build- and dev-only and never
 # reach a guest that links this slice.
-nexum-sdk = { path = "../nexum-sdk", optional = true }
+nexum-sdk = { path = "../../../nexum/crates/nexum-sdk", optional = true }
 # `assembly` slice: the chain-edge order projections and orderbook
 # submission bodies. Express-declared (not workspace-inherited) so the
 # guest build never inherits the native `http-client` feature.
@@ -55,7 +55,7 @@ serde = { workspace = true }
 toml = { workspace = true }
 thiserror = { workspace = true }
 # The conformance kit: holds the body codec to its published vector set.
-videre-test = { path = "../videre-test" }
+videre-test = { path = "../../../videre/crates/videre-test" }
 # Parity tests only: the upstream errorType enum and `retry_hint()` the
 # shipped table is reconciled against. Never a runtime dependency.
 cowprotocol = { version = "0.2.0", default-features = false }

crates/shepherd-backtest/Cargo.toml → shepherd/crates/shepherd-backtest/Cargo.toml

@@ -16,9 +16,9 @@ path = "src/main.rs"
 # `strategy::on_chain_logs` directly without an embedded runtime.
 ethflow-watcher = { path = "../../modules/ethflow-watcher" }
 cow-venue = { path = "../cow-venue", features = ["client"] }
-nexum-sdk = { path = "../nexum-sdk" }
-nexum-sdk-test = { path = "../nexum-sdk-test" }
-videre-sdk = { path = "../videre-sdk" }
+nexum-sdk = { path = "../../../nexum/crates/nexum-sdk" }
+nexum-sdk-test = { path = "../../../nexum/crates/nexum-sdk-test" }
+videre-sdk = { path = "../../../videre/crates/videre-sdk" }
 
 anyhow.workspace = true
 clap.workspace = true

crates/shepherd/Cargo.toml → shepherd/crates/shepherd/Cargo.toml

@@ -13,9 +13,9 @@ name = "shepherd"
 path = "src/main.rs"
 
 [dependencies]
-nexum-launch = { path = "../nexum-launch" }
-nexum-runtime = { path = "../nexum-runtime" }
-videre-host = { path = "../videre-host" }
+nexum-launch = { path = "../../../nexum/crates/nexum-launch" }
+nexum-runtime = { path = "../../../nexum/crates/nexum-runtime" }
+videre-host = { path = "../../../videre/crates/videre-host" }
 
 anyhow.workspace = true
 tokio.workspace = true