diff --git a/.changeset/afraid-birds-bow.md b/.changeset/afraid-birds-bow.md
new file mode 100644
index 00000000..97e76eff
--- /dev/null
+++ b/.changeset/afraid-birds-bow.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+`cartesi build` and `cartesi run` now default to SDK 0.12.0-alpha.45, which carries rollups-node 2.0.0-alpha.14 with Dave 3.0.0-alpha.6 and cartesi-machine 0.22. The node's database migration was edited in place, so a database created by an earlier node can't be reused. `cartesi run` recreates its own on every start, and a node you run yourself needs a fresh one.
diff --git a/.changeset/few-carrots-count.md b/.changeset/few-carrots-count.md
new file mode 100644
index 00000000..29697167
--- /dev/null
+++ b/.changeset/few-carrots-count.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": patch
+---
+
+`cartesi run --default-block` no longer accepts `pending`, which the rollups-node no longer supports. Use `latest`, `safe` or `finalized`.
diff --git a/.changeset/fiery-flies-tickle.md b/.changeset/fiery-flies-tickle.md
new file mode 100644
index 00000000..466116aa
--- /dev/null
+++ b/.changeset/fiery-flies-tickle.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": patch
+---
+
+Bump the rollups-explorer service to 2.0.0-alpha.6, which supports rollups-node 2.0.0-alpha.14.
diff --git a/.changeset/hot-rings-decide.md b/.changeset/hot-rings-decide.md
new file mode 100644
index 00000000..3f15cf29
--- /dev/null
+++ b/.changeset/hot-rings-decide.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": patch
+---
+
+`cartesi run`'s Build and redeploy no longer fails with "CARTESI_CONTRACTS_APPLICATION_FACTORY_ADDRESS: variable not defined". The CLI now passes the devnet's ApplicationFactory address to the node, which `CARTESI_CONTRACTS_APPLICATION_FACTORY_ADDRESS` can still override.
diff --git a/.changeset/lazy-cougars-add.md b/.changeset/lazy-cougars-add.md
new file mode 100644
index 00000000..ce1c8bd4
--- /dev/null
+++ b/.changeset/lazy-cougars-add.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+`cartesi run --prt` now runs a sling node for each `[prt.nodes.<label>]` entry with `type = "sling"`, as container `prt-node-<label>`, so claims the sentries agree with are accepted without waiting out `--claim-staging-period`. Pool accounts (devnet 20 to 29) are funded with 10,000 ETH by the CLI. An entry with `private_key_file` runs on your own key, whose address becomes the entry's, and you fund it. The nodes are stopped before a rebuild and started again for the redeployed application.
diff --git a/.changeset/many-trams-stop.md b/.changeset/many-trams-stop.md
new file mode 100644
index 00000000..e6a2b963
--- /dev/null
+++ b/.changeset/many-trams-stop.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+The rollups-node has its own `[prt.nodes.<label>]` entry, `type = "reference"`, implied when omitted. `claim = false` on it runs the node in reader mode, following the tournaments and recording settled epochs while sling nodes claim, as production deployments may do. Changing it takes effect on the next `cartesi run`, not on a shell rebuild.
diff --git a/.changeset/mighty-otters-know.md b/.changeset/mighty-otters-know.md
new file mode 100644
index 00000000..11b2a21f
--- /dev/null
+++ b/.changeset/mighty-otters-know.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+`cartesi send` and `cartesi deposit` now default to devnet account 8 instead of account 0, which the node uses to sign its claims. Pass `--from` to pick another account.
diff --git a/.changeset/pretty-lilies-taste.md b/.changeset/pretty-lilies-taste.md
new file mode 100644
index 00000000..6d3b8f0b
--- /dev/null
+++ b/.changeset/pretty-lilies-taste.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+`cartesi logs` and the shell's View logs now show the PRT nodes next to the rollups-node. Name services to pick some, e.g. `cartesi logs prt-node-green`.
diff --git a/.changeset/quick-dancers-pick.md b/.changeset/quick-dancers-pick.md
new file mode 100644
index 00000000..b341b37b
--- /dev/null
+++ b/.changeset/quick-dancers-pick.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": patch
+---
+
+`CARTESI_*_FILE` key files set on the host now reach the node container as copies the node can read. Before, only the path was forwarded and the node couldn't read the file.
diff --git a/.changeset/seven-moments-prove.md b/.changeset/seven-moments-prove.md
new file mode 100644
index 00000000..3afe7349
--- /dev/null
+++ b/.changeset/seven-moments-prove.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+Require cartesi-machine 0.22. Machines stored by 0.21 can't be loaded by 0.22: rebuild and redeploy every application.
diff --git a/.changeset/stale-clubs-end.md b/.changeset/stale-clubs-end.md
new file mode 100644
index 00000000..a76fe6d5
--- /dev/null
+++ b/.changeset/stale-clubs-end.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+`cartesi run` now rejects a `CARTESI_BLOCKCHAIN_HTTP_ENDPOINT` the rollups-node can't use before starting anything. It must be an http(s) URL with a DNS name or IP address. The error doesn't show the value, which may hold credentials.
diff --git a/.changeset/strict-grapes-do.md b/.changeset/strict-grapes-do.md
new file mode 100644
index 00000000..720d1276
--- /dev/null
+++ b/.changeset/strict-grapes-do.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": patch
+---
+
+Use the Dave 3.0.0-alpha.6 PRT contracts. Every PRT address moves, including the devnet DaveAppFactory. The rollups contract addresses are unchanged.
diff --git a/.changeset/swift-berries-tie.md b/.changeset/swift-berries-tie.md
new file mode 100644
index 00000000..69793080
--- /dev/null
+++ b/.changeset/swift-berries-tie.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": patch
+---
+
+Keep `$` in the `CARTESI_*` variables `cartesi run` forwards to the node and in its `--fork-url`. Docker Compose read `$name` in them as a variable, so a value such as a password or an API key in a URL arrived changed.
diff --git a/.changeset/witty-crews-repeat.md b/.changeset/witty-crews-repeat.md
new file mode 100644
index 00000000..401366f9
--- /dev/null
+++ b/.changeset/witty-crews-repeat.md
@@ -0,0 +1,5 @@
+---
+"@cartesi/cli": minor
+---
+
+`cartesi run --prt` now deploys the application with the PRT sentries set in `cartesi.toml`. A `[prt]` section names an optional `sentry_manager` and one `[prt.nodes.<label>]` table per node, with `sentry = true` on the ones to appoint. The sentries are appointed on the consensus in file order. An entry with `type = "sling"` and no `address` gets one of the CLI's PRT pool, devnet accounts 20 to 29. An entry with only an `address` is appointed and run elsewhere. Without `--prt` the section is ignored.
diff --git a/apps/cli/package.json b/apps/cli/package.json
index 9933cca3..a5c3acb2 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -14,7 +14,7 @@
         "/dist"
     ],
     "devDependencies": {
-        "@cartesi/wagmi-plugin": "1.0.0-alpha.7",
+        "@cartesi/wagmi-plugin": "1.0.0-alpha.9",
         "@commander-js/extra-typings": "^15.0.0",
         "@inquirer/confirm": "^6.3.3",
         "@inquirer/core": "^12.0.4",
diff --git a/apps/cli/src/commands/deposit.ts b/apps/cli/src/commands/deposit.ts
index 64d31e1a..e502960d 100644
--- a/apps/cli/src/commands/deposit.ts
+++ b/apps/cli/src/commands/deposit.ts
@@ -12,7 +12,10 @@ export const createDepositCommand = () => {
     const command = new Command("deposit")
         .description("Deposits an asset to the application")
         .configureHelp({ showGlobalOptions: true })
-        .option("--from <address>", "input sender address")
+        .option(
+            "--from <address>",
+            "input sender address (default: devnet account 8)",
+        )
         .option("--application <address>", "application address")
         .option(
             "--project-name <string>",
diff --git a/apps/cli/src/commands/deposit/erc1155.ts b/apps/cli/src/commands/deposit/erc1155.ts
index a57287bb..b40ba366 100644
--- a/apps/cli/src/commands/deposit/erc1155.ts
+++ b/apps/cli/src/commands/deposit/erc1155.ts
@@ -17,7 +17,7 @@ import {
     bigintInput,
     getInputApplicationAddress,
 } from "../../prompts.js";
-import { connect } from "../../wallet.js";
+import { connect, getDefaultSender } from "../../wallet.js";
 import type { DepositCommandOpts } from "../deposit.js";
 
 type ERC1155Token = {
@@ -75,7 +75,7 @@ export const createErc1155SingleCommand = () => {
             const account =
                 from && isAddress(from)
                     ? getAddress(from)
-                    : (await testClient.getAddresses())[0];
+                    : await getDefaultSender(testClient);
 
             const amount = amountString
                 ? BigInt(amountString)
@@ -253,7 +253,7 @@ export const createErc1155BatchCommand = () => {
             const account =
                 from && isAddress(from)
                     ? getAddress(from)
-                    : (await testClient.getAddresses())[0];
+                    : await getDefaultSender(testClient);
 
             const tokenAbi = testMultiTokenAbi;
 
diff --git a/apps/cli/src/commands/deposit/erc20.ts b/apps/cli/src/commands/deposit/erc20.ts
index 70b775ed..8ba8f3e1 100755
--- a/apps/cli/src/commands/deposit/erc20.ts
+++ b/apps/cli/src/commands/deposit/erc20.ts
@@ -22,7 +22,7 @@ import {
     bigintInput,
     getInputApplicationAddress,
 } from "../../prompts.js";
-import { connect } from "../../wallet.js";
+import { connect, getDefaultSender } from "../../wallet.js";
 import type { DepositCommandOpts } from "../deposit.js";
 
 type ERC20Token = {
@@ -93,7 +93,7 @@ export const createErc20Command = () => {
             const account =
                 from && isAddress(from)
                     ? getAddress(from)
-                    : (await testClient.getAddresses())[0];
+                    : await getDefaultSender(testClient);
 
             const token = await parseToken({
                 testClient,
diff --git a/apps/cli/src/commands/deposit/erc721.ts b/apps/cli/src/commands/deposit/erc721.ts
index 896c51e7..4aaaf7e0 100755
--- a/apps/cli/src/commands/deposit/erc721.ts
+++ b/apps/cli/src/commands/deposit/erc721.ts
@@ -23,7 +23,7 @@ import {
     bigintInput,
     getInputApplicationAddress,
 } from "../../prompts.js";
-import { connect } from "../../wallet.js";
+import { connect, getDefaultSender } from "../../wallet.js";
 import type { DepositCommandOpts } from "../deposit.js";
 
 type ERC721Token = {
@@ -93,7 +93,7 @@ export const createErc721Command = () => {
             const account =
                 from && isAddress(from)
                     ? getAddress(from)
-                    : (await testClient.getAddresses())[0];
+                    : await getDefaultSender(testClient);
 
             const token = await parseToken({
                 testClient,
diff --git a/apps/cli/src/commands/deposit/ether.ts b/apps/cli/src/commands/deposit/ether.ts
index 2b0bf6c7..ad23054d 100755
--- a/apps/cli/src/commands/deposit/ether.ts
+++ b/apps/cli/src/commands/deposit/ether.ts
@@ -5,7 +5,7 @@ import { formatUnits, getAddress, isAddress, isHex, parseUnits } from "viem";
 import { getProjectName } from "../../base.js";
 import { etherPortalAbi, etherPortalAddress } from "../../contracts.js";
 import { bigintInput, getInputApplicationAddress } from "../../prompts.js";
-import { connect } from "../../wallet.js";
+import { connect, getDefaultSender } from "../../wallet.js";
 import type { DepositCommandOpts } from "../deposit.js";
 
 export const createEtherCommand = () => {
@@ -26,7 +26,7 @@ export const createEtherCommand = () => {
             const account =
                 from && isAddress(from)
                     ? getAddress(from)
-                    : (await testClient.getAddresses())[0];
+                    : await getDefaultSender(testClient);
 
             // get dapp address from local node, or ask
             const application = await getInputApplicationAddress({
diff --git a/apps/cli/src/commands/logs.ts b/apps/cli/src/commands/logs.ts
index b103da1c..0bb98c39 100644
--- a/apps/cli/src/commands/logs.ts
+++ b/apps/cli/src/commands/logs.ts
@@ -1,10 +1,89 @@
 import { Command } from "@commander-js/extra-typings";
 import { execa } from "execa";
-import { getProjectName, getServiceInfo } from "../base.js";
+import { getProjectName } from "../base.js";
+import { isPrtNodeService } from "../compose/prt-node.js";
+
+/** The node's compose service, shown by default and first. */
+export const NODE_SERVICE = "rollups_node";
+
+/**
+ * The services of a running environment, as compose lists them; an exited
+ * container is still listed, so its last logs can be read.
+ */
+export const listServices = async (projectName: string): Promise<string[]> => {
+    const { stdout } = await execa("docker", [
+        "compose",
+        "--project-name",
+        projectName,
+        "ps",
+        "--services",
+        "--all",
+    ]);
+    return stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+};
+
+/**
+ * The services to show: the ones named, checked against the environment, or
+ * the node followed by every PRT node.
+ * @param services the environment's services, from `listServices`
+ * @param requested the services named on the command line
+ * @throws when the node isn't there, or a named service isn't
+ */
+export const selectLogServices = (
+    services: string[],
+    requested: string[],
+): string[] => {
+    if (requested.length === 0) {
+        if (!services.includes(NODE_SERVICE)) {
+            throw new Error(`service ${NODE_SERVICE} not found`);
+        }
+        return [NODE_SERVICE, ...services.filter(isPrtNodeService)];
+    }
+    // compose shows nothing for an unknown service, without an error
+    const unknown = requested.filter((service) => !services.includes(service));
+    if (unknown.length > 0) {
+        throw new Error(
+            `service ${unknown.join(", ")} not found; the environment has ${services.join(", ")}`,
+        );
+    }
+    return requested;
+};
+
+/**
+ * The `docker compose logs` arguments. One service is shown as it is, like
+ * `docker container logs`; more than one get compose's per-service prefix,
+ * which tells the node's lines from the PRT nodes'.
+ */
+export const buildLogsArgs = (options: {
+    follow?: boolean;
+    projectName: string;
+    services: string[];
+    since?: string;
+    tail?: string;
+    until?: string;
+}): string[] => {
+    const { follow, projectName, services, since, tail, until } = options;
+    const args = ["compose", "--project-name", projectName, "logs"];
+    if (follow) args.push("--follow");
+    if (since) args.push("--since", since);
+    if (tail) args.push("--tail", tail);
+    if (until) args.push("--until", until);
+    if (services.length === 1) args.push("--no-log-prefix");
+    return [...args, ...services];
+};
 
 export const createLogsCommand = () => {
     return new Command("logs")
-        .description("Show logs of a local environment.")
+        .description(
+            "Show logs of a local environment: the node and its PRT nodes, or the services named.",
+        )
+        .argument(
+            "[service...]",
+            "services to show, as cartesi run names them (default: the node and the PRT nodes)",
+        )
         .option(
             "--project-name <string>",
             "name of project (used by docker compose and cartesi-rollups-node)",
@@ -24,26 +103,24 @@ export const createLogsCommand = () => {
             "Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)",
         )
         .configureHelp({ showGlobalOptions: true })
-        .action(async (options) => {
+        .action(async (requested, options) => {
             const { follow, since, tail, until } = options;
             const projectName = getProjectName(options);
-            const logOptions: string[] = [];
-            if (follow) logOptions.push("--follow");
-            if (since) logOptions.push("--since", since);
-            if (tail) logOptions.push("--tail", tail);
-            if (until) logOptions.push("--until", until);
-
-            const serviceInfo = await getServiceInfo({
-                projectName,
-                service: "rollups_node",
-            });
-            if (!serviceInfo) {
-                throw new Error(`service rollups_node not found`);
-            }
+            const services = selectLogServices(
+                await listServices(projectName),
+                requested,
+            );
 
             await execa(
                 "docker",
-                ["container", "logs", ...logOptions, serviceInfo.ID],
+                buildLogsArgs({
+                    follow,
+                    projectName,
+                    services,
+                    since,
+                    tail,
+                    until,
+                }),
                 { stdio: "inherit" },
             );
         });
diff --git a/apps/cli/src/commands/run.ts b/apps/cli/src/commands/run.ts
index 7afa2e86..c98ff183 100755
--- a/apps/cli/src/commands/run.ts
+++ b/apps/cli/src/commands/run.ts
@@ -18,11 +18,15 @@ import {
 } from "viem";
 import {
     getApplicationConfig,
+    getCartesiEnvironmentVariables,
     getContextPath,
     getMachineHash,
     getProjectName,
 } from "../base.js";
-import { nodeAllowedEnvironmentVariables } from "../compose/node.js";
+import {
+    nodeAllowedEnvironmentVariables,
+    nodePrtAuthVariables,
+} from "../compose/node.js";
 import {
     DEFAULT_SDK_VERSION,
     PREFERRED_PORT,
@@ -31,19 +35,33 @@ import {
 import {
     AVAILABLE_SERVICES,
     deployApplication,
+    type EnvironmentOptions,
     host,
     removeApplication,
     getDeployments,
     type RollupsDeployment,
     startEnvironment,
+    startPrtNodes,
     stopEnvironment,
+    stopPrtNodes,
     TERMINAL_APPLICATION_STATUSES,
     waitHealthyEnvironment,
 } from "../exec/rollups.js";
 import { keySelect } from "../prompts.js";
+import {
+    checkPrtNodes,
+    describePrtNode,
+    describeReference,
+    readerModeChanged,
+    type ResolvedPrt,
+    resolvePrtNodes,
+    runnableNodes,
+    sentriesOf,
+} from "../prt.js";
 import type { ForkConfig } from "../types/chain.js";
 import { assertForkConfig } from "../validations.js";
-import { getWithdrawalConfig } from "../withdrawal.js";
+import { connect } from "../wallet.js";
+import { DEVNET_GUARDIAN, getWithdrawalConfig } from "../withdrawal.js";
 
 const commaSeparatedList = (value: string) => value.split(",");
 
@@ -81,28 +99,37 @@ const reportApplicationStatus = (deployment: RollupsDeployment) => {
 const shell = async (options: {
     build?: CommandUnknownOpts;
     deployment?: RollupsDeployment;
+    environment: EnvironmentOptions;
     epochLength: number;
     log?: CommandUnknownOpts;
     projectName: string;
     prt?: boolean;
     salt: number;
     sdk: string;
+    /** the PRT node services running for the deployment */
+    prtServices: string[];
+    /** the [prt] setup the environment started with */
+    prtConfig?: ResolvedPrt;
     resolveWithdrawalConfig: () => WithdrawalConfig | undefined;
+    resolvePrt: () => ResolvedPrt | undefined;
     claimStagingPeriod: number;
 }) => {
     const {
         build,
+        environment,
         epochLength,
         log,
         projectName,
         prt,
         sdk,
         resolveWithdrawalConfig,
+        resolvePrt,
         claimStagingPeriod,
     } = options;
 
     let lastDeployment = options.deployment;
     let salt = options.salt;
+    let prtServices = options.prtServices;
     let lastStatus = lastDeployment?.status;
     let pendingReport: RollupsDeployment | undefined;
 
@@ -175,6 +202,14 @@ const shell = async (options: {
                     break;
                 }
                 case "b": {
+                    // the PRT nodes read the machine the build replaces, and
+                    // claim for the application the redeploy removes
+                    await stopPrtNodes({
+                        projectName,
+                        services: prtServices,
+                    });
+                    prtServices = [];
+
                     // build
                     await build?.parseAsync([], { from: "user" });
 
@@ -184,6 +219,21 @@ const shell = async (options: {
                         // the accounts drive may have moved with the rebuild,
                         // resolved before undeploying in case it is now invalid
                         const withdrawalConfig = resolveWithdrawalConfig();
+                        // a PRT redeploy creates a new consensus, with the
+                        // sentries as they are in the config now. The node's
+                        // mode can't change: it is fixed in its database
+                        const resolved = resolvePrt();
+                        const moved = readerModeChanged(
+                            options.prtConfig,
+                            resolved,
+                        );
+                        if (moved !== undefined) {
+                            console.warn(chalk.yellow(`WARNING: ${moved}`));
+                        }
+                        const prtConfig =
+                            moved === undefined ? resolved : options.prtConfig;
+                        reportPrtWarnings(prtConfig, claimStagingPeriod);
+                        await fundPrtNodes({ environment, prtConfig });
                         if (lastDeployment) {
                             await undeploy({ projectName });
                         }
@@ -193,12 +243,18 @@ const shell = async (options: {
                             hash,
                             projectName,
                             prt,
+                            prtConfig,
                             salt: numberToHex(salt++, { size: 32 }),
                             withdrawalConfig,
                             claimStagingPeriod,
                         });
                         lastStatus = lastDeployment?.status;
                         pendingReport = undefined;
+                        prtServices = await runPrtNodes({
+                            application: lastDeployment.address,
+                            environment,
+                            prtConfig,
+                        });
                     }
 
                     break;
@@ -234,12 +290,118 @@ const undeploy = async (options: { projectName: string }) => {
     progress.succeed(`${chalk.cyan(projectName)} undeployed`);
 };
 
+/**
+ * Warn about [prt] settings that are valid but have no effect.
+ */
+const reportPrtWarnings = (
+    prtConfig: ResolvedPrt | undefined,
+    claimStagingPeriod: number,
+) => {
+    for (const warning of prtConfig?.warnings ?? []) {
+        console.warn(chalk.yellow(`WARNING: ${warning}`));
+    }
+    if (
+        prtConfig &&
+        sentriesOf(prtConfig).length > 0 &&
+        claimStagingPeriod === 0
+    ) {
+        console.warn(
+            chalk.yellow(
+                "WARNING: with --claim-staging-period 0 a staged claim is accepted at once, so the sentries have no effect",
+            ),
+        );
+    }
+};
+
+/**
+ * Funds the pool accounts and checks the other PRT nodes have ETH, once anvil
+ * is up and before the deploy they claim for.
+ */
+const fundPrtNodes = async (options: {
+    environment: EnvironmentOptions;
+    prtConfig?: ResolvedPrt;
+}) => {
+    const { environment, prtConfig } = options;
+    if (!prtConfig || runnableNodes(prtConfig).length === 0) {
+        return;
+    }
+    const client = await connect({
+        rpcUrl: `${host}:${environment.port}/anvil`,
+    });
+    await checkPrtNodes(client, prtConfig);
+};
+
+/**
+ * Starts the PRT nodes the CLI runs, for the deployed application, then prints
+ * the rollups-node's line, the manager and every [prt.nodes] entry in file
+ * order: a check for each one running, a note for each one appointed only.
+ * @returns the services started
+ */
+const runPrtNodes = async (options: {
+    application: Address;
+    environment: EnvironmentOptions;
+    prtConfig?: ResolvedPrt;
+}): Promise<string[]> => {
+    const { application, environment, prtConfig } = options;
+    if (
+        !prtConfig ||
+        (prtConfig.nodes.length === 0 &&
+            prtConfig.reference.label === undefined)
+    ) {
+        return [];
+    }
+
+    const nodes = runnableNodes(prtConfig);
+    const progress = ora();
+    let services: string[] = [];
+    if (nodes.length > 0) {
+        progress.start(
+            `starting ${nodes.length === 1 ? "the PRT node" : `${nodes.length} PRT nodes`}...`,
+        );
+        try {
+            services = await startPrtNodes({
+                ...environment,
+                application,
+                imageTag: environment.runtimeVersion,
+                nodes: prtConfig.nodes,
+            });
+            progress.stop();
+        } catch (error: unknown) {
+            progress.fail("the PRT nodes failed to start");
+            throw error;
+        }
+    }
+
+    // log-symbols' blue info mark is hard to read on a dark terminal
+    const note = (text: string) =>
+        progress.stopAndPersist({ symbol: chalk.cyan("ℹ"), text });
+    if (prtConfig.reference.claim) {
+        note(describeReference(prtConfig));
+    } else {
+        progress.warn(describeReference(prtConfig));
+    }
+    if (prtConfig.sentryManager === undefined) {
+        progress.warn("sentry manager none (the sentries can't be rotated)");
+    } else {
+        note(`sentry manager ${prtConfig.sentryManager}`);
+    }
+    for (const node of prtConfig.nodes) {
+        if (node.type === undefined) {
+            note(describePrtNode(node));
+        } else {
+            progress.succeed(describePrtNode(node));
+        }
+    }
+    return services;
+};
+
 const deploy = async (options: {
     consensus?: Address;
     epochLength: number;
     hash: Hex;
     projectName: string;
     prt?: boolean;
+    prtConfig?: ResolvedPrt;
     salt: Hex;
     withdrawalConfig?: WithdrawalConfig;
     claimStagingPeriod: number;
@@ -250,6 +412,7 @@ const deploy = async (options: {
         hash,
         projectName,
         prt,
+        prtConfig,
         salt,
         withdrawalConfig,
         claimStagingPeriod,
@@ -267,6 +430,9 @@ const deploy = async (options: {
         projectName,
         prt,
         salt,
+        sentries:
+            prtConfig && sentriesOf(prtConfig).map(({ address }) => address),
+        sentryManager: prtConfig?.sentryManager,
         snapshotPath: "/var/lib/cartesi-rollups-node/snapshots/image",
         withdrawalConfig,
         claimStagingPeriod,
@@ -312,7 +478,7 @@ export const createRunCommand = () => {
         .addOption(
             new Option(
                 "--prt",
-                "deploy application with PRT consensus",
+                "deploy the application on a PRT consensus, with the [prt] section of cartesi.toml",
             ).default(false),
         )
         .addOption(
@@ -334,7 +500,7 @@ export const createRunCommand = () => {
                 "--default-block <string>",
                 "default block to be used when fetching new blocks.",
             )
-                .choices(["latest", "safe", "pending", "finalized"])
+                .choices(["latest", "safe", "finalized"])
                 .default("latest"),
         )
         .option("--dry-run", "show the docker compose configuration", false)
@@ -443,6 +609,44 @@ export const createRunCommand = () => {
             // get application configuration (e.g. use withdrawal config if present)
             const applicationConfig = getApplicationConfig(configFiles);
 
+            // [prt] is parsed either way, so a mistake in it fails early, but
+            // the node takes sentries only on a PRT deploy. Read again on a
+            // rebuild, like the withdrawal config.
+            const resolvePrt = () => {
+                const config = getApplicationConfig(configFiles);
+                return prt && config.prt
+                    ? resolvePrtNodes(config.prt, {
+                          guardian:
+                              config.withdrawal?.guardian ?? DEVNET_GUARDIAN,
+                      })
+                    : undefined;
+            };
+            if (applicationConfig.prt && !prt) {
+                console.log(
+                    chalk.dim("[prt] in cartesi.toml is ignored without --prt"),
+                );
+            }
+
+            // fail before starting the environment if [prt] can't be resolved
+            const prtConfig = resolvePrt();
+            reportPrtWarnings(prtConfig, claimStagingPeriod);
+
+            // in reader mode the node has no PRT signer
+            const claimSubmission = prtConfig?.reference.claim ?? true;
+            if (!claimSubmission) {
+                const hostVars = getCartesiEnvironmentVariables();
+                const prtAuth = nodePrtAuthVariables.filter(
+                    (name) => hostVars[name] !== undefined,
+                );
+                if (prtAuth.length > 0) {
+                    console.warn(
+                        chalk.yellow(
+                            `WARNING: ${prtAuth.join(", ")} ${prtAuth.length === 1 ? "is" : "are"} set, but [prt.nodes.${prtConfig?.reference.label}] has claim = false, so the rollups-node runs in reader mode with no PRT signer and the value is dropped`,
+                        ),
+                    );
+                }
+            }
+
             // resolve port number, using the first free port in a range, unless explicitly set
             const port =
                 options.port ||
@@ -477,21 +681,26 @@ export const createRunCommand = () => {
             // if TTY is not attached, run on foreground (not detached)
             const detach = process.stdin.isTTY;
 
-            // run compose environment (detached)
-            const { cmd, config } = await startEnvironment({
+            const environment: EnvironmentOptions = {
                 blockTime,
                 cpus,
                 defaultBlock,
-                detach,
-                dryRun,
                 forkConfig,
                 memory,
                 port,
                 projectName,
                 prt,
+                claimSubmission,
                 runtimeVersion,
                 services,
                 verbose,
+            };
+
+            // run compose environment (detached)
+            const { cmd, config } = await startEnvironment({
+                ...environment,
+                detach,
+                dryRun,
             });
 
             // host address
@@ -517,20 +726,28 @@ export const createRunCommand = () => {
 
             // deploy the application
             let deployment: RollupsDeployment | undefined;
+            let prtServices: string[] = [];
             let salt = 0;
             const hash = await getMachineHash({
                 sdk: applicationConfig.sdk,
             });
             if (hash) {
+                await fundPrtNodes({ environment, prtConfig });
                 deployment = await deploy({
                     epochLength,
                     hash,
                     projectName,
                     prt,
+                    prtConfig,
                     salt: numberToHex(salt++, { size: 32 }),
                     claimStagingPeriod,
                     withdrawalConfig,
                 });
+                prtServices = await runPrtNodes({
+                    application: deployment.address,
+                    environment,
+                    prtConfig,
+                });
             } else {
                 console.warn(
                     chalk.yellow(
@@ -566,14 +783,18 @@ export const createRunCommand = () => {
                 await shell({
                     build,
                     deployment,
+                    environment,
                     epochLength,
                     log,
                     projectName,
                     prt,
                     salt,
                     sdk: applicationConfig.sdk,
+                    prtServices,
+                    prtConfig,
                     claimStagingPeriod,
                     resolveWithdrawalConfig,
+                    resolvePrt,
                 });
                 await shutdown();
             } else {
diff --git a/apps/cli/src/commands/send.ts b/apps/cli/src/commands/send.ts
index 62e21ff9..debb653e 100755
--- a/apps/cli/src/commands/send.ts
+++ b/apps/cli/src/commands/send.ts
@@ -12,7 +12,7 @@ import {
 import { getProjectName } from "../base.js";
 import { inputBoxAbi, inputBoxAddress } from "../contracts.js";
 import { bytesInput, getInputApplicationAddress } from "../prompts.js";
-import { connect } from "../wallet.js";
+import { connect, getDefaultSender } from "../wallet.js";
 
 const getInput = async (
     input: string | undefined,
@@ -114,7 +114,10 @@ export const createSendCommand = () => {
     const command = new Command("send")
         .description("Send input to the application")
         .argument("[input]", "input payload")
-        .option("--from <address>", "input sender address")
+        .option(
+            "--from <address>",
+            "input sender address (default: devnet account 8)",
+        )
         .option("--application <address>", "application address")
         .addOption(
             new Option("--encoding <encoding>", "input encoding").choices([
@@ -142,7 +145,7 @@ export const createSendCommand = () => {
             const account =
                 from && isAddress(from)
                     ? getAddress(from)
-                    : (await testClient.getAddresses())[0];
+                    : await getDefaultSender(testClient);
 
             // get dapp address from local node, or ask
             const applicationAddress = await getInputApplicationAddress({
diff --git a/apps/cli/src/compose/anvil.ts b/apps/cli/src/compose/anvil.ts
index c1607fea..69688480 100644
--- a/apps/cli/src/compose/anvil.ts
+++ b/apps/cli/src/compose/anvil.ts
@@ -1,6 +1,6 @@
 import type { ForkConfig } from "../types/chain.js";
 import type { ComposeFile, Config, Service } from "../types/compose.js";
-import { DEFAULT_HEALTHCHECK } from "./common.js";
+import { DEFAULT_HEALTHCHECK, escapeComposeValue } from "./common.js";
 
 type ServiceOptions = {
     imageTag?: string;
@@ -23,7 +23,8 @@ const service = (options?: ServiceOptions): Service => {
               "--block-time",
               blockTime.toString(),
               "--fork-url",
-              forkConfig.url,
+              // the URL may hold an API key with a `$`, which compose must not interpolate
+              escapeComposeValue(forkConfig.url),
               ...(forkConfig.blockNumber !== undefined
                   ? ["--fork-block-number", forkConfig.blockNumber.toString()]
                   : []),
diff --git a/apps/cli/src/compose/common.ts b/apps/cli/src/compose/common.ts
index fe8780c2..0aef4f4b 100644
--- a/apps/cli/src/compose/common.ts
+++ b/apps/cli/src/compose/common.ts
@@ -7,3 +7,11 @@ export const DEFAULT_HEALTHCHECK: Healthcheck = {
     timeout: "1s",
     retries: 5,
 };
+
+/**
+ * Escapes a value for a compose file, which would otherwise read `$name` and
+ * `${name}` in it as variables and replace them, `$` and all.
+ * The container still gets the original value.
+ */
+export const escapeComposeValue = (value: string): string =>
+    value.replaceAll("$", () => "$$");
diff --git a/apps/cli/src/compose/node.ts b/apps/cli/src/compose/node.ts
index 4c6e45c3..4119f628 100644
--- a/apps/cli/src/compose/node.ts
+++ b/apps/cli/src/compose/node.ts
@@ -1,12 +1,14 @@
 import { anvil } from "viem/chains";
 import type { CartesiEnvironmentVariables } from "../base.js";
 import {
+    applicationFactoryAddress,
     daveAppFactoryAddress,
     inputBoxAddress,
     selfHostedApplicationFactoryAddress,
 } from "../contracts.js";
 import type { ComposeFile, Config, Service } from "../types/compose.js";
-import { DEFAULT_HEALTHCHECK } from "./common.js";
+import { DEFAULT_HEALTHCHECK, escapeComposeValue } from "./common.js";
+import { type FileSecret, fileSecret, secretInitService } from "./secrets.js";
 
 /**
  * Mnemonic of the devnet test accounts, used by the node to sign transactions
@@ -19,13 +21,19 @@ export type ServiceOptions = {
     databaseHost?: string;
     databasePort?: number;
     databasePassword: string;
-    defaultBlock?: "latest" | "safe" | "pending" | "finalized";
+    defaultBlock?: "latest" | "safe" | "finalized";
     forkChainId?: number;
     logLevel?: "info" | "debug" | "warn" | "error" | "fatal";
     memory?: number;
     mnemonic?: string;
     imageTag?: string;
     prt?: boolean;
+    /**
+     * whether the node submits claims, the default; with a sling claimer it
+     * runs in reader mode, following the tournaments and recording settled
+     * epochs with no PRT signer
+     */
+    claimSubmission?: boolean;
     cartesiEnvironmentVariables?: CartesiEnvironmentVariables;
 };
 
@@ -104,8 +112,55 @@ export const getNodeAllowedVariables = (
     return allowedVars;
 };
 
+/**
+ * The allowed variables of the node's PRT signer, which a reader-mode node
+ * has no use for.
+ */
+export const nodePrtAuthVariables = nodeAllowedEnvironmentVariables.filter(
+    (name) => name.startsWith("CARTESI_PRT_AUTH_"),
+);
+
+/**
+ * The allowed variables that name a file the node reads its keys from.
+ * Forwarding only the path would leave the node without the file, so each
+ * one is copied into the container instead.
+ */
+export const nodeSecretFileVariables = nodeAllowedEnvironmentVariables.filter(
+    (name) => name.endsWith("_FILE"),
+);
+
+const isPrtAuthVariable = (name: string) =>
+    (nodePrtAuthVariables as readonly string[]).includes(name);
+
+/** Service that copies the key files for the node, and its volume. */
+const SECRET_INIT_SERVICE = "node-secret-init";
+const SECRETS_VOLUME = "node_secrets";
+
+/**
+ * Returns the key files named in the host variables, each with the variable
+ * that points the node at its copy.
+ */
+const nodeFileSecrets = (
+    cartesiVars: CartesiEnvironmentVariables | undefined,
+    claimSubmission: boolean,
+): (FileSecret & { variable: string })[] => {
+    const allowedVars = getNodeAllowedVariables(cartesiVars);
+    return nodeSecretFileVariables.flatMap((variable) => {
+        if (!claimSubmission && isPrtAuthVariable(variable)) {
+            return [];
+        }
+        const hostPath = allowedVars[variable];
+        return hostPath === undefined
+            ? []
+            : [{ variable, ...fileSecret(variable.toLowerCase(), hostPath) }];
+    });
+};
+
 // Rollups Node service
-const service = (options: ServiceOptions): Service => {
+const service = (
+    options: ServiceOptions,
+    fileSecrets: (FileSecret & { variable: string })[],
+): Service => {
     const databasePassword = options.databasePassword;
     const databaseHost = options.databaseHost ?? "database";
     const databasePort = options.databasePort ?? 5432;
@@ -114,6 +169,7 @@ const service = (options: ServiceOptions): Service => {
     const logLevel = options.logLevel ?? "info";
     const mnemonic = options.mnemonic ?? DEVNET_MNEMONIC;
     const prt = options.prt ?? false;
+    const claimSubmission = options.claimSubmission ?? true;
     const chainId = (options.forkChainId ??
         31337) as keyof typeof daveAppFactoryAddress;
 
@@ -130,6 +186,10 @@ const service = (options: ServiceOptions): Service => {
         CARTESI_BLOCKCHAIN_DEFAULT_BLOCK: defaultBlock,
         CARTESI_BLOCKCHAIN_HTTP_ENDPOINT: "http://anvil:8545",
         CARTESI_BLOCKCHAIN_ID: anvil.id.toString(),
+        // a deploy on an existing consensus, as the shell's redeploy does,
+        // creates only the application, through this factory
+        CARTESI_CONTRACTS_APPLICATION_FACTORY_ADDRESS:
+            applicationFactoryAddress,
         ...(chainDaveAppFactoryAddress && {
             CARTESI_CONTRACTS_DAVE_APP_FACTORY_ADDRESS:
                 chainDaveAppFactoryAddress,
@@ -141,15 +201,30 @@ const service = (options: ServiceOptions): Service => {
         CARTESI_LOG_LEVEL: logLevel,
         // The node always starts its PRT service, and with claim submission
         // enabled by default that service needs its own signer. PRT has no
-        // default mnemonic, so the devnet one is supplied explicitly.
-        CARTESI_PRT_AUTH_MNEMONIC: mnemonic,
+        // default mnemonic, so the devnet one is supplied explicitly. With a
+        // sling claimer the node reads instead, and needs no PRT signer.
+        ...(claimSubmission
+            ? { CARTESI_PRT_AUTH_MNEMONIC: mnemonic }
+            : { CARTESI_FEATURE_CLAIM_SUBMISSION_ENABLED: "false" }),
         CARTESI_SNAPSHOTS_DIR: "/var/lib/cartesi-rollups-node/snapshots",
     };
 
-    const hostVars = getNodeAllowedVariables(
-        options.cartesiEnvironmentVariables,
+    // the host values are the user's own and may hold a `$`, e.g. in a
+    // password, which compose must not interpolate
+    const hostVars = Object.fromEntries(
+        Object.entries(
+            getNodeAllowedVariables(options.cartesiEnvironmentVariables),
+        )
+            // a reader-mode node has no PRT signer, so the host's is dropped
+            .filter(([name]) => claimSubmission || !isPrtAuthVariable(name))
+            .map(([name, value]) => [name, escapeComposeValue(value)]),
     );
 
+    // the key files reach the node as secrets, at a path inside the container
+    for (const { variable, target } of fileSecrets) {
+        hostVars[variable] = target;
+    }
+
     // Merge default and host environment variables, with host variables taking precedence
     // further to the right of the parameter list the higher the precedence
     // TODO: Here or somewhere else; Add other variables with precedence rules, e.g. command line > <config>.toml > host environment > default
@@ -161,6 +236,11 @@ const service = (options: ServiceOptions): Service => {
         depends_on: {
             database: { condition: "service_healthy" },
             anvil: { condition: "service_healthy" },
+            ...(fileSecrets.length > 0 && {
+                [SECRET_INIT_SERVICE]: {
+                    condition: "service_completed_successfully",
+                },
+            }),
         },
         deploy: {
             resources: {
@@ -185,7 +265,12 @@ const service = (options: ServiceOptions): Service => {
         environment: {
             ...environmentVariables,
         },
-        volumes: ["./.cartesi:/var/lib/cartesi-rollups-node/snapshots:ro"],
+        volumes: [
+            "./.cartesi:/var/lib/cartesi-rollups-node/snapshots:ro",
+            ...(fileSecrets.length > 0
+                ? [`${SECRETS_VOLUME}:/run/secrets:ro`]
+                : []),
+        ],
     };
 };
 
@@ -234,19 +319,36 @@ http:
     };
 };
 
-export default (options: ServiceOptions): ComposeFile => ({
-    services: {
-        proxy: {
-            configs: [
-                {
-                    source: "rollups_node_proxy",
-                    target: "/etc/traefik/conf.d/rollups-node.yaml",
-                },
-            ],
+export default (options: ServiceOptions): ComposeFile => {
+    const fileSecrets = nodeFileSecrets(
+        options.cartesiEnvironmentVariables,
+        options.claimSubmission ?? true,
+    );
+
+    return {
+        services: {
+            proxy: {
+                configs: [
+                    {
+                        source: "rollups_node_proxy",
+                        target: "/etc/traefik/conf.d/rollups-node.yaml",
+                    },
+                ],
+            },
+            rollups_node: service(options, fileSecrets),
+            ...(fileSecrets.length > 0 && {
+                [SECRET_INIT_SERVICE]: secretInitService({
+                    imageTag: options.imageTag ?? "latest",
+                    secrets: fileSecrets,
+                    volume: SECRETS_VOLUME,
+                }),
+            }),
+        },
+        configs: {
+            rollups_node_proxy: proxy(),
         },
-        rollups_node: service(options),
-    },
-    configs: {
-        rollups_node_proxy: proxy(),
-    },
-});
+        ...(fileSecrets.length > 0 && {
+            volumes: { [SECRETS_VOLUME]: {} },
+        }),
+    };
+};
diff --git a/apps/cli/src/compose/prt-node.ts b/apps/cli/src/compose/prt-node.ts
new file mode 100644
index 00000000..0f1516fb
--- /dev/null
+++ b/apps/cli/src/compose/prt-node.ts
@@ -0,0 +1,129 @@
+import type { Address } from "viem";
+import { anvil } from "viem/chains";
+import type { ResolvedPrtNode } from "../prt.js";
+import type { ComposeFile, Service } from "../types/compose.js";
+import { fileSecret, secretInitService } from "./secrets.js";
+
+/**
+ * The compose services of the PRT nodes the CLI runs: one sling node per
+ * [prt.nodes.<label>] entry with `type = "sling"`. They are composed after
+ * the deploy, since each one needs the application's address.
+ */
+
+export type PrtNodeServiceOptions = {
+    application: Address;
+    /** anvil's block time, which sets how often a node polls the chain */
+    blockTime: number;
+    imageTag?: string;
+    nodes: ResolvedPrtNode[];
+};
+
+/** The compose service of an entry, which its label names. */
+export const prtNodeServiceName = (label: string) => `prt-node-${label}`;
+
+/**
+ * The service that installs an entry's key file. Named outside the nodes'
+ * `prt-node-` space, since a label may hold a `-`, so no label can produce
+ * the installer's name of another node.
+ */
+const prtNodeInitServiceName = (label: string) =>
+    `secret-init-${prtNodeServiceName(label)}`;
+
+/** Whether a compose service is a PRT node the CLI runs, as `cartesi logs` lists them. */
+export const isPrtNodeService = (service: string): boolean =>
+    service.startsWith(prtNodeServiceName(""));
+
+const prtNodeSecretsVolume = (label: string) =>
+    `prt_node_${label.replaceAll("-", "_")}_secrets`;
+
+/**
+ * The directory of the runtime image its user can write to; a recreated
+ * container starts clean, for the application it is deployed for.
+ */
+const DATA_DIR = "/var/lib/cartesi-rollups-node/snapshots";
+
+/** Where the node reads the built machine, the same files the rollups-node deploys. */
+const TEMPLATE_DIR = "/var/lib/cartesi-rollups-node/template";
+
+/** The key of an entry on a devnet account, which resolution always sets. */
+const privateKeyOf = (node: ResolvedPrtNode): string => {
+    if (node.privateKey === undefined) {
+        throw new Error(
+            `${node.sentry ? "sentry" : "validator"} ${node.label} ${node.address} has no key to run with`,
+        );
+    }
+    return node.privateKey;
+};
+
+const sling = (
+    options: PrtNodeServiceOptions,
+    node: ResolvedPrtNode,
+): ComposeFile => {
+    const { application, blockTime, imageTag = "latest" } = options;
+    const { label } = node;
+    const image = `cartesi/rollups-runtime:${imageTag}`;
+    const secret =
+        node.source.kind === "key-file"
+            ? fileSecret(prtNodeServiceName(label), node.source.path)
+            : undefined;
+
+    const service: Service = {
+        image,
+        init: true,
+        depends_on: {
+            anvil: { condition: "service_healthy" },
+            ...(secret && {
+                [prtNodeInitServiceName(label)]: {
+                    condition: "service_completed_successfully",
+                },
+            }),
+        },
+        // the signer never comes from the command line
+        command: ["cartesi-sling-node", "pk"],
+        environment: {
+            CARTESI_SLING_APP_ADDRESS: application,
+            CARTESI_SLING_BLOCKCHAIN_HTTP_ENDPOINT: "http://anvil:8545",
+            CARTESI_SLING_BLOCKCHAIN_ID: anvil.id.toString(),
+            CARTESI_SLING_DATA_DIR: DATA_DIR,
+            CARTESI_SLING_POLLING_INTERVAL: Math.max(1, blockTime).toString(),
+            CARTESI_SLING_TEMPLATE_PATH: `${TEMPLATE_DIR}/image`,
+            ...(secret
+                ? { CARTESI_SLING_AUTH_PRIVATE_KEY_FILE: secret.target }
+                : // a devnet account's key is public, so it can go in the environment
+                  { CARTESI_SLING_AUTH_PRIVATE_KEY: privateKeyOf(node) }),
+        },
+        volumes: [
+            `./.cartesi:${TEMPLATE_DIR}:ro`,
+            ...(secret
+                ? [`${prtNodeSecretsVolume(label)}:/run/secrets:ro`]
+                : []),
+        ],
+    };
+
+    return {
+        services: {
+            [prtNodeServiceName(label)]: service,
+            ...(secret && {
+                [prtNodeInitServiceName(label)]: secretInitService({
+                    imageTag,
+                    secrets: [secret],
+                    volume: prtNodeSecretsVolume(label),
+                }),
+            }),
+        },
+        ...(secret && {
+            volumes: { [prtNodeSecretsVolume(label)]: {} },
+        }),
+    };
+};
+
+/** The compose files of the PRT nodes the CLI runs, one per type it knows. */
+export default (options: PrtNodeServiceOptions): ComposeFile[] =>
+    options.nodes.flatMap((node) => {
+        switch (node.type) {
+            case "sling":
+                return [sling(options, node)];
+            default:
+                return [];
+        }
+    });
diff --git a/apps/cli/src/compose/secrets.ts b/apps/cli/src/compose/secrets.ts
new file mode 100644
index 00000000..ad1003cc
--- /dev/null
+++ b/apps/cli/src/compose/secrets.ts
@@ -0,0 +1,71 @@
+import type { Service, VolumeMount } from "../types/compose.js";
+import { escapeComposeValue } from "./common.js";
+
+/**
+ * User and group the node runs as, created in the rollups-runtime image
+ * (`packages/sdk/Dockerfile`). Named, not numbered: the init service runs in
+ * that same image, so `install` resolves the ids the image actually has.
+ */
+export const RUNTIME_USER = "cartesi";
+
+/**
+ * A host key file a service reads from `target`. A bind mount would keep the
+ * host's owner and mode, which the service's user may not be able to read,
+ * so an init service copies the file into a volume, owned by that user.
+ */
+export type FileSecret = {
+    name: string;
+    /** read-only bind mount of the host file, into the init service */
+    source: VolumeMount;
+    /** shell line that installs the copy, in the init service */
+    install: string;
+    /** path of the copy in the service that reads it */
+    target: string;
+};
+
+/**
+ * Declares a host file the runtime user reads as `/run/secrets/<name>`.
+ * @param name file name under `/run/secrets`
+ * @param hostPath absolute, or relative to the project directory
+ */
+export const fileSecret = (name: string, hostPath: string): FileSecret => ({
+    name,
+    source: {
+        type: "bind",
+        source: escapeComposeValue(hostPath),
+        target: `/src/${name}`,
+        read_only: true,
+        // a missing file must fail, not become an empty directory
+        bind: { create_host_path: false },
+    },
+    install: `install -o ${RUNTIME_USER} -g ${RUNTIME_USER} -m 0400 /src/${name} /dst/${name}`,
+    target: `/run/secrets/${name}`,
+});
+
+/**
+ * Returns the service that installs the secrets into `volume`. The services
+ * that read them wait for it to complete and mount `volume` at
+ * `/run/secrets`, read-only.
+ */
+export const secretInitService = (options: {
+    imageTag: string;
+    secrets: FileSecret[];
+    volume: string;
+}): Service => ({
+    image: `cartesi/rollups-runtime:${options.imageTag}`,
+    user: "root",
+    network_mode: "none",
+    restart: "no",
+    entrypoint: ["sh", "-ec"],
+    command: [
+        [
+            // copies of a previous run must not outlive their host files
+            "find /dst -mindepth 1 -delete",
+            ...options.secrets.map(({ install }) => install),
+        ].join("\n"),
+    ],
+    volumes: [
+        ...options.secrets.map(({ source }) => source),
+        `${options.volume}:/dst`,
+    ],
+});
diff --git a/apps/cli/src/config.ts b/apps/cli/src/config.ts
index ad079583..4411a683 100644
--- a/apps/cli/src/config.ts
+++ b/apps/cli/src/config.ts
@@ -5,6 +5,7 @@ import { DuplicateLabelError } from "./config/errors.js";
 import { parseDrives } from "./config/toml/drives.js";
 import { parseMachine } from "./config/toml/machine.js";
 import { parseNvrams } from "./config/toml/nvrams.js";
+import { parseOptionalPrt } from "./config/toml/prt.js";
 import { assertKnownKeys, mergeTomlTables } from "./config/toml/tables.js";
 import { parseString } from "./config/toml/values.js";
 import { parseOptionalWithdrawal } from "./config/toml/accounts.js";
@@ -37,6 +38,7 @@ const CONFIG_KEYS: readonly string[] = [
     "drives",
     "machine",
     "nvrams",
+    "prt",
     "sdk",
     "withdrawal",
 ];
@@ -63,6 +65,7 @@ export const parse = (str: string[]): Config => {
         drives,
         machine: parseMachine(toml.machine),
         nvrams,
+        prt: parseOptionalPrt(toml.prt),
         sdk: parseString(
             toml.sdk,
             `${DEFAULT_SDK_IMAGE}:${DEFAULT_SDK_VERSION}`,
diff --git a/apps/cli/src/config/constants.ts b/apps/cli/src/config/constants.ts
index 97b879f1..43aac6e7 100644
--- a/apps/cli/src/config/constants.ts
+++ b/apps/cli/src/config/constants.ts
@@ -3,6 +3,6 @@ export const MAX_NVRAMS = 8; // guest exposes nvrams as /dev/uio0 to /dev/uio7
 
 export const DEFAULT_FORMAT = "ext2";
 export const DEFAULT_RAM = "128Mi";
-export const DEFAULT_SDK_VERSION = "0.12.0-alpha.44";
+export const DEFAULT_SDK_VERSION = "0.12.0-alpha.45";
 export const DEFAULT_SDK_IMAGE = "cartesi/sdk";
 export const PREFERRED_PORT = 6751;
diff --git a/apps/cli/src/config/defaults.ts b/apps/cli/src/config/defaults.ts
index 67dd95b7..d227ceac 100644
--- a/apps/cli/src/config/defaults.ts
+++ b/apps/cli/src/config/defaults.ts
@@ -33,6 +33,7 @@ export const defaultConfig = (): Config => ({
     drives: { root: defaultRootDriveConfig() },
     machine: defaultMachineConfig(),
     nvrams: {},
+    prt: undefined,
     sdk: `${DEFAULT_SDK_IMAGE}:${DEFAULT_SDK_VERSION}`,
     withdrawal: undefined,
 });
diff --git a/apps/cli/src/config/errors.ts b/apps/cli/src/config/errors.ts
index 46ae0346..bdaba5d7 100644
--- a/apps/cli/src/config/errors.ts
+++ b/apps/cli/src/config/errors.ts
@@ -144,6 +144,16 @@ export class InvalidWithdrawalConfigError extends Error {
     }
 }
 
+export class InvalidPrtConfigError extends Error {
+    /**
+     * @param where the table at fault, `[prt]` by default, or an entry such as `prt.sentries[2]`
+     */
+    constructor(reason: string, where = "[prt]") {
+        super(`Invalid ${where}: ${reason}`);
+        this.name = "InvalidPrtConfigError";
+    }
+}
+
 export class UnknownConfigKeyError extends Error {
     /**
      * @param where where the keys are, e.g. "in [machine]" or "at the top level"
diff --git a/apps/cli/src/config/toml/prt.ts b/apps/cli/src/config/toml/prt.ts
new file mode 100644
index 00000000..5d7fe0ab
--- /dev/null
+++ b/apps/cli/src/config/toml/prt.ts
@@ -0,0 +1,210 @@
+import type { TomlValue } from "smol-toml";
+import { isAddressEqual, zeroAddress } from "viem";
+import {
+    formatValue,
+    InvalidPrtConfigError,
+    InvalidTableError,
+} from "../errors.js";
+import type { PrtNode, PrtNodeType, PrtOptions } from "../types.js";
+import { assertKnownKeys, isTomlTable } from "./tables.js";
+import {
+    parseBoolean,
+    parseRequiredAddress,
+    parseRequiredString,
+} from "./values.js";
+
+export const PRT_KEYS: readonly string[] = ["nodes", "sentry_manager"];
+
+export const PRT_NODE_KEYS: readonly string[] = [
+    "address",
+    "claim",
+    "private_key_file",
+    "sentry",
+    "type",
+];
+
+export const PRT_NODE_TYPES: readonly PrtNodeType[] = ["reference", "sling"];
+
+/**
+ * A label is the key of an entry and names its container, so it keeps to what a service name
+ * can hold. It starts with a letter: entries count in file order, and a parsed table puts
+ * integer-like keys first.
+ */
+const LABEL_PATTERN = /^[a-z][a-z0-9_-]*$/;
+
+/** The table of an entry, as errors name it. */
+export const prtNodeTable = (label: string) => `[prt.nodes.${label}]`;
+
+const parseChoice = <T extends string>(
+    value: TomlValue,
+    key: string,
+    choices: readonly T[],
+    where: string,
+): T => {
+    if (typeof value === "string" && choices.includes(value as T)) {
+        return value as T;
+    }
+    throw new InvalidPrtConfigError(
+        `${key} ${formatValue(value)} isn't supported, expected one of: ${choices.join(", ")}`,
+        where,
+    );
+};
+
+const parseNode = (label: string, value: TomlValue): PrtNode => {
+    const where = prtNodeTable(label);
+    if (!LABEL_PATTERN.test(label)) {
+        throw new InvalidPrtConfigError(
+            `label "${label}" must start with a lowercase letter, then lowercase letters, digits, - or _`,
+            where,
+        );
+    }
+    if (!isTomlTable(value)) {
+        throw new InvalidTableError(where, value);
+    }
+    assertKnownKeys(value, PRT_NODE_KEYS, `in ${where}`);
+
+    const type =
+        value.type === undefined
+            ? undefined
+            : parseChoice(value.type, "type", PRT_NODE_TYPES, where);
+    const sentry = parseBoolean(value.sentry, false);
+    const address =
+        value.address === undefined
+            ? undefined
+            : parseRequiredAddress(value.address, "address");
+    if (address !== undefined && isAddressEqual(address, zeroAddress)) {
+        throw new InvalidPrtConfigError(
+            "address must not be the zero address",
+            where,
+        );
+    }
+    const privateKeyFile =
+        value.private_key_file === undefined
+            ? undefined
+            : parseRequiredString(value.private_key_file, "private_key_file");
+
+    // the rollups-node's own entry: the CLI runs it on the devnet accounts, and it never
+    // claims as a sentry, so the only setting is whether it submits claims at all
+    if (type === "reference") {
+        if (sentry) {
+            throw new InvalidPrtConfigError(
+                "the reference node can't be a sentry yet",
+                where,
+            );
+        }
+        if (address !== undefined || privateKeyFile !== undefined) {
+            throw new InvalidPrtConfigError(
+                "the reference node takes no address or private_key_file: the CLI runs it on the devnet accounts",
+                where,
+            );
+        }
+        return { type, sentry, claim: parseBoolean(value.claim, true) };
+    }
+    if (value.claim !== undefined) {
+        throw new InvalidPrtConfigError(
+            type === "sling"
+                ? "claim isn't supported on a sling node yet: it always claims"
+                : 'claim needs type = "reference": only the rollups-node can read instead of claiming',
+            where,
+        );
+    }
+    if (type === undefined) {
+        if (address === undefined) {
+            throw new InvalidPrtConfigError(
+                "set a type for the CLI to run the node, or an address to appoint one run elsewhere",
+                where,
+            );
+        }
+        if (privateKeyFile !== undefined) {
+            throw new InvalidPrtConfigError(
+                "private_key_file needs a type: the CLI only reads the key of a node it runs",
+                where,
+            );
+        }
+        // without a type the CLI runs nothing, so appointing is all the entry can do
+        if (!sentry) {
+            throw new InvalidPrtConfigError(
+                "an entry without a type is appointed only, so it needs sentry = true",
+                where,
+            );
+        }
+    }
+    if (privateKeyFile === "") {
+        throw new InvalidPrtConfigError(
+            "private_key_file must name a file",
+            where,
+        );
+    }
+
+    return {
+        ...(type !== undefined && { type }),
+        sentry,
+        ...(address !== undefined && { address }),
+        ...(privateKeyFile !== undefined && { privateKeyFile }),
+    };
+};
+
+/**
+ * Parses the [prt.nodes.<label>] entries, in file order. The label is the key, so it is unique
+ * by construction. Addresses are checked against each other since the node rejects a
+ * duplicate, and the rollups-node is one entry.
+ */
+const parseNodes = (value: TomlValue): Record<string, PrtNode> => {
+    if (value === undefined) {
+        return {};
+    }
+    if (!isTomlTable(value)) {
+        throw new InvalidTableError("[prt.nodes]", value);
+    }
+    const nodes: Record<string, PrtNode> = {};
+    for (const [label, entry] of Object.entries(value)) {
+        const node = parseNode(label, entry);
+        const reference = Object.entries(nodes).find(
+            ([, other]) => other.type === "reference",
+        );
+        if (node.type === "reference" && reference !== undefined) {
+            throw new InvalidPrtConfigError(
+                `only one entry is the reference node, and ${prtNodeTable(reference[0])} already is`,
+                prtNodeTable(label),
+            );
+        }
+        const same = Object.entries(nodes).find(
+            ([, other]) =>
+                other.address !== undefined &&
+                node.address !== undefined &&
+                isAddressEqual(other.address, node.address),
+        );
+        if (same !== undefined) {
+            throw new InvalidPrtConfigError(
+                `address ${node.address} is also the address of ${prtNodeTable(same[0])}`,
+                prtNodeTable(label),
+            );
+        }
+        nodes[label] = node;
+    }
+    return nodes;
+};
+
+/**
+ * Parses [prt], which `cartesi run --prt` uses to deploy the application's consensus with
+ * sentries. Like the other tables, it reads the keys it uses and rejects any other.
+ */
+export const parseOptionalPrt = (prt: TomlValue): PrtOptions | undefined => {
+    if (prt === undefined) {
+        return undefined;
+    }
+    if (!isTomlTable(prt)) {
+        throw new InvalidTableError("[prt]", prt);
+    }
+    assertKnownKeys(prt, PRT_KEYS, "in [prt]");
+
+    return {
+        ...(prt.sentry_manager !== undefined && {
+            sentryManager: parseRequiredAddress(
+                prt.sentry_manager,
+                "sentry_manager",
+            ),
+        }),
+        nodes: parseNodes(prt.nodes),
+    };
+};
diff --git a/apps/cli/src/config/types.ts b/apps/cli/src/config/types.ts
index 92941f04..7575f63f 100644
--- a/apps/cli/src/config/types.ts
+++ b/apps/cli/src/config/types.ts
@@ -124,10 +124,41 @@ export type WithdrawalOptions = {
     account_size?: number; // in bytes, default is 32
 };
 
+/**
+ * The node of a [prt.nodes.<label>] entry: the rollups-node itself (`reference`, the one
+ * entry that is implied when omitted), or a Dave sling node the CLI runs. A type is added
+ * once a released node can take part.
+ */
+export type PrtNodeType = "reference" | "sling";
+
+/**
+ * One [prt.nodes.<label>] entry: a PRT validator, which joins tournaments, stages and accepts
+ * results. `sentry` is the optional extra: the address holds a slot on the application's
+ * DaveConsensus and submits a sentry claim per epoch. The label is the key and names the
+ * container of a node the CLI runs. Without a `type` the entry is appointed only.
+ */
+export type PrtNode = {
+    type?: PrtNodeType;
+    sentry: boolean; // default false
+    claim?: boolean; // the reference node only: false runs it in reader mode, default true
+    address?: Address; // required without a type; with one, the PRT pool by default
+    privateKeyFile?: string; // the entry's own key, for a sling node; sets the address
+};
+
+/**
+ * The optional [prt] section, used by `cartesi run --prt` to deploy the application's
+ * DaveConsensus with sentries.
+ */
+export type PrtOptions = {
+    sentryManager?: Address; // may rotate sentries, default is none
+    nodes: Record<string, PrtNode>; // in file order, which sets sentry IDs and pool accounts
+};
+
 export type Config = {
     drives: Record<string, DriveConfig>;
     machine: MachineConfig;
     nvrams: Record<string, NvramConfig>;
+    prt?: PrtOptions;
     sdk: string;
     withdrawal?: WithdrawalOptions;
 };
diff --git a/apps/cli/src/exec/cartesi-machine.ts b/apps/cli/src/exec/cartesi-machine.ts
index 30571500..1fb60112 100644
--- a/apps/cli/src/exec/cartesi-machine.ts
+++ b/apps/cli/src/exec/cartesi-machine.ts
@@ -4,7 +4,7 @@ import {
     type ExecaOptionsDockerFallback,
 } from "./util.js";
 
-export const requiredVersion = new Range("^0.21.0");
+export const requiredVersion = new Range("^0.22.0");
 
 export const boot = (
     args: readonly string[],
diff --git a/apps/cli/src/exec/rollups.ts b/apps/cli/src/exec/rollups.ts
index 61219056..f0b9b626 100644
--- a/apps/cli/src/exec/rollups.ts
+++ b/apps/cli/src/exec/rollups.ts
@@ -30,8 +30,14 @@ import node from "../compose/node.js";
 import passkey from "../compose/passkey.js";
 import paymaster from "../compose/paymaster.js";
 import proxy from "../compose/proxy.js";
+import prtNodes, {
+    type PrtNodeServiceOptions,
+    prtNodeServiceName,
+} from "../compose/prt-node.js";
 import type { WithdrawalConfig } from "../config.js";
 import type { ForkConfig } from "../types/chain.js";
+import type { ComposeFile } from "../types/compose.js";
+import { assertBlockchainEndpoint, assertSecretFiles } from "../validations.js";
 import type { AccountsDriveConfig } from "./cartesi-rollups-machine-tool.js";
 import { execNodeCommand } from "./node-container.js";
 
@@ -266,6 +272,74 @@ export const getLastAcceptedEpoch = async (options: {
     return parseLastAcceptedEpoch(stdout);
 };
 
+/**
+ * The sentries of an application's DaveConsensus, as `cartesi-rollups-cli
+ * contract consensus` reports them.
+ */
+export type DaveConsensusSentries = {
+    address: Address;
+    claimStagingPeriod: number;
+    sentryManager: Address;
+    sentries: { id: number; address: Address }[];
+    /** set once a tournament result is staged */
+    allSentriesAgree?: boolean;
+};
+
+type CliDaveConsensus = {
+    type: string;
+    address: string;
+    claim_staging_period: number;
+    sentry_manager: string;
+    num_sentries: number;
+    sentries: { id: number; address: string }[];
+    all_sentries_agree?: boolean;
+};
+
+/**
+ * Parse the JSON `cartesi-rollups-cli contract consensus --json` writes to
+ * stdout for a DaveConsensus
+ * @throws if the consensus is of another type
+ */
+export const parseDaveConsensus = (stdout: string): DaveConsensusSentries => {
+    const consensus = JSON.parse(stdout) as CliDaveConsensus;
+    if (consensus.type !== "DaveConsensus") {
+        throw new Error(
+            `The consensus at ${consensus.address} is a ${consensus.type}, not a DaveConsensus`,
+        );
+    }
+    return {
+        address: getAddress(consensus.address),
+        claimStagingPeriod: consensus.claim_staging_period,
+        sentryManager: getAddress(consensus.sentry_manager),
+        sentries: consensus.sentries.map(({ id, address }) => ({
+            id,
+            address: getAddress(address),
+        })),
+        allSentriesAgree: consensus.all_sentries_agree,
+    };
+};
+
+/**
+ * Read the sentries of an application's DaveConsensus from the chain
+ */
+export const getDaveConsensus = async (options: {
+    application: Address;
+    projectName: string;
+}): Promise<DaveConsensusSentries> => {
+    const { application, projectName } = options;
+    const stdout = await execNodeCommand({
+        command: [
+            "cartesi-rollups-cli",
+            "contract",
+            "consensus",
+            application,
+            "--json",
+        ],
+        projectName,
+    });
+    return parseDaveConsensus(stdout);
+};
+
 export const getApplicationDeployment = async (
     options: ComposeParams,
 ): Promise<RollupsDeployment | undefined> => {
@@ -452,32 +526,41 @@ const serviceMonitorTask = (options: {
     };
 };
 
-export const startEnvironment = async (options: {
+export type EnvironmentOptions = {
     blockTime: number;
     cpus?: number;
-    defaultBlock: "latest" | "safe" | "pending" | "finalized";
-    detach: boolean;
-    dryRun: boolean;
+    defaultBlock: "latest" | "safe" | "finalized";
     forkConfig?: ForkConfig;
     memory?: number;
     port: number;
     projectName: string;
     prt?: boolean;
+    /** false puts the node in reader mode, when a sling node claims */
+    claimSubmission?: boolean;
     runtimeVersion: string;
     services: string[];
     verbose: boolean;
-}) => {
+};
+
+/**
+ * Composes the environment: the compose file of the project and the variables
+ * it is rendered with. The PRT nodes, composed only after the deploy, are added
+ * to the same file so compose sees one project.
+ */
+const composeEnvironment = (
+    options: EnvironmentOptions,
+    extraFiles: ComposeFile[] = [],
+) => {
     const {
         blockTime,
         cpus,
         defaultBlock,
-        detach,
-        dryRun,
         forkConfig,
         memory,
         port,
         projectName,
         prt,
+        claimSubmission,
         runtimeVersion,
         services,
         verbose,
@@ -495,6 +578,8 @@ export const startEnvironment = async (options: {
 
     // Load all environment variables from the host that start with CARTESI_.
     const hostVars = getCartesiEnvironmentVariables();
+    assertBlockchainEndpoint(hostVars);
+    assertSecretFiles(hostVars);
 
     const files = [
         anvil({
@@ -512,6 +597,7 @@ export const startEnvironment = async (options: {
             logLevel: verbose ? "debug" : "info",
             memory,
             prt,
+            claimSubmission,
             cartesiEnvironmentVariables: hostVars,
         }),
         proxy({ imageTag: "v3.3.4", port }),
@@ -520,7 +606,7 @@ export const startEnvironment = async (options: {
     if (services.includes("explorer")) {
         files.push(
             explorer({
-                imageTag: "2.0.0-alpha.5",
+                imageTag: "2.0.0-alpha.6",
                 port,
             }),
         );
@@ -535,21 +621,37 @@ export const startEnvironment = async (options: {
         files.push(passkey({ imageTag: runtimeVersion }));
     }
 
-    const composeArgs = ["compose", "-f", "-", "--project-directory", "."];
+    // merge files, following Docker Compose merge rules
+    const composeFile = concat([
+        { name: projectName },
+        ...files,
+        ...extraFiles,
+    ]);
+
+    return {
+        env,
+        input: stringify(composeFile, { lineWidth: 0, indent: 2 }),
+    };
+};
+
+const composeArgs = ["compose", "-f", "-", "--project-directory", "."];
+
+export const startEnvironment = async (
+    options: EnvironmentOptions & { detach: boolean; dryRun: boolean },
+) => {
+    const { detach, dryRun } = options;
+    const { env, input } = composeEnvironment(options);
 
     // run in detached mode (background)
     const upArgs = detach ? ["--detach"] : [];
 
-    // merge files, following Docker Compose merge rules
-    const composeFile = concat([{ name: projectName }, ...files]);
-
     // if only dry run, just return the config
     if (dryRun) {
         // parse, resolve and render compose file in canonical format
         const { stdout: config } = await execa(
             "docker",
             [...composeArgs, "config", "--format", "yaml"],
-            { env, input: stringify(composeFile, { lineWidth: 0, indent: 2 }) },
+            { env, input },
         );
 
         return { config };
@@ -558,7 +660,7 @@ export const startEnvironment = async (options: {
     // run compose
     const cmd = execa("docker", [...composeArgs, "up", ...upArgs], {
         env,
-        input: stringify(composeFile, { lineWidth: 0, indent: 2 }),
+        input,
     });
 
     // if detached, wait to finish
@@ -569,6 +671,57 @@ export const startEnvironment = async (options: {
     return { cmd };
 };
 
+/**
+ * Starts the PRT nodes the CLI runs for a deployed application, in the running
+ * environment. The file sent is the environment's plus the node services, so
+ * compose treats them as one project and recreates only the nodes, whose
+ * application changed. Their dependencies are already running, except the init
+ * service of a key file, which runs first.
+ * @returns the names of the services started
+ */
+export const startPrtNodes = async (
+    options: EnvironmentOptions & PrtNodeServiceOptions,
+): Promise<string[]> => {
+    const names = options.nodes
+        .filter(({ type }) => type !== undefined)
+        .map(({ label }) => prtNodeServiceName(label));
+    if (names.length === 0) {
+        return [];
+    }
+    const { env, input } = composeEnvironment(options, prtNodes(options));
+    // --wait: a node that exits at once, e.g. on a bad key, fails here
+    await execa(
+        "docker",
+        [...composeArgs, "up", "--detach", "--wait", ...names],
+        { env, input },
+    );
+    return names;
+};
+
+/**
+ * Stops and removes the PRT node containers, before the application they
+ * claim for is undeployed. Their secret volumes stay until the environment
+ * stops.
+ */
+export const stopPrtNodes = async (options: {
+    projectName: string;
+    services: string[];
+}) => {
+    const { projectName, services } = options;
+    if (services.length === 0) {
+        return;
+    }
+    await execa("docker", [
+        "compose",
+        "--project-name",
+        projectName,
+        "rm",
+        "--stop",
+        "--force",
+        ...services,
+    ]);
+};
+
 /**
  * Wait for the environment to be healthy
  * @param options
@@ -686,6 +839,10 @@ export type DeployApplicationOptions = {
     projectName: string;
     prt?: boolean;
     salt?: Hex;
+    /** PRT only: the sentries appointed on the consensus, in ID order */
+    sentries?: Address[];
+    /** PRT only: the account that may rotate the sentries */
+    sentryManager?: Address;
     snapshotPath: string;
     withdrawalConfig?: WithdrawalConfig;
     claimStagingPeriod: number;
@@ -704,6 +861,8 @@ export const buildDeployApplicationArgs = (
         name,
         prt,
         salt,
+        sentries,
+        sentryManager,
         snapshotPath,
         withdrawalConfig,
         claimStagingPeriod,
@@ -711,7 +870,9 @@ export const buildDeployApplicationArgs = (
 
     const deployArgs = [name, snapshotPath];
 
-    if (consensus) {
+    // a prt deploy always creates its own DaveConsensus, which is bound to
+    // the machine, so an existing consensus is only reused without --prt
+    if (consensus && !prt) {
         deployArgs.push("--consensus", consensus);
     } else {
         deployArgs.push("--epoch-length", epochLength.toString());
@@ -725,6 +886,14 @@ export const buildDeployApplicationArgs = (
         deployArgs.push("--prt");
     }
 
+    // the node takes both only with --prt
+    if (sentryManager) {
+        deployArgs.push("--sentry-manager", sentryManager);
+    }
+    if (sentries && sentries.length > 0) {
+        deployArgs.push("--sentries", sentries.join(","));
+    }
+
     // the node takes this on the whole deploy command, PRT included
     deployArgs.push("--claim-staging-period", claimStagingPeriod.toString());
 
@@ -764,6 +933,27 @@ export const deployApplication = async (
     throw new Error("Failed to deploy application");
 };
 
+/**
+ * Assemble the `cartesi-rollups-cli app remove` arguments.
+ * Kept separate from the call so it can be tested without a node.
+ */
+export const buildRemoveApplicationArgs = (options: {
+    application: string | Address;
+    force: boolean;
+}): string[] => {
+    const { application, force } = options;
+
+    const removeArgs = [application];
+
+    if (force) {
+        // the node refuses to remove without acknowledging the work it abandons,
+        // and --yes only skips its confirmation prompt
+        removeArgs.push("--allow-abandonment", "--yes");
+    }
+
+    return removeArgs;
+};
+
 /**
  * Remove application from rollups node
  * @param options
@@ -774,7 +964,7 @@ export const removeApplication = async (options: {
     force: boolean;
     projectName: string;
 }) => {
-    const { application, force, projectName } = options;
+    const { application, projectName } = options;
 
     // disable application first so we can remove it
     await execNodeCommand({
@@ -788,14 +978,13 @@ export const removeApplication = async (options: {
         projectName,
     });
 
-    const removeArgs = [application];
-
-    if (force) {
-        removeArgs.push("--yes");
-    }
-
     return execNodeCommand({
-        command: ["cartesi-rollups-cli", "app", "remove", ...removeArgs],
+        command: [
+            "cartesi-rollups-cli",
+            "app",
+            "remove",
+            ...buildRemoveApplicationArgs(options),
+        ],
         projectName,
     });
 };
diff --git a/apps/cli/src/prt.ts b/apps/cli/src/prt.ts
new file mode 100644
index 00000000..ff6ad207
--- /dev/null
+++ b/apps/cli/src/prt.ts
@@ -0,0 +1,408 @@
+import chalk from "chalk";
+import fs from "node:fs";
+import path from "node:path";
+import {
+    type Address,
+    type Hex,
+    isAddressEqual,
+    isHex,
+    parseEther,
+} from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { DEVNET_MNEMONIC } from "./compose/node.js";
+import {
+    InvalidPrtConfigError,
+    type PrtNode,
+    type PrtOptions,
+} from "./config.js";
+import { prtNodeTable } from "./config/toml/prt.js";
+import {
+    DEFAULT_SENDER_INDEX,
+    DEVNET_ACCOUNTS,
+    findMnemonicAccountIndex,
+    getDevnetAccount,
+} from "./wallet.js";
+
+/**
+ * The PRT pool: devnet accounts a [prt.nodes.<label>] entry gets when it names none, in file
+ * order. They come after the accounts anvil funds (0 to 9), which the node, the CLI and the
+ * developer use, so a pool account shares nonces with nothing else.
+ */
+export const PRT_POOL_START = 20;
+export const PRT_POOL_SIZE = 10;
+
+/** What `cartesi run` gives each pool account: what anvil gives its own accounts. */
+export const PRT_FUNDING = parseEther("10000");
+
+/**
+ * Devnet accounts the node signs with: the claimer (`CARTESI_AUTH_MNEMONIC_ACCOUNT_INDEX`,
+ * set by the CLI) and the PRT submitter (the node's `CARTESI_PRT_AUTH_MNEMONIC_ACCOUNT_INDEX`
+ * default), which the node has only when it claims (the reference entry's `claim`).
+ */
+const NODE_CLAIMER_INDEX = 0;
+const NODE_PRT_INDEX = 6;
+
+/** Where an entry's address came from. */
+export type PrtNodeSource =
+    | { kind: "pool"; index: number } // a devnet account of the PRT pool
+    | { kind: "devnet"; index: number } // another devnet account, named in the entry
+    | { kind: "key-file"; path: string } // the developer's own key, read from a file
+    | { kind: "external" }; // an address of the developer's own
+
+export type ResolvedPrtNode = {
+    label: string;
+    address: Address;
+    /** the node the CLI runs, the sling node; none for an appointed-only entry */
+    type?: "sling";
+    sentry: boolean;
+    /** 1-based position among the sentries, in file order: the sentry's ID on the consensus */
+    sentryId?: number;
+    source: PrtNodeSource;
+    /** the key the CLI runs the node with; only for a devnet account, whose key is public */
+    privateKey?: Hex;
+};
+
+/** The rollups-node's entry, implied when the config has none. */
+export type ResolvedReference = {
+    /** the entry's label, when the config spells it */
+    label?: string;
+    /** whether the node submits claims; false is reader mode */
+    claim: boolean;
+};
+
+export type ResolvedPrt = {
+    sentryManager?: Address;
+    reference: ResolvedReference;
+    /** every entry but the reference node, in file order */
+    nodes: ResolvedPrtNode[];
+    warnings: string[];
+};
+
+const isPoolIndex = (index: number) =>
+    index >= PRT_POOL_START && index < PRT_POOL_START + PRT_POOL_SIZE;
+
+const devnetIndexOf = (address: Address): number | undefined =>
+    findMnemonicAccountIndex({
+        address,
+        max: DEVNET_ACCOUNTS,
+        mnemonic: DEVNET_MNEMONIC,
+    });
+
+const sourceOf = (address: Address): PrtNodeSource => {
+    const index = devnetIndexOf(address);
+    if (index === undefined) {
+        return { kind: "external" };
+    }
+    return { kind: isPoolIndex(index) ? "pool" : "devnet", index };
+};
+
+const PRIVATE_KEY_PATTERN = /^(0x)?[0-9a-fA-F]{64}$/;
+
+/**
+ * Reads an entry's key file: its first line is a 32-byte hex private key, with or without
+ * `0x`, the format the sling node reads. The key is never part of an error.
+ * @param file path as given in the config, relative to the project directory
+ */
+export const readKeyFile = (file: string, where: string): Hex => {
+    let content: string;
+    try {
+        content = fs.readFileSync(path.resolve(file), "utf8");
+    } catch {
+        throw new InvalidPrtConfigError(
+            `private_key_file "${file}" can't be read`,
+            where,
+        );
+    }
+    const [firstLine = ""] = content.split("\n");
+    const key = firstLine.trim();
+    if (!PRIVATE_KEY_PATTERN.test(key)) {
+        throw new InvalidPrtConfigError(
+            `the first line of private_key_file "${file}" must be a hex private key, 64 hex digits with or without 0x`,
+            where,
+        );
+    }
+    return (isHex(key) ? key : `0x${key}`) as Hex;
+};
+
+/**
+ * Resolves an entry that brings its own key: the address is the key's, and must match
+ * `address` when both are set. The devnet accounts' keys are public and derived by the CLI,
+ * so a file holding one is a mistake.
+ */
+const resolveKeyFile = (
+    node: PrtNode,
+    where: string,
+): { address: Address; source: PrtNodeSource } => {
+    const file = node.privateKeyFile as string;
+    const { address } = privateKeyToAccount(readKeyFile(file, where));
+    const devnetIndex = devnetIndexOf(address);
+    if (devnetIndex !== undefined) {
+        throw new InvalidPrtConfigError(
+            `private_key_file "${file}" holds the key of devnet account ${devnetIndex}, which the CLI derives itself. Drop the file, or set the address instead`,
+            where,
+        );
+    }
+    if (node.address !== undefined && !isAddressEqual(node.address, address)) {
+        throw new InvalidPrtConfigError(
+            `private_key_file "${file}" is the key of ${address}, not ${node.address}`,
+            where,
+        );
+    }
+    return { address, source: { kind: "key-file", path: file } };
+};
+
+/**
+ * Gives every [prt.nodes.<label>] entry its address: the one it names, the one of its key
+ * file, or else the next free account of the PRT pool, in file order. Pool accounts named by
+ * an entry are skipped, so no two entries share an address. The reference entry takes none,
+ * since the node runs on its own devnet accounts. Needs no chain, so it runs before anything
+ * starts, `--dry-run` included.
+ * @param options.guardian the application's guardian, which an entry shouldn't share nonces with
+ * @throws InvalidPrtConfigError when the pool runs out, a key file is unusable, or an entry
+ * the CLI runs is an account the node signs with
+ */
+export const resolvePrtNodes = (
+    prt: PrtOptions,
+    options: { guardian?: Address } = {},
+): ResolvedPrt => {
+    const warnings: string[] = [];
+    const referenceEntry = Object.entries(prt.nodes).find(
+        ([, { type }]) => type === "reference",
+    );
+    const reference: ResolvedReference = {
+        ...(referenceEntry && { label: referenceEntry[0] }),
+        claim: referenceEntry?.[1].claim ?? true,
+    };
+    const entries = Object.entries(prt.nodes).filter(
+        ([, { type }]) => type !== "reference",
+    );
+    const named = new Set(
+        entries.flatMap(([, { address }]) =>
+            address === undefined ? [] : [address.toLowerCase()],
+        ),
+    );
+    let next = PRT_POOL_START;
+    let sentries = 0;
+
+    const nodes = entries.map(([label, node]): ResolvedPrtNode => {
+        const where = prtNodeTable(label);
+        const resolved = {
+            label,
+            ...(node.type === "sling" && { type: node.type }),
+            sentry: node.sentry,
+            ...(node.sentry && { sentryId: ++sentries }),
+        };
+        if (node.privateKeyFile !== undefined) {
+            return { ...resolved, ...resolveKeyFile(node, where) };
+        }
+        if (node.address !== undefined) {
+            const source = sourceOf(node.address);
+            if (node.type !== undefined && source.kind === "external") {
+                throw new InvalidPrtConfigError(
+                    `the CLI has no key for ${node.address}: set private_key_file to run the node with it, or drop the type to appoint it only`,
+                    where,
+                );
+            }
+            return {
+                ...resolved,
+                address: node.address,
+                source,
+                ...(node.type !== undefined &&
+                    source.kind !== "external" &&
+                    source.kind !== "key-file" && {
+                        privateKey: getDevnetAccount(source.index).privateKey,
+                    }),
+            };
+        }
+        while (
+            isPoolIndex(next) &&
+            named.has(getDevnetAccount(next).address.toLowerCase())
+        ) {
+            next++;
+        }
+        if (!isPoolIndex(next)) {
+            throw new InvalidPrtConfigError(
+                `needs an address: the PRT pool, devnet accounts ${PRT_POOL_START} to ${PRT_POOL_START + PRT_POOL_SIZE - 1}, is used up`,
+                where,
+            );
+        }
+        const poolIndex = next++;
+        const { address, privateKey } = getDevnetAccount(poolIndex);
+        return {
+            ...resolved,
+            address,
+            source: { kind: "pool", index: poolIndex },
+            privateKey,
+        };
+    });
+
+    // a key file's address is known only now
+    nodes.forEach((node, index) => {
+        const same = nodes.find(
+            (other, i) =>
+                i < index && isAddressEqual(other.address, node.address),
+        );
+        if (same !== undefined) {
+            throw new InvalidPrtConfigError(
+                `address ${node.address} is also the address of ${prtNodeTable(same.label)}`,
+                prtNodeTable(node.label),
+            );
+        }
+    });
+
+    // a node the CLI runs sends its own transactions, so it can't be an account the node
+    // sends from. Sharing one with the guardian or the default sender only risks a collision
+    for (const node of nodes) {
+        if (node.type === undefined || node.source.kind === "pool") {
+            continue;
+        }
+        const where = prtNodeTable(node.label);
+        if (node.source.kind === "devnet") {
+            if (node.source.index === NODE_CLAIMER_INDEX) {
+                throw new InvalidPrtConfigError(
+                    `devnet account ${NODE_CLAIMER_INDEX} signs the node's claims, so it can't also run ${where}`,
+                    where,
+                );
+            }
+            if (reference.claim && node.source.index === NODE_PRT_INDEX) {
+                throw new InvalidPrtConfigError(
+                    `devnet account ${NODE_PRT_INDEX} signs the node's PRT transactions, so it can't also run ${where}`,
+                    where,
+                );
+            }
+            if (node.source.index === DEFAULT_SENDER_INDEX) {
+                warnings.push(
+                    `${where} is devnet account ${DEFAULT_SENDER_INDEX}, the default sender of cartesi send and deposit, so their transactions may collide`,
+                );
+            }
+        }
+        if (
+            options.guardian !== undefined &&
+            isAddressEqual(node.address, options.guardian)
+        ) {
+            warnings.push(
+                `${where} is the guardian of the application, so its transactions may collide with an emergency withdrawal`,
+            );
+        }
+    }
+
+    if (prt.sentryManager !== undefined && sentries === 0) {
+        warnings.push(
+            "[prt].sentry_manager is set but no [prt.nodes] entry is a sentry, so the manager has no sentries to rotate",
+        );
+    }
+
+    // PRT is permissionless, so a claimer may run outside the CLI, but a devnet with
+    // nothing claiming settles no epoch
+    const slings = nodes.filter(({ type }) => type === "sling");
+    if (!reference.claim && slings.length === 0) {
+        warnings.push(
+            `nothing the CLI runs claims: ${prtNodeTable(reference.label as string)} has claim = false and no entry has type = "sling", so a claimer must run elsewhere`,
+        );
+    }
+    // the consensus accepts a staged result once every sentry voted for it, and a sling
+    // sentry votes for its own claim
+    const appointed = nodes.filter(({ sentry }) => sentry);
+    if (
+        !reference.claim &&
+        appointed.length > 0 &&
+        appointed.every(({ type }) => type === "sling")
+    ) {
+        warnings.push(
+            "every sentry is a sling node the CLI runs and the rollups-node reads, so a claim is accepted as soon as its own authors vote for it",
+        );
+    }
+
+    return { sentryManager: prt.sentryManager, reference, nodes, warnings };
+};
+
+/**
+ * The warning for a reference entry whose `claim` changed between a startup and a rebuild:
+ * the rollups-node saves its submission mode in its database at the first start and refuses
+ * the other mode on it, so the change needs a fresh `cartesi run`. The sling entries are free
+ * to change, their containers are recreated on every rebuild.
+ * @returns the warning, or undefined when the mode is what it was
+ */
+export const readerModeChanged = (
+    before: ResolvedPrt | undefined,
+    after: ResolvedPrt | undefined,
+): string | undefined => {
+    const was = before?.reference.claim ?? true;
+    const now = after?.reference.claim ?? true;
+    if (was === now) {
+        return undefined;
+    }
+    return `the rollups-node's claim setting changed to claim = ${now} in cartesi.toml. Restart cartesi run to apply it. This rebuild keeps the [prt] setup it started with.`;
+};
+
+/** The sentries, in ID order: what the deploy appoints on the consensus. */
+export const sentriesOf = (prt: ResolvedPrt): ResolvedPrtNode[] =>
+    prt.nodes.filter(({ sentry }) => sentry);
+
+/** The entries the CLI runs a node for. */
+export const runnableNodes = (prt: ResolvedPrt): ResolvedPrtNode[] =>
+    prt.nodes.filter(({ type }) => type !== undefined);
+
+/**
+ * The chain calls `checkPrtNodes` makes, so it can run against a fake client in tests.
+ */
+export type PrtClient = {
+    getBalance: (args: { address: Address }) => Promise<bigint>;
+    setBalance: (args: { address: Address; value: bigint }) => Promise<void>;
+};
+
+/**
+ * Funds the pool accounts and checks that the other nodes the CLI runs have ETH to send
+ * their transactions with. Runs once anvil is healthy, before the deploy, and again before a
+ * redeploy: the balance is set, not added to, so repeating it changes nothing.
+ * @throws when a node of the developer's own has no ETH, which the CLI never gives it
+ */
+export const checkPrtNodes = async (
+    client: PrtClient,
+    prt: ResolvedPrt,
+): Promise<void> => {
+    for (const node of runnableNodes(prt)) {
+        if (node.source.kind === "pool") {
+            await client.setBalance({
+                address: node.address,
+                value: PRT_FUNDING,
+            });
+            continue;
+        }
+        const balance = await client.getBalance({ address: node.address });
+        if (balance === 0n) {
+            throw new Error(
+                `${node.sentry ? "sentry" : "validator"} ${node.label} ${node.address} has no ETH on this devnet. Fund it before cartesi run, e.g. with cast rpc anvil_setBalance`,
+            );
+        }
+    }
+};
+
+/** The rollups-node's line: what its entry says it does. */
+export const describeReference = (prt: ResolvedPrt): string =>
+    prt.reference.claim
+        ? "rollups-node claims"
+        : "rollups-node reads (claim = false, no PRT signer)";
+
+/**
+ * One line per entry: sentry with its ID or validator, its label and its full address, so it
+ * can be copied into other tools. The note says what the CLI does with the entry, then where
+ * its account comes from.
+ */
+export const describePrtNode = (node: ResolvedPrtNode): string => {
+    const { source } = node;
+    const account =
+        source.kind === "pool"
+            ? `devnet account ${source.index}, funded by the CLI`
+            : source.kind === "devnet"
+              ? `devnet account ${source.index}`
+              : source.kind === "key-file"
+                ? `key in ${source.path}`
+                : undefined;
+    const origin =
+        node.type === undefined
+            ? ["appointed only", ...(account ? [account] : [])].join(", ")
+            : (account ?? "");
+    const kind = node.sentry ? `sentry ${node.sentryId}` : "validator";
+    return `${kind} ${chalk.cyan(node.label)} ${node.address} ${chalk.dim(`(${origin})`)}`;
+};
diff --git a/apps/cli/src/validations.ts b/apps/cli/src/validations.ts
index 83770d9a..1fab8cca 100644
--- a/apps/cli/src/validations.ts
+++ b/apps/cli/src/validations.ts
@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import { isIPv6 } from "node:net";
 import {
     createPublicClient,
     http,
@@ -17,6 +19,8 @@ import {
     etherPortalConfig,
     inputBoxConfig,
 } from "./contracts";
+import type { CartesiEnvironmentVariables } from "./base";
+import { nodeSecretFileVariables } from "./compose/node";
 import ForkChainValidationError from "./errors/ForkChainValidationError";
 import UnsupportedForkChainError from "./errors/UnsupportedForkChainError";
 import type { ForkConfig } from "./types/chain";
@@ -284,3 +288,153 @@ export const assertForkConfig = async (
 
     return true;
 };
+
+/**
+ * Asserts that each key file the host names for the node is a readable file,
+ * so a wrong path fails before any container starts. The error names the
+ * variable and the path, never the file's content.
+ */
+export const assertSecretFiles = (env: CartesiEnvironmentVariables) => {
+    for (const name of nodeSecretFileVariables) {
+        const file = env[name];
+        if (file === undefined) {
+            continue;
+        }
+        try {
+            if (!fs.statSync(file).isFile()) {
+                throw new Error("not a file");
+            }
+            fs.accessSync(file, fs.constants.R_OK);
+        } catch {
+            throw new Error(`${name} must name a readable file: "${file}"`);
+        }
+    }
+};
+
+/** Whether every `%` in `value` starts a `%XX` escape. */
+const hasValidEscapes = (value: string): boolean =>
+    !/%(?![0-9A-Fa-f]{2})/.test(value);
+
+/**
+ * Whether `name` is a host name Go's `url.Parse` accepts: no character it
+ * would have to escape, and `%XX` only for non-ASCII bytes or `%25`.
+ */
+const isValidHostName = (name: string): boolean => {
+    for (let i = 0; i < name.length; i++) {
+        const c = name[i];
+        if (c === "%") {
+            const hex = name.slice(i + 1, i + 3);
+            if (!/^[0-9A-Fa-f]{2}$/.test(hex)) {
+                return false;
+            }
+            if (Number.parseInt(hex[0], 16) < 8 && hex !== "25") {
+                return false;
+            }
+            i += 2;
+        } else if (
+            c.charCodeAt(0) < 0x80 &&
+            !/[A-Za-z0-9\-._~!$&'()*+,;="<>[\]]/.test(c)
+        ) {
+            return false;
+        }
+    }
+    return true;
+};
+
+/** Whether `host` (`name[:port]` or `[ipv6][:port]`) has a non-empty name. */
+const isValidHost = (host: string): boolean => {
+    let name: string;
+    let port: string;
+    if (host.startsWith("[")) {
+        const close = host.lastIndexOf("]");
+        if (close < 0) {
+            return false;
+        }
+        name = host.slice(1, close);
+        port = host.slice(close + 1);
+        // an IPv6 zone is escaped as %25, e.g. [fe80::1%25en0]
+        const zoneAt = name.indexOf("%25");
+        const address = zoneAt < 0 ? name : name.slice(0, zoneAt);
+        if (!isIPv6(address) || !hasValidEscapes(name)) {
+            return false;
+        }
+    } else {
+        const colonAt = host.indexOf(":");
+        if (colonAt !== host.lastIndexOf(":")) {
+            return false;
+        }
+        name = colonAt < 0 ? host : host.slice(0, colonAt);
+        port = colonAt < 0 ? "" : host.slice(colonAt);
+        if (!isValidHostName(name)) {
+            return false;
+        }
+    }
+    return name !== "" && /^(:[0-9]*)?$/.test(port);
+};
+
+/**
+ * Whether `raw` is an endpoint the rollups-node accepts: Go's `url.Parse`
+ * succeeds on it, its scheme is http or https and it has a host name. Mirrors
+ * Go rather than WHATWG `URL`, which accepts and rejects other URLs.
+ */
+export const isValidHttpEndpoint = (raw: string): boolean => {
+    // Go rejects control characters; surrounding whitespace is a mistake
+    const isControl = (c: string) => c < " " || c === "\x7f";
+    if (raw !== raw.trim() || [...raw].some(isControl)) {
+        return false;
+    }
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):/.exec(raw);
+    if (!scheme || !["http", "https"].includes(scheme[1].toLowerCase())) {
+        return false;
+    }
+    let rest = raw.slice(scheme[0].length);
+
+    // Go checks the escapes of the fragment, but not the query
+    const hashAt = rest.indexOf("#");
+    if (hashAt >= 0) {
+        if (!hasValidEscapes(rest.slice(hashAt + 1))) {
+            return false;
+        }
+        rest = rest.slice(0, hashAt);
+    }
+    const queryAt = rest.indexOf("?");
+    if (queryAt >= 0) {
+        rest = rest.slice(0, queryAt);
+    }
+
+    // without //, the URL has no authority and so no host
+    if (!rest.startsWith("//")) {
+        return false;
+    }
+    rest = rest.slice(2);
+    const slashAt = rest.indexOf("/");
+    const authority = slashAt < 0 ? rest : rest.slice(0, slashAt);
+    const path = slashAt < 0 ? "" : rest.slice(slashAt);
+    if (!hasValidEscapes(path)) {
+        return false;
+    }
+
+    const atAt = authority.lastIndexOf("@");
+    const userinfo = atAt < 0 ? "" : authority.slice(0, atAt);
+    if (
+        !/^[A-Za-z0-9\-._:~!$&'()*+,;=%@]*$/.test(userinfo) ||
+        !hasValidEscapes(userinfo)
+    ) {
+        return false;
+    }
+    return isValidHost(authority.slice(atAt + 1));
+};
+
+/**
+ * Asserts that a blockchain endpoint set on the host is one the rollups-node
+ * accepts, so a wrong one fails before any container starts. The error never
+ * shows the value, which may hold credentials.
+ */
+export const assertBlockchainEndpoint = (env: CartesiEnvironmentVariables) => {
+    const endpoint = env.CARTESI_BLOCKCHAIN_HTTP_ENDPOINT;
+    if (endpoint !== undefined && !isValidHttpEndpoint(endpoint)) {
+        throw new Error(
+            "CARTESI_BLOCKCHAIN_HTTP_ENDPOINT must be an http(s) URL with a DNS name or IP address (redirects are not followed)",
+        );
+    }
+};
diff --git a/apps/cli/src/wallet.ts b/apps/cli/src/wallet.ts
index 595df6b4..6f4977b8 100644
--- a/apps/cli/src/wallet.ts
+++ b/apps/cli/src/wallet.ts
@@ -3,14 +3,17 @@ import {
     type Address,
     createTestClient,
     defineChain,
+    type Hex,
     http,
     isAddressEqual,
     publicActions,
+    toHex,
     walletActions,
 } from "viem";
 import { mnemonicToAccount } from "viem/accounts";
 import { anvil } from "viem/chains";
 import { getProjectName } from "./base.js";
+import { DEVNET_MNEMONIC } from "./compose/node.js";
 import { PREFERRED_PORT } from "./config.js";
 import { getProjectPort } from "./exec/rollups.js";
 
@@ -78,3 +81,55 @@ export const findMnemonicAccountIndex = (options: {
     }
     return undefined;
 };
+
+/**
+ * How many accounts the CLI derives from the devnet mnemonic: the 10 anvil
+ * funds and unlocks, and the ones after them, up to the sentry pool's last.
+ */
+export const DEVNET_ACCOUNTS = 30;
+
+/**
+ * Returns a devnet account by its index in the mnemonic, with the key the
+ * CLI signs with on its behalf. The mnemonic is public, so the key is too.
+ */
+export const getDevnetAccount = (
+    index: number,
+): { address: Address; privateKey: Hex } => {
+    if (!Number.isInteger(index) || index < 0 || index >= DEVNET_ACCOUNTS) {
+        throw new Error(
+            `There is no devnet account ${index}, the CLI derives accounts 0 to ${DEVNET_ACCOUNTS - 1}`,
+        );
+    }
+    const account = mnemonicToAccount(DEVNET_MNEMONIC, {
+        addressIndex: index,
+    });
+    const privateKey = account.getHdKey().privateKey;
+    if (!privateKey) {
+        throw new Error(`Devnet account ${index} has no private key`);
+    }
+    return { address: account.address, privateKey: toHex(privateKey) };
+};
+
+/**
+ * Index of the devnet account that sends inputs and deposits when no `--from`
+ * is given. The node signs its claims with account 0 and the CLI uses account
+ * 1 as the guardian, so a sender of its own shares no nonces with either.
+ */
+export const DEFAULT_SENDER_INDEX = 8;
+
+/**
+ * Returns the default sender among the accounts the RPC exposes.
+ * @throws if the RPC exposes too few accounts
+ */
+export const getDefaultSender = async (client: {
+    getAddresses: () => Promise<readonly Address[]>;
+}): Promise<Address> => {
+    const addresses = await client.getAddresses();
+    const sender = addresses[DEFAULT_SENDER_INDEX];
+    if (sender === undefined) {
+        throw new Error(
+            `The RPC exposes ${addresses.length} accounts, so there is no devnet account ${DEFAULT_SENDER_INDEX} to send from; pass --from to choose the sender`,
+        );
+    }
+    return sender;
+};
diff --git a/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal-layouts.ts b/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal-layouts.ts
index 4b39f691..e05b8581 100644
--- a/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal-layouts.ts
+++ b/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal-layouts.ts
@@ -21,9 +21,6 @@ export type Layout = {
         at: number; // offset of data, the rest is zeros
         data: Buffer;
     };
-    // TODO: the machine-tool of rollups-node v2.0.0-alpha.13 only looks for the
-    // accounts drive among the flash drives, unskip once it finds nvrams too
-    skip?: boolean;
 };
 
 const scratchDrive = `
@@ -76,7 +73,6 @@ accounts_drive = true
 `,
         label: "accounts",
         device: "/dev/uio0",
-        skip: true,
     },
     {
         name: "the beginning of a larger nvram",
@@ -96,7 +92,6 @@ accounts_drive_size = "4Mi"
         label: "state",
         device: "/dev/uio1",
         accountsSize: 4 * MiB,
-        skip: true,
     },
     {
         // like a DEX, which memory-maps its state after the accounts, from an image
@@ -118,6 +113,5 @@ accounts_drive_size = "4Mi"
             at: 4 * MiB,
             data: Buffer.alloc(8 * MiB, 0xab),
         },
-        skip: true,
     },
 ];
diff --git a/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal/dapp.sh b/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal/dapp.sh
index fd7c9b5b..aaa2e5f6 100755
--- a/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal/dapp.sh
+++ b/apps/cli/tests/integration/commands/fixtures/accounts-withdrawal/dapp.sh
@@ -106,8 +106,8 @@ handle_erc20_deposit() {
   [[ "$token" == "$trusted_token" ]] || return 1
   [[ "${amount_hex:0:49}" =~ ^0{48}[0-7]$ ]] || return 1
 
+  # a zero deposit opens an account with no balance, as one emptied by a debit would be
   amount="$(uint64_be_to_dec "${amount_hex:48:16}")"
-  (( amount > 0 )) || return 1
   credit_account "$sender" "$amount"
 }
 
diff --git a/apps/cli/tests/integration/commands/prt-sling-claimer.test.ts b/apps/cli/tests/integration/commands/prt-sling-claimer.test.ts
new file mode 100644
index 00000000..67fc3735
--- /dev/null
+++ b/apps/cli/tests/integration/commands/prt-sling-claimer.test.ts
@@ -0,0 +1,271 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { execa, type ResultPromise } from "execa";
+import fs from "fs-extra";
+import os from "node:os";
+import path from "node:path";
+import type { Address } from "viem";
+import { erc20PortalAddress, testUsdcAddress } from "../../../src/contracts";
+import {
+    getDaveConsensus,
+    getLastAcceptedEpoch,
+} from "../../../src/exec/rollups";
+import { TEST_SDK } from "../config";
+import {
+    type AnvilClient,
+    buildApplication,
+    createAnvilClient,
+    deposit,
+    devnetAccount,
+    runCli,
+    startApplication,
+    stopApplication,
+    TIMEOUT,
+    waitFor,
+} from "../devnet";
+
+/**
+ * Covers `cartesi run --prt` with the reference entry's `claim = false`: the
+ * rollups-node runs in reader mode with no PRT signer, a sling validator joins
+ * the tournament, stages and accepts the result, and the sling sentry's claim
+ * lets it do so without waiting out the staging period.
+ */
+
+const EPOCH_LENGTH = 10;
+
+// long enough that acceptance within the test can only come from the sentry
+const CLAIM_STAGING_PERIOD = 1_000_000;
+
+// a lone claim wins its root tournament by timeout after about 700 blocks on
+// the devnet clock
+const MAX_BLOCKS = 4_000;
+const BLOCKS_PER_STEP = 25;
+
+const fixture = path.join(__dirname, "fixtures", "accounts-withdrawal");
+const projectName = `prt-claimer-${process.pid}`;
+
+const services = ["prt-node-blue", "prt-node-green"];
+
+const compose = (...args: string[]) =>
+    execa("docker", ["compose", "-p", projectName, ...args], {
+        all: true,
+        reject: false,
+    });
+
+const logsOf = async (service: string) =>
+    (await compose("logs", "--no-log-prefix", service)).all ?? "";
+
+/**
+ * Mines in steps until `done` holds or the budget is spent, letting the nodes
+ * see the blocks between steps.
+ * @returns the blocks mined; the caller checks `done` held
+ */
+const mineUntil = async (
+    anvil: AnvilClient,
+    done: () => Promise<boolean>,
+    maxBlocks = MAX_BLOCKS,
+): Promise<number> => {
+    let mined = 0;
+    while (mined < maxBlocks) {
+        await anvil.mine({ blocks: BLOCKS_PER_STEP });
+        mined += BLOCKS_PER_STEP;
+        if (await done()) {
+            break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    return mined;
+};
+
+describe("prt with a sling claimer", () => {
+    let appDir: string;
+    let cleanup: () => void;
+    let run: ResultPromise | undefined;
+    let application: Address;
+    let output: () => string;
+    let anvil: AnvilClient;
+
+    beforeAll(async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "prt-claimer-"));
+        cleanup = () => fs.removeSync(dir);
+        appDir = path.join(dir, "accounts-withdrawal");
+        await fs.copy(fixture, appDir);
+        await fs.writeFile(
+            path.join(appDir, "cartesi.toml"),
+            `sdk = "${TEST_SDK}"
+
+[machine.env]
+TRUSTED_ERC20_PORTAL = "${erc20PortalAddress}"
+TRUSTED_ERC20_TOKEN = "${testUsdcAddress}"
+ACCOUNTS_LABEL = "accounts"
+
+[drives.accounts]
+builder = "empty"
+format = "raw"
+size = "4MB"
+mount = false
+user = "dapp"
+accounts_drive = true
+
+[prt.nodes.reference]
+type = "reference"
+claim = false
+
+[prt.nodes.blue]
+type = "sling"
+
+[prt.nodes.green]
+type = "sling"
+sentry = true
+`,
+        );
+
+        console.log("! Building the accounts-withdrawal application...");
+        const build = await buildApplication(appDir);
+        expect(build.exitCode, build.all).toBe(0);
+        console.log("✓ Built the accounts-withdrawal application");
+
+        ({ application, output, run } = await startApplication({
+            appDir,
+            epochLength: EPOCH_LENGTH,
+            extraArgs: [
+                "--prt",
+                "--claim-staging-period",
+                CLAIM_STAGING_PERIOD.toString(),
+            ],
+            projectName,
+        }));
+        anvil = await createAnvilClient(projectName);
+
+        // the PRT nodes start after the deploy, which is what startApplication waits for
+        console.log("! Waiting for the PRT nodes to start...");
+        await waitFor(async () => {
+            if (!output().includes("(devnet account 21, funded by the CLI)")) {
+                throw new Error("PRT nodes not started yet");
+            }
+        });
+        console.log("✓ PRT nodes started");
+    }, TIMEOUT);
+
+    afterAll(() => stopApplication({ cleanup, projectName, run }), TIMEOUT);
+
+    it(
+        "should appoint only the sentry on the consensus",
+        async () => {
+            const consensus = await getDaveConsensus({
+                application,
+                projectName,
+            });
+
+            expect(consensus.claimStagingPeriod).toBe(CLAIM_STAGING_PERIOD);
+            expect(consensus.sentries).toEqual([
+                { id: 1, address: devnetAccount(21) },
+            ]);
+        },
+        TIMEOUT,
+    );
+
+    // the node follows the tournaments and records settled epochs, with no
+    // PRT signer: the identity line of a submitting node never shows
+    it(
+        "should run the rollups-node in reader mode, with no PRT signer",
+        async () => {
+            const { stdout } = await execa("docker", [
+                "compose",
+                "-p",
+                projectName,
+                "exec",
+                "-T",
+                "rollups_node",
+                "sh",
+                "-c",
+                'echo "$CARTESI_FEATURE_CLAIM_SUBMISSION_ENABLED:$CARTESI_PRT_AUTH_MNEMONIC"',
+            ]);
+
+            expect(stdout.trim()).toBe("false:");
+            expect(await logsOf("rollups_node")).not.toContain(
+                "PRT submitter identity",
+            );
+        },
+        TIMEOUT,
+    );
+
+    it("should print the node's mode first, then the validator and the sentry", () => {
+        const printed = output();
+        const node = printed.indexOf(
+            "rollups-node reads (claim = false, no PRT signer)",
+        );
+        const validator = printed.indexOf(
+            `validator blue ${devnetAccount(20)} (devnet account 20, funded by the CLI)`,
+        );
+        const sentry = printed.indexOf(
+            `sentry 1 green ${devnetAccount(21)} (devnet account 21, funded by the CLI)`,
+        );
+
+        expect(node).toBeGreaterThan(printed.indexOf("contract deployed at"));
+        expect(validator).toBeGreaterThan(node);
+        expect(sentry).toBeGreaterThan(validator);
+    });
+
+    // the sling node reads its role from the consensus: a signer in no slot
+    // disputes and settles, a signer in a slot also casts sentry claims
+    it(
+        "should log the validator as no sentry, and the sentry with its slot",
+        async () => {
+            await waitFor(async () => {
+                const [validator, sentry] = await Promise.all(
+                    services.map(logsOf),
+                );
+                if (!validator.includes("is not a sentry of consensus")) {
+                    throw new Error("the validator hasn't logged its role yet");
+                }
+                if (!sentry.includes("is sentry 1 of consensus")) {
+                    throw new Error("the sentry hasn't logged its role yet");
+                }
+            });
+        },
+        TIMEOUT,
+    );
+
+    // only the sling nodes can stage and accept here, and only the sentry's
+    // vote lets them accept inside the staging period
+    it(
+        "should accept a claim inside the staging period, with the node reading",
+        async () => {
+            await deposit(anvil, application, devnetAccount(2), 1000n);
+            const start = await anvil.getBlockNumber();
+
+            let accepted: Awaited<ReturnType<typeof getLastAcceptedEpoch>>;
+            const mined = await mineUntil(anvil, async () => {
+                accepted = await getLastAcceptedEpoch({
+                    application,
+                    projectName,
+                });
+                return accepted !== undefined;
+            });
+            console.log(
+                `! Accepted epoch ${accepted?.index} after ${mined} mined blocks, from block ${start}`,
+            );
+
+            expect(accepted, await logsOf("prt-node-blue")).toBeDefined();
+            expect(accepted?.index).toBe(0n);
+            expect(mined).toBeLessThan(CLAIM_STAGING_PERIOD);
+            expect(await logsOf("rollups_node")).not.toContain(
+                "PRT submitter identity",
+            );
+        },
+        TIMEOUT,
+    );
+
+    it("should show the node, the validator and the sentry in cartesi logs", async () => {
+        const { all, exitCode } = await runCli({ appDir, projectName }, [
+            "logs",
+            "--tail",
+            "5",
+        ]);
+
+        expect(exitCode).toBe(0);
+        expect(all).toContain("rollups_node-1");
+        expect(all).toContain("prt-node-blue-1");
+        expect(all).toContain("prt-node-green-1");
+    });
+});
diff --git a/apps/cli/tests/integration/commands/prt.test.ts b/apps/cli/tests/integration/commands/prt.test.ts
new file mode 100644
index 00000000..38927ce2
--- /dev/null
+++ b/apps/cli/tests/integration/commands/prt.test.ts
@@ -0,0 +1,355 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { execa, type ResultPromise } from "execa";
+import fs from "fs-extra";
+import os from "node:os";
+import path from "node:path";
+import { type Address, parseEther } from "viem";
+import { erc20PortalAddress, testUsdcAddress } from "../../../src/contracts";
+import {
+    getDaveConsensus,
+    getLastAcceptedEpoch,
+} from "../../../src/exec/rollups";
+import { PRT_FUNDING } from "../../../src/prt";
+import { TEST_SDK } from "../config";
+import {
+    type AnvilClient,
+    buildApplication,
+    createAnvilClient,
+    deposit,
+    devnetAccount,
+    runCli,
+    startApplication,
+    stopApplication,
+    TIMEOUT,
+    waitFor,
+} from "../devnet";
+
+/**
+ * Covers `cartesi run --prt` with sentries from [prt]: the application is
+ * deployed on a DaveConsensus with the sentries and the manager the config
+ * names, in order; the CLI funds the pool accounts and runs a sling node for
+ * each; a claim they agree with is accepted without waiting out the staging
+ * period; and a claim one of them is missing from waits, until it claims.
+ */
+
+const EPOCH_LENGTH = 10;
+
+// long enough that acceptance within the test can only come from the sentries
+const CLAIM_STAGING_PERIOD = 1_000_000;
+
+// a lone claim wins its root tournament by timeout after about 700 blocks on
+// the devnet clock; two epochs fit well within this
+const MAX_BLOCKS = 4_000;
+const BLOCKS_PER_STEP = 25;
+
+// mined on top of a staged claim nobody may accept, to show that nobody does
+const GRACE_BLOCKS = 500;
+
+const fixture = path.join(__dirname, "fixtures", "accounts-withdrawal");
+const projectName = `prt-${process.pid}`;
+
+const sentryManager = devnetAccount(5);
+const sentryServices = ["prt-node-first", "prt-node-second"];
+
+const sentryLogs = async () => {
+    const { all } = await execa(
+        "docker",
+        [
+            "compose",
+            "-p",
+            projectName,
+            "logs",
+            "--tail",
+            "40",
+            ...sentryServices,
+        ],
+        { all: true, reject: false },
+    );
+    return all;
+};
+
+/**
+ * Mines in steps until `done` holds or the budget is spent, letting the node
+ * and the sentries see the blocks between steps.
+ * @returns the blocks mined; the caller checks `done` held
+ */
+const mineUntil = async (
+    anvil: AnvilClient,
+    done: () => Promise<boolean>,
+    maxBlocks = MAX_BLOCKS,
+): Promise<number> => {
+    let mined = 0;
+    while (mined < maxBlocks) {
+        await anvil.mine({ blocks: BLOCKS_PER_STEP });
+        mined += BLOCKS_PER_STEP;
+        if (await done()) {
+            break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    return mined;
+};
+
+describe("prt", () => {
+    let appDir: string;
+    let cleanup: () => void;
+    let run: ResultPromise | undefined;
+    let application: Address;
+    let output: () => string;
+    let anvil: AnvilClient;
+
+    beforeAll(async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "prt-"));
+        cleanup = () => fs.removeSync(dir);
+        appDir = path.join(dir, "accounts-withdrawal");
+        await fs.copy(fixture, appDir);
+        await fs.writeFile(
+            path.join(appDir, "cartesi.toml"),
+            `sdk = "${TEST_SDK}"
+
+[machine.env]
+TRUSTED_ERC20_PORTAL = "${erc20PortalAddress}"
+TRUSTED_ERC20_TOKEN = "${testUsdcAddress}"
+ACCOUNTS_LABEL = "accounts"
+
+[drives.accounts]
+builder = "empty"
+format = "raw"
+size = "4MB"
+mount = false
+user = "dapp"
+accounts_drive = true
+
+[prt]
+sentry_manager = "${sentryManager}"
+
+[prt.nodes.first]
+type = "sling"
+sentry = true
+
+[prt.nodes.second]
+type = "sling"
+sentry = true
+`,
+        );
+
+        console.log("! Building the accounts-withdrawal application...");
+        const build = await buildApplication(appDir);
+        expect(build.exitCode, build.all).toBe(0);
+        console.log("✓ Built the accounts-withdrawal application");
+
+        ({ application, output, run } = await startApplication({
+            appDir,
+            epochLength: EPOCH_LENGTH,
+            extraArgs: [
+                "--prt",
+                "--claim-staging-period",
+                CLAIM_STAGING_PERIOD.toString(),
+            ],
+            projectName,
+        }));
+        anvil = await createAnvilClient(projectName);
+
+        // the sentries start after the deploy, which is what startApplication waits for
+        console.log("! Waiting for the sentries to start...");
+        await waitFor(async () => {
+            if (!output().includes("(devnet account 21, funded by the CLI)")) {
+                throw new Error("sentries not started yet");
+            }
+        });
+        console.log("✓ Sentries started");
+    }, TIMEOUT);
+
+    afterAll(() => stopApplication({ cleanup, projectName, run }), TIMEOUT);
+
+    it(
+        "should appoint the sentries of [prt] on the consensus, in order",
+        async () => {
+            const consensus = await getDaveConsensus({
+                application,
+                projectName,
+            });
+
+            expect(consensus.sentryManager).toBe(sentryManager);
+            expect(consensus.claimStagingPeriod).toBe(CLAIM_STAGING_PERIOD);
+            expect(consensus.sentries).toEqual([
+                { id: 1, address: devnetAccount(20) },
+                { id: 2, address: devnetAccount(21) },
+            ]);
+        },
+        TIMEOUT,
+    );
+
+    it(
+        "should run a sling node for each sentry, on a funded pool account",
+        async () => {
+            // the sentries are up only once the application is deployed
+            const { stdout } = await execa("docker", [
+                "compose",
+                "-p",
+                projectName,
+                "ps",
+                "--services",
+                "--status",
+                "running",
+            ]);
+            expect(stdout.split("\n")).toEqual(
+                expect.arrayContaining(sentryServices),
+            );
+
+            // set by the CLI, less the gas the sentries spent since
+            for (const index of [20, 21]) {
+                const balance = await anvil.getBalance({
+                    address: devnetAccount(index),
+                });
+                expect(balance).toBeGreaterThan(PRT_FUNDING - parseEther("1"));
+                expect(balance).toBeLessThanOrEqual(PRT_FUNDING);
+            }
+        },
+        TIMEOUT,
+    );
+
+    // printed once the sentries run, after the deploy; the check mark before
+    // each line is the terminal's, so the lines are matched without it
+    it("should print the manager and each sentry with its devnet account", () => {
+        const printed = output();
+        const deployed = printed.indexOf("contract deployed at");
+
+        expect(deployed).toBeGreaterThan(-1);
+        expect(
+            printed.indexOf(`sentry manager ${sentryManager}`),
+        ).toBeGreaterThan(deployed);
+        expect(printed).toContain(
+            `sentry 1 first ${devnetAccount(20)} (devnet account 20, funded by the CLI)`,
+        );
+        expect(printed).toContain(
+            `sentry 2 second ${devnetAccount(21)} (devnet account 21, funded by the CLI)`,
+        );
+    });
+
+    // the shell's View logs runs `cartesi logs --follow`, so the sentries
+    // must show there, next to the node
+    it("should show the node and the sentries in cartesi logs", async () => {
+        const { all, exitCode } = await runCli({ appDir, projectName }, [
+            "logs",
+            "--tail",
+            "5",
+        ]);
+
+        expect(exitCode).toBe(0);
+        expect(all).toContain("rollups_node-1");
+        expect(all).toContain("prt-node-first-1");
+        expect(all).toContain("prt-node-second-1");
+    });
+
+    it("should show one service named, without a prefix", async () => {
+        const { all, exitCode } = await runCli({ appDir, projectName }, [
+            "logs",
+            "--tail",
+            "5",
+            "prt-node-first",
+        ]);
+
+        expect(exitCode).toBe(0);
+        expect(all?.trim().length).toBeGreaterThan(0);
+        expect(all).not.toContain("prt-node-first-1");
+    });
+
+    it("should reject a service the environment doesn't have", async () => {
+        const { all, exitCode } = await runCli({ appDir, projectName }, [
+            "logs",
+            "prt-node-third",
+        ]);
+
+        expect(exitCode).not.toBe(0);
+        expect(all).toContain("service prt-node-third not found");
+    });
+
+    // with the staging period out of reach, the node accepts a staged claim
+    // only when every sentry claimed the same result
+    it(
+        "should accept a claim the sentries agree with, within the staging period",
+        async () => {
+            await deposit(anvil, application, devnetAccount(2), 1000n);
+            const start = await anvil.getBlockNumber();
+
+            let accepted: Awaited<ReturnType<typeof getLastAcceptedEpoch>>;
+            const mined = await mineUntil(anvil, async () => {
+                accepted = await getLastAcceptedEpoch({
+                    application,
+                    projectName,
+                });
+                return accepted !== undefined;
+            });
+            console.log(
+                `! Accepted epoch ${accepted?.index} after ${mined} mined blocks, from block ${start}`,
+            );
+
+            expect(accepted, await sentryLogs()).toBeDefined();
+            expect(accepted?.index).toBe(0n);
+            expect(mined).toBeLessThan(CLAIM_STAGING_PERIOD);
+        },
+        TIMEOUT,
+    );
+
+    // the consensus accepts early only when every sentry claimed the staged
+    // result, so one sentry down means the staging period applies again; a
+    // sentry that comes back claims the epoch it missed, and acceptance follows
+    it(
+        "should wait for a sentry that is down, and accept once it claims",
+        async () => {
+            const sentry = (command: "stop" | "start") =>
+                execa("docker", [
+                    "compose",
+                    "-p",
+                    projectName,
+                    command,
+                    "prt-node-second",
+                ]);
+            const lastAccepted = async () =>
+                (await getLastAcceptedEpoch({ application, projectName }))
+                    ?.index;
+            const allSentriesAgree = async () =>
+                (await getDaveConsensus({ application, projectName }))
+                    .allSentriesAgree;
+
+            await sentry("stop");
+            let staged: number;
+            try {
+                // epoch 1, sealed with the deposit above when epoch 0 was
+                // accepted: the node's claim wins its tournament by timeout
+                // and gets staged, which is when the consensus reports the
+                // sentries' agreement
+                staged = await mineUntil(
+                    anvil,
+                    async () => (await allSentriesAgree()) !== undefined,
+                );
+                expect(await allSentriesAgree(), await sentryLogs()).toBe(
+                    false,
+                );
+                expect(await lastAccepted()).toBe(0n);
+
+                // nobody may accept it: the staging period is out of reach
+                await anvil.mine({ blocks: GRACE_BLOCKS });
+                await new Promise((resolve) => setTimeout(resolve, 2000));
+                expect(await lastAccepted()).toBe(0n);
+            } finally {
+                await sentry("start");
+            }
+
+            const accepted = await mineUntil(
+                anvil,
+                async () => (await lastAccepted()) === 1n,
+            );
+            console.log(
+                `! Epoch 1 staged after ${staged} mined blocks without sentry 2, accepted ${accepted} blocks after it came back`,
+            );
+
+            expect(await lastAccepted(), await sentryLogs()).toBe(1n);
+            expect(staged + GRACE_BLOCKS + accepted).toBeLessThan(
+                CLAIM_STAGING_PERIOD,
+            );
+        },
+        TIMEOUT,
+    );
+});
diff --git a/apps/cli/tests/integration/commands/recovery.test.ts b/apps/cli/tests/integration/commands/recovery.test.ts
index 2ffb6158..9c1b634f 100644
--- a/apps/cli/tests/integration/commands/recovery.test.ts
+++ b/apps/cli/tests/integration/commands/recovery.test.ts
@@ -42,8 +42,10 @@ import {
  * The runtime must ship a rollups node with the refund command, as the
  * default SDK does.
  *
- * Inputs: alice (0), bob (1) and erin (2) are finalized in epoch 0; carol (3)
- * and dave (4) stay in the open epoch 1 and are refunded.
+ * Inputs: alice (0), bob (1), erin (2) and frank (3) are finalized in epoch 0;
+ * carol (4) and dave (5) stay in the open epoch 1 and are refunded. frank
+ * deposits nothing, leaving an account with no balance in the drive, which
+ * must not stop the other accounts from being proven.
  */
 
 const EPOCH_LENGTH = 720;
@@ -56,13 +58,21 @@ const bob = devnetAccount(2);
 const carol = devnetAccount(3);
 const dave = devnetAccount(4);
 const erin = devnetAccount(5);
+const frank = devnetAccount(6);
 
 // the guardian comes from a mnemonic the node doesn't sign with
 const guardianMnemonic =
     "legal winner thank year wave sausage worth useful legal winner thank yellow";
 const guardian = mnemonicToAccount(guardianMnemonic).address;
 
-const amounts = { alice: 100n, bob: 50n, carol: 25n, dave: 15n, erin: 10n };
+const amounts = {
+    alice: 100n,
+    bob: 50n,
+    carol: 25n,
+    dave: 15n,
+    erin: 10n,
+    frank: 0n,
+};
 
 const count = (text: string, part: string) => text.split(part).length - 1;
 
@@ -177,6 +187,7 @@ guardian = "${guardian}"
             await deposit(alice, amounts.alice);
             await deposit(bob, amounts.bob);
             await deposit(erin, amounts.erin);
+            await deposit(frank, amounts.frank);
 
             // close the first epoch and wait for its claim to be accepted
             await anvil.mine({ blocks: EPOCH_LENGTH });
@@ -193,7 +204,7 @@ guardian = "${guardian}"
             await deposit(carol, amounts.carol);
             await deposit(dave, amounts.dave);
             await waitFor(() =>
-                getNodeInput({ application, inputIndex: 4n, projectName }),
+                getNodeInput({ application, inputIndex: 5n, projectName }),
             );
         },
         TIMEOUT,
@@ -203,7 +214,7 @@ guardian = "${guardian}"
         it(
             "should pass the node's NotForeclosed error through on refund",
             async () => {
-                const refund = await cli(["refund", "3", "--yes"]);
+                const refund = await cli(["refund", "4", "--yes"]);
                 expect(refund.exitCode).not.toBe(0);
                 expect(refund.all).toContain("NotForeclosed");
             },
@@ -273,10 +284,10 @@ guardian = "${guardian}"
             "should refund a deposit that was not finalized",
             async () => {
                 expect(await usdcBalance(carol)).toBe(0n);
-                const refund = await cli(["refund", "3", "--yes", "--json"]);
+                const refund = await cli(["refund", "4", "--yes", "--json"]);
                 expect(refund.exitCode, refund.all).toBe(0);
                 expect(JSON.parse(refund.stdout)).toMatchObject({
-                    input_index: "3",
+                    input_index: "4",
                 });
                 expect(await usdcBalance(carol)).toBe(amounts.carol);
             },
@@ -288,7 +299,7 @@ guardian = "${guardian}"
             async () => {
                 const rawData = await getNodeInput({
                     application,
-                    inputIndex: 4n,
+                    inputIndex: 5n,
                     projectName,
                 });
                 const inputFile = path.join(appDir, "dave-input.hex");
@@ -296,7 +307,7 @@ guardian = "${guardian}"
                 expect(await usdcBalance(dave)).toBe(0n);
                 const refund = await cli([
                     "refund",
-                    "4",
+                    "5",
                     "--input-file",
                     inputFile,
                     "--yes",
diff --git a/apps/cli/tests/integration/commands/run.test.ts b/apps/cli/tests/integration/commands/run.test.ts
new file mode 100644
index 00000000..78d9d735
--- /dev/null
+++ b/apps/cli/tests/integration/commands/run.test.ts
@@ -0,0 +1,305 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { execa } from "execa";
+import fs from "fs-extra";
+import os from "node:os";
+import path from "node:path";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+import { TEST_RUNTIME_VERSION } from "../config";
+import { cliPath } from "../devnet";
+
+/**
+ * Covers what `cartesi run` checks before it starts anything. A dry run only
+ * renders the compose configuration, so no environment is started and no
+ * application needs to be built.
+ */
+describe("run", () => {
+    let dir: string;
+
+    beforeAll(() => {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), "run-"));
+    });
+
+    afterAll(() => fs.removeSync(dir));
+
+    const dryRun = (args: string[], env?: Record<string, string>) =>
+        execa(
+            "node",
+            [
+                cliPath,
+                "run",
+                "--dry-run",
+                "--runtime-version",
+                TEST_RUNTIME_VERSION,
+                ...args,
+            ],
+            { all: true, cwd: dir, env, reject: false },
+        );
+
+    describe("--default-block", () => {
+        it("should pass a supported default block to the node", async () => {
+            const { all, exitCode } = await dryRun(["--default-block", "safe"]);
+
+            expect(exitCode, all).toBe(0);
+            expect(all).toContain("CARTESI_BLOCKCHAIN_DEFAULT_BLOCK: safe");
+        });
+
+        // the node refuses to start with 'pending', so the CLI rejects it
+        // before rendering anything
+        it("should reject pending before rendering the configuration", async () => {
+            const { all, exitCode } = await dryRun([
+                "--default-block",
+                "pending",
+            ]);
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                "Allowed choices are latest, safe, finalized",
+            );
+            expect(all).not.toContain("CARTESI_BLOCKCHAIN_DEFAULT_BLOCK");
+        });
+    });
+
+    describe("host variables", () => {
+        // compose prints the value it would pass as `$$`, the way it reads it
+        // back; unescaped, it would have replaced `$t` with nothing
+        it("should keep the $ in a forwarded node variable", async () => {
+            const { all, exitCode } = await dryRun([], {
+                CARTESI_BLOCKCHAIN_HTTP_AUTHORIZATION: "Bearer s3cr$t",
+            });
+
+            expect(exitCode, all).toBe(0);
+            expect(all).toContain(
+                "CARTESI_BLOCKCHAIN_HTTP_AUTHORIZATION: Bearer s3cr$$t",
+            );
+        });
+    });
+
+    describe("key files", () => {
+        it("should hand the node a copy of a key file named on the host", async () => {
+            fs.writeFileSync(path.join(dir, "claimer.key"), "0xsecret\n");
+
+            const { all, exitCode } = await dryRun([], {
+                CARTESI_AUTH_PRIVATE_KEY_FILE: "claimer.key",
+            });
+
+            expect(exitCode, all).toBe(0);
+            expect(all).toContain(
+                "CARTESI_AUTH_PRIVATE_KEY_FILE: /run/secrets/cartesi_auth_private_key_file",
+            );
+            expect(all).toContain("node-secret-init:");
+            expect(all).toContain("condition: service_completed_successfully");
+            expect(all).toContain(path.join(dir, "claimer.key"));
+            expect(all).not.toContain("0xsecret");
+        });
+
+        it("should reject a missing key file before rendering", async () => {
+            const { all, exitCode } = await dryRun([], {
+                CARTESI_AUTH_PRIVATE_KEY_FILE: "missing.key",
+            });
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                'CARTESI_AUTH_PRIVATE_KEY_FILE must name a readable file: "missing.key"',
+            );
+            expect(all).not.toContain("services:");
+        });
+    });
+
+    describe("[prt]", () => {
+        const sentries = `
+[prt]
+sentry_manager = "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc"
+
+[prt.nodes.first]
+type = "sling"
+sentry = true
+
+[prt.nodes.second]
+type = "sling"
+sentry = true
+`;
+        const config = (prt: string) => {
+            const file = path.join(dir, "prt.toml");
+            fs.writeFileSync(file, prt);
+            return ["--config", file];
+        };
+
+        // the section is read even without --prt, so a mistake fails early
+        it("should reject a duplicate sentry before rendering", async () => {
+            const { all, exitCode } = await dryRun([
+                "--prt",
+                ...config(`${sentries}
+[prt.nodes.third]
+sentry = true
+address = "0x70997970C51812dc3A010C7d01b50e0d17dc79C8"
+
+[prt.nodes.fourth]
+sentry = true
+address = "0x70997970c51812dc3a010c7d01b50e0d17dc79c8"
+`),
+            ]);
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain("[prt.nodes.fourth]");
+            expect(all).toContain("is also the address of [prt.nodes.third]");
+            expect(all).not.toContain("services:");
+        });
+
+        it("should ignore the section without --prt", async () => {
+            const { all, exitCode } = await dryRun(config(sentries));
+
+            expect(exitCode, all).toBe(0);
+            expect(all).toContain(
+                "[prt] in cartesi.toml is ignored without --prt",
+            );
+            expect(all).toContain("services:");
+        });
+
+        it("should render the configuration with --prt and sentries", async () => {
+            const { all, exitCode } = await dryRun([
+                "--prt",
+                ...config(sentries),
+            ]);
+
+            expect(exitCode, all).toBe(0);
+            expect(all).not.toContain("ignored without --prt");
+            expect(all).toContain("services:");
+        });
+
+        // a key file is read before anything starts, and never printed
+        it("should reject a key file that doesn't match the address, before rendering", async () => {
+            const named = privateKeyToAccount(generatePrivateKey());
+            const fileKey = generatePrivateKey();
+            const keyFile = path.join(dir, "sentry.key");
+            fs.writeFileSync(keyFile, `${fileKey}\n`);
+
+            const { all, exitCode } = await dryRun([
+                "--prt",
+                ...config(`
+[prt.nodes.mine]
+type = "sling"
+sentry = true
+address = "${named.address}"
+private_key_file = "${keyFile}"
+`),
+            ]);
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                `private_key_file "${keyFile}" is the key of ${privateKeyToAccount(fileKey).address}, not ${named.address}`,
+            );
+            expect(all).not.toContain(fileKey.slice(2));
+            expect(all).not.toContain("services:");
+        });
+
+        it("should reject a second reference node before rendering", async () => {
+            const { all, exitCode } = await dryRun([
+                "--prt",
+                ...config(`
+[prt.nodes.reference]
+type = "reference"
+
+[prt.nodes.node]
+type = "reference"
+`),
+            ]);
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                "Invalid [prt.nodes.node]: only one entry is the reference node, and [prt.nodes.reference] already is",
+            );
+            expect(all).not.toContain("services:");
+        });
+
+        // only the rollups-node can read instead of claiming, for now
+        it("should reject claim on a sling node before rendering", async () => {
+            const { all, exitCode } = await dryRun([
+                "--prt",
+                ...config('[prt.nodes.blue]\ntype = "sling"\nclaim = false\n'),
+            ]);
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                "Invalid [prt.nodes.blue]: claim isn't supported on a sling node yet: it always claims",
+            );
+            expect(all).not.toContain("services:");
+        });
+
+        // an entry the CLI doesn't run is only there to be appointed
+        it("should reject an appointed entry without sentry = true", async () => {
+            const { all, exitCode } = await dryRun([
+                "--prt",
+                ...config(
+                    '[prt.nodes.theirs]\naddress = "0x70997970C51812dc3A010C7d01b50e0d17dc79C8"\n',
+                ),
+            ]);
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                "Invalid [prt.nodes.theirs]: an entry without a type is appointed only, so it needs sentry = true",
+            );
+            expect(all).not.toContain("services:");
+        });
+
+        // with claim = false the node follows the tournaments and records
+        // settled epochs, and the host's PRT signer has no node to go to
+        it("should render the node in reader mode with claim = false", async () => {
+            const { all, exitCode } = await dryRun(
+                [
+                    "--prt",
+                    ...config(`
+[prt.nodes.reference]
+type = "reference"
+claim = false
+
+[prt.nodes.blue]
+type = "sling"
+
+[prt.nodes.green]
+type = "sling"
+sentry = true
+`),
+                ],
+                { CARTESI_PRT_AUTH_MNEMONIC_ACCOUNT_INDEX: "7" },
+            );
+
+            expect(exitCode, all).toBe(0);
+            expect(all).toContain(
+                'CARTESI_FEATURE_CLAIM_SUBMISSION_ENABLED: "false"',
+            );
+            // the warning names the variable, the rendered env must not
+            expect(all).not.toContain("CARTESI_PRT_AUTH_MNEMONIC:");
+            expect(all).toContain(
+                "WARNING: CARTESI_PRT_AUTH_MNEMONIC_ACCOUNT_INDEX is set, but [prt.nodes.reference] has claim = false, so the rollups-node runs in reader mode with no PRT signer and the value is dropped",
+            );
+        });
+    });
+
+    describe("CARTESI_BLOCKCHAIN_HTTP_ENDPOINT", () => {
+        it("should forward a supported endpoint to the node", async () => {
+            const { all, exitCode } = await dryRun([], {
+                CARTESI_BLOCKCHAIN_HTTP_ENDPOINT: "https://rpc.example.com/v1",
+            });
+
+            expect(exitCode, all).toBe(0);
+            expect(all).toContain(
+                "CARTESI_BLOCKCHAIN_HTTP_ENDPOINT: https://rpc.example.com/v1",
+            );
+        });
+
+        // the node only fails once its container starts, and hides the value
+        it("should reject an unsupported endpoint without showing it", async () => {
+            const { all, exitCode } = await dryRun([], {
+                CARTESI_BLOCKCHAIN_HTTP_ENDPOINT:
+                    "wss://rpc.example.com/SECRET",
+            });
+
+            expect(exitCode).not.toBe(0);
+            expect(all).toContain(
+                "CARTESI_BLOCKCHAIN_HTTP_ENDPOINT must be an http(s) URL",
+            );
+            expect(all).not.toContain("SECRET");
+            expect(all).not.toContain("services:");
+        });
+    });
+});
diff --git a/apps/cli/tests/integration/commands/send.test.ts b/apps/cli/tests/integration/commands/send.test.ts
new file mode 100644
index 00000000..c2a1c361
--- /dev/null
+++ b/apps/cli/tests/integration/commands/send.test.ts
@@ -0,0 +1,142 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import getPort, { portNumbers } from "get-port";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+    type Address,
+    decodeFunctionData,
+    numberToHex,
+    zeroAddress,
+    zeroHash,
+} from "viem";
+import {
+    inputBoxAbi,
+    inputBoxAddress,
+    inputsAbi,
+    selfHostedApplicationFactoryAbi,
+    selfHostedApplicationFactoryAddress,
+} from "../../../src/contracts";
+import {
+    startEnvironment,
+    stopEnvironment,
+    waitHealthyEnvironment,
+} from "../../../src/exec/rollups";
+import { TEST_RUNTIME_VERSION } from "../config";
+import { createAnvilClient, devnetAccount, runCli } from "../devnet";
+
+// The InputBox only takes inputs for an application contract, but the node
+// doesn't need to run it: each case creates one with the factory, with no
+// machine behind it, and reads the sender back from the input the InputBox
+// recorded.
+describe("send", () => {
+    const projectName = `cli-send-${process.pid}`;
+    let directory: string;
+    let originalCwd: string;
+
+    beforeAll(async () => {
+        originalCwd = process.cwd();
+        directory = fs.mkdtempSync(path.join(os.tmpdir(), "send-"));
+        // compose files are written relative to the working directory
+        process.chdir(directory);
+        const port = await getPort({ port: portNumbers(16762, 16772) });
+        await startEnvironment({
+            blockTime: 1,
+            defaultBlock: "latest",
+            detach: true,
+            dryRun: false,
+            port,
+            projectName,
+            runtimeVersion: TEST_RUNTIME_VERSION,
+            services: [],
+            verbose: false,
+        });
+        await waitHealthyEnvironment({ port, projectName, services: [] });
+    }, 300_000);
+
+    afterAll(async () => {
+        try {
+            await stopEnvironment({ projectName });
+        } finally {
+            process.chdir(originalCwd);
+            fs.rmSync(directory, { recursive: true, force: true });
+        }
+    });
+
+    /** Creates an application contract the node doesn't know of. */
+    const createApplication = async (salt: number) => {
+        const anvil = await createAnvilClient(projectName);
+        const owner = devnetAccount(3);
+        const { request, result } = await anvil.simulateContract({
+            abi: selfHostedApplicationFactoryAbi,
+            account: owner,
+            address: selfHostedApplicationFactoryAddress,
+            args: [
+                owner,
+                720n,
+                0n,
+                zeroHash,
+                inputBoxAddress,
+                {
+                    guardian: zeroAddress,
+                    log2LeavesPerAccount: 0,
+                    log2MaxNumOfAccounts: 0,
+                    accountsDriveStartIndex: 0n,
+                    withdrawalOutputBuilder: zeroAddress,
+                },
+                numberToHex(salt, { size: 32 }),
+            ],
+            functionName: "deployContracts",
+        });
+        const hash = await anvil.writeContract(request);
+        await anvil.waitForTransactionReceipt({ hash });
+        return result[0];
+    };
+
+    /** Sends an input with the CLI and returns its sender. */
+    const sendInput = async (application: Address, args: string[] = []) => {
+        const { all, exitCode } = await runCli(
+            { appDir: directory, projectName },
+            [
+                "send",
+                "--application",
+                application,
+                "--encoding",
+                "string",
+                ...args,
+                "hello",
+            ],
+        );
+        expect(exitCode, all).toBe(0);
+
+        const anvil = await createAnvilClient(projectName);
+        const events = await anvil.getContractEvents({
+            abi: inputBoxAbi,
+            address: inputBoxAddress,
+            args: { appContract: application },
+            eventName: "InputAdded",
+            fromBlock: 0n,
+        });
+        expect(events).toHaveLength(1);
+        const { args: input } = decodeFunctionData({
+            abi: inputsAbi,
+            data: events[0].args.input ?? "0x",
+        });
+        return input[2];
+    };
+
+    // the node signs its claims with account 0, so inputs must not come from it
+    it("should send from devnet account 8 by default", async () => {
+        const application = await createApplication(1);
+
+        expect(await sendInput(application)).toBe(devnetAccount(8));
+    });
+
+    it("should send from the --from account", async () => {
+        const application = await createApplication(2);
+
+        expect(await sendInput(application, ["--from", devnetAccount(2)])).toBe(
+            devnetAccount(2),
+        );
+    });
+});
diff --git a/apps/cli/tests/integration/commands/undeploy.test.ts b/apps/cli/tests/integration/commands/undeploy.test.ts
new file mode 100644
index 00000000..6c4a08f3
--- /dev/null
+++ b/apps/cli/tests/integration/commands/undeploy.test.ts
@@ -0,0 +1,141 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import type { ResultPromise } from "execa";
+import fs from "fs-extra";
+import os from "node:os";
+import path from "node:path";
+import { erc20PortalAddress, testUsdcAddress } from "../../../src/contracts";
+import { type Address, numberToHex } from "viem";
+import {
+    deployApplication,
+    getDeployments,
+    removeApplication,
+} from "../../../src/exec/rollups";
+import { TEST_SDK } from "../config";
+import {
+    buildApplication,
+    startApplication,
+    stopApplication,
+    TIMEOUT,
+} from "../devnet";
+
+/**
+ * Covers the undeploy and the redeploy `cartesi run` does for a rebuilt
+ * application. The shell that rebuilds needs a terminal, so both are called
+ * the way the shell calls them, against an application of its own.
+ */
+
+const EPOCH_LENGTH = 720;
+
+const fixture = path.join(__dirname, "fixtures", "accounts-withdrawal");
+const projectName = `undeploy-${process.pid}`;
+
+describe("undeploy", () => {
+    let appDir: string;
+    let cleanup: () => void;
+    let run: ResultPromise | undefined;
+    let consensus: Address | undefined;
+
+    beforeAll(async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "undeploy-"));
+        cleanup = () => fs.removeSync(dir);
+        appDir = path.join(dir, "accounts-withdrawal");
+        await fs.copy(fixture, appDir);
+        await fs.writeFile(
+            path.join(appDir, "cartesi.toml"),
+            `sdk = "${TEST_SDK}"
+
+[machine.env]
+TRUSTED_ERC20_PORTAL = "${erc20PortalAddress}"
+TRUSTED_ERC20_TOKEN = "${testUsdcAddress}"
+ACCOUNTS_LABEL = "accounts"
+
+[drives.accounts]
+builder = "empty"
+format = "raw"
+size = "4MB"
+mount = false
+user = "dapp"
+accounts_drive = true
+`,
+        );
+
+        console.log("! Building the accounts-withdrawal application...");
+        const build = await buildApplication(appDir);
+        expect(build.exitCode, build.all).toBe(0);
+        console.log("✓ Built the accounts-withdrawal application");
+
+        ({ run } = await startApplication({
+            appDir,
+            epochLength: EPOCH_LENGTH,
+            projectName,
+        }));
+
+        // read before any case removes the application
+        const deployments = await getDeployments({ projectName });
+        consensus = deployments.find(
+            ({ name }) => name === projectName,
+        )?.consensus;
+    }, TIMEOUT);
+
+    afterAll(() => stopApplication({ cleanup, projectName, run }), TIMEOUT);
+
+    // the node refuses to remove an application unless the removal
+    // acknowledges the work it abandons
+    it(
+        "should remove the deployed application",
+        async () => {
+            await removeApplication({
+                application: projectName,
+                force: true,
+                projectName,
+            });
+
+            const deployments = await getDeployments({ projectName });
+            expect(deployments.map(({ name }) => name)).not.toContain(
+                projectName,
+            );
+        },
+        TIMEOUT,
+    );
+
+    // the shell redeploys a rebuilt machine on the consensus of the first
+    // deploy, which the node does through the application factory
+    it(
+        "should deploy an application on an existing consensus",
+        async () => {
+            expect(consensus).toBeDefined();
+            const name = `${projectName}-redeploy`;
+
+            const deployment = await deployApplication({
+                claimStagingPeriod: 0,
+                consensus,
+                epochLength: EPOCH_LENGTH,
+                name,
+                projectName,
+                salt: numberToHex(1, { size: 32 }),
+                snapshotPath: "/var/lib/cartesi-rollups-node/snapshots/image",
+            });
+
+            expect(deployment.consensus).toBe(consensus as Address);
+            const deployments = await getDeployments({ projectName });
+            expect(deployments.map(({ name }) => name)).toContain(name);
+        },
+        TIMEOUT,
+    );
+
+    // a failed removal must reach the caller, or a rebuild would deploy over
+    // an application that is still registered
+    it(
+        "should fail to remove an application that was never deployed",
+        async () => {
+            await expect(
+                removeApplication({
+                    application: "never-deployed",
+                    force: true,
+                    projectName,
+                }),
+            ).rejects.toThrow();
+        },
+        TIMEOUT,
+    );
+});
diff --git a/apps/cli/tests/integration/commands/withdrawal-layouts.test.ts b/apps/cli/tests/integration/commands/withdrawal-layouts.test.ts
index 350e7529..02ed278c 100644
--- a/apps/cli/tests/integration/commands/withdrawal-layouts.test.ts
+++ b/apps/cli/tests/integration/commands/withdrawal-layouts.test.ts
@@ -65,9 +65,7 @@ ${layout.accountsSize ? `ACCOUNTS_SIZE = "${layout.accountsSize}"` : ""}
 };
 
 layouts.forEach((layout, index) => {
-    const describeLayout = layout.skip ? describe.skip : describe;
-
-    describeLayout(`emergency withdrawal from ${layout.name}`, () => {
+    describe(`emergency withdrawal from ${layout.name}`, () => {
         const projectName = `layouts-${index}-${process.pid}`;
         let appDir: string;
         let cleanup: () => void;
diff --git a/apps/cli/tests/integration/devnet.ts b/apps/cli/tests/integration/devnet.ts
index 96b94016..21483791 100644
--- a/apps/cli/tests/integration/devnet.ts
+++ b/apps/cli/tests/integration/devnet.ts
@@ -134,13 +134,20 @@ export const deposit = async (
 /**
  * Starts the environment with `cartesi run` and waits for the application to
  * be deployed.
+ * @returns `output` reads what `cartesi run` has printed so far
  */
 export const startApplication = async (options: {
     appDir: string;
     epochLength: number;
+    /** further `cartesi run` arguments, e.g. `--prt` */
+    extraArgs?: string[];
     projectName: string;
-}): Promise<{ application: Address; run: ResultPromise }> => {
-    const { appDir, epochLength, projectName } = options;
+}): Promise<{
+    application: Address;
+    output: () => string;
+    run: ResultPromise;
+}> => {
+    const { appDir, epochLength, extraArgs = [], projectName } = options;
 
     // without a terminal the environment runs in the foreground
     console.log(`! Starting the environment ${projectName}...`);
@@ -157,6 +164,7 @@ export const startApplication = async (options: {
             epochLength.toString(),
             "--block-time",
             "1",
+            ...extraArgs,
         ],
         {
             all: true,
@@ -165,6 +173,11 @@ export const startApplication = async (options: {
         },
     );
 
+    // the process keeps running, so its output is read as it comes
+    const chunks: string[] = [];
+    run.all?.on("data", (chunk) => chunks.push(String(chunk)));
+    const output = () => chunks.join("");
+
     const application = await waitFor(async () => {
         if (run.nodeChildProcess.exitCode !== null) {
             const { all } = await run;
@@ -178,7 +191,7 @@ export const startApplication = async (options: {
     }, 600);
     console.log(`✓ Application deployed at ${application}`);
 
-    return { application, run };
+    return { application, output, run };
 };
 
 /**
diff --git a/apps/cli/tests/integration/node-startup.test.ts b/apps/cli/tests/integration/node-startup.test.ts
index 57b0dde1..e82781d5 100644
--- a/apps/cli/tests/integration/node-startup.test.ts
+++ b/apps/cli/tests/integration/node-startup.test.ts
@@ -4,6 +4,10 @@ import getPort, { portNumbers } from "get-port";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { toHex } from "viem";
+import { mnemonicToAccount } from "viem/accounts";
+import { DEVNET_MNEMONIC } from "../../src/compose/node.js";
+import { execNodeCommand } from "../../src/exec/node-container.js";
 import {
     startEnvironment,
     stopEnvironment,
@@ -17,6 +21,7 @@ import { TEST_RUNTIME_VERSION } from "./config.js";
 // is needed: the node serves /livez before any application is deployed.
 describe("rollups node startup", () => {
     const projectName = `cli-node-startup-${process.pid}`;
+    const keysProjectName = `cli-node-startup-keys-${process.pid}`;
     let port: number;
     let directory: string;
     let originalCwd: string;
@@ -32,6 +37,7 @@ describe("rollups node startup", () => {
     afterAll(async () => {
         try {
             await stopEnvironment({ projectName });
+            await stopEnvironment({ projectName: keysProjectName });
         } finally {
             process.chdir(originalCwd);
             fs.rmSync(directory, { recursive: true, force: true });
@@ -67,4 +73,91 @@ describe("rollups node startup", () => {
         // proves the signer was used and not merely that the node booted
         expect(stdout).toContain("PRT submitter identity");
     }, 300_000);
+
+    // the node runs as uid 102 and a key file is usually its owner's alone, so
+    // the CLI hands the node a copy it owns; a PRT identity of the key file's
+    // account, not the mnemonic's account 0, proves the node read it
+    it("should reach a healthy node with owner-only key files", async () => {
+        const writeKey = (name: string, addressIndex: number) => {
+            const account = mnemonicToAccount(DEVNET_MNEMONIC, {
+                addressIndex,
+            });
+            const privateKey = account.getHdKey().privateKey;
+            if (!privateKey) {
+                throw new Error(`no private key for account ${addressIndex}`);
+            }
+            const file = path.join(directory, name);
+            fs.writeFileSync(file, `${toHex(privateKey)}\n`, { mode: 0o600 });
+            return { address: account.address, file };
+        };
+        const claimer = writeKey("claimer.key", 0);
+        const prt = writeKey("prt.key", 6);
+        const keyVars = {
+            CARTESI_AUTH_KIND: "private_key_file",
+            CARTESI_AUTH_PRIVATE_KEY_FILE: claimer.file,
+            CARTESI_PRT_AUTH_KIND: "private_key_file",
+            CARTESI_PRT_AUTH_PRIVATE_KEY_FILE: prt.file,
+        };
+        const keysPort = await getPort({ port: portNumbers(16751, 16761) });
+
+        Object.assign(process.env, keyVars);
+        try {
+            await startEnvironment({
+                blockTime: 1,
+                defaultBlock: "latest",
+                detach: true,
+                dryRun: false,
+                port: keysPort,
+                projectName: keysProjectName,
+                prt: false,
+                runtimeVersion: TEST_RUNTIME_VERSION,
+                services: [],
+                verbose: false,
+            });
+        } finally {
+            for (const name of Object.keys(keyVars)) {
+                delete process.env[name];
+            }
+        }
+
+        await waitHealthyEnvironment({
+            port: keysPort,
+            projectName: keysProjectName,
+            services: [],
+        });
+
+        const { stdout } = await execa("docker", [
+            "compose",
+            "--project-name",
+            keysProjectName,
+            "logs",
+            "rollups_node",
+        ]);
+
+        expect(stdout).toMatch(
+            new RegExp(`PRT submitter identity.*${prt.address}`, "i"),
+        );
+
+        // the copy is what makes an owner-only file readable: owned by the
+        // node's user, read-only, and the host file is left as it was
+        const stat = (file: string) =>
+            execNodeCommand({
+                command: ["stat", "-c", "%U:%G %a", file],
+                projectName: keysProjectName,
+            });
+        expect(await stat("/run/secrets/cartesi_auth_private_key_file")).toBe(
+            "cartesi:cartesi 400",
+        );
+        expect(
+            await stat("/run/secrets/cartesi_prt_auth_private_key_file"),
+        ).toBe("cartesi:cartesi 400");
+
+        // the init service mounts the host files read-only and copies them,
+        // so their owner and mode don't change
+        for (const { file } of [claimer, prt]) {
+            const { uid, mode } = fs.statSync(file);
+            expect(uid).toBe(process.getuid?.() ?? uid);
+            expect(mode & 0o777).toBe(0o600);
+        }
+    }, 300_000);
 });
diff --git a/apps/cli/tests/unit/commands/logs.test.ts b/apps/cli/tests/unit/commands/logs.test.ts
new file mode 100644
index 00000000..23e00ead
--- /dev/null
+++ b/apps/cli/tests/unit/commands/logs.test.ts
@@ -0,0 +1,104 @@
+import { describe, expect, it } from "bun:test";
+import {
+    buildLogsArgs,
+    createLogsCommand,
+    selectLogServices,
+} from "../../../src/commands/logs";
+
+describe("logs command", () => {
+    // as `docker compose ps --services --all` lists an environment with a
+    // pool node and a key-file node, whose installer has exited
+    const services = [
+        "anvil",
+        "database",
+        "prt-node-first",
+        "prt-node-mine",
+        "proxy",
+        "rollups_node",
+        "secret-init-prt-node-mine",
+    ];
+
+    it("should take the services to show as arguments", () => {
+        const [argument] = createLogsCommand().registeredArguments;
+
+        expect(argument?.name()).toBe("service");
+        expect(argument?.variadic).toBe(true);
+        expect(argument?.required).toBe(false);
+    });
+
+    it("should show the node first, then the PRT nodes, by default", () => {
+        expect(selectLogServices(services, [])).toEqual([
+            "rollups_node",
+            "prt-node-first",
+            "prt-node-mine",
+        ]);
+    });
+
+    it("should show only the node without PRT nodes", () => {
+        expect(selectLogServices(["anvil", "rollups_node"], [])).toEqual([
+            "rollups_node",
+        ]);
+    });
+
+    it("should fail without the node", () => {
+        expect(() =>
+            selectLogServices(["anvil", "prt-node-first"], []),
+        ).toThrow("service rollups_node not found");
+    });
+
+    it("should show the services named, in that order", () => {
+        expect(
+            selectLogServices(services, ["prt-node-mine", "rollups_node"]),
+        ).toEqual(["prt-node-mine", "rollups_node"]);
+    });
+
+    // compose shows nothing for an unknown service, without an error
+    it("should reject a service the environment doesn't have", () => {
+        expect(() =>
+            selectLogServices(services, ["prt-node-first", "prt-node-second"]),
+        ).toThrow(
+            "service prt-node-second not found; the environment has anvil, database, prt-node-first, prt-node-mine, proxy, rollups_node, secret-init-prt-node-mine",
+        );
+    });
+
+    it("should pass the log options through, prefixing each service", () => {
+        expect(
+            buildLogsArgs({
+                follow: true,
+                projectName: "app",
+                services: ["rollups_node", "prt-node-first"],
+                since: "42m",
+                tail: "all",
+                until: "1m",
+            }),
+        ).toEqual([
+            "compose",
+            "--project-name",
+            "app",
+            "logs",
+            "--follow",
+            "--since",
+            "42m",
+            "--tail",
+            "all",
+            "--until",
+            "1m",
+            "rollups_node",
+            "prt-node-first",
+        ]);
+    });
+
+    // one service reads as `docker container logs` did
+    it("should drop the prefix for one service", () => {
+        expect(
+            buildLogsArgs({ projectName: "app", services: ["rollups_node"] }),
+        ).toEqual([
+            "compose",
+            "--project-name",
+            "app",
+            "logs",
+            "--no-log-prefix",
+            "rollups_node",
+        ]);
+    });
+});
diff --git a/apps/cli/tests/unit/commands/run.test.ts b/apps/cli/tests/unit/commands/run.test.ts
new file mode 100644
index 00000000..7ec6c9ee
--- /dev/null
+++ b/apps/cli/tests/unit/commands/run.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from "bun:test";
+import { createRunCommand } from "../../../src/commands/run";
+
+describe("run command", () => {
+    // the node refuses to start with 'pending', which does not identify a
+    // mined block, so the command must not offer it
+    it("should offer only the default blocks the node supports", () => {
+        const option = createRunCommand().options.find(
+            ({ long }) => long === "--default-block",
+        );
+
+        expect(option?.argChoices).toEqual(["latest", "safe", "finalized"]);
+    });
+});
diff --git a/apps/cli/tests/unit/compose/anvil.test.ts b/apps/cli/tests/unit/compose/anvil.test.ts
new file mode 100644
index 00000000..55e704c4
--- /dev/null
+++ b/apps/cli/tests/unit/compose/anvil.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "bun:test";
+import buildAnvilCompose from "../../../src/compose/anvil.js";
+
+describe("Compose anvil service", () => {
+    // compose interpolates `$name` in the file it reads, so the URL must reach
+    // it as `$$`, which compose turns back into `$`
+    it("should escape the $ in the fork url for compose", () => {
+        const compose = buildAnvilCompose({
+            forkConfig: {
+                blockNumber: 10n,
+                chainId: 11155111,
+                url: "https://rpc.example.com/v2/k$y",
+            },
+        });
+
+        expect(compose.services?.anvil?.command).toEqual([
+            "anvil",
+            "--chain-id",
+            "31337",
+            "--block-time",
+            "2",
+            "--fork-url",
+            "https://rpc.example.com/v2/k$$y",
+            "--fork-block-number",
+            "10",
+        ]);
+    });
+});
diff --git a/apps/cli/tests/unit/compose/node.test.ts b/apps/cli/tests/unit/compose/node.test.ts
index b80a8354..08d50d39 100644
--- a/apps/cli/tests/unit/compose/node.test.ts
+++ b/apps/cli/tests/unit/compose/node.test.ts
@@ -5,6 +5,7 @@ import buildNodeCompose, {
     type ServiceOptions,
 } from "../../../src/compose/node.js";
 import {
+    applicationFactoryAddress,
     inputBoxAddress,
     selfHostedApplicationFactoryAddress,
 } from "../../../src/contracts.js";
@@ -215,7 +216,7 @@ describe("Compose node service", () => {
 
             const env = compose.services?.rollups_node?.environment ?? {};
 
-            expect(Object.keys(env)).toHaveLength(11);
+            expect(Object.keys(env)).toHaveLength(12);
 
             expect(env).toHaveProperty(
                 "CARTESI_AUTH_MNEMONIC",
@@ -235,6 +236,10 @@ describe("Compose node service", () => {
                 "http://anvil:8545",
             );
             expect(env).toHaveProperty("CARTESI_BLOCKCHAIN_ID", "31337");
+            expect(env).toHaveProperty(
+                "CARTESI_CONTRACTS_APPLICATION_FACTORY_ADDRESS",
+                applicationFactoryAddress,
+            );
             expect(env).toHaveProperty(
                 "CARTESI_CONTRACTS_INPUT_BOX_ADDRESS",
                 inputBoxAddress,
@@ -298,6 +303,70 @@ describe("Compose node service", () => {
             );
         });
 
+        it("should submit claims by default", () => {
+            const env =
+                buildNodeCompose({ ...baseOptions, prt: true }).services
+                    ?.rollups_node?.environment ?? {};
+
+            expect(env).not.toHaveProperty(
+                "CARTESI_FEATURE_CLAIM_SUBMISSION_ENABLED",
+            );
+        });
+
+        // with a sling claimer the node follows the tournaments and records
+        // settled epochs, and needs no PRT signer
+        it("should run in reader mode without a PRT signer when a sling node claims", () => {
+            const env =
+                buildNodeCompose({
+                    ...baseOptions,
+                    prt: true,
+                    claimSubmission: false,
+                }).services?.rollups_node?.environment ?? {};
+
+            expect(env).toHaveProperty(
+                "CARTESI_FEATURE_CLAIM_SUBMISSION_ENABLED",
+                "false",
+            );
+            expect(env).not.toHaveProperty("CARTESI_PRT_AUTH_MNEMONIC");
+            // the deploy still signs with the claimer auth
+            expect(env).toHaveProperty(
+                "CARTESI_AUTH_MNEMONIC",
+                "test test test test test test test test test test test junk",
+            );
+        });
+
+        it("should drop the host's PRT auth variables in reader mode", () => {
+            const compose = buildNodeCompose({
+                ...baseOptions,
+                prt: true,
+                claimSubmission: false,
+                cartesiEnvironmentVariables: {
+                    CARTESI_AUTH_KIND: "private_key_file",
+                    CARTESI_AUTH_PRIVATE_KEY_FILE: "secrets/claimer.key",
+                    CARTESI_PRT_AUTH_KIND: "private_key",
+                    CARTESI_PRT_AUTH_PRIVATE_KEY: "0xprt",
+                    CARTESI_PRT_AUTH_MNEMONIC_FILE: "/keys/prt",
+                },
+            });
+            const env = compose.services?.rollups_node?.environment ?? {};
+
+            expect(env).toHaveProperty("CARTESI_AUTH_KIND", "private_key_file");
+            expect(env).toHaveProperty(
+                "CARTESI_AUTH_PRIVATE_KEY_FILE",
+                "/run/secrets/cartesi_auth_private_key_file",
+            );
+            expect(env).not.toHaveProperty("CARTESI_PRT_AUTH_KIND");
+            expect(env).not.toHaveProperty("CARTESI_PRT_AUTH_PRIVATE_KEY");
+            expect(env).not.toHaveProperty("CARTESI_PRT_AUTH_MNEMONIC_FILE");
+            // only the claimer's key file is copied
+            expect(compose.services?.["node-secret-init"]?.command).toEqual([
+                [
+                    "find /dst -mindepth 1 -delete",
+                    "install -o cartesi -g cartesi -m 0400 /src/cartesi_auth_private_key_file /dst/cartesi_auth_private_key_file",
+                ].join("\n"),
+            ]);
+        });
+
         it("should pass cartesiEnvironmentVariables that are in the allow-list to the service", () => {
             const compose = buildNodeCompose({
                 ...baseOptions,
@@ -334,6 +403,106 @@ describe("Compose node service", () => {
             expect(env).toHaveProperty("CARTESI_LOG_LEVEL", "warn");
         });
 
+        // compose interpolates `$name` in the file it reads, so a host value
+        // must reach it as `$$`, which compose turns back into `$`
+        it("should escape the $ in host variables for compose", () => {
+            const compose = buildNodeCompose({
+                ...baseOptions,
+                cartesiEnvironmentVariables: {
+                    CARTESI_BLOCKCHAIN_HTTP_ENDPOINT:
+                        "https://alice:s3cr$t@rpc.example.com/$key",
+                    CARTESI_LOG_LEVEL: "warn",
+                },
+            });
+            const env = compose.services?.rollups_node?.environment ?? {};
+
+            expect(env).toHaveProperty(
+                "CARTESI_BLOCKCHAIN_HTTP_ENDPOINT",
+                "https://alice:s3cr$$t@rpc.example.com/$$key",
+            );
+            expect(env).toHaveProperty("CARTESI_LOG_LEVEL", "warn");
+        });
+
+        // only the path would reach the container otherwise, and the node
+        // couldn't open the file
+        // a bind mount would keep the host's owner and mode, which the node's
+        // user may not read, so an init service hands the node copies it owns
+        it("should copy the key files the host names for the node", () => {
+            const compose = buildNodeCompose({
+                ...baseOptions,
+                cartesiEnvironmentVariables: {
+                    CARTESI_AUTH_KIND: "private_key_file",
+                    CARTESI_AUTH_PRIVATE_KEY_FILE: "secrets/claimer.key",
+                    CARTESI_PRT_AUTH_MNEMONIC_FILE: "/keys/prt$1",
+                },
+            });
+            const init = compose.services?.["node-secret-init"];
+            const service = compose.services?.rollups_node;
+
+            expect(init).toMatchObject({
+                image: "cartesi/rollups-runtime:latest",
+                network_mode: "none",
+                restart: "no",
+                user: "root",
+            });
+            expect(init?.command).toEqual([
+                [
+                    "find /dst -mindepth 1 -delete",
+                    "install -o cartesi -g cartesi -m 0400 /src/cartesi_auth_private_key_file /dst/cartesi_auth_private_key_file",
+                    "install -o cartesi -g cartesi -m 0400 /src/cartesi_prt_auth_mnemonic_file /dst/cartesi_prt_auth_mnemonic_file",
+                ].join("\n"),
+            ]);
+            expect(init?.volumes).toEqual([
+                {
+                    type: "bind",
+                    source: "secrets/claimer.key",
+                    target: "/src/cartesi_auth_private_key_file",
+                    read_only: true,
+                    bind: { create_host_path: false },
+                },
+                {
+                    type: "bind",
+                    source: "/keys/prt$$1",
+                    target: "/src/cartesi_prt_auth_mnemonic_file",
+                    read_only: true,
+                    bind: { create_host_path: false },
+                },
+                "node_secrets:/dst",
+            ]);
+            expect(compose.volumes).toEqual({ node_secrets: {} });
+            expect(service?.depends_on).toMatchObject({
+                "node-secret-init": {
+                    condition: "service_completed_successfully",
+                },
+            });
+            expect(service?.volumes).toContain("node_secrets:/run/secrets:ro");
+            expect(service?.environment).toMatchObject({
+                CARTESI_AUTH_KIND: "private_key_file",
+                CARTESI_AUTH_PRIVATE_KEY_FILE:
+                    "/run/secrets/cartesi_auth_private_key_file",
+                CARTESI_PRT_AUTH_MNEMONIC_FILE:
+                    "/run/secrets/cartesi_prt_auth_mnemonic_file",
+            });
+        });
+
+        it("should copy nothing when the host names no key file", () => {
+            const compose = buildNodeCompose({
+                ...baseOptions,
+                cartesiEnvironmentVariables: {
+                    CARTESI_AUTH_PRIVATE_KEY: "0xsecret",
+                },
+            });
+
+            expect(compose.services).not.toHaveProperty("node-secret-init");
+            expect(compose.volumes).toBeUndefined();
+            expect(
+                compose.services?.rollups_node?.depends_on,
+            ).not.toHaveProperty("node-secret-init");
+            expect(compose.services?.rollups_node?.volumes).toEqual([
+                "./.cartesi:/var/lib/cartesi-rollups-node/snapshots:ro",
+            ]);
+        });
+
         it("should build the database connection string from provided property", () => {
             const compose = buildNodeCompose({
                 databasePassword: "specialsecret",
diff --git a/apps/cli/tests/unit/compose/prt-node.test.ts b/apps/cli/tests/unit/compose/prt-node.test.ts
new file mode 100644
index 00000000..bc3b5756
--- /dev/null
+++ b/apps/cli/tests/unit/compose/prt-node.test.ts
@@ -0,0 +1,200 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { Address } from "viem";
+import { generatePrivateKey } from "viem/accounts";
+import buildPrtNodes, {
+    isPrtNodeService,
+    prtNodeServiceName,
+} from "../../../src/compose/prt-node";
+import { resolvePrtNodes } from "../../../src/prt";
+import type { ComposeFile } from "../../../src/types/compose";
+import { getDevnetAccount } from "../../../src/wallet";
+
+/**
+ * The compose services of the PRT nodes the CLI runs: a sling node per
+ * `type = "sling"` entry, with its key in the environment for a devnet
+ * account, or copied by an init service for a key file.
+ */
+describe("Compose PRT node services", () => {
+    const application: Address = "0x1111111111111111111111111111111111111111";
+    const ownKey = generatePrivateKey();
+    let keyFile: string;
+
+    beforeAll(() => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "prt-node-"));
+        keyFile = path.join(dir, "sentry.key");
+        fs.writeFileSync(keyFile, ownKey);
+    });
+
+    afterAll(() => fs.rmSync(path.dirname(keyFile), { recursive: true }));
+
+    const compose = (blockTime = 2) =>
+        buildPrtNodes({
+            application,
+            blockTime,
+            imageTag: "devel",
+            nodes: resolvePrtNodes({
+                nodes: {
+                    first: { type: "sling", sentry: true },
+                    mine: {
+                        type: "sling",
+                        sentry: true,
+                        privateKeyFile: keyFile,
+                    },
+                    theirs: {
+                        sentry: true,
+                        address: "0x5555555555555555555555555555555555555555",
+                    },
+                },
+            }).nodes,
+        });
+
+    it("should name the services after the labels", () => {
+        expect(prtNodeServiceName("mine")).toBe("prt-node-mine");
+    });
+
+    it("should compose one file per node the CLI runs, none for an appointed one", () => {
+        const files = compose();
+
+        expect(files.map((file) => Object.keys(file.services ?? {}))).toEqual([
+            ["prt-node-first"],
+            ["prt-node-mine", "secret-init-prt-node-mine"],
+        ]);
+    });
+
+    it("should run a sling node on the pool account's key, polling every block", () => {
+        const [file] = compose(2);
+        const service = file.services?.["prt-node-first"];
+
+        expect(service?.image).toBe("cartesi/rollups-runtime:devel");
+        expect(service?.command).toEqual(["cartesi-sling-node", "pk"]);
+        expect(service?.depends_on).toEqual({
+            anvil: { condition: "service_healthy" },
+        });
+        expect(service?.environment).toEqual({
+            CARTESI_SLING_APP_ADDRESS: application,
+            CARTESI_SLING_AUTH_PRIVATE_KEY: getDevnetAccount(20).privateKey,
+            CARTESI_SLING_BLOCKCHAIN_HTTP_ENDPOINT: "http://anvil:8545",
+            CARTESI_SLING_BLOCKCHAIN_ID: "31337",
+            CARTESI_SLING_DATA_DIR: "/var/lib/cartesi-rollups-node/snapshots",
+            CARTESI_SLING_POLLING_INTERVAL: "2",
+            CARTESI_SLING_TEMPLATE_PATH:
+                "/var/lib/cartesi-rollups-node/template/image",
+        });
+        // the machine the node deploys, read-only
+        expect(service?.volumes).toEqual([
+            "./.cartesi:/var/lib/cartesi-rollups-node/template:ro",
+        ]);
+        expect(file.volumes).toBeUndefined();
+    });
+
+    it("should poll at least every second", () => {
+        const [file] = compose(0.5);
+
+        expect(file.services?.["prt-node-first"]?.environment).toMatchObject({
+            CARTESI_SLING_POLLING_INTERVAL: "1",
+        });
+    });
+
+    it("should copy a key file for the node and point it at the copy", () => {
+        const [, file] = compose();
+        const service = file.services?.["prt-node-mine"];
+        const init = file.services?.["secret-init-prt-node-mine"];
+
+        expect(service?.environment).toMatchObject({
+            CARTESI_SLING_AUTH_PRIVATE_KEY_FILE: "/run/secrets/prt-node-mine",
+        });
+        expect(service?.environment).not.toHaveProperty(
+            "CARTESI_SLING_AUTH_PRIVATE_KEY",
+        );
+        expect(service?.depends_on).toEqual({
+            anvil: { condition: "service_healthy" },
+            "secret-init-prt-node-mine": {
+                condition: "service_completed_successfully",
+            },
+        });
+        expect(service?.volumes).toEqual([
+            "./.cartesi:/var/lib/cartesi-rollups-node/template:ro",
+            "prt_node_mine_secrets:/run/secrets:ro",
+        ]);
+        expect(init?.image).toBe("cartesi/rollups-runtime:devel");
+        expect(init?.user).toBe("root");
+        expect(init?.command).toEqual([
+            `find /dst -mindepth 1 -delete\ninstall -o cartesi -g cartesi -m 0400 /src/prt-node-mine /dst/prt-node-mine`,
+        ]);
+        expect(init?.volumes).toEqual([
+            {
+                type: "bind",
+                source: keyFile,
+                target: "/src/prt-node-mine",
+                read_only: true,
+                bind: { create_host_path: false },
+            },
+            "prt_node_mine_secrets:/dst",
+        ]);
+        expect(file.volumes).toEqual({ prt_node_mine_secrets: {} });
+    });
+
+    // the key never leaves the file
+    it("should not put a key file's key anywhere in the compose file", () => {
+        const [, file] = compose();
+
+        expect(JSON.stringify(file)).not.toContain(ownKey.slice(2));
+    });
+
+    // `cartesi logs` tells the PRT nodes from the rest of the environment by
+    // name; a label holding `-` must not make the installer of another node
+    it("should tell a node's service from its key file installer", () => {
+        const [, file] = compose();
+
+        expect(
+            Object.keys(file.services ?? {}).filter(isPrtNodeService),
+        ).toEqual(["prt-node-mine"]);
+        expect(isPrtNodeService(prtNodeServiceName("x-secret-init"))).toBe(
+            true,
+        );
+        expect(isPrtNodeService("secret-init-prt-node-x-secret-init")).toBe(
+            false,
+        );
+        expect(isPrtNodeService("rollups_node")).toBe(false);
+    });
+
+    // the sling node takes no flag: the same binary claims either way, and
+    // learns from the chain whether it also holds a sentry slot
+    it("should run a validator as it runs a sentry, told apart by its signer", () => {
+        const [validator, sentry] = buildPrtNodes({
+            application,
+            blockTime: 2,
+            imageTag: "devel",
+            nodes: resolvePrtNodes({
+                nodes: {
+                    blue: { type: "sling", sentry: false },
+                    green: { type: "sling", sentry: true },
+                },
+            }).nodes,
+        });
+        const envOf = (file: ComposeFile, service: string) =>
+            (file.services?.[service]?.environment ?? {}) as Record<
+                string,
+                string
+            >;
+        const { CARTESI_SLING_AUTH_PRIVATE_KEY: _, ...validatorEnv } = envOf(
+            validator,
+            "prt-node-blue",
+        );
+        const { CARTESI_SLING_AUTH_PRIVATE_KEY: __, ...sentryEnv } = envOf(
+            sentry,
+            "prt-node-green",
+        );
+
+        expect(Object.keys(validator.services ?? {})).toEqual([
+            "prt-node-blue",
+        ]);
+        expect(validatorEnv).toEqual(sentryEnv);
+        expect(envOf(validator, "prt-node-blue")).toMatchObject({
+            CARTESI_SLING_AUTH_PRIVATE_KEY: getDevnetAccount(20).privateKey,
+        });
+    });
+});
diff --git a/apps/cli/tests/unit/config.test.ts b/apps/cli/tests/unit/config.test.ts
index e9338ac4..daa42297 100644
--- a/apps/cli/tests/unit/config.test.ts
+++ b/apps/cli/tests/unit/config.test.ts
@@ -16,6 +16,7 @@ import {
     InvalidEnvError,
     InvalidNumberValueError,
     InvalidNvramSizeError,
+    InvalidPrtConfigError,
     InvalidStringValueError,
     InvalidTableError,
     InvalidWithdrawalConfigError,
@@ -155,6 +156,27 @@ describe("when parsing the fixtures", () => {
                     user: undefined,
                 },
             },
+            prt: {
+                sentryManager: "0x3333333333333333333333333333333333333333",
+                nodes: {
+                    reference: {
+                        type: "reference",
+                        sentry: false,
+                        claim: false,
+                    },
+                    blue: { type: "sling", sentry: false },
+                    first: { type: "sling", sentry: true },
+                    mine: {
+                        type: "sling",
+                        sentry: true,
+                        address: "0x4444444444444444444444444444444444444444",
+                    },
+                    theirs: {
+                        sentry: true,
+                        address: "0x5555555555555555555555555555555555555555",
+                    },
+                },
+            },
             withdrawal: {
                 guardian: "0x1111111111111111111111111111111111111111",
                 withdrawal_output_builder:
@@ -417,6 +439,330 @@ shared = true`,
         );
     });
 
+    /**
+     * [prt]
+     */
+    describe("when parsing [prt]", () => {
+        const prt = (config: string) => parse([config]).prt;
+        const address = (digit: string) =>
+            `0x${digit.repeat(40)}` as `0x${string}`;
+
+        it("should parse the entries in file order, with only the keys set", () => {
+            const config = `
+                [prt]
+                sentry_manager = "${address("3")}"
+
+                [prt.nodes.reference]
+                type = "reference"
+                claim = false
+
+                [prt.nodes.blue]
+                type = "sling"
+
+                [prt.nodes.mine]
+                type = "sling"
+                sentry = true
+                address = "${address("4")}"
+                private_key_file = "secrets/sentry.key"
+
+                [prt.nodes.theirs]
+                sentry = true
+                address = "${address("5")}"
+            `;
+            const parsed = prt(config);
+            expect(parsed).toStrictEqual({
+                sentryManager: address("3"),
+                nodes: {
+                    reference: {
+                        type: "reference",
+                        sentry: false,
+                        claim: false,
+                    },
+                    blue: { type: "sling", sentry: false },
+                    mine: {
+                        type: "sling",
+                        sentry: true,
+                        address: address("4"),
+                        privateKeyFile: "secrets/sentry.key",
+                    },
+                    theirs: { sentry: true, address: address("5") },
+                },
+            });
+            expect(Object.keys(parsed?.nodes ?? {})).toEqual([
+                "reference",
+                "blue",
+                "mine",
+                "theirs",
+            ]);
+        });
+
+        // a validator by default, and the rollups-node claims by default
+        it("should default sentry to false and the reference node's claim to true", () => {
+            expect(prt('[prt.nodes.blue]\ntype = "sling"')).toStrictEqual({
+                nodes: { blue: { type: "sling", sentry: false } },
+            });
+            expect(prt('[prt.nodes.node]\ntype = "reference"')).toStrictEqual({
+                nodes: {
+                    node: { type: "reference", sentry: false, claim: true },
+                },
+            });
+        });
+
+        it.each(["sentry", "claim"])(
+            "should fail when %s is not a boolean",
+            (key) => {
+                const type = key === "claim" ? "reference" : "sling";
+                expect(() =>
+                    prt(`[prt.nodes.a]\ntype = "${type}"\n${key} = "yes"`),
+                ).toThrowError("Invalid boolean value: yes");
+            },
+        );
+
+        // the rollups-node is one entry
+        it("should fail for a second reference node", () => {
+            const config = `
+                [prt.nodes.reference]
+                type = "reference"
+
+                [prt.nodes.node]
+                type = "reference"
+            `;
+            expect(() => prt(config)).toThrowError(
+                new InvalidPrtConfigError(
+                    "only one entry is the reference node, and [prt.nodes.reference] already is",
+                    "[prt.nodes.node]",
+                ),
+            );
+        });
+
+        it("should fail for a sentry on the reference node", () => {
+            expect(() =>
+                prt('[prt.nodes.reference]\ntype = "reference"\nsentry = true'),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "the reference node can't be a sentry yet",
+                    "[prt.nodes.reference]",
+                ),
+            );
+        });
+
+        it("should fail for an address or a key file on the reference node", () => {
+            const reason =
+                "the reference node takes no address or private_key_file: the CLI runs it on the devnet accounts";
+            expect(() =>
+                prt(
+                    `[prt.nodes.reference]\ntype = "reference"\naddress = "${address("4")}"`,
+                ),
+            ).toThrowError(
+                new InvalidPrtConfigError(reason, "[prt.nodes.reference]"),
+            );
+            expect(() =>
+                prt(
+                    '[prt.nodes.reference]\ntype = "reference"\nprivate_key_file = "node.key"',
+                ),
+            ).toThrowError(
+                new InvalidPrtConfigError(reason, "[prt.nodes.reference]"),
+            );
+        });
+
+        // only the rollups-node can read instead of claiming, for now
+        it("should fail for claim on a sling node or an appointed entry", () => {
+            expect(() =>
+                prt('[prt.nodes.blue]\ntype = "sling"\nclaim = false'),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "claim isn't supported on a sling node yet: it always claims",
+                    "[prt.nodes.blue]",
+                ),
+            );
+            expect(() =>
+                prt(
+                    `[prt.nodes.theirs]\nsentry = true\naddress = "${address("5")}"\nclaim = true`,
+                ),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    'claim needs type = "reference": only the rollups-node can read instead of claiming',
+                    "[prt.nodes.theirs]",
+                ),
+            );
+        });
+
+        // without a type the CLI runs nothing, so the entry must appoint
+        it("should fail for an appointed entry without sentry = true", () => {
+            expect(() =>
+                prt(`[prt.nodes.theirs]\naddress = "${address("5")}"`),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "an entry without a type is appointed only, so it needs sentry = true",
+                    "[prt.nodes.theirs]",
+                ),
+            );
+        });
+
+        // the CLI reads a key only for a node it runs
+        it("should fail for a private_key_file without a type", () => {
+            expect(() =>
+                prt(
+                    `[prt.nodes.mine]\nsentry = true\naddress = "${address("4")}"\nprivate_key_file = "sentry.key"`,
+                ),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "private_key_file needs a type: the CLI only reads the key of a node it runs",
+                    "[prt.nodes.mine]",
+                ),
+            );
+        });
+
+        it("should fail for an empty private_key_file", () => {
+            expect(() =>
+                prt('[prt.nodes.mine]\ntype = "sling"\nprivate_key_file = ""'),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "private_key_file must name a file",
+                    "[prt.nodes.mine]",
+                ),
+            );
+        });
+
+        it("should fail for a private_key_file that is not a string", () => {
+            expect(() =>
+                prt('[prt.nodes.mine]\ntype = "sling"\nprivate_key_file = 1'),
+            ).toThrowError("Invalid string value: 1");
+        });
+
+        it("should accept an empty section", () => {
+            expect(prt("[prt]")).toStrictEqual({ nodes: {} });
+        });
+
+        it("should return undefined when [prt] is not defined", () => {
+            expect(parse([""]).prt).toBeUndefined();
+        });
+
+        it("should fail when the section is not a table", () => {
+            expect(() => prt("prt = 42")).toThrowError(
+                new InvalidTableError("[prt]", 42),
+            );
+        });
+
+        it("should fail when nodes is not a table of tables", () => {
+            expect(() => prt('[prt]\nnodes = "0x1234"')).toThrowError(
+                new InvalidTableError("[prt.nodes]", "0x1234"),
+            );
+            expect(() => prt("[prt.nodes]\nfirst = 42")).toThrowError(
+                new InvalidTableError("[prt.nodes.first]", 42),
+            );
+        });
+
+        it("should checksum the addresses", () => {
+            const config = `
+                [prt.nodes.first]
+                sentry = true
+                address = "0x70997970c51812dc3a010c7d01b50e0d17dc79c8"
+            `;
+            expect(prt(config)?.nodes.first?.address).toBe(
+                "0x70997970C51812dc3A010C7d01b50e0d17dc79C8",
+            );
+        });
+
+        it.each([
+            ["sentry_manager", "[prt]"],
+            ["address", "[prt.nodes.first]\nsentry = true"],
+        ])("should fail when %s is not a valid address", (key, table) => {
+            expect(() =>
+                prt(`${table}\n${key} = "invalid_address"`),
+            ).toThrowError(
+                new InvalidAddressValueError("invalid_address", key),
+            );
+        });
+
+        // the node refuses it, so the config does too
+        it("should fail for the zero address", () => {
+            expect(() =>
+                prt(
+                    `[prt.nodes.first]\nsentry = true\naddress = "${address("0")}"`,
+                ),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "address must not be the zero address",
+                    "[prt.nodes.first]",
+                ),
+            );
+        });
+
+        it("should fail when two entries name the same address", () => {
+            const config = `
+                [prt.nodes.a]
+                sentry = true
+                address = "${address("4")}"
+
+                [prt.nodes.b]
+                type = "sling"
+
+                [prt.nodes.c]
+                type = "sling"
+                address = "${address("4").toLowerCase()}"
+            `;
+            expect(() => prt(config)).toThrowError(
+                new InvalidPrtConfigError(
+                    `address ${address("4")} is also the address of [prt.nodes.a]`,
+                    "[prt.nodes.c]",
+                ),
+            );
+        });
+
+        it("should fail for a type the CLI can't run", () => {
+            expect(() =>
+                prt('[prt.nodes.first]\ntype = "rollups-node"'),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    "type rollups-node isn't supported, expected one of: reference, sling",
+                    "[prt.nodes.first]",
+                ),
+            );
+        });
+
+        it("should fail for an entry with neither type nor address", () => {
+            expect(() => prt("[prt.nodes.idle]\nsentry = true")).toThrowError(
+                new InvalidPrtConfigError(
+                    "set a type for the CLI to run the node, or an address to appoint one run elsewhere",
+                    "[prt.nodes.idle]",
+                ),
+            );
+        });
+
+        // the label is the key: a container name, and a position in file
+        // order, which a parsed table keeps only for keys that aren't numbers
+        it.each([
+            ['"My Sentry"', "My Sentry"],
+            ['"a/b"', "a/b"],
+            ["10", "10"],
+            ["_x", "_x"],
+        ])("should fail for the label %s", (key, label) => {
+            expect(() =>
+                prt(`[prt.nodes.${key}]\ntype = "sling"`),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    `label "${label}" must start with a lowercase letter, then lowercase letters, digits, - or _`,
+                    `[prt.nodes.${label}]`,
+                ),
+            );
+        });
+
+        it("should fail for an unknown key in [prt]", () => {
+            expect(() => prt("[prt]\nmanager = 1")).toThrowError(
+                "Unknown key 'manager' in [prt], expected one of: nodes, sentry_manager",
+            );
+        });
+
+        it("should fail for an unknown key in an entry", () => {
+            expect(() =>
+                prt('[prt.nodes.first]\ntype = "sling"\nrole = "sentry"'),
+            ).toThrowError(
+                "Unknown key 'role' in [prt.nodes.first], expected one of: address, claim, private_key_file, sentry, type",
+            );
+        });
+    });
+
     /**
      * accounts drive validation, before the machine is built
      */
@@ -1069,7 +1415,7 @@ shared = true`,
             expect(() =>
                 parse(['[drive.root]\nbuilder = "docker"']),
             ).toThrowError(
-                "Unknown key 'drive' at the top level, expected one of: drives, machine, nvrams, sdk, withdrawal",
+                "Unknown key 'drive' at the top level, expected one of: drives, machine, nvrams, prt, sdk, withdrawal",
             );
         });
 
diff --git a/apps/cli/tests/unit/config/fixtures/full.toml b/apps/cli/tests/unit/config/fixtures/full.toml
index fabdcca9..45723787 100644
--- a/apps/cli/tests/unit/config/fixtures/full.toml
+++ b/apps/cli/tests/unit/config/fixtures/full.toml
@@ -84,3 +84,26 @@ filename = "./seed.raw" # existing raw image with the initial contents
 guardian = "0x1111111111111111111111111111111111111111" # devnet account by default
 withdrawal_output_builder = "0x2222222222222222222222222222222222222222" # devnet builder by default, required on a fork
 account_size = 64 # bytes per account, a power of two, 32 by default
+
+[prt] # optional, read by `cartesi run --prt`: the PRT nodes of the application's consensus
+sentry_manager = "0x3333333333333333333333333333333333333333" # may rotate sentries, default is none
+
+[prt.nodes.reference] # the rollups-node's own entry, implied when omitted
+type = "reference"
+claim = false # reader mode: it follows the tournaments and records settled epochs, default is true
+
+[prt.nodes.blue] # the label is the key, and names the container prt-node-blue
+type = "sling" # the CLI runs a Dave sling node for it; without an address it gets devnet account 20
+
+[prt.nodes.first]
+type = "sling" # devnet account 21, the next of the pool
+sentry = true # appointed on the consensus; sentries count in file order, with IDs from 1
+
+[prt.nodes.mine]
+type = "sling"
+sentry = true
+address = "0x4444444444444444444444444444444444444444" # an account of your own
+
+[prt.nodes.theirs]
+sentry = true # no type: appointed only, run elsewhere
+address = "0x5555555555555555555555555555555555555555"
diff --git a/apps/cli/tests/unit/config/fixtures/prt/config.toml b/apps/cli/tests/unit/config/fixtures/prt/config.toml
new file mode 100644
index 00000000..0e1d005f
--- /dev/null
+++ b/apps/cli/tests/unit/config/fixtures/prt/config.toml
@@ -0,0 +1,35 @@
+# example of an application deployed with PRT nodes by `cartesi run --prt`.
+# without --prt the section is ignored.
+
+[prt]
+# optional, may rotate sentries on the consensus. default is none
+# sentry_manager = "0x3333333333333333333333333333333333333333"
+
+# one table per PRT node, keyed by its label, which names the container
+# prt-node-<label>. every entry is a validator; sentry = true also appoints it
+# on the consensus, in file order, with IDs from 1. an entry with a type is run
+# by the CLI; one with only an address is appointed and run elsewhere
+
+# the rollups-node's own entry, implied when omitted. claim = false runs it in
+# reader mode, following the tournaments while the sling nodes claim
+# [prt.nodes.reference]
+# type = "reference"
+# claim = false
+
+[prt.nodes.first]
+type = "sling" # no address: devnet account 20, the first of the CLI's PRT pool
+sentry = true
+
+[prt.nodes.second]
+type = "sling" # devnet account 21
+sentry = true
+
+# a key of your own: the address is the key's, and you fund it
+# [prt.nodes.mine]
+# type = "sling"
+# sentry = true
+# private_key_file = "secrets/sentry.key"
+
+[prt.nodes.theirs]
+sentry = true
+address = "0x5555555555555555555555555555555555555555" # appointed only
diff --git a/apps/cli/tests/unit/exec/cartesi-machine.test.ts b/apps/cli/tests/unit/exec/cartesi-machine.test.ts
index eb0c10cc..2ef48f52 100644
--- a/apps/cli/tests/unit/exec/cartesi-machine.test.ts
+++ b/apps/cli/tests/unit/exec/cartesi-machine.test.ts
@@ -9,11 +9,11 @@ import {
 const semver = (version: string) => parse(version) as SemVer;
 
 describe("requiredVersion", () => {
-    it.each(["0.21.0", "0.21.3"])("should accept %s", (version) => {
+    it.each(["0.22.0", "0.22.3"])("should accept %s", (version) => {
         expect(satisfies(version, requiredVersion)).toBeTruthy();
     });
 
-    it.each(["0.20.0", "0.20.9", "0.22.0", "1.0.0"])(
+    it.each(["0.21.0", "0.21.9", "0.23.0", "1.0.0"])(
         "should reject %s",
         (version) => {
             expect(satisfies(version, requiredVersion)).toBeFalsy();
@@ -22,11 +22,11 @@ describe("requiredVersion", () => {
 });
 
 describe("assertSupported", () => {
-    it.each(["0.21.0", "0.21.3"])("should accept %s", (version) => {
+    it.each(["0.22.0", "0.22.3"])("should accept %s", (version) => {
         expect(() => assertSupported(semver(version))).not.toThrow();
     });
 
-    it.each(["0.20.0", "0.22.0"])("should reject %s", (version) => {
+    it.each(["0.21.0", "0.23.0"])("should reject %s", (version) => {
         expect(() => assertSupported(semver(version))).toThrowError(
             new UnsupportedVersionError(semver(version)),
         );
diff --git a/apps/cli/tests/unit/exec/rollups.test.ts b/apps/cli/tests/unit/exec/rollups.test.ts
index 23268c4d..4ed46caa 100644
--- a/apps/cli/tests/unit/exec/rollups.test.ts
+++ b/apps/cli/tests/unit/exec/rollups.test.ts
@@ -1,7 +1,9 @@
 import { describe, expect, it } from "bun:test";
 import {
     buildDeployApplicationArgs,
+    buildRemoveApplicationArgs,
     parseApplications,
+    parseDaveConsensus,
     parseLastAcceptedEpoch,
     parseNodeInput,
 } from "../../../src/exec/rollups";
@@ -199,6 +201,63 @@ describe("parseLastAcceptedEpoch", () => {
     });
 });
 
+describe("parseDaveConsensus", () => {
+    const consensus = (overrides: Record<string, unknown> = {}) =>
+        JSON.stringify({
+            type: "DaveConsensus",
+            address: "0xac9dde569ea502f8e002f6ff1bd4aa55386bc4e1",
+            claim_staging_period: 300,
+            is_tournament_result_staged: false,
+            current_epoch_number: 0,
+            sentry_manager: "0x9965507d1a55bcc2695c58ba16fb37d819b0a4dc",
+            num_sentries: 2,
+            sentries: [
+                {
+                    id: 1,
+                    address: "0x1111111111111111111111111111111111111111",
+                },
+                {
+                    id: 2,
+                    address: "0x2222222222222222222222222222222222222222",
+                },
+            ],
+            ...overrides,
+        });
+
+    it("should read the sentries in ID order, with checksummed addresses", () => {
+        expect(parseDaveConsensus(consensus())).toEqual({
+            address: "0xac9dDe569EA502f8e002f6Ff1Bd4AA55386Bc4E1",
+            claimStagingPeriod: 300,
+            sentryManager: "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
+            sentries: [
+                {
+                    id: 1,
+                    address: "0x1111111111111111111111111111111111111111",
+                },
+                {
+                    id: 2,
+                    address: "0x2222222222222222222222222222222222222222",
+                },
+            ],
+            allSentriesAgree: undefined,
+        });
+    });
+
+    // the node reports it only while a result is staged
+    it("should read whether all sentries agree when reported", () => {
+        expect(
+            parseDaveConsensus(consensus({ all_sentries_agree: true }))
+                .allSentriesAgree,
+        ).toBe(true);
+    });
+
+    it("should reject another consensus type", () => {
+        expect(() =>
+            parseDaveConsensus(consensus({ type: "Authority" })),
+        ).toThrow("is a Authority, not a DaveConsensus");
+    });
+});
+
 describe("buildDeployApplicationArgs", () => {
     const base = {
         claimStagingPeriod: 720,
@@ -243,6 +302,20 @@ describe("buildDeployApplicationArgs", () => {
         expect(args).not.toContain("--epoch-length");
     });
 
+    // the shell's redeploy passes the last consensus, which a prt deploy
+    // can't reuse: the node creates a new DaveConsensus for the new machine
+    it("should not pass the consensus with prt", () => {
+        const args = buildDeployApplicationArgs({
+            ...base,
+            consensus: "0xabcdefabcdefabcdefabcdefabcdefabcdefabcd",
+            prt: true,
+        });
+
+        expect(args).toContain("--prt");
+        expect(args).not.toContain("--consensus");
+        expect(args).toContain("--epoch-length");
+    });
+
     it("should start with the name and snapshot path and end with --json", () => {
         const args = buildDeployApplicationArgs(base);
 
@@ -250,6 +323,44 @@ describe("buildDeployApplicationArgs", () => {
         expect(args.at(-1)).toBe("--json");
     });
 
+    // the node takes the sentries as one comma separated list, in ID order
+    it("should pass the sentries and their manager with prt", () => {
+        const args = buildDeployApplicationArgs({
+            ...base,
+            prt: true,
+            sentries: [
+                "0x1111111111111111111111111111111111111111",
+                "0x2222222222222222222222222222222222222222",
+            ],
+            sentryManager: "0x3333333333333333333333333333333333333333",
+        });
+
+        expect(args).toContain("--prt");
+        expect(args[args.indexOf("--sentries") + 1]).toBe(
+            "0x1111111111111111111111111111111111111111,0x2222222222222222222222222222222222222222",
+        );
+        expect(args[args.indexOf("--sentry-manager") + 1]).toBe(
+            "0x3333333333333333333333333333333333333333",
+        );
+    });
+
+    it("should pass neither sentries nor a manager when none are set", () => {
+        const args = buildDeployApplicationArgs({ ...base, prt: true });
+
+        expect(args).not.toContain("--sentries");
+        expect(args).not.toContain("--sentry-manager");
+    });
+
+    it("should pass no --sentries for an empty list", () => {
+        const args = buildDeployApplicationArgs({
+            ...base,
+            prt: true,
+            sentries: [],
+        });
+
+        expect(args).not.toContain("--sentries");
+    });
+
     it("should pass the withdrawal config as JSON", () => {
         const args = buildDeployApplicationArgs({
             ...base,
@@ -268,3 +379,19 @@ describe("buildDeployApplicationArgs", () => {
         );
     });
 });
+
+describe("buildRemoveApplicationArgs", () => {
+    // the node refuses `app remove` without --allow-abandonment, so a forced
+    // removal, like the shell's undeploy before a redeploy, must pass it
+    it("should acknowledge the abandoned work when forced", () => {
+        expect(
+            buildRemoveApplicationArgs({ application: "echo", force: true }),
+        ).toEqual(["echo", "--allow-abandonment", "--yes"]);
+    });
+
+    it("should leave the confirmation to the node when not forced", () => {
+        expect(
+            buildRemoveApplicationArgs({ application: "echo", force: false }),
+        ).toEqual(["echo"]);
+    });
+});
diff --git a/apps/cli/tests/unit/prt.test.ts b/apps/cli/tests/unit/prt.test.ts
new file mode 100644
index 00000000..87cdbc70
--- /dev/null
+++ b/apps/cli/tests/unit/prt.test.ts
@@ -0,0 +1,668 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { Address } from "viem";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+import { InvalidPrtConfigError, type PrtNode } from "../../src/config";
+import {
+    checkPrtNodes,
+    describePrtNode,
+    describeReference,
+    PRT_FUNDING,
+    PRT_POOL_SIZE,
+    PRT_POOL_START,
+    type PrtClient,
+    readerModeChanged,
+    readKeyFile,
+    resolvePrtNodes,
+    sentriesOf,
+} from "../../src/prt";
+import { getDevnetAccount } from "../../src/wallet";
+import { DEVNET_GUARDIAN } from "../../src/withdrawal";
+
+const devnet = (index: number) => getDevnetAccount(index).address;
+const external: Address = "0x4444444444444444444444444444444444444444";
+// a sling node that holds a sentry slot
+const sling = (node: Partial<PrtNode> = {}): PrtNode => ({
+    type: "sling",
+    sentry: true,
+    ...node,
+});
+// a sling node with no slot
+const validator = (node: Partial<PrtNode> = {}): PrtNode => ({
+    type: "sling",
+    sentry: false,
+    ...node,
+});
+const appointed = (address: Address): PrtNode => ({ sentry: true, address });
+const reference = (claim: boolean): PrtNode => ({
+    type: "reference",
+    sentry: false,
+    claim,
+});
+const resolve = (
+    nodes: Record<string, PrtNode>,
+    options?: { guardian?: Address },
+) => resolvePrtNodes({ nodes }, options);
+
+// key files of the developer's own, never devnet accounts
+let dir: string;
+const keyFile = (content: string, name = `${Math.random()}.key`) => {
+    const file = path.join(dir, name);
+    fs.writeFileSync(file, content);
+    return file;
+};
+const ownKey = generatePrivateKey();
+const ownAddress = privateKeyToAccount(ownKey).address;
+
+beforeAll(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "prt-"));
+});
+
+afterAll(() => fs.rmSync(dir, { recursive: true, force: true }));
+
+describe("resolvePrtNodes", () => {
+    it("should give bare entries the pool accounts in file order, with their keys", () => {
+        const { nodes } = resolve({ a: sling(), b: sling(), c: sling() });
+
+        expect(nodes.map(({ address }) => address)).toEqual([
+            devnet(20),
+            devnet(21),
+            devnet(22),
+        ]);
+        expect(nodes.map(({ source }) => source)).toEqual([
+            { kind: "pool", index: 20 },
+            { kind: "pool", index: 21 },
+            { kind: "pool", index: 22 },
+        ]);
+        expect(nodes.map(({ privateKey }) => privateKey)).toEqual([
+            getDevnetAccount(20).privateKey,
+            getDevnetAccount(21).privateKey,
+            getDevnetAccount(22).privateKey,
+        ]);
+    });
+
+    it("should start the pool after the accounts anvil funds", () => {
+        expect(PRT_POOL_START).toBe(20);
+        expect(PRT_POOL_SIZE).toBe(10);
+    });
+
+    // an entry that names a pool account keeps it, so the pool must not hand
+    // the same account to a bare entry, wherever the two are
+    it("should skip a pool account another entry names", () => {
+        const { nodes } = resolve({
+            a: sling(),
+            b: sling({ address: devnet(21) }),
+            c: sling(),
+        });
+
+        expect(nodes.map(({ address }) => address)).toEqual([
+            devnet(20),
+            devnet(21),
+            devnet(22),
+        ]);
+    });
+
+    it("should skip a pool account named later in the config", () => {
+        const { nodes } = resolve({ a: sling(), b: appointed(devnet(20)) });
+
+        expect(nodes.map(({ address }) => address)).toEqual([
+            devnet(21),
+            devnet(20),
+        ]);
+    });
+
+    it("should fail naming the entry when the pool runs out", () => {
+        const nodes = Object.fromEntries(
+            Array.from({ length: PRT_POOL_SIZE + 1 }, (_, i) => [
+                `n${i + 1}`,
+                sling(),
+            ]),
+        );
+
+        expect(() => resolve(nodes)).toThrowError(
+            new InvalidPrtConfigError(
+                "needs an address: the PRT pool, devnet accounts 20 to 29, is used up",
+                "[prt.nodes.n11]",
+            ),
+        );
+    });
+
+    it("should keep explicit addresses and tell devnet accounts from others", () => {
+        const { nodes } = resolve({
+            a: sling({ address: devnet(2) }),
+            b: appointed(devnet(25)),
+            c: appointed(external),
+        });
+
+        expect(
+            nodes.map(({ address, privateKey, source }) => [
+                address,
+                source,
+                privateKey,
+            ]),
+        ).toEqual([
+            [
+                devnet(2),
+                { kind: "devnet", index: 2 },
+                getDevnetAccount(2).privateKey,
+            ],
+            [devnet(25), { kind: "pool", index: 25 }, undefined],
+            [external, { kind: "external" }, undefined],
+        ]);
+    });
+
+    // the CLI can run a node only with a key it has
+    it("should fail for a type on an address the CLI has no key for", () => {
+        expect(() => resolve({ a: sling({ address: external }) })).toThrowError(
+            new InvalidPrtConfigError(
+                `the CLI has no key for ${external}: set private_key_file to run the node with it, or drop the type to appoint it only`,
+                "[prt.nodes.a]",
+            ),
+        );
+    });
+
+    // the ID on the consensus is the position among the sentries
+    it("should number the sentries in file order, labelled by their keys", () => {
+        const { nodes } = resolve({
+            first: sling(),
+            theirs: appointed(external),
+            last: sling(),
+        });
+
+        expect(nodes.map(({ label, sentryId }) => [label, sentryId])).toEqual([
+            ["first", 1],
+            ["theirs", 2],
+            ["last", 3],
+        ]);
+        expect(
+            sentriesOf({ reference: { claim: true }, nodes, warnings: [] }),
+        ).toEqual(nodes);
+    });
+
+    it("should carry the type, the sentry flag and the manager", () => {
+        const resolved = resolvePrtNodes({
+            sentryManager: devnet(5),
+            nodes: { a: sling(), b: appointed(external) },
+        });
+
+        expect(resolved.sentryManager).toBe(devnet(5));
+        expect(
+            resolved.nodes.map(({ sentry, type }) => [sentry, type]),
+        ).toEqual([
+            [true, "sling"],
+            [true, undefined],
+        ]);
+        expect(resolved.warnings).toEqual([]);
+    });
+
+    it("should warn about a manager with no sentries to rotate", () => {
+        const { warnings } = resolvePrtNodes({
+            sentryManager: devnet(5),
+            nodes: {},
+        });
+
+        expect(warnings).toEqual([
+            "[prt].sentry_manager is set but no [prt.nodes] entry is a sentry, so the manager has no sentries to rotate",
+        ]);
+    });
+
+    describe("with a key file", () => {
+        it("should take the address from the key, without one in the entry", () => {
+            const file = keyFile(ownKey);
+            const { nodes } = resolve({
+                mine: sling({ privateKeyFile: file }),
+            });
+
+            expect(nodes[0]).toEqual({
+                label: "mine",
+                address: ownAddress,
+                type: "sling",
+                sentry: true,
+                sentryId: 1,
+                source: { kind: "key-file", path: file },
+            });
+            // the key stays in the file: the init service copies it
+            expect(nodes[0].privateKey).toBeUndefined();
+        });
+
+        it("should accept an address that matches the key", () => {
+            const { nodes } = resolve({
+                mine: sling({
+                    address: ownAddress,
+                    privateKeyFile: keyFile(ownKey),
+                }),
+            });
+
+            expect(nodes[0].address).toBe(ownAddress);
+        });
+
+        it("should fail for an address the key doesn't match, naming both", () => {
+            const file = keyFile(ownKey);
+
+            expect(() =>
+                resolve({
+                    mine: sling({ address: external, privateKeyFile: file }),
+                }),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    `private_key_file "${file}" is the key of ${ownAddress}, not ${external}`,
+                    "[prt.nodes.mine]",
+                ),
+            );
+        });
+
+        // the devnet keys are public and derived by the CLI itself
+        it("should fail for the key of a devnet account", () => {
+            const file = keyFile(getDevnetAccount(3).privateKey);
+
+            expect(() =>
+                resolve({ mine: sling({ privateKeyFile: file }) }),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    `private_key_file "${file}" holds the key of devnet account 3, which the CLI derives itself. Drop the file, or set the address instead`,
+                    "[prt.nodes.mine]",
+                ),
+            );
+        });
+
+        // a key file's address is known only after reading it
+        it("should fail when a key file repeats the address of another entry", () => {
+            expect(() =>
+                resolve({
+                    theirs: appointed(ownAddress),
+                    mine: sling({ privateKeyFile: keyFile(ownKey) }),
+                }),
+            ).toThrowError(
+                new InvalidPrtConfigError(
+                    `address ${ownAddress} is also the address of [prt.nodes.theirs]`,
+                    "[prt.nodes.mine]",
+                ),
+            );
+        });
+
+        it("should skip a pool account only when an entry names it", () => {
+            const { nodes } = resolve({
+                mine: sling({ privateKeyFile: keyFile(ownKey) }),
+                a: sling(),
+            });
+
+            expect(nodes.map(({ address }) => address)).toEqual([
+                ownAddress,
+                devnet(20),
+            ]);
+        });
+    });
+
+    // a node the CLI runs sends transactions of its own
+    describe("on an account the node or the CLI sends from", () => {
+        it.each([
+            [
+                0,
+                "devnet account 0 signs the node's claims, so it can't also run [prt.nodes.a]",
+            ],
+            [
+                6,
+                "devnet account 6 signs the node's PRT transactions, so it can't also run [prt.nodes.a]",
+            ],
+        ])("should fail for devnet account %i", (index, reason) => {
+            expect(() =>
+                resolve({ a: sling({ address: devnet(index) }) }),
+            ).toThrowError(new InvalidPrtConfigError(reason, "[prt.nodes.a]"));
+        });
+
+        it("should warn for the default sender of send and deposit", () => {
+            const { warnings } = resolve({ a: sling({ address: devnet(8) }) });
+
+            expect(warnings).toEqual([
+                "[prt.nodes.a] is devnet account 8, the default sender of cartesi send and deposit, so their transactions may collide",
+            ]);
+        });
+
+        it("should warn for the guardian, devnet or not", () => {
+            expect(
+                resolve(
+                    { a: sling({ address: DEVNET_GUARDIAN }) },
+                    { guardian: DEVNET_GUARDIAN },
+                ).warnings,
+            ).toEqual([
+                "[prt.nodes.a] is the guardian of the application, so its transactions may collide with an emergency withdrawal",
+            ]);
+            expect(
+                resolve(
+                    { a: sling({ privateKeyFile: keyFile(ownKey) }) },
+                    { guardian: ownAddress },
+                ).warnings,
+            ).toEqual([
+                "[prt.nodes.a] is the guardian of the application, so its transactions may collide with an emergency withdrawal",
+            ]);
+        });
+
+        it("should accept an appointed-only entry on any account", () => {
+            const { warnings } = resolve(
+                { a: appointed(devnet(0)), b: appointed(devnet(1)) },
+                { guardian: devnet(1) },
+            );
+
+            expect(warnings).toEqual([]);
+        });
+    });
+});
+
+// the rollups-node's own entry: implied when omitted, and the one place that says whether
+// the node claims
+describe("with a reference entry", () => {
+    it("should imply a claiming reference node when the config has none", () => {
+        const resolved = resolve({ a: sling() });
+
+        expect(resolved.reference).toEqual({ claim: true });
+        expect(resolved.nodes.map(({ label }) => label)).toEqual(["a"]);
+    });
+
+    it("should keep the reference entry out of the nodes and the pool", () => {
+        const resolved = resolve({
+            reference: reference(false),
+            a: sling(),
+            blue: validator(),
+        });
+
+        expect(resolved.reference).toEqual({
+            label: "reference",
+            claim: false,
+        });
+        expect(
+            resolved.nodes.map(({ label, address, sentryId }) => [
+                label,
+                address,
+                sentryId,
+            ]),
+        ).toEqual([
+            ["a", devnet(20), 1],
+            ["blue", devnet(21), undefined],
+        ]);
+    });
+
+    // every sling node claims; the flag only appoints
+    it("should number sentries only, and leave validators out of the deploy", () => {
+        const resolved = resolve({ blue: validator(), a: sling(), b: sling() });
+
+        expect(resolved.nodes.map(({ sentryId }) => sentryId)).toEqual([
+            undefined,
+            1,
+            2,
+        ]);
+        expect(sentriesOf(resolved).map(({ label }) => label)).toEqual([
+            "a",
+            "b",
+        ]);
+    });
+
+    // the node has a PRT signer only when it claims
+    it("should free devnet account 6 when the reference node reads", () => {
+        expect(
+            resolve({
+                reference: reference(false),
+                blue: validator({ address: devnet(6) }),
+            }).warnings,
+        ).toEqual([]);
+        expect(() =>
+            resolve({ a: sling({ address: devnet(6) }) }),
+        ).toThrowError(
+            "devnet account 6 signs the node's PRT transactions, so it can't also run [prt.nodes.a]",
+        );
+    });
+
+    it("should still reserve devnet account 0 for the node", () => {
+        expect(() =>
+            resolve({
+                reference: reference(false),
+                blue: validator({ address: devnet(0) }),
+            }),
+        ).toThrowError(
+            "devnet account 0 signs the node's claims, so it can't also run [prt.nodes.blue]",
+        );
+    });
+
+    it("should fund a validator with the pool", async () => {
+        const calls: { address: Address; value: bigint }[] = [];
+        const client: PrtClient = {
+            getBalance: async () => 1n,
+            setBalance: async ({ address, value }) => {
+                calls.push({ address, value });
+            },
+        };
+
+        await checkPrtNodes(client, resolve({ blue: validator() }));
+
+        expect(calls).toEqual([{ address: devnet(20), value: PRT_FUNDING }]);
+    });
+
+    it("should describe a validator without a sentry ID", () => {
+        expect(describePrtNode(resolve({ blue: validator() }).nodes[0])).toBe(
+            `validator blue ${devnet(20)} (devnet account 20, funded by the CLI)`,
+        );
+    });
+
+    it("should describe the reference node by its claim setting", () => {
+        expect(describeReference(resolve({ a: sling() }))).toBe(
+            "rollups-node claims",
+        );
+        expect(
+            describeReference(resolve({ reference: reference(false) })),
+        ).toBe("rollups-node reads (claim = false, no PRT signer)");
+    });
+
+    // PRT is permissionless, so a claimer may run outside the CLI
+    it("should warn when nothing the CLI runs claims", () => {
+        expect(
+            resolve({
+                reference: reference(false),
+                theirs: appointed(external),
+            }).warnings,
+        ).toEqual([
+            'nothing the CLI runs claims: [prt.nodes.reference] has claim = false and no entry has type = "sling", so a claimer must run elsewhere',
+        ]);
+        expect(
+            resolve({ reference: reference(false), blue: validator() })
+                .warnings,
+        ).toEqual([]);
+    });
+
+    // a sling sentry votes for its own claim
+    it("should warn when the only sentries are slings and the node reads", () => {
+        const warning =
+            "every sentry is a sling node the CLI runs and the rollups-node reads, so a claim is accepted as soon as its own authors vote for it";
+
+        expect(
+            resolve({ reference: reference(false), a: sling() }).warnings,
+        ).toEqual([warning]);
+        expect(
+            resolve({
+                reference: reference(false),
+                a: sling(),
+                theirs: appointed(external),
+            }).warnings,
+        ).toEqual([]);
+        expect(resolve({ a: sling() }).warnings).toEqual([]);
+    });
+
+    // the node's mode is saved in its database at the first start
+    describe("readerModeChanged", () => {
+        const nodeClaims = resolve({ a: sling() });
+        const nodeReads = resolve({ reference: reference(false), a: sling() });
+
+        it("should accept the same mode, whatever the other entries do", () => {
+            expect(readerModeChanged(undefined, undefined)).toBeUndefined();
+            expect(readerModeChanged(nodeClaims, nodeClaims)).toBeUndefined();
+            expect(readerModeChanged(nodeReads, nodeReads)).toBeUndefined();
+            expect(
+                readerModeChanged(
+                    nodeClaims,
+                    resolve({ reference: reference(true), b: validator() }),
+                ),
+            ).toBeUndefined();
+            expect(
+                readerModeChanged(
+                    nodeReads,
+                    resolve({ reference: reference(false), red: validator() }),
+                ),
+            ).toBeUndefined();
+        });
+
+        it("should warn when the reference node switches to reading", () => {
+            expect(readerModeChanged(nodeClaims, nodeReads)).toBe(
+                "the rollups-node's claim setting changed to claim = false in cartesi.toml. Restart cartesi run to apply it. This rebuild keeps the [prt] setup it started with.",
+            );
+            expect(readerModeChanged(undefined, nodeReads)).toBe(
+                "the rollups-node's claim setting changed to claim = false in cartesi.toml. Restart cartesi run to apply it. This rebuild keeps the [prt] setup it started with.",
+            );
+        });
+
+        it("should warn when the reference node switches back to claiming", () => {
+            expect(readerModeChanged(nodeReads, nodeClaims)).toBe(
+                "the rollups-node's claim setting changed to claim = true in cartesi.toml. Restart cartesi run to apply it. This rebuild keeps the [prt] setup it started with.",
+            );
+        });
+    });
+});
+
+describe("readKeyFile", () => {
+    const bare = ownKey.slice(2);
+
+    it.each([
+        ["with 0x", ownKey],
+        ["without 0x", bare],
+        ["with a trailing newline", `${ownKey}\n`],
+        ["with surrounding whitespace", `  ${bare}\t\n`],
+        ["with more lines after the key", `${ownKey}\nsecond line\n`],
+    ])("should read a key %s", (_, content) => {
+        expect(readKeyFile(keyFile(content), "[prt.nodes.mine]")).toBe(ownKey);
+    });
+
+    it.each([
+        [
+            "a mnemonic",
+            "test test test test test test test test test test test junk",
+        ],
+        ["a short key", "0x1234"],
+        ["an empty file", ""],
+        ["a key on the second line", `\n${ownKey}`],
+    ])("should reject %s without printing it", (_, content) => {
+        const file = keyFile(content);
+
+        expect(() => readKeyFile(file, "[prt.nodes.mine]")).toThrowError(
+            new InvalidPrtConfigError(
+                `the first line of private_key_file "${file}" must be a hex private key, 64 hex digits with or without 0x`,
+                "[prt.nodes.mine]",
+            ),
+        );
+    });
+
+    it("should fail for a file that can't be read", () => {
+        const file = path.join(dir, "missing.key");
+
+        expect(() => readKeyFile(file, "[prt.nodes.mine]")).toThrowError(
+            new InvalidPrtConfigError(
+                `private_key_file "${file}" can't be read`,
+                "[prt.nodes.mine]",
+            ),
+        );
+    });
+});
+
+describe("checkPrtNodes", () => {
+    const fakeClient = (balances: Record<string, bigint> = {}) => {
+        const calls: { method: string; address: Address; value?: bigint }[] =
+            [];
+        const client: PrtClient = {
+            getBalance: async ({ address }) => {
+                calls.push({ method: "getBalance", address });
+                return balances[address] ?? 0n;
+            },
+            setBalance: async ({ address, value }) => {
+                calls.push({ method: "setBalance", address, value });
+            },
+        };
+        return { calls, client };
+    };
+
+    it("should fund the pool accounts only, with what anvil gives its accounts", async () => {
+        const { calls, client } = fakeClient({ [devnet(2)]: 1n });
+        const prt = resolve({
+            a: sling(),
+            b: sling({ address: devnet(2) }),
+            c: appointed(external),
+        });
+
+        await checkPrtNodes(client, prt);
+
+        expect(PRT_FUNDING).toBe(10_000n * 10n ** 18n);
+        expect(calls).toEqual([
+            {
+                method: "setBalance",
+                address: devnet(20),
+                value: PRT_FUNDING,
+            },
+            { method: "getBalance", address: devnet(2) },
+        ]);
+    });
+
+    it("should fail for a node of the developer's own with no ETH", async () => {
+        const { client } = fakeClient();
+        const prt = resolve({
+            mine: sling({ privateKeyFile: keyFile(ownKey) }),
+        });
+
+        expect(checkPrtNodes(client, prt)).rejects.toThrowError(
+            `sentry mine ${ownAddress} has no ETH on this devnet. Fund it before cartesi run, e.g. with cast rpc anvil_setBalance`,
+        );
+    });
+
+    it("should do nothing without nodes to run", async () => {
+        const { calls, client } = fakeClient();
+
+        await checkPrtNodes(client, resolve({ a: appointed(external) }));
+
+        expect(calls).toEqual([]);
+    });
+});
+
+describe("describePrtNode", () => {
+    const describe_ = (nodes: Record<string, PrtNode>, index = 0) =>
+        describePrtNode(resolve(nodes).nodes[index]);
+
+    it("should name a pool account as funded by the CLI", () => {
+        expect(describe_({ a: sling() })).toBe(
+            `sentry 1 a ${devnet(20)} (devnet account 20, funded by the CLI)`,
+        );
+    });
+
+    it("should name another devnet account", () => {
+        expect(describe_({ two: sling({ address: devnet(2) }) })).toBe(
+            `sentry 1 two ${devnet(2)} (devnet account 2)`,
+        );
+    });
+
+    it("should name the key file of the developer's own node", () => {
+        const file = keyFile(ownKey, "sentry.key");
+
+        expect(describe_({ mine: sling({ privateKeyFile: file }) })).toBe(
+            `sentry 1 mine ${ownAddress} (key in ${file})`,
+        );
+    });
+
+    it("should tell a sentry that is appointed only", () => {
+        expect(describe_({ a: sling(), theirs: appointed(external) }, 1)).toBe(
+            `sentry 2 theirs ${external} (appointed only)`,
+        );
+    });
+
+    // what the CLI does comes first: a devnet address alone would read as
+    // an entry the CLI runs
+    it("should tell an appointed-only sentry on a devnet account", () => {
+        expect(describe_({ theirs: appointed(devnet(3)) })).toBe(
+            `sentry 1 theirs ${devnet(3)} (appointed only, devnet account 3)`,
+        );
+    });
+});
diff --git a/apps/cli/tests/unit/validations.test.ts b/apps/cli/tests/unit/validations.test.ts
index f75188e2..6bb6f20d 100644
--- a/apps/cli/tests/unit/validations.test.ts
+++ b/apps/cli/tests/unit/validations.test.ts
@@ -1,5 +1,6 @@
 import {
     afterAll,
+    beforeAll,
     beforeEach,
     describe,
     expect,
@@ -7,6 +8,9 @@ import {
     mock,
     spyOn,
 } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import * as viem from "viem";
 import { celo, sepolia } from "viem/chains";
 import {
@@ -21,7 +25,11 @@ import {
 import ForkChainValidationError from "../../src/errors/ForkChainValidationError";
 import UnsupportedForkChainError from "../../src/errors/UnsupportedForkChainError";
 import type { ForkConfig } from "../../src/types/chain";
-import { assertForkConfig } from "../../src/validations";
+import {
+    assertBlockchainEndpoint,
+    assertForkConfig,
+    assertSecretFiles,
+} from "../../src/validations";
 
 const mockGetBlockNumber = mock().mockResolvedValue(12345n);
 const mockGetCode = mock().mockResolvedValue("0x1234");
@@ -311,4 +319,125 @@ describe("validations", () => {
             expect(mockGetCode.mock.calls[0][0].blockNumber).toBe(999n);
         });
     });
+
+    describe("assertSecretFiles", () => {
+        let dir: string;
+        let keyFile: string;
+
+        beforeAll(() => {
+            dir = fs.mkdtempSync(path.join(os.tmpdir(), "secrets-"));
+            keyFile = path.join(dir, "key");
+            fs.writeFileSync(keyFile, "0xsecret\n");
+        });
+
+        afterAll(() => fs.rmSync(dir, { recursive: true }));
+
+        it("should accept readable key files", () => {
+            expect(() =>
+                assertSecretFiles({
+                    CARTESI_AUTH_PRIVATE_KEY_FILE: keyFile,
+                    CARTESI_PRT_AUTH_MNEMONIC_FILE: keyFile,
+                }),
+            ).not.toThrow();
+        });
+
+        it("should ignore the variables that name no file", () => {
+            expect(() =>
+                assertSecretFiles({
+                    CARTESI_AUTH_PRIVATE_KEY: "0xsecret",
+                    CARTESI_SNAPSHOTS_DIR: dir,
+                }),
+            ).not.toThrow();
+        });
+
+        it("should name the variable and path of a missing file", () => {
+            const missing = path.join(dir, "missing");
+
+            expect(() =>
+                assertSecretFiles({
+                    CARTESI_PRT_AUTH_PRIVATE_KEY_FILE: missing,
+                }),
+            ).toThrow(
+                `CARTESI_PRT_AUTH_PRIVATE_KEY_FILE must name a readable file: "${missing}"`,
+            );
+        });
+
+        it("should reject a directory", () => {
+            expect(() =>
+                assertSecretFiles({ CARTESI_AUTH_MNEMONIC_FILE: dir }),
+            ).toThrow("CARTESI_AUTH_MNEMONIC_FILE must name a readable file");
+        });
+    });
+
+    // the cases of the node's own tests (internal/httpclient/client_test.go and
+    // internal/config/http_endpoints_test.go), then the edges of Go's url.Parse;
+    // all checked against the alpha.14 node binary, which only differs in
+    // accepting trailing whitespace after the path
+    describe("assertBlockchainEndpoint", () => {
+        const marker = "SECRET";
+        const expectedError =
+            "CARTESI_BLOCKCHAIN_HTTP_ENDPOINT must be an http(s) URL with a DNS name or IP address (redirects are not followed)";
+
+        it.each([
+            "http://localhost:8545",
+            "https://u:p@example.com/path?q=key",
+            "http://[::1]:8545/rpc",
+            `http://user:${marker}@provider.example:8545/a%2Fb?key=${marker}&key=second`,
+            `https://user:${marker}@provider.example:8545/a%2Fb?key=${marker}&key=second`,
+            "HTTPS://provider.example",
+            "http://provider.example:",
+            "http://[fe80::1%25en0]:8545",
+            "http://us%41er@provider.example",
+            "http://ho%c3%a9st",
+            "http://provider.example?%zz",
+        ])("should accept %p", (endpoint) => {
+            expect(() =>
+                assertBlockchainEndpoint({
+                    CARTESI_BLOCKCHAIN_HTTP_ENDPOINT: endpoint,
+                }),
+            ).not.toThrow();
+        });
+
+        it.each([
+            "",
+            `${marker}.sock`,
+            `wss://host/${marker}`,
+            `ws://host/${marker}`,
+            `ipc://host/${marker}`,
+            `file:///tmp/${marker}`,
+            `/tmp/${marker}`,
+            `https:///${marker}`,
+            `http:///${marker}`,
+            `http://:8545/${marker}`,
+            `https://:8545/${marker}`,
+            `http:${marker}`,
+            `http://host/%${marker}`,
+            `https://provider.example/%${marker}`,
+            `http://host:${marker}`,
+            `http://user:${marker}@/`,
+            `http://user:${marker}@host:8545:8545`,
+            `http://[${marker}]:8545`,
+            `http://[::1/${marker}`,
+            `http://[fe80::1%en0]/${marker}`,
+            `http://ho st/${marker}`,
+            `http://ho%20st/${marker}`,
+            `http://us er:${marker}@host`,
+            `http://host/${marker}#%zz`,
+            ` http://host/${marker}`,
+            `http://host/${marker} `,
+            `http://host/${marker}\n`,
+        ])("should reject %p without showing it", (endpoint) => {
+            const assert = () =>
+                assertBlockchainEndpoint({
+                    CARTESI_BLOCKCHAIN_HTTP_ENDPOINT: endpoint,
+                });
+
+            expect(assert).toThrow(expectedError);
+            expect(assert).not.toThrow(marker);
+        });
+
+        it("should leave the endpoint to the CLI when the host sets none", () => {
+            expect(() => assertBlockchainEndpoint({})).not.toThrow();
+        });
+    });
 });
diff --git a/apps/cli/tests/unit/wallet.test.ts b/apps/cli/tests/unit/wallet.test.ts
index 22a03f72..a02f0fb0 100644
--- a/apps/cli/tests/unit/wallet.test.ts
+++ b/apps/cli/tests/unit/wallet.test.ts
@@ -1,6 +1,14 @@
 import { describe, expect, it } from "bun:test";
 import { DEVNET_MNEMONIC } from "../../src/compose/node";
-import { findMnemonicAccountIndex } from "../../src/wallet";
+import type { Address } from "viem";
+import { mnemonicToAccount } from "viem/accounts";
+import {
+    DEFAULT_SENDER_INDEX,
+    DEVNET_ACCOUNTS,
+    findMnemonicAccountIndex,
+    getDefaultSender,
+    getDevnetAccount,
+} from "../../src/wallet";
 
 describe("findMnemonicAccountIndex", () => {
     it("should find the index of a devnet account", () => {
@@ -42,3 +50,61 @@ describe("findMnemonicAccountIndex", () => {
         ).toBeUndefined();
     });
 });
+
+describe("getDefaultSender", () => {
+    const devnetAddresses = (count: number): Address[] =>
+        Array.from(
+            { length: count },
+            (_, addressIndex) =>
+                mnemonicToAccount(DEVNET_MNEMONIC, { addressIndex }).address,
+        );
+    const client = (addresses: Address[]) => ({
+        getAddresses: async () => addresses,
+    });
+
+    it("should be devnet account 8", async () => {
+        expect(DEFAULT_SENDER_INDEX).toBe(8);
+        expect(await getDefaultSender(client(devnetAddresses(10)))).toBe(
+            "0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f",
+        );
+    });
+
+    it("should ask for --from when the RPC exposes too few accounts", async () => {
+        await expect(
+            getDefaultSender(client(devnetAddresses(8))),
+        ).rejects.toThrow(
+            "The RPC exposes 8 accounts, so there is no devnet account 8 to send from; pass --from to choose the sender",
+        );
+    });
+});
+
+describe("getDevnetAccount", () => {
+    it("should derive the address and key of a devnet account", () => {
+        const account = mnemonicToAccount(DEVNET_MNEMONIC, {
+            addressIndex: 20,
+        });
+
+        expect(getDevnetAccount(20)).toEqual({
+            address: account.address,
+            privateKey: `0x${Buffer.from(account.getHdKey().privateKey as Uint8Array).toString("hex")}`,
+        });
+    });
+
+    it("should be the account anvil funds for the first indexes", () => {
+        expect(getDevnetAccount(0).address).toBe(
+            "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
+        );
+        expect(getDevnetAccount(0).privateKey).toBe(
+            "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80",
+        );
+    });
+
+    it.each([-1, 1.5, DEVNET_ACCOUNTS])(
+        "should fail for the index %s",
+        (index) => {
+            expect(() => getDevnetAccount(index)).toThrow(
+                `There is no devnet account ${index}, the CLI derives accounts 0 to ${DEVNET_ACCOUNTS - 1}`,
+            );
+        },
+    );
+});
diff --git a/bun.lock b/bun.lock
index 98f12444..a3cbcea1 100644
--- a/bun.lock
+++ b/bun.lock
@@ -13,12 +13,12 @@
     },
     "apps/cli": {
       "name": "@cartesi/cli",
-      "version": "2.0.0-alpha.40",
+      "version": "2.0.0-alpha.41",
       "bin": {
         "cartesi": "./dist/index.js",
       },
       "devDependencies": {
-        "@cartesi/wagmi-plugin": "1.0.0-alpha.7",
+        "@cartesi/wagmi-plugin": "1.0.0-alpha.9",
         "@commander-js/extra-typings": "^15.0.0",
         "@inquirer/confirm": "^6.3.3",
         "@inquirer/core": "^12.0.4",
@@ -75,7 +75,7 @@
     },
     "packages/sdk": {
       "name": "@cartesi/sdk",
-      "version": "0.12.0-alpha.44",
+      "version": "0.12.0-alpha.45",
     },
     "packages/tsconfig": {
       "name": "tsconfig",
@@ -95,13 +95,13 @@
 
     "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.6.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-fxmvkF81srlS3DiMyfm+aG3J0eG+6/BjaxRyjy57KbLSafnq0PO+hHfVWmtH2ty0S7nm6yDXBRwySfFeaRJKRQ=="],
 
-    "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.6.4", "", { "os": "linux", "cpu": "arm64", "libc": "glibc" }, "sha512-6+bK1Y/evmIUiJr7auertuMbiaYVicJhqA1bZyL47lCMWugv8l0gFQCqvR/gN1vZMHYm+HwoTKgeMxdNFCoQTg=="],
+    "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.6.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-6+bK1Y/evmIUiJr7auertuMbiaYVicJhqA1bZyL47lCMWugv8l0gFQCqvR/gN1vZMHYm+HwoTKgeMxdNFCoQTg=="],
 
-    "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.6.4", "", { "os": "linux", "cpu": "arm64", "libc": "musl" }, "sha512-31ZaH/MHqPX+O+evRwRrCHQ8W5/9adY+/eMytGGWZnRx1T41QsWIF09+/WujynLBhWZUxNGS5CtsWLwgOFTAyg=="],
+    "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.6.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-31ZaH/MHqPX+O+evRwRrCHQ8W5/9adY+/eMytGGWZnRx1T41QsWIF09+/WujynLBhWZUxNGS5CtsWLwgOFTAyg=="],
 
-    "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.6.4", "", { "os": "linux", "cpu": "x64", "libc": "glibc" }, "sha512-tbFZMdL6dP/ws4edXxYG9WhvaVa1ZDzL4G5DzahnWW7Psib9H+VTdyU4XXVxpJk5j/nYZroSbvSNyYlpW3yCIw=="],
+    "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.6.4", "", { "os": "linux", "cpu": "x64" }, "sha512-tbFZMdL6dP/ws4edXxYG9WhvaVa1ZDzL4G5DzahnWW7Psib9H+VTdyU4XXVxpJk5j/nYZroSbvSNyYlpW3yCIw=="],
 
-    "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.6.4", "", { "os": "linux", "cpu": "x64", "libc": "musl" }, "sha512-bomSa2XdQAGGj6Cwdm4M13qE+lN9+AOlW8KtI4hdyVyRRF/Z71qPAi95T4wtdZK0QpBbkTW8hgbZZCwPi4xzIw=="],
+    "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.6.4", "", { "os": "linux", "cpu": "x64" }, "sha512-bomSa2XdQAGGj6Cwdm4M13qE+lN9+AOlW8KtI4hdyVyRRF/Z71qPAi95T4wtdZK0QpBbkTW8hgbZZCwPi4xzIw=="],
 
     "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.6.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-eCsqt8Ma3eVap+oyJCDnJZH60SIU464B66n3y38EUTJdM1T/HfZol1FJC9vb+sHToX0ix8XzqPcwJnOzyAJz0g=="],
 
@@ -113,7 +113,7 @@
 
     "@cartesi/sdk": ["@cartesi/sdk@workspace:packages/sdk"],
 
-    "@cartesi/wagmi-plugin": ["@cartesi/wagmi-plugin@1.0.0-alpha.7", "", { "dependencies": { "abitype": "^1.3.0", "modern-tar": "^0.8.4" }, "peerDependencies": { "@wagmi/cli": "^2.10.0", "viem": "^2.0.0" } }, "sha512-oVgBBMxuEd/xa5OSxToGjRf7nOA9OyjXLmCyH8V19DjZ+k9GNFFfZSDsk7bbDHtia1Vnq4nl6aNU6dU0K7po3w=="],
+    "@cartesi/wagmi-plugin": ["@cartesi/wagmi-plugin@1.0.0-alpha.9", "", { "dependencies": { "abitype": "^1.3.0", "modern-tar": "^0.8.6" }, "peerDependencies": { "@wagmi/cli": "^2.10.0", "viem": "^2.0.0" } }, "sha512-NDk3CQhgY1uowuFz9QVpj0KycSN2nxlmHRM7SxwmtOwRDpZkTlhO1IYXs1YJk92+s3grS9igP8CbpXjCkB76mw=="],
 
     "@changesets/apply-release-plan": ["@changesets/apply-release-plan@8.1.1", "", { "dependencies": { "@changesets/config": "^4.0.1", "@changesets/format": "^0.1.2", "@changesets/git": "^4.0.1", "@changesets/should-skip-package": "^1.0.0", "@changesets/types": "^7.0.0", "import-meta-resolve": "^4.2.0", "jsonc-parser": "^3.3.1", "semver": "^7.8.1" } }, "sha512-nk2Hbq3M9NeHMdaIRBDvawKrQJzXB9sGyBUE5yWnIKtvdcNCPj75zBekJYr0gTT2ecJH3eFeTrc8eisPImcv0Q=="],
 
@@ -245,7 +245,7 @@
 
     "@manypkg/tools": ["@manypkg/tools@2.1.2", "", { "dependencies": { "jju": "^1.4.0", "tinyglobby": "^0.2.13", "yaml": "^2.9.0" } }, "sha512-6QEf6yqFbETdwGITKq57aYoPfX/3K8XFNwsAlx0C1M7o8cb79sv1M3w+tWuWvIcSbNqrLF7OD7YpZMVVz335hQ=="],
 
-    "@napi-rs/lzma-linux-x64-gnu": ["@napi-rs/lzma-linux-x64-gnu@1.5.1", "", { "os": "linux", "cpu": "x64", "libc": "glibc" }, "sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ=="],
+    "@napi-rs/lzma-linux-x64-gnu": ["@napi-rs/lzma-linux-x64-gnu@1.5.1", "", { "os": "linux", "cpu": "x64" }, "sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ=="],
 
     "@noble/ciphers": ["@noble/ciphers@1.3.0", "", {}, "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="],
 
@@ -269,31 +269,31 @@
 
     "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.66.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-GEaUQQjMaG7X1304qMgqLjzCKv6CdDirzJSS+UqUs3xhJ9X2Kjzu0JDbLoUU42FWxwmZqz+SsgU1SlQv9GNRVA=="],
 
-    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.66.0", "", { "os": "linux", "cpu": "arm", "libc": "glibc" }, "sha512-DgmAU9N0NhDQDzHgFUocDio7zRO8jR/nY/obDGvCR8zbJ6J77Fg6X49yPuExJUpYPbC82EOaRhG969pWzUSnHQ=="],
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.66.0", "", { "os": "linux", "cpu": "arm" }, "sha512-DgmAU9N0NhDQDzHgFUocDio7zRO8jR/nY/obDGvCR8zbJ6J77Fg6X49yPuExJUpYPbC82EOaRhG969pWzUSnHQ=="],
 
-    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.66.0", "", { "os": "linux", "cpu": "arm", "libc": "musl" }, "sha512-zG09YZ+sk/HoHq+P9gYB0EseQ3M20RbDuKGWey6fbiMDV1LxfXvhgSW9jDaCcvFPMgfLXpimzXY+UYvA8R2mLQ=="],
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.66.0", "", { "os": "linux", "cpu": "arm" }, "sha512-zG09YZ+sk/HoHq+P9gYB0EseQ3M20RbDuKGWey6fbiMDV1LxfXvhgSW9jDaCcvFPMgfLXpimzXY+UYvA8R2mLQ=="],
 
-    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.66.0", "", { "os": "linux", "cpu": "arm64", "libc": "glibc" }, "sha512-vlArhgyXbcVc1D4WZPoiYuqJIaMiSHBj6etRXua0KlfjlZeuiQyVAPYi0/N49O4mSp3u1iGUBLEjNa8ec81XZg=="],
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.66.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-vlArhgyXbcVc1D4WZPoiYuqJIaMiSHBj6etRXua0KlfjlZeuiQyVAPYi0/N49O4mSp3u1iGUBLEjNa8ec81XZg=="],
 
-    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.66.0", "", { "os": "linux", "cpu": "arm64", "libc": "musl" }, "sha512-RxJZtk0G87YPotDaRDvRqStV8cbqLSC5TroHvQHHKsqBg0ok64RxKgtXeFsa7FBcy7mb4crBrG3xK8USWIqWNA=="],
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.66.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RxJZtk0G87YPotDaRDvRqStV8cbqLSC5TroHvQHHKsqBg0ok64RxKgtXeFsa7FBcy7mb4crBrG3xK8USWIqWNA=="],
 
-    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.66.0", "", { "os": "linux", "cpu": "none", "libc": "glibc" }, "sha512-qlGcw959PrLLkZhiBxF3OZ6SQvj+OKY85mCqGNgSRs4LZlDJ6ICqmz6UdxtINdhcXYwNIbZoapQVBAmZlD2hUQ=="],
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.66.0", "", { "os": "linux", "cpu": "none" }, "sha512-qlGcw959PrLLkZhiBxF3OZ6SQvj+OKY85mCqGNgSRs4LZlDJ6ICqmz6UdxtINdhcXYwNIbZoapQVBAmZlD2hUQ=="],
 
-    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.66.0", "", { "os": "linux", "cpu": "none", "libc": "musl" }, "sha512-TvTI/7Cy0WvRA1SXgwzu6bwXBnMpmeT/ln5q7WvSpqmXy1VbmEnY8HVIDQNBiaHJvoWqRr0M4FNo7qiqtyMaFw=="],
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.66.0", "", { "os": "linux", "cpu": "none" }, "sha512-TvTI/7Cy0WvRA1SXgwzu6bwXBnMpmeT/ln5q7WvSpqmXy1VbmEnY8HVIDQNBiaHJvoWqRr0M4FNo7qiqtyMaFw=="],
 
-    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.66.0", "", { "os": "linux", "cpu": "ppc64", "libc": "glibc" }, "sha512-UZEDkSoDRZ50NyLj70nO6mpIK3dvs2cPTTvQb1bA/PBDmr9fvn5KiESuGfh6srd7Zi6Lt9Sv2sVrFr1QoHLvPQ=="],
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.66.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-UZEDkSoDRZ50NyLj70nO6mpIK3dvs2cPTTvQb1bA/PBDmr9fvn5KiESuGfh6srd7Zi6Lt9Sv2sVrFr1QoHLvPQ=="],
 
-    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.66.0", "", { "os": "linux", "cpu": "ppc64", "libc": "musl" }, "sha512-VRbxTvagLh3HRcysx1CNq+HHcvJbSebNI6fCbk7jwmmWHkXjrSIV3igXBpRHUTFdg0pagWGu50xoSZXnrZHjVQ=="],
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.66.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-VRbxTvagLh3HRcysx1CNq+HHcvJbSebNI6fCbk7jwmmWHkXjrSIV3igXBpRHUTFdg0pagWGu50xoSZXnrZHjVQ=="],
 
-    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.66.0", "", { "os": "linux", "cpu": "none", "libc": "glibc" }, "sha512-uWdJpvYqh0LE/i+YBL3sMX0a2kUkICENjmrPmyBmMOFc3jMrs6MSQH/pMD+VIpGEoUcr3XkHGLLfymzIqPSRRg=="],
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.66.0", "", { "os": "linux", "cpu": "none" }, "sha512-uWdJpvYqh0LE/i+YBL3sMX0a2kUkICENjmrPmyBmMOFc3jMrs6MSQH/pMD+VIpGEoUcr3XkHGLLfymzIqPSRRg=="],
 
-    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.66.0", "", { "os": "linux", "cpu": "none", "libc": "musl" }, "sha512-3FUd88pxgWAjK60OgCrika1AcNG+u8zaCdWjg4TlcZTDkt5TGyci8ZU64l3OJ9ax0MEjw3P80B/3PoSQDCLwJQ=="],
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.66.0", "", { "os": "linux", "cpu": "none" }, "sha512-3FUd88pxgWAjK60OgCrika1AcNG+u8zaCdWjg4TlcZTDkt5TGyci8ZU64l3OJ9ax0MEjw3P80B/3PoSQDCLwJQ=="],
 
-    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.66.0", "", { "os": "linux", "cpu": "s390x", "libc": "glibc" }, "sha512-qT2rMmgyej62g5AdwktK+Bt2lBu497pzWZe12TTQ5JmZjOYPnEwcPEAOSLTBxBV+6gIES75rXm219v/QkT397A=="],
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.66.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-qT2rMmgyej62g5AdwktK+Bt2lBu497pzWZe12TTQ5JmZjOYPnEwcPEAOSLTBxBV+6gIES75rXm219v/QkT397A=="],
 
-    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.66.0", "", { "os": "linux", "cpu": "x64", "libc": "glibc" }, "sha512-E46rnZgp7J84Qwe8RMlF+rgimnDo/9fuiGbUArGB0ZkMWf97O7yeSCfKls5x/YJOF0RcuSe9RctuKe1hlxICiA=="],
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.66.0", "", { "os": "linux", "cpu": "x64" }, "sha512-E46rnZgp7J84Qwe8RMlF+rgimnDo/9fuiGbUArGB0ZkMWf97O7yeSCfKls5x/YJOF0RcuSe9RctuKe1hlxICiA=="],
 
-    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.66.0", "", { "os": "linux", "cpu": "x64", "libc": "musl" }, "sha512-Uz1HiZe+qBzqgdPsON+z0wRx3WdATuyzwvGT6cr2VZVrqqko0ZJVfkrQJtwDMuDcAfXYdo7XucaxJ7lTLjEcgg=="],
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.66.0", "", { "os": "linux", "cpu": "x64" }, "sha512-Uz1HiZe+qBzqgdPsON+z0wRx3WdATuyzwvGT6cr2VZVrqqko0ZJVfkrQJtwDMuDcAfXYdo7XucaxJ7lTLjEcgg=="],
 
     "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.66.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-Ph7TX3Ex5qdfcb7Tc6eEPugVkRfJ501eTovO4T5029YObfpZ7dzn3RiwpFvGp50nk2QUhvBMZ0PFGlEj6pOYTg=="],
 
@@ -1091,7 +1091,7 @@
 
     "tsup/chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
 
-    "tsup/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "hasInstallScript": true, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+    "tsup/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
 
     "tsup/tinyexec": ["tinyexec@0.3.2", "", {}, "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="],