feat(rust): add OpenEngine bindings crate

.github/workflows/rust-release.yml

@@ -0,0 +1,103 @@
+name: Rust crate release
+
+on:
+  push:
+    tags:
+      - "openengine-v*"
+
+permissions:
+  contents: read
+
+env:
+  RUSTUP_TOOLCHAIN: "1.98.1"
+
+jobs:
+  validate:
+    name: Validate release
+    runs-on: ubuntu-latest
+    outputs:
+      published: ${{ steps.registry.outputs.published }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Verify release tag points to main
+        shell: bash
+        run: |
+          git fetch --no-tags origin main
+          if ! git merge-base --is-ancestor HEAD origin/main; then
+            echo "::error::Release tags must point to commits on main"
+            exit 1
+          fi
+
+      - name: Set up Rust
+        run: rustup toolchain install "${RUSTUP_TOOLCHAIN}" --profile minimal --no-self-update
+
+      - name: Check release version
+        run: ./scripts/check-release-version.sh "${GITHUB_REF_NAME}"
+
+      - name: Check schema release metadata
+        run: ./scripts/check-schema-release.sh --verify-registry
+
+      - name: Check generated bindings
+        run: ./scripts/check-generated.sh
+
+      - name: Build publishable crate
+        run: cargo package --locked --package openengine
+
+      - name: Check for an existing publication
+        id: registry
+        env:
+          VERSION: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          version="${VERSION#openengine-v}"
+          url="https://crates.io/api/v1/crates/openengine/${version}"
+          user_agent="openengine-release (+https://github.com/ai-dynamo/openengine)"
+          response="${RUNNER_TEMP}/openengine-${version}.json"
+          status="$(curl --silent --show-error --user-agent "${user_agent}" --output "${response}" --write-out '%{http_code}' "${url}")"
+          case "${status}" in
+            200)
+              remote_checksum="$(jq --raw-output '.version.checksum' "${response}")"
+              local_checksum="$(sha256sum "target/package/openengine-${version}.crate" | cut --delimiter=' ' --fields=1)"
+              if [[ "${local_checksum}" != "${remote_checksum}" ]]; then
+                echo "::error::crates.io already has openengine ${version} with different contents"
+                exit 1
+              fi
+              echo "published=true" >> "${GITHUB_OUTPUT}"
+              ;;
+            404)
+              echo "published=false" >> "${GITHUB_OUTPUT}"
+              ;;
+            *)
+              echo "::error::crates.io returned HTTP ${status}"
+              exit 1
+              ;;
+          esac
+
+  publish:
+    name: Publish crate
+    needs: validate
+    if: needs.validate.outputs.published != 'true'
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
+
+      - name: Set up Rust
+        run: rustup toolchain install "${RUSTUP_TOOLCHAIN}" --profile minimal --no-self-update
+
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+
+      - name: Publish to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+        run: cargo publish --locked --package openengine

.github/workflows/rust.yml

@@ -0,0 +1,104 @@
+name: Rust
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "proto/**"
+      - "packages/rust/**"
+      - "tools/rust-codegen/**"
+      - "scripts/check-generated.sh"
+      - "scripts/check-release-version.sh"
+      - "scripts/check-schema-release.sh"
+      - "scripts/generate-rust.sh"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/rust.yml"
+      - ".github/workflows/rust-release.yml"
+  pull_request:
+    paths:
+      - "proto/**"
+      - "packages/rust/**"
+      - "tools/rust-codegen/**"
+      - "scripts/check-generated.sh"
+      - "scripts/check-release-version.sh"
+      - "scripts/check-schema-release.sh"
+      - "scripts/generate-rust.sh"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/rust.yml"
+      - ".github/workflows/rust-release.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  generated:
+    name: Generated bindings
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Check schema release metadata
+        run: ./scripts/check-schema-release.sh
+
+      - name: Check generated bindings
+        run: ./scripts/check-generated.sh
+
+  check:
+    name: Rust ${{ matrix.toolchain }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: ["1.88.0", "stable"]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+
+      - name: Check workspace
+        run: cargo check --locked --workspace --all-targets
+
+  quality:
+    name: Rust quality
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.0.2
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+          components: clippy,rustfmt
+
+      - name: Check formatting
+        run: cargo fmt --all --check
+
+      - name: Run Clippy
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+      - name: Build documentation
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+        run: cargo doc --locked --no-deps --package openengine
+
+      - name: Build publishable crate
+        run: cargo package --locked --package openengine
+
+      - name: List packaged files
+        run: cargo package --locked --package openengine --list

CHANGELOG.md

@@ -0,0 +1,17 @@
+<!--
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Changelog
+
+All notable changes to the generated OpenEngine Rust crate are documented here.
+
+## [Unreleased]
+
+### Added
+
+- Generated `openengine` Prost messages and Tonic client/server bindings.
+- Reproducible Rust code generation, package CI, and tag-driven crates.io releases.
+
+[Unreleased]: https://github.com/ai-dynamo/openengine/commits/main

CONTRIBUTING.md

@@ -30,7 +30,27 @@ sending a PR.
 - **Bugs / feedback / design questions**: open a [GitHub issue](https://github.com/ai-dynamo/openengine/issues).
 - **Pull requests**: open against `main`. Keep changes focused (one logical change per PR).
 
-## Signing Your Work
+## Development checks
+
+The schema under `proto/openengine/v1/` is the source of truth. Generated Rust bindings are checked in for crate consumers and must be updated in the same pull request as a schema change.
+
+```bash
+buf build
+buf lint
+
+./scripts/generate-rust.sh
+./scripts/check-generated.sh
+./scripts/check-schema-release.sh
+
+cargo check --locked --workspace --all-targets
+cargo clippy --locked --workspace --all-targets -- -D warnings
+cargo doc --locked --no-deps --package openengine
+cargo package --locked --package openengine
+```
+
+The Rust code-generation toolchain is pinned. Do not edit generated files by hand; update the schema or generator and regenerate them.
+
+## Signing your work
 
 We require that all contributors "sign off" on their commits. This certifies that
 you wrote the contribution, or otherwise have the right to submit it under the