host: mount owner-written non-secret global config

Reviewed-on: #3

PROTOCOL.md

@@ -59,13 +59,17 @@ it exits. After 5 seconds, it kills the instance.
 
 ## Filesystem
 
-Each instance sees three folders:
+Each instance sees these mounts:
 
 | Path | Access | Contents |
 | --- | --- | --- |
-| `/data` | read-write | the actor's state |
+| `/data` | read-write by its actor; readable by every actor | the actor's state |
 | `/public` | read-write | the files that the actor publishes |
 | `/actor` | read-only | the `actor/` folder of the world |
+| `/config` | read-only | one non-secret global JSON file, owned by `shared` |
+| `/global` | read-write for `shared`, read-only for all other actors | backing directory containing that same `config` file |
+
+An actor can write only its own `/data`, but can read every actor's `/data` through `/actor/<id>/data/`. `/data` is not private: any unprotected secret file there is readable by every actor.
 
 `/actor/<id>/` holds everything about an actor: `actor.wasm`, `actor.json`
 (installed version, running, subscriptions, tapped, watches), `source/`, `public/`, `data/`,
@@ -75,6 +79,28 @@ Files are plain POSIX files: a write is visible at once. To publish a file
 so that readers never see half of it, write a temporary file and `rename` it
 (the Rust SDK has `write_atomic`).
 
+`/config` is global configuration, never credentials (in particular, never the
+LLM proxy token). The host initializes it to `{}` without reading or copying
+legacy actor settings. Configuration schema and typed edits belong to `shared`,
+not the host. Ordinary actors cannot write either `/config` or its alias
+`/global/config`: WASI mounts are read-only, with no message sender checks.
+
+WASI preopens directories rather than individual files. The host mounts the
+isolated world `global/` directory at `/` read-only and at `/global` with the
+owner's write access. `shared` publishes atomically by writing a sibling such
+as `/global/config.tmp`, closing it, then renaming it to `/global/config`.
+New opens of `/config` see the replacement, including in already-running
+actors; an already-open file retains its old inode. The root mount does not
+expose the rest of the host world. Candidate tests get a scratch copy of
+`global/`, so even `shared` tests cannot modify the live file.
+
+On disk, the one JSON file is `<world>/global/config`. `<world>/config` is a
+relative symlink to it, for native/world filesystem readers (including an
+export of the world directory). Host-side atomic writers must replace
+`<world>/global/config`, not replace the symlink. Starting an older world
+adds the empty file and alias without changing actor state; an existing
+regular `<world>/config` is moved into the backing directory on first use.
+
 Send large or binary data as a path under `/actor/<id>/public/`, not inside a
 message.
 
@@ -123,14 +149,16 @@ the request: the request's `type` in past tense (`spawned`, `upgraded`,
 | `type` | Fields | Effect |
 | --- | --- | --- |
 | `spawn` | `actor`, `wasm`, `source`?, `built_by`? | test, then start a new actor |
-| `upgrade` | `actor`, `wasm`, `source`?, `built_by`? | test, then swap the version |
-| `rollback` | `actor`, `version` | go back to an older version |
+| `upgrade` | `actor`, `wasm`, `source`?, `built_by`? | test, then swap the version: a running actor is stopped (normal shutdown) and starts the new version; a stopped actor gets the new version and stays stopped, with its mailbox untouched, until `start`. The answer has `running` |
+| `rollback` | `actor`, `version` | go back to an older version; like `upgrade`, a stopped actor stays stopped. The answer has `running` |
 | `stop`, `start` | `actor` | stop or start an actor |
 | `remove` | `actor` | stop the actor (normal shutdown), then delete its whole folder `/actor/<id>/` (all versions, `data/`, `public/`, logs); answer `{"type": "removed", "actor"}`. Messages to it are then undeliverable, and the ID can be spawned again. An unknown actor or a native one (`broker`, `console`, `cargo`, `fs`) is an `error` |
 | `subscribe`, `unsubscribe` | `actor` | receive (or not) what `actor` publishes |
 | `tap`, `untap` | | receive (or not) a copy of every message the broker routes |
 | `watch`, `unwatch` | `path` | receive (or not) `fs_changed` for every change of `path` or anything under it; answer `{"type": "watching" \| "unwatched", "path"}` with the path as an `/actor/...` path |
-| `exit` | | answer `exiting`, stop every actor, and end the `sausage` process (a wrapper like `nix run .#loop` starts it again, updated) |
+| `exit` | | answer `exiting`, stop every actor, and end the `sausage` process with exit code 75 (a wrapper like `nix run .#loop` starts it again, updated) |
+
+**Headless.** `sausage run --headless [dir]` (or `sausage --headless`, or `SAUSAGE_HEADLESS=1`) turns the console input off: the host does not read stdin, so end of input (`/dev/null`) does not stop the world. `nix run .#loop -- --headless <world>` passes it through the loop. It runs until SIGTERM or SIGINT (stops every actor, exit code 0) or a broker `exit` request (exit code 75, as above). Without the flag, EOF on stdin or `/quit` ends the host.
 
 Paths are `/actor/...`, or the sender's `/public/...` or `/data/...`.
 
@@ -208,7 +236,8 @@ instance. A version without test files passes.
 
 **Swap.** The broker holds the mailbox, stops the old instance, makes the
 top-level `actor.wasm` and `source/` a copy of the new version, and starts
-it. A rollback does the same with the older version.
+it. A stopped actor is not started: it keeps its mailbox and runs the new
+version at the next `start`. A rollback does the same with the older version.
 
 **Crashes.** The broker restarts a crashed actor after 0.5 s, then doubles
 the delay up to 30 s. A new version that crashes 3 times within 30 seconds
@@ -231,9 +260,19 @@ folder again, as at start.
 {"type": "build", "source": "/actor/agent/public/drafts/notes"}
 ```
 
-The reply is `{"type": "built", "wasm": "/actor/cargo/public/builds/<n>/<name>.wasm", "built_by": "cargo", ...}`
-or `{"type": "build_failed", "errors": "..."}`. Pass `wasm`, `source`, and
-`built_by` on to `spawn` or `upgrade`.
+The build request may include `"skip_tests": true` to skip Rust unit tests.
+By default, `cargo` first runs `cargo test` for the host target (not WASI),
+so pure-logic unit tests in a `wasm32-wasip2` actor crate can run without a
+WASI test runner. If tests fail or cannot compile, the build fails before the
+WASI build. The reply carries `tests: {"passed": <count>, "failed": <count>,
+"output": "<cargo test stdout and stderr>"}`; counts sum Cargo's test-result
+summaries, and a test command/compilation failure without a summary counts as
+one failure. With `skip_tests: true`, counts are zero and output says tests
+were skipped.
+
+The reply is `{"type": "built", "wasm": "/actor/cargo/public/builds/<n>/<name>.wasm", "built_by": "cargo", "tests": {...}, ...}`
+or `{"type": "build_failed", "errors": "...", "tests": {...}}`. Pass
+`wasm`, `source`, and `built_by` on to `spawn` or `upgrade`.
 
 A Rust actor depends on the SDK with `sausage-actor = "0.1"`. `cargo` points
 that dependency at the SDK of the host, which it publishes at

README.md

@@ -48,6 +48,18 @@ From a clone (`git clone https://gitea.surma.technology/surma/sausage`), the
 same commands are `nix run`, `nix run -- init`, `nix run -- run` and
 `nix run .#loop`.
 
+### Headless
+
+`--headless` (or `SAUSAGE_HEADLESS=1`) turns the console input off: the host
+never reads stdin, so end of input does not stop the world. It runs until
+SIGTERM/SIGINT (clean stop, exit code 0) or a broker `exit` request (exit
+code 75, so the loop starts the newest version). Create the world first
+(`init`), then pass the flag through the loop:
+
+```sh
+nix run git+https://gitea.surma.technology/surma/sausage#loop -- --headless my-world
+```
+
 In the console:
 
 ```text
@@ -66,7 +78,7 @@ actor.wasm     the current version
 actor.json     installed version, running, subscriptions
 source/        the source of the current version
 public/        files that the actor publishes
-data/          the actor's state
+data/          actor state; owner-writable, world-readable via /actor/<id>/data/ (not private)
 stderr.log     what the actor and the broker write about it
 versions/<n>/  every installed version: actor.wasm, source/, meta.json
 ```

agent/src/llm.rs

@@ -14,11 +14,49 @@ pub struct Config {
     pub base_url: String,
     pub model: String,
     pub token: String,
-    /// Optional reasoning effort for OpenAI models ("low", "medium", ...).
+    /// Optional reasoning effort for OpenAI models only (wins over `thinking` there).
     #[serde(default)]
     pub reasoning_effort: Option<String>,
     #[serde(default)]
     pub max_tokens: Option<u32>,
+    /// Thinking effort for both APIs: "low", "medium", "high", "xhigh", "max" (`LEVELS`), or "off"/unset for none.
+    /// Anthropic: adaptive thinking + output_config.effort; OpenAI: reasoning.effort. A level the model rejects is
+    /// replaced by the nearest accepted one (logged), never by "off".
+    #[serde(default)]
+    pub thinking: Option<String>,
+}
+
+/// Thinking levels, lowest first.
+pub const LEVELS: [&str; 5] = ["low", "medium", "high", "xhigh", "max"];
+
+/// The level nearest to `want` (lower on a tie) among those a 400 error lists in quotes (else all levels), not
+/// yet `tried`. None: nothing left, so the request goes out without an effort field (model default).
+fn fallback_effort(want: &str, error: &str, tried: &[String]) -> Option<String> {
+    let listed: Vec<&str> = error.split('\'').skip(1).step_by(2).filter(|w| LEVELS.contains(w)).collect();
+    let pool = if listed.iter().any(|l| *l != want) { listed } else { LEVELS.to_vec() };
+    let at = LEVELS.iter().position(|l| *l == want).unwrap_or(1) as i32;
+    pool.into_iter()
+        .filter(|l| *l != want && !tried.iter().any(|t| t == l))
+        .min_by_key(|l| {
+            let i = LEVELS.iter().position(|x| x == l).unwrap_or(1) as i32;
+            ((i - at).abs(), i > at)
+        })
+        .map(str::to_string)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::fallback_effort;
+
+    #[test]
+    fn nearest_accepted_level() {
+        let anthropic = "HTTP 400: output_config.effort: Input should be 'low', 'medium', 'high' or 'max'";
+        assert_eq!(fallback_effort("xhigh", anthropic, &["xhigh".into()]).as_deref(), Some("high"));
+        let openai = "HTTP 400: Invalid value: 'ultra'. Supported values are: 'none', 'minimal', 'low', 'medium', 'high', 'xhigh', and 'max'.";
+        assert_eq!(fallback_effort("ultra", openai, &["ultra".into()]).as_deref(), Some("medium"));
+        // No list in the error: step to the neighbour, never to off.
+        assert_eq!(fallback_effort("max", "HTTP 400: effort max not supported", &["max".into()]).as_deref(), Some("xhigh"));
+    }
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug)]
@@ -32,7 +70,7 @@ pub enum Entry {
     },
     ToolCall { id: String, name: String, arguments: String },
     ToolResult { id: String, output: String },
-    /// A provider item that only this API shape understands (OpenAI reasoning).
+    /// A provider item that only this API shape understands (OpenAI reasoning, Anthropic thinking).
     Opaque { api: String, item: Value },
 }
 
@@ -43,10 +81,28 @@ pub struct Tool {
 }
 
 pub async fn complete(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]) -> Result<Vec<Entry>, String> {
-    match cfg.api.as_str() {
-        "openai-responses" => openai(cfg, system, tools, history).await,
-        "anthropic-messages" => anthropic(cfg, system, tools, history).await,
-        other => Err(format!("unknown API shape {other:?}")),
+    let want = match cfg.api.as_str() {
+        "openai-responses" => cfg.reasoning_effort.clone().or_else(|| cfg.thinking.clone()),
+        _ => cfg.thinking.clone(),
+    }
+    .filter(|t| t != "off");
+    let mut effort = want.clone();
+    let mut tried = Vec::new();
+    loop {
+        let result = match cfg.api.as_str() {
+            "openai-responses" => openai(cfg, system, tools, history, effort.as_deref()).await,
+            "anthropic-messages" => anthropic(cfg, system, tools, history, want.is_some(), effort.as_deref()).await,
+            other => return Err(format!("unknown API shape {other:?}")),
+        };
+        match (result, effort.clone()) {
+            // The model rejected the effort level: retry with the nearest accepted one (thinking stays on).
+            (Err(e), Some(current)) if e.starts_with("HTTP 400") && e.contains("effort") => {
+                tried.push(current.clone());
+                effort = fallback_effort(want.as_deref().unwrap_or(""), &e, &tried);
+                eprintln!("agent: {} rejected thinking effort {current:?}; retrying with {effort:?}: {e}", cfg.model);
+            }
+            (result, _) => return result,
+        }
     }
 }
 
@@ -67,7 +123,7 @@ async fn post(url: &str, headers: &[(&str, String)], body: &Value) -> Result<Val
     serde_json::from_str(&text).map_err(|e| format!("invalid JSON in response: {e}"))
 }
 
-async fn openai(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]) -> Result<Vec<Entry>, String> {
+async fn openai(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry], effort: Option<&str>) -> Result<Vec<Entry>, String> {
     let mut input = Vec::new();
     for e in history {
         match e {
@@ -104,7 +160,7 @@ async fn openai(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]) -
     if let Some(max_tokens) = cfg.max_tokens {
         body["max_output_tokens"] = json!(max_tokens);
     }
-    if let Some(effort) = &cfg.reasoning_effort {
+    if let Some(effort) = effort {
         body["reasoning"] = json!({"effort": effort});
     }
     let url = format!("{}/v1/responses", cfg.base_url);
@@ -143,7 +199,14 @@ async fn openai(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]) -
     Ok(out)
 }
 
-async fn anthropic(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]) -> Result<Vec<Entry>, String> {
+async fn anthropic(
+    cfg: &Config,
+    system: &str,
+    tools: &[Tool],
+    history: &[Entry],
+    thinking: bool,
+    effort: Option<&str>,
+) -> Result<Vec<Entry>, String> {
     // Merge consecutive blocks of the same role into one message.
     let mut messages: Vec<(String, Vec<Value>)> = Vec::new();
     let mut push = |role: &str, block: Value| match messages.last_mut() {
@@ -163,6 +226,8 @@ async fn anthropic(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]
             Entry::ToolResult { id, output } => {
                 push("user", json!({"type": "tool_result", "tool_use_id": id, "content": output}))
             }
+            // Thinking blocks go back unchanged (with their signature): required next to tool use.
+            Entry::Opaque { api, item } if api == "anthropic-messages" && thinking => push("assistant", item.clone()),
             Entry::Opaque { .. } => {}
         }
     }
@@ -171,13 +236,19 @@ async fn anthropic(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]
         .iter()
         .map(|t| json!({"name": t.name, "description": t.description, "input_schema": t.parameters}))
         .collect();
-    let body = json!({
+    let mut body = json!({
         "model": cfg.model,
         "system": system,
         "messages": messages,
         "tools": tools,
         "max_tokens": cfg.max_tokens.unwrap_or(32000),
     });
+    if thinking {
+        body["thinking"] = json!({"type": "adaptive"});
+        if let Some(effort) = effort {
+            body["output_config"] = json!({"effort": effort});
+        }
+    }
     let url = format!("{}/v1/messages", cfg.base_url);
     let resp = post(
         &url,
@@ -199,6 +270,9 @@ async fn anthropic(cfg: &Config, system: &str, tools: &[Tool], history: &[Entry]
                 name: block["name"].as_str().unwrap_or_default().to_string(),
                 arguments: block["input"].to_string(),
             }),
+            Some("thinking") | Some("redacted_thinking") => {
+                out.push(Entry::Opaque { api: "anthropic-messages".into(), item: block })
+            }
             _ => {}
         }
     }

agent/src/prompt.md

@@ -3,3 +3,5 @@ People talk to you through other actors. Your text goes to your subscribers.
 Before writing an actor, read `/actor/broker/public/PROTOCOL.md` for messages, the broker, `cargo`, and tests.
 Read the SDK at `/actor/cargo/public/sdk/` before you write an actor.
 You can change your own source at `/actor/agent/source`.
+
+The global filesystem is readable by every actor, including every actor's `/data` at `/actor/<id>/data/`. An actor can write only its own `/data` and `/public`. `/data` is not private: any unprotected secret file there is readable by every actor.

cli/src/broker.rs

@@ -255,6 +255,10 @@ impl Broker {
         }
         InstanceConfig {
             mounts: vec![
+                // WASI preopens directories, not files. This isolated directory
+                // supplies /config without exposing the rest of the world.
+                Mount { guest: "/".into(), host: scratch.map_or_else(|| self.world.global_dir(), |p| p.join("global")), writable: false },
+                Mount { guest: "/global".into(), host: scratch.map_or_else(|| self.world.global_dir(), |p| p.join("global")), writable: id == "shared" },
                 Mount { guest: "/actor".into(), host: self.world.actors_root(), writable: false },
                 Mount { guest: "/public".into(), host: own.join("public"), writable: true },
                 Mount { guest: "/data".into(), host: own.join("data"), writable: true },
@@ -331,12 +335,13 @@ impl Broker {
         Ok((component, tests))
     }
 
-    /// Make `version` the current `actor.wasm`, `source/`, and `actor.json`.
-    pub fn install(&self, id: &str, version: u64) -> Result<()> {
+    /// Make `version` the current `actor.wasm`, `source/`, and `actor.json`,
+    /// and record whether the actor runs.
+    pub fn install(&self, id: &str, version: u64, running: bool) -> Result<()> {
         self.world.install_files(id, version)?;
         self.update_meta(id, |m| {
             m.version = Some(version);
-            m.running = true;
+            m.running = running;
         })
     }
 
@@ -360,7 +365,7 @@ impl Broker {
 
     async fn create_version(self: &Arc<Self>, id: &str, meta: &VersionMeta, wasm: &Path, source: Option<&Path>) -> Result<Value> {
         let (_, tests) = self.try_version(id, meta, wasm, source).await?;
-        self.install(id, meta.version)?;
+        self.install(id, meta.version, true)?;
         self.start_supervisor(id, meta.version, true);
         Ok(json!({"type": "spawned", "actor": id, "version": meta.version, "tests": tests}))
     }

cli/src/candidate.rs

@@ -97,7 +97,7 @@ impl Candidate<'_> {
         let dir = self.broker.world.scratch_dir().join(format!("{}-{}-{n}", self.id, std::process::id()));
         let scratch = Scratch { dir: dir.clone() };
         let world = &self.broker.world;
-        for (from, name) in [(world.data_dir(self.id), "data"), (world.public_dir(self.id), "public")] {
+        for (from, name) in [(world.data_dir(self.id), "data"), (world.public_dir(self.id), "public"), (world.global_dir(), "global")] {
             std::fs::create_dir_all(dir.join(name))?;
             if from.is_dir() {
                 world::copy_tree(&from, &dir.join(name))?;

cli/src/cargo_actor.rs

@@ -1,8 +1,9 @@
 //! The native `cargo` actor: builds Rust source folders into `.wasm` files.
 //!
 //! Request:  `{"type": "build", "source": "/actor/<id>/public/<folder>"}`
-//! Replies:  `{"type": "built", "wasm": "/actor/cargo/public/builds/<n>/<name>.wasm", ...}`
-//!           `{"type": "build_failed", "errors": "..."}`
+//!           optional `"skip_tests": true` skips native `cargo test` (tests run by default).
+//! Replies:  `{"type": "built", "wasm": "/actor/cargo/public/builds/<n>/<name>.wasm", "tests": {"passed": 1, "failed": 0, "output": "..."}, ...}`
+//!           `{"type": "build_failed", "errors": "...", "tests": {"passed": 0, "failed": 1, "output": "..."}}`
 //!
 //! The broker knows nothing about Rust. This actor is one way to get a
 //! `.wasm` file. Other actors can add other languages.
@@ -32,11 +33,49 @@ pub const TARGET: &str = "wasm32-wasip2";
 /// The source of the `sausage-actor` SDK.
 static SDK: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/../sdk");
 
+#[derive(Clone, Default, Debug)]
+pub struct TestResults {
+    pub passed: u64,
+    pub failed: u64,
+    pub output: String,
+}
+
+impl TestResults {
+    fn value(&self) -> Value {
+        json!({"passed": self.passed, "failed": self.failed, "output": self.output})
+    }
+}
+
 pub struct BuildOutput {
     /// Host path of the published `.wasm` file.
     pub wasm: PathBuf,
     pub seconds: f64,
     pub warnings: String,
+    pub tests: TestResults,
+}
+
+#[derive(Debug)]
+pub struct BuildFailure {
+    pub reason: String,
+    pub tests: TestResults,
+}
+
+impl std::fmt::Display for BuildFailure {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        if self.tests.failed > 0 && !self.tests.output.is_empty() {
+            write!(f, "{}:\n{}", self.reason, self.tests.output)
+        } else {
+            f.write_str(&self.reason)
+        }
+    }
+}
+
+impl std::error::Error for BuildFailure {}
+
+impl From<anyhow::Error> for BuildFailure {
+    fn from(error: anyhow::Error) -> Self {
+        Self { reason: format!("{error:#}"), tests: TestResults::default() }
+    }
 }
 
 /// All builds share one target folder, so they run one at a time.
@@ -51,51 +90,84 @@ impl Cargo {
         Ok(Self { world })
     }
 
-    /// Build the crate in `source` (a host path) and publish the `.wasm` file
-    /// under `/actor/cargo/public/builds/<n>/`.
-    pub async fn build(&self, source: &Path) -> Result<BuildOutput> {
+    /// Run native `cargo test` unless opted out, then build and publish the
+    /// crate's `wasm32-wasip2` binary under `/actor/cargo/public/builds/<n>/`.
+    pub async fn build(&self, source: &Path, skip_tests: bool) -> std::result::Result<BuildOutput, BuildFailure> {
         if !source.join("Cargo.toml").is_file() {
-            bail!("{} has no Cargo.toml", source.display());
+            return Err(BuildFailure {
+                reason: format!("{} has no Cargo.toml", source.display()),
+                tests: TestResults::default(),
+            });
         }
         let started = Instant::now();
         let data = self.world.data_dir(ID);
         let build_dir = data.join("work");
         world::replace_source(source, &build_dir)?;
         let manifest = build_dir.join("Cargo.toml");
-        std::fs::write(&manifest, prepare_manifest(&std::fs::read_to_string(&manifest)?, Some(&self.world.public_dir(ID).join("sdk")))?)?;
+        let original = std::fs::read_to_string(&manifest).context("read build manifest")?;
+        let prepared = prepare_manifest(&original, Some(&self.world.public_dir(ID).join("sdk")))?;
+        std::fs::write(&manifest, prepared).context("write prepared manifest")?;
 
-        let mut cmd = Command::new("cargo");
-        cmd.arg("build")
-            .arg("--release")
-            .arg("--target")
-            .arg(TARGET)
-            .arg("--message-format=json-render-diagnostics")
-            .arg("--target-dir")
-            .arg(data.join("target"))
-            .current_dir(&build_dir)
-            .kill_on_drop(true);
-        let out = cmd.output().await.context("cannot run cargo (is it on PATH, with the wasm32-wasip2 target?)")?;
-        let stderr = String::from_utf8_lossy(&out.stderr).to_string();
-        if !out.status.success() {
-            bail!("{}", strip_progress(&stderr));
-        }
-        let mut artifact = None;
-        for line in String::from_utf8_lossy(&out.stdout).lines() {
-            if let Ok(v) = serde_json::from_str::<Value>(line)
-                && v["reason"] == "compiler-artifact"
-                && let Some(exe) = v["executable"].as_str()
-            {
-                artifact = Some(PathBuf::from(exe));
+        let target_dir = data.join("target");
+        let tests = if skip_tests {
+            TestResults { output: "skipped (skip_tests=true)".into(), ..TestResults::default() }
+        } else {
+            match run_tests(&build_dir, &target_dir).await {
+                Ok(tests) => tests,
+                Err(error) => {
+                    let output = format!("cannot run cargo tests: {error:#}");
+                    return Err(BuildFailure {
+                        reason: output.clone(),
+                        tests: TestResults { failed: 1, output, ..TestResults::default() },
+                    });
+                }
             }
+        };
+        if tests.failed > 0 {
+            return Err(BuildFailure { reason: "unit tests failed".into(), tests });
         }
-        let artifact = artifact.ok_or_else(|| anyhow!("cargo built no binary. Does the crate have a src/main.rs?"))?;
 
-        let n = next_build_number(&self.world.public_dir(ID).join("builds"))?;
-        let dest_dir = self.world.public_dir(ID).join("builds").join(n.to_string());
-        let name = artifact.file_name().context("artifact has no file name")?;
-        let dest = dest_dir.join(name);
-        world::write_atomic(&dest, &std::fs::read(&artifact)?)?;
-        Ok(BuildOutput { wasm: dest, seconds: started.elapsed().as_secs_f64(), warnings: strip_progress(&stderr) })
+        let build_result: Result<BuildOutput> = async {
+            let mut cmd = Command::new("cargo");
+            cmd.arg("build")
+                .arg("--release")
+                .arg("--target")
+                .arg(TARGET)
+                .arg("--message-format=json-render-diagnostics")
+                .arg("--target-dir")
+                .arg(&target_dir)
+                .current_dir(&build_dir)
+                .kill_on_drop(true);
+            let out = cmd.output().await.context("cannot run cargo (is it on PATH, with the wasm32-wasip2 target?)")?;
+            let stderr = String::from_utf8_lossy(&out.stderr).to_string();
+            if !out.status.success() {
+                bail!("{}", strip_progress(&stderr));
+            }
+            let mut artifact = None;
+            for line in String::from_utf8_lossy(&out.stdout).lines() {
+                if let Ok(v) = serde_json::from_str::<Value>(line)
+                    && v["reason"] == "compiler-artifact"
+                    && let Some(exe) = v["executable"].as_str()
+                {
+                    artifact = Some(PathBuf::from(exe));
+                }
+            }
+            let artifact = artifact.ok_or_else(|| anyhow!("cargo built no binary. Does the crate have a src/main.rs?"))?;
+
+            let n = next_build_number(&self.world.public_dir(ID).join("builds"))?;
+            let dest_dir = self.world.public_dir(ID).join("builds").join(n.to_string());
+            let name = artifact.file_name().context("artifact has no file name")?;
+            let dest = dest_dir.join(name);
+            world::write_atomic(&dest, &std::fs::read(&artifact)?)?;
+            Ok(BuildOutput {
+                wasm: dest,
+                seconds: started.elapsed().as_secs_f64(),
+                warnings: strip_progress(&stderr),
+                tests: tests.clone(),
+            })
+        }
+        .await;
+        build_result.map_err(|error| BuildFailure { reason: format!("{error:#}"), tests })
     }
 
     /// The native `cargo` actor. Builds run one at a time, in order.
@@ -106,7 +178,7 @@ impl Cargo {
                 continue;
             }
             let body = self.handle(&broker, &env).await.unwrap_or_else(|e| {
-                json!({"type": "build_failed", "source": env.body.get("source"), "errors": format!("{e:#}")})
+                json!({"type": "build_failed", "source": env.body.get("source"), "errors": format!("{e:#}"), "tests": TestResults::default().value()})
             });
             broker.send(ID, Some(&env.from), None, Some(&env.id), body);
         }
@@ -117,22 +189,76 @@ impl Cargo {
             Some("build") => {
                 let source_s = env.body.get("source").and_then(Value::as_str).ok_or_else(|| anyhow!("missing \"source\""))?;
                 let source = broker.world.resolve(&env.from, source_s)?;
-                let out = self.build(&source).await?;
-                let wasm = self.world.global_path(&out.wasm).unwrap_or_else(|| out.wasm.display().to_string());
-                Ok(json!({
-                    "type": "built",
-                    "wasm": wasm,
-                    "source": source_s,
-                    "built_by": ID,
-                    "seconds": (out.seconds * 10.0).round() / 10.0,
-                    "warnings": out.warnings,
-                }))
+                let skip_tests = env.body.get("skip_tests").and_then(Value::as_bool).unwrap_or(false);
+                match self.build(&source, skip_tests).await {
+                    Ok(out) => {
+                        let wasm = self.world.global_path(&out.wasm).unwrap_or_else(|| out.wasm.display().to_string());
+                        Ok(json!({
+                            "type": "built",
+                            "wasm": wasm,
+                            "source": source_s,
+                            "built_by": ID,
+                            "seconds": (out.seconds * 10.0).round() / 10.0,
+                            "warnings": out.warnings,
+                            "tests": out.tests.value(),
+                        }))
+                    }
+                    Err(failure) => Ok(json!({
+                        "type": "build_failed",
+                        "source": source_s,
+                        "errors": failure.reason,
+                        "tests": failure.tests.value(),
+                    })),
+                }
             }
             other => bail!("unknown request {other:?}. Known: build"),
         }
     }
 }
 
+/// Run tests for the host triple: WASI crates' pure-logic tests can use the
+/// normal Rust test harness without needing a WASI test runner.
+async fn run_tests(build_dir: &Path, target_dir: &Path) -> Result<TestResults> {
+    let mut cmd = Command::new("cargo");
+    cmd.arg("test")
+        .arg("--target-dir")
+        .arg(target_dir)
+        .current_dir(build_dir)
+        .kill_on_drop(true);
+    let out = cmd.output().await.context("cannot run cargo test")?;
+    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
+    let stderr = String::from_utf8_lossy(&out.stderr).to_string();
+    let combined = match (stdout.is_empty(), stderr.is_empty()) {
+        (true, true) => String::new(),
+        (false, true) => stdout,
+        (true, false) => stderr,
+        (false, false) => format!("{stdout}\n{stderr}"),
+    };
+    let output = strip_progress(&combined);
+    let passed = test_count(&output, "passed");
+    let mut failed = test_count(&output, "failed");
+    // Compilation failures and runner errors have no `test result` summary,
+    // but still make the default test phase fail.
+    if !out.status.success() && failed == 0 {
+        failed = 1;
+    }
+    Ok(TestResults { passed, failed, output })
+}
+
+/// Count the `passed` or `failed` totals in cargo's per-target test summaries.
+fn test_count(output: &str, field: &str) -> u64 {
+    output
+        .lines()
+        .filter_map(|line| line.split_once("test result:").map(|(_, rest)| rest))
+        .flat_map(|summary| summary.split(';'))
+        .filter_map(|part| {
+            let words: Vec<_> = part.split_whitespace().collect();
+            let index = words.iter().position(|word| *word == field)?;
+            words.get(index.checked_sub(1)?)?.parse::<u64>().ok()
+        })
+        .sum()
+}
+
 /// Point a `sausage-actor` dependency at `sdk` (keeping its features), and
 /// add an empty `[workspace]`, so the crate never joins a parent workspace.
 fn prepare_manifest(text: &str, sdk: Option<&Path>) -> Result<String> {

cli/src/console.rs

@@ -3,7 +3,8 @@
 //! - `@<actor> <json>` sends a JSON body. `@<actor> <text>` sends
 //!   `{"type": "text", "text": ...}`.
 //! - A line without `@` goes to `agent` as text.
-//! - `/help`, `/quit`. EOF on stdin also quits.
+//! - `/help`, `/quit`. EOF on stdin also quits (not with `--headless`, which
+//!   never reads stdin).
 
 use std::sync::Arc;
 

cli/src/lib.rs

@@ -48,6 +48,7 @@ impl Host {
         if lock.try_lock().is_err() {
             bail!("another sausage process runs {}", root.display());
         }
+        world.ensure_config()?;
         let broker = Broker::new(world.clone(), runtime::Runtime::new()?)?;
         world::write_atomic(&world.public_dir("broker").join("PROTOCOL.md"), PROTOCOL.as_bytes())?;
 

cli/src/main.rs

@@ -5,6 +5,7 @@ use anyhow::{Context, Result, bail};
 use clap::{Parser, Subcommand};
 use include_dir::{Dir, include_dir};
 use serde_json::json;
+use tokio::signal::unix::Signal;
 
 use sausage::world::{ActorMeta, World};
 use sausage::{Host, cargo_actor, console};
@@ -17,6 +18,11 @@ static AGENT_SOURCE: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/../agent");
 #[derive(Parser)]
 #[command(version, about)]
 struct Cli {
+    /// Do not read stdin, so end of input does not stop the world. It runs
+    /// until SIGTERM (or SIGINT), or until an actor sends
+    /// `@broker {"type":"exit"}`. Also set by SAUSAGE_HEADLESS=1.
+    #[arg(long, global = true)]
+    headless: bool,
     #[command(subcommand)]
     command: Option<Cmd>,
 }
@@ -85,19 +91,47 @@ async fn init(dir: PathBuf) -> Result<()> {
     std::fs::create_dir_all(&source)?;
     AGENT_SOURCE.extract(&source).context("extract agent source")?;
     println!("Building the agent actor (the first build takes a few minutes) …");
-    let out = cargo_actor::Cargo::new(world.clone())?.build(&source).await.context("build agent")?;
+    let out = cargo_actor::Cargo::new(world.clone())?.build(&source, false).await.context("build agent")?;
     std::fs::copy(&out.wasm, world.wasm_path("agent"))?;
     println!("Built in {:.1} s. Start the world with: sausage run {}", out.seconds, dir.display());
     Ok(())
 }
 
-async fn run(dir: PathBuf) -> Result<()> {
+/// Install the SIGTERM and SIGINT handlers now (not when first polled).
+fn termination_signals() -> Result<(Signal, Signal)> {
+    use tokio::signal::unix::{SignalKind, signal};
+    let term = signal(SignalKind::terminate()).context("install SIGTERM handler")?;
+    let int = signal(SignalKind::interrupt()).context("install SIGINT handler")?;
+    Ok((term, int))
+}
+
+/// Resolves on SIGTERM or SIGINT.
+async fn termination((mut term, mut int): (Signal, Signal)) {
+    tokio::select! {
+        _ = term.recv() => {}
+        _ = int.recv() => {}
+    }
+}
+
+async fn run(dir: PathBuf, headless: bool) -> Result<()> {
+    // Register the signal handlers before the host starts, so a signal that
+    // arrives early is never the default (kill) action.
+    let signals = if headless { Some(termination_signals()?) } else { None };
     let host = Host::start(&dir).await?;
     tokio::spawn(console::run_mailbox(host.mailbox(console::ID)));
     let broker = host.broker.clone();
-    let exit = tokio::select! {
-        _ = console::run_input(host.broker.clone()) => false,
-        _ = broker.exit_requested() => true,
+    let exit = match signals {
+        Some(signals) => {
+            println!("Sausage headless: running until SIGTERM or an exit request.");
+            tokio::select! {
+                _ = termination(signals) => false,
+                _ = broker.exit_requested() => true,
+            }
+        }
+        None => tokio::select! {
+            _ = console::run_input(host.broker.clone()) => false,
+            _ = broker.exit_requested() => true,
+        },
     };
     println!("Stopping actors …");
     host.stop().await;
@@ -113,16 +147,18 @@ async fn run(dir: PathBuf) -> Result<()> {
 
 #[tokio::main]
 async fn main() -> Result<()> {
-    match Cli::parse().command {
+    let cli = Cli::parse();
+    let headless = cli.headless || std::env::var("SAUSAGE_HEADLESS").is_ok_and(|v| !v.is_empty() && v != "0");
+    match cli.command {
         Some(Cmd::Init { dir }) => init(dir).await,
-        Some(Cmd::Run { dir }) => run(dir).await,
+        Some(Cmd::Run { dir }) => run(dir, headless).await,
         None => {
             let dir = PathBuf::from("world");
             if !dir.join("actor").is_dir() {
                 println!("No world in ./world yet, creating it (same as `sausage init`).");
                 init(dir.clone()).await?;
             }
-            run(dir).await
+            run(dir, headless).await
         }
     }
 }

cli/src/runtime.rs

@@ -23,7 +23,9 @@ use wasmtime_wasi_http::{WasiHttpCtx, WasiHttpCtxView, WasiHttpHooks, WasiHttpVi
 use crate::broker::Broker;
 use crate::vfs::{Vfs, VfsState, VfsView};
 
-/// A host folder that the guest sees at `guest`.
+/// A host folder that the guest sees at `guest`. File-like root paths such
+/// as `/config` use an isolated backing directory mounted at `/`; owners
+/// get a separate writable directory alias for atomic replacement.
 #[derive(Clone, Debug)]
 pub struct Mount {
     pub guest: String,

cli/src/supervisor.rs

@@ -220,17 +220,16 @@ impl Supervisor {
 
     /// Make `version` current. It is compiled first (unless `component` is
     /// given): if that fails, nothing changes. `data/` and `public/` stay as
-    /// they are.
+    /// they are. A stopped actor stays stopped.
     async fn install(&mut self, version: u64, component: Option<Component>) -> Result<()> {
         let component = match component {
             Some(c) => c,
             None => self.broker.load_version(&self.id, version)?,
         };
         self.stop().await;
-        self.broker.install(&self.id, version)?;
+        self.broker.install(&self.id, version, self.running)?;
         self.version = version;
         self.component = Some(component);
-        self.running = true;
         self.restarts = 0;
         self.restart_at = None;
         Ok(())
@@ -239,20 +238,26 @@ impl Supervisor {
     async fn upgrade(&mut self, version: u64, component: Component, requester: String) -> Result<Value> {
         let previous = self.version;
         self.install(version, Some(component)).await?;
+        if !self.running {
+            // Installed, not started: main runs and mail is read at the next `start`.
+            return Ok(json!({"type": "upgraded", "actor": self.id, "version": version, "previous": previous, "running": false}));
+        }
         self.probation = Some(Probation { previous, since: Instant::now(), crashes: 0, requester });
         if let Err(e) = self.start().await {
             self.rollback(previous).await?;
             bail!("version {version} did not start ({e:#}); rolled back to {previous}");
         }
-        Ok(json!({"type": "upgraded", "actor": self.id, "version": version, "previous": previous}))
+        Ok(json!({"type": "upgraded", "actor": self.id, "version": version, "previous": previous, "running": true}))
     }
 
     async fn rollback(&mut self, version: u64) -> Result<Value> {
         let from = self.version;
         self.install(version, None).await?;
         self.probation = None;
-        self.start().await?;
-        Ok(json!({"type": "rolled_back", "actor": self.id, "from": from, "to": version}))
+        if self.running {
+            self.start().await?;
+        }
+        Ok(json!({"type": "rolled_back", "actor": self.id, "from": from, "to": version, "running": self.running}))
     }
 
     /// Handle a control request. Returns `true` when the supervisor ends.

cli/src/vfs.rs

@@ -6,6 +6,8 @@
 //! actor `<id>` with a message from `fs` and waits up to `ASK_TIMEOUT` for
 //! the reply. Other paths go to `wasmtime-wasi` unchanged except that an
 //! actor directory listing advertises `fs/` when its source docs declare it.
+//! `/config` and `/global/config` are native mount paths: they deliberately
+//! use WASI mount permissions rather than actor-served write requests.
 //!
 //! - `fs_read {path}` -> `fs_file {text | base64}`, `fs_dir {entries: [{name, type}]}`
 //! - `fs_write {path, text | base64}`, `fs_mkdir {path}`, `fs_remove {path}`,

cli/src/world.rs

@@ -4,6 +4,8 @@
 //!
 //! ```text
 //! <world>/
+//!   global/config       non-secret global JSON (shared owns writes)
+//!   config -> global/config  world-facing read alias
 //!   actor/<id>/
 //!     actor.wasm        the current version
 //!     actor.json        version, running, subscriptions, tapped, watches (broker)
@@ -89,6 +91,37 @@ impl World {
         Self { root: root.into() }
     }
 
+    /// Isolated backing directory for the root /config mount and the
+    /// owner's writable /global alias. Never copy legacy actor config here.
+    pub fn global_dir(&self) -> PathBuf {
+        self.root.join("global")
+    }
+
+    pub fn config_path(&self) -> PathBuf {
+        self.global_dir().join("config")
+    }
+
+    /// Add the non-secret file to new and pre-existing worlds. The symlink
+    /// is for native world readers; actor mounts use the backing directory.
+    pub fn ensure_config(&self) -> Result<()> {
+        std::fs::create_dir_all(self.global_dir())?;
+        let alias = self.root.join("config");
+        if !self.config_path().exists() {
+            if alias.is_file() && !alias.is_symlink() {
+                std::fs::rename(&alias, self.config_path())?;
+            } else {
+                write_atomic(&self.config_path(), b"{}\n")?;
+            }
+        }
+        match std::fs::read_link(&alias) {
+            Ok(target) if target == Path::new("global/config") => {}
+            Ok(_) => bail!("{} must point to global/config", alias.display()),
+            Err(_) if alias.try_exists()? => bail!("{} already exists", alias.display()),
+            Err(_) => std::os::unix::fs::symlink("global/config", alias)?,
+        }
+        Ok(())
+    }
+
     pub fn actors_root(&self) -> PathBuf {
         self.root.join("actor")
     }
@@ -131,6 +164,7 @@ impl World {
         for id in NATIVE {
             world.ensure_actor_dirs(id)?;
         }
+        world.ensure_config()?;
         Ok(world)
     }
 
@@ -209,6 +243,9 @@ impl World {
         let prefixed = |prefix: &str| {
             path.strip_prefix(prefix).filter(|rest| rest.is_empty() || rest.starts_with('/'))
         };
+        if path == "/config" || path == "/global/config" {
+            return Ok(self.config_path());
+        }
         if let Some(rest) = prefixed("/actor") {
             return under(self.actors_root(), rest);
         }

cli/tests/cli.rs

@@ -39,3 +39,47 @@ fn bare_command_without_a_world_starts_init() {
     // It asks before it creates anything.
     assert!(!dir.join("world").exists());
 }
+
+/// Start a headless host on a fresh world with stdin at EOF; returns once it
+/// printed its ready line (printed after the signal handlers are installed).
+fn start_headless(label: &str) -> (std::process::Child, std::io::Lines<std::io::BufReader<std::process::ChildStdout>>) {
+    use std::io::{BufRead, BufReader};
+    let dir = empty_dir(label);
+    let world = dir.join("world");
+    sausage::World::create(&world).unwrap();
+    let mut child = Command::new(env!("CARGO_BIN_EXE_sausage"))
+        .args(["run", "--headless"])
+        .arg(&world)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap();
+    let mut lines = BufReader::new(child.stdout.take().unwrap()).lines();
+    let line = lines.next().expect("host exited before it started").unwrap();
+    assert!(line.contains("headless"), "unexpected first line: {line}");
+    (child, lines)
+}
+
+/// With stdin at EOF (as soon as the host starts), a headless host stays up.
+#[test]
+fn headless_ignores_stdin_eof() {
+    let (mut child, _lines) = start_headless("headless-eof");
+    std::thread::sleep(std::time::Duration::from_millis(500));
+    let alive = child.try_wait().unwrap().is_none();
+    let _ = child.kill();
+    let _ = child.wait();
+    assert!(alive, "headless host exited on stdin EOF");
+}
+
+/// SIGTERM right after the ready line stops the actors and exits with 0.
+#[test]
+fn headless_stops_cleanly_on_sigterm_right_after_ready() {
+    let (mut child, lines) = start_headless("headless-term");
+    let pid = child.id().to_string();
+    assert!(Command::new("kill").args(["-TERM", &pid]).status().unwrap().success());
+    let rest: Vec<String> = lines.map(|l| l.unwrap()).collect();
+    let status = child.wait().unwrap();
+    assert!(status.success(), "exit status {status:?}, output {rest:?}");
+    assert!(rest.iter().any(|l| l.contains("Stopping actors")), "output {rest:?}");
+}

cli/tests/crates/cargo-test-fail/Cargo.toml

@@ -0,0 +1,6 @@
+[package]
+name = "cargo-test-fail"
+version = "0.1.0"
+edition = "2024"
+
+[workspace]

cli/tests/crates/cargo-test-fail/src/main.rs

@@ -0,0 +1,9 @@
+fn main() {}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn deliberate_unit_test_failure() {
+        assert_eq!(2 + 2, 5);
+    }
+}

cli/tests/crates/cargo-valid/src/main.rs

@@ -1 +1,9 @@
 fn main() {}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn unit_tests_run_on_the_host_target() {
+        assert_eq!(2 + 2, 4);
+    }
+}

cli/tests/host.rs

@@ -47,6 +47,83 @@ async fn receive_shutdown_messages(
     .expect("shutdown output or lifecycle reply did not arrive");
 }
 
+#[tokio::test]
+async fn global_config_is_readable_owner_written_and_atomically_replaced() {
+    let world = create_world("global-config");
+    let (host, mut mailbox) = start(&world).await;
+    let wasm = toolbox_wasm().clone();
+    for actor in ["shared", "reader"] {
+        let source = passing_source(&world, actor);
+        spawn_type(&host, &mut mailbox, actor, &wasm, &source).await;
+    }
+    let initial = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
+    assert_eq!(initial.body["text"], "{}\n");
+    for path in ["/config", "/global/config", "/global/config.tmp", "/actor/shared/data/../../../../global/config"] {
+        ask_type(&host, &mut mailbox, "reader", json!({"type": "write", "path": path, "text": "not allowed"}), "error").await;
+    }
+    ask_type(&host, &mut mailbox, "reader", json!({"type": "rename", "path": "/config", "to": "/global/stolen"}), "error").await;
+    // The root view stays read-only even for the owner; publication uses its
+    // writable directory alias, with a sibling temporary file and rename.
+    ask_type(&host, &mut mailbox, "shared", json!({"type": "write", "path": "/config", "text": "not allowed"}), "error").await;
+    let next = "{\"llm\":{\"thinking\":\"medium\"}}\n";
+    ask_type(&host, &mut mailbox, "shared", json!({"type": "write", "path": "/global/config.tmp", "text": next}), "ok").await;
+    let before = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
+    assert_eq!(before.body["text"], "{}\n");
+    // A native/world reader holding the old inode sees the complete old file.
+    let mut old = std::fs::File::open(world.root.join("config")).unwrap();
+    ask_type(&host, &mut mailbox, "shared", json!({"type": "rename", "path": "/global/config.tmp", "to": "/global/config"}), "ok").await;
+    let after = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
+    assert_eq!(after.body["text"], next);
+    assert_eq!(std::fs::read_to_string(world.root.join("config")).unwrap(), next);
+    assert_eq!(std::fs::read_to_string(world.resolve("reader", "/config").unwrap()).unwrap(), next);
+    let mut previous = String::new();
+    std::io::Read::read_to_string(&mut old, &mut previous).unwrap();
+    assert_eq!(previous, "{}\n");
+    assert!(!world.global_dir().join("config.tmp").exists());
+    // The mount must not give shared writable access to any other world data.
+    ask_type(&host, &mut mailbox, "shared", json!({"type": "write", "path": "/global/../actor/reader/data/escape", "text": "no"}), "error").await;
+    host.stop().await;
+    let (host, mut mailbox) = start(&world).await;
+    let persisted = ask_type(&host, &mut mailbox, "reader", json!({"type": "read", "path": "/config"}), "content").await;
+    assert_eq!(persisted.body["text"], next);
+    host.stop().await;
+}
+
+#[tokio::test]
+async fn global_config_candidates_cannot_change_the_live_file() {
+    let world = create_world("candidate-global-config");
+    let (host, mut mailbox) = start(&world).await;
+    let source = source_with_test(&world, "shared", json!({"steps": [
+        {"send": {"type": "write", "path": "/global/next", "text": "{\"test\":true}"}, "expect": {"type": "ok"}},
+        {"send": {"type": "rename", "path": "/global/next", "to": "/global/config"}, "expect": {"type": "ok"}},
+        {"send": {"type": "read", "path": "/config"}, "expect": {"type": "content", "text": "{\"test\":true}"}}
+    ]}));
+    spawn_type(&host, &mut mailbox, "shared", toolbox_wasm(), &source).await;
+    assert_eq!(std::fs::read_to_string(world.config_path()).unwrap(), "{}\n");
+    host.stop().await;
+}
+
+#[tokio::test]
+async fn global_config_is_added_to_existing_worlds_without_copying_actor_settings() {
+    let world = create_world("old-world-config");
+    std::fs::remove_file(world.root.join("config")).unwrap();
+    std::fs::remove_dir_all(world.global_dir()).unwrap();
+    world.ensure_actor_dirs("shared").unwrap();
+    // Synthetic marker only; no actual credentials are read in this test.
+    std::fs::write(world.data_dir("shared").join("config.json"), "legacy-private-marker").unwrap();
+    let (host, _) = start(&world).await;
+    assert_eq!(std::fs::read_to_string(world.root.join("config")).unwrap(), "{}\n");
+    assert_eq!(std::fs::read_to_string(world.data_dir("shared").join("config.json")).unwrap(), "legacy-private-marker");
+    host.stop().await;
+    // Preserve an operator-provided global config when adding the mounts.
+    std::fs::remove_file(world.root.join("config")).unwrap();
+    std::fs::remove_dir_all(world.global_dir()).unwrap();
+    std::fs::write(world.root.join("config"), "{\"operator\":true}").unwrap();
+    let (host, _) = start(&world).await;
+    assert_eq!(std::fs::read_to_string(world.root.join("config")).unwrap(), "{\"operator\":true}");
+    host.stop().await;
+}
+
 #[tokio::test]
 async fn routes_replies_publishes_and_reports_undeliverable() {
     let world = create_world("routing");
@@ -506,6 +583,50 @@ async fn rolls_back_a_crash_loop_to_the_previous_version_without_restoring_data(
     host.stop().await;
 }
 
+#[tokio::test]
+async fn upgrade_and_rollback_keep_a_stopped_actor_stopped() {
+    let world = create_world("upgrade-stopped");
+    let wasm = toolbox_wasm().clone();
+    let (host, mut mailbox) = start(&world).await;
+    let source = passing_source(&world, "source");
+    spawn_type(&host, &mut mailbox, "sleeper", &wasm, &source).await;
+    let stopped = request(&host, &mut mailbox, json!({"type": "stop", "actor": "sleeper"})).await;
+    assert_eq!(stopped.body["type"], "stopped");
+
+    let upgraded = upgrade_actor(&host, &mut mailbox, "sleeper", &wasm, &source).await;
+    assert_eq!(upgraded.body["type"], "upgraded", "{upgraded:?}");
+    assert_eq!(upgraded.body["version"], 2);
+    assert_eq!(upgraded.body["running"], false);
+    let meta = world.read_meta("sleeper");
+    assert_eq!((meta.version, meta.running), (Some(2), false));
+
+    // Mail waits in the mailbox: the stopped actor reads nothing.
+    let waiting = host.broker.send("console", Some("sleeper"), None, None, json!({"type": "version"}));
+    assert!(
+        tokio::time::timeout(Duration::from_millis(500), receive_reply(&mut mailbox, &waiting, Duration::from_secs(10)))
+            .await
+            .is_err(),
+        "a stopped actor must not answer"
+    );
+
+    let rolled_back = request(&host, &mut mailbox, json!({"type": "rollback", "actor": "sleeper", "version": 1})).await;
+    assert_eq!(rolled_back.body["type"], "rolled_back", "{rolled_back:?}");
+    assert_eq!(rolled_back.body["running"], false);
+    assert!(!world.read_meta("sleeper").running);
+
+    // `start` runs the installed version and delivers the waiting message.
+    let started = request(&host, &mut mailbox, json!({"type": "start", "actor": "sleeper"})).await;
+    assert_eq!(started.body["type"], "started");
+    let answer = receive_reply(&mut mailbox, &waiting, Duration::from_secs(10)).await;
+    assert_eq!(answer.body["version"], "1");
+
+    // A running actor still restarts on the new version.
+    let running = upgrade_actor(&host, &mut mailbox, "sleeper", &wasm, &source).await;
+    assert_eq!(running.body["running"], true);
+    assert_eq!(ask(&host, &mut mailbox, "sleeper", json!({"type": "version"})).await.body["version"], "3");
+    host.stop().await;
+}
+
 #[tokio::test]
 async fn explicit_rollback_keeps_current_data() {
     let world = create_world("explicit-rollback");
@@ -619,9 +740,10 @@ async fn unknown_broker_request_lists_the_known_ones() {
 }
 
 #[tokio::test]
-async fn cargo_actor_builds_valid_crates_and_reports_compiler_errors() {
+async fn cargo_actor_runs_unit_tests_by_default_and_can_skip_them() {
     let world = create_world("cargo-actor");
     let (host, mut mailbox) = start(&world).await;
+
     let valid_source = cargo_source("cargo-valid");
     let valid_id = host.broker.send(
         "console",
@@ -630,12 +752,42 @@ async fn cargo_actor_builds_valid_crates_and_reports_compiler_errors() {
         None,
         json!({"type": "build", "source": valid_source.display().to_string()}),
     );
-    let built = receive_reply(&mut mailbox, &valid_id, Duration::from_secs(120)).await;
-    assert_eq!(built.body["type"], "built");
+    let built = receive_reply(&mut mailbox, &valid_id, Duration::from_secs(180)).await;
+    assert_eq!(built.body["type"], "built", "{built:?}");
+    assert_eq!(built.body["tests"]["passed"], 1);
+    assert_eq!(built.body["tests"]["failed"], 0);
+    assert!(built.body["tests"]["output"].as_str().unwrap().contains("unit_tests_run_on_the_host_target"));
     let wasm = built.body["wasm"].as_str().unwrap();
     assert!(wasm.ends_with(".wasm"));
     assert!(host.world.resolve("console", wasm).unwrap().is_file());
 
+    let failing_test_source = cargo_source("cargo-test-fail");
+    let failed_test_id = host.broker.send(
+        "console",
+        Some("cargo"),
+        None,
+        None,
+        json!({"type": "build", "source": failing_test_source.display().to_string()}),
+    );
+    let failed_test = receive_reply(&mut mailbox, &failed_test_id, Duration::from_secs(120)).await;
+    assert_eq!(failed_test.body["type"], "build_failed", "{failed_test:?}");
+    assert_eq!(failed_test.body["tests"]["passed"], 0);
+    assert_eq!(failed_test.body["tests"]["failed"], 1);
+    assert!(failed_test.body["tests"]["output"].as_str().unwrap().contains("deliberate_unit_test_failure"));
+
+    let skipped_id = host.broker.send(
+        "console",
+        Some("cargo"),
+        None,
+        None,
+        json!({"type": "build", "source": failing_test_source.display().to_string(), "skip_tests": true}),
+    );
+    let skipped = receive_reply(&mut mailbox, &skipped_id, Duration::from_secs(120)).await;
+    assert_eq!(skipped.body["type"], "built", "{skipped:?}");
+    assert_eq!(skipped.body["tests"]["passed"], 0);
+    assert_eq!(skipped.body["tests"]["failed"], 0);
+    assert_eq!(skipped.body["tests"]["output"], "skipped (skip_tests=true)");
+
     let invalid_source = cargo_source("cargo-fail");
     let invalid_id = host.broker.send(
         "console",
@@ -644,14 +796,10 @@ async fn cargo_actor_builds_valid_crates_and_reports_compiler_errors() {
         None,
         json!({"type": "build", "source": invalid_source.display().to_string()}),
     );
-    let failed = receive_reply(&mut mailbox, &invalid_id, Duration::from_secs(120)).await;
-    assert_eq!(failed.body["type"], "build_failed");
-    assert!(
-        failed.body["errors"]
-            .as_str()
-            .unwrap()
-            .contains("missing_function")
-    );
+    let invalid = receive_reply(&mut mailbox, &invalid_id, Duration::from_secs(120)).await;
+    assert_eq!(invalid.body["type"], "build_failed", "{invalid:?}");
+    assert_eq!(invalid.body["tests"]["failed"], 1);
+    assert!(invalid.body["tests"]["output"].as_str().unwrap().contains("missing_function"));
 
     host.stop().await;
 }

flake.lock

@@ -1,5 +1,20 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1791754810,
+        "narHash": "sha256-cN0Mgk+sQtCJcGWs9H4M0CnLRAuC4I8aCwiBTcBJs6E=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "bd63bf1d0a0f6dcacd7549c714a671ee63b0db6a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -36,6 +51,7 @@
     },
     "root": {
       "inputs": {
+        "crane": "crane",
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs",
         "rust-overlay": "rust-overlay"

flake.nix

@@ -6,9 +6,10 @@
     flake-utils.url = "github:numtide/flake-utils";
     rust-overlay.url = "github:oxalica/rust-overlay";
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+    crane.url = "github:ipetkov/crane";
   };
 
-  outputs = { nixpkgs, flake-utils, rust-overlay, ... }:
+  outputs = { nixpkgs, flake-utils, rust-overlay, crane, ... }:
     flake-utils.lib.eachSystem flake-utils.lib.allSystems (system:
       let
         pkgs = import nixpkgs {
@@ -20,21 +21,39 @@
           targets = [ "wasm32-wasip2" ];
           extensions = [ "rust-src" ];
         };
-        rustPlatform = pkgs.makeRustPlatform { cargo = rust; rustc = rust; };
-        sausage = rustPlatform.buildRustPackage {
+        # The runtime cargo actor needs Cargo, rustc (with wasm32-wasip2), and
+        # the native linker, even when the host itself is started with a bare
+        # PATH. Keep this same runtime path in the packaged host and exercise
+        # the installed binary below with PATH deliberately empty.
+        runtimePath = pkgs.lib.makeBinPath [ rust pkgs.stdenv.cc ];
+        craneLib = (crane.mkLib pkgs).overrideToolchain rust;
+        common = {
           pname = "sausage";
           version = "0.1.0";
           src = ./.;
-          cargoLock.lockFile = ./Cargo.lock;
-          cargoBuildFlags = [ "-p" "sausage" ];
+        };
+        # The test packages for `checks.tests`.
+        testPackages = "-p sausage -p sausage-actor -p agent";
+        cargoArtifacts = craneLib.buildDepsOnly (common // {
+          doCheck = false;
+          # The dependencies of the host binary and of the tests.
+          buildPhaseCargoCommand = ''
+            cargoWithProfile build --locked -p sausage
+            cargoWithProfile test --locked --no-run ${testPackages}
+          '';
+        });
+        sausage = craneLib.buildPackage (common // {
+          inherit cargoArtifacts;
+          doNotRemoveReferencesToRustToolchain = true;
+          cargoExtraArgs = "--locked -p sausage";
           doCheck = false;
           nativeBuildInputs = [ pkgs.makeWrapper ];
           # The `cargo` actor runs cargo at runtime. Build scripts need a C linker.
           postInstall = ''
-            wrapProgram $out/bin/sausage --prefix PATH : ${pkgs.lib.makeBinPath [ rust pkgs.stdenv.cc ]}
+            wrapProgram $out/bin/sausage --prefix PATH : ${runtimePath}
           '';
           meta.mainProgram = "sausage";
-        };
+        });
         # `nix run .#loop -- <world>` runs the newest `sausage run <world>`
         # (without a folder: bare `sausage`, i.e. ./world, created if needed)
         # from the public repo, again and again: after a crash or a broker
@@ -62,15 +81,82 @@
         # `nix flake check` runs every test of the host, the SDK, and the
         # agent. The tests build WASM actors with cargo, offline, from the
         # vendored crates of Cargo.lock.
-        checks.tests = sausage.overrideAttrs (old: {
-          pname = "sausage-tests";
-          doCheck = true;
-          cargoTestFlags = [ "-p" "sausage" "-p" "sausage-actor" "-p" "agent" ];
+        # The binary the host loop runs (`nix run`), built from the same
+        # cached dependencies as the tests.
+        checks.package = sausage;
+        checks.tests = craneLib.cargoTest (common // {
+          inherit cargoArtifacts;
+          cargoExtraArgs = "--locked ${testPackages}";
+          # Nothing builds on the test run's target folder: don't store it.
+          doInstallCargoArtifacts = false;
           preCheck = ''
             # Its own lock file pins crates that the vendored set may lack.
             rm -f cli/tests/actors/toolbox/Cargo.lock
           '';
         });
+        # Exercise the installed host exactly as the loop launches it: the
+        # caller has no Cargo on PATH, so only the packaged runtime toolchain
+        # can run the native tests and the wasm32-wasip2 build.
+        checks.runtime-toolchain = pkgs.runCommand "sausage-runtime-toolchain" { } ''
+          set -eu
+          root="$TMPDIR/runtime-toolchain"
+          world="$root/world"
+          emptyPath="$root/empty-bin"
+          mkdir -p "$emptyPath" "$root/home" "$root/cargo-home"
+          for actor in broker console cargo fs; do
+            mkdir -p "$world/actor/$actor/public" "$world/actor/$actor/data"
+          done
+          source="$world/actor/console/public/probe"
+          mkdir -p "$source/src" "$source/tests"
+          cat > "$source/Cargo.toml" <<'TOML'
+          [package]
+          name = "runtime-probe"
+          version = "0.1.0"
+          edition = "2024"
+          TOML
+          printf 'fn main() {}\n' > "$source/src/main.rs"
+          cat > "$source/tests/probe.rs" <<'RUST'
+          #[test]
+          fn native_test_harness_runs() {
+              assert_eq!(2 + 2, 4);
+          }
+          RUST
+          echo "runtime-check: run packaged host with an empty PATH"
+          coproc host {
+            ${pkgs.coreutils}/bin/env -i PATH="$emptyPath" HOME="$root/home" TMPDIR="$root" \
+              CARGO_HOME="$root/cargo-home" ${sausage}/bin/sausage run "$world"
+          }
+          hostInput=''${host[1]}
+          hostOutput=''${host[0]}
+          hostPid=$host_PID
+          trap 'kill "$hostPid" 2>/dev/null || true' EXIT
+          printf '%s\n' '@cargo {"type":"build","source":"/actor/console/public/probe"}' >&"$hostInput"
+          built=0
+          while IFS= read -r -t 300 line <&"$hostOutput"; do
+            echo "$line"
+            case "$line" in
+              *'"type":"build_failed"'*)
+                echo "packaged cargo actor build failed with an empty caller PATH" >&2
+                exit 1
+                ;;
+              *'"type":"built"'*)
+                case "$line" in
+                  *'"passed":1'*) built=1 ;;
+                  *) echo "native test did not pass" >&2; exit 1 ;;
+                esac
+                break
+                ;;
+            esac
+          done
+          if [ "$built" -ne 1 ]; then
+            echo "packaged host did not build the probe" >&2
+            exit 1
+          fi
+          printf '%s\n' '/quit' >&"$hostInput"
+          wait "$hostPid"
+          mkdir -p "$out"
+          touch "$out/passed"
+        '';
 
         apps.default = { type = "app"; program = "${sausage}/bin/sausage"; };
         apps.loop = { type = "app"; program = "${loop}/bin/sausage-loop"; };