refactor: centralize root runtime sources (#3846)

docs/architecture/migration-progress.md

@@ -5,9 +5,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
 ## Current Context
 
 - Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660)
-- Branch: `overtrue/arch-admin-runtime-sources-batch`
-- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201/API-202/API-203/API-204/API-205`.
-- Based on: `origin/main` after PR #3843.
+- Branch: `overtrue/arch-root-runtime-sources-batch`
+- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201/API-202/API-203/API-204/API-205/API-206`.
+- Based on: stacked on PR #3845 head while PR #3845 is pending.
 - PR type for this branch: `consumer-migration`
 - Runtime behavior changes: none.
 - Rust code changes: route replication pool, outbound TLS generation, runtime
@@ -45,7 +45,7 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
   readiness-time, observability, metrics, buffer, and TLS runtime source
   helpers, plus server readiness/audit/event/module-switch runtime source
   helpers, storage request/RPC/SSE runtime source helpers, and admin
-  handler/service/router runtime source helpers,
+  handler/service/router runtime source helpers, plus root auth/init/config/protocol/workload, app usecase, and storage node-service runtime source helpers,
   through AppContext-first or owner-crate resolver boundaries.
 - CI/script changes: lock completed owner and test/fuzz boundaries against
   bare/glob imports, scattered raw ECStore facade subpaths, and startup
@@ -56,8 +56,8 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
   event-bridge thin module regressions, plus IAM runtime-source bypasses;
   accept the reviewed AppContext resolver reverse dependencies in the layer
   baseline, and block direct admin AppContext resolver consumers outside the
-  admin runtime-source boundary.
-- Docs changes: record the API-136 through API-205 owner facade and lifecycle
+  admin runtime-source boundary, and block root, app usecase, and storage direct AppContext resolver consumers outside their runtime-source boundaries.
+- Docs changes: record the API-136 through API-206 owner facade and lifecycle
   runtime-source cleanup.
 
 ## Phase 0 Tasks
@@ -4954,6 +4954,21 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
     layer guards, diff hygiene, residual direct AppContext scan, Rust risk
     scan, fast PR gate, and full PR gate before PR.
 
+- [x] `API-206` Centralize root, app, and storage RPC runtime source readers.
+  - Do: route root auth/init/config/protocol/workload consumers, app usecase
+    consumers, and storage node-service runtime resolver consumers through
+    root, app, or storage runtime-source boundaries.
+  - Acceptance: migrated root/app/storage consumers no longer import AppContext
+    resolvers directly, and migration rules reject reintroducing those direct
+    resolver reads outside the owner runtime-source modules.
+  - Must preserve: request credential lookup, IAM readiness checks, update and
+    notification startup behavior, runtime region and buffer config lookup,
+    workload admission replication status, S3 Select DB lookup, app-context
+    object-store/notification resolution, and node-service IAM/lock behavior.
+  - Verification: focused RustFS compile/tests, formatting, migration and layer
+    guards, diff hygiene, residual direct AppContext scan, Rust risk scan, fast
+    PR gate, and full PR gate before PR.
+
 ## Next PRs
 
 1. `consumer-migration`: continue reducing direct global reads behind AppContext resolver boundaries.
@@ -4962,6 +4977,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
 
 | Expert | Status | Notes |
 |---|---|---|
+| Quality/architecture | pass | API-206 keeps root, app usecase, and storage node-service AppContext resolver consumers behind owner runtime-source boundaries and adds regression guards. |
+| Migration preservation | pass | Request credentials, IAM readiness, startup notify/region, buffer config, workload admission, S3 Select, app-context object-store/notify, and node-service IAM/lock behavior preserve existing semantics. |
+| Testing/verification | pass | Focused RustFS compile/tests, formatting, migration/layer guards, residual scan, fast PR gate, and full PR gate are planned before PR. |
 | Quality/architecture | pass | API-205 keeps direct admin AppContext resolver consumers behind the admin runtime-source boundary and adds a guard against regressions. |
 | Migration preservation | pass | Admin auth, IAM readiness, KMS manager fallback, site replication TLS, config publication, and object-store resolver behavior preserve existing semantics. |
 | Testing/verification | pass | Focused admin compile/tests, formatting, migration/layer guards, residual scan, fast PR gate, and full PR gate are planned before PR. |

rustfs/src/app/admin_usecase.rs

@@ -19,7 +19,7 @@ use super::EndpointServerPools;
 use super::get_server_info;
 use super::{PoolDecommissionInfo, PoolStatus, RebalStatus, get_total_usable_capacity, get_total_usable_capacity_free};
 use super::{apply_bucket_usage_memory_overlay, load_data_usage_from_backend};
-use crate::app::context::{
+use crate::app::runtime_sources::{
     AppContext, get_global_app_context, resolve_endpoints_handle, resolve_object_store_handle_for_context,
 };
 use crate::capacity::resolve_admin_used_capacity;

rustfs/src/app/bucket_usecase.rs

@@ -38,7 +38,7 @@ use super::{
 use crate::admin::handlers::site_replication::{
     site_replication_bucket_meta_hook, site_replication_delete_bucket_hook, site_replication_make_bucket_hook,
 };
-use crate::app::context::{
+use crate::app::runtime_sources::{
     AppContext, get_global_app_context, resolve_encryption_service, resolve_notification_system,
     resolve_notify_interface_for_context, resolve_object_store_handle_for_context,
 };

rustfs/src/app/lifecycle_transition_api_test.rs

@@ -21,7 +21,7 @@ use super::{
 };
 use super::{multipart_usecase::DefaultMultipartUsecase, object_usecase::DefaultObjectUsecase};
 use crate::app::bucket_usecase::DefaultBucketUsecase;
-use crate::app::context::resolve_tier_config_handle;
+use crate::app::runtime_sources::resolve_tier_config_handle;
 use crate::storage::ecfs::FS;
 use crate::storage::{
     StorageObjectInfo as ObjectInfo, StorageObjectOptions as ObjectOptions, StoragePutObjReader as PutObjReader,

rustfs/src/app/mod.rs

@@ -20,6 +20,7 @@ pub mod bucket_usecase;
 pub mod context;
 pub mod multipart_usecase;
 pub mod object_usecase;
+pub(crate) mod runtime_sources;
 mod select_object;
 
 #[cfg(test)]

rustfs/src/app/multipart_usecase.rs

@@ -30,8 +30,8 @@ use super::{
     replication::{get_must_replicate_options, must_replicate, schedule_replication},
     versioning_sys::BucketVersioningSys,
 };
-use crate::app::context::{AppContext, get_global_app_context, resolve_object_store_handle_for_context};
 use crate::app::object_usecase::{build_put_like_object_lock_metadata, validate_existing_object_lock_for_write};
+use crate::app::runtime_sources::{AppContext, get_global_app_context, resolve_object_store_handle_for_context};
 use crate::capacity::record_capacity_write;
 use crate::error::ApiError;
 use crate::storage::access::has_bypass_governance_header;

rustfs/src/app/object_usecase.rs

@@ -44,7 +44,7 @@ use super::{
     tagging::decode_tags,
     versioning_sys::BucketVersioningSys,
 };
-use crate::app::context::{
+use crate::app::runtime_sources::{
     AppContext, get_global_app_context, resolve_expiry_state_handle, resolve_notify_interface_for_context,
     resolve_object_store_handle_for_context,
 };

rustfs/src/app/runtime_sources.rs

@@ -0,0 +1,22 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub(crate) use crate::app::context::{
+    AppContext, get_global_app_context, resolve_encryption_service, resolve_endpoints_handle, resolve_expiry_state_handle,
+    resolve_notification_system, resolve_notify_interface_for_context, resolve_object_store_handle_for_context,
+    resolve_s3select_db,
+};
+
+#[cfg(test)]
+pub(crate) use crate::app::context::resolve_tier_config_handle;

rustfs/src/app/select_object.rs

@@ -1,4 +1,4 @@
-use crate::app::context::resolve_s3select_db;
+use crate::app::runtime_sources::resolve_s3select_db;
 use crate::error::ApiError;
 use crate::storage::options::get_opts;
 use crate::storage::request_context::spawn_traced;

rustfs/src/auth.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::app::context::resolve_action_credentials;
+use crate::runtime_sources::resolve_action_credentials;
 use http::HeaderMap;
 use http::Uri;
 use rustfs_credentials::Credentials;
@@ -186,7 +186,7 @@ impl S3Auth for IAMAuth {
             return Ok(key);
         }
 
-        if let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() {
+        if let Ok(iam_store) = crate::runtime_sources::resolve_ready_iam_handle() {
             // Use check_key instead of get_user to ensure user is loaded from disk if not in cache
             // This is important for newly created users that may not be in cache yet.
             // check_key will automatically attempt to load the user from disk if not found in cache.
@@ -341,7 +341,7 @@ pub async fn check_key_valid(session_token: &str, access_key: &str) -> S3Result<
     let sys_cred = cred.clone();
 
     if !constant_time_eq(&cred.access_key, access_key) {
-        let Ok(iam_store) = crate::app::context::resolve_ready_iam_handle() else {
+        let Ok(iam_store) = crate::runtime_sources::resolve_ready_iam_handle() else {
             return Err(S3Error::with_message(
                 S3ErrorCode::InternalError,
                 format!("check_key_valid {:?}", IamError::IamSysNotInitialized),

rustfs/src/config/info.rs

@@ -19,7 +19,7 @@
 //! configuration, and dependencies.
 
 use super::{InfoOpts, InfoType};
-use crate::app::context::resolve_buffer_config;
+use crate::runtime_sources::resolve_buffer_config;
 use crate::version::build;
 use rustfs_credentials::Masked;
 use serde::Serialize;

rustfs/src/init.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::app::context::{resolve_notify_interface, resolve_region};
+use crate::runtime_sources::{resolve_notify_interface, resolve_region};
 use crate::server::ShutdownHandle;
 use crate::storage::{
     get_bucket_notification_config, process_lambda_configurations, process_queue_configurations, process_topic_configurations,

rustfs/src/lib.rs

@@ -68,6 +68,7 @@ pub mod profiling;
 #[cfg(any(feature = "ftps", feature = "webdav", feature = "sftp"))]
 pub mod protocols;
 pub mod runtime_capabilities;
+pub(crate) mod runtime_sources;
 pub mod server;
 pub(crate) mod startup_audit;
 pub(crate) mod startup_auth;

rustfs/src/protocols/client.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::app::context::resolve_action_credentials;
+use crate::runtime_sources::resolve_action_credentials;
 use crate::storage::ecfs::FS;
 use http::{HeaderMap, Method};
 use percent_encoding::{AsciiSet, CONTROLS, utf8_percent_encode};

rustfs/src/runtime_sources.rs

@@ -0,0 +1,20 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::app::context;
+
+pub(crate) use context::{
+    AppContext, resolve_action_credentials, resolve_buffer_config, resolve_notify_interface, resolve_ready_iam_handle,
+    resolve_region, resolve_replication_pool_handle,
+};

rustfs/src/startup_iam.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::app::context::AppContext;
+use crate::runtime_sources::AppContext;
 use crate::server::{ServiceStateManager, publish_ready_when_runtime_ready};
 use crate::storage::ECStore;
 use rustfs_common::{GlobalReadiness, SystemStage};

rustfs/src/storage/rpc/node_service.rs

@@ -23,9 +23,7 @@ use crate::admin::service::{
     config::{reload_dynamic_config_runtime_state, reload_runtime_config_snapshot},
     site_replication::reload_site_replication_runtime_state,
 };
-use crate::app::context::{
-    AppContext, get_global_app_context, resolve_iam_handle, resolve_lock_client, resolve_object_store_handle_for_context,
-};
+use crate::storage::runtime_sources;
 use bytes::Bytes;
 use futures::Stream;
 use futures_util::future::join_all;
@@ -175,7 +173,7 @@ mod metrics;
 
 pub struct NodeService {
     local_peer: LocalPeerS3Client,
-    context: Option<Arc<AppContext>>,
+    context: Option<Arc<runtime_sources::AppContext>>,
 }
 
 impl std::fmt::Debug for NodeService {
@@ -188,19 +186,19 @@ impl std::fmt::Debug for NodeService {
 }
 
 pub fn make_server() -> NodeService {
-    let context = get_global_app_context();
+    let context = runtime_sources::get_global_app_context();
     make_server_for_context(context)
 }
 
-pub fn make_server_for_context(context: Option<Arc<AppContext>>) -> NodeService {
+pub fn make_server_for_context(context: Option<Arc<runtime_sources::AppContext>>) -> NodeService {
     let local_peer = LocalPeerS3Client::new(None, None);
     NodeService { local_peer, context }
 }
 
 impl NodeService {
     fn resolve_object_store(&self) -> Option<Arc<crate::app::ECStore>> {
-        let context = self.context.clone().or_else(get_global_app_context);
-        resolve_object_store_handle_for_context(context.as_deref())
+        let context = self.context.clone().or_else(runtime_sources::get_global_app_context);
+        runtime_sources::object_store_handle_for_context(context.as_deref())
     }
 
     async fn find_disk(&self, disk_path: &str) -> Option<DiskStore> {
@@ -213,7 +211,7 @@ impl NodeService {
 
     /// Get the lock client, returning an error if not initialized
     fn get_lock_client(&self) -> Result<Arc<dyn LockClient>, Status> {
-        resolve_lock_client()
+        runtime_sources::lock_client()
             .ok_or_else(|| Status::internal("Lock client not initialized. Please ensure storage is initialized first."))
     }
 }
@@ -672,7 +670,7 @@ impl Node for NodeService {
             }));
         }
 
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(DeletePolicyResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -701,7 +699,7 @@ impl Node for NodeService {
                 error_info: Some("policy name is missing".to_string()),
             }));
         }
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(LoadPolicyResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -740,7 +738,7 @@ impl Node for NodeService {
             }));
         };
         let is_group = request.is_group;
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(LoadPolicyMappingResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -768,7 +766,7 @@ impl Node for NodeService {
                 error_info: Some("access_key name is missing".to_string()),
             }));
         }
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(DeleteUserResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -800,7 +798,7 @@ impl Node for NodeService {
                 error_info: Some("access_key name is missing".to_string()),
             }));
         }
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(DeleteServiceAccountResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -830,7 +828,7 @@ impl Node for NodeService {
             }));
         }
 
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(LoadUserResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -866,7 +864,7 @@ impl Node for NodeService {
             }));
         }
 
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(LoadServiceAccountResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),
@@ -897,7 +895,7 @@ impl Node for NodeService {
             }));
         }
 
-        let Some(iam_sys) = resolve_iam_handle() else {
+        let Some(iam_sys) = runtime_sources::iam_handle() else {
             return Ok(Response::new(LoadGroupResponse {
                 success: false,
                 error_info: Some("errServerNotInitialized".to_string()),

rustfs/src/storage/runtime_sources.rs

@@ -19,12 +19,19 @@ use rustfs_credentials::Credentials;
 use rustfs_iam::{error::Result as IamResult, store::object::ObjectStore, sys::IamSys};
 use rustfs_io_metrics::{PerformanceMetrics, internode_metrics::InternodeMetrics};
 use rustfs_kms::ObjectEncryptionService;
+use rustfs_lock::LockClient;
 use std::sync::Arc;
 
+pub(crate) use context::{AppContext, get_global_app_context};
+
 pub(crate) fn object_store_handle() -> Option<Arc<ECStore>> {
     context::resolve_object_store_handle()
 }
 
+pub(crate) fn object_store_handle_for_context(context: Option<&AppContext>) -> Option<Arc<ECStore>> {
+    context::resolve_object_store_handle_for_context(context)
+}
+
 pub(crate) fn buffer_config() -> RustFSBufferConfig {
     context::resolve_buffer_config()
 }
@@ -60,3 +67,11 @@ pub(crate) fn region() -> Option<s3s::region::Region> {
 pub(crate) fn ready_iam_handle() -> IamResult<Arc<IamSys<ObjectStore>>> {
     context::resolve_ready_iam_handle()
 }
+
+pub(crate) fn iam_handle() -> Option<Arc<IamSys<ObjectStore>>> {
+    context::resolve_iam_handle()
+}
+
+pub(crate) fn lock_client() -> Option<Arc<dyn LockClient>> {
+    context::resolve_lock_client()
+}

rustfs/src/workload_admission.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::app::context::resolve_replication_pool_handle;
+use crate::runtime_sources::resolve_replication_pool_handle;
 use crate::storage::{bucket_metadata_runtime_initialized, replication_queue_current_count};
 use rustfs_concurrency::{
     AdmissionState, WorkloadAdmissionRegistrySnapshot, WorkloadAdmissionSnapshot, WorkloadAdmissionSnapshotProvider,

scripts/check_architecture_migration_rules.sh

@@ -157,6 +157,9 @@ RUSTFS_STARTUP_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_startup_runtim
 RUSTFS_SERVER_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_server_runtime_source_bypass_hits.txt"
 RUSTFS_STORAGE_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_storage_runtime_source_bypass_hits.txt"
 RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_admin_runtime_source_bypass_hits.txt"
+RUSTFS_APP_CONTEXT_DIRECT_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_app_context_direct_bypass_hits.txt"
+RUSTFS_APP_USECASE_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_app_usecase_runtime_source_bypass_hits.txt"
+RUSTFS_STORAGE_DIRECT_APP_CONTEXT_BYPASS_HITS_FILE="${TMP_DIR}/rustfs_storage_direct_app_context_bypass_hits.txt"
 
 awk '
   /^## PR Types$/ {
@@ -1383,6 +1386,38 @@ if [[ -s "$RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE" ]]; then
   report_failure "RustFS admin runtime source reads must stay behind rustfs/src/admin/runtime_sources.rs: $(paste -sd '; ' "$RUSTFS_ADMIN_RUNTIME_SOURCE_BYPASS_HITS_FILE")"
 fi
 
+(
+  cd "$ROOT_DIR"
+  rg -n --with-filename 'crate::app::context::|use crate::app::context' rustfs/src --glob '*.rs' |
+    rg -v '^rustfs/src/app/context' |
+    rg -v '(^rustfs/src/[^/]*runtime_sources\.rs:|/runtime_sources\.rs:)' || true
+) >"$RUSTFS_APP_CONTEXT_DIRECT_BYPASS_HITS_FILE"
+
+if [[ -s "$RUSTFS_APP_CONTEXT_DIRECT_BYPASS_HITS_FILE" ]]; then
+  report_failure "RustFS AppContext resolver reads must stay behind context or runtime_sources modules: $(paste -sd '; ' "$RUSTFS_APP_CONTEXT_DIRECT_BYPASS_HITS_FILE")"
+fi
+
+(
+  cd "$ROOT_DIR"
+  rg -n --with-filename 'crate::app::context::|use crate::app::context' rustfs/src/app --glob '*.rs' |
+    rg -v '^rustfs/src/app/context' |
+    rg -v '^rustfs/src/app/runtime_sources\.rs:' || true
+) >"$RUSTFS_APP_USECASE_RUNTIME_SOURCE_BYPASS_HITS_FILE"
+
+if [[ -s "$RUSTFS_APP_USECASE_RUNTIME_SOURCE_BYPASS_HITS_FILE" ]]; then
+  report_failure "RustFS app usecase runtime source reads must stay behind rustfs/src/app/runtime_sources.rs: $(paste -sd '; ' "$RUSTFS_APP_USECASE_RUNTIME_SOURCE_BYPASS_HITS_FILE")"
+fi
+
+(
+  cd "$ROOT_DIR"
+  rg -n --with-filename 'crate::app::context::|use crate::app::context' rustfs/src/storage --glob '*.rs' |
+    rg -v '^rustfs/src/storage/runtime_sources\.rs:' || true
+) >"$RUSTFS_STORAGE_DIRECT_APP_CONTEXT_BYPASS_HITS_FILE"
+
+if [[ -s "$RUSTFS_STORAGE_DIRECT_APP_CONTEXT_BYPASS_HITS_FILE" ]]; then
+  report_failure "RustFS storage runtime source reads must stay behind rustfs/src/storage/runtime_sources.rs: $(paste -sd '; ' "$RUSTFS_STORAGE_DIRECT_APP_CONTEXT_BYPASS_HITS_FILE")"
+fi
+
 (
   cd "$ROOT_DIR"
   rg -n --with-filename 'rustfs_ecstore::api::' \

scripts/layer-dependency-baseline.txt

@@ -39,31 +39,20 @@ dep|rustfs/src/app/multipart_usecase.rs|app->interface|crate::storage::s3_api::m
 dep|rustfs/src/app/multipart_usecase.rs|app->interface|crate::storage::s3_api::multipart::parse_upload_part_number
 dep|rustfs/src/app/object_usecase.rs|app->interface|crate::storage::ecfs
 dep|rustfs/src/app/object_usecase.rs|app->interface|crate::storage::s3_api::multipart::parse_list_parts_params
-dep|rustfs/src/auth.rs|infra->app|crate::app::context::resolve_action_credentials
-dep|rustfs/src/config/info.rs|infra->app|crate::app::context::resolve_buffer_config
-dep|rustfs/src/init.rs|infra->app|crate::app::context::resolve_notify_interface
-dep|rustfs/src/init.rs|infra->app|crate::app::context::resolve_region
 dep|rustfs/src/init.rs|infra->interface|crate::admin
-dep|rustfs/src/protocols/client.rs|infra->app|crate::app::context::resolve_action_credentials
 dep|rustfs/src/protocols/client.rs|infra->interface|crate::storage::ecfs::FS
+dep|rustfs/src/runtime_sources.rs|infra->app|crate::app::context
 dep|rustfs/src/server/http.rs|infra->interface|crate::admin
 dep|rustfs/src/server/layer.rs|infra->interface|crate::admin::console::is_console_path
 dep|rustfs/src/server/layer.rs|infra->interface|crate::admin::handlers::health::HealthProbe
 dep|rustfs/src/server/layer.rs|infra->interface|crate::admin::handlers::health::build_health_response_parts
 dep|rustfs/src/server/runtime_sources.rs|infra->app|crate::app::context
-dep|rustfs/src/startup_iam.rs|infra->app|crate::app::context::AppContext
 dep|rustfs/src/storage/ecfs_extend.rs|infra->interface|crate::storage::ecfs::ListObjectUnorderedQuery
 dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::ecfs::FS
 dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::ecfs::validate_object_lock_configuration_input
 dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::s3_api::common::rustfs_initiator
 dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::s3_api::common::rustfs_owner
 dep|rustfs/src/storage/runtime_sources.rs|infra->app|crate::app::context
-dep|rustfs/src/storage/rpc/node_service.rs|infra->app|crate::app::context::AppContext
-dep|rustfs/src/storage/rpc/node_service.rs|infra->app|crate::app::context::get_global_app_context
-dep|rustfs/src/storage/rpc/node_service.rs|infra->app|crate::app::context::resolve_iam_handle
-dep|rustfs/src/storage/rpc/node_service.rs|infra->app|crate::app::context::resolve_lock_client
-dep|rustfs/src/storage/rpc/node_service.rs|infra->app|crate::app::context::resolve_object_store_handle_for_context
 dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::admin::service::config::reload_dynamic_config_runtime_state
 dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::admin::service::config::reload_runtime_config_snapshot
 dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::admin::service::site_replication::reload_site_replication_runtime_state
-dep|rustfs/src/workload_admission.rs|infra->app|crate::app::context::resolve_replication_pool_handle