host: add a shared writable /config world mount

PROTOCOL.md

@@ -59,15 +59,17 @@ it exits. After 5 seconds, it kills the instance.
 
 ## Filesystem
 
-Each instance sees these mounts:
+Each instance sees four folders:
 
 | Path | Access | Contents |
 | --- | --- | --- |
 | `/data` | read-write by its actor; readable by every actor | the actor's state |
 | `/public` | read-write | the files that the actor publishes |
 | `/actor` | read-only | the `actor/` folder of the world |
-| `/config` | read-only | one non-secret global JSON file, owned by `shared` |
+| `/config` | read-write by every actor | the world's shared `config/` folder; persists across restarts |
-| `/global` | read-write for `shared`, read-only for all other actors | backing directory containing that same `config` file |
+
+`/config` is the same world folder for every instance, including candidates;
+writers coordinate by convention, not permissions. Do not put secrets there.
 
 An actor can write only its own `/data`, but can read every actor's `/data` through `/actor/<id>/data/`. `/data` is not private: any unprotected secret file there is readable by every actor.
 
@@ -79,28 +81,6 @@ Files are plain POSIX files: a write is visible at once. To publish a file
 so that readers never see half of it, write a temporary file and `rename` it
 (the Rust SDK has `write_atomic`).
 
-`/config` is global configuration, never credentials (in particular, never the
-LLM proxy token). The host initializes it to `{}` without reading or copying
-legacy actor settings. Configuration schema and typed edits belong to `shared`,
-not the host. Ordinary actors cannot write either `/config` or its alias
-`/global/config`: WASI mounts are read-only, with no message sender checks.
-
-WASI preopens directories rather than individual files. The host mounts the
-isolated world `global/` directory at `/` read-only and at `/global` with the
-owner's write access. `shared` publishes atomically by writing a sibling such
-as `/global/config.tmp`, closing it, then renaming it to `/global/config`.
-New opens of `/config` see the replacement, including in already-running
-actors; an already-open file retains its old inode. The root mount does not
-expose the rest of the host world. Candidate tests get a scratch copy of
-`global/`, so even `shared` tests cannot modify the live file.
-
-On disk, the one JSON file is `<world>/global/config`. `<world>/config` is a
-relative symlink to it, for native/world filesystem readers (including an
-export of the world directory). Host-side atomic writers must replace
-`<world>/global/config`, not replace the symlink. Starting an older world
-adds the empty file and alias without changing actor state; an existing
-regular `<world>/config` is moved into the backing directory on first use.
-
 Send large or binary data as a path under `/actor/<id>/public/`, not inside a
 message.
 
@@ -160,7 +140,7 @@ the request: the request's `type` in past tense (`spawned`, `upgraded`,
 
 **Headless.** `sausage run --headless [dir]` (or `sausage --headless`, or `SAUSAGE_HEADLESS=1`) turns the console input off: the host does not read stdin, so end of input (`/dev/null`) does not stop the world. `nix run .#loop -- --headless <world>` passes it through the loop. It runs until SIGTERM or SIGINT (stops every actor, exit code 0) or a broker `exit` request (exit code 75, as above). Without the flag, EOF on stdin or `/quit` ends the host.
 
-Paths are `/actor/...`, or the sender's `/public/...` or `/data/...`.
+Paths are `/actor/...`, `/config/...`, or the sender's `/public/...` or `/data/...`.
 
 **Taps.** After `tap`, the sender gets a copy of every message that the
 broker routes (direct messages, replies, and publishes, between any actors,

cli/src/broker.rs

@@ -70,6 +70,7 @@ pub struct Broker {
 
 impl Broker {
     pub fn new(world: World, runtime: Arc<Runtime>) -> Result<Arc<Self>> {
+        std::fs::create_dir_all(world.config_dir())?;
         let metas = world.actor_ids()?.into_iter().map(|id| (id.clone(), world.read_meta(&id))).collect();
         Ok(Arc::new_cyclic(|me| Self {
             world,
@@ -255,13 +256,10 @@ impl Broker {
         }
         InstanceConfig {
             mounts: vec![
-                // WASI preopens directories, not files. This isolated directory
-                // supplies /config without exposing the rest of the world.
-                Mount { guest: "/".into(), host: scratch.map_or_else(|| self.world.global_dir(), |p| p.join("global")), writable: false },
-                Mount { guest: "/global".into(), host: scratch.map_or_else(|| self.world.global_dir(), |p| p.join("global")), writable: id == "shared" },
                 Mount { guest: "/actor".into(), host: self.world.actors_root(), writable: false },
                 Mount { guest: "/public".into(), host: own.join("public"), writable: true },
                 Mount { guest: "/data".into(), host: own.join("data"), writable: true },
+                Mount { guest: "/config".into(), host: self.world.config_dir(), writable: true },
             ],
             network: scratch.is_none(),
             stderr_log: own.join("stderr.log"),

cli/src/candidate.rs

@@ -97,7 +97,7 @@ impl Candidate<'_> {
         let dir = self.broker.world.scratch_dir().join(format!("{}-{}-{n}", self.id, std::process::id()));
         let scratch = Scratch { dir: dir.clone() };
         let world = &self.broker.world;
-        for (from, name) in [(world.data_dir(self.id), "data"), (world.public_dir(self.id), "public"), (world.global_dir(), "global")] {
+        for (from, name) in [(world.data_dir(self.id), "data"), (world.public_dir(self.id), "public")] {
             std::fs::create_dir_all(dir.join(name))?;
             if from.is_dir() {
                 world::copy_tree(&from, &dir.join(name))?;

cli/src/lib.rs

@@ -48,7 +48,6 @@ impl Host {
         if lock.try_lock().is_err() {
             bail!("another sausage process runs {}", root.display());
         }
-        world.ensure_config()?;
         let broker = Broker::new(world.clone(), runtime::Runtime::new()?)?;
         world::write_atomic(&world.public_dir("broker").join("PROTOCOL.md"), PROTOCOL.as_bytes())?;
 

cli/src/runtime.rs

@@ -23,9 +23,7 @@ use wasmtime_wasi_http::{WasiHttpCtx, WasiHttpCtxView, WasiHttpHooks, WasiHttpVi
 use crate::broker::Broker;
 use crate::vfs::{Vfs, VfsState, VfsView};
 
-/// A host folder that the guest sees at `guest`. File-like root paths such
+/// A host folder that the guest sees at `guest`.
-/// as `/config` use an isolated backing directory mounted at `/`; owners
-/// get a separate writable directory alias for atomic replacement.
 #[derive(Clone, Debug)]
 pub struct Mount {
     pub guest: String,

cli/src/vfs.rs

@@ -6,8 +6,6 @@
 //! actor `<id>` with a message from `fs` and waits up to `ASK_TIMEOUT` for
 //! the reply. Other paths go to `wasmtime-wasi` unchanged except that an
 //! actor directory listing advertises `fs/` when its source docs declare it.
-//! `/config` and `/global/config` are native mount paths: they deliberately
-//! use WASI mount permissions rather than actor-served write requests.
 //!
 //! - `fs_read {path}` -> `fs_file {text | base64}`, `fs_dir {entries: [{name, type}]}`
 //! - `fs_write {path, text | base64}`, `fs_mkdir {path}`, `fs_remove {path}`,

cli/src/world.rs

@@ -4,8 +4,7 @@
 //!
 //! ```text
 //! <world>/
-//!   global/config       non-secret global JSON (shared owns writes)
+//!   config/              shared configuration, writable by every actor
-//!   config -> global/config  world-facing read alias
 //!   actor/<id>/
 //!     actor.wasm        the current version
 //!     actor.json        version, running, subscriptions, tapped, watches (broker)
@@ -91,37 +90,9 @@ impl World {
         Self { root: root.into() }
     }
 
-    /// Isolated backing directory for the root /config mount and the
+    pub fn config_dir(&self) -> PathBuf {
-    /// owner's writable /global alias. Never copy legacy actor config here.
+        self.root.join("config")
-    pub fn global_dir(&self) -> PathBuf {
-        self.root.join("global")
     }
-
-    pub fn config_path(&self) -> PathBuf {
-        self.global_dir().join("config")
-    }
-
-    /// Add the non-secret file to new and pre-existing worlds. The symlink
-    /// is for native world readers; actor mounts use the backing directory.
-    pub fn ensure_config(&self) -> Result<()> {
-        std::fs::create_dir_all(self.global_dir())?;
-        let alias = self.root.join("config");
-        if !self.config_path().exists() {
-            if alias.is_file() && !alias.is_symlink() {
-                std::fs::rename(&alias, self.config_path())?;
-            } else {
-                write_atomic(&self.config_path(), b"{}\n")?;
-            }
-        }
-        match std::fs::read_link(&alias) {
-            Ok(target) if target == Path::new("global/config") => {}
-            Ok(_) => bail!("{} must point to global/config", alias.display()),
-            Err(_) if alias.try_exists()? => bail!("{} already exists", alias.display()),
-            Err(_) => std::os::unix::fs::symlink("global/config", alias)?,
-        }
-        Ok(())
-    }
-
     pub fn actors_root(&self) -> PathBuf {
         self.root.join("actor")
     }
@@ -164,7 +135,6 @@ impl World {
         for id in NATIVE {
             world.ensure_actor_dirs(id)?;
         }
-        world.ensure_config()?;
         Ok(world)
     }
 
@@ -225,7 +195,7 @@ impl World {
 
     /// Map a path in an actor's namespace to a host path.
     ///
-    /// - `/actor/<id>/...` is the global filesystem.
+    /// - `/actor/<id>/...` and `/config/...` are world paths.
     /// - `/public/...` and `/data/...` belong to `sender`.
     /// - Native senders (the console) can also give absolute host paths.
     pub fn resolve(&self, sender: &str, path: &str) -> Result<PathBuf> {
@@ -243,12 +213,12 @@ impl World {
         let prefixed = |prefix: &str| {
             path.strip_prefix(prefix).filter(|rest| rest.is_empty() || rest.starts_with('/'))
         };
-        if path == "/config" || path == "/global/config" {
-            return Ok(self.config_path());
-        }
         if let Some(rest) = prefixed("/actor") {
             return under(self.actors_root(), rest);
         }
+        if let Some(rest) = prefixed("/config") {
+            return under(self.config_dir(), rest);
+        }
         if let Some(rest) = prefixed("/public") {
             return under(self.public_dir(sender), rest);
         }
@@ -258,7 +228,7 @@ impl World {
         if NATIVE.contains(&sender) && Path::new(path).is_absolute() {
             return Ok(PathBuf::from(path));
         }
-        bail!("cannot resolve path {path} for {sender}: use /actor/<id>/..., /public/... or /data/...")
+        bail!("cannot resolve path {path} for {sender}: use /actor/<id>/..., /config/..., /public/... or /data/...")
     }
 
     /// The path of a host file in the global filesystem, if it has one.

cli/tests/host.rs

@@ -47,83 +47,6 @@ async fn receive_shutdown_messages(
     .expect("shutdown output or lifecycle reply did not arrive");
 }
 
-#[tokio::test]
-async fn global_config_is_readable_owner_written_and_atomically_replaced() {
-    let world = create_world("global-config");
-    let (host, mut mailbox) = start(&world).await;
-    let wasm = toolbox_wasm().clone();
-    for actor in ["shared", "reader"] {
-        let source = passing_source(&world, actor);
-        spawn_type(&host, &mut mailbox, actor, &wasm, &source).await;
-    }
-    let initial = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
-    assert_eq!(initial.body["text"], "{}\n");
-    for path in ["/config", "/global/config", "/global/config.tmp", "/actor/shared/data/../../../../global/config"] {
-        ask_type(&host, &mut mailbox, "reader", json!({"type": "write", "path": path, "text": "not allowed"}), "error").await;
-    }
-    ask_type(&host, &mut mailbox, "reader", json!({"type": "rename", "path": "/config", "to": "/global/stolen"}), "error").await;
-    // The root view stays read-only even for the owner; publication uses its
-    // writable directory alias, with a sibling temporary file and rename.
-    ask_type(&host, &mut mailbox, "shared", json!({"type": "write", "path": "/config", "text": "not allowed"}), "error").await;
-    let next = "{\"llm\":{\"thinking\":\"medium\"}}\n";
-    ask_type(&host, &mut mailbox, "shared", json!({"type": "write", "path": "/global/config.tmp", "text": next}), "ok").await;
-    let before = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
-    assert_eq!(before.body["text"], "{}\n");
-    // A native/world reader holding the old inode sees the complete old file.
-    let mut old = std::fs::File::open(world.root.join("config")).unwrap();
-    ask_type(&host, &mut mailbox, "shared", json!({"type": "rename", "path": "/global/config.tmp", "to": "/global/config"}), "ok").await;
-    let after = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
-    assert_eq!(after.body["text"], next);
-    assert_eq!(std::fs::read_to_string(world.root.join("config")).unwrap(), next);
-    assert_eq!(std::fs::read_to_string(world.resolve("reader", "/config").unwrap()).unwrap(), next);
-    let mut previous = String::new();
-    std::io::Read::read_to_string(&mut old, &mut previous).unwrap();
-    assert_eq!(previous, "{}\n");
-    assert!(!world.global_dir().join("config.tmp").exists());
-    // The mount must not give shared writable access to any other world data.
-    ask_type(&host, &mut mailbox, "shared", json!({"type": "write", "path": "/global/../actor/reader/data/escape", "text": "no"}), "error").await;
-    host.stop().await;
-    let (host, mut mailbox) = start(&world).await;
-    let persisted = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
-    assert_eq!(persisted.body["text"], next);
-    host.stop().await;
-}
-
-#[tokio::test]
-async fn global_config_candidates_cannot_change_the_live_file() {
-    let world = create_world("candidate-global-config");
-    let (host, mut mailbox) = start(&world).await;
-    let source = source_with_test(&world, "shared", json!({"steps": [
-        {"send": {"type": "write", "path": "/global/next", "text": "{\"test\":true}"}, "expect": {"type": "ok"}},
-        {"send": {"type": "rename", "path": "/global/next", "to": "/global/config"}, "expect": {"type": "ok"}},
-        {"send": {"type": "read", "path": "/config"}, "expect": {"type": "content", "text": "{\"test\":true}"}}
-    ]}));
-    spawn_type(&host, &mut mailbox, "shared", toolbox_wasm(), &source).await;
-    assert_eq!(std::fs::read_to_string(world.config_path()).unwrap(), "{}\n");
-    host.stop().await;
-}
-
-#[tokio::test]
-async fn global_config_is_added_to_existing_worlds_without_copying_actor_settings() {
-    let world = create_world("old-world-config");
-    std::fs::remove_file(world.root.join("config")).unwrap();
-    std::fs::remove_dir_all(world.global_dir()).unwrap();
-    world.ensure_actor_dirs("shared").unwrap();
-    // Synthetic marker only; no actual credentials are read in this test.
-    std::fs::write(world.data_dir("shared").join("config.json"), "legacy-private-marker").unwrap();
-    let (host, _) = start(&world).await;
-    assert_eq!(std::fs::read_to_string(world.root.join("config")).unwrap(), "{}\n");
-    assert_eq!(std::fs::read_to_string(world.data_dir("shared").join("config.json")).unwrap(), "legacy-private-marker");
-    host.stop().await;
-    // Preserve an operator-provided global config when adding the mounts.
-    std::fs::remove_file(world.root.join("config")).unwrap();
-    std::fs::remove_dir_all(world.global_dir()).unwrap();
-    std::fs::write(world.root.join("config"), "{\"operator\":true}").unwrap();
-    let (host, _) = start(&world).await;
-    assert_eq!(std::fs::read_to_string(world.root.join("config")).unwrap(), "{\"operator\":true}");
-    host.stop().await;
-}
-
 #[tokio::test]
 async fn routes_replies_publishes_and_reports_undeliverable() {
     let world = create_world("routing");
@@ -252,6 +175,42 @@ async fn filesystem_permissions_and_public_sharing() {
     host.stop().await;
 }
 
+#[tokio::test]
+async fn config_is_shared_writable_and_survives_host_restart() {
+    let (world, host, mut mailbox) = filesystem_world("world-config").await;
+    let path = "/config/global.json";
+    let first = r#"{"model":"first"}"#;
+    let second = r#"{"model":"second"}"#;
+    ask_type(
+        &host, &mut mailbox, "writer",
+        json!({"type": "write", "path": path, "text": first}), "ok",
+    ).await;
+    let read = ask_type(
+        &host, &mut mailbox, "reader",
+        json!({"type": "read", "path": path}), "content",
+    ).await;
+    assert_eq!(read.body["text"], first);
+    // The second actor can replace the same file too.
+    ask_type(
+        &host, &mut mailbox, "reader",
+        json!({"type": "write", "path": path, "text": second}), "ok",
+    ).await;
+    assert_eq!(std::fs::read_to_string(world.config_dir().join("global.json")).unwrap(), second);
+    assert_eq!(world.resolve("writer", path).unwrap(), world.config_dir().join("global.json"));
+    assert_eq!(world.resolve("console", path).unwrap(), world.config_dir().join("global.json"));
+    host.stop().await;
+
+    let (host, mut mailbox) = start(&world).await;
+    for actor in ["writer", "reader"] {
+        let read = ask_type(
+            &host, &mut mailbox, actor,
+            json!({"type": "read", "path": path}), "content",
+        ).await;
+        assert_eq!(read.body["text"], second);
+    }
+    host.stop().await;
+}
+
 #[tokio::test]
 async fn actors_can_read_but_not_write_other_actor_data() {
     let (_, host, mut mailbox) = filesystem_world("actor-data-sharing").await;