packaging: pin cross-group deps to git tags behind an umbrella patch

Cargo.toml

@@ -223,6 +223,23 @@ todo = "deny"
 [patch.crates-io]
 cowprotocol = { git = "https://github.com/nullislabs/cow-rs", rev = "17fc0c5f55d04fad38963911da07d5da9290fefb" }
 
+# Cross-group deps already carry their final git-tag form. Resolve every
+# such crate from the in-tree group until the split repos are populated;
+# a fully patched source is never fetched.
+[patch."https://github.com/nullislabs/nexum-runtime"]
+nexum-launch = { path = "nexum/crates/nexum-launch" }
+nexum-runtime = { path = "nexum/crates/nexum-runtime" }
+nexum-sdk = { path = "nexum/crates/nexum-sdk" }
+nexum-sdk-test = { path = "nexum/crates/nexum-sdk-test" }
+nexum-status-body = { path = "nexum/crates/nexum-status-body" }
+nexum-tasks = { path = "nexum/crates/nexum-tasks" }
+nexum-world = { path = "nexum/crates/nexum-world" }
+
+[patch."https://github.com/nullislabs/videre-nexum-module"]
+videre-host = { path = "videre/crates/videre-host" }
+videre-sdk = { path = "videre/crates/videre-sdk" }
+videre-test = { path = "videre/crates/videre-test" }
+
 [profile.dev]
 panic = "abort"
 

nexum/Cargo.repo.toml

@@ -0,0 +1,120 @@
+# Workspace root for the standalone nexum-runtime repo; renamed to
+# Cargo.toml at the carve. Carries no [patch]: this group has no
+# cross-group deps to neutralise.
+
+[workspace]
+members = [
+    "crates/nexum-cli",
+    "crates/nexum-launch",
+    "crates/nexum-module-macros",
+    "crates/nexum-runtime",
+    "crates/nexum-sdk",
+    "crates/nexum-sdk-test",
+    "crates/nexum-status-body",
+    "crates/nexum-tasks",
+    "crates/nexum-world",
+    "modules/example",
+    "modules/examples/balance-tracker",
+    "modules/examples/http-probe",
+    "modules/examples/price-alert",
+    "modules/fixtures/clock-reader",
+    "modules/fixtures/flaky-bomb",
+    "modules/fixtures/fuel-bomb",
+    "modules/fixtures/memory-bomb",
+    "modules/fixtures/panic-bomb",
+    "modules/fixtures/slow-host",
+]
+resolver = "2"
+
+[workspace.package]
+edition = "2024"
+license = "AGPL-3.0"
+repository = "https://github.com/nullislabs/nexum-runtime"
+
+# Hoisted external deps. Core crates inherit with `dep.workspace = true`;
+# guest modules express-declare their own external deps.
+[workspace.dependencies]
+# Error + async plumbing.
+anyhow = "1"
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+futures = "0.3"
+async-trait = "0.1"
+
+# Serde + config.
+serde = { version = "1", features = ["derive"] }
+serde_json = { version = "1", default-features = false, features = ["alloc"] }
+toml = "1"
+
+# Wire codec.
+borsh = { version = "1", features = ["derive"] }
+
+# Observability.
+tracing = "0.1"
+tracing-core = { version = "0.1", default-features = false, features = ["std"] }
+tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter", "ansi", "json"] }
+strum = { version = "0.28", default-features = false, features = ["derive"] }
+metrics = "0.24"
+metrics-exporter-prometheus = { version = "0.18", default-features = false, features = ["http-listener"] }
+
+# CLI parser.
+clap = { version = "4", features = ["derive"] }
+
+# alloy stack; featureless provider so the guest SDK's wasm build stays
+# transport-free, call sites add ws/ipc/pubsub/reqwest.
+alloy-primitives = { version = "1.6", default-features = false, features = ["std", "serde"] }
+alloy-sol-types = { version = "1.6", default-features = false, features = ["std"] }
+alloy-provider = { version = "2.1", default-features = false }
+alloy-rpc-types-eth = { version = "2.1", default-features = false, features = ["std"] }
+alloy-transport-ws = { version = "2.1", default-features = false }
+alloy-chains = { version = "0.2", default-features = false, features = ["std", "serde"] }
+alloy-json-rpc = { version = "2.1", default-features = false }
+alloy-rpc-client = { version = "2.1", default-features = false }
+alloy-transport = { version = "2.1", default-features = false }
+
+# HTTP surface.
+http = "1"
+http-body = "1"
+http-body-util = "0.1"
+bytes = "1"
+
+# Bee HTTP API client behind the Swarm `remote-store` backend.
+bee-rs = "1.7"
+
+# Proc-macro toolkit.
+proc-macro2 = "1"
+quote = "1"
+syn = { version = "2", features = ["full"] }
+
+# Guest-side wasi:http client behind the SDK's `http::fetch` helper.
+wstd = { version = "0.6", default-features = false }
+
+# WASM Component Model runtime.
+wasmtime = { version = "46", features = ["component-model"] }
+wasmtime-wasi = "46"
+wasmtime-wasi-http = "46"
+
+# Embedded key-value store (local-store backend).
+redb = "4"
+
+# Misc engine host deps.
+url = "2"
+
+# Dev/test helpers.
+tempfile = "3"
+wiremock = "0.6"
+proptest = "1"
+tower = "0.5"
+
+[workspace.lints.rust]
+unsafe_op_in_unsafe_fn = "warn"
+
+[workspace.lints.clippy]
+dbg_macro = "deny"
+todo = "deny"
+
+[profile.dev]
+panic = "abort"
+
+[profile.release]
+panic = "abort"

shepherd/Cargo.repo.toml

@@ -0,0 +1,89 @@
+# Workspace root for the standalone shepherd repo; renamed to Cargo.toml
+# at the carve. Carries no cross-group [patch]: nexum-* and videre-* deps
+# resolve from their real git tags.
+
+[workspace]
+members = [
+    "crates/composable-cow",
+    "crates/cow-venue",
+    "crates/shepherd",
+    "crates/shepherd-backtest",
+    "modules/ethflow-watcher",
+    "modules/examples/stop-loss",
+    "modules/twap-monitor",
+    "tools/load-gen",
+    "tools/orderbook-mock",
+]
+resolver = "2"
+
+[workspace.package]
+edition = "2024"
+license = "AGPL-3.0"
+repository = "https://github.com/nullislabs/shepherd"
+
+# Hoisted external deps. Core crates inherit with `dep.workspace = true`;
+# guest modules express-declare their own external deps.
+[workspace.dependencies]
+# Error + async plumbing.
+anyhow = "1"
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+futures = "0.3"
+
+# Serde + config.
+serde = { version = "1", features = ["derive"] }
+serde_json = { version = "1", default-features = false, features = ["alloc"] }
+toml = "1"
+
+# Wire codec.
+borsh = { version = "1", features = ["derive"] }
+
+# Observability.
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter", "ansi", "json"] }
+
+# CLI parser.
+clap = { version = "4", features = ["derive"] }
+
+# alloy stack; featureless provider, call sites add transports.
+alloy-primitives = { version = "1.6", default-features = false, features = ["std", "serde"] }
+alloy-sol-types = { version = "1.6", default-features = false, features = ["std"] }
+alloy-provider = { version = "2.1", default-features = false }
+alloy-rpc-types-eth = { version = "2.1", default-features = false, features = ["std"] }
+alloy-transport-ws = { version = "2.1", default-features = false }
+
+# HTTP surface.
+reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
+http = "1"
+axum = "0.8"
+
+# Guest bindings.
+wit-bindgen = { version = "0.59", default-features = false, features = ["macros", "realloc"] }
+
+# Misc.
+url = "2"
+rand = "0.10"
+hex = "0.4"
+
+# Dev/test helpers.
+proptest = "1"
+tower = "0.5"
+
+[workspace.lints.rust]
+unsafe_op_in_unsafe_fn = "warn"
+
+[workspace.lints.clippy]
+dbg_macro = "deny"
+todo = "deny"
+
+# `cowprotocol` 0.2.0 (hash-only submission shape + the WASI clock fix)
+# is unpublished; patch to the cow-rs rev carrying both. Drop once a
+# release with the hash-only constructor ships.
+[patch.crates-io]
+cowprotocol = { git = "https://github.com/nullislabs/cow-rs", rev = "17fc0c5f55d04fad38963911da07d5da9290fefb" }
+
+[profile.dev]
+panic = "abort"
+
+[profile.release]
+panic = "abort"

shepherd/crates/composable-cow/Cargo.toml

@@ -18,11 +18,11 @@ alloy-primitives.workspace = true
 alloy-sol-types.workspace = true
 borsh.workspace = true
 cowprotocol = { version = "0.2.0", default-features = false }
-nexum-sdk = { path = "../../../nexum/crates/nexum-sdk" }
+nexum-sdk = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
 # `sweep` slice: the keeper run over the typed CoW client on the
 # `videre:venue/client` seam.
 cow-venue = { path = "../cow-venue", features = ["client", "assembly"], optional = true }
-videre-sdk = { path = "../../../videre/crates/videre-sdk", optional = true }
+videre-sdk = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0", optional = true }
 tracing = { workspace = true, optional = true }
 
 [features]
@@ -32,7 +32,7 @@ sweep = ["dep:cow-venue", "dep:videre-sdk", "dep:tracing"]
 
 [dev-dependencies]
 proptest.workspace = true
-nexum-sdk-test = { path = "../../../nexum/crates/nexum-sdk-test" }
+nexum-sdk-test = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
 
 [[test]]
 name = "sweep"

shepherd/crates/cow-venue/Cargo.toml

@@ -23,12 +23,12 @@ workspace = true
 borsh = { workspace = true, optional = true }
 # Source of the `IntentBody` derive and trait the version enum implements,
 # and the typed intent client the `client` slice binds to the CoW venue.
-videre-sdk = { path = "../../../videre/crates/videre-sdk", optional = true }
+videre-sdk = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0", optional = true }
 # `client` slice only: the keeper `RetryAction` the generated
 # classification table maps each errorType to. The TOML parse happens in
 # `build.rs`, so serde/toml/thiserror are build- and dev-only and never
 # reach a guest that links this slice.
-nexum-sdk = { path = "../../../nexum/crates/nexum-sdk", optional = true }
+nexum-sdk = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0", optional = true }
 # `assembly` slice: the chain-edge order projections and orderbook
 # submission bodies. Express-declared (not workspace-inherited) so the
 # guest build never inherits the native `http-client` feature.
@@ -55,7 +55,7 @@ serde = { workspace = true }
 toml = { workspace = true }
 thiserror = { workspace = true }
 # The conformance kit: holds the body codec to its published vector set.
-videre-test = { path = "../../../videre/crates/videre-test" }
+videre-test = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0" }
 # Parity tests only: the upstream errorType enum and `retry_hint()` the
 # shipped table is reconciled against. Never a runtime dependency.
 cowprotocol = { version = "0.2.0", default-features = false }

shepherd/crates/shepherd-backtest/Cargo.toml

@@ -16,9 +16,9 @@ path = "src/main.rs"
 # `strategy::on_chain_logs` directly without an embedded runtime.
 ethflow-watcher = { path = "../../modules/ethflow-watcher" }
 cow-venue = { path = "../cow-venue", features = ["client"] }
-nexum-sdk = { path = "../../../nexum/crates/nexum-sdk" }
-nexum-sdk-test = { path = "../../../nexum/crates/nexum-sdk-test" }
-videre-sdk = { path = "../../../videre/crates/videre-sdk" }
+nexum-sdk = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+nexum-sdk-test = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+videre-sdk = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0" }
 
 anyhow.workspace = true
 clap.workspace = true

shepherd/crates/shepherd/Cargo.toml

@@ -13,9 +13,9 @@ name = "shepherd"
 path = "src/main.rs"
 
 [dependencies]
-nexum-launch = { path = "../../../nexum/crates/nexum-launch" }
-nexum-runtime = { path = "../../../nexum/crates/nexum-runtime" }
-videre-host = { path = "../../../videre/crates/videre-host" }
+nexum-launch = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+nexum-runtime = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+videre-host = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0" }
 
 anyhow.workspace = true
 tokio.workspace = true

shepherd/modules/ethflow-watcher/Cargo.toml

@@ -13,8 +13,8 @@ repository.workspace = true
 crate-type = ["cdylib", "rlib"]
 
 [dependencies]
-nexum-sdk = { path = "../../../nexum/crates/nexum-sdk" }
-videre-sdk = { path = "../../../videre/crates/videre-sdk" }
+nexum-sdk = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+videre-sdk = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0" }
 cow-venue = { path = "../../crates/cow-venue", features = ["client", "assembly"] }
 cowprotocol = { version = "0.2.0", default-features = false }
 alloy-primitives = { version = "1.6", default-features = false, features = ["std"] }
@@ -23,4 +23,4 @@ tracing = { version = "0.1", default-features = false }
 wit-bindgen = { version = "0.59", default-features = false, features = ["macros", "realloc"] }
 
 [dev-dependencies]
-nexum-sdk-test = { path = "../../../nexum/crates/nexum-sdk-test" }
+nexum-sdk-test = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }

shepherd/modules/examples/stop-loss/Cargo.toml

@@ -11,8 +11,8 @@ crate-type = ["cdylib"]
 
 [dependencies]
 cow-venue = { path = "../../../crates/cow-venue", features = ["client"] }
-nexum-sdk = { path = "../../../../nexum/crates/nexum-sdk" }
-videre-sdk = { path = "../../../../videre/crates/videre-sdk" }
+nexum-sdk = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+videre-sdk = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0" }
 cowprotocol = { version = "0.2.0", default-features = false }
 alloy-primitives = { version = "1.6", default-features = false, features = ["std"] }
 tracing = { version = "0.1", default-features = false }
@@ -21,7 +21,7 @@ wit-bindgen = { version = "0.59", default-features = false, features = ["macros"
 [dev-dependencies]
 # The chain-edge projections back the pinned-UID regression test.
 cow-venue = { path = "../../../crates/cow-venue", features = ["client", "assembly"] }
-nexum-sdk-test = { path = "../../../../nexum/crates/nexum-sdk-test" }
+nexum-sdk-test = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
 # Only used by tests in `strategy.rs` to encode a synthetic oracle
 # return body; the production code uses `nexum_sdk::chain::chainlink`.
 alloy-sol-types = { version = "1.6", default-features = false, features = ["std"] }

shepherd/modules/twap-monitor/Cargo.toml

@@ -11,8 +11,8 @@ crate-type = ["cdylib"]
 [dependencies]
 composable-cow = { path = "../../crates/composable-cow", features = ["sweep"] }
 cow-venue = { path = "../../crates/cow-venue", features = ["client"] }
-nexum-sdk = { path = "../../../nexum/crates/nexum-sdk" }
-videre-sdk = { path = "../../../videre/crates/videre-sdk" }
+nexum-sdk = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }
+videre-sdk = { git = "https://github.com/nullislabs/videre-nexum-module", tag = "v0.1.0" }
 cowprotocol = { version = "0.2.0", default-features = false }
 alloy-primitives = { version = "1.6", default-features = false, features = ["std"] }
 alloy-sol-types = { version = "1.6", default-features = false, features = ["std"] }
@@ -22,4 +22,4 @@ wit-bindgen = { version = "0.59", default-features = false, features = ["macros"
 [dev-dependencies]
 cow-venue = { path = "../../crates/cow-venue", features = ["client", "assembly"] }
 serde_json = { version = "1", default-features = false, features = ["alloc"] }
-nexum-sdk-test = { path = "../../../nexum/crates/nexum-sdk-test" }
+nexum-sdk-test = { git = "https://github.com/nullislabs/nexum-runtime", tag = "v0.1.0" }