Merge remote-tracking branch 'origin/release' into cxymds/fix/release-multipool-version-history

This reverts commit 6eb200022e.

.agents/references/implementation.md

@@ -58,13 +58,6 @@ are repository-relative. Read only the relevant sections during read-only review
 - Attach error context once where it is actionable. Do not erase typed errors
   below aggregation or quorum layers.
 
-## Rust Boundaries
-
-- Production `unwrap`/`expect` must follow a type guarantee or checked invariant; explain only non-obvious guarantees.
-- Public APIs do not return `Result<_, String>`. Library APIs use domain errors unless intentional erasure is part of the boundary contract; expose a stored inner error through `Error::source()`.
-- Numeric conversions must not silently truncate. Use fallible conversions for untrusted values; validate finiteness, sign, and range before float-to-integer conversion. Clamp/saturate only when required by the domain.
-- Do not add crate-root `#![allow(dead_code)]`.
-
 ## Naming
 
 Use Rust API naming: `SCREAMING_SNAKE_CASE` constants/statics, `snake_case`

.agents/skills/adversarial-validation/references/concurrency-durability.md

@@ -2,12 +2,8 @@
 
 - For every changed lock, enumerate overlapping lock sets and construct the
   ABBA interleaving. Multiple-lock order must be documented and consistent.
-- Mark guard lifetimes and every `.await`, disk,
-  and RPC call; estimate contention/timeouts. Tokio read/write guards across
-  `.await` need bounded hold time; long-lived reads can wedge writers (#4195).
-  Keep `std::sync::Mutex` holds brief and never across `.await`.
-- Use direct `fetch_*` for unconditional atomic read-modify-write and
-  `compare_exchange` for conditional updates.
+- Mark guard lifetimes and every `.await`, disk, and RPC call inside them.
+  Estimate contention and timeout behavior under concurrent requests.
 - Object commits remain fenced if the distributed lock is lost after shard
   writes and before metadata rename.
 - For write/rename changes, trace `write tmp -> sync tmp -> rename -> sync parent

.agents/skills/adversarial-validation/references/correctness.md

@@ -15,8 +15,6 @@ Attack the changed behavior, not every subsystem in the repository.
   bytes and length.
 - For multipart/object commits, fail before/after rename and cleanup; committed
   data must remain readable and pre-commit cleanup must not destroy parts.
-- Bound recursion over untrusted or persisted input; handle corrupted/cyclic
-  tree and cache traversals safely.
 - For version/index ordering, test `len - 1`, `len`, equal timestamps, missing
   versions, and deterministic tie-breaking.
 - For directory-object behavior, trace `__XLDIR__` at the store layer; branches

.agents/skills/adversarial-validation/references/test-coverage.md

@@ -19,8 +19,7 @@
   serialization is required.
 - Internal metadata tests assert both RustFS and MinIO keys, not only read-back
   through a helper that prefers one key.
-- Avoid duplicate tests of the same production path and poison-value class.
-  Boundary companions are distinct coverage: `n == max` vs `max + 1`, and
+- Boundary companions are distinct coverage: `n == max` vs `max + 1`, and
   absent vs empty vs nil UUID.
 - A focused test proves only the targets/features it builds. Add compilation or
   Clippy only for uncovered changed targets.

.agents/skills/arch-checks/SKILL.md

@@ -1,5 +1,9 @@
+---
+name: arch-checks
+description: Diagnose failures from check_layer_dependencies.sh, check_architecture_migration_rules.sh, check_unsafe_code_allowances.sh, check_logging_guardrails.sh, check_doc_paths.sh, or check_no_planning_docs.sh. Use when one of these guards fails, not for every architecture question or documentation edit.
+---
 
-# Architecture Guard Troubleshooting
+# Architecture Guard Checks
 
 Read only the section for the failing guard. Use `.config/make/` and the current
 workflow to verify its wiring; not every guard is part of every gate. Fix the
@@ -34,16 +38,6 @@ source lines. If it fails after a doc edit, you reworded or removed a
 guarded line — restore the wording or update the script deliberately in the
 same PR, with rationale.
 
-## OIDC architecture boundaries
-
-`check_architecture_migration_rules.sh` also runs `scripts/check_oidc_architecture_boundaries.sh`. Its rule identifier and `file:line` point to the source boundary that changed. Keep OIDC provider configuration, discovery, transport, state, and runtime under `crates/iam/src/oidc/`; keep verified identity mapping under `crates/iam/src/federation/mapper.rs`; construct the runtime in IAM startup and `rustfs/src/startup_auth.rs`; publish the federation service and OIDC query together through `AppContext`. The Keycloak workflow must include the OIDC module path for pull requests and pushes.
-
-OIDC production modules must not reference RustFS `Credentials` or `FederatedSessionTransaction`. Federation orchestration creates the transaction, and the Admin session binding issues credentials.
-
-The Admin OIDC handler delegates persisted configuration reads, updates, and provider validation to `admin/service/oidc_config.rs`. Site replication uses `OidcConfigQuery::site_replication_snapshot()` and receives only the fields required for its response, including a hashed client secret. The Keycloak workflow also tracks the Admin configuration service path for both events.
-
-Run `bash scripts/check_oidc_architecture_boundaries.sh --self-test` after editing a rule. Its negative and accepted examples under `scripts/fixtures/architecture_migration_rules/oidc/` must produce the exact expected rule identifiers. Then run the full architecture guard.
-
 ## `check_unsafe_code_allowances.sh`
 
 Every `#[allow(unsafe_code)]` needs a `SAFETY:` comment within a few lines.

.agents/skills/code-change-verification/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: code-change-verification
+description: Review a commit, PR, or merged patch when the user requests ordinary code-change verification. Do not combine with adversarial-validation; use that skill instead for explicitly adversarial, substantial, or high-risk RustFS reviews.
+---
+
+# Code Change Verification
+
+Use this skill for an ordinary requested review. If the root policy or user calls
+for adversarial validation, use `adversarial-validation` instead of running both.
+
+## Core Workflow
+
+### 1) Scope and assumptions
+- Derive the change source, target branch, and relevant runtime/version from the
+  supplied diff and metadata. Ask only when missing context could change the verdict.
+- Focus only on requested scope; avoid reviewing unrelated files.
+
+### 2) Risk map
+- Prioritize in this order:
+  - Data correctness and user-visible behavior
+  - API/contract compatibility
+  - Security and authz/authn boundaries
+  - Concurrency and lifecycle correctness
+  - Performance and resource usage
+- Give higher priority to stateful paths, migration logic, defaults, and error handling.
+
+### 3) Evidence-based inspection
+- Read each modified hunk with neighboring context.
+- Trace call paths and call-site expectations.
+- Check for:
+  - invariant breaks and missing guards
+  - unchecked assumptions and null/empty/error-path handling
+  - stale tests, fixtures, and configs
+  - hidden coupling to shared helpers/constants/features
+- Apply root `AGENTS.md`'s finding standard: try to disprove a candidate before
+  reporting it. Mention an unresolved question only when it could materially
+  change the verdict; do not fill the report with speculative possibilities.
+
+#### Rust-specific checks
+
+For changed Rust behavior, use the matching sections of [rust-code-quality](../rust-code-quality/SKILL.md). Reuse checks already performed by the selected review workflow. Comment-only or formatting-only Rust diffs do not require the full Rust checklist. Carry its P0–P3 ratings over unchanged and use this skill's output format.
+
+### 4) Findings-first output
+- Order supported findings by P0–P3 severity; preserve the Rust ratings above.
+  Include `path:line`, the failure and impact, a focused fix, and its validation.
+- If no supported issues remain, state `No findings` with the reviewed scope and
+  any material verification limitation. Do not append optional improvements to
+  make a clean review look productive.
+
+Close after the required review. Recommend additional verification only for an
+identified unresolved risk or required gate; reuse evidence for unchanged code.

.agents/skills/code-change-verification/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Change Verification"
+  short_description: "Prioritize risks and verify code changes before merge."
+  default_prompt: "Use $code-change-verification for an ordinary requested diff review with prioritized findings."

.agents/skills/issue-triage/SKILL.md

@@ -1,13 +1,112 @@
 ---
 name: issue-triage
-description: Verify issue completion against current implementation and merged work. Use for issue triage; comment, close, or change labels only when authorized.
+description: Assess whether a GitHub issue is fixed, needs implementation, or can be closed by checking related work and current code. Use for issue completion/triage requests. Status questions are read-only; comment, close, or change labels only when the conversation authorizes that action.
 ---
+
 # Issue Triage
 
-- Resolve the issue repository separately from the implementation repository: `rustfs/backlog` tracks work in `rustfs/rustfs`. Pass `--repo` explicitly to GitHub queries.
-- Read the issue body, relevant comments, linked PRs, checklist, and sub-issues with `gh issue view`. Search explicit links, the full issue URL, qualified references, and subject keywords; an empty search result does not prove implementation is absent.
-- Fetch the implementation base and inspect its current code. For each merged candidate, verify `git merge-base --is-ancestor <merge-commit> <remote>/<base>`; a title, commit message, or merged state alone is insufficient. A local checkout may be stale or on another branch.
-- Verify every checklist/sub-issue before declaring completion. For batches, paginate the entire requested issue scope, exclude PR entries, and filter by author only when requested.
-- Recommend closing only when all requested behavior is present or evidence shows the issue is superseded. Otherwise name what remains. A status request is read-only; reuse existing authority for comments/closing/labels, and follow [Git and PR rules](../../references/pull-requests.md) before posting. Use Chinese for `rustfs/backlog`, existing repository labels only, and a closing comment naming the verified behavior and PRs.
+Use this skill when the user provides a GitHub issue URL and asks "can this be closed?", "is this already implemented?", "check completion status", or similar triage questions.
 
-Report the issue, current state, implementation evidence, remaining work, verdict, and action actually taken. Use a table for batches. Write multiline comments via `--body-file`; when closing, post the prepared comment before closing without an inline multiline body.
+## Workflow
+
+### 1. Fetch issue context
+
+```bash
+gh issue view <N> --repo <owner/repo> --json title,body,state,comments,labels,updatedAt
+```
+
+Read the issue body to understand what was requested. Extract:
+- The specific feature/fix/behavior described.
+- Any linked PRs or commits mentioned in the body or comments.
+- Any checklist items or sub-issues.
+
+Resolve the issue repository and implementation repository separately (for example, `rustfs/backlog` tracks work in `rustfs/rustfs`). Pass the implementation repository explicitly to PR queries; the current checkout may belong to another repository.
+
+### 2. Search for related work
+
+Search git history for commits referencing the issue:
+```bash
+git log --oneline --all --grep="<N>" | head -30
+```
+
+Search for related PRs:
+```bash
+gh pr list --repo <implementation-repo> --search "<issue-url>" --state all --json number,title,state,mergedAt
+```
+
+Also search qualified issue references and subject keywords; for same-repository
+issues, include `#<N>`. Follow explicit links even without a text match. A search
+page with no match does not prove the work is absent.
+
+If the issue mentions specific PRs, check their status:
+```bash
+gh pr view <PR_N> --repo <implementation-repo> --json state,mergedAt,title,mergeCommit,baseRefName
+```
+
+### 3. Verify implementation
+
+Fetch the implementation repository's current base branch. For each merged candidate, verify its merge commit is present and inspect the current code for the claimed behavior; a commit message match alone is not proof:
+```bash
+git fetch <implementation-remote> <base-branch>
+git merge-base --is-ancestor <merge-commit> <implementation-remote>/<base-branch>
+```
+
+If the issue describes a specific defect, inspect the fetched base's code rather than assuming the current checkout contains it:
+```bash
+git show <implementation-remote>/<base-branch>:crates/<relevant>/src/<file>.rs
+```
+
+For issues with checklists, verify each item individually. If sub-items are tracked as separate issues, check those too:
+```bash
+gh issue view <SUB_N> --repo <owner/repo> --json state
+```
+
+### 4. Determine verdict
+
+- **All items fixed and merged**: Recommend closing; name the verified PRs and behavior.
+- **Some items fixed, some remaining**: Keep open; report each remaining item.
+- **Not yet implemented**: Keep open; report what remains.
+- **Superseded or no longer relevant**: Recommend closing with evidence.
+
+### 5. Take action
+
+For a status-only request, return the assessment without GitHub writes. If commenting, closing, or label edits are authorized, perform only those actions; do not ask again for authority already given. Prepare the final assessment before asking for any missing authority. Write `rustfs/backlog` issue content in Chinese.
+
+Close with comment:
+```bash
+gh issue close <N> --repo <owner/repo> --comment "<body>"
+```
+
+Comment without closing:
+```bash
+gh issue comment <N> --repo <owner/repo> --body-file /tmp/triage.md
+```
+
+Update labels only when label changes are authorized, using existing repository labels; never add tool-specific labels:
+```bash
+gh issue edit <N> --repo <owner/repo> --add-label "<existing-label>"
+```
+
+Always use `--body-file` for multiline content, never inline `--body`.
+
+### 6. Handle multi-issue batches
+
+When the user asks to check multiple issues (e.g., "check all issues by user X" or "scan backlog for closable issues"):
+1. List the full requested scope with pagination (for example `gh api --paginate 'repos/<repo>/issues?state=open&per_page=100'`, excluding entries with `pull_request`). Add an author filter only when the user requested one; the default page/limit is not evidence that all issues were checked.
+2. For each issue, run steps 1-5 above.
+3. Report a summary table of all triaged issues with verdicts.
+
+## Report
+
+Identify the issue and current state, verified implementation/PR evidence,
+remaining items, verdict, and action actually taken. Use a table for batches;
+a single issue does not require a heading for each field. Follow step 4's
+verdicts without repeating the assessment in another template.
+
+## Notes
+
+- The user may ask in Chinese ("是否可以关闭", "检查完成情况"); respond in the same language.
+- When closing, always include a summary of what was fixed and which PRs resolved it — this creates a useful audit trail.
+- For issues in `rustfs/backlog`, use `--repo rustfs/backlog`.
+- For issues in `rustfs/rustfs`, use `--repo rustfs/rustfs`.
+- If the issue has sub-issues (GitHub sub-issues API), check each one's state before declaring the parent complete.

.agents/skills/pr-review/SKILL.md

@@ -1,20 +1,93 @@
 ---
 name: pr-review
-description: Review a GitHub PR using its exact base/head and repository risk policy. Use for requested PR reviews; publish or fix only within conversation authorization.
+description: Review a GitHub PR from a URL or number using its actual base/head and risk-appropriate code review. Use when the user asks for a PR review, not a status lookup or PR wording edit. Publish a review only when authorized; delegation and monitoring follow the requested scope and root AGENTS.md.
 ---
+
 # PR Review
 
-1. Resolve the PR repository and remote; the current checkout may belong elsewhere. Read the PR purpose and linked issues, then fetch the actual base and PR head:
+Use this skill for PR context and review delivery. An ordinary review request is read-only unless the conversation also authorizes posting or fixes. Reuse that authorization without asking again; prepare the review before requesting any missing publication approval.
 
-   ```bash
-   gh pr view <N> --repo <owner/repo> --json title,author,state,body,baseRefName,headRefName,baseRefOid,headRefOid
-   git fetch <repo-remote> <baseRefName> refs/pull/<N>/head
-   git diff <baseRefOid>...<headRefOid>
-   ```
+## Prerequisites
 
-   Record both SHAs; refresh if either moved during fetching. Follow relevant [implementation boundaries](../../references/implementation.md).
-2. Apply the [risk policy](../../references/adversarial-validation.md). Ordinary reviews use the root finding standard directly. For explicit adversarial, substantial, or high-risk reviews, use [the domain probes](../adversarial-validation/SKILL.md). File count does not authorize delegation; use exactly two independent reviewers only when authorized, otherwise two fresh sequential passes for that risk tier. Reviewers do not spawn further agents.
-3. Check `gh pr checks <N> --repo <owner/repo>`. Investigate failures when relevant to a finding or a requested CI/readiness diagnosis. Distinguish pending, unavailable, pre-existing, flaky, and PR-caused states using evidence; a code review does not authorize unrelated repairs.
-4. Report the reviewed SHAs, risk tier, supported findings or `No findings`, material verification limits, check state, and verdict. P0/P1 findings block approval. Severity: P0 = demonstrated data loss, security breach, remote crash, or deadlock; P1 = correctness, compatibility, or material hot-path regression; P2 = a concrete maintainability defect; P3 = optional style, only when requested.
-5. When posting is authorized, follow [Git and PR rules](../../references/pull-requests.md), recheck the remote head, and review any delta before submitting. Use `gh pr review` with `--approve`, `--request-changes`, or `--comment` and `--body-file`; use [the API example](references/posting.md) for authorized inline comments. Reuse existing authorization.
-6. Follow the repository PR lifecycle and explicit monitoring scope. Fetch new heads before comparing to the reviewed SHA; never rely on an unfetched `origin/pull/<N>/head`. Push fixes or resolve threads only when authorized; check `maintainerCanModify` before a fork push.
+- Follow root `AGENTS.md`; classify risk with the [review policy](../../references/adversarial-validation.md) and consult relevant [change-style and boundary rules](../../references/implementation.md).
+- Select `code-change-verification` for ordinary review or `adversarial-validation` for explicitly adversarial, substantial, or high-risk review; do not run both on the same diff.
+
+## Workflow
+
+### 1. Gather PR context
+
+```bash
+gh pr view <N> --repo <owner/repo> --json title,author,state,body,additions,deletions,changedFiles,commits,baseRefName,headRefName,baseRefOid,headRefOid
+gh pr diff <N> --repo <owner/repo> --name-only
+```
+
+Read the PR body and linked issues to understand the change's purpose. If the PR references an issue, fetch that too:
+```bash
+gh issue view <ISSUE> --repo <issue-owner/repo> --json title,body,state
+```
+
+### 2. Fetch the diff and classify the change
+
+```bash
+git fetch <repo-remote> <baseRefName> refs/pull/<N>/head
+git diff <baseRefOid>...<headRefOid> --stat
+```
+
+Resolve `<repo-remote>` to the PR repository; do not assume the current checkout's `origin` or `main` matches. Record the exact base/head used. If either moved during fetching, refresh the snapshot before reviewing. Classify using the repository review policy; instruction changes that affect agent execution are mechanical, not exempt.
+
+### 3. Review the changed behavior
+
+Group files by functional area to trace callers and invariants. Use the root risk tier's review shape and only matching lenses. File count does not authorize delegation. When delegation is explicitly authorized, high-risk/substantial reviews use exactly two independent reviewers with the applicable lenses split between them; otherwise use two fresh sequential passes. Reviewers do not spawn further agents.
+
+Findings need a concrete failure scenario with `file:line`; a null verdict briefly names the relevant probes. Reuse existing evidence and choose local checks from the final diff under the root verification policy.
+
+### 4. Check CI status
+
+```bash
+gh pr checks <N> --repo <owner/repo>
+```
+
+Investigate a failed check when it bears on a finding or the user requested CI diagnosis/merge readiness:
+```bash
+gh run view --repo <owner/repo> --log-failed --job=<JOB_ID>
+```
+
+Use current evidence to distinguish pre-existing, flaky, and PR-caused failures. Do not classify them by guesswork or turn a code-only review into unrelated CI repair.
+
+### 5. Synthesize findings
+
+Report the PR, reviewed base/head, and risk tier, then summarize the assessment.
+Use the selected review's P0–P3 ratings and root finding standard: supported
+findings with `file:line`, failure scenario, and fix, or `No findings`.
+State the observed check status, including pending or unavailable checks, and
+the verdict (`APPROVE`, `REQUEST_CHANGES`, or `COMMENT`). Do not infer a pass
+from missing checks or add style nits to populate a clean review.
+
+### 6. Post the review
+
+Only when posting is authorized, write the review body to a temp file and post via CLI. Refresh the PR head first; if it changed, review the delta and update the verdict before posting:
+```bash
+# Request changes
+gh pr review <N> --repo <owner/repo> --request-changes --body-file /tmp/pr_review.md
+
+# Approve
+gh pr review <N> --repo <owner/repo> --approve --body-file /tmp/pr_review.md
+
+# Comment only (no verdict)
+gh pr review <N> --repo <owner/repo> --comment --body-file /tmp/pr_review.md
+```
+
+For authorized inline comments, use [the submission example](references/posting.md).
+
+Always use `--body-file` or `--input`, never inline multiline `--body`.
+
+### 7. Handle follow-up
+
+Follow the [PR lifecycle](../../references/pull-requests.md) and any explicit monitoring request. For follow-up, fetch the new head and compare the recorded reviewed SHA with the new SHA; revisit affected callers and findings. Never use an unfetched `origin/pull/<N>/head` ref as evidence. Update the posted review or resolve addressed threads only within existing authorization.
+
+## Notes
+
+- The user may ask for review in Chinese; respond in the same language but keep the review body in English per AGENTS.md rules.
+- When the user asks for "多角色对抗 review", run the full adversarial validation protocol — this skill's step 3 covers that.
+- If the PR is from a fork, check `maintainerCanModify` before attempting to push fixes.
+- For very large PRs, batch the review by functional area while keeping the same bounded review shape.

.agents/skills/rust-code-quality/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: rust-code-quality
+description: Run a focused Rust quality review when the user requests one or a selected review workflow needs Rust-specific checks for changed behavior. Do not auto-load for every implementation edit, comment-only or formatting-only Rust diff, or repeat an already completed review.
+---
+
+# Rust Code Quality Gate
+
+Use this skill for a dedicated Rust review to cover rules that `cargo clippy`
+does not catch.
+
+Search matches and checklist items are candidates, not findings. Apply the root
+finding standard; distinguish a demonstrated bug, an explicit rule violation,
+and an optional preference. P2/P3 suggestions do not need to be invented or
+included in an otherwise clean correctness review.
+
+## Quick Start
+
+1. Identify changed `.rs` files.
+2. Run the matching candidate searches on changed files.
+3. Apply the manual checklist sections whose behavior the diff touches.
+4. Report or rebut every finding with evidence; P0/P1 findings block approval.
+   Fix them when implementation is authorized; a read-only review reports them.
+
+## Automated Checks
+
+Use these searches to find candidates in changed `.rs` files. Inspect syntax,
+`#[cfg(test)]` scope, and the changed hunk before reporting a finding; text
+filters do not reliably distinguish production code from tests.
+
+```bash
+# 1. unwrap/expect candidates
+rg -n '\.unwrap\(\)|\.expect\(' <changed-files>
+
+# 2. Silent type truncation via `as` cast
+rg -n ' as (u8|u16|u32|u64|usize|i8|i16|i32|i64|isize)\b' <changed-files>
+
+# 3. String as error type
+rg -n 'Result<.*String>' <changed-files>
+
+# 4. Box<dyn Error> in public APIs
+rg -n 'Box<dyn.*Error' <changed-files>
+
+# 5. println/eprintln in production
+rg -n 'println!|eprintln!' <changed-files>
+
+# 6. Ordering::Relaxed usage (verify each is intentional)
+rg -n 'Ordering::Relaxed' <changed-files>
+
+# 7. Default substituted for a possibly-required value (judge each: is the value optional by domain?)
+rg -n 'unwrap_or_default\(\)|unwrap_or\(' <changed-files>
+```
+
+## Manual Review Checklist
+
+For the Rust diff under review, verify:
+
+### Error Handling
+- [ ] Every production `unwrap()` or `expect()` is infallible by type or a checked invariant; explain only non-obvious invariants, using an existing type, a useful `expect` message, or a concise comment
+- [ ] No `Result<_, String>` in public API signatures
+- [ ] Public library APIs use domain errors unless deliberate error erasure at a boundary is part of the contract
+- [ ] `Error::source()` is overridden when inner error is stored
+- [ ] Error messages are actionable without exposing secret input
+
+### Type Safety
+- [ ] No silent `as` truncation (negative→unsigned, large→small)
+- [ ] Fallible numeric conversions use `TryFrom`/`try_into()` and return a typed error; clamp or saturate only when the domain explicitly requires it
+- [ ] Floating-point to integer conversion validates finiteness, sign, and range before conversion
+
+### Concurrency
+- [ ] Lock acquisition order is documented when multiple locks are used, and matches every other call site taking any overlapping subset (ABBA check)
+- [ ] No `tokio::sync` lock guard (read or write) held across `.await` without bounded hold time — long-lived read guards wedge writers (#4195)
+- [ ] Atomic read-modify-write uses the direct `fetch_*` operation when possible; use `compare_exchange` only for conditional updates
+- [ ] `std::sync::Mutex` in async context is held only briefly, never across `.await`
+
+### Memory and Performance
+- [ ] On an identified hot path, report cloning or allocation only with a concrete per-request/per-object cost or benchmark signal
+- [ ] Prefer borrowing, moving, `Bytes`/`Arc`, or capacity reservation only when it reduces that cost without obscuring ownership or APIs
+
+### Recursion Safety
+- [ ] Recursion over untrusted, persisted, or otherwise unbounded input has a depth limit or uses iterative traversal
+- [ ] Tree/cache traversals handle corrupted/cyclic input safely
+
+### Testing
+- [ ] Tests have an observable failure criterion; delegated assertions, `#[should_panic]`, snapshot/property checks, and meaningful `Result` failures do not need a redundant `assert!`
+- [ ] Use `expect` only when its message improves failure diagnosis; do not add boilerplate to self-evident test setup
+- [ ] Test volume and line count are never treated as production-code growth
+
+### Serde
+- [ ] Structs from untrusted input reject unknown fields where the compatibility contract permits; otherwise validate security-critical fields explicitly and test the supported input shape
+- [ ] `#[serde(default)]` not used on security-critical fields without validation
+
+### Code Hygiene
+- [ ] No `#![allow(dead_code)]` at crate root
+- [ ] No camelCase statics or Hungarian notation
+- [ ] New string literals don't duplicate existing constants
+
+### Reuse and Necessity
+- [ ] No new helper duplicates `crates/utils`, `crates/common`, the touched crate, the likely domain-owning crate, a relevant direct dependency, or plain std/tokio behavior; reused helpers match the call site's semantics
+- [ ] No branch without a nameable concrete trigger; no re-validation of what a validated upstream layer on the same path already guarantees (Cross-Cutting Domain Invariant patterns and pre-destructive-action re-checks are load-bearing — keep them)
+- [ ] Error context attached once where actionable, not re-wrapped at every hop; no typed→generic error conversion below aggregation/quorum layers
+- [ ] Comments avoid narration and change history while completely stating non-obvious lock, `SAFETY`, durability, compatibility, and unwrap invariants
+- [ ] No near-duplicate test pinning the same code path and poison-value class as an existing test (boundary companions — n==max vs max+1, absent/empty/nil UUID — are never near-duplicates)
+
+## Severity Classification
+
+- **P0 (Block merge)**: demonstrated data loss, security breach, remote crash, or deadlock
+- **P1 (Must fix)**: concrete correctness, compatibility, or material hot-path regression
+- **P2 (Should fix)**: avoidable duplication or maintainability issue with a concrete simpler replacement
+- **P3 (Nice to fix)**: local style or clarity issue with no behavioral risk
+
+## Output Template
+
+Use the calling review's output format. For a standalone review, report supported
+findings with severity, location, impact, fix, and validation, or `No findings`.
+Include only material unverified checks. Candidate counts are not a quality
+metric and do not need a separate scan report.

.agents/skills/rustfs-logging-governance/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: rustfs-logging-governance
+description: Add or review RustFS `tracing` events with the repository field shape, level policy, privacy boundaries, and guardrails. Use when a change adds or edits a tracing macro/instrumentation site or the logging guardrail script.
+---
+
+# RustFS Logging Governance
+
+Apply this skill only to changed logging sites; do not turn a local log edit into
+a broad logging cleanup.
+
+## Workflow
+
+1. Read the changed function/module context and classify the site as lifecycle,
+   request/hot path, fallback, external fetch, or summary.
+2. Match neighboring structured events and reuse existing `EVENT_*`,
+   `LOG_COMPONENT_*`, and `LOG_SUBSYSTEM_*` constants.
+3. Put stable fields first (`event`, `component`, `subsystem`, `state`/`result`,
+   then context) and a short label last.
+4. Select the level by operational meaning:
+   - `error`: behavior/security-affecting failure;
+   - `warn`: degraded/fallback/operator-actionable state;
+   - `info`: low-frequency lifecycle/mode change;
+   - `debug`: targeted diagnostics;
+   - `trace`: repetitive request/object/shard success paths.
+5. Never log secrets, tokens, auth headers, credential payloads, raw
+   attacker-controlled bodies, or merged config dumps. Error strings and
+   `Debug` output are log surfaces too.
+6. Prefer one aggregate summary over inventories or startup banners.
+7. Run `./scripts/check_logging_guardrails.sh` and the checks selected by root
+   `AGENTS.md`.
+
+Read [logging-governance.md](references/logging-governance.md) only for a broad
+logging audit, event-model migration, or guardrail expansion. Ordinary single-
+site edits do not require the full workspace scope map.

.agents/skills/rustfs-logging-governance/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "RustFS Logging Governance"
+  short_description: "Standardize RustFS logs with structured events and guardrails."
+  default_prompt: "Use $rustfs-logging-governance to standardize or review RustFS logging, reduce noise, and update guardrails."

.agents/skills/rustfs-logging-governance/references/logging-governance.md

@@ -1,6 +1,5 @@
 # Logging Audit and Migration Reference
 
-Use the [root logging rules](../../AGENTS.md#logging) for individual events.
 Read this reference only for a broad logging audit, an event-model migration,
 or a change to `scripts/check_logging_guardrails.sh`. Use `Cargo.toml` for the
 current workspace/crate list instead of maintaining one here.

.agents/skills/rustfs-release-publish/SKILL.md

@@ -1,42 +1,156 @@
 ---
 name: rustfs-release-publish
-description: Publish a RustFS version through Console, release-branch CI, preview acceptance, human confirmation, and final publication. Use only for an explicit release request.
+description: "Run the end-to-end RustFS console gate, version bump, preview validation, human confirmation, and final-tag publication pipeline. Use only when the user explicitly asks to release or publish a RustFS version (发版/发布)."
 ---
-# RustFS Release
+# RustFS Release Publish (preview-validated pipeline)
 
-Require the exact final SemVer target before version edits or publication. If unspecified, inspect current releases/tags and ask with concrete candidates; do not guess the channel or bump. A named bump type resolves to an exact version that still needs confirmation. Report the confirmed target verbatim; resolve any later mismatch before proceeding. Independent read-only preflight may continue.
+This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (invoked here with the authorized commit/push/PR scope) with a mandatory preview-tag validation loop before the final tag is published.
 
-## Invariants
+The binary reports its build tag (`build::TAG` via shadow_rs; `SHORT_VERSION` in
+`rustfs/src/config/cli.rs`), and `build.yml` derives asset names and preview
+classification from that tag. Cargo.toml supplies only the no-tag fallback.
+Preview and final tags must therefore share the validated source commit;
+their tag-dependent version and asset names differ. The channel and cleanup
+constraints are defined once under Preview tag naming and Hard rules below.
 
-- Cargo stores `<target>`, never `-preview.N`. Before publication, installation defaults retain the previous available deliverable. Final and preview binaries embed their own tag names, so version/asset names differ despite identical source.
-- Use annotated tags without `v`. Preview names are exactly `<target>-preview.<digits>`; choose the next unused iteration after fetching tags. Preview Releases are prereleases, never Latest; publish only versioned assets/exact Docker tags, never latest assets, R2, Helm, moving Docker channels, or installation/banner updates.
-- `release/<target>` owns the candidate. Retain its history, backport only reviewed fixes, and never merge main wholesale or force-push it. Pin `PREVIEW_HASH` to its exact commit with complete passing CI. Preview and final tags both point there; never tag a later main/branch HEAD or insert another bump.
-- Phase failures block dependents. Keep preview Releases until final publication and notes generation finish; CI removes Releases while retaining tags. Never move an existing preview or final tag.
+Pipeline shape:
 
-## Read by Phase
+```
+check console main against its latest Release
+  -> if ahead: publish console -> wait for Release asset + latest API
+  -> bump RustFS version files to <target> (final version, ONE commit) -> merge
+  -> tag <preview-tag> at that commit -> CI green
+  -> verify preview Release assets -> run binary locally + console checks
+  -> validate with latest rc client
+  -> report preview acceptance results -> STOP for explicit human confirmation
+  -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
+  -> CI deletes the <target>-preview.N Releases (tags kept)
+```
 
-Read only the current phase's procedure; retain completed evidence across turns. Follow root verification, Git/PR, and authorization rules.
+On validation failure: fix lands on main via normal PR (version files are already at `<target>`, no new bump PR), then tag `<preview-tag N+1>` at the new main commit and restart from Phase 2.
 
-| Phase | Procedure |
-|---|---|
-| 0 | Clean tree, fetch main/tags, verify GitHub access, then complete the mandatory [Console release gate](references/console-gate.md). A green Console build alone is insufficient. |
-| 1–2 | [Prepare/reuse the release candidate and run exact-SHA branch CI](references/release-candidate.md). Source version changes use `rustfs-release-version-bump` with authorized delivery scope. |
-| 3 | [Verify the preview build, assets, channels, and notes](references/preview-release.md). |
-| 4–5 | [Run the downloaded binary, Console CRUD, and latest-rc matrix](references/preview-acceptance.md). Every check must pass. |
-| Confirmation | Complete the gate below and end the turn. |
-| 6 | After fresh confirmation, [publish and verify the final tag](references/final-release.md) at `PREVIEW_HASH`. |
-| 7 | [Maintain milestones, installation references, and the website](references/post-release-updates.md) only after complete publication. |
+## Required inputs
 
-## Human Confirmation
+- Final target version, for example `1.0.0-beta.10`.
+- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` after `git fetch --tags`).
 
-After Phases 3–5 pass, recheck that the release branch still equals `PREVIEW_HASH`. Report the target, branch, preview tag/hash, branch CI run, preview Release URL, Console result, and rc matrix. Explicitly ask whether to publish the final tag and end the turn without creating/pushing it.
+If the target version is missing or ambiguous, collect the current release/tag baseline and ask before version edits or publication. Continue independent read-only preflight while the answer is pending (see the semver gate below).
 
-Only a new affirmative user reply to that exact report authorizes Phase 6. The original release request, earlier confirmation, silence, or automated follow-up does not count. Confirmation binds the target, preview tag, and hash; a changed value or repeated/failed acceptance cycle invalidates it. Revalidate and obtain fresh confirmation before continuing.
+## Semver gate — resolve the target before version edits or publication
 
-## Recovery
+Versions follow [SemVer 2.0.0](https://semver.org/). Precedence reminder:
 
-- Before the final tag exists, land fixes on main, backport to the candidate, verify target versions, and restart branch CI/acceptance. Use a new preview iteration once a preview was tagged; main may advance independently.
-- Once the final tag exists, retry publication jobs for that exact tag. A source fix requires a newly confirmed target, not retagging or a newer preview. Phase 7 retries recheck artifact availability and superseding releases.
-- If abandoned after the bump merged, report the unpublished version on main and record whether to revert or let the next release overwrite it. Deleting candidate branches or preview tags requires an explicit decision.
+```
+1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0 < 1.0.1 < 1.1.0 < 2.0.0
+```
 
-Report completed phase results and incomplete work with evidence: Console previous/latest tags, release need, hash and run/Release URLs; target, branch CI/SHA, previews and hash, confirmation state; preview/final assets, latest-channel state, Console/rc results and cleanup; both milestone states, installation PR checks/merge state, and website text/link/PR/deployment state. Keep artifact publication separate from follow-up delivery; do not call an open PR a live update. Report deviations and their authorization.
+Numeric prerelease identifiers compare numerically (`beta.9 < beta.10`), not lexically — see [semver.org spec item 11](https://semver.org/#spec-item-11). Preview tags are internal validation tags layered on top of the target's prerelease channel — they are never themselves a deliverable version and never appear in version files.
+
+Rules:
+
+- A request like "发个版" / "release the next version" without an exact version string is ALWAYS ambiguous. Derive the current latest tag (`git tag --sort=-v:refname | head`), then ask the user to choose with concrete candidates, e.g. from `1.0.0-beta.10`: next prerelease `1.0.0-beta.11`, promote to `1.0.0-rc.1`, promote to stable `1.0.0`. Never guess between these — they have very different meanings (channel promotion vs. iteration) and different CI classification consequences.
+- After a stable `X.Y.Z` exists, the next version must state which component bumps: patch `X.Y.(Z+1)` for fixes only, minor `X.(Y+1).0` for backward-compatible features, major `(X+1).0.0` for breaking changes. If the user names a bump type but not a number, compute it from the latest stable tag and echo the exact resulting version back for confirmation.
+- Echo the final confirmed version string verbatim in your first status report; every later phase must use exactly that string. If at any point the user's wording and the confirmed version diverge, stop and re-confirm.
+
+## Preview tag naming
+
+- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
+- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
+- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Docker, or Helm publication is a pipeline failure.
+- Preview Releases are cleaned up by the `cleanup-preview-releases` job after `publish-release` succeeds for the deliverable tag. It deletes every Release whose tag is exactly `<target>-preview.<digits>` and never passes `--cleanup-tag`, so the tags survive.
+
+## Hard rules
+
+- Version files (Cargo.toml, Cargo.lock, README, flake.nix, Chart.yaml, rustfs.spec) are bumped ONCE, directly to `<target>`. Never write a `-preview.N` suffix into any version file. If `rustfs-release-version-bump` is ever asked for a `-preview` version, that is a pipeline bug — stop.
+- Preview Release assets are versioned and intentionally visible on the Releases page for the duration of validation. Do not label them Latest or use them to update any latest distribution channel.
+- Never delete a preview Release by hand before Phase 6 finishes — Phase 4 downloads its assets and the final Release notes are generated while it still exists. Cleanup is CI's job; only step in manually (`gh release delete "<preview-tag>" --yes`, never `--cleanup-tag`) if `cleanup-preview-releases` failed.
+- Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
+- The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD (commits merged after validation are unvalidated), and never create an extra version-bump commit between preview and final.
+- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag — cleanup runs after the notes are generated, so the preview Release is still present and would otherwise be picked as the baseline. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
+- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
+- Phases run in order; a failure in any phase blocks everything after it. After the fix lands on main, restart from Phase 2 with the next preview iteration against the new `origin/main` hash — do not resume mid-pipeline against a stale hash.
+- Completing preview acceptance does not authorize the final tag. After Phases 3–5 pass, report the acceptance evidence and stop until the user explicitly confirms continuation. The original release request, an earlier confirmation, silence, or an automated follow-up does not satisfy this gate.
+- Confirmation is scoped to the reported `<target>`, `<preview-tag>`, and `PREVIEW_HASH`. A failed or repeated acceptance cycle, including any new preview iteration, invalidates prior confirmation and requires a new one.
+- If the release is abandoned after Phase 1 merged, main's version files claim a version that was never tagged. Either revert the bump PR or leave it to be overwritten by the next release — but tell the user explicitly and record the decision.
+- User-facing status updates in Chinese; commits, PR titles/bodies, and tag messages in English. No hard-wrapping in commit messages, PR bodies, or documentation prose — one logical line per sentence/paragraph, let soft wrap handle display.
+
+## Phase 0 — Preflight
+
+- `git status --short` clean; `git fetch origin main --tags`.
+- `gh auth status` works; confirm you can view `gh release list -L 3`.
+- Confirm the exact final target version with the user if not explicit.
+
+### Console release gate
+
+Read and complete [the Console gate](references/console-gate.md) before Phase 1. Verify the latest published Console asset and exact commit; if Console main is ahead, complete its release and asset verification first. A successful build alone does not satisfy this gate.
+
+## Phase 1 — Version bump to the final target (once)
+
+- If main's version files already read `<target>` (e.g. this is a restart after a failed preview), verify with `rg -n "<target>" Cargo.toml rustfs.spec helm/rustfs/Chart.yaml` and skip to Phase 2.
+- Otherwise invoke the `rustfs-release-version-bump` skill with the final `<target>` (NOT a preview version), full GitHub flow (commit/push/PR).
+- Get the PR merged into main. Record the resulting main commit:
+
+```bash
+git fetch origin main
+PREVIEW_HASH=$(git rev-parse origin/main)   # must contain the bump PR
+```
+
+`PREVIEW_HASH` is the single source of truth for the rest of the pipeline — report it to the user and reuse it verbatim in Phases 2 and 6. Both the preview tag and the final tag will point at it.
+
+## Phase 2 — Publish the preview tag
+
+```bash
+git tag -a "<preview-tag>" -m "Release <preview-tag>" "$PREVIEW_HASH"
+git push origin "<preview-tag>"
+```
+
+Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.
+
+The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Its latest-channel, R2, Docker, and Helm jobs must be skipped. Those publication paths run only after the final tag is pushed.
+
+On a restart (N+1), refresh `PREVIEW_HASH=$(git rev-parse origin/main)` first — it must contain the fix — and re-report it.
+
+## Phase 3 — CI and preview Release verification
+
+- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
+- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
+- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
+- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
+- Confirm preview-triggered Docker and Helm jobs are skipped. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; Docker image construction and Helm publication are deferred to the final tag because the Dockerfiles consume GitHub Release assets.
+
+## Phases 4–5 — Local artifact, Console, and rc acceptance
+
+Read and complete [preview acceptance](references/preview-acceptance.md): verify the downloaded binary's tag/SHA and readiness, exercise Console CRUD with byte-identical download, and pass the full latest-rc command matrix. Any failure blocks final publication. Retain the results for the confirmation gate below.
+
+### Manual confirmation gate
+
+After every Phase 3–5 check passes, report the target, preview tag, `PREVIEW_HASH`, preview Release URL, console result, and rc matrix, then explicitly ask the user whether to publish the final tag. End the turn without creating or pushing `<target>`.
+
+Continue to Phase 6 only after a new user reply explicitly confirms the reported target, preview tag, and commit. A clear affirmative reply to that exact report, such as `确认继续`, is sufficient; if the reply is ambiguous or any reported value changed, ask again.
+
+## Phase 6 — Publish the final tag on the validated commit
+
+No second version bump, no release branch. The final tag goes on the exact commit the preview validated:
+
+```bash
+git fetch origin --tags
+git rev-parse "<preview-tag>^{commit}"          # must equal PREVIEW_HASH — abort if not
+git tag -a "<target>" -m "Release <target>" "$PREVIEW_HASH"
+git push origin "<target>"
+```
+
+- CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
+- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
+- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
+- Verify the preview cleanup: `cleanup-preview-releases` must succeed, `gh release view "<preview-tag>"` must then report `release not found` for every preview iteration of this target, and `git rev-parse "<preview-tag>^{commit}"` must still resolve to `PREVIEW_HASH` (the tag is kept). If the job failed, delete the leftover Releases manually with `gh release delete "<preview-tag>" --yes` and report it.
+- Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.
+
+## Output contract
+
+Always report:
+
+- Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
+- Target version, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
+- Manual confirmation gate status (`WAITING_FOR_CONFIRMATION` or `CONFIRMED`) and its exact target, preview tag, and `PREVIEW_HASH`.
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, the rc command matrix, and the preview-Release cleanup result (deleted Releases plus surviving tags).
+- Any deviation from this pipeline and why the user approved it.

.agents/skills/rustfs-release-publish/references/final-release.md

@@ -1,22 +0,0 @@
-# Final Release Publication
-
-Read only after fresh user confirmation of the preview acceptance report. The [parent confirmation gate](../SKILL.md#human-confirmation) applies.
-
-## Phase 6 — Publish the final tag on the validated commit
-
-No second source version bump. Before creating the final tag, recheck the remote `release/<target>` HEAD equals `PREVIEW_HASH`. If it moved after confirmation, the approval no longer applies; validate and obtain confirmation for a new preview. The final tag goes on the exact commit the preview validated:
-
-```bash
-git fetch origin --tags
-git rev-parse "<preview-tag>^{commit}"          # must equal PREVIEW_HASH — abort if not
-git tag -a "<target>" -m "Release <target>" "$PREVIEW_HASH"
-git push origin "<target>"
-```
-
-- CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
-- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
-- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
-- Verify the preview cleanup: `cleanup-preview-releases` must succeed, `gh release view "<preview-tag>"` must then report `release not found` for every preview iteration of this target, and `git rev-parse "<preview-tag>^{commit}"` must still resolve to `PREVIEW_HASH` (the tag is kept). If the job failed, delete the leftover Releases manually with `gh release delete "<preview-tag>" --yes` and report it.
-- Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.
-
-Never pass `--cleanup-tag` when removing preview Releases. Remove them manually only if `cleanup-preview-releases` failed, after final publication and notes generation. Record deleted Releases and surviving tags.

.agents/skills/rustfs-release-publish/references/post-release-updates.md

@@ -1,40 +0,0 @@
-# Post-release Milestone, Installation, and Website Updates
-
-Read only after the final non-preview tag has passed Phase 6. Tag creation or a green binary build alone is insufficient: the release assets, source archive, container images, Helm package, and applicable latest channels must be available. Preview tags never enter this phase.
-
-## Version milestones
-
-1. Query all pages of both open and closed milestones in the RustFS release repository, matching titles exactly to version strings without a `v` prefix. A failed or incomplete query is not evidence that a milestone is absent; resolve the lookup before making changes.
-2. Close the milestone matching the published `<target>` if it is open; an already closed milestone needs no change. If it is missing, report the gap and continue checking the next version. Do not create a substitute for the released milestone or close/reassign its issues or PRs.
-3. Use an explicitly planned next version when provided; otherwise, for a stable `X.Y.Z`, use `X.Y.(Z+1)`. For example, after `1.0.1` is published, close milestone `1.0.1` and ensure milestone `1.0.2` exists. For an alpha/beta/rc target with a trailing numeric counter, increment that counter within the same channel unless a different next version was specified. If the next version cannot be determined, ask for that version and report this follow-up as blocked. Creating a planning milestone does not confirm the target of a future release or bypass the semver gate.
-4. Reuse an existing next-version milestone, whether open or closed; do not reopen it or create a duplicate. Only when the complete query confirms it is absent, create an open milestone with the exact next-version title. Do not invent a due date or description. After an uncertain creation result, query again before retrying.
-5. Read back both milestones and report their titles, URLs, and actual states, including whether the next milestone was reused or created. A failed close, create, or verification leaves milestone maintenance incomplete; retry only the unfinished operation after refreshing live state. Continue independent installation and website work without moving or republishing the release tag.
-
-## Installation references
-
-1. Re-read the published deliverable state before edits or a retry. If a newer release has superseded this target, do not downgrade installation references or the website announcement. Report the superseding release and leave those defaults intact.
-2. Invoke `rustfs-release-version-bump` with stage `post-release`, the exact target, and the authorized delivery scope. Prepare the follow-up on current main; do not edit or move either validated release tag. Cargo versions may already be preparing the next target and must remain untouched.
-3. Verify the exact Docker image manifest, Release download links, RPM source archive, and Helm repository entry before publishing the installation PR. The chart workflow overrides chart/app versions from the final tag, pins the source checkout to that release, and waits for its default Docker image before packaging.
-4. Report the installation PR and its merge state separately from the completed release. Reuse existing merge authorization and repository checks; do not infer new merge authority from this reference.
-
-## rustfs.com top banner
-
-Use the existing announcement configuration from [website PR #112](https://github.com/rustfs/rustfs.com/pull/112). Do not add a second banner or redesign the header.
-
-1. In an isolated checkout of `rustfs/rustfs.com`, read its current `AGENTS.md`, PR template if present, `data/announcement.ts`, and the consuming header component. Search for an existing announcement PR for this target before creating another.
-2. Update `homeAnnouncement` in `data/announcement.ts` after the release and installation availability checks pass. Keep `enabled: true`, `badge: 'New'`, and the existing component. For a stable release, use:
-
-   ```ts
-   export const homeAnnouncement = {
-     enabled: true,
-     badge: 'New',
-     message: 'RustFS <target> is now available! Please',
-     linkText: 'upgrade and try',
-     href: '/download',
-   } as const
-   ```
-
-   Replace `<target>` with the exact published version. Reserve GA wording for the actual first stable release. For a final alpha/beta/rc tag, explicitly call it a prerelease; use its GitHub Release URL if `/download` does not expose that target. Never announce a `-preview.N` build here.
-3. Use the site's current package manager and required checks. For this config-only change, type-check and lint the changed file, build the site, and inspect the generated homepage for the version, visible link text, and destination. Confirm `/download` actually offers the announced version before using that link.
-4. Commit, push, and create or update the website PR when included in the authorized release scope. Include the published RustFS Release URL and checks run. Keep merge and production-deployment authority separate; reuse permission already given, but this reference grants none by itself.
-5. After an authorized merge/deployment, verify the live `https://rustfs.com/` banner and its destination. If only the PR is ready, report that state and URL; do not report the banner as deployed. A website failure does not invalidate or move the published release tag: retry this phase after resolving the failure.

.agents/skills/rustfs-release-publish/references/preview-release.md

@@ -1,24 +0,0 @@
-# Preview Release Verification
-
-Read for Phase 3 after the candidate passed exact-SHA CI. The [parent release invariants](../SKILL.md) apply.
-
-## Preview channels
-
-- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
-- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
-- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Helm, or moving Docker channel tag is a pipeline failure. Docker images may use the exact preview version tag, including its existing variant suffixes.
-- Preview Releases are cleaned up by the `cleanup-preview-releases` job after `publish-release` succeeds for the deliverable tag. It deletes every Release whose tag is exactly `<target>-preview.<digits>` and never passes `--cleanup-tag`, so the tags survive.
-
-## Phase 3 — CI and preview Release verification
-
-- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
-- Confirm the preview tag resolves to the Phase 2 CI-validated `PREVIEW_HASH`. If the release branch advances during acceptance, repeat Phases 2–5 with a new preview tag.
-- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
-- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
-- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
-- Confirm Helm is skipped. If preview Docker images are published, confirm they use only exact preview tags (and variant suffixes), with no `latest`, `alpha`, `beta`, or `rc` channel updates. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; it does not authorize advancing any installation default.
-
-## Release notes
-
-- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag — cleanup runs after the notes are generated, so the preview Release is still present and would otherwise be picked as the baseline. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
-- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.

.agents/skills/rustfs-release-publish/references/release-candidate.md

@@ -1,37 +0,0 @@
-# Release Candidate Preparation
-
-Read for Phases 1–2. The [parent release invariants](../SKILL.md) and Console gate apply.
-
-## Candidate Resume Preflight
-
-- `git status --short` clean; `git fetch origin main --tags`.
-- `gh auth status` works; confirm you can view `gh release list -L 3`.
-- Confirm the exact final target version with the user if not explicit.
-- Check whether `release/<target>` already exists before creating it; a resumed release reuses the existing branch and its history. For an in-flight release that already has a preview tag but no branch, anchor the new branch to that tag's commit only after verifying its target versions and prior acceptance evidence.
-
-## Phase 1 — Source version bump to the final target (once)
-
-- If `release/<target>` exists, verify its Cargo.toml and workspace members in Cargo.lock read `<target>` and skip the source bump, even if main has advanced. If the branch versions differ, stop and resolve the mismatch without downgrading main.
-- If no branch exists but an unfinished preview tag does, verify its commit has `<target>` in both version files and skip the bump; Phase 2 anchors the branch to that commit. Stop if those files disagree. Otherwise, if main already has `<target>` in both files, skip the bump. Installation references intentionally retain the previous published deliverable during preview; if they were advanced to an unavailable target, restore that baseline before choosing the next candidate.
-- Only when neither the release branch, an unfinished preview tag, nor current main already has `<target>`: if main is at a later version, select and verify a historical commit containing `<target>` rather than downgrading main; block if none exists. Otherwise invoke the `rustfs-release-version-bump` skill with stage `prepare`, the final `<target>` (NOT a preview version), and full GitHub flow (commit/push/PR).
-- If a bump PR was needed, get it merged into main and record its merge commit. For a new release branch when main already has `<target>`, identify the main commit that introduced those versions. Phase 2 chooses a release candidate containing that commit; an existing release branch keeps its own history and a newer main HEAD is not required.
-
-Do not wait for the moving latest main HEAD to become green. The release-branch CI in Phase 2 validates the chosen commit before a preview tag is created.
-
-## Phase 2 — Pin and validate the release candidate, then publish the preview tag
-
-- Use `release/<target>`. On the first attempt, create it from a selected main commit containing the version bump and intended changes; it need not be the latest main HEAD. On a restart, retain the existing branch and backport only reviewed fixes from main. Verify the branch's Cargo versions still equal `<target>`. If adopting an existing preview, run this branch CI before continuing its acceptance; reuse the tag only when it points to the validated SHA.
-- The current `ci.yml` runs automatically on main pushes, not release-branch pushes. Dispatch it explicitly with `gh workflow run ci.yml --ref "release/<target>"`. Locate that dispatch run, verify its `head_sha` equals the release branch's remote HEAD, and require the full expected CI job set to pass, including `Quick Checks`, `Test and Lint`, and `End-to-End Tests (full merge gate)`. Treat a missing or skipped required lane as incomplete. A successful PR check or CI run for a different SHA does not qualify. If the branch advances or a run is cancelled, validate the new SHA again. Do not tag a candidate with failing or incomplete CI.
-- Prefer protecting `release/*` against force pushes and deletion and requiring reviewed backport PRs. Check live rulesets rather than assuming the main ruleset covers release branches; report a missing release-branch rule as a gap.
-- Set `PREVIEW_HASH` to the CI-validated release-branch commit and recheck the remote branch HEAD immediately before tagging. Report the branch, commit, and CI run URL; do not derive `PREVIEW_HASH` from a later `origin/main` fetch. When adopting an existing preview tag at this SHA, skip tag creation and continue Phase 3.
-
-```bash
-git tag -a "<preview-tag>" -m "Release <preview-tag>" "$PREVIEW_HASH"
-git push origin "<preview-tag>"
-```
-
-Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.
-
-The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Docker may publish exact preview image tags. Latest-channel, R2, and Helm publication must be skipped; installation references and the website announcement stay unchanged.
-
-On a restart after a backport, re-run release-branch CI before setting the new `PREVIEW_HASH`. Use the next unused preview iteration when the validated commit differs from an existing preview tag; never move an existing tag.

.agents/skills/rustfs-release-version-bump/SKILL.md

@@ -1,24 +1,118 @@
 ---
 name: rustfs-release-version-bump
-description: Prepare an exact RustFS Cargo version or align installation references after publication. Use for requested version bumps or the release workflow.
+description: "Prepare the version-file and release-asset bump for an exact RustFS alpha/beta/stable target, with verification and optional commit/push/PR delivery. Use for an explicit version bump or when invoked by the release-publish workflow."
 ---
-# Release Version Files
+# RustFS Release Version Bump
 
-Require an exact target; ask if missing or ambiguous. Reject targets containing `-preview`: those are tag-only. Infer `post-release` only from an explicit request or parent workflow; otherwise use `prepare`. Delivery defaults to local edit/verify; commit, push, PR, and merge follow existing authorization and [Git rules](../../references/pull-requests.md).
+Use this skill to prepare and verify release version files. Commit, push, and PR steps apply only when included in the user's delivery scope; publishing release tags belongs to `rustfs-release-publish`.
 
-| Stage | Files and constraints |
-|---|---|
-| `prepare` | Only `Cargo.toml` and `Cargo.lock`: workspace package, internal dependency, and workspace member versions become `<target>`. External dependencies stay unchanged. |
-| `post-release` | Only `README.md`, `README_ZH.md`, `flake.nix`, `helm/rustfs/Chart.yaml`, and `rustfs.spec`. Cargo may already target the next release; leave it untouched. |
+Validated baseline: release pattern used in PR `#2957`.
 
-Before installation edits, verify the exact non-preview Release, downloadable assets/source archive, pullable `rustfs/rustfs:<target>` image manifest, and published Helm chart. Block on missing artifacts. Do not downgrade defaults if a newer deliverable superseded the target. Preview preparation retains the previous published installation references; follow-up commits never replace either validated tag.
+## Required inputs
 
-Packaging policy:
+- Exact target version, for example `1.0.0-beta.4`.
+- Delivery scope: local (`edit/verify`), git (`commit/push`), or GitHub
+  (`commit/push/PR`). Derive it from the conversation; when unspecified, prepare
+  and verify locally without blocking on a delivery question.
 
-- Docker image tags have no `v` prefix. Derive chart/app versions with `scripts/helm_chart_version.sh <target>` (`beta.N -> 0.N.0`; other versions unchanged). Helm CI derives versions from the final tag, so no early chart bump is required.
-- RPM `Version` is numeric; `Release` is the prerelease suffix or `1` for stable. Expanded `Source0` and the unpack directory must resolve to the exact target including its suffix. Add the changelog entry using current git identity, date, and target; never copy an example identity/date.
-- Changing these mappings requires explicit confirmation.
+If target version is missing or ambiguous, stop and ask before editing.
 
-Verification follows root tiers: `prepare` validates Cargo metadata with the updated lockfile and checks every workspace/internal version with no unrelated lockfile updates. `post-release` renders Helm with the verified image, runs `scripts/test_helm_chart_version.sh` for chart version edits, and checks README, Nix, and RPM references. Run `git diff --check`; report unresolved required checks as `BLOCKED` without unrelated fixes.
+Reject any target version containing `-preview`: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.
 
-For authorized commits, keep stages separate: `chore(release): prepare <target>` or `chore(release): align installation references for <target>`. Report target/stage, changed files, verification, material uncertainty, and actual commit/push/PR state.
+## Read before editing
+
+- `AGENTS.md` (root and nearest path-specific files).
+- `.github/pull_request_template.md` only when preparing a PR.
+- Current branch status and diff against `origin/main`.
+
+## Default release file scope
+
+Treat the following file list as the default checklist for each release bump:
+
+- `Cargo.toml`
+- `Cargo.lock`
+- `README.md`
+- `README_ZH.md`
+- `flake.nix`
+- `helm/rustfs/Chart.yaml`
+- `rustfs.spec`
+
+Only drop a file when the current repository release process clearly no longer requires it.
+
+## Hard release policy
+
+- Docker doc tags use `<version>` (for example `rustfs/rustfs:1.0.0-beta.4`), not `v<version>`.
+- Helm chart version mapping follows `beta.N -> 0.N.0`.
+- `rustfs.spec` `Release` uses prerelease suffix only (for example `beta.4`).
+- Do not change these rules without explicit confirmation.
+
+## Step-by-step workflow
+
+1. Confirm intent and isolate scope
+- Use the exact target and delivery scope already supplied; ask only for a missing or ambiguous target or a material release-policy choice.
+- Inspect current branch and ensure only release-related files are touched for this task.
+
+2. Update workspace versions
+- Bump `[workspace.package].version` in `Cargo.toml`.
+- Bump internal workspace crate dependency versions in `Cargo.toml`.
+- Update `Cargo.lock` so workspace package versions match target version.
+- Re-scan for partial leftovers.
+
+3. Update release assets
+- `README.md` and `README_ZH.md`: update versioned Docker examples to target version.
+- `flake.nix`: update package version to target version.
+- `helm/rustfs/Chart.yaml`:
+- `appVersion` = target version.
+- `version` follows chart mapping rule, for example:
+- `1.0.0-beta.3` -> `0.3.0`
+- `1.0.0-beta.4` -> `0.4.0`
+- `rustfs.spec`:
+- Set `Release` to prerelease suffix (example `beta.4`).
+- Add/update top changelog entry with exact format:
+- `* Thu May 20 2026 houseme <housemecn@gmail.com>`
+- `- Update RPM package to RustFS 1.0.0-beta.4`
+- Changelog identity and time must come from current environment:
+- `git config --get user.name`
+- `git config --get user.email`
+- `date '+%a %b %d %Y'`
+- Changelog version text must match target release version exactly.
+
+4. Verify before shipping
+- Run:
+- `make pre-commit`
+- If `make pre-commit` fails, fix task-attributable failures and rerun affected checks. Report unresolved required checks as `BLOCKED`; do not silently widen scope to fix unrelated issues.
+
+5. Commit strategy (only when committing is authorized)
+- Preferred split when both parts changed:
+- `chore(release): prepare <version>` for `Cargo.toml` and `Cargo.lock`.
+- `chore(release): align release assets for <version>` for docs and packaging files.
+- If user asks for one commit, use one commit.
+- Stage only intended release files; do not include unrelated working tree changes.
+
+6. Push and PR (only for the authorized delivery scope)
+- Push branch:
+- Use the user-requested or configured push remote: `git push -u <push-remote> <branch>` (first push), or `git push` when tracking is already configured.
+- Create PR with template headings unchanged:
+- `gh pr create --base main --head <branch> --title ... --body-file ...`
+- PR title/body must be English.
+- Use `N/A` for non-applicable template sections.
+- Include verification commands and any `BLOCKED` reason clearly.
+
+## Recommended check commands
+
+- `git status --short --branch`
+- `git diff --name-only origin/main...HEAD`
+- `git diff --stat origin/main...HEAD`
+- `rg -n "<old_version>|<new_version>" Cargo.toml Cargo.lock README.md README_ZH.md flake.nix helm/rustfs/Chart.yaml rustfs.spec`
+- `make pre-commit`
+
+## Output contract
+
+When using this skill, always report:
+
+- Target version.
+- Files changed.
+- Any assumptions or uncertainties requiring confirmation.
+- Verification result (`PASSED` or `BLOCKED`) with key evidence.
+- Commit message(s) used.
+- Push status and PR URL when GitHub flow is requested.

.agents/skills/security-advisory-lessons/references/advisory-patterns.md

@@ -45,14 +45,11 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 - `GHSA-6r96-hmgc-726c`: request headers collided with lowercase server-derived condition keys such as `userid`, `groups`, `versionid`, and JWT/LDAP claims. Lesson: never let caller-controlled headers append to or replace server-derived policy context; reserve trusted condition keys and keep intentional request-header keys separate.
 - `GHSA-v9cp-qfw9-9pfp`: quantified negated string conditions applied negation after aggregation, transposing `ForAllValues` and `ForAnyValue` semantics. Lesson: push negation into the per-value predicate for quantified operators and test partially overlapping multi-value sets.
 - `GHSA-5w8r-p896-6vq2`: OPA policy mode skipped `ExistingObjectTag/*` loading, so tagged objects looked untagged to external policies. Lesson: external authorization plugins need the same object-tag and request context as built-in policy evaluation before they decide.
-- `GHSA-9wgh-5r68-49p7`: substituted policy-variable values could recreate `${...}` and loop inside a single resolution pass, never reaching the outer iteration limit. Lesson: bound substitutions within each pass and test cycles formed across otherwise literal resolver values; confirm whether attacker-controlled claims can reach those values before assigning remote impact.
 
 ### S3 object actions, copy, multipart, and upload policy validation
 
-- `GHSA-g8w9-qw9q-fghr` and `GHSA-xm99-m3gq-83g8`: a valid presigned `PutObject` accepted extra `x-amz-*` headers omitted from `SignedHeaders`; `x-amz-copy-source` could turn that upload capability into a cross-bucket read performed as the signer. Lesson: a presigned URL is a bounded capability; inspect all received security-sensitive headers and reject unsigned ones before selecting the S3 operation or reaching storage.
+- `GHSA-g8w9-qw9q-fghr`: a valid presigned `PutObject` accepted extra `x-amz-tagging`, website redirect, and storage-class headers omitted from `SignedHeaders`. Lesson: a presigned URL is a bounded capability; reject `x-amz-*` headers that are not cryptographically bound by the signature so unsigned metadata cannot change authorization, lifecycle, redirect, cost, or durability semantics.
 - `GHSA-3ppv-fx5m-m749`: explicit `versionId` reads and copy sources authorized `s3:GetObject` instead of `s3:GetObjectVersion`. Lesson: version-specific object access must select version-specific actions for direct reads, `CopyObject`, and `UploadPartCopy`, with tests proving the backend is not reached on denial.
-- `GHSA-cg33-pxfp-qcj3` and `GHSA-65wq-gjw8-xr9w`: `HeadObject` and object-tagging paths authorized current-object actions while operating on an explicit historical `versionId`. Lesson: select the corresponding version action for metadata and tag reads and writes too; audit every operation that accepts a version ID.
-- `GHSA-gjph-xcgw-4p7w`: `PutObject` and browser POST accepted a caller-supplied `versionId` and replaced an unlocked historical version with only `s3:PutObject`. Lesson: only replication-authorized writes may choose an existing version ID; ordinary uploads must not rewrite version history.
 - `GHSA-x298-9x87-fvjq`: anonymous `ListObjectVersions` fell back to `ListBucket` and returned before public-access-block gates. Lesson: compatibility fallbacks must converge on the same post-authorization checks as direct grants, especially `RestrictPublicBuckets` and anonymous data-plane denies.
 - `GHSA-mx42-j6wv-px98`: `UploadPartCopy` missed source authorization and allowed cross-bucket object exfiltration. Lesson: multipart copy must enforce the same source and destination contract as `CopyObject`.
 - `GHSA-wfxj-ph3v-7mjf`: `UploadPartCopy` checked source and destination independently but missed destination copy-source policy constraints. Lesson: source read and destination write checks are not sufficient when policy constrains allowed copy sources.
@@ -63,14 +60,12 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 - `GHSA-3g29-xff2-92vp`: FTP `RETR` and `SIZE`/`MDTM` read paths authenticated the user but skipped IAM before calling storage. Lesson: non-HTTP protocol frontends must enforce the same per-operation authorization as the S3 API before backend access.
 - `GHSA-g3vq-vv42-f647`: FTPS `MKD` called `create_bucket` without checking `s3:CreateBucket`. Lesson: protocol command handlers need action-specific checks even when sibling handlers already authorize correctly.
 - `GHSA-3p3x-734c-h5vx`: FTPS and WebDAV compared secret keys with early-return string equality, while FTPS also returned distinguishable invalid-user and invalid-password failures. Lesson: password-style protocol auth needs constant-time secret comparison, indistinguishable failures where practical, and rate limiting.
-- `GHSA-rhg6-jrf2-29c4`: WebDAV, FTP/FTPS, and SFTP used identity-policy checks with empty conditions and bypassed S3 bucket-policy explicit denies and condition-key denies. Lesson: alternate listeners must evaluate the same effective policy and trustworthy request context before storage access.
 
 ### Filesystem paths and object key traversal
 
 - `GHSA-pq29-69jg-9mxc`: RPC `read_file_stream` joined untrusted paths under a volume directory without canonical boundary checks. Lesson: `PathBuf::join` plus length checks are not path security.
 - `GHSA-8r6f-hmq2-28rg`: object keys containing traversal sequences bypassed bucket/object authorization when mapped to filesystem paths. Lesson: reject traversal at object-key parsing and verify final storage paths remain under the expected bucket/key root.
 - `GHSA-f4vq-9ffr-m8m3`: Snowball auto-extract accepted archive entries such as `../victim-bucket/object`, authorized the raw attacker-bucket path, then storage path cleaning crossed bucket boundaries. Lesson: archive entries become object keys and need traversal rejection plus consistent authz/storage normalization before writes.
-- `GHSA-g7fq-6xjm-mxf4`: versioned `DeleteObjects` accepted dot-segment keys, authorized the literal prefix, then wrote delete markers under a resolved sibling prefix. Lesson: validate each batch key before authorization and storage normalization, using the same object-name rules as single delete.
 
 ### Secrets, defaults, and cryptographic misuse
 
@@ -106,13 +101,10 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 ### SSE and on-disk storage invariants
 
 - `GHSA-xrrf-67jm-3c2r`: SSE metadata reported encryption while reader composition bypassed `EncryptReader` and stored plaintext. Lesson: test actual bytes on disk and wrapper order, not only API metadata.
-- `GHSA-wqmc-vjgv-jrpw`: SSE-C persisted and listed the plaintext MD5 as the ETag, allowing list-only users to confirm or brute-force low-entropy content and correlate equal plaintext across keys. Lesson: encrypted-object ETags must not expose deterministic plaintext fingerprints; protect them with per-object key material and keep listing, conditional, copy, and multipart semantics consistent.
 
 ### Object Lock and retention invariants
 
 - `GHSA-j548-9grx-fh4f`: Object Lock enforcement treated unreadable, fabricated, or unparsable bucket metadata as absent configuration and allowed retained objects to be deleted or expired. Lesson: retention must fail closed unless Object Lock absence is authoritative, and every delete, lifecycle, scanner, force-delete, and default-retention path needs the same state distinction.
-- `GHSA-28w4-rp2p-636w` and `GHSA-c7hx-vr97-45rg`: an authorized `DeleteBucket` with `x-rustfs-force-delete: true` removed active COMPLIANCE-retained versions even though ordinary version deletion was denied. Lesson: bucket force-delete must enforce retention across every version, including against root/owner callers.
-- `GHSA-q23w-fp7p-472v`: `PutObjectRetention` policy conditions read `x-amz-object-lock-*` headers while the handler applied mode and date from the XML body. Lesson: authorize the parsed retention that will be stored, or reject mismatched header/body values; compare retention dates as instants so offsets cannot change the applied bound.
 
 ### Serde deserialization and input validation
 
@@ -128,13 +120,13 @@ Use these targeted searches when a diff touches security-sensitive code:
 ```bash
 rg -n "validate_admin_request|check_permissions|AdminAction::|deny_only|is_allowed" rustfs crates
 rg -n "authorize_operation|FtpsDriver|SftpDriver|RETR|MKD|SIZE|MDTM|CreateBucket|GetObject|HeadObject" crates/protocols rustfs
-rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|presign|SignedHeaders|x-amz-copy-source|collect_signed_headers|content-length-range|starts-with" rustfs crates
+rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|presign|SignedHeaders|content-length-range|starts-with" rustfs crates
 rg -n "ListBucketVersions|GetObjectVersion|versionId|VersionId|ExistingObjectTag|ForAllValues|ForAnyValue|POLICY_PLUGIN|opa" rustfs crates
 rg -n "normalize_extract_entry_key|Snowball|auto-extract|PathBuf::join|canonicalize|\\.\\.|x-forwarded-for|x-real-ip|SourceIp" rustfs crates
 rg -n "DEFAULT_SECRET|DEFAULT_ACCESS|TEST_PRIVATE_KEY|rustfs rpc|RUSTFS_RPC_SECRET" rustfs crates
 rg -n "TONIC_RPC_PREFIX|verify_rpc_signature|check_auth|NodeServiceServer|x-rustfs-signature" rustfs crates
 rg -n "debug!|trace!|info!|error!|\\?resp|\\?merged_config|session_token|secret_key" rustfs crates
-rg -n "HashReader|EncryptReader|try_resolve_etag|ETag|SSE|server-side encryption|Access-Control-Allow-Credentials|Origin" rustfs crates
+rg -n "HashReader|EncryptReader|SSE|server-side encryption|Access-Control-Allow-Credentials|Origin" rustfs crates
 rg -n "ObjectLock|object_lock|retention|COMPLIANCE|GOVERNANCE|delete_prefix|lifecycle|scanner" rustfs crates
 rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
 ```
@@ -142,17 +134,16 @@ rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
 ## Minimum Regression Test Expectations
 
 - Authz fixes: include unauthenticated, valid low-privilege, wrong-action, correct-action, owner, non-owner, and root/admin cases as applicable.
-- Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases; test bucket-policy explicit denies and condition-key denies on each enabled listener against an S3 control, and assert denied paths do not reach storage.
+- Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases, and assert denied paths do not reach the storage backend.
 - IAM fixes: include import/update/list service-account cases with attacker-controlled parent, claims, access key, secret key, and policy.
 - Copy/upload fixes: include cross-bucket, cross-user, source-denied, destination-denied, copy-source-condition, and multipart completion cases.
-- Presigned upload fixes: include a valid presign with extra unsigned tagging, redirect, storage-class, and cross-bucket copy-source headers; require rejection before source or destination storage access, and verify explicitly signed equivalents still work.
-- Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, multipart-copy source, `HeadObject`, and tag read/write cases.
-- Version-write fixes: a `PutObject`-only principal must not replace an existing version through `PutObject` or browser POST `?versionId=`; verify replication-authorized writes and versioned, suspended, and unversioned buckets separately.
-- Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, cyclic variable substitutions, plugin mode, and built-in policy mode.
-- Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks; test per-key `DeleteObjects` errors and prefix-scoped denials on versioned buckets.
+- Presigned upload fixes: include a valid presign with extra unsigned tagging, redirect, and storage-class headers; require rejection before storage access, and verify explicitly signed equivalents still work.
+- Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, and multipart-copy source cases.
+- Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, plugin mode, and built-in policy mode.
+- Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks.
 - Logging fixes: assert redacted output for structs and response bodies that may contain credentials.
 - IAM export fixes: assert exported archives omit plaintext user and service-account secrets unless the format deliberately encrypts or seals them.
 - RPC auth fixes: include captured metadata replay across two concrete methods, stale timestamps, wrong path, wrong method surrogate, wrong secret, and valid same-method calls.
 - Browser/CORS fixes: assert no credentials on reflected/default origins, correct behavior for explicit allowlists, and no same-origin script execution for previewed object content.
-- SSE fixes: inspect stored bytes and verify API metadata, read-back behavior, and on-disk ciphertext together; for ETags, upload equal plaintext under different keys and assert list-only callers cannot derive or correlate the plaintext digest, including multipart objects.
-- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths; an authorized force-delete must preserve active COMPLIANCE versions. For `PutObjectRetention`, test conflicting header/body values and offset dates against policy bounds and read-back retention.
+- SSE fixes: inspect stored bytes and verify API metadata, read-back behavior, and on-disk ciphertext together.
+- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths.

.agents/skills/test-coverage-improver/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: test-coverage-improver
+description: Analyze a supplied coverage report or perform an explicitly requested RustFS coverage assessment, rank uncovered risks, and propose focused tests. Do not trigger for ordinary implementation verification, a single regression test, documentation wording, or release preparation without a coverage request.
+---
+
+# Test Coverage Improver
+
+Use this skill when you need a prioritized, risk-aware plan to improve tests from coverage results.
+
+## Usage assumptions
+- Focus scope is either changed lines/files, a module, or the whole repository.
+- Reuse a supplied coverage artifact when its revision, scope, and format match.
+- If required context is missing, call out assumptions explicitly before proposing work.
+
+## Workflow
+
+1. Define scope and baseline
+   - Derive the revision and scope from the request, diff, or supplied report.
+   - Default to the affected files/module; whole-workspace coverage requires that
+     scope in the request. Ask only if a wrong scope would change the result.
+
+2. Obtain coverage evidence
+   - First inspect a matching existing artifact; do not regenerate it merely
+     because this skill was selected.
+   - If measurement is needed, read the Coverage section of
+     [the testing guide](../../../docs/testing/README.md#coverage), check disk
+     space/tool availability, and select package/test-scoped `cargo llvm-cov`
+     using the repository's nextest configuration. `make coverage` measures the
+     whole workspace (excluding E2E) and is only for that requested scope.
+   - Collect only metrics the report supports. Missing branch/changed-line
+     coverage is unknown, not zero.
+   - If measurement cannot run, continue with code-based test proposals and
+     mark measured coverage unverified; do not invent a coverage percentage.
+
+3. Rank highest-risk gaps
+   - Prioritize changed code, branch coverage gaps, and low-confidence boundaries.
+   - Apply the risk rubric in [coverage-prioritization.md](references/coverage-prioritization.md).
+   - Report up to 5–8 evidenced gaps; do not pad a small scope.
+   - For each gap, capture: file, lines, uncovered branches, and estimated risk score.
+
+4. Propose high-impact tests
+   - For each gap, name the behavior and regression, distinguishing assertions,
+     relevant normal/edge/failure cases, necessary setup, and estimated effort.
+   - Include only scenarios and setup that apply; reuse shared fixture details.
+
+5. Close with validation plan
+   - State which gaps remain after proposals.
+   - Give a scoped verification command and behavior-based acceptance criterion;
+     use a coverage threshold only when the task or repository requires one.
+   - List assumptions or blockers (environment, fixtures, flaky dependencies).
+
+## Report
+
+Summarize the supported metrics, then combine each ranked gap with its proposed
+test and validation. Include source lines only when supplied or inspected;
+mark missing metrics or locations as unknown. Do not duplicate gaps and tests
+in separate templates or fill empty categories for an otherwise small report.

.agents/skills/test-coverage-improver/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Test Coverage Improver"
+  short_description: "Find top uncovered risk areas and propose high-impact tests."
+  default_prompt: "Use $test-coverage-improver to analyze coverage for the requested scope, reuse matching reports, and propose tests for evidenced risks."

.agents/skills/test-coverage-improver/references/coverage-prioritization.md

@@ -0,0 +1,25 @@
+# Coverage Gap Prioritization Guide
+
+Use this rubric for each uncovered area.
+
+Score = (Criticality × 2) + CoverageDebt + (Volatility × 0.5)
+
+- Criticality:
+  - 5: authz/authn, data-loss, payment/consistency path
+  - 4: state mutation, cache invalidation, scheduling
+  - 3: error handling + fallbacks in user-visible flows
+  - 2: parsing/format conversion paths
+  - 1: logging-only or low-impact utilities
+
+- CoverageDebt:
+  - 0: 0–5 uncovered lines
+  - 1: 6–20 uncovered lines
+  - 2: 21–40 uncovered lines
+  - 3: 41+ uncovered lines
+
+- Volatility:
+  - 1: stable legacy code with few recent edits
+  - 2: changed in last 2 releases
+  - 3: touched in last 30 days or currently in active PR
+
+Sort by score descending, then by business impact.

.config/e2e-distributed-selection.txt

@@ -1,2 +1,2 @@
-sha256-linux=233bd7a68777eda1f044b6cb77128056be2b6492583c0dfd114b21e98a6102ef
-sha256-darwin=233bd7a68777eda1f044b6cb77128056be2b6492583c0dfd114b21e98a6102ef
+sha256-linux=563bff8f1171d6dbe166ff8440310dbe98430e466aa3ecd8dc39e3c872b320f7
+sha256-darwin=563bff8f1171d6dbe166ff8440310dbe98430e466aa3ecd8dc39e3c872b320f7

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=1520cd3027c3a6924afc6a204eddd5475bc30f0109d4c2847456a66177263244
-sha256-linux=26155b7f1c5bf6bf596ff24a4136e6767ea4ee6461c32db7fbe1400791da2c28
+sha256-darwin=15cb0cf9909bfbfc5a835fb08bd3675516c641db1b92ecc1e170a1cfa0fa2fd5
+sha256-linux=3163fdd29df5def86cf511ca7db05880d5c0caaa608a7031a71394327f7c217a

.config/e2e-nightly-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=347a0d4e5e547d5388703062ce66a66167a845b6e57ec591ccb4c732a567c68d
-sha256-linux=4f9efa47194279185bb68249e82c788fa147abe944b6c764050e3d47f31e7926
+sha256-darwin=83a7dcaffd5a789517ae9f02a224f66a9713937885cff96fca2ad7e216f197ae
+sha256-linux=626c10f8c964507ff987b6c86069e9019dc6d2ae7fb02db9be5df5aa8cc5145b

.config/e2e-protocols-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=a2cb67d91eb0d093928371d6e84a84b2dd41b2ba975a28094e81879bd65838ad
-sha256-linux=82db0561cf9b111f11782d647d0859c9d2a44c5c68481b5e39c48505828bd392
+sha256-darwin=55534a97fbd376f64c8f6c341d319017d11ff77cad6da8629a1a7f6a874e0315
+sha256-linux=c06fb8c19aed6f388b9dc61cb8251b7a44f8561a9bf764ad2b9e635598f8dc17

.config/e2e-repl-nightly-selection.txt

@@ -1 +1 @@
-sha256=e4ee3898b840a8374cb02c64342cc15f8d7ecd1becaf4b4a2a4657290f9e7ff1
+sha256=0e338d305260229e17ccfb2adc48a6212dbdfea36a9ebfb5a4e0d38658e6cc45

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=ba8f392b617cf9f2338142233a417e43927b28096635e628233ce8a60cf49d10
+sha256=5fbb230b89212b7c3d7229d6cef3e7e2d16f0ecfec62237ebc770785706f67d9

.config/ecstore-required-tests.json

@@ -55,281 +55,6 @@
       "invariant": "odm-source-contract-gcs",
       "suite": "rustfs",
       "name": "on_demand_migration::gcs::tests::gcs_native_backend_satisfies_the_shared_backend_contract"
-    },
-    {
-      "invariant": "rollback-inspection",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_preserves_overwrite_data_dirs_and_staging"
-    },
-    {
-      "invariant": "rollback-closed-inspection-channel",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_closed_heal_receiver_preserves_recovery_material"
-    },
-    {
-      "invariant": "rollback-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_cancelled_task_is_not_success"
-    },
-    {
-      "invariant": "rollback-completion-equivalence",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_matches_early_ack_and_full_wait_after_reopen"
-    },
-    {
-      "invariant": "rollback-physical-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_children_keep_namespace_ownership_after_coordinator_panic"
-    },
-    {
-      "invariant": "late-ack-retains-commit",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_data_early_ack_post_mutation_tail_error_never_rolls_back_commit"
-    },
-    {
-      "invariant": "tail-drained-cas",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::tail_drained_put_waits_for_tail_and_allows_immediate_cas"
-    },
-    {
-      "invariant": "seeded-put-tail-pressure",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::seeded_put_completion_pressure_drains_every_real_tail"
-    },
-    {
-      "invariant": "borrowed-lock-tail",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::no_lock_put_waits_for_rename_tail_under_outer_guard"
-    },
-    {
-      "invariant": "cancelled-writer-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::tail_drained_put_owned_commit_survives_waiter_cancellation"
-    },
-    {
-      "invariant": "get-body-reconstruction",
-      "suite": "rustfs-ecstore",
-      "name": "ecstore_validation_blackbox::blackbox_get_restores_body_after_one_shard_file_is_removed"
-    },
-    {
-      "invariant": "range-reconstruction",
-      "suite": "rustfs-ecstore",
-      "name": "ecstore_validation_blackbox::blackbox_range_read_restores_exact_slice_with_one_offline_disk"
-    },
-    {
-      "invariant": "multipart-abort-linearization",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::abort_and_complete_linearize_for_plain_sse_and_legacy_layouts"
-    },
-    {
-      "invariant": "multipart-write-quorum",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::abort_enforces_delete_write_quorum_boundary"
-    },
-    {
-      "invariant": "multipart-physical-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::complete_multipart_timeout_keeps_namespace_owner_until_physical_publication"
-    },
-    {
-      "invariant": "restore-abort-cleanup",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::transition_commit_failure_tests::multipart_restore_aborts_every_post_create_failure"
-    },
-    {
-      "invariant": "legacy-metadata",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::test_issue_2288_legacy_xlmeta_compatibility"
-    },
-    {
-      "invariant": "legacy-nil-version",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::test_into_fileinfo_reads_legacy_nil_uuid_inline_key"
-    },
-    {
-      "invariant": "commit-phase-schedule",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::commit_fault_schedule_keeps_multiple_disk_phases_independent"
-    },
-    {
-      "invariant": "commit-phase-ownership",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::commit_fault_schedule_rejects_duplicate_checkpoint_without_disarming_owner"
-    },
-    {
-      "invariant": "metadata-observation-all-four-slot-states-and-arrival-orders-preserve-reduction",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_all_four_slot_states_and_arrival_orders_preserve_reduction"
-    },
-    {
-      "invariant": "metadata-observation-mixed-current-identity-arrivals-preserve-selection",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_mixed_current_identity_arrivals_preserve_selection"
-    },
-    {
-      "invariant": "metadata-observation-pending-newer-version-and-same-time-different-directory-force-full-wait",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_pending_newer_version_and_same_time_different_directory_force_full_wait"
-    },
-    {
-      "invariant": "metadata-observation-duplicate-shard-cannot-supply-a-read-reserve",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_duplicate_shard_cannot_supply_a_read_reserve"
-    },
-    {
-      "invariant": "metadata-observation-null-versions-markers-and-invalid-success-keep-their-meaning",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_null_versions_markers_and_invalid_success_keep_their_meaning"
-    },
-    {
-      "invariant": "metadata-cache-real-get-and-range-preserve-body-across-read-modes",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::read::metadata_cache_tests::metadata_cache_real_get_and_range_preserve_body_across_read_modes"
-    },
-    {
-      "invariant": "late-metadata-refresh-rejects-changed-generation-and-mapped-shards",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::read::metadata_cache_tests::late_metadata_refresh_rejects_changed_generation_and_mapped_shards"
-    },
-    {
-      "invariant": "late-full-get-rejects-changed-object-generation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::prepared_get_object_metadata_tests::non_inline_two_phase_get_rejects_generation_change_before_late_refresh"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-static-namespace",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_static_namespace"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-cross-subdirectory-limit",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_cross_subdirectory_limit"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-max-and-max-plus-one",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_max_and_max_plus_one"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-fixed-seed-marker-and-prefix",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_fixed_seed_marker_and_prefix"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-offline-corrupt-and-minority-stale",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_offline_corrupt_and_minority_stale"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-versions-delete-markers-and-free-versions",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_versions_delete_markers_and_free_versions"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-orphan-cleanup-requires-authoritative-evidence",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_orphan_cleanup_requires_authoritative_evidence"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-consumer-drop-joins-real-disk-producer",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_consumer_drop_joins_real_disk_producer"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-cancelled-quorum-walk-releases-senders-and-disk-lock",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_cancelled_quorum_walk_releases_senders_and_disk_lock"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-enabled-index-contracts",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_enabled_index_contracts"
-    },
-    {
-      "invariant": "borrowed-context-boundary",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::borrowed_write_context_rejects_wrong_namespace_and_cache_flag"
-    },
-    {
-      "invariant": "borrowed-put-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::borrowed_tail_drained_put_keeps_owner_after_caller_cancel"
-    },
-    {
-      "invariant": "borrowed-mpu-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::borrowed_complete_keeps_namespace_owner_after_caller_cancel"
-    },
-    {
-      "invariant": "pool-cas-owner",
-      "suite": "rustfs-ecstore",
-      "name": "core::pools::pools_tests::pool_meta_cas_context_retains_actual_owner_for_exact_target"
-    },
-    {
-      "invariant": "pool-cas-released-owner",
-      "suite": "rustfs-ecstore",
-      "name": "core::pools::pools_tests::pool_meta_cas_rejects_released_owner"
-    },
-    {
-      "invariant": "copy-tail-drained",
-      "suite": "rustfs-ecstore",
-      "name": "store::object::tests::borrowed_copy_tail_drained_waits_for_rename_tail"
-    },
-    {
-      "invariant": "catalog-borrowed-publication",
-      "suite": "rustfs",
-      "name": "admin::handlers::table_catalog::tests::commit_backend_borrowed_put_preserves_owner_authorization_and_precondition"
-    },
-    {
-      "invariant": "directory-marker-quorum",
-      "suite": "rustfs-filemeta",
-      "name": "metacache::tests::resolve_directory_marker_and_prefix_preserve_quorum_in_both_orders"
-    },
-    {
-      "invariant": "logical-prefix-limit",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::test::list_path_gather_results_counts_common_prefixes_before_page_limit"
-    },
-    {
-      "invariant": "quota-same-name-owner-and-disk-authority",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_reuses_same_name_owner_and_rereads_disk_authority"
-    },
-    {
-      "invariant": "quota-snapshot-scope-and-owner",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_rejects_wrong_scope_incarnation_and_transaction_guard"
-    },
-    {
-      "invariant": "quota-snapshot-lifecycle-and-incarnation",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_rejects_lifecycle_loss_during_read_and_changed_disk_incarnation"
-    },
-    {
-      "invariant": "marker-purge-receipt-reopen",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::marker_purge_receipt_tests::quorum_marker_purge_receipt_survives_reopen_with_stale_member"
-    },
-    {
-      "invariant": "external-minio-shards",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_minio_shards_decode_and_reconstruct_plaintext"
-    },
-    {
-      "invariant": "external-legacy-shards",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_legacy_shards_decode_and_reconstruct_plaintext"
-    },
-    {
-      "invariant": "external-shard-bitrot",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_erasure_shards_reject_bitrot_corruption"
-    },
-    {
-      "invariant": "external-shard-quorum-codec",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_erasure_shards_reject_insufficient_quorum_and_wrong_codec"
     }
   ],
   "fixtures": [
@@ -357,36 +82,6 @@
       "path": "crates/ecstore/tests/fixtures/minio/bucket_metadata_full.xlmeta.hex",
       "sha256": "3b6de589519c08a1614c8bd409bb8199c17d42043861b07bce513075e6fbfc12",
       "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/issue_2288_legacy_xlmeta.hex",
-      "sha256": "b3e8d32f9950a38b5dc71f679519cc830a2b2a807e8b0b39f78840b238d8eacf",
-      "source": "Legacy xl.meta captured for rustfs/backlog#2288; filemeta::test::test_issue_2288_legacy_xlmeta_compatibility"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/issue_2265_legacy_meta_v2_object.hex",
-      "sha256": "89dd7ec92d16e54b5d31e0c49c9edffff8a7aa58890aaeff59bc2ff84da0a62f",
-      "source": "Legacy metadata v2 object captured for rustfs/backlog#2265; crates/filemeta/src/test_data.rs"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/list_namespace_keys.json",
-      "sha256": "5afddb60565deba0938e617470255563f0e15a15fab699645c59bb7ccc84898e",
-      "source": "Shared static LIST namespace corpus; ECStore differential tests and ODM list_through_static_namespace_boundary_matrix"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/minio/manifest.json",
-      "sha256": "c398f8dcb76903f6cf8eee07931c76592895ced201ff9d59ed4ff9b0ead2b13c",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/erasure-shards/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/legacy/manifest.json",
-      "sha256": "dce397d5b2f42748eb5091b4355bb9d133a50cbba003626fafac28095dbe540b",
-      "source": "RustFS 1.0.0-alpha.37; crates/ecstore/tests/fixtures/erasure-shards/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/plaintext.bin",
-      "sha256": "b5a83332327961a31b65a8731c64559fd04ff8ac9f6124022201dbbdba5ffa01",
-      "source": "Independent fixed SHA256 counter-stream oracle; crates/ecstore/tests/fixtures/erasure-shards/README.md"
     }
   ]
 }

.config/functional-script-revision.txt

@@ -1 +0,0 @@
-27e9584a2d776db9416d0edfd040d524d48b5d4d

.config/make/tests.mak

@@ -24,14 +24,11 @@ TEST_THREADS ?= 1
 .PHONY: script-tests
 script-tests: ## Run shell script tests
 	@echo "Running script tests..."
-	trap 'status=$$?; printf "ERROR: script-tests failed (exit %s): %s\n" "$$status" "$$BASH_COMMAND" >&2; exit "$$status"' ERR
 	./scripts/test_build_rustfs_options.sh
 	./scripts/test_docker_runtime_timezone.sh
-	sh ./scripts/test_ca_bundle.sh
 	./scripts/test_entrypoint_credentials.sh
 	./scripts/test_internode_grpc_ab_bench.sh
 	./scripts/test_object_batch_bench_enhanced.sh
-	./scripts/test_package_service_scripts.sh
 	./scripts/test_hotpath_warp_ab_gate.sh
 	./scripts/test_hotpath_warp_abba.sh
 	./scripts/test_scanner_validation_harness.sh
@@ -52,21 +49,12 @@ script-tests: ## Run shell script tests
 	./scripts/test_python_bin.sh
 	./scripts/check_embedded_secrets.sh --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_e2e_binary.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_build_workflow.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_glibc.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_upgrade_workflow.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_migration_gate_evidence.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/ci_gate.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_security_coverage.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_scheduled_validation_freshness.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_security_workflow.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_nightly_candidate.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_functional_chain.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_functional_chain_health.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_ci_timing_report.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_report_compat.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_runner_tools.py
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test

.config/nextest.toml

@@ -64,62 +64,18 @@ command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 
 # --- default profile (local): serialize the flaky groups, never retry --------
-# These real-disk progress oracles exercise fsync, quorum IO, and crash/replay
-# boundaries. Reserve the run's capacity so unrelated fixtures cannot starve
-# their existing deadlines and typed-failure assertions (rustfs/backlog#2706).
-# Keep each test's internal concurrency and zero-retry policy unchanged.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^connect::diagnostics::schedule::tests::/)'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^set_disk::tests::streaming_get_blocks_concurrent_/) | test(=store::object::tests::retired_marker_converges_after_bucket_recreation_on_sixteen_disks))'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-heal) & (binary(mrf_partial_write_test) | (binary(mrf_pipeline_test) & test(/^journal_replay_survives_/)) | test(=admin_selector_survives_sigkill_with_original_scope_and_receipts))'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_(writer|retirement)_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
-threads-required = "num-test-threads"
-
 [[profile.default.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
 
-# These cross-crate real-storage fixtures need the same bounded stack as ECStore tests.
-[[profile.default.scripts]]
-filter = '(package(rustfs) & test(/^(admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
-setup = 'ecstore-base-stack'
-
 [[profile.default.scripts]]
 filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
-# These handler/store fixtures and the relocated-pool GET compose deep storage
-# futures in libtest threads; on Linux they overflow the default 2 MiB stack.
-[[profile.default.scripts]]
-filter = 'package(rustfs) & (test(/^admin::handlers::table_catalog::tests::/) | test(/^table_catalog::store::tests::/) | test(=app::object::get::tests::execute_get_object_resumes_from_relocated_pool_without_splicing_body))'
-setup = 'ecstore-base-stack'
-
 [[profile.default.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
 
-# The pool metadata placement regression composes the full erasure-heal
-# startup future and overflows the default Linux test-thread stack.
-[[profile.default.scripts]]
-filter = 'package(rustfs-heal) & test(=replacement_pool_metadata_follows_real_two_set_placement)'
-setup = 'ecstore-large-stack'
-
-# These real-disk scanner fixtures assert quiet-workload publication and
-# durable MRF admission. Reserve the pool while their bounded CAS/fsync
-# handoffs run so unrelated disk fanouts cannot consume that fixture budget.
-[[profile.default.overrides]]
-filter = 'package(rustfs-scanner) & (test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(=scanner_io::tests::multi_pool_scanner_cycle_publishes_combined_usage) | test(=scanner_io::tests::pending_put_commit_keeps_scanner_walk_live_without_authoritative_usage) | test(=scanner_folder::tests::mrf_ownership::checkpoint_fixture_metadata_heal_reaches_budgeted_tail))'
-threads-required = "num-test-threads"
-
 [[profile.default.overrides]]
 filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes) | test(/^store::bucket::tests::bucket_delete_(mark_delete|purge_removes|default_s3_delete)/))'
 test-group = 'ecstore-serial-flaky'
@@ -145,16 +101,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::heal::heal_result_report_tests::/)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the replacement bucket metadata heal test. It builds a real-disk
-# hermetic erasure set, writes bucket metadata, then asserts byte-identical
-# xl.meta readback after a rejected delayed repair. Under parallel load,
-# concurrent ecstore tests mutate the process-wide disk registry and alter
-# the serialized timestamp/disk-identity fields, flipping the assertion.
-# Preventive serialization only, no retries.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(replacement_bucket_metadata_respects_pool_ownership_and_required_records)'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the metadata-cache generation-retirement pair. Both carry
 # #[serial(metadata_cache_invalidation_probe)] — a no-op across nextest's
 # process boundary — and assert get_object_metadata_cache generation
@@ -180,40 +126,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnostic_capability_e2e))'
 test-group = 'embedded-test-ports'
 
-# Registration, inventory delivery, and real drive/object probes include
-# filesystem or HTTP IO in short deadlines. Reserve capacity so sibling test
-# processes cannot exhaust those budgets. Keep deadlines and assertions intact.
-# The short HTTP fixtures are tracked in rustfs/backlog#2714.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_client) & test(=configured_proxy_and_direct_endpoint_failures_are_distinct)) | (binary(connect_perf_object) & test(/^(real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put|cleanup_uses_a_budget_independent_of_the_measurement_window|oversized_response_is_rejected_without_buffering_it)$/)))'
-threads-required = "num-test-threads"
-
-# This cancellation probe hashes the serving executable before acquiring its
-# collector lease. Keep competing test processes out of its 30s startup budget.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(=connect::diagnostics::trace_runtime::tests::local_runtime_profile_cancellation_waits_for_lease_release)'
-threads-required = "num-test-threads"
-
-# These real IAM/state fixtures keep production lock-acquisition limits while
-# peers complete durable IO. Reserve capacity from unrelated test processes;
-# the shared fixture's durable_iam_state_ prefix keeps the whole family together.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::site_replication::tests::durable_iam_state_/)'
-threads-required = "num-test-threads"
-
-# Real target-repair and rebalance-stop fixtures commit durable metadata while
-# peers wait on production locks or bounded cancellation checks. Reserve IO
-# capacity for each fixture; its internal races and deadlines remain intact.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::(replication::target_repair_tests::|rebalance::rebalance_handler_tests::real_admin_stop_)/)'
-threads-required = "num-test-threads"
-
-# Reserve capacity for these short heartbeat TLS/fsync probes (rustfs#8129).
-# Their existing deadlines, assertions, and retry policy remain in force.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & binary(connect_heartbeat) & test(/^(restart_replays_pending_request_then_advances_sequence|restart_replays_exact_legacy_capabilities_with_and_without_jobs)$/)'
-threads-required = "num-test-threads"
-
 # Serialize the durable manual-transition checkpoint test across nextest's
 # process boundary; it mutates bucket lifecycle metadata and is not quarantined.
 [[profile.default.overrides]]
@@ -240,18 +152,9 @@ test-group = 'ecstore-serial-flaky'
 # deterministic commit barriers. Keep the whole init decommission family in one
 # nextest group; serial_test alone cannot isolate separate test processes.
 [[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_.*|suspended_.*decommission.*)$/)'
+filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_|suspended_.*decommission)$/)'
 test-group = 'ecstore-serial-flaky'
 
-# The tier overwrite cleanup-owner matrix restarts a real 4-disk store and
-# drives free-version recovery through lifecycle expiry workers. Reserve the
-# full test budget so competing real-store fixtures cannot starve the walk's
-# filesystem progress deadlines. Keep the production deadlines and no retries.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(tier_overwrite_put_and_self_copy_recover_persisted_cleanup_owners)'
-test-group = 'ecstore-serial-flaky'
-threads-required = "num-test-threads"
-
 # Serialize the bucket-incarnation / lifecycle-fence tests. They drive
 # init_bucket_metadata_sys and bucket_metadata_sys_of, i.e. process-global
 # OnceLock state that serial_test's #[serial] cannot protect across nextest's
@@ -294,13 +197,6 @@ test-group = 'e2e-cluster-nightly'
 filter = 'package(e2e_test) & (test(/^kms::kms_vault_test::/) | test(/^kms::kms_rekey_sweep_test::/) | test(/^kms::configured_roundtrip_test::test_configured_vault_kms_admin_and_versioned_cleanup$/))'
 test-group = 'e2e-vault'
 
-# These server-heavy smoke cases perform 1k+ sequential S3 writes or run the
-# scanner and a remote tier server together. Reserve the full test budget so
-# unrelated E2E processes cannot starve their storage and polling deadlines.
-[[profile.default.overrides]]
-filter = 'package(e2e_test) & (test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/) | test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry))'
-threads-required = "num-test-threads"
-
 # This four-disk, 65-member rollback probe already drives up to 32 concurrent
 # durable deletions. Reserve this nextest run's capacity for its progress oracle.
 [[profile.default.overrides]]
@@ -322,58 +218,18 @@ fail-fast = false
 # marker is the observable signal the flake policy is built around.
 path = "junit.xml"
 
-# Match the local durable-progress reservations. All members, deadlines,
-# assertions, and internal concurrency remain enabled without retries.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^connect::diagnostics::schedule::tests::/)'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^set_disk::tests::streaming_get_blocks_concurrent_/) | test(=store::object::tests::retired_marker_converges_after_bucket_recreation_on_sixteen_disks))'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-heal) & (binary(mrf_partial_write_test) | (binary(mrf_pipeline_test) & test(/^journal_replay_survives_/)) | test(=admin_selector_survives_sigkill_with_original_scope_and_receipts))'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_(writer|retirement)_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
-threads-required = "num-test-threads"
-
 [[profile.ci.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
 
-# These cross-crate real-storage fixtures need the same bounded stack as ECStore tests.
-[[profile.ci.scripts]]
-filter = '(package(rustfs) & test(/^(admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
-setup = 'ecstore-base-stack'
-
 [[profile.ci.scripts]]
 filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
-[[profile.ci.scripts]]
-filter = 'package(rustfs) & (test(/^admin::handlers::table_catalog::tests::/) | test(/^table_catalog::store::tests::/) | test(=app::object::get::tests::execute_get_object_resumes_from_relocated_pool_without_splicing_body))'
-setup = 'ecstore-base-stack'
-
 [[profile.ci.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
 
-# The pool metadata placement regression composes the full erasure-heal
-# startup future and overflows the default Linux test-thread stack.
-[[profile.ci.scripts]]
-filter = 'package(rustfs-heal) & test(=replacement_pool_metadata_follows_real_two_set_placement)'
-setup = 'ecstore-large-stack'
-
-# These real-disk scanner fixtures assert quiet-workload publication and
-# durable MRF admission. Reserve the pool while their bounded CAS/fsync
-# handoffs run so unrelated disk fanouts cannot consume that fixture budget.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-scanner) & (test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(=scanner_io::tests::multi_pool_scanner_cycle_publishes_combined_usage) | test(=scanner_io::tests::pending_put_commit_keeps_scanner_walk_live_without_authoritative_usage) | test(=scanner_folder::tests::mrf_ownership::checkpoint_fixture_metadata_heal_reaches_budgeted_tail))'
-threads-required = "num-test-threads"
-
 # ===========================================================================
 # QUARANTINE — flaky tests granted retries = 2 under the ci profile ONLY.
 #
@@ -399,6 +255,13 @@ retries = 2
 filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes))'
 test-group = 'ecstore-serial-flaky'
 
+# QUARANTINE: OPEN rustfs#4690 — walk_dir stall-budget accounting test depends
+# on producer/consumer timing windows that stretch past the budget on loaded
+# CI runners (regression test for rustfs#4644; failed on a zero-Rust-diff PR).
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & test(walk_dir_does_not_charge_consumer_backpressure_to_the_stall_budget)'
+retries = 2
+
 # Serialize the relocated-pool GET resume regression under the ci profile too
 # (see the matching default-profile override near the top). No longer a
 # quarantine: the fixture race (rustfs#6701/rustfs#6703) was fixed by #6707,
@@ -430,11 +293,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::heal::heal_result_report_tests::/)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the replacement bucket metadata heal test under the ci profile too.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(replacement_bucket_metadata_respects_pool_ownership_and_required_records)'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the metadata-cache generation-retirement pair under the ci
 # profile too (see the matching default-profile override near the top). Not a
 # quarantine: no retries.
@@ -448,33 +306,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnostic_capability_e2e))'
 test-group = 'embedded-test-ports'
 
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_client) & test(=configured_proxy_and_direct_endpoint_failures_are_distinct)) | (binary(connect_perf_object) & test(/^(real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put|cleanup_uses_a_budget_independent_of_the_measurement_window|oversized_response_is_rejected_without_buffering_it)$/)))'
-threads-required = "num-test-threads"
-
-# Preserve the cancellation probe's startup budget and assertions in CI too.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(=connect::diagnostics::trace_runtime::tests::local_runtime_profile_cancellation_waits_for_lease_release)'
-threads-required = "num-test-threads"
-
-# Keep the same IAM/state fixture capacity reservation in CI without changing the
-# production lock deadline, internal concurrency, assertions, or retry policy.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::site_replication::tests::durable_iam_state_/)'
-threads-required = "num-test-threads"
-
-# Match the real admin fixture capacity reservation without retries or changes
-# to production lock deadlines, cancellation barriers, or assertions.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::(replication::target_repair_tests::|rebalance::rebalance_handler_tests::real_admin_stop_)/)'
-threads-required = "num-test-threads"
-
-# Reserve capacity for these short heartbeat TLS/fsync probes (rustfs#8129).
-# Their existing deadlines, assertions, and retry policy remain in force.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & binary(connect_heartbeat) & test(/^(restart_replays_pending_request_then_advances_sequence|restart_replays_exact_legacy_capabilities_with_and_without_jobs)$/)'
-threads-required = "num-test-threads"
-
 # Serialize the durable manual-transition checkpoint test under the ci profile
 # too. No retries: failures stay visible.
 [[profile.ci.overrides]]
@@ -492,14 +323,9 @@ filter = 'package(rustfs-ecstore) & (test(decommission_migrates_and_verifies_reg
 test-group = 'ecstore-serial-flaky'
 
 [[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_.*|suspended_.*decommission.*)$/)'
+filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_|suspended_.*decommission)$/)'
 test-group = 'ecstore-serial-flaky'
 
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(tier_overwrite_put_and_self_copy_recover_persisted_cleanup_owners)'
-test-group = 'ecstore-serial-flaky'
-threads-required = "num-test-threads"
-
 # Serialize the bucket-incarnation / lifecycle-fence tests under the ci profile
 # too (see the matching default-profile override near the top). No retries.
 [[profile.ci.overrides]]
@@ -606,7 +432,6 @@ default-filter = """
         | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
         | test(/^reliant::lifecycle::/)
         | test(/^reliant::tiering::/)
-        | test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
         | test(/^on_demand_migration::(get_basic_test::(get_miss_pulls_inline_and_serves_locally_afterwards|head_miss_answers_from_the_source_without_persisting)|interaction_test::test_odm_admin_config_is_redacted_and_status_counts_match_the_source)$/)
     )
 """
@@ -615,16 +440,13 @@ fail-fast = false
 [profile.e2e-smoke.junit]
 path = "junit.xml"
 
-# Bound the whole pagination fixture, including startup, seeding, and cleanup;
-# its LIST deadline begins only after the seed objects have been written.
+# The pagination boundary cases can stall when a server/listing regression
+# prevents the continuation request from completing. Keep the timeout scoped
+# to those known failure modes so legitimate lifecycle/tiering waits retain
+# their test-level timing budget.
 [[profile.e2e-smoke.overrides]]
 filter = 'package(e2e_test) & test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/)'
 slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
-threads-required = "num-test-threads"
-
-[[profile.e2e-smoke.overrides]]
-filter = 'package(e2e_test) & test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry)'
-threads-required = "num-test-threads"
 
 # ---------------------------------------------------------------------------
 # e2e-repl-nightly profile — scheduled full replication e2e lane (repl-1)
@@ -823,8 +645,8 @@ path = "junit.xml"
 # Each e2e test spawns its own single-node rustfs server on a random port with
 # an isolated temp dir (crates/e2e_test/src/common.rs), so the set is
 # parallel-safe — the same property e2e-smoke relies on. The exceptions are the
-# 4-disk reliability / degraded-read fault-injection tests, multi-node heal
-# clusters, and the fixed-port Vault tests, all serialized below.
+# 4-disk reliability / degraded-read fault-injection tests and the fixed-port
+# Vault tests, both serialized below.
 [profile.e2e-full]
 default-filter = """
     package(e2e_test)
@@ -834,7 +656,6 @@ default-filter = """
     & !test(/^replication_extension_test::/)
     & !test(/^replication_target_matrix_test::/)
     & !test(/^on_demand_migration::(concurrency_test|fault_test|interop_test|real_source_test)::/)
-    & !test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
 """
 fail-fast = false
 
@@ -854,18 +675,6 @@ test-group = 'e2e-reliability'
 filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
 test-group = 'e2e-inline-boundaries'
 
-# Heal interruption cases start whole multi-node clusters. Bound their overlap
-# just as the nightly lane does, without changing membership or retry policy.
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & test(/^heal_erasure_disk_rebuild_test::/)'
-test-group = 'e2e-cluster-nightly'
-
 [[profile.e2e-full.overrides]]
 filter = 'package(e2e_test) & (test(/^kms::kms_vault_test::/) | test(/^kms::kms_rekey_sweep_test::/) | test(/^kms::configured_roundtrip_test::test_configured_vault_kms_admin_and_versioned_cleanup$/))'
 test-group = 'e2e-vault'
-
-# Keep the storage-heavy smoke cases isolated in the full suite too. They
-# start multiple server fixtures and issue many sequential S3 operations.
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & (test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/) | test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry))'
-threads-required = "num-test-threads"

.config/security-smoke-floor.txt

@@ -9,4 +9,4 @@
 # if the selected count drops below this number, so a rename or removal that
 # thins the security smoke gate must update this file in the same PR.
 # Adding tests does not require a bump, but bumping keeps the guard tight.
-28
+26

.docker/observability/grafana/dashboards/rustfs.json

@@ -1748,7 +1748,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id=\"$storage_cluster\", job=~\"$job\", bucket=~\"$bucket\"})",
+          "expr": "max by (job, bucket) (rustfs_cluster_usage_buckets_objects_count{job=~\"$job\", bucket=~\"$bucket\"})",
           "legendFormat": "{{bucket}}",
           "range": true,
           "refId": "A"
@@ -1848,7 +1848,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id=\"$storage_cluster\", job=~\"$job\", bucket=~\"$bucket\"})",
+          "expr": "max by (job, bucket) (rustfs_cluster_usage_buckets_total_bytes{job=~\"$job\", bucket=~\"$bucket\"})",
           "legendFormat": "{{bucket}}",
           "range": true,
           "refId": "A"

.docker/observability/prometheus.yml

@@ -61,7 +61,6 @@ scrape_configs:
 otlp:
   promote_resource_attributes:
     - service.instance.id
-    - process.pid
     - service.name
     - service.namespace
     - cloud.availability_zone

.docker/observability/tests/bucket-usage.test.yml

@@ -1,48 +0,0 @@
-evaluation_interval: 1m
-tests:
-- name: bucket usage keeps clusters separate and deduplicates reporting nodes
-  interval: 1m
-  input_series:
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a1"}
-    values: '4096 1024'
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a2"}
-    values: '4096 1024'
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="b",job="rustfs",bucket="shared",service_instance_id="b1"}
-    values: '65536 65536'
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job="rustfs",bucket="empty",service_instance_id="a1"}
-    values: '0 0'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a1"}
-    values: '3 1'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a2"}
-    values: '3 1'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="b",job="rustfs",bucket="shared",service_instance_id="b1"}
-    values: '70 70'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job="rustfs",bucket="empty",service_instance_id="a1"}
-    values: '0 0'
-  promql_expr_test:
-  - expr: max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job=~"rustfs",bucket=~".*"})
-    eval_time: 1m
-    exp_samples:
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="shared"}'
-      value: 1024
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="empty"}'
-      value: 0
-  - expr: max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job=~"rustfs",bucket=~".*"})
-    eval_time: 1m
-    exp_samples:
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="shared"}'
-      value: 1
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="empty"}'
-      value: 0
-  - expr: max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_total_bytes)
-    eval_time: 1m
-    exp_samples:
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="shared"}'
-      value: 1024
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="empty"}'
-      value: 0
-    - labels: '{rustfs_cluster_id="b",job="rustfs",bucket="shared"}'
-      value: 65536
-  - expr: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",bucket="unknown"}
-    eval_time: 1m
-    exp_samples: []

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,110 +0,0 @@
-name: Bug report
-description: Create a report to help us improve
-body:
-  - type: markdown
-    attributes:
-      value: |
-        ### Storage support requirements
-        **Supported:** local disks, SAN (Fibre Channel) attached volumes, or JBOD-mounted disks. We recommend formatting them with the **XFS** file system.
-
-        **Not supported:** NFS, SMB/Samba/CIFS, and other remote or shared filesystems as RustFS data directories. This also applies to the underlying host storage for Docker volumes and Kubernetes PersistentVolumes.
-
-        Reports that only reproduce on unsupported storage will be closed without investigation. Please reproduce the issue on supported storage before submitting a bug report.
-
-        See [Disk Planning and File System Selection](https://docs.rustfs.com/en/installation/linux/prerequisites-and-service) for details.
-  - type: checkboxes
-    id: storage-support
-    attributes:
-      label: Supported storage confirmation
-      options:
-        - label: I have reproduced this issue with all RustFS data directories on supported storage (local disks, SAN/Fibre Channel, or JBOD; XFS recommended), without NFS, SMB/Samba/CIFS, or other remote or shared filesystem mounts, including storage backing Docker volumes and Kubernetes PersistentVolumes.
-          required: true
-  - type: textarea
-    id: bug-description
-    attributes:
-      label: Describe the bug
-      description: A clear and concise description of what happened.
-    validations:
-      required: true
-  - type: textarea
-    id: reproduction-steps
-    attributes:
-      label: Steps to reproduce
-      description: Include the commands, configuration, or actions needed to reproduce the problem.
-      placeholder: |
-        1. Start RustFS with ...
-        2. Run ...
-        3. Observe ...
-    validations:
-      required: true
-  - type: textarea
-    id: expected-behavior
-    attributes:
-      label: Expected behavior
-      description: A clear and concise description of what you expected to happen.
-    validations:
-      required: true
-  - type: input
-    id: rustfs-version
-    attributes:
-      label: RustFS version
-      description: Provide the release version, container image tag, or commit hash.
-    validations:
-      required: true
-  - type: dropdown
-    id: deployment-method
-    attributes:
-      label: Deployment method
-      description: How are you running RustFS? Add any relevant details in Additional context.
-      options:
-        - Binary
-        - Docker / Docker Compose
-        - Kubernetes / Helm
-        - Built from source
-        - Other
-  - type: textarea
-    id: storage-mounts
-    attributes:
-      label: Data directory filesystems and mounts
-      description: |
-        Identify the filesystem type and mount source for every RustFS data directory.
-        On Linux, include output from `findmnt -T /path/to/data -o TARGET,SOURCE,FSTYPE,OPTIONS` for each data path; on other systems, provide equivalent mount information.
-        For Docker, identify the backing host path and filesystem, not just the container path or volume name.
-        For Kubernetes, identify the PV, StorageClass/CSI driver, and actual backing filesystem; a PVC name alone is not sufficient.
-        Remove credentials and other sensitive information before submitting.
-      placeholder: |
-        RustFS data paths:
-        Filesystem types and mount sources:
-        Mount command output:
-        Docker host paths or Kubernetes volume backing storage (if applicable):
-    validations:
-      required: true
-  - type: input
-    id: operating-system
-    attributes:
-      label: Server operating system and architecture
-      description: Include the operating system version and CPU architecture where RustFS is running.
-      placeholder: "For example: Ubuntu 24.04, x86_64"
-    validations:
-      required: true
-  - type: textarea
-    id: client-environment
-    attributes:
-      label: Client environment
-      description: Include the S3 client or SDK and version. For console issues, include the browser, operating system, and desktop or mobile device details.
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant logs
-      description: Paste relevant log output. Remove credentials and other sensitive information before submitting.
-      render: shell
-  - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: If applicable, drag and drop screenshots here to help explain the problem.
-  - type: textarea
-    id: additional-context
-    attributes:
-      label: Additional context
-      description: Add any other context, such as deployment topology or relevant configuration. Remove credentials and other sensitive information before submitting.

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +0,0 @@
-blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,38 +0,0 @@
-name: Feature request
-description: Suggest an idea for this project
-body:
-  - type: checkboxes
-    id: request-scope
-    attributes:
-      label: Request scope
-      description: |
-        RustFS data directories backed by NFS, SMB/Samba/CIFS, or other remote or shared filesystems are unsupported, including those behind Docker volumes or Kubernetes PersistentVolumes.
-        Troubleshooting requests for these deployments will be closed without investigation. Use this form for new or improved functionality.
-      options:
-        - label: This is a feature request and does not ask for troubleshooting an unsupported remote or shared filesystem deployment.
-          required: true
-  - type: textarea
-    id: problem-description
-    attributes:
-      label: Problem or use case
-      description: Describe the problem or use case that motivates this feature request.
-      placeholder: "For example: I am trying to ... but ..."
-    validations:
-      required: true
-  - type: textarea
-    id: proposed-solution
-    attributes:
-      label: Proposed solution
-      description: A clear and concise description of what you would like to happen.
-    validations:
-      required: true
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives considered
-      description: Describe any alternative solutions or features you have considered.
-  - type: textarea
-    id: additional-context
-    attributes:
-      label: Additional context
-      description: Add any other context or drag and drop screenshots about the feature request here.

.github/actions/quick-checks/action.yml

@@ -19,7 +19,7 @@ runs:
   using: composite
   steps:
     - name: Install quality tools
-      uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2
+      uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
       with:
         tool: |
           ripgrep@15.2.0
@@ -98,13 +98,14 @@ runs:
       shell: bash
       run: make script-tests
 
-    - name: Check object generation protocol model
-      shell: bash
-      run: python3 ./scripts/test_object_generation_protocol_model.py
-
     - name: Check test wiring
       shell: bash
-      run: python3 ./scripts/check_test_wiring.py
+      run: |
+        python3 ./scripts/check_test_wiring.py --self-test
+        python3 ./scripts/check_scheduled_validation_freshness.py --self-test
+        python3 ./scripts/test_security_workflow.py
+        python3 ./scripts/test_nightly_candidate.py
+        python3 ./scripts/check_test_wiring.py
 
     - name: Check no planning docs committed
       shell: bash

.github/actions/schedule-failure-issue/README.md

@@ -5,38 +5,20 @@ This is the single alerting mechanism for all timed pipelines
 (rustfs/backlog#1149 ci-8, arbitration G3): scheduled workflows must consume
 this action instead of inventing their own notification paths.
 
-Issues are filed in **rustfs/backlog** (override with `target-repository`),
-not the repository the workflow runs in, so scheduled-failure noise stays
-out of the code repository's issue tracker.
-
 ## Behavior
 
 - Issue title: `[scheduled-failure] <workflow name>` — the workflow name is
   the dedupe key.
-- If an **open** issue with that exact title exists in the target
-  repository, the failure is appended as a comment; otherwise a new issue is
-  created (labeled `infrastructure` by default; the label must exist in the
-  target repository). Closing the issue resets the cycle: the next failure
-  opens a fresh one.
-- The issue body / comment includes the source repository, run URL, run
-  attempt, event, ref and the names of the failed (or timed-out/cancelled)
-  jobs of the current run attempt.
+- If an **open** issue with that exact title exists, the failure is appended
+  as a comment; otherwise a new issue is created (labeled `infrastructure` by
+  default). Closing the issue resets the cycle: the next failure opens a
+  fresh one.
+- The issue body / comment includes the run URL, run attempt, event, ref and
+  the names of the failed (or timed-out/cancelled) jobs of the current run
+  attempt.
 - Requires `gh` and `jq` on the runner (both preinstalled on GitHub-hosted
   runners such as `ubuntu-latest`).
 
-## Tokens
-
-Two tokens are involved:
-
-- `github-token` authenticates issue create/comment/search against the
-  target repository. The workflow-scoped `secrets.GITHUB_TOKEN` is scoped to
-  the code repository and **cannot** open issues in rustfs/backlog, so this
-  must be a PAT or GitHub App token with `issues: write` on the target
-  repository, stored as the `BACKLOG_ISSUE_TOKEN` repository secret.
-- `source-token` (defaults to `${{ github.token }}`) reads the failed-job
-  list from the reported run, which lives in the repository running the
-  workflow.
-
 ## Usage
 
 Add a final job to the workflow. `always()` is required — without it the job
@@ -59,7 +41,7 @@ this job only; no other job may gain permissions.
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
 Notes:

.github/actions/schedule-failure-issue/action.yml

@@ -16,31 +16,18 @@ name: "Schedule Failure Issue"
 description: >-
   Open (or update) a tracking issue when a scheduled workflow run fails or
   does not complete normally.
-  Issues are filed in the target repository (default rustfs/backlog), not
-  the repository the workflow runs in.
   Dedupes by workflow name: if an open issue titled
-  "[scheduled-failure] <workflow name>" already exists there, the result is
+  "[scheduled-failure] <workflow name>" already exists, the result is
   appended as a comment; otherwise a new issue is created. This is the
   single alerting mechanism for all scheduled pipelines (backlog#1149 ci-8).
 
 inputs:
   github-token:
     description: >-
-      Token with issues:write on the target repository. The workflow-scoped
-      secrets.GITHUB_TOKEN is scoped to the code repository and cannot open
-      issues in rustfs/backlog, so pass a PAT / GitHub App token stored as a
-      repository secret (BACKLOG_ISSUE_TOKEN).
+      Token with issues:write on the repository. Pass secrets.GITHUB_TOKEN
+      from a job that declares `permissions: issues: write` (scope the
+      permission to the alert job only, never workflow-wide).
     required: true
-  target-repository:
-    description: "Repository the failure-tracking issue is filed in."
-    required: false
-    default: rustfs/backlog
-  source-token:
-    description: >-
-      Token used to read the failed-job list from the reported run. Defaults
-      to the workflow's own token, which can read runs of its own repository.
-    required: false
-    default: ${{ github.token }}
   workflow-name:
     description: "Workflow name used for the issue title (the dedupe key)."
     required: false
@@ -48,8 +35,8 @@ inputs:
   label:
     description: >-
       Label applied when a new issue is created. Must already exist in the
-      target repository; if applying it fails, the issue is created without a
-      label. Set to an empty string to skip labeling.
+      repository; if applying it fails, the issue is created without a label.
+      Set to an empty string to skip labeling.
     required: false
     default: "infrastructure"
   source-run-id:
@@ -84,8 +71,6 @@ runs:
       shell: bash
       env:
         GH_TOKEN: ${{ inputs.github-token }}
-        SOURCE_TOKEN: ${{ inputs.source-token }}
-        TARGET_REPOSITORY: ${{ inputs.target-repository }}
         WORKFLOW_NAME: ${{ inputs.workflow-name }}
         ISSUE_LABEL: ${{ inputs.label }}
         SOURCE_RUN_ID: ${{ inputs.source-run-id }}
@@ -101,10 +86,8 @@ runs:
         run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${SOURCE_RUN_ID}"
 
         # Inspect the reported run attempt. It can be the current in-workflow
-        # failure or a completed run observed by the external watchdog. The
-        # run lives in the repository running the workflow, so authenticate
-        # with the source token, not the target-repository token.
-        failed_jobs="$(GH_TOKEN="${SOURCE_TOKEN}" gh api \
+        # failure or a completed run observed by the external watchdog.
+        failed_jobs="$(gh api \
           "repos/${GITHUB_REPOSITORY}/actions/runs/${SOURCE_RUN_ID}/attempts/${SOURCE_RUN_ATTEMPT}/jobs" \
           --paginate \
           --jq '.jobs[]
@@ -126,7 +109,6 @@ runs:
         body="$(cat <<EOF
         Run of **${WORKFLOW_NAME}** did not complete successfully.
 
-        - Repository: ${GITHUB_REPOSITORY}
         - Run: ${run_url} (attempt ${SOURCE_RUN_ATTEMPT})
         - Event: \`${SOURCE_EVENT}\`
         - Ref: \`${SOURCE_REF_NAME}\` @ \`${SOURCE_SHA}\`
@@ -138,26 +120,26 @@ runs:
         EOF
         )"
 
-        # Dedupe by exact title among OPEN issues in the target repository (a
-        # closed issue means the earlier breakage was resolved; a new failure
-        # gets a fresh issue). GitHub search strips the [] characters, so
-        # search loosely and match the exact title with jq.
-        existing="$(gh issue list --repo "${TARGET_REPOSITORY}" --state open --limit 100 \
+        # Dedupe by exact title among OPEN issues (a closed issue means the
+        # earlier breakage was resolved; a new failure gets a fresh issue).
+        # GitHub search strips the [] characters, so search loosely and match
+        # the exact title with jq.
+        existing="$(gh issue list --repo "${GITHUB_REPOSITORY}" --state open --limit 100 \
           --search "\"scheduled-failure\" in:title" --json number,title \
           | jq -r --arg title "${title}" 'map(select(.title == $title)) | (.[0].number // empty)')"
 
         if [ -n "${existing}" ]; then
-          echo "Appending comment to existing open issue rustfs/backlog#${existing}"
-          gh issue comment "${existing}" --repo "${TARGET_REPOSITORY}" --body "${body}"
+          echo "Appending comment to existing open issue #${existing}"
+          gh issue comment "${existing}" --repo "${GITHUB_REPOSITORY}" --body "${body}"
           exit 0
         fi
 
-        echo "Creating new issue in ${TARGET_REPOSITORY}: ${title}"
+        echo "Creating new issue: ${title}"
         if [ -n "${ISSUE_LABEL}" ]; then
-          if gh issue create --repo "${TARGET_REPOSITORY}" \
+          if gh issue create --repo "${GITHUB_REPOSITORY}" \
                --title "${title}" --body "${body}" --label "${ISSUE_LABEL}"; then
             exit 0
           fi
           echo "::warning::issue creation with label '${ISSUE_LABEL}' failed (missing label?); retrying without a label"
         fi
-        gh issue create --repo "${TARGET_REPOSITORY}" --title "${title}" --body "${body}"
+        gh issue create --repo "${GITHUB_REPOSITORY}" --title "${title}" --body "${body}"

.github/actions/setup-docker-compose/action.yml

@@ -1,39 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Set up Docker Compose
-description: Install the verified Compose CLI used by native Linux x86_64 Connect acceptance
-
-runs:
-  using: composite
-  steps:
-    - name: Install verified Docker Compose CLI plugin
-      shell: bash
-      run: |
-        set -euo pipefail
-        [[ $(uname -s) == Linux && $(uname -m) == x86_64 ]]
-        plugin_dir="${DOCKER_CONFIG:-$HOME/.docker}/cli-plugins"
-        mkdir -p "$plugin_dir"
-        compose_download=$(mktemp "${RUNNER_TEMP:?}/connect-compose.XXXXXX")
-        compose_staged=$(mktemp "$plugin_dir/.docker-compose.XXXXXX")
-        trap 'rm -f "$compose_download" "$compose_staged"' EXIT
-        curl --fail --location --retry 3 \
-          https://github.com/docker/compose/releases/download/v2.40.3/docker-compose-linux-x86_64 \
-          --output "$compose_download"
-        printf '%s  %s\n' \
-          dba9d98e1ba5bfe11d88c99b9bd32fc4a0624a30fafe68eea34d61a3e42fd372 \
-          "$compose_download" | sha256sum --check --strict
-        install -m 0755 "$compose_download" "$compose_staged"
-        mv -f "$compose_staged" "$plugin_dir/docker-compose"
-        [[ $(docker compose version --short) == 2.40.3 ]]

.github/actions/setup/action.yml

@@ -36,16 +36,6 @@ inputs:
     description: "Install cross-compilation tools"
     required: false
     default: "false"
-  zig-version:
-    description: >-
-      Zig version for cargo-zigbuild builds. Pinned so the `<target>.<glibc>`
-      baseline semantics cannot drift with an untested zig release.
-    required: false
-    default: "0.17.0"
-  cargo-zigbuild-version:
-    description: "cargo-zigbuild version installed for cross builds."
-    required: false
-    default: "0.23.4"
   target:
     description: "Target architecture to add"
     required: false
@@ -109,23 +99,17 @@ runs:
     - name: Install Zig
       if: inputs.install-cross-tools == 'true'
       uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
-      with:
-        version: ${{ inputs.zig-version }}
 
     - name: Install cargo-zigbuild
       if: inputs.install-cross-tools == 'true'
       uses: taiki-e/install-action@a21ae4029b089b9ddc45704028756f51ab8abe48 # cargo-zigbuild
-      with:
-        tool: cargo-zigbuild@${{ inputs.cargo-zigbuild-version }}
 
     - name: Install cargo-nextest
       if: inputs.install-test-tools == 'true'
       uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest
-      with:
-        tool: cargo-nextest@0.9.138
 
     - name: Setup Rust cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       with:
         # false is rust-cache's own default. With true, cleanup.ts returns
         # *before* pruning ~/.cargo/registry/src, and config.ts archives the
@@ -140,5 +124,5 @@ runs:
         # normalises, so cargo fingerprints stay valid.
         cache-all-crates: false
         cache-on-failure: true
-        shared-key: ${{ inputs.cache-shared-key }}${{ inputs.install-cross-tools == 'true' && format('-zig-{0}-zigbuild-{1}', inputs.zig-version, inputs.cargo-zigbuild-version) || '' }}
+        shared-key: ${{ inputs.cache-shared-key }}
         save-if: ${{ inputs.cache-save-if }}

.github/workflows/architecture-migration-rules.yml

@@ -0,0 +1,61 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Architecture Migration Rules
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened, closed ]
+    branches: [ main ]
+    paths:
+      - "ARCHITECTURE.md"
+      - "docs/architecture/**"
+      - "scripts/check_architecture_migration_rules.sh"
+      - ".github/workflows/architecture-migration-rules.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cancel-closed-pr-runs:
+    name: Cancel Closed PR Runs
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Explain cancellation run
+        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
+
+  architecture-migration-rules:
+    name: Architecture Migration Rules
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install ripgrep
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0
+
+      - name: Check architecture migration rules
+        run: ./scripts/check_architecture_migration_rules.sh

.github/workflows/audit.yml

@@ -24,11 +24,8 @@ on:
       - '.github/actions/**'
       - '.github/workflows/**'
       - 'scripts/release/create_or_update_release.sh'
-      - 'scripts/release/package_service_scripts.sh'
       - 'scripts/release/package_versions.sh'
-      - 'scripts/test_package_service_scripts.sh'
       - 'scripts/test_package_versions.sh'
-      - 'scripts/test_docker_workflow.py'
       - 'scripts/security/check_performance_ab_workflow.sh'
       - 'scripts/security/check_preview_release_workflow.sh'
       - 'scripts/security/check_tier_artifact_workflow.sh'
@@ -43,11 +40,8 @@ on:
       - '.github/actions/**'
       - '.github/workflows/**'
       - 'scripts/release/create_or_update_release.sh'
-      - 'scripts/release/package_service_scripts.sh'
       - 'scripts/release/package_versions.sh'
-      - 'scripts/test_package_service_scripts.sh'
       - 'scripts/test_package_versions.sh'
-      - 'scripts/test_docker_workflow.py'
       - 'scripts/security/check_performance_ab_workflow.sh'
       - 'scripts/security/check_preview_release_workflow.sh'
       - 'scripts/security/check_tier_artifact_workflow.sh'
@@ -77,7 +71,7 @@ jobs:
   cancel-closed-pr-runs:
     name: Cancel Closed PR Runs
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Explain cancellation run
@@ -88,12 +82,12 @@ jobs:
   # database lookup with a second ignore list to maintain.
   cargo-deny:
     name: Cargo Deny
-    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
-    runs-on: sm-standard-2
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -112,7 +106,7 @@ jobs:
       # default is now "false", but state it explicitly — see
       # scripts/security/check_cache_save_if.sh.
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           # Same reasoning as the setup composite: true archives every
           # dependency's unpacked source tree.
@@ -122,7 +116,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
         with:
           tool: cargo-deny
 
@@ -131,12 +125,12 @@ jobs:
 
   workflow-pin-report:
     name: Workflow Pin Report
-    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
-    runs-on: sm-standard-2
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -164,12 +158,9 @@ jobs:
       - name: Check package version contract
         run: ./scripts/test_package_versions.sh
 
-      - name: Check package service lifecycle contract
-        run: ./scripts/test_package_service_scripts.sh
-
   dependency-review:
     name: Dependency Review
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     permissions:
@@ -177,7 +168,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -203,17 +194,17 @@ jobs:
     # workflow produces, and until now it was only visible to whoever happened to
     # open the Actions tab. Same ci-8 mechanism coverage.yml and
     # e2e-replication-nightly.yml already use.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build.yml

@@ -27,8 +27,7 @@
 #   schedule and manual dispatch build the full platform matrix.
 #
 # Manual Parameters:
-# - publish: Publish binaries/releases for manual runs (default: false)
-# - build_docker: Advisory only; manual runs do not trigger Docker publishing
+# - build_docker: Build and push Docker images (default: true)
 # - platforms: Comma-separated platform IDs or 'all' (default: all)
 
 name: Build and Release
@@ -56,16 +55,12 @@ on:
     - cron: "13 1 * * 0" # Weekly on Sunday 01:13 UTC
   workflow_dispatch:
     inputs:
-      publish:
-        description: "Publish to download channels and GitHub Releases (false keeps only workflow artifacts)"
-        required: false
-        default: false
-        type: boolean
       build_docker:
         # Advisory only. docker.yml triggers on workflow_run and its job-level
         # condition requires the triggering event to be a tag push, so a manual
         # dispatch of this workflow never produces images regardless of this
-        # value. Publishing remains controlled by the explicit publish input.
+        # value. Kept because the summary step reports it; wiring it up would
+        # mean teaching docker.yml's version parser a second event shape.
         description: "Build and push Docker images after binary build (ignored: dispatch runs never reach docker.yml)"
         required: false
         default: true
@@ -93,18 +88,17 @@ jobs:
   # Build strategy check - determine build type based on trigger
   build-check:
     name: Build Strategy Check
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
-      should_publish: ${{ github.event_name != 'workflow_dispatch' || inputs.publish == true }}
       build_type: ${{ steps.check.outputs.build_type }}
       version: ${{ steps.check.outputs.version }}
       short_sha: ${{ steps.check.outputs.short_sha }}
       is_prerelease: ${{ steps.check.outputs.is_prerelease }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -178,7 +172,7 @@ jobs:
   prepare-platform-matrix:
     name: Prepare Platform Matrix
     needs: build-check
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     outputs:
       matrix: ${{ steps.select.outputs.matrix }}
@@ -213,12 +207,12 @@ jobs:
           fi
 
           all='{"include":[
-            {"target_id":"linux-x86_64-musl","os":"sm-standard-4","target":"x86_64-unknown-linux-musl","cross":false,"platform":"linux","rustflags":"","features":"","glibc":""},
-            {"target_id":"linux-aarch64-musl","os":"sm-standard-4-arm","target":"aarch64-unknown-linux-musl","cross":false,"platform":"linux","rustflags":"","features":"","glibc":""},
-            {"target_id":"linux-x86_64-gnu","os":"sm-standard-4","target":"x86_64-unknown-linux-gnu","cross":true,"platform":"linux","rustflags":"","features":"pyroscope","glibc":"2.31"},
-            {"target_id":"linux-aarch64-gnu","os":"sm-standard-4-arm","target":"aarch64-unknown-linux-gnu","cross":true,"platform":"linux","rustflags":"","features":"pyroscope","glibc":"2.31"},
-            {"target_id":"macos-aarch64","os":"macos-latest","target":"aarch64-apple-darwin","cross":false,"platform":"macos","rustflags":"","features":"pyroscope","glibc":""},
-            {"target_id":"windows-x86_64","os":"windows-latest","target":"x86_64-pc-windows-msvc","cross":false,"platform":"windows","rustflags":"","features":"","glibc":""}
+            {"target_id":"linux-x86_64-musl","os":"sm-standard-2","target":"x86_64-unknown-linux-musl","cross":false,"platform":"linux","rustflags":""},
+            {"target_id":"linux-aarch64-musl","os":"sm-standard-2","target":"aarch64-unknown-linux-musl","cross":true,"platform":"linux","rustflags":""},
+            {"target_id":"linux-x86_64-gnu","os":"sm-standard-2","target":"x86_64-unknown-linux-gnu","cross":false,"platform":"linux","rustflags":""},
+            {"target_id":"linux-aarch64-gnu","os":"sm-standard-2","target":"aarch64-unknown-linux-gnu","cross":true,"platform":"linux","rustflags":""},
+            {"target_id":"macos-aarch64","os":"macos-latest","target":"aarch64-apple-darwin","cross":false,"platform":"macos","rustflags":""},
+            {"target_id":"windows-x86_64","os":"windows-latest","target":"x86_64-pc-windows-msvc","cross":false,"platform":"windows","rustflags":""}
           ]}'
 
           if [[ "${selected}" == "all" ]]; then
@@ -246,8 +240,7 @@ jobs:
           echo "Selected platforms: ${selected}"
 
   build-rustfs:
-    # Acceptance workflows select artifacts by this stable platform name.
-    name: Build RustFS (${{ matrix.target_id }})
+    name: Build RustFS
     needs: [ build-check, prepare-platform-matrix ]
     if: needs.build-check.outputs.should_build == 'true' && needs.prepare-platform-matrix.result == 'success'
     runs-on: ${{ matrix.os }}
@@ -264,7 +257,7 @@ jobs:
       matrix: ${{ fromJson(needs.prepare-platform-matrix.outputs.matrix) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -274,7 +267,7 @@ jobs:
         with:
           rust-version: stable
           target: ${{ matrix.target }}
-          cache-shared-key: build-${{ matrix.target }}${{ matrix.glibc && format('-glibc-{0}', matrix.glibc) || '' }}
+          cache-shared-key: build-${{ matrix.target }}
           # main only. A cache saved on refs/tags/X is scoped to that tag: no
           # other tag, no main run and no PR can restore it, so every release
           # cycle wrote up to 12 entries of 1-2GB (preview tag plus final tag,
@@ -322,8 +315,7 @@ jobs:
           download_console_assets() {
             local curl_bin="curl"
             local python_bin="python3"
-            # Preserve the reviewed 1.0.3 Console in this security-only release branch.
-            local console_api="https://api.github.com/repos/rustfs/console/releases/tags/v0.1.37"
+            local console_api="https://api.github.com/repos/rustfs/console/releases/latest"
             local console_json="console-release.json"
             local console_url
             local console_sha256
@@ -360,15 +352,12 @@ jobs:
               release = json.load(handle)
 
           tag = release.get("tag_name", "") or "unknown"
-          if tag != "v0.1.37":
-              raise SystemExit("Console release does not match the security-release pin")
-          expected_digest = "sha256:e6ff2c7e7695de824ec4cda91d8611d1aba5d8462e6809592c92a50b23f5b9ab"
 
           for asset in release.get("assets", []):
               name = asset.get("name", "")
               digest = asset.get("digest", "")
               url = asset.get("browser_download_url", "")
-              if name == "rustfs-console-v0.1.37.zip" and digest == expected_digest and url:
+              if name.startswith("rustfs-console-") and name.endswith(".zip") and digest.startswith("sha256:") and url:
                   sha256 = digest.split(":", 1)[1]
                   if not re.fullmatch(r"[0-9a-fA-F]{64}", sha256):
                       raise SystemExit(f"console zip asset has invalid sha256 digest: {sha256}")
@@ -413,84 +402,17 @@ jobs:
 
       - name: Build RustFS
         shell: bash
-        env:
-          BUILD_TARGET: ${{ matrix.target }}
-          BUILD_OS: ${{ matrix.platform }}-${{ startsWith(matrix.target, 'aarch64-') && 'aarch64' || 'x86_64' }}
         run: |
           # Force rebuild by touching build.rs
           touch rustfs/build.rs
 
-          FEATURE_ARGS=()
-          if [[ -n "${{ matrix.features }}" ]]; then
-            FEATURE_ARGS=(--features "${{ matrix.features }}")
-          fi
-
-          # gnu targets pin an explicit glibc baseline (`<target>.<glibc>` for
-          # cargo-zigbuild) so release binaries link no symbols newer than it
-          # and run on older distros such as RHEL/Rocky 9 (glibc 2.34); #8062.
-          TARGET_ARG="$BUILD_TARGET"
-          if [[ -n "${{ matrix.glibc }}" ]]; then
-            TARGET_ARG="${TARGET_ARG}.${{ matrix.glibc }}"
-          fi
-
-          PROFILE_ARGS=()
-          if [[ "$BUILD_TARGET" == *-linux-gnu && "${{ matrix.features }}" == "pyroscope" ]]; then
-            # The in-process profiler resolves names from the final executable.
-            # Retain function symbols without enabling DWARF source information.
-            PROFILE_ARGS=(--config 'profile.release.strip="none"')
-          fi
           if [[ "${{ matrix.cross }}" == "true" ]]; then
-            cargo zigbuild --release --locked --target "$TARGET_ARG" "${FEATURE_ARGS[@]}" "${PROFILE_ARGS[@]}" -p rustfs --bin rustfs
+            # All cross targets in the matrix are Linux; zigbuild handles them.
+            cargo zigbuild --release --target ${{ matrix.target }} -p rustfs --bin rustfs
           else
-            cargo build --release --locked --target "$TARGET_ARG" "${FEATURE_ARGS[@]}" "${PROFILE_ARGS[@]}" -p rustfs --bin rustfs
+            cargo build --release --target ${{ matrix.target }} -p rustfs --bin rustfs
           fi
 
-          # All release targets use same-architecture runners, including GNU
-          # builds that use Zig only to select the glibc ABI floor.
-          bin="target/${{ matrix.target }}/release/rustfs"
-          if [[ -f "${bin}.exe" ]]; then
-            bin="${bin}.exe"
-          fi
-          version_output=$("$bin" --version)
-          if ! grep -Fxq "build target : ${BUILD_TARGET}" <<< "$version_output" || \
-             ! grep -Fxq "build os     : ${BUILD_OS}" <<< "$version_output" || \
-             ! grep -Fxq "rust channel : stable-${BUILD_TARGET}" <<< "$version_output"; then
-            echo "release binary reports an unexpected compile target" >&2
-            exit 1
-          fi
-          if [[ -n "${{ matrix.glibc }}" ]]; then
-            python3 scripts/release/check_glibc.py "${{ matrix.glibc }}" \
-              "target/${{ matrix.target }}/release/rustfs"
-          fi
-
-      - name: Verify macOS binary has no dynamic liblzma dependency
-        if: matrix.platform == 'macos'
-        shell: bash
-        run: |
-          binary="target/${{ matrix.target }}/release/rustfs"
-          if otool -L "$binary" | grep -E 'liblzma.*\.dylib'; then
-            echo "macOS release binary must not depend on a dynamic liblzma library" >&2
-            exit 1
-          fi
-          "$binary" --version
-
-      - name: Generate the CPU symbol catalog
-        if: endsWith(matrix.target, '-linux-gnu') && matrix.features == 'pyroscope'
-        shell: bash
-        run: |
-          cargo metadata --locked --format-version 1 --filter-platform '${{ matrix.target }}' \
-            --features rustfs/pyroscope > "$RUNNER_TEMP/cpu-catalog-metadata.json"
-          features=$(jq -ce '
-            (.packages[] | select(.name == "rustfs") | .id) as $id |
-            .resolve.nodes[] | select(.id == $id) | .features | map(select(. != "default")) | sort
-          ' "$RUNNER_TEMP/cpu-catalog-metadata.json")
-          release_dir="target/${{ matrix.target }}/release"
-          # These task-owned outputs may remain in a restored target cache.
-          rm -f "$release_dir/rustfs.cpu-symbol-catalog.json" "$release_dir/rustfs.cpu-symbol-catalog.sha256"
-          cargo run --locked -p rustfs-connect-symbol-catalog -- \
-            "$release_dir/rustfs" "$(git rev-parse HEAD)" '${{ matrix.target }}' "$features" \
-            "$release_dir/rustfs.cpu-symbol-catalog.json" > "$release_dir/rustfs.cpu-symbol-catalog.sha256"
-
       - name: Create release package
         id: package
         shell: bash
@@ -576,24 +498,16 @@ jobs:
             BINARY_NAME="rustfs"
           fi
 
-          BINARY_FILES=("$BINARY_NAME")
-
-          if [[ "$TARGET" == *-linux-gnu && "${{ matrix.features }}" == "pyroscope" ]]; then
-            BINARY_FILES+=(rustfs.cpu-symbol-catalog.json rustfs.cpu-symbol-catalog.sha256)
-          fi
-
-          # Verify the binaries exist before packaging
-          for binary in "${BINARY_FILES[@]}"; do
-            if [[ ! -f "$binary" ]]; then
-              echo "❌ Binary $binary not found in $(pwd)"
-              if [[ "${{ matrix.platform }}" == "windows" ]]; then
-                dir
-              else
-                ls -la
-              fi
-              exit 1
+          # Verify the binary exists before packaging
+          if [[ ! -f "$BINARY_NAME" ]]; then
+            echo "❌ Binary $BINARY_NAME not found in $(pwd)"
+            if [[ "${{ matrix.platform }}" == "windows" ]]; then
+              dir
+            else
+              ls -la
             fi
-          done
+            exit 1
+          fi
 
           # Universal packaging function
           package_zip() {
@@ -612,12 +526,8 @@ jobs:
           }
 
           # Create the zip package
-          echo "Start packaging: ${BINARY_FILES[*]} -> ../../../${PACKAGE_NAME}.zip"
-          if [[ "${{ matrix.platform }}" == "linux" ]]; then
-            zip "../../../${PACKAGE_NAME}.zip" "${BINARY_FILES[@]}"
-          else
-            package_zip "$BINARY_NAME" "../../../${PACKAGE_NAME}.zip"
-          fi
+          echo "Start packaging: $BINARY_NAME -> ../../../${PACKAGE_NAME}.zip"
+          package_zip "$BINARY_NAME" "../../../${PACKAGE_NAME}.zip"
 
           cd ../../..
 
@@ -691,37 +601,8 @@ jobs:
           echo "🔧 Build type: ${BUILD_TYPE}"
           echo "📊 Version: ${VERSION}"
 
-      - name: Verify packaged Linux binary
-        if: matrix.platform == 'linux'
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          package_file="${{ steps.package.outputs.package_file }}"
-          archive_members="$(unzip -Z1 "$package_file" | sort)"
-          expected_members='rustfs'
-          target="${{ matrix.target }}"
-          features="${{ matrix.features }}"
-          if [[ "$target" == *-linux-gnu && "$features" == "pyroscope" ]]; then
-            expected_members+=$'\nrustfs.cpu-symbol-catalog.json\nrustfs.cpu-symbol-catalog.sha256'
-          fi
-          if [[ "$archive_members" != "$expected_members" ]]; then
-            echo "Linux package does not contain the expected files" >&2
-            printf '%s\n' "$archive_members" >&2
-            exit 1
-          fi
-
-          # musl targets build natively; the gnu legs are same-arch
-          # cargo-zigbuild builds pinned to the release glibc baseline. Either
-          # way the binaries run on their runner, so executing them here
-          # proves each artifact matches its runner architecture.
-          binary_dir="$(mktemp -d)"
-          trap 'rm -rf "$binary_dir"' EXIT
-          unzip -q "$package_file" rustfs -d "$binary_dir"
-          "$binary_dir/rustfs" --version
-
       - name: Verify packaged console
-        if: matrix.target == 'x86_64-unknown-linux-gnu' || matrix.target == 'aarch64-unknown-linux-gnu'
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
         shell: bash
         run: |
           set -euo pipefail
@@ -775,14 +656,14 @@ jobs:
           exit 1
 
       - name: Upload to GitHub artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: ${{ steps.package.outputs.package_name }}
           path: "rustfs-*.zip"
           retention-days: ${{ startsWith(github.ref, 'refs/tags/') && 30 || 7 }}
 
       - name: Upload to Cloudflare R2
-        if: needs.build-check.outputs.should_publish == 'true' && env.R2_ACCESS_KEY_ID != '' && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease' || needs.build-check.outputs.build_type == 'development')
+        if: env.R2_ACCESS_KEY_ID != '' && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease' || needs.build-check.outputs.build_type == 'development')
         env:
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
@@ -799,33 +680,12 @@ jobs:
           fi
 
           # The self-hosted Linux runners do not ship the aws CLI (GitHub-hosted
-          # images did). Install the official CLI bundle on demand so R2 uploads
-          # survive a fresh runner without relying on a distro package.
+          # images did). Install it on demand so R2 uploads survive a fresh runner
+          # instead of hard-failing here.
           if ! command -v aws >/dev/null 2>&1; then
             echo "aws CLI not found on runner; installing..."
             if command -v apt-get >/dev/null 2>&1; then
-              aws_arch="$(uname -m)"
-              case "$aws_arch" in
-                x86_64) aws_arch="x86_64" ;;
-                aarch64|arm64) aws_arch="aarch64" ;;
-                *)
-                  echo "❌ Unsupported Linux architecture for AWS CLI: $aws_arch"
-                  exit 1
-                  ;;
-              esac
-
-              aws_install_root="${RUNNER_TEMP:-$PWD}/aws-cli"
-              rm -rf "$aws_install_root"
-              mkdir -p "$aws_install_root"
-              curl --fail --location --retry 3 \
-                "https://awscli.amazonaws.com/awscli-exe-linux-${aws_arch}.zip" \
-                --output "$aws_install_root/awscliv2.zip"
-              unzip -q "$aws_install_root/awscliv2.zip" -d "$aws_install_root"
-              "$aws_install_root/aws/install" \
-                --install-dir "$aws_install_root/aws-cli" \
-                --bin-dir "$aws_install_root/bin"
-              export PATH="$aws_install_root/bin:$PATH"
-              aws --version
+              sudo apt-get update && sudo apt-get install -y awscli
             elif command -v brew >/dev/null 2>&1; then
               brew install awscli
             else
@@ -864,41 +724,70 @@ jobs:
     name: Build Summary
     needs: [ build-check, build-rustfs ]
     if: always() && needs.build-check.outputs.should_build == 'true'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Build completion summary
         shell: bash
         env:
-          SHOULD_PUBLISH: ${{ needs.build-check.outputs.should_publish }}
-          BUILD_TYPE: ${{ needs.build-check.outputs.build_type }}
-          VERSION: ${{ needs.build-check.outputs.version }}
-          BUILD_STATUS: ${{ needs.build-rustfs.result }}
-          EVENT_NAME: ${{ github.event_name }}
+          # dispatch input via env: free-form text must not be pasted into the
+          # script for bash to evaluate.
+          INPUT_BUILD_DOCKER: ${{ github.event.inputs.build_docker }}
         run: |
-          echo "Build type: $BUILD_TYPE"
-          echo "Version: $VERSION"
-          echo "Build result: $BUILD_STATUS"
-          if [[ "$SHOULD_PUBLISH" != "true" ]]; then
-            echo "Artifact-only run: no download channels or GitHub Releases are updated."
-            echo "Successful platform packages are available as workflow artifacts."
+          BUILD_TYPE="${{ needs.build-check.outputs.build_type }}"
+          VERSION="${{ needs.build-check.outputs.version }}"
+
+          echo "🎉 Build completed successfully!"
+          echo "📦 Build type: $BUILD_TYPE"
+          echo "🔢 Version: $VERSION"
+          echo ""
+
+          # Check build status
+          BUILD_STATUS="${{ needs.build-rustfs.result }}"
+
+          echo "📊 Build Results:"
+          echo "  📦 All platforms: $BUILD_STATUS"
+          echo ""
+
+          case "$BUILD_TYPE" in
+            "preview")
+              echo "🔍 Preview artifacts are published in a GitHub prerelease"
+              echo "⏭️  Preview releases do not update latest channels"
+              ;;
+            "development")
+              echo "🛠️  Development build artifacts have been uploaded to OSS dev directory"
+              echo "⚠️  This is a development build - not suitable for production use"
+              ;;
+            "release")
+              echo "🚀 Release build artifacts have been uploaded to OSS release directory"
+              echo "✅ This build is ready for production use"
+              echo "🏷️  GitHub Release will be created in this workflow"
+              ;;
+            "prerelease")
+              echo "🧪 Prerelease build artifacts have been uploaded to OSS release directory"
+              echo "⚠️  This is a prerelease build - use with caution"
+              echo "🏷️  GitHub Release will be created in this workflow"
+              ;;
+          esac
+
+          echo ""
+          echo "🐳 Docker Images:"
+          if [[ "$BUILD_TYPE" == "preview" ]]; then
+            echo "⏭️  Preview tags do not publish Docker images"
+          elif [[ "$INPUT_BUILD_DOCKER" == "false" ]]; then
+            echo "⏭️  Docker image build was skipped (binary only build)"
           elif [[ "$BUILD_STATUS" == "success" ]]; then
-            echo "Publishing enabled; check the upload and release jobs for their results."
+            echo "🔄 Docker images will be built and pushed automatically via workflow_run event"
           else
-            echo "Build incomplete; check individual platform jobs for any completed uploads."
-          fi
-          if [[ "$EVENT_NAME" == "push" && "$GITHUB_REF" == refs/tags/* && "$BUILD_STATUS" == "success" ]]; then
-            echo "Docker publishing is eligible through the downstream workflow."
-          else
-            echo "This run does not trigger Docker publishing."
+            echo "❌ Docker image build will be skipped due to build failure"
           fi
 
   # Create GitHub Release for every valid release tag, including previews
   create-release:
     name: Create GitHub Release
     needs: [ build-check, build-rustfs ]
-    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
-    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: write
@@ -907,7 +796,7 @@ jobs:
       release_url: ${{ steps.create.outputs.release_url }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -958,20 +847,20 @@ jobs:
   upload-release-assets:
     name: Upload Release Assets
     needs: [ build-check, build-rustfs, create-release ]
-    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
-    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: write
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Download all build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           path: ./artifacts
           pattern: rustfs-*
@@ -1052,8 +941,8 @@ jobs:
   update-latest-version:
     name: Update Latest Version
     needs: [ build-check, publish-release ]
-    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
-    runs-on: sm-standard-2
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Update latest.json
@@ -1112,8 +1001,8 @@ jobs:
   publish-release:
     name: Publish Release
     needs: [ build-check, create-release, upload-release-assets ]
-    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
-    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'preview' || needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: write
@@ -1150,8 +1039,8 @@ jobs:
   cleanup-preview-releases:
     name: Cleanup Preview Releases
     needs: [ build-check, publish-release ]
-    if: needs.build-check.outputs.should_publish == 'true' && startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
-    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: write
@@ -1205,10 +1094,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cache-warm.yml

@@ -15,16 +15,16 @@
 # Sole writer of the Rust dependency caches that ci.yml restores.
 #
 # Why this is a separate workflow rather than steps inside ci.yml: ci.yml's
-# concurrency group originally cancelled in-progress main runs, while merges
-# landed faster than its 70-minute pipeline. Over 15 consecutive main pushes:
+# concurrency group cancels in-progress runs on main pushes, and merges land far
+# faster than its 70-minute pipeline. Measured over 15 consecutive main pushes:
 # 12 cancelled, 2 failed, 0 succeeded. A cancelled run never reaches
 # Swatinem/rust-cache's post step (cache-on-failure does not cover cancellation),
 # so the writer lanes were saving nothing and every PR paid a cold restore —
 # 11.8-20.9 minutes of "Setup Rust environment" against 0.7-3.4 warm.
 #
-# Keep cache writing separate from validation: only these jobs publish the
-# complete feature closure for each key. Main validation now also finishes its
-# running baseline, while superseded PR attempts can still be cancelled.
+# Splitting cache writing out of the test pipeline lets ci.yml keep cancelling
+# superseded runs (which is correct — nobody needs test results for a commit
+# that is already three merges behind) while the caches still get written.
 #
 # The group below deliberately does NOT cancel in progress; see the comment on
 # it for how that bounds concurrency and why it is scoped by event.
@@ -99,7 +99,7 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
-  # Readers: test-and-lint (workspace and ILM), build-rustfs-debug-binary,
+  # Readers: test-and-lint, test-ilm-integration-serial, build-rustfs-debug-binary,
   # e2e-tests, e2e-full.
   warm-ci-dev:
     name: Warm ci-dev
@@ -109,7 +109,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -141,7 +141,7 @@ jobs:
 
       - name: Upload cargo timings report
         if: inputs.emit_timings
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: cargo-timings-ci-dev
           path: target/cargo-timings/
@@ -199,7 +199,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -230,7 +230,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -260,7 +260,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ name: Continuous Integration
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, release ]
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -36,9 +36,7 @@ on:
       - "flake.lock"
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
-    # gateway/integration carries main's ruleset (rustfs/backlog#2734), so its
-    # pull requests must produce the same required checks.
-    branches: [ main, gateway/integration ]
+    branches: [ main, release ]
   merge_group:
     types: [ checks_requested ]
   schedule:
@@ -49,12 +47,12 @@ permissions:
   contents: read
 
 # Concurrency groups are scoped per event so different triggers never cancel
-# each other. PR pushes cancel superseded attempts; main and scheduled runs
-# finish so a busy merge stream cannot starve the complete baseline. For main,
-# GitHub retains one running run and replaces the pending run with the latest.
+# each other: PR pushes cancel the previous run of that PR, main pushes keep
+# latest-wins semantics among themselves, and scheduled runs always complete
+# (a shared group used to let every merge kill the weekly scheduled run).
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
 
 env:
   CARGO_TERM_COLOR: always
@@ -65,7 +63,7 @@ jobs:
   cancel-closed-pr-runs:
     name: Cancel Closed PR Runs
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Explain cancellation run
@@ -74,12 +72,12 @@ jobs:
   classify-changes:
     name: Select CI scope
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
       mode: ${{ steps.scope.outputs.mode }}
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -100,28 +98,24 @@ jobs:
   typos:
     name: Typos
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-      - name: Install typos download dependency
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends wget
       - name: Typos check with custom config file
-        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
+        uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master
 
   # Fail early with compile-free checks for every pull request.
   quick-checks:
     name: Quick Checks
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -130,7 +124,7 @@ jobs:
 
   test-and-lint:
     name: Workspace Test and Lint
-    if: contains(fromJSON('["full", "e2e"]'), needs.classify-changes.outputs.mode) && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
     needs: [ quick-checks, classify-changes ]
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -138,7 +132,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # Checkout otherwise writes the token into .git/config, where a PR's
           # own build.rs or proc-macro could read it back out.
@@ -148,9 +142,11 @@ jobs:
         uses: ./.github/actions/setup
         with:
           rust-version: stable
-          # Every lane reads its cache; cache-warm.yml remains the sole writer
-          # with the matching feature closure. Tests never compete to replace
-          # shared caches, including when a PR attempt is cancelled.
+          # Every lane in this workflow reads its cache and none writes it.
+          # cache-warm.yml is the sole writer for all four keys: this workflow
+          # cancels superseded runs on main, and a cancelled run never reaches
+          # rust-cache's post step, so writing from here saved nothing (12 of 15
+          # consecutive main-push runs were cancelled). See rustfs/backlog#1600.
           cache-shared-key: ci-dev
           cache-save-if: 'false'
           install-build-packaging-tools: 'false'
@@ -168,10 +164,13 @@ jobs:
             echo "started_at=$(date --utc --iso-8601=seconds)"
           } > artifacts/test-and-lint/run-metadata.txt
 
-      # Keep full Clippy validation on main, merge groups, and scheduled/manual
-      # runs. PRs retain the complete default test suite and compile-free checks.
+      # Clippy runs before the test pass: lint failures are the most common
+      # CI-only breakage and should surface in minutes, not after 20+ minutes
+      # of tests.
+      # Sampled too: clippy is the natural control arm for any CARGO_BUILD_JOBS
+      # experiment, since --all-targets is check-only for workspace members and
+      # never links the ~100 test binaries the limit exists to throttle.
       - name: Run clippy lints
-        if: github.event_name != 'pull_request'
         run: |
           ./scripts/ci/resource_sampler.sh start clippy
           trap './scripts/ci/resource_sampler.sh stop' EXIT
@@ -192,10 +191,13 @@ jobs:
           # Raised to 3 on main pushes and manual dispatches; PRs keep 2 so the
           # merge path is untouched while the experiment runs.
           #
-          # During baseline collection, main pushes cancelled superseded runs:
-          # only 4 of 20 Test and Lint jobs reached a terminal state. Running
-          # main validations now finish; dispatch remains an independent group
-          # for collecting additional samples on demand.
+          # Dispatch is included because push alone cannot supply the samples:
+          # this workflow cancels superseded runs on main, and only 4 of the last
+          # 20 push-triggered Test and Lint jobs reached a terminal state — at
+          # that rate ten samples would take roughly fifty merges. The
+          # concurrency group is scoped by event_name, so a dispatched run has
+          # its own group and is not cancelled by merge traffic, which makes the
+          # sample collectable on demand rather than by waiting.
           #
           # Baseline over 17 samples at 2:
           # median nextest/clippy step ratio 1.95, spread 1.85-2.06. The gate-2
@@ -244,11 +246,11 @@ jobs:
           mkdir -p artifacts/test-and-lint
           set +e
           timeout --verbose --signal=TERM --kill-after=30s 15m \
-            cargo test --all --exclude e2e_test --doc \
+            cargo test --all --doc \
             2>&1 | tee artifacts/test-and-lint/doctest.log
           status=${PIPESTATUS[0]}
           {
-            echo "command=cargo test --all --exclude e2e_test --doc"
+            echo "command=cargo test --all --doc"
             echo "exit_status=${status}"
             echo "finished_at=$(date --utc --iso-8601=seconds)"
             echo
@@ -257,9 +259,12 @@ jobs:
           } > artifacts/test-and-lint/doctest-diagnostics.txt
           exit "${status}"
 
+      - name: Check offline enrollment E2E root boundary
+        run: ./scripts/check_offline_enrollment_e2e.sh
+
       - name: Upload test reports and diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: junit-test-and-lint-${{ github.run_number }}
           path: |
@@ -275,14 +280,54 @@ jobs:
       - name: Check log-analyzer rule anchors
         run: ./scripts/check_log_analyzer_rules.sh
 
-      # Preserve the migration floor and require successful execution evidence
-      # from the workspace run, without compiling or executing its subset again.
-      - name: Verify rebalance/decommission migration proofs
-        run: ./scripts/check_migration_gate_count.sh evidence artifacts/test-and-lint/core-test-listing.json target/nextest/ci/junit.xml
+      # Explicit gate for migration-critical suites. These tests already ran in
+      # the full nextest pass above; a single filtered nextest invocation keeps
+      # the named gate without rebuilding or re-running them one package at a time.
+      #
+      # The gate selects tests by name substring (data_movement / rebalance /
+      # decommission / source_cleanup / delete_marker), so renames can silently
+      # thin it. The script owns the filter expression and first verifies the
+      # selected-test count against the committed floor in
+      # .config/migration-gate-floor.txt before running the gate; renames or
+      # removals must update that file consciously (see the script header).
+      # Kept on the default profile (no --profile ci): a second --profile ci run
+      # would clobber target/nextest/ci/junit.xml, and none of these tests are
+      # quarantined so they gain nothing from the ci profile's retry overrides.
+      - name: Run rebalance/decommission migration proofs
+        run: ./scripts/check_migration_gate_count.sh
+
+  # Dedicated serial lane for the ILM / lifecycle integration tests. These tests
+  # drive the object layer through process-global singletons (the GLOBAL_ENV
+  # ECStore, the global tier-config manager, background-expiry workers) and bind
+  # fixed ports (9002 for the scanner suite, 9003 for the app suite), so they are
+  # marked #[ignore] to keep them out of the default parallel `cargo nextest run
+  # --all` pass. Run them here explicitly with `--run-ignored ignored-only` and
+  # `-j1` so no two of them share global state or race for a port at once.
+  # serial_test's #[serial] does NOT serialize across nextest's process-per-test
+  # boundary (see .config/nextest.toml); `-j1` is what actually serializes them.
+  # See rustfs/backlog#1148 (ilm-1) and #1155.
+  test-ilm-integration-serial:
+    name: ILM Integration (serial)
+    if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    needs: [ quick-checks, classify-changes ]
+    runs-on: sm-standard-4
+    timeout-minutes: 90
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust environment
+        uses: ./.github/actions/setup
+        with:
+          rust-version: stable
+          cache-shared-key: ci-dev
+          cache-save-if: 'false'
+          install-build-packaging-tools: 'false'
 
-      # The workspace already compiled these ignored tests. Keep the same Cargo
-      # package selection to reuse their binaries, then run them serially in
-      # separate processes because they share fixed ports and global state.
       # test_transition_and_restore_flows was re-enabled by rustfs/backlog#1303:
       # its "missing xl.meta on disk2" was a test-util bug (open_disk hardcoded
       # disk_index 0), not an EC metadata-distribution issue.
@@ -292,16 +337,17 @@ jobs:
       # so the mid-restore ongoing read and fast 409 rejection it asserts are
       # the implemented contract).
       - name: Run ignored ILM integration tests serially
-        if: needs.classify-changes.outputs.mode == 'full'
         env:
-          # Match the preceding workspace build and reuse its feature graph.
+          # Match the measured Test and Lint link budget. The default exposed
+          # all 14 pod CPUs and a cold cache spent the full 80m compiling
+          # without starting one ILM test (main run 32982910990).
           CARGO_BUILD_JOBS: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && '3' || '2' }}
         run: |
           mkdir -p artifacts/ilm-integration
           set +e
           NEXTEST_HIDE_PROGRESS_BAR=1 timeout --verbose --signal=TERM --kill-after=30s 80m \
-            cargo nextest run --profile default -j1 --run-ignored ignored-only \
-            --all --exclude e2e_test \
+            cargo nextest run -j1 --run-ignored ignored-only \
+            -p rustfs-scanner -p rustfs \
             -E 'binary(lifecycle_integration_test) or (package(rustfs) and test(lifecycle_transition_api_test))' \
             --status-level all --final-status-level all \
             2>&1 | tee artifacts/ilm-integration/nextest.log
@@ -316,17 +362,16 @@ jobs:
           exit "${status}"
 
       - name: Upload ILM test diagnostics
-        if: always() && needs.classify-changes.outputs.mode == 'full'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: ilm-integration-${{ github.run_number }}-${{ github.run_attempt }}
-          path: artifacts/ilm-integration
-          retention-days: 3
+          path: |
+            artifacts/ilm-integration
+            target/nextest/ci/junit.xml
 
-  # This gate builds into a fresh target directory to isolate the E2E root.
-  # Give its cold build a separate budget from workspace tests and migration proofs.
-  offline-enrollment-e2e:
-    name: Offline Enrollment E2E Root Boundary
+  test-and-lint-rio-v2:
+    name: Test and Lint (rio-v2)
     if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
     needs: [ quick-checks, classify-changes ]
     runs-on: sm-standard-4
@@ -335,38 +380,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          rust-version: stable
-          cache-shared-key: ci-dev
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-          install-test-tools: 'false'
-
-      - name: Protect Connect test home
-        run: chmod go-w "$(realpath "$HOME")"
-
-      - name: Check offline enrollment E2E root boundary
-        run: ./scripts/check_offline_enrollment_e2e.sh
-
-  test-and-lint-rio-v2:
-    name: Test and Lint (rio-v2)
-    # Alternate feature configurations run on main, merge groups, and scheduled
-    # or manual validation; the default workspace remains the PR gate.
-    if: needs.classify-changes.outputs.mode == 'full' && github.event_name != 'pull_request'
-    needs: [ quick-checks, classify-changes ]
-    runs-on: sm-standard-4
-    timeout-minutes: 90
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -385,7 +399,6 @@ jobs:
         run: cargo clippy -p rustfs -p rustfs-ecstore --all-targets --features rio-v2 -- -D warnings
 
       - name: Run rio-v2 feature tests
-        shell: bash
         env:
           # Match the main nextest lane's #5394 link-I/O guard. A cold feature
           # cache otherwise fans out enough rust-lld processes to exhaust this
@@ -395,25 +408,9 @@ jobs:
           # --profile ci so the quarantine list (and its junit flaky markers)
           # covers this leg too; the default profile is the local no-retry
           # profile and silently ignored quarantined flakes here (rustfs#6703).
-          mkdir -p artifacts/test-and-lint
-          rm -f target/nextest/ci/junit.xml
-          ./scripts/ci/resource_sampler.sh start nextest-rio-v2
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
-          cargo nextest run --profile ci -p rustfs -p rustfs-ecstore --features rio-v2 \
-            2>&1 | tee artifacts/test-and-lint/nextest.log
+          cargo nextest run --profile ci -p rustfs -p rustfs-ecstore --features rio-v2
           cargo test -p rustfs --doc --features rio-v2
 
-      - name: Upload rio-v2 test reports and diagnostics
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: junit-test-and-lint-rio-v2-${{ github.run_number }}
-          path: |
-            target/nextest/ci/junit.xml
-            artifacts/test-and-lint
-          retention-days: 3
-          if-no-files-found: error
-
   connect-short-credential-boundary:
     name: Connect Short Credential Boundary
     if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
@@ -424,7 +421,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -474,27 +471,29 @@ jobs:
 
   test-and-lint-protocols:
     name: "Test and Lint (${{ matrix.features.name }})"
-    if: needs.classify-changes.outputs.mode == 'full' && github.event_name != 'pull_request'
+    if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
     needs: [ quick-checks, classify-changes ]
     runs-on: sm-standard-4
     timeout-minutes: 90
     strategy:
-      # Preserve independent results when one protocol fails, so diagnosis
-      # and a focused fix do not require rebuilding an interrupted sibling.
-      fail-fast: false
+      # On a PR, one failing protocol leg is enough to know the PR is not ready,
+      # so stop the sibling leg instead of paying another ~40 minutes for it.
+      # Everywhere else (main pushes, the merge queue, the weekly schedule) keep
+      # the full signal: there we want to know whether swift AND sftp are broken,
+      # not just whichever failed first. This is the only part of the early-stop
+      # work that also covers fork PRs, since it needs no token.
+      fail-fast: ${{ github.event_name == 'pull_request' }}
       matrix:
         features:
           - name: swift
             flags: "--features swift"
           - name: sftp
             flags: "--features sftp"
-          - name: http3
-            flags: "--features http3,swift"
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -506,50 +505,27 @@ jobs:
           cache-save-if: 'false'
           install-build-packaging-tools: 'false'
 
-      - name: Prepare protocol test state
-        run: |
-          rm -f target/nextest/ci/junit.xml
-          chmod go-w "$(realpath "$HOME")"
+      - name: Protect Connect test home
+        run: chmod go-w "$(realpath "$HOME")"
 
       - name: Run clippy with ${{ matrix.features.name }}
         run: |
-          ./scripts/ci/resource_sampler.sh start clippy
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
           cargo clippy -p rustfs -p rustfs-protocols --all-targets ${{ matrix.features.flags }} -- -D warnings
 
       - name: Run tests with ${{ matrix.features.name }}
-        id: protocol-tests
-        shell: bash
         env:
           # Keep feature-test linking under the same bounded concurrency as the
           # main nextest lane; Clippy is metadata-only and needs no such limit.
           CARGO_BUILD_JOBS: "2"
-          SAMPLER_INTERVAL_SECS: "15"
         run: |
           # --profile ci so the quarantine list (and its junit flaky markers)
           # covers this leg too; the default profile is the local no-retry
           # profile and silently ignored quarantined flakes here (rustfs#6703).
-          mkdir -p artifacts/protocol-tests
-          ./scripts/ci/resource_sampler.sh start nextest
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
-          cargo nextest run --profile ci -p rustfs -p rustfs-protocols ${{ matrix.features.flags }} \
-            2>&1 | tee artifacts/protocol-tests/nextest.log
-
-      - name: Upload protocol test reports and diagnostics
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: junit-test-and-lint-${{ matrix.features.name }}-${{ github.run_number }}-${{ github.run_attempt }}
-          path: |
-            target/nextest/ci/junit.xml
-            artifacts/protocol-tests
-            artifacts/test-and-lint
-          retention-days: 3
-          if-no-files-found: warn
+          cargo nextest run --profile ci -p rustfs -p rustfs-protocols ${{ matrix.features.flags }}
 
   build-rustfs-debug-binary:
     name: Build RustFS Debug Binary
-    if: contains(fromJSON('["full", "e2e"]'), needs.classify-changes.outputs.mode) && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: needs.classify-changes.outputs.mode == 'full' && (github.event_name != 'pull_request' || github.event.action != 'closed')
     needs: [ quick-checks, classify-changes ]
     runs-on: sm-standard-4
     timeout-minutes: 30
@@ -557,7 +533,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -588,7 +564,7 @@ jobs:
                       digest.update(chunk)
               return digest.hexdigest()
 
-          argv = ["python3", "scripts/e2e_binary.py", "build", "--bins", "--features", "e2e-test-hooks"]
+          argv = ["cargo", "build", "-p", "rustfs", "--bins", "--features", "e2e-test-hooks"]
           commit, tree = git("rev-parse", "HEAD"), git("rev-parse", "HEAD^{tree}")
           clean_before = not git("status", "--porcelain", "--untracked-files=normal")
           if not clean_before:
@@ -617,12 +593,11 @@ jobs:
           PYBUILD
 
       - name: Upload debug binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-debug-binary
           path: |
             target/debug/rustfs
-            target/debug/rustfs.e2e.json
             target/debug/rustfs.e2e-startup-cas-build.json
           if-no-files-found: error
           retention-days: 1
@@ -642,7 +617,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -655,15 +630,13 @@ jobs:
           install-build-packaging-tools: 'false'
 
       - name: Build debug binary with rio-v2
-        run: python3 scripts/e2e_binary.py build --bins --features rio-v2,e2e-test-hooks
+        run: cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks
 
       - name: Upload debug binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-debug-binary-rio-v2
-          path: |
-            target/debug/rustfs
-            target/debug/rustfs.e2e.json
+          path: target/debug/rustfs
           if-no-files-found: error
           retention-days: 1
 
@@ -686,7 +659,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -750,7 +723,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -766,7 +739,7 @@ jobs:
           install-build-packaging-tools: 'false'
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
@@ -781,7 +754,7 @@ jobs:
       # Download after the cache restore so the freshly built binary from the
       # build job always wins over anything restored into target/debug.
       - name: Download debug binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: rustfs-debug-binary
           path: target/debug
@@ -802,10 +775,6 @@ jobs:
           python3 ./scripts/check_test_wiring.py --check-profile e2e-smoke "${NEXTEST_LISTING}"
           ./scripts/check_security_smoke_count.sh check "${NEXTEST_LISTING}"
 
-      # Keep E2E documentation coverage with its already-built package graph.
-      - name: Run E2E documentation tests
-        run: cargo test -p e2e_test --doc
-
       # PR smoke subset of the in-repo e2e suite (backlog#1149 ci-4). The
       # profile.e2e-smoke default-filter in .config/nextest.toml is the single
       # wiring mechanism for e2e tests in CI — extend that filter instead of
@@ -815,27 +784,23 @@ jobs:
         env:
           NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-smoke-logs
-          SAMPLER_INTERVAL_SECS: "15"
         run: |
-          ./scripts/ci/resource_sampler.sh start e2e-smoke
-          trap './scripts/ci/resource_sampler.sh stop' EXIT
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
+          cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
             --status-level all --final-status-level all --failure-output final
 
       - name: Upload e2e smoke diagnostics
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: failure()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-smoke-diagnostics-${{ github.run_number }}
           path: |
             ${{ runner.temp }}/rustfs-e2e-smoke-logs/
             ${{ runner.temp }}/rustfs-e2e-smoke-list.json
-            artifacts/test-and-lint
           if-no-files-found: warn
 
       - name: Upload e2e smoke JUnit report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-smoke-junit-${{ github.run_number }}
           path: target/nextest/e2e-smoke/junit.xml
@@ -856,11 +821,11 @@ jobs:
           RUSTFS_TEST_PORT="$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1]); s.close()')"
           RUSTFS_TEST_PORT="${RUSTFS_TEST_PORT}" \
           RUSTFS_TEST_LOG="${RUN_ROOT}/rustfs.log" \
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- ./scripts/e2e-run.sh ./target/debug/rustfs "${RUN_ROOT}/data"
+          ./scripts/e2e-run.sh ./target/debug/rustfs "${RUN_ROOT}/data"
 
       - name: Upload test logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-test-logs-${{ github.run_number }}
           path: ${{ runner.temp }}/rustfs-e2e-*/rustfs.log
@@ -871,19 +836,20 @@ jobs:
     # Merge gate only (backlog#1149 ci-5): the never-automated user-visible
     # suites — KMS, object_lock, multipart_auth, quota, checksum, encryption,
     # security-boundary, ... — via the e2e-full nextest profile. Too heavy for
-    # every PR, so it is gated to main pushes, the merge queue, and manual
+    # every PR, so it is gated to main/release pushes, the merge queue, and manual
     # dispatch. protocols / the 7 cluster suites / replication / #[ignore] are
     # owned by other lanes (see .config/nextest.toml profile.e2e-full).
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'merge_group' ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      (github.event_name == 'push' &&
+        (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release'))
     needs: [ build-rustfs-debug-binary ]
     runs-on: sm-standard-2
     timeout-minutes: 55
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -907,7 +873,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
@@ -949,7 +915,7 @@ jobs:
       # Download after the cache restore so the freshly built binary from the
       # build job always wins over anything restored into target/debug.
       - name: Download debug binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: rustfs-debug-binary
           path: target/debug
@@ -984,7 +950,6 @@ jobs:
           if manifest["binary_sha256"] != digest.hexdigest() or manifest["commit"] != commit:
               raise SystemExit("downloaded hooks binary identity mismatch")
           shutil.copy2(manifest_path, target / manifest_path.name)
-          shutil.copy2(source.with_name("rustfs.e2e.json"), target / "rustfs.e2e.json")
           binary.chmod(0o755)
           PYINPUT
 
@@ -1001,16 +966,14 @@ jobs:
       # debug binary; each test spawns its own rustfs server on a random port.
       - name: Run e2e full suite
         env:
-          CARGO_BIN_EXE_rustfs: ${{ runner.temp }}/rustfs-startup-cas-input/rustfs
           RUSTFS_E2E_STARTUP_CAS_BINARY: ${{ runner.temp }}/rustfs-startup-cas-input/rustfs
           RUSTFS_E2E_STARTUP_CAS_BUILD_MANIFEST: ${{ runner.temp }}/rustfs-startup-cas-input/rustfs.e2e-startup-cas-build.json
           RUSTFS_E2E_STARTUP_CAS_ARTIFACT_DIR: ${{ runner.temp }}/rustfs-startup-cas-evidence
-          RUSTFS_HEAL_CHAOS_LOG_ROOT: ${{ runner.temp }}/rustfs-heal-chaos-logs
-        run: python3 scripts/e2e_binary.py run --binary "$RUSTFS_E2E_STARTUP_CAS_BINARY" --features e2e-test-hooks -- cargo nextest run --profile e2e-full -p e2e_test
+        run: cargo nextest run --profile e2e-full -p e2e_test
 
       - name: Upload junit
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-full-junit-${{ github.run_number }}
           path: |
@@ -1020,7 +983,7 @@ jobs:
 
       - name: Upload startup CAS evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: fresh-startup-cas-evidence-${{ github.run_number }}
           path: |
@@ -1029,15 +992,6 @@ jobs:
           if-no-files-found: warn
           retention-days: 7
 
-      - name: Upload heal cluster logs
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-full-heal-logs-${{ github.run_number }}
-          path: ${{ runner.temp }}/rustfs-heal-chaos-logs
-          if-no-files-found: warn
-          retention-days: 7
-
   e2e-tests-rio-v2:
     name: End-to-End Tests (rio-v2)
     # Inherits the schedule/dispatch-only gate through needs: on every other
@@ -1048,7 +1002,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -1058,7 +1012,7 @@ jobs:
           rm -f /tmp/rustfs.log
 
       - name: Download debug binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: rustfs-debug-binary-rio-v2
           path: target/debug
@@ -1087,11 +1041,11 @@ jobs:
       - name: Run end-to-end tests
         run: |
           s3s-e2e --version
-          python3 scripts/e2e_binary.py run --features rio-v2,e2e-test-hooks -- ./scripts/e2e-run.sh ./target/debug/rustfs /tmp/rustfs
+          ./scripts/e2e-run.sh ./target/debug/rustfs /tmp/rustfs
 
       - name: Upload test logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-test-logs-rio-v2-${{ github.run_number }}
           path: /tmp/rustfs.log
@@ -1104,12 +1058,12 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Download debug binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: rustfs-debug-binary
           path: target/debug
@@ -1130,11 +1084,11 @@ jobs:
           S3_PORT="${S3_PORT}" \
           DATA_ROOT="${RUN_ROOT}" \
           S3TESTS_CONF=artifacts/s3tests-single/s3tests.conf \
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- ./scripts/s3-tests/run.sh
+          ./scripts/s3-tests/run.sh
 
       - name: Upload s3 test artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: s3tests-implemented-${{ github.run_number }}
           path: artifacts/s3tests-single/**
@@ -1178,12 +1132,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Download debug binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: rustfs-debug-binary
           path: target/debug
@@ -1212,11 +1166,11 @@ jobs:
           S3_PORT="${S3_PORT}" \
           DATA_ROOT="${RUN_ROOT}" \
           S3TESTS_CONF=artifacts/s3tests-single/s3tests.conf \
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- ./scripts/s3-tests/run.sh
+          ./scripts/s3-tests/run.sh
 
       - name: Upload s3 test artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: s3tests-lifecycle-behavior-${{ github.run_number }}
           path: artifacts/s3tests-single/**
@@ -1231,7 +1185,7 @@ jobs:
       - typos
       - quick-checks
       - test-and-lint
-      - offline-enrollment-e2e
+      - test-ilm-integration-serial
       - test-and-lint-rio-v2
       - connect-short-credential-boundary
       - test-and-lint-protocols
@@ -1243,10 +1197,10 @@ jobs:
       - build-rustfs-debug-binary-rio-v2
       - e2e-tests-rio-v2
       - e2e-full
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Require the expected result of every CI lane
@@ -1264,7 +1218,7 @@ jobs:
       - typos
       - quick-checks
       - test-and-lint
-      - offline-enrollment-e2e
+      - test-ilm-integration-serial
       - test-and-lint-rio-v2
       - test-and-lint-protocols
       - build-rustfs-debug-binary
@@ -1284,10 +1238,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cla.yml

@@ -46,7 +46,7 @@ jobs:
     # Echoes one line; the run exists only so the concurrency group cancels the
     # in-flight run of a closed PR.
     permissions: {}
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Explain cancellation run
@@ -61,12 +61,12 @@ jobs:
       checks: write
       issues: write
       pull-requests: write
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Report CLA result for merge queue
         if: github.event_name == 'merge_group'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             await github.rest.checks.create({

.github/workflows/connect-diagnostic-schedule-acceptance.yml

@@ -1,206 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Connect diagnostic scheduler receipt acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect scheduler acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  diagnostic-schedule:
-    name: Verify production scheduler receipts over mTLS
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ && "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" --arg repository "$GITHUB_REPOSITORY" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == $repository
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-
-          gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract the verified official binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and (stat.S_IFMT(mode) in (0, stat.S_IFREG))
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({item.filename for item in entries}) == len(entries)
-              assert all(regular(item) and pathlib.PurePosixPath(item.filename).name == item.filename for item in entries)
-              assert sum(item.file_size for item in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  assert {item.filename for item in entries} == {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'} and len(entries) == 3
-                  assert all(regular(item) and 0 < item.file_size <= 1073741824 for item in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      import shutil
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-          file binary/rustfs | grep -Eq 'ELF 64-bit LSB.*x86-64'
-
-      - name: Run the real scheduler and receipt delivery scenario
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          [[ $(git -C connect-harness diff --name-only) == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          (cd connect-harness && ./tests/connectivity/diagnostic-schedule-evidence.test.sh)
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_DIAGNOSTIC_SCHEDULE_EVIDENCE="$GITHUB_WORKSPACE/diagnostic-schedule-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=diagnostic-schedule
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" '
-            .provenance.connectSha == $connect and .provenance.sourceSha == $source
-            and .provenance.binarySha256 == $binary
-          ' diagnostic-schedule-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" '
-            .provenance += {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest}
-          ' diagnostic-schedule-evidence.json > diagnostic-schedule-evidence.bound.json
-          mv diagnostic-schedule-evidence.bound.json diagnostic-schedule-evidence.json
-          node connect-harness/tests/connectivity/verify-diagnostic-schedule-evidence.mjs diagnostic-schedule-evidence.json --bound
-
-      - name: Upload verified receipt evidence
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: connect-diagnostic-schedule-evidence-${{ github.run_id }}
-          path: diagnostic-schedule-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-health-service-acceptance.yml

@@ -1,244 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Connect bounded health service acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect health service acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  health-service:
-    name: Verify bounded health service over mTLS
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_REPOSITORY" == rustfs/rustfs ]]
-          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-          run=$(gh api "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == "rustfs/rustfs"
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-          jq -r '.expires_at' <<<"$artifact" > artifact-expires-at
-          gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          [[ $(stat --format=%s official-artifact.zip) == $(jq -r '.size_in_bytes' <<<"$artifact") ]]
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract only the verified official service binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import shutil
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and stat.S_IFMT(mode) in (0, stat.S_IFREG)
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({entry.filename for entry in entries}) == len(entries)
-              assert all(regular(entry) and pathlib.PurePosixPath(entry.filename).name == entry.filename for entry in entries)
-              assert sum(entry.file_size for entry in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  assert {entry.filename for entry in entries} == {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'} and len(entries) == 3
-                  assert all(regular(entry) and 0 < entry.file_size <= 1073741824 for entry in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      header = source.read(20)
-                      assert header[:7] == b'\x7fELF\x02\x01\x01' and header[18:20] == b'\x3e\x00', 'Expected a little-endian ELF64 x86-64 binary'
-                      destination.write(header)
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-
-      - name: Run the real health service job
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          changed=$(git -C connect-harness diff --name-only)
-          [[ -z "$changed" || "$changed" == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          (cd connect-harness && ./tests/connectivity/health-service-evidence.test.sh)
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_HEALTH_SERVICE_EVIDENCE="$GITHUB_WORKSPACE/health-service-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=health-service
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" '
-            .provenance.connectSha == $connect and .provenance.sourceSha == $source
-            and .provenance.binarySha256 == $binary
-          ' health-service-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" \
-            --arg expiry "$(cat artifact-expires-at)" '
-            .provenance += {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest,artifactExpiresAt:$expiry}
-          ' health-service-evidence.json > health-service-evidence.bound.json
-          mv health-service-evidence.bound.json health-service-evidence.json
-          node connect-harness/tests/connectivity/health-service-evidence.mjs health-service-evidence.json --bound
-
-      - name: Upload only verified sanitized evidence
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: connect-health-service-evidence-${{ github.run_id }}
-          path: health-service-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-performance-drive-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect performance.drive service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  performance-drive:
-    name: Verify native Linux x86_64 performance.drive service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PERFORMANCE_DRIVE_EVIDENCE="$GITHUB_WORKSPACE/performance-drive-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=performance-drive
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('performance-drive-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            performance-drive-service-job-evidence.json >performance-drive-service-job-evidence.bound.json
-          mv performance-drive-service-job-evidence.bound.json performance-drive-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('performance-drive-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-performance-drive-evidence-${{ github.run_id }}
-          path: |
-            performance-drive-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-performance-network-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect performance.network service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  performance-network:
-    name: Verify native Linux x86_64 performance.network service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PERFORMANCE_NETWORK_EVIDENCE="$GITHUB_WORKSPACE/performance-network-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=performance-network
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('performance-network-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            performance-network-service-job-evidence.json >performance-network-service-job-evidence.bound.json
-          mv performance-network-service-job-evidence.bound.json performance-network-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('performance-network-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-performance-network-evidence-${{ github.run_id }}
-          path: |
-            performance-network-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-profile-cpu-acceptance.yml

@@ -1,221 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect profile.cpu service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      catalog_sha256:
-        description: Independently reviewed release CPU catalog SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  profile-cpu:
-    name: Verify native Linux x86_64 profile.cpu service job
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          github_api() {
-            curl --fail --silent --show-error \
-              --header "Authorization: Bearer $GH_TOKEN" \
-              --header 'Accept: application/vnd.github+json' \
-              "https://api.github.com/$1"
-          }
-
-          run=$(github_api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(github_api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(github_api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary and reviewed catalog
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CATALOG_SHA256: ${{ inputs.catalog_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ "$CATALOG_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs rustfs.cpu-symbol-catalog.json rustfs.cpu-symbol-catalog.sha256 -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-          # The packaged digest is corroboration, never the independent trust input.
-          [[ $(cat binary/rustfs.cpu-symbol-catalog.sha256) == "$CATALOG_SHA256" ]]
-          printf '%s  %s\n' "$CATALOG_SHA256" binary/rustfs.cpu-symbol-catalog.json | sha256sum --check --strict
-          chmod 0444 binary/rustfs.cpu-symbol-catalog.json
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          CATALOG_SHA256: ${{ inputs.catalog_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_CPU_CATALOG="$GITHUB_WORKSPACE/binary/rustfs.cpu-symbol-catalog.json" \
-            CONNECT_E2E_CPU_CATALOG_SHA256="$CATALOG_SHA256" \
-            CONNECT_E2E_PROFILE_EVIDENCE="$GITHUB_WORKSPACE/profile-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=profile
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('profile-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            profile-service-job-evidence.json >profile-service-job-evidence.bound.json
-          mv profile-service-job-evidence.bound.json profile-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('profile-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-profile-cpu-evidence-${{ github.run_id }}
-          path: |
-            profile-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-profile-memory-acceptance.yml

@@ -1,243 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Connect service memory profile acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect memory acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  profile-memory:
-    name: Verify signed service memory profile over mTLS
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_REPOSITORY" == rustfs/rustfs ]]
-          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-          run=$(gh api "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == "rustfs/rustfs"
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-          jq -r '.expires_at' <<<"$artifact" > artifact-expires-at
-          gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          [[ $(stat --format=%s official-artifact.zip) == $(jq -r '.size_in_bytes' <<<"$artifact") ]]
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract only the verified official service binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import shutil
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and stat.S_IFMT(mode) in (0, stat.S_IFREG)
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({entry.filename for entry in entries}) == len(entries)
-              assert all(regular(entry) and pathlib.PurePosixPath(entry.filename).name == entry.filename for entry in entries)
-              assert sum(entry.file_size for entry in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  expected = {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'}
-                  assert {entry.filename for entry in entries} == expected and len(entries) == len(expected)
-                  assert all(regular(entry) and 0 < entry.file_size <= 1073741824 for entry in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-          file binary/rustfs | grep -Eq 'ELF 64-bit LSB.*x86-64'
-
-      - name: Run the real service job under S3 workload
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          changed=$(git -C connect-harness diff --name-only)
-          [[ -z "$changed" || "$changed" == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          (cd connect-harness && ./tests/connectivity/profile-memory-evidence.test.sh)
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PROFILE_MEMORY_EVIDENCE="$GITHUB_WORKSPACE/profile-memory-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=profile-memory
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" '
-            .provenance.connectSha == $connect and .provenance.sourceSha == $source
-            and .provenance.binarySha256 == $binary
-          ' profile-memory-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" \
-            --arg expiry "$(cat artifact-expires-at)" '
-            .provenance += {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest,artifactExpiresAt:$expiry}
-          ' profile-memory-evidence.json > profile-memory-evidence.bound.json
-          mv profile-memory-evidence.bound.json profile-memory-evidence.json
-          node connect-harness/tests/connectivity/profile-memory-evidence.mjs profile-memory-evidence.json --bound
-
-      - name: Upload only verified sanitized evidence
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: connect-profile-memory-evidence-${{ github.run_id }}
-          path: profile-memory-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-profile-threads-acceptance.yml

@@ -1,249 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect profile.threads service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      thread_scope:
-        description: Thread profile scope
-        required: true
-        type: choice
-        default: native
-        options:
-          - native
-          - runtime
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  profile-threads:
-    name: Verify Linux x86_64 profile.threads service job
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          THREAD_SCOPE: ${{ inputs.thread_scope }}
-        run: |
-          set -euo pipefail
-          case "$THREAD_SCOPE" in
-            native) export CONNECT_E2E_THREAD_SCOPE=NATIVE_THREADS ;;
-            runtime) export CONNECT_E2E_THREAD_SCOPE=TOKIO_RUNTIME ;;
-            *) exit 1 ;;
-          esac
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PROFILE_THREADS_EVIDENCE="$GITHUB_WORKSPACE/profile-threads-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=profile-threads
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('profile-threads-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          THREAD_SCOPE: ${{ inputs.thread_scope }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            --arg requestedThreadScope "$THREAD_SCOPE" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha, requestedThreadScope: $requestedThreadScope}' \
-            profile-threads-service-job-evidence.json >profile-threads-service-job-evidence.bound.json
-          mv profile-threads-service-job-evidence.bound.json profile-threads-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('profile-threads-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-profile-threads-evidence-${{ github.run_id }}
-          path: |
-            profile-threads-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-api-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.api service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-api:
-    name: Verify native Linux x86_64 top.api service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_API_EVIDENCE="$GITHUB_WORKSPACE/top-api-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-api
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('top-api-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            top-api-service-job-evidence.json >top-api-service-job-evidence.bound.json
-          mv top-api-service-job-evidence.bound.json top-api-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('top-api-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-api-evidence-${{ github.run_id }}
-          path: |
-            top-api-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-disk-acceptance.yml

@@ -1,259 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.disk service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect top.disk service-job acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-disk:
-    name: Verify native top.disk service job over mTLS
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_REPOSITORY" == rustfs/rustfs ]]
-          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-          run=$(gh api "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == "rustfs/rustfs"
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-          jq -r '.expires_at' <<<"$artifact" > artifact-expires-at
-          gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          [[ $(stat --format=%s official-artifact.zip) == $(jq -r '.size_in_bytes' <<<"$artifact") ]]
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract only the verified official service binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import shutil
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and stat.S_IFMT(mode) in (0, stat.S_IFREG)
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({entry.filename for entry in entries}) == len(entries)
-              assert all(regular(entry) and pathlib.PurePosixPath(entry.filename).name == entry.filename for entry in entries)
-              assert sum(entry.file_size for entry in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  expected = {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'}
-                  assert {entry.filename for entry in entries} == expected and len(entries) == len(expected)
-                  assert all(regular(entry) and 0 < entry.file_size <= 1073741824 for entry in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      header = source.read(20)
-                      assert header[:7] == b'\x7fELF\x02\x01\x01' and header[18:20] == b'\x3e\x00', 'Expected a little-endian ELF64 x86-64 binary'
-                      destination.write(header)
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-
-      - name: Run the real top.disk service job
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          CONNECT_E2E_PRODUCER_SOURCE: ${{ inputs.source_sha }}
-          CONNECT_E2E_PRODUCER_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_E2E_PRODUCER_ARTIFACT_ID: ${{ inputs.artifact_id }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          changed=$(git -C connect-harness diff --name-only)
-          [[ -z "$changed" || "$changed" == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_DISK_EVIDENCE="$GITHUB_WORKSPACE/top-disk-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-disk
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" --arg artifact "$ARTIFACT_ID" '
-            .status == "PASS" and .officialArtifactId == $artifact and .producerSource == $source and .producerSha256 == $binary
-            and .result.provenance.sourceCommit == $source
-            and .result.provenance.executableSha256 == $binary
-          ' top-disk-service-job-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" \
-            --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" \
-            --arg expiry "$(cat artifact-expires-at)" '
-            . + {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest,artifactExpiresAt:$expiry,connectSha:$connect,sourceSha:$source,binarySha256:$binary}
-          ' top-disk-service-job-evidence.json > top-disk-service-job-evidence.bound.json
-          mv top-disk-service-job-evidence.bound.json top-disk-service-job-evidence.json
-
-      - name: Upload only verified sanitized evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-disk-service-job-evidence-${{ github.run_id }}
-          path: top-disk-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-locks-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.locks service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-locks:
-    name: Verify native Linux x86_64 top.locks service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_LOCKS_EVIDENCE="$GITHUB_WORKSPACE/top-locks-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-locks
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('top-locks-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            top-locks-service-job-evidence.json >top-locks-service-job-evidence.bound.json
-          mv top-locks-service-job-evidence.bound.json top-locks-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('top-locks-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-locks-evidence-${{ github.run_id }}
-          path: |
-            top-locks-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-rpc-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.rpc service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-rpc:
-    name: Verify native Linux x86_64 top.rpc service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_RPC_EVIDENCE="$GITHUB_WORKSPACE/top-rpc-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-rpc
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('top-rpc-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            top-rpc-service-job-evidence.json >top-rpc-service-job-evidence.bound.json
-          mv top-rpc-service-job-evidence.bound.json top-rpc-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('top-rpc-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-rpc-evidence-${{ github.run_id }}
-          path: |
-            top-rpc-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/coverage.yml

@@ -76,7 +76,7 @@ jobs:
       NEXTEST_PROFILE: ci
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -89,7 +89,7 @@ jobs:
           install-build-packaging-tools: 'false'
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
         with:
           tool: cargo-llvm-cov
 
@@ -112,7 +112,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: coverage-lcov-${{ github.run_number }}
           path: |
@@ -134,10 +134,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docker.yml

@@ -47,7 +47,7 @@ on:
         default: true
         type: boolean
       version:
-        description: "Version to build (latest, v1.0.0, v1.0.0-alpha1, or v1.0.1-preview.1)"
+        description: "Version to build (latest for stable release, or specific version like v1.0.0, v1.0.0-alpha1)"
         required: false
         default: "latest"
         type: string
@@ -82,8 +82,9 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.event == 'push' &&
-       github.event.workflow_run.head_branch != 'main')
-    runs-on: sm-standard-2
+       github.event.workflow_run.head_branch != 'main' &&
+       !contains(github.event.workflow_run.head_branch, '-preview'))
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
@@ -96,7 +97,7 @@ jobs:
       source_ref: ${{ steps.check.outputs.source_ref }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           # For workflow_run events, checkout the specific commit that triggered the workflow
@@ -196,14 +197,7 @@ jobs:
                   version="${version#v}"
                 fi
 
-                if [[ "$version" =~ -preview\.[0-9]+$ ]]; then
-                  build_type="preview"
-                  is_prerelease=true
-                  echo "🔍 Building Docker image for preview: $version (version tags only)"
-                elif [[ "$version" == *"-preview"* ]]; then
-                  echo "❌ Invalid preview tag: $version (expected suffix: -preview.<number>)" >&2
-                  exit 1
-                elif [[ "$version" == *"alpha"* ]] || [[ "$version" == *"beta"* ]] || [[ "$version" == *"rc"* ]]; then
+                if [[ "$version" == *"alpha"* ]] || [[ "$version" == *"beta"* ]] || [[ "$version" == *"rc"* ]]; then
                   build_type="prerelease"
                   is_prerelease=true
                   # Pre-GA policy: prereleases update latest until the first stable tag exists.
@@ -255,14 +249,11 @@ jobs:
                 echo "🚀 Building with latest stable release version"
                 ;;
               *-preview*)
-                if [[ ! "$input_version" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?-preview\.[0-9]+$ ]]; then
-                  echo "❌ Invalid preview version: $input_version" >&2
-                  exit 1
-                fi
                 build_type="preview"
                 is_prerelease=true
-                version="${input_version#v}"
-                echo "🔍 Building with preview version: $version (version tags only)"
+                should_build=false
+                should_push=false
+                echo "⏭️  Preview tags do not publish Docker images"
                 ;;
               # Prerelease versions (must match first, more specific)
               v*alpha*|v*beta*|v*rc*|*alpha*|*beta*|*rc*)
@@ -352,7 +343,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           ref: ${{ needs.build-check.outputs.source_ref }}
@@ -501,7 +492,7 @@ jobs:
     name: Scan Docker Images
     needs: [ build-check, build-docker ]
     if: needs.build-check.outputs.should_build == 'true' && needs.build-check.outputs.should_push == 'true'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: read
@@ -544,7 +535,7 @@ jobs:
           category: container-image-${{ matrix.variant }}
 
       - name: Upload container scan report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: container-image-scan-${{ matrix.variant }}
           path: trivy-${{ matrix.variant }}.sarif
@@ -556,7 +547,7 @@ jobs:
     name: Docker Build Summary
     needs: [ build-check, build-docker ]
     if: always() && needs.build-check.outputs.should_build == 'true'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Docker build completion summary
@@ -572,10 +563,6 @@ jobs:
           echo ""
 
           case "$BUILD_TYPE" in
-            "preview")
-              echo "🔍 Preview Docker image has been built with ${VERSION} tags"
-              echo "⏭️  Preview images do not update latest or prerelease channels"
-              ;;
             "release")
               echo "🚀 Release Docker image has been built with ${VERSION} tags"
               echo "✅ This image is ready for production use"

.github/workflows/e2e-distributed.yml

@@ -38,7 +38,6 @@ on:
       - "Cargo.lock"
       - "Cargo.toml"
       - ".config/nextest.toml"
-      - ".config/e2e-distributed-selection.txt"
       - ".github/workflows/e2e-distributed.yml"
       - "crates/audit/**"
       - "crates/common/**"
@@ -78,7 +77,6 @@ concurrency:
 
 jobs:
   distributed:
-    if: github.repository == 'rustfs/rustfs'
     name: Distributed 4-node 4-disk e2e
     # GitHub-hosted VM: loop and tmpfs mounts work here. sm-standard-4 is an
     # ARC pod and rejects both (`mount -o loop` ENOENT, tmpfs "read-only").
@@ -95,7 +93,7 @@ jobs:
       UPGRADE_SOURCE_SHA256: 7c789386bf85278f865b8e0d359bf4edb84d5aa408cc3fa54a18c25ca74cd6e7
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -153,7 +151,8 @@ jobs:
 
       - name: Build rustfs binary
         run: |
-          python3 scripts/e2e_binary.py build --bins
+          cargo build -p rustfs --bins
+          : > target/debug/rustfs.features
 
       - name: Verify distributed e2e membership
         env:
@@ -168,17 +167,15 @@ jobs:
           FILTER: ${{ inputs.filter }}
         run: |
           set -euo pipefail
-          rm -f target/nextest/e2e-distributed/junit.xml
           if [ -n "${FILTER}" ]; then
-            python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-distributed -p e2e_test -E "${FILTER}"
+            cargo nextest run --profile e2e-distributed -p e2e_test -E "${FILTER}"
           else
-            python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-distributed -p e2e_test --no-tests=fail
+            cargo nextest run --profile e2e-distributed -p e2e_test --no-tests=fail
           fi
-          test -s target/nextest/e2e-distributed/junit.xml
 
       - name: Upload distributed e2e diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-distributed-${{ github.run_number }}
           path: |
@@ -203,17 +200,17 @@ jobs:
   alert-on-failure:
     name: Alert on scheduled failure
     needs: [distributed]
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/e2e-replication-nightly.yml

@@ -53,7 +53,6 @@ concurrency:
 
 jobs:
   repl-nightly:
-    if: github.repository == 'rustfs/rustfs'
     name: Replication e2e (nightly)
     # dual-node tests spawn two full rustfs servers each; the extra headroom
     # over the per-PR sm-standard-2 e2e job keeps the parallel process fan-out
@@ -64,7 +63,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -78,7 +77,7 @@ jobs:
 
       # The STS dual-node test requires awscurl and fails if it is unavailable.
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
@@ -90,10 +89,14 @@ jobs:
       - name: Verify awscurl
         run: test -x "$AWSCURL_PATH"
 
-      # Build once and carry its source/binary identity into the test invocation.
+      # Build the rustfs binary once up front. The e2e tests spawn it as a
+      # child process (crates/e2e_test/src/common.rs) and will build it on
+      # demand otherwise, but a single explicit build avoids several parallel
+      # nextest test processes racing to build it at once.
       - name: Build rustfs binary
         run: |
-          python3 scripts/e2e_binary.py build --bins
+          cargo build -p rustfs --bins
+          : > target/debug/rustfs.features
 
       - name: Verify replication e2e membership
         env:
@@ -105,11 +108,11 @@ jobs:
       - name: Run replication e2e nightly suite
         env:
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-repl-nightly-logs
-        run: python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-repl-nightly -p e2e_test
+        run: cargo nextest run --profile e2e-repl-nightly -p e2e_test
 
       - name: Upload nextest junit report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-replication-nightly-junit-${{ github.run_number }}
           path: |
@@ -120,7 +123,6 @@ jobs:
           if-no-files-found: ignore
 
   cluster-nightly:
-    if: github.repository == 'rustfs/rustfs'
     name: Cluster fault e2e (nightly)
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -128,7 +130,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -142,7 +144,8 @@ jobs:
 
       - name: Build rustfs binary
         run: |
-          python3 scripts/e2e_binary.py build --bins --features e2e-test-hooks
+          cargo build -p rustfs --bins --features e2e-test-hooks
+          : > target/debug/rustfs.features
 
       - name: Verify cluster fault e2e membership
         env:
@@ -153,13 +156,12 @@ jobs:
 
       - name: Run cluster fault e2e nightly suite
         env:
-          CARGO_BIN_EXE_rustfs: ${{ github.workspace }}/target/debug/rustfs
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-nightly-logs
-        run: python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-nightly -p e2e_test
+        run: cargo nextest run --profile e2e-nightly -p e2e_test
 
       - name: Upload cluster fault diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-cluster-nightly-${{ github.run_number }}
           path: |
@@ -170,7 +172,6 @@ jobs:
           if-no-files-found: warn
 
   protocols-nightly:
-    if: github.repository == 'rustfs/rustfs'
     name: Protocol e2e (nightly)
     runs-on: sm-standard-4
     timeout-minutes: 90
@@ -179,7 +180,7 @@ jobs:
       RUSTFS_BUILD_FEATURES: ftps,webdav,sftp
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -197,9 +198,6 @@ jobs:
           sudo apt-get install -y -qq iproute2
           ss -tn state CLOSE-WAIT >/dev/null
 
-      - name: Build protocol server
-        run: python3 scripts/e2e_binary.py build --features "$RUSTFS_BUILD_FEATURES"
-
       # The suite owns fixed protocol ports and serializes its internal cases.
       - name: Verify protocol e2e membership
         env:
@@ -212,11 +210,11 @@ jobs:
         env:
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-protocol-e2e-logs
         run: >-
-          python3 scripts/e2e_binary.py run --features "$RUSTFS_BUILD_FEATURES" -- cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
+          cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
 
       - name: Upload protocol diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: e2e-protocol-nightly-${{ github.run_number }}
           path: |
@@ -232,17 +230,17 @@ jobs:
     # Only scheduled runs open/append the tracking issue (backlog#1149 ci-8);
     # manual workflow_dispatch runs stay quiet so a debugging run never files a
     # spurious alert.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/e2e-s3tests.yml

@@ -159,7 +159,7 @@ jobs:
       TEST_MODE: ${{ matrix.test-mode }}
       S3_SHARD_INDEX: ${{ matrix.shard-index }}
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -167,7 +167,7 @@ jobs:
       # ship a working pip (ci-1: a bare python3 without pip is what broke the
       # scheduled sweep). Keeps the workflow correct across runner drift.
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
@@ -264,7 +264,7 @@ jobs:
               hostname: rustfs4
               volumes: [rustfs4-data:/data]
             lb:
-              image: haproxy:3.4.4
+              image: haproxy:2.9
               hostname: lb
               networks: [rustfs-net]
               ports:
@@ -308,11 +308,6 @@ jobs:
 
           docker compose -f compose.yml up -d
 
-          # Validate the pinned HAProxy image parses the exact config before
-          # the S3 compatibility sweep starts.
-          docker compose -f compose.yml exec -T lb \
-            haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg
-
       - name: Wait for RustFS ready
         run: |
           for _ in {1..120}; do
@@ -362,7 +357,7 @@ jobs:
 
       - name: Upload artifacts
         if: always() && env.ACT != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: s3tests-${{ env.TEST_MODE }}-shard-${{ matrix.shard-index }}
           path: artifacts/**
@@ -371,15 +366,15 @@ jobs:
     name: Upstream HEAD classification canary
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     continue-on-error: true
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
@@ -440,7 +435,7 @@ jobs:
 
       - name: Upload canary artifacts
         if: always() && env.ACT != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: s3tests-upstream-head
           path: artifacts/s3tests-upstream-head/**
@@ -459,10 +454,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/e2e-upgrade.yml

@@ -51,87 +51,71 @@ env:
   UPGRADE_SOURCE_SHA256: 3ee8df71e8edcfada533be452c4135868f697bc515460ae97b027313eade7a3d
 
 jobs:
-  build:
-    name: Build upgrade candidate
-    runs-on: sm-standard-2
+  upgrade:
+    name: ${{ matrix.name }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # The two `_from_rc2_` tests keep their names: they assert
+          # release-independent object contracts and pass unchanged against the
+          # newer pinned source, so renaming them would only churn history and
+          # the CI required-check names. UPGRADE_SOURCE_VERSION above is the
+          # single source of truth for which release they actually run against.
+          - name: Direct upgrade from the previous release
+            cache_key: e2e-direct-upgrade
+            test: direct_upgrade_from_rc2_preserves_object_contracts
+            artifact: direct-upgrade
+          - name: Mixed-version rolling upgrade from the previous release
+            cache_key: e2e-mixed-version-upgrade
+            test: rolling_upgrade_from_rc2_preserves_mixed_version_contracts
+            artifact: mixed-version-upgrade
+          - name: Bucket configuration survives the upgrade
+            cache_key: e2e-bucket-config-upgrade
+            test: direct_upgrade_from_previous_release_preserves_bucket_configuration
+            artifact: bucket-config-upgrade
+          - name: Rollback reads current bucket metadata
+            cache_key: e2e-bucket-config-rollback
+            test: rollback_to_previous_release_reads_current_bucket_metadata
+            artifact: bucket-config-rollback
+          - name: ODM configuration recovery after rc.5 rollback
+            cache_key: e2e-odm-config-rollback
+            test: rc5_rollback_requires_restoring_odm_configuration
+            artifact: odm-config-rollback
+          - name: Multipart layouts survive the rc.5 upgrade
+            cache_key: e2e-multipart-layout-upgrade
+            test: direct_upgrade_from_rc5_preserves_multipart_layouts
+            artifact: multipart-layout-upgrade
+          - name: rc.5 multipart replication baseline
+            cache_key: e2e-multipart-layout-baseline
+            test: rc5_baseline_replicates_multipart_layouts
+            artifact: multipart-layout-baseline
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
         with:
-          cache-shared-key: e2e-upgrade-server
+          cache-shared-key: ${{ matrix.cache_key }}
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
           install-build-packaging-tools: "false"
-          install-test-tools: "false"
 
       - name: Download pinned previous release
-        run: |
-          mkdir -p target/debug
-          archive="target/debug/$UPGRADE_SOURCE_ASSET"
-          curl --fail --location --retry 3 --output "$archive" \
-            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${UPGRADE_SOURCE_VERSION}/${UPGRADE_SOURCE_ASSET}"
-          echo "$UPGRADE_SOURCE_SHA256  $archive" | sha256sum --check --strict
-
-      - name: Build current RustFS binary
-        run: python3 scripts/e2e_binary.py build
-
-      - name: Upload verified upgrade candidate
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: upgrade-candidate-${{ github.run_id }}
-          path: |
-            target/debug/rustfs
-            target/debug/rustfs.e2e.json
-            target/debug/${{ env.UPGRADE_SOURCE_ASSET }}
-          if-no-files-found: error
-          retention-days: 3
-          compression-level: 0
-          overwrite: true
-
-  upgrade:
-    name: Upgrade compatibility
-    needs: build
-    runs-on: sm-standard-2
-    timeout-minutes: 60
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          cache-shared-key: e2e-upgrade-tests
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          install-build-packaging-tools: "false"
-          install-test-tools: "false"
-
-      - name: Download verified upgrade candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: upgrade-candidate-${{ github.run_id }}
-          path: target/debug
-
-      - name: Restore candidate executable bit
-        run: chmod +x target/debug/rustfs
-
-      - name: Verify and unpack pinned previous release
         env:
           SOURCE_DIR: ${{ runner.temp }}/rustfs-upgrade-source
         run: |
           set -euo pipefail
           mkdir -p "$SOURCE_DIR"
-          archive="target/debug/$UPGRADE_SOURCE_ASSET"
+          archive="$SOURCE_DIR/$UPGRADE_SOURCE_ASSET"
+          curl --fail --location --retry 3 --output "$archive" \
+            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${UPGRADE_SOURCE_VERSION}/${UPGRADE_SOURCE_ASSET}"
           echo "$UPGRADE_SOURCE_SHA256  $archive" | sha256sum --check --strict
           unzip -q "$archive" -d "$SOURCE_DIR"
           chmod +x "$SOURCE_DIR/rustfs"
@@ -139,57 +123,33 @@ jobs:
           echo "RUSTFS_UPGRADE_SOURCE_BINARY=$SOURCE_DIR/rustfs" >> "$GITHUB_ENV"
           echo "RUSTFS_E2E_LOG_DIR=$RUNNER_TEMP/rustfs-upgrade-logs" >> "$GITHUB_ENV"
 
-      # Reuse one compiled harness, while keeping each case in its own process.
-      # Continue after a failure to retain the former matrix's complete verdict.
-      - name: Run upgrade compatibility tests
-        shell: bash
-        env:
-          NO_PROXY: 127.0.0.1,localhost,::1
+      - name: Build current RustFS binary
         run: |
-          export no_proxy="$NO_PROXY"
-          cases=(
-            direct-upgrade:direct_upgrade_from_rc2_preserves_object_contracts
-            mixed-version-upgrade:rolling_upgrade_from_rc2_preserves_mixed_version_contracts
-            bucket-config-upgrade:direct_upgrade_from_previous_release_preserves_bucket_configuration
-            bucket-config-rollback:rollback_to_previous_release_reads_current_bucket_metadata
-            odm-config-rollback:rc5_rollback_requires_restoring_odm_configuration
-            multipart-layout-upgrade:direct_upgrade_from_rc5_preserves_multipart_layouts
-            multipart-layout-baseline:rc5_baseline_replicates_multipart_layouts
-          )
-          status=0
-          for entry in "${cases[@]}"; do
-            artifact="${entry%%:*}"
-            test="${entry#*:}"
-            export RUSTFS_SCANNER_HEAL_G09_EVIDENCE_DIR="$RUNNER_TEMP/rustfs-upgrade-g09-evidence/$artifact"
-            export RUSTFS_E2E_LOG_DIR="$RUNNER_TEMP/rustfs-upgrade-logs/$artifact"
-            mkdir -p "$RUSTFS_E2E_LOG_DIR"
-            echo "::group::$test"
-            if python3 scripts/e2e_binary.py run -- cargo test --locked -p e2e_test \
-              "upgrade_compatibility_test::$test" -- --ignored --exact --nocapture \
-              2>&1 | tee "$RUSTFS_E2E_LOG_DIR/test.log"; then
-              echo "PASS: $test"
-            else
-              echo "::error::Upgrade compatibility failed: $test"
-              status=1
-            fi
-            echo "::endgroup::"
-          done
-          exit "$status"
+          cargo build --locked -p rustfs --bin rustfs
+          : > target/debug/rustfs.features
+
+      - name: Run upgrade compatibility test
+        env:
+          RUSTFS_SCANNER_HEAL_G09_EVIDENCE_DIR: ${{ runner.temp }}/rustfs-upgrade-g09-evidence/${{ matrix.artifact }}
+        run: |
+          cargo test --locked -p e2e_test \
+            "upgrade_compatibility_test::${{ matrix.test }}" \
+            -- --ignored --exact --nocapture
 
       - name: Upload scanner/heal G09 evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: upgrade-g09-evidence-${{ github.run_number }}
-          path: ${{ runner.temp }}/rustfs-upgrade-g09-evidence
+          name: ${{ matrix.artifact }}-g09-evidence-${{ github.run_number }}
+          path: ${{ runner.temp }}/rustfs-upgrade-g09-evidence/${{ matrix.artifact }}
           if-no-files-found: ignore
           retention-days: 14
 
       - name: Upload server logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: upgrade-server-logs-${{ github.run_number }}
+          name: ${{ matrix.artifact }}-server-logs-${{ github.run_number }}
           path: ${{ runner.temp }}/rustfs-upgrade-logs
           if-no-files-found: warn
           retention-days: 14

.github/workflows/functional-chain-health.yml

@@ -1,64 +0,0 @@
-name: Functional chain health
-on:
-  schedule:
-    - cron: '23 * * * *'
-  workflow_dispatch:
-permissions:
-  contents: read
-  actions: read
-concurrency:
-  group: functional-chain-health
-  cancel-in-progress: false
-jobs:
-  collect:
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: smoke-testing
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-      - name: Collect and publish verified chain health
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          NIGHTLY_SOURCE_REF: ${{ vars.NIGHTLY_BRANCH || 'main' }}
-        run: python3 scripts/functional_chain_health.py --source-ref "${NIGHTLY_SOURCE_REF}" --publish --output "${RUNNER_TEMP}/chain-health.json"
-      - name: Retain health observation
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-health-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-health.json
-          if-no-files-found: error

.github/workflows/fuzz.yml

@@ -60,7 +60,7 @@ jobs:
   cancel-closed-pr-runs:
     name: Cancel Closed PR Runs
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Explain cancellation run
@@ -72,18 +72,16 @@ jobs:
   fuzz-build:
     name: Build Fuzz Harness
     if: >
-      github.repository == 'rustfs/rustfs' && (
-        (github.event_name == 'pull_request' && github.event.action != 'closed') ||
-        github.event_name == 'schedule' ||
-        github.event_name == 'workflow_dispatch'
-      )
+      (github.event_name == 'pull_request' && github.event.action != 'closed') ||
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch'
     runs-on: sm-standard-4
     timeout-minutes: 60
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -95,7 +93,7 @@ jobs:
           cache-save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'schedule' }}
 
       - name: Install cargo-fuzz
-        uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
         with:
           tool: cargo-fuzz
 
@@ -115,7 +113,7 @@ jobs:
           done
 
       - name: Upload prebuilt fuzz binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: fuzz-prebuilt-binaries-${{ github.run_number }}
           path: fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/
@@ -145,12 +143,12 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Download prebuilt fuzz binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: fuzz-prebuilt-binaries-${{ github.run_number }}
           path: fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release
@@ -169,7 +167,7 @@ jobs:
 
       - name: Upload fuzz smoke artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: fuzz-smoke-${{ matrix.target }}-${{ github.run_number }}
           path: |
@@ -199,12 +197,12 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Download prebuilt fuzz binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: fuzz-prebuilt-binaries-${{ github.run_number }}
           path: fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release
@@ -223,7 +221,7 @@ jobs:
 
       - name: Upload nightly fuzz artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: fuzz-nightly-${{ matrix.target }}-${{ github.run_number }}
           path: |
@@ -241,17 +239,17 @@ jobs:
     # `always()` is required: without it this job is skipped when a needed
     # job fails. Alerts only for scheduled (nightly) runs (backlog#1149
     # ci-8); PR and manual dispatch failures are already watched by a human.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/gateway-integration-sync.yml

@@ -1,197 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Gateway Integration Sync
-
-# Merges `main` into the long-lived `gateway/integration` branch every weekday
-# so the s3s -> gateway migration (rustfs/backlog#2734, task T0.1 in #2736)
-# never accumulates merge debt. A clean merge lands as a `--no-ff` merge commit
-# pushed straight to the branch. A conflicting merge is aborted and surfaced as
-# a pull request from `sync/<source>-<date>`, whose head is the un-merged
-# source commit, so the conflict is resolved the same day, in review, with no
-# other change riding along. The run itself stays green in that case: the pull
-# request is the signal. Any other failure (push rejected, pull request not
-# created) fails the run and, on the schedule, files the shared failure issue.
-#
-# Resolving a conflict pull request: merge `origin/gateway/integration` into
-# the sync branch, resolve, push, get the review. Land it with a fast-forward
-# push of the resolved merge commit to `gateway/integration`, not with the
-# squash button: a squash drops the merge ancestry and the same hunks conflict
-# again on the next run.
-#
-# Write scope: only `gateway/integration` and `sync/*` are ever pushed, and
-# both push targets below are literal refs. The pushes use a one-hour
-# installation token of the organisation's own GitHub App (contents: write)
-# because that app is the only non-admin bypass actor of the
-# `gateway/integration` ruleset; GITHUB_TOKEN cannot be a ruleset bypass actor,
-# so it cannot push through the required reviews and checks. The conflict pull
-# request is opened with FLAKE_UPDATE_TOKEN, the PAT that already opens the
-# weekly flake.lock pull requests, because this repository keeps "Allow GitHub
-# Actions to create and approve pull requests" switched off. GITHUB_TOKEN is
-# therefore read-only here.
-#
-# `schedule` fires only from the default branch, so the cron is live once this
-# file exists on `main`. `workflow_dispatch` runs from any ref that carries the
-# file and always acts on `gateway/integration`.
-
-on:
-  schedule:
-    - cron: "0 2 * * 1-5" # Weekdays 02:00 UTC
-  workflow_dispatch:
-    inputs:
-      source_ref:
-        description: >-
-          Branch to merge into gateway/integration. The schedule always merges
-          main; only the conflict acceptance test (rustfs/backlog#2736) sets
-          another branch.
-        required: false
-        default: main
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-env:
-  TARGET_BRANCH: gateway/integration
-
-jobs:
-  sync:
-    name: Merge main into gateway/integration
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Create the branch push token
-        id: push-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
-        with:
-          app-id: ${{ vars.CLA_BOT_APP_ID }}
-          private-key: ${{ secrets.CLA_BOT_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: rustfs
-          permission-contents: write
-
-      - name: Checkout gateway/integration
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          # persist-credentials-exempt: this checkout's token IS the push
-          # credential — the merge commit and the sync branch are pushed with it
-          # below. It is a one-hour installation token scoped to contents.
-          ref: gateway/integration
-          fetch-depth: 0
-          token: ${{ steps.push-token.outputs.token }}
-
-      - name: Configure the bot identity
-        run: |
-          git config user.name "rustfs-cla-assistant[bot]"
-          git config user.email "273121464+rustfs-cla-assistant[bot]@users.noreply.github.com"
-
-      - name: Merge the source branch
-        id: merge
-        env:
-          SOURCE_REF: ${{ inputs.source_ref || 'main' }}
-        run: |
-          set -euo pipefail
-          if ! [[ "$SOURCE_REF" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]*$ ]] \
-            || [[ "$SOURCE_REF" == *..* ]] \
-            || [[ "$SOURCE_REF" == "$TARGET_BRANCH" ]]; then
-            echo "::error::refusing source_ref '${SOURCE_REF}'"
-            exit 1
-          fi
-          git fetch origin "refs/heads/${SOURCE_REF}:refs/remotes/origin/${SOURCE_REF}"
-          source_sha=$(git rev-parse "origin/${SOURCE_REF}")
-          target_sha=$(git rev-parse HEAD)
-          {
-            echo "source_ref=${SOURCE_REF}"
-            echo "source_sha=${source_sha}"
-            echo "target_sha=${target_sha}"
-          } >> "$GITHUB_OUTPUT"
-          if git merge --no-ff --no-edit "origin/${SOURCE_REF}"; then
-            if [[ "$(git rev-parse HEAD)" == "$target_sha" ]]; then
-              echo "result=up-to-date" >> "$GITHUB_OUTPUT"
-              echo "\`${TARGET_BRANCH}\` already contains \`${SOURCE_REF}\` (${source_sha}); nothing to push." >> "$GITHUB_STEP_SUMMARY"
-            else
-              echo "result=merged" >> "$GITHUB_OUTPUT"
-            fi
-            exit 0
-          fi
-          git diff --name-only --diff-filter=U > "$RUNNER_TEMP/conflicts.txt"
-          git merge --abort
-          if [[ ! -s "$RUNNER_TEMP/conflicts.txt" ]]; then
-            echo "::error::git merge failed without reporting conflicting paths; this is not a conflict"
-            exit 1
-          fi
-          echo "result=conflict" >> "$GITHUB_OUTPUT"
-
-      - name: Push the merge commit
-        if: steps.merge.outputs.result == 'merged'
-        env:
-          SOURCE_REF: ${{ steps.merge.outputs.source_ref }}
-          SOURCE_SHA: ${{ steps.merge.outputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git push origin HEAD:refs/heads/gateway/integration
-          echo "Merged \`${SOURCE_REF}\` (${SOURCE_SHA}) into \`${TARGET_BRANCH}\` as $(git rev-parse HEAD)." >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Open the conflict pull request
-        if: steps.merge.outputs.result == 'conflict'
-        env:
-          GH_TOKEN: ${{ secrets.FLAKE_UPDATE_TOKEN }}
-          SOURCE_REF: ${{ steps.merge.outputs.source_ref }}
-          SOURCE_SHA: ${{ steps.merge.outputs.source_sha }}
-          TARGET_SHA: ${{ steps.merge.outputs.target_sha }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          date_utc=$(date -u +%Y-%m-%d)
-          sync_branch="sync/${SOURCE_REF//\//-}-${date_utc}"
-          git push origin "refs/remotes/origin/${SOURCE_REF}:refs/heads/${sync_branch}"
-          {
-            echo "The scheduled merge of \`${SOURCE_REF}\` into \`${TARGET_BRANCH}\` stopped on conflicts and was aborted; \`${TARGET_BRANCH}\` is unchanged."
-            echo
-            echo "This branch is the un-merged \`${SOURCE_REF}\` head. Merge \`origin/${TARGET_BRANCH}\` into it, resolve the files below, push, and get the review. Land the resolved merge commit with a fast-forward push to \`${TARGET_BRANCH}\`; a squash merge drops the merge ancestry and the same hunks conflict again on the next run. Do not include any change that is not conflict resolution."
-            echo
-            echo "- Run: ${RUN_URL}"
-            echo "- Source: \`${SOURCE_REF}\` at ${SOURCE_SHA}"
-            echo "- Target: \`${TARGET_BRANCH}\` at ${TARGET_SHA}"
-            echo
-            echo "## Conflicting files"
-            echo
-            echo "Output of \`git diff --name-only --diff-filter=U\` captured before \`git merge --abort\`:"
-            echo
-            sed 's/^/- /' "$RUNNER_TEMP/conflicts.txt"
-          } > "$RUNNER_TEMP/pr-body.md"
-          title="sync: merge ${SOURCE_REF} ${date_utc} (conflicts)"
-          existing=$(gh pr list --repo "$GITHUB_REPOSITORY" --base "$TARGET_BRANCH" --head "$sync_branch" --state open --json number --jq '.[0].number // empty')
-          if [[ -n "$existing" ]]; then
-            gh pr edit "$existing" --repo "$GITHUB_REPOSITORY" --title "$title" --body-file "$RUNNER_TEMP/pr-body.md"
-            pr_url=$(gh pr view "$existing" --repo "$GITHUB_REPOSITORY" --json url --jq .url)
-          else
-            pr_url=$(gh pr create --repo "$GITHUB_REPOSITORY" --base "$TARGET_BRANCH" --head "$sync_branch" --title "$title" --body-file "$RUNNER_TEMP/pr-body.md")
-          fi
-          echo "Conflicts in \`${SOURCE_REF}\` -> \`${TARGET_BRANCH}\`; pull request: ${pr_url}" >> "$GITHUB_STEP_SUMMARY"
-
-  alert-on-failure:
-    name: Alert on scheduled failure
-    needs: [sync]
-    # Same ci-8 mechanism audit.yml and coverage.yml use: a scheduled run that
-    # could not push or could not open the conflict pull request must not stay
-    # visible only in the Actions tab.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Open or update failure-tracking issue
-        uses: ./.github/actions/schedule-failure-issue
-        with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}

.github/workflows/helm-package.yml

@@ -31,7 +31,7 @@ permissions:
 
 jobs:
   build-helm-package:
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     if: |
       (github.event_name == 'workflow_dispatch' && !contains(github.event.inputs.version, '-preview')) ||
@@ -48,10 +48,9 @@ jobs:
       chart_version: ${{ steps.version.outputs.chart_version }}
 
     steps:
-      - name: Checkout release source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - name: Checkout helm chart repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
-          ref: ${{ github.event.workflow_run.head_sha || (startsWith(inputs.version, 'refs/tags/') && inputs.version || format('refs/tags/{0}', inputs.version)) }}
           persist-credentials: false
 
       # Both inputs reach the shell through env rather than `${{ }}`
@@ -84,40 +83,6 @@ jobs:
 
           ./scripts/helm_chart_version.sh "$RAW_TAG"
 
-      # Docker and Helm share the binary-build trigger. Do not publish a chart
-      # until the image selected by its default appVersion is pullable.
-      - name: Wait for release image
-        timeout-minutes: 20
-        env:
-          APP_VERSION: ${{ steps.version.outputs.app_version }}
-        run: |
-          set -euo pipefail
-          if [[ ! "$APP_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] ||
-             [[ "$APP_VERSION" == *-preview* ]]; then
-            echo "Invalid deliverable image version: $APP_VERSION" >&2
-            exit 1
-          fi
-
-          for attempt in {1..60}; do
-            if token=$(curl --fail --silent --show-error --connect-timeout 10 --max-time 20 \
-              'https://auth.docker.io/token?service=registry.docker.io&scope=repository:rustfs/rustfs:pull' \
-              | jq -er '.token // empty') &&
-              curl --fail --silent --show-error --head --connect-timeout 10 --max-time 20 \
-                --header "Authorization: Bearer $token" \
-                --header 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json' \
-                "https://registry-1.docker.io/v2/rustfs/rustfs/manifests/$APP_VERSION" > /dev/null; then
-              echo "Release image is available: rustfs/rustfs:$APP_VERSION"
-              exit 0
-            fi
-            echo "Waiting for rustfs/rustfs:$APP_VERSION ($attempt/60)"
-            if (( attempt < 60 )); then
-              sleep 15
-            fi
-          done
-
-          echo "Release image is unavailable; refusing to publish Helm chart" >&2
-          exit 1
-
       - name: Replace chart version and app version
         env:
           CHART_VERSION: ${{ steps.version.outputs.chart_version }}
@@ -130,21 +95,6 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
 
-      - name: Install yq
-        run: |
-          set -euo pipefail
-          yq_version="4.54.1"
-          yq_sha256="8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f"
-          tools_dir="$RUNNER_TEMP/rustfs-helm-tools"
-          mkdir -p "$tools_dir"
-          curl --fail --silent --show-error --location --retry 3 \
-            "https://github.com/mikefarah/yq/releases/download/v${yq_version}/yq_linux_amd64" \
-            --output "$tools_dir/yq"
-          printf '%s  %s\n' "$yq_sha256" "$tools_dir/yq" | sha256sum --check -
-          chmod +x "$tools_dir/yq"
-          echo "$tools_dir" >> "$GITHUB_PATH"
-          "$tools_dir/yq" --version
-
       - name: Test Helm Chart Templates
         run: ./scripts/test_helm_templates.sh
 
@@ -157,23 +107,21 @@ jobs:
             --version "${{ steps.version.outputs.chart_version }}"
 
       - name: Upload helm package as artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: helm-package
-          path: |
-            helm/rustfs/*.tgz
-            helm/rustfs/README.md
+          path: helm/rustfs/*.tgz
           retention-days: 1
 
   publish-helm-package:
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: [ build-helm-package ]
     if: needs.build-helm-package.result == 'success'
 
     steps:
       - name: Checkout helm package repo
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # persist-credentials-exempt: this checkout's token IS the push credential —
           # the job git-pushes to rustfs/helm below. Clearing it breaks chart publishing.
@@ -181,7 +129,7 @@ jobs:
           token: ${{ secrets.RUSTFS_HELM_PACKAGE }}
 
       - name: Download helm package
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: helm-package
           path: ./

.github/workflows/issue-translator.yml

@@ -32,7 +32,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: usthe/issues-translate-action@b41f55ddc81d7d54bd542a4f289fe28ec081898e # v2.7

.github/workflows/minio-interop.yml

@@ -60,7 +60,7 @@ permissions:
 jobs:
   minio-interop:
     name: MinIO interop (EC + SSE read parity)
-    # Keep this scheduled interoperability lane scoped to the upstream repo.
+    # Skip on forks: needs the repo's runners and is not a contributor gate.
     if: github.repository == 'rustfs/rustfs'
     runs-on: ubuntu-latest
     timeout-minutes: 40
@@ -83,7 +83,7 @@ jobs:
       INTEROP_REQUIRED_TESTS: '["reads_minio_generated_sse_s3_multipart_fixture", "reads_minio_generated_sse_kms_multipart_fixture", "rejects_minio_generated_sse_s3_fixture_with_wrong_kms_key", "rejects_minio_generated_sse_s3_fixture_with_truncated_ciphertext"]'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -137,10 +137,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/mint.yml

@@ -114,10 +114,10 @@ jobs:
     # label was abandoned (no docker.sock on the pod its only run landed on).
     # TODO(ci-8): scheduled-failure alerting (auto-open issue on a red weekly
     # run) is added by the ci-8 composite action; do not implement it here.
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -246,7 +246,7 @@ jobs:
 
       - name: Upload artifacts
         if: always() && env.ACT != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: mint
           path: artifacts/**
@@ -264,10 +264,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/nightly-gnu.yml

@@ -42,62 +42,29 @@ env:
   NIGHTLY_BUILD_REF: ${{ github.event_name == 'schedule' && (vars.NIGHTLY_BRANCH || 'main') || (inputs.branch || github.ref_name) }}
 
 jobs:
-  resolve-source:
-    if: github.repository == 'rustfs/rustfs'
-    name: Resolve nightly source
-    runs-on: sm-standard-2
-    timeout-minutes: 10
-    outputs:
-      source_sha: ${{ steps.source.outputs.sha }}
-      source_ref: ${{ steps.source.outputs.ref }}
-    steps:
-      - name: Checkout selected source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-          ref: ${{ env.NIGHTLY_BUILD_REF }}
-      - name: Record immutable source
-        id: source
-        run: |
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "ref=${NIGHTLY_BUILD_REF}" >> "$GITHUB_OUTPUT"
-
   build:
-    needs: resolve-source
     name: Build x86_64 GNU
     runs-on: sm-standard-4
     timeout-minutes: 150
     env:
-      NIGHTLY_BUILD_REF: ${{ needs.resolve-source.outputs.source_ref }}
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-          ref: ${{ needs.resolve-source.outputs.source_sha }}
+          ref: ${{ env.NIGHTLY_BUILD_REF }}
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
         with:
-          cache-shared-key: build-x86_64-unknown-linux-gnu-glibc-2.31
+          cache-shared-key: build-x86_64-unknown-linux-gnu
           cache-save-if: 'false'
-          install-cross-tools: 'true'
-          target: x86_64-unknown-linux-gnu
           install-build-packaging-tools: 'false'
           install-test-tools: 'false'
 
       - name: Build RustFS
-        # Pin the glibc baseline (`<target>.<glibc>` for cargo-zigbuild) so
-        # nightlies run on older distros such as RHEL/Rocky 9 (glibc 2.34); #8062.
-        run: cargo zigbuild --release --locked --target x86_64-unknown-linux-gnu.2.31 -p rustfs --bins
-
-      - name: Verify glibc symbol baseline
-        run: |
-          python3 scripts/release/check_glibc.py 2.31 \
-            target/x86_64-unknown-linux-gnu/release/rustfs \
-            target/x86_64-unknown-linux-gnu/release/rustfs-cli
-          target/x86_64-unknown-linux-gnu/release/rustfs --version | grep -Fx 'build target : x86_64-unknown-linux-gnu'
+        run: cargo build --release --locked --target x86_64-unknown-linux-gnu -p rustfs --bins
 
       - name: Build DEB package
         id: deb
@@ -129,15 +96,10 @@ jobs:
 
           cat > "${PKG_DIR}/etc/default/rustfs" << 'ENVEOF'
           # RustFS Environment Configuration
-          # See https://docs.rustfs.com for more information
-          # RUSTFS_ACCESS_KEY=<changeme>
-          # RUSTFS_SECRET_KEY=<changeme>
+          # See https://rustfs.com/docs/ for more information
           # RUSTFS_VOLUMES=""
-          # RUSTFS_ADDRESS=":9000"
-          # RUSTFS_CONSOLE_ADDRESS=":9001"
-          # RUSTFS_CONSOLE_ENABLE=true
-          # RUSTFS_OBS_LOGGER_LEVEL=error
-          # RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"
+          # RUSTFS_ROOT_USER=""
+          # RUSTFS_ROOT_PASSWORD=""
           ENVEOF
 
           # dpkg versions must start with a digit and cannot contain hyphens;
@@ -163,13 +125,37 @@ jobs:
           /etc/default/rustfs
           CONFFILES
 
-          ./scripts/release/package_service_scripts.sh after-install > "${PKG_DIR}/DEBIAN/postinst"
+          cat > "${PKG_DIR}/DEBIAN/postinst" << 'POSTINST'
+          #!/bin/bash
+          set -e
+          if ! getent passwd rustfs > /dev/null 2>&1; then
+              useradd -r -s /bin/false -d /opt/rustfs rustfs
+          fi
+          mkdir -p /opt/rustfs /data/rustfs /var/log/rustfs
+          chown rustfs:rustfs /opt/rustfs /data/rustfs /var/log/rustfs
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          echo "RustFS installed. Configure /etc/default/rustfs then: systemctl start rustfs"
+          POSTINST
           chmod 755 "${PKG_DIR}/DEBIAN/postinst"
 
-          ./scripts/release/package_service_scripts.sh before-remove > "${PKG_DIR}/DEBIAN/prerm"
+          cat > "${PKG_DIR}/DEBIAN/prerm" << 'PRERM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ] && systemctl is-active --quiet rustfs; then
+              systemctl stop rustfs
+          fi
+          PRERM
           chmod 755 "${PKG_DIR}/DEBIAN/prerm"
 
-          ./scripts/release/package_service_scripts.sh after-remove > "${PKG_DIR}/DEBIAN/postrm"
+          cat > "${PKG_DIR}/DEBIAN/postrm" << 'POSTRM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          POSTRM
           chmod 755 "${PKG_DIR}/DEBIAN/postrm"
 
           cp LICENSE "${PKG_DIR}/usr/share/doc/rustfs/"
@@ -207,15 +193,10 @@ jobs:
           mkdir -p ./tmp-pkg/etc/default
           cat > ./tmp-pkg/etc/default/rustfs << 'ENVEOF'
           # RustFS Environment Configuration
-          # See https://docs.rustfs.com for more information
-          # RUSTFS_ACCESS_KEY=<changeme>
-          # RUSTFS_SECRET_KEY=<changeme>
+          # See https://rustfs.com/docs/ for more information
           # RUSTFS_VOLUMES=""
-          # RUSTFS_ADDRESS=":9000"
-          # RUSTFS_CONSOLE_ADDRESS=":9001"
-          # RUSTFS_CONSOLE_ENABLE=true
-          # RUSTFS_OBS_LOGGER_LEVEL=error
-          # RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"
+          # RUSTFS_ROOT_USER=""
+          # RUSTFS_ROOT_PASSWORD=""
           ENVEOF
 
           fpm -s dir -t rpm \
@@ -229,13 +210,35 @@ jobs:
             --description "High-performance distributed object storage" \
             --url "https://rustfs.com" \
             --license "Apache-2.0" \
-            --before-install <(./scripts/release/package_service_scripts.sh rpm-before-install) \
-            --before-upgrade <(./scripts/release/package_service_scripts.sh rpm-before-upgrade) \
-            --after-install <(./scripts/release/package_service_scripts.sh after-install) \
-            --after-upgrade <(./scripts/release/package_service_scripts.sh after-install) \
-            --before-remove <(./scripts/release/package_service_scripts.sh before-remove) \
-            --after-remove <(./scripts/release/package_service_scripts.sh after-remove) \
-            --rpm-posttrans <(./scripts/release/package_service_scripts.sh rpm-posttrans) \
+            --after-install <(cat << 'POSTINST'
+          #!/bin/bash
+          set -e
+          if ! getent passwd rustfs > /dev/null 2>&1; then
+              useradd -r -s /bin/false -d /opt/rustfs rustfs
+          fi
+          mkdir -p /opt/rustfs /data/rustfs /var/log/rustfs
+          chown rustfs:rustfs /opt/rustfs /data/rustfs /var/log/rustfs
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          POSTINST
+            ) \
+            --before-remove <(cat << 'PRERM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ] && systemctl is-active --quiet rustfs; then
+              systemctl stop rustfs
+          fi
+          PRERM
+            ) \
+            --after-remove <(cat << 'POSTRM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          POSTRM
+            ) \
             --config-files /etc/default/rustfs \
             "rustfs-nightly-${DEB_DATE}/usr/bin/rustfs=/usr/bin/rustfs" \
             ./tmp-pkg/etc/default/rustfs=/etc/default/rustfs \
@@ -249,12 +252,12 @@ jobs:
           echo "rpm_file=$RPM_FILE" >> "$GITHUB_OUTPUT"
 
       - name: Upload DEB artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: ${{ steps.deb.outputs.deb_file }}
           path: ${{ steps.deb.outputs.deb_file }}
       - name: Upload RPM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: ${{ steps.rpm.outputs.rpm_file }}
           path: ${{ steps.rpm.outputs.rpm_file }}
@@ -331,16 +334,15 @@ jobs:
 
           CANDIDATE_FILE="${RUNNER_TEMP}/nightly-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.json"
           jq -n --arg source_sha "${SOURCE_SHA}" \
-            --arg workflow_sha "${GITHUB_SHA}" --arg source_ref "${NIGHTLY_BUILD_REF}" \
             --argjson build_run_id "${GITHUB_RUN_ID}" --argjson build_run_attempt "${GITHUB_RUN_ATTEMPT}" \
             --arg package_url "${CANDIDATE_URL}" --arg package_sha256 "${DEB_SHA256}" \
-            '{schema: 2, workflow_sha: $workflow_sha, source_ref: $source_ref, source_sha: $source_sha, build_run_id: $build_run_id, build_run_attempt: $build_run_attempt, package_url: $package_url, package_sha256: $package_sha256}' \
+            '{schema: 1, source_sha: $source_sha, build_run_id: $build_run_id, build_run_attempt: $build_run_attempt, package_url: $package_url, package_sha256: $package_sha256}' \
             > "${CANDIDATE_FILE}"
           echo "candidate_file=${CANDIDATE_FILE}" >> "${GITHUB_OUTPUT}"
 
       - name: Upload nightly candidate manifest
         if: ${{ steps.publish.outputs.candidate_file != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: nightly-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.publish.outputs.candidate_file }}
@@ -372,14 +374,10 @@ jobs:
   # live scripts (AppRole login, three-node Raft leader failover).
   #
   # GitHub-hosted ubuntu-latest, deliberately not the self-hosted sm-standard
-  # fleet: both lanes need a working Docker daemon, and the sm-standard-2 pool
-  # does not provide one. #8112 rerouted these lanes there and both died in
-  # seconds on "Docker is not available" while the package itself built and
-  # published fine, which kept the nightly chain from firing (its gate
-  # requires a successful build run). See also the banner in e2e-s3tests.yml
-  # and rustfs/backlog#1149.
+  # fleet: the HA failover script needs a working Docker daemon, and the
+  # self-hosted fleet is heterogeneous — a docker-dependent workflow has been
+  # burned by it before (see the banner in e2e-s3tests.yml, rustfs/backlog#1149).
   kms-vault-lane:
-    needs: resolve-source
     name: KMS live Vault lane
     runs-on: ubuntu-latest
     timeout-minutes: 90
@@ -398,10 +396,10 @@ jobs:
       NO_PROXY: 127.0.0.1,localhost
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-          ref: ${{ needs.resolve-source.outputs.source_sha }}
+          ref: ${{ env.NIGHTLY_BUILD_REF }}
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -479,7 +477,6 @@ jobs:
   # flake cannot mask the main lane's verdict, and vice versa. The script
   # provisions and tears down its own Docker cluster.
   kms-vault-ha-failover:
-    needs: resolve-source
     name: KMS Vault HA failover lane
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -488,10 +485,10 @@ jobs:
       NO_PROXY: 127.0.0.1,localhost
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-          ref: ${{ needs.resolve-source.outputs.source_sha }}
+          ref: ${{ env.NIGHTLY_BUILD_REF }}
 
       - name: Setup Rust environment
         uses: ./.github/actions/setup
@@ -508,20 +505,18 @@ jobs:
     name: Alert on scheduled failure
     needs: [build, kms-vault-lane, kms-vault-ha-failover]
     if: >-
-      github.repository == 'rustfs/rustfs' && (
-        always() && github.event_name == 'schedule' &&
-        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
-      )
+      always() && github.event_name == 'schedule' &&
+      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/nix-flake-update.yml

@@ -32,32 +32,31 @@ concurrency:
 
 jobs:
   update-flake:
-    if: github.repository == 'rustfs/rustfs'
     name: Update flake.lock
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 90
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         # persist-credentials-exempt: update-flake-lock pushes the branch and opens
         # the PR. It passes FLAKE_UPDATE_TOKEN to create-pull-request itself rather
         # than reusing .git/config, but that is unverified — exempt until a
         # workflow_dispatch run confirms it (rustfs/backlog#1602).
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@8d87e8d5e5b8a8309d4281094560f127d9a265f1 # v3.22.5
+        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3
 
       - name: Cache Nix
-        uses: DeterminateSystems/flakehub-cache-action@83282a8aef353db1d659d3bacf4a28b6683de0b3 # v3.22.5
+        uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3.20.0
 
       - name: Check Nix flake inputs
-        uses: DeterminateSystems/flake-checker-action@786422608c7bded2bbc9741ad9f91356842bf520 # v14
+        uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12
 
       - name: Update flake.lock
         id: update
-        uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3 # v29
+        uses: DeterminateSystems/update-flake-lock@fd9359ac79d0e912f1b4b947a48470b3e2799b56 # main
         with:
           git-author-name: houseme
           git-author-email: housemecn@gmail.com

.github/workflows/nix.yml

@@ -54,7 +54,7 @@ jobs:
   cancel-closed-pr-runs:
     name: Cancel Closed PR Runs
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Explain cancellation run
@@ -63,7 +63,7 @@ jobs:
   nix-validation:
     name: Nix Build & Check
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
       contents: read
@@ -72,12 +72,12 @@ jobs:
       NIX_CURL_FLAGS: -A cargo/stable
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@8d87e8d5e5b8a8309d4281094560f127d9a265f1 # v3.22.5
+        uses: DeterminateSystems/determinate-nix-action@4eea0b33e3d1f02ecfe37cf16e7204c424009606 # v3.21.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           extra-conf: |
@@ -86,10 +86,10 @@ jobs:
             max-jobs = 1
 
       - name: Cache Nix
-        uses: DeterminateSystems/flakehub-cache-action@83282a8aef353db1d659d3bacf4a28b6683de0b3 # v3.22.5
+        uses: DeterminateSystems/flakehub-cache-action@c01e819d047464c3edf6ba778f075952af5a3aa7 # v3.21.0
 
       - name: Check Nix Flake Inputs
-        uses: DeterminateSystems/flake-checker-action@786422608c7bded2bbc9741ad9f91356842bf520 # v14
+        uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12
         with:
           fail-mode: true
           ignore-missing-flake-lock: false

.github/workflows/oidc-keycloak.yml

@@ -20,9 +20,8 @@ on:
       - ".github/workflows/oidc-keycloak.yml"
       - "crates/config/src/constants/oidc.rs"
       - "crates/iam/src/federation/**"
-      - "crates/iam/src/oidc/**"
+      - "crates/iam/src/oidc.rs"
       - "rustfs/src/admin/handlers/oidc.rs"
-      - "rustfs/src/admin/service/oidc_config.rs"
       - "rustfs/src/admin/handlers/sts.rs"
       - "scripts/test/oidc_keycloak_live.sh"
       - "scripts/test/fixtures/keycloak-rustfs-ci-realm.json"
@@ -32,9 +31,8 @@ on:
       - ".github/workflows/oidc-keycloak.yml"
       - "crates/config/src/constants/oidc.rs"
       - "crates/iam/src/federation/**"
-      - "crates/iam/src/oidc/**"
+      - "crates/iam/src/oidc.rs"
       - "rustfs/src/admin/handlers/oidc.rs"
-      - "rustfs/src/admin/service/oidc_config.rs"
       - "rustfs/src/admin/handlers/sts.rs"
       - "scripts/test/oidc_keycloak_live.sh"
       - "scripts/test/fixtures/keycloak-rustfs-ci-realm.json"
@@ -59,7 +57,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -74,11 +72,6 @@ jobs:
       - name: Build RustFS
         run: cargo build --locked -p rustfs --bin rustfs
 
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
       - name: Install pinned request signer
         run: |
           python3 -m pip install --user --upgrade pip "awscurl==0.44"
@@ -89,7 +82,7 @@ jobs:
 
       - name: Upload service logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: oidc-keycloak-live-${{ github.run_number }}
           path: ${{ runner.temp }}/rustfs-keycloak-live-*/**/*.log
@@ -108,10 +101,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/on-demand-migration-interop.yml

@@ -69,7 +69,8 @@ env:
 jobs:
   minio-source:
     name: MinIO source (read-through, list-through, backfill)
-    # Keep this scheduled interoperability lane scoped to the upstream repo.
+    # Skip on forks: needs this repository's runners and is not a contributor
+    # gate.
     if: github.repository == 'rustfs/rustfs'
     runs-on: ubuntu-latest
     timeout-minutes: 90
@@ -92,7 +93,7 @@ jobs:
       NEXTEST_LISTING: ${{ github.workspace }}/artifacts/odm-interop/minio/selection.json
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -107,15 +108,11 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p artifacts/odm-interop/minio
-          docker build -t rustfs-odm-interop-minio \
-            -f crates/rio-v2/tests/minio_fixture_lab/Dockerfile \
-            crates/rio-v2/tests/minio_fixture_lab
           docker run -d --name rustfs-odm-interop-minio \
-            --entrypoint /usr/local/bin/minio \
             -e "MINIO_ROOT_USER=${MINIO_ROOT_USER}" \
             -e "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}" \
             -p 9100:9000 \
-            rustfs-odm-interop-minio server /data
+            minio/minio:RELEASE.2025-09-07T16-13-09Z server /data
           for _ in $(seq 1 120); do
             curl -fsS http://127.0.0.1:9100/minio/health/live >/dev/null 2>&1 && break
             sleep 1
@@ -135,7 +132,7 @@ jobs:
             s3api create-bucket --bucket "${RUSTFS_ODM_INTEROP_BUCKET}"
 
       - name: Build the RustFS binary under test
-        run: python3 scripts/e2e_binary.py build --bins
+        run: cargo build --locked -p rustfs --bins
 
       # The lane selects tests by module, so a rename would quietly shrink it.
       # The committed digest in .config/e2e-odm-interop-selection.txt fails
@@ -146,7 +143,7 @@ jobs:
           python3 ./scripts/check_test_wiring.py --check-profile e2e-odm-interop "${NEXTEST_LISTING}"
 
       - name: Run the interop cases against MinIO
-        run: python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-odm-interop -p e2e_test --no-tests=fail
+        run: cargo nextest run --profile e2e-odm-interop -p e2e_test --no-tests=fail
 
       - name: Build the MinIO interop report
         if: always()
@@ -169,7 +166,7 @@ jobs:
 
       - name: Upload the MinIO interop report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: odm-interop-minio-${{ github.run_number }}-${{ github.run_attempt }}
           path: |
@@ -186,7 +183,7 @@ jobs:
   cloud-source:
     name: ${{ matrix.provider }} source (three-case minimum)
     if: github.repository == 'rustfs/rustfs'
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     strategy:
       fail-fast: false
@@ -240,7 +237,7 @@ jobs:
 
       - name: Checkout repository
         if: steps.credentials.outputs.present == 'true'
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -254,7 +251,7 @@ jobs:
 
       - name: Build the RustFS binary under test
         if: steps.credentials.outputs.present == 'true'
-        run: python3 scripts/e2e_binary.py build --bins
+        run: cargo build --locked -p rustfs --bins
 
       # A filterset that matches nothing is valid, so the count is asserted
       # rather than inferred from a green run.
@@ -275,7 +272,7 @@ jobs:
       - name: Run the three-case minimum
         if: steps.credentials.outputs.present == 'true'
         run: |
-          python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-odm-interop -p e2e_test \
+          cargo nextest run --profile e2e-odm-interop -p e2e_test \
             -E "${CLOUD_CASE_FILTER}" --no-tests=fail
 
       - name: Build the ${{ matrix.provider }} interop report
@@ -289,7 +286,7 @@ jobs:
 
       - name: Upload the ${{ matrix.provider }} interop report
         if: always() && steps.credentials.outputs.present == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: odm-interop-${{ matrix.provider }}-${{ github.run_number }}-${{ github.run_attempt }}
           path: |
@@ -309,10 +306,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package.yml

@@ -25,10 +25,9 @@
 #
 # Flow:
 # 1. Resolve and validate the selected Build workflow run and source identity
-# 2. Download Linux binaries (x86_64-gnu, aarch64-gnu, x86_64-musl,
-#    aarch64-musl) from build artifacts
-# 3. Build DEB packages for amd64 and arm64, gnu and musl variants
-# 4. Build RPM packages for x86_64 and aarch64, gnu and musl variants
+# 2. Download Linux binaries (x86_64-gnu, aarch64-gnu) from build artifacts
+# 3. Build DEB packages for amd64 and arm64
+# 4. Build RPM packages for x86_64 and aarch64
 # 5. Upload all packages to Cloudflare R2 and the GitHub release
 
 name: Package DEB/RPM
@@ -77,7 +76,7 @@ jobs:
       (github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.event == 'push' &&
        github.event.workflow_run.head_branch != 'main')
-    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
       version: ${{ steps.resolve.outputs.version }}
@@ -123,7 +122,7 @@ jobs:
           semver_core='(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)'
           prerelease_id='(alpha|beta|rc)\.(0|[1-9][0-9]*)'
           if [[ -n "$TAG" ]]; then
-            if [[ "$TAG" =~ ^${semver_core}(-${prerelease_id})?-preview\.(0|[1-9][0-9]*)$ ]]; then
+            if [[ "$TAG" =~ ^${semver_core}-${prerelease_id}-preview\.(0|[1-9][0-9]*)$ ]]; then
               BUILD_TYPE=preview
             elif [[ "$TAG" =~ ^${semver_core}-${prerelease_id}$ ]]; then
               BUILD_TYPE=prerelease
@@ -225,11 +224,11 @@ jobs:
           echo "  Build run ID: $BUILD_RUN_ID"
           echo "  Build run number: $RUN_NUMBER"
 
-  # Build DEB and RPM packages for each architecture and libc variant
+  # Build DEB and RPM packages for each architecture
   package:
-    name: Package (${{ matrix.arch }}-${{ matrix.libc }})
+    name: Package (${{ matrix.arch }})
     needs: resolve
-    runs-on: ubuntu-latest # gh CLI required; the sm-standard-2 fleet does not ship it
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -237,38 +236,16 @@ jobs:
       matrix:
         include:
           - arch: x86_64
-            libc: gnu
             deb_arch: amd64
             rpm_arch: x86_64
             artifact_name: "rustfs-linux-x86_64-gnu"
-            # gnu binaries dynamically link glibc; musl binaries are static
-            # and run without a libc dependency.
-            deb_depends: "libc6 (>= 2.31)"
-            rpm_depends: "glibc >= 2.31"
           - arch: aarch64
-            libc: gnu
             deb_arch: arm64
             rpm_arch: aarch64
             artifact_name: "rustfs-linux-aarch64-gnu"
-            deb_depends: "libc6 (>= 2.31)"
-            rpm_depends: "glibc >= 2.31"
-          - arch: x86_64
-            libc: musl
-            deb_arch: amd64
-            rpm_arch: x86_64
-            artifact_name: "rustfs-linux-x86_64-musl"
-            deb_depends: ""
-            rpm_depends: ""
-          - arch: aarch64
-            libc: musl
-            deb_arch: arm64
-            rpm_arch: aarch64
-            artifact_name: "rustfs-linux-aarch64-musl"
-            deb_depends: ""
-            rpm_depends: ""
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -279,17 +256,17 @@ jobs:
           BUILD_TYPE: ${{ needs.resolve.outputs.build_type }}
           SOURCE_VERSION: ${{ needs.resolve.outputs.version }}
           DEV_SEQUENCE: ${{ needs.resolve.outputs.dev_sequence }}
-          ARCH: ${{ matrix.rpm_arch }}
-          LIBC: ${{ matrix.libc }}
+          DEB_ARCH: ${{ matrix.deb_arch }}
+          RPM_ARCH: ${{ matrix.rpm_arch }}
         run: |
           set -euo pipefail
 
           normalized=$(./scripts/release/package_versions.sh \
-            "$BUILD_TYPE" "$SOURCE_VERSION" "$DEV_SEQUENCE" "$ARCH" "$LIBC")
+            "$BUILD_TYPE" "$SOURCE_VERSION" "$DEV_SEQUENCE" "$DEB_ARCH" "$RPM_ARCH")
           printf '%s\n' "$normalized" >> "$GITHUB_OUTPUT"
 
       - name: Download binary artifact from build run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           pattern: ${{ matrix.artifact_name }}*
           path: ./binary-artifact
@@ -331,8 +308,6 @@ jobs:
           DEB_VERSION: ${{ steps.versions.outputs.deb_version }}
           DEB_ARCH: ${{ matrix.deb_arch }}
           DEB_FILE: ${{ steps.versions.outputs.deb_file }}
-          DEB_DEPENDS: ${{ matrix.deb_depends }}
-          LIBC: ${{ matrix.libc }}
         run: |
           set -euo pipefail
 
@@ -353,15 +328,10 @@ jobs:
 
           cat > "${PKG_DIR}/etc/default/rustfs" << 'ENVEOF'
           # RustFS Environment Configuration
-          # See https://docs.rustfs.com for more information
-          # RUSTFS_ACCESS_KEY=<changeme>
-          # RUSTFS_SECRET_KEY=<changeme>
+          # See https://rustfs.com/docs/ for more information
           # RUSTFS_VOLUMES=""
-          # RUSTFS_ADDRESS=":9000"
-          # RUSTFS_CONSOLE_ADDRESS=":9001"
-          # RUSTFS_CONSOLE_ENABLE=true
-          # RUSTFS_OBS_LOGGER_LEVEL=error
-          # RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"
+          # RUSTFS_ROOT_USER=""
+          # RUSTFS_ROOT_PASSWORD=""
           ENVEOF
 
           cat > "${PKG_DIR}/DEBIAN/control" << EOF
@@ -370,17 +340,9 @@ jobs:
           Section: utils
           Priority: optional
           Architecture: ${DEB_ARCH}
-          EOF
-
-          # gnu binaries dynamically link glibc and must declare it; musl
-          # binaries are statically linked and need no libc dependency.
-          if [[ -n "$DEB_DEPENDS" ]]; then
-            echo "Depends: ${DEB_DEPENDS}" >> "${PKG_DIR}/DEBIAN/control"
-          fi
-
-          cat >> "${PKG_DIR}/DEBIAN/control" << EOF
+          Depends: libc6 (>= 2.31)
           Maintainer: RustFS Team <support@rustfs.com>
-          Description: High-performance distributed object storage (${LIBC} build)
+          Description: High-performance distributed object storage
            RustFS is a high-performance distributed object storage software
            built using Rust. It is compatible with MinIO and S3 API.
           Homepage: https://rustfs.com
@@ -392,13 +354,37 @@ jobs:
           /etc/default/rustfs
           CONFFILES
 
-          ./scripts/release/package_service_scripts.sh after-install > "${PKG_DIR}/DEBIAN/postinst"
+          cat > "${PKG_DIR}/DEBIAN/postinst" << 'POSTINST'
+          #!/bin/bash
+          set -e
+          if ! getent passwd rustfs > /dev/null 2>&1; then
+              useradd -r -s /bin/false -d /opt/rustfs rustfs
+          fi
+          mkdir -p /opt/rustfs /data/rustfs /var/log/rustfs
+          chown rustfs:rustfs /opt/rustfs /data/rustfs /var/log/rustfs
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          echo "RustFS installed. Configure /etc/default/rustfs then: systemctl start rustfs"
+          POSTINST
           chmod 755 "${PKG_DIR}/DEBIAN/postinst"
 
-          ./scripts/release/package_service_scripts.sh before-remove > "${PKG_DIR}/DEBIAN/prerm"
+          cat > "${PKG_DIR}/DEBIAN/prerm" << 'PRERM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ] && systemctl is-active --quiet rustfs; then
+              systemctl stop rustfs
+          fi
+          PRERM
           chmod 755 "${PKG_DIR}/DEBIAN/prerm"
 
-          ./scripts/release/package_service_scripts.sh after-remove > "${PKG_DIR}/DEBIAN/postrm"
+          cat > "${PKG_DIR}/DEBIAN/postrm" << 'POSTRM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          POSTRM
           chmod 755 "${PKG_DIR}/DEBIAN/postrm"
 
           cp LICENSE "${PKG_DIR}/usr/share/doc/rustfs/"
@@ -422,38 +408,24 @@ jobs:
           RPM_RELEASE: ${{ steps.versions.outputs.rpm_release }}
           RPM_ARCH: ${{ matrix.rpm_arch }}
           RPM_FILE: ${{ steps.versions.outputs.rpm_file }}
-          RPM_DEPENDS: ${{ matrix.rpm_depends }}
-          LIBC: ${{ matrix.libc }}
         run: |
           set -euo pipefail
 
-          echo "Building RPM for ${RPM_ARCH} (${LIBC})"
+          echo "Building RPM for ${RPM_ARCH}"
 
           sudo apt-get update && sudo apt-get install -y ruby ruby-dev build-essential rpm
           sudo gem install fpm
           ./scripts/test_package_versions.sh --require-package-managers
 
-          # gnu binaries dynamically link glibc and must declare it; musl
-          # binaries are statically linked and need no libc dependency.
-          depends_args=()
-          if [[ -n "$RPM_DEPENDS" ]]; then
-            depends_args+=(--depends "$RPM_DEPENDS")
-          fi
-
           # Create config file for fpm (DEB build creates it in its package dir structure,
           # but fpm needs the file to exist before packaging)
           mkdir -p ./tmp-pkg/etc/default
           cat > ./tmp-pkg/etc/default/rustfs << 'ENVEOF'
           # RustFS Environment Configuration
-          # See https://docs.rustfs.com for more information
-          # RUSTFS_ACCESS_KEY=<changeme>
-          # RUSTFS_SECRET_KEY=<changeme>
+          # See https://rustfs.com/docs/ for more information
           # RUSTFS_VOLUMES=""
-          # RUSTFS_ADDRESS=":9000"
-          # RUSTFS_CONSOLE_ADDRESS=":9001"
-          # RUSTFS_CONSOLE_ENABLE=true
-          # RUSTFS_OBS_LOGGER_LEVEL=error
-          # RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"
+          # RUSTFS_ROOT_USER=""
+          # RUSTFS_ROOT_PASSWORD=""
           ENVEOF
 
           fpm -s dir -t rpm \
@@ -462,18 +434,40 @@ jobs:
             --iteration "$RPM_RELEASE" \
             --architecture "$RPM_ARCH" \
             --package "$RPM_FILE" \
-            "${depends_args[@]}" \
-            --description "High-performance distributed object storage (${LIBC} build)" \
+            --depends "glibc >= 2.31" \
             --maintainer "RustFS Team <support@rustfs.com>" \
+            --description "High-performance distributed object storage" \
             --url "https://rustfs.com" \
             --license "Apache-2.0" \
-            --before-install <(./scripts/release/package_service_scripts.sh rpm-before-install) \
-            --before-upgrade <(./scripts/release/package_service_scripts.sh rpm-before-upgrade) \
-            --after-install <(./scripts/release/package_service_scripts.sh after-install) \
-            --after-upgrade <(./scripts/release/package_service_scripts.sh after-install) \
-            --before-remove <(./scripts/release/package_service_scripts.sh before-remove) \
-            --after-remove <(./scripts/release/package_service_scripts.sh after-remove) \
-            --rpm-posttrans <(./scripts/release/package_service_scripts.sh rpm-posttrans) \
+            --after-install <(cat <<'POSTINST'
+          #!/bin/bash
+          set -e
+          if ! getent passwd rustfs > /dev/null 2>&1; then
+              useradd -r -s /bin/false -d /opt/rustfs rustfs
+          fi
+          mkdir -p /opt/rustfs /data/rustfs /var/log/rustfs
+          chown rustfs:rustfs /opt/rustfs /data/rustfs /var/log/rustfs
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          POSTINST
+            ) \
+            --before-remove <(cat <<'PRERM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ] && systemctl is-active --quiet rustfs; then
+              systemctl stop rustfs
+          fi
+          PRERM
+            ) \
+            --after-remove <(cat <<'POSTRM'
+          #!/bin/bash
+          set -e
+          if [ -d /run/systemd/system ]; then
+              systemctl daemon-reload
+          fi
+          POSTRM
+            ) \
             --config-files /etc/default/rustfs \
             ./bin/rustfs=/usr/bin/rustfs \
             ./tmp-pkg/etc/default/rustfs=/etc/default/rustfs \
@@ -495,16 +489,16 @@ jobs:
           echo "✅ RPM built: $RPM_FILE"
 
       - name: Upload packages to artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: packages-${{ matrix.arch }}-${{ matrix.libc }}
+          name: packages-${{ matrix.arch }}
           path: |
             *.deb
             *.rpm
           retention-days: 30
 
       - name: Upload packages to Cloudflare R2
-        if: needs.resolve.outputs.build_type != 'preview' && env.R2_ACCESS_KEY_ID != ''
+        if: env.R2_ACCESS_KEY_ID != ''
         env:
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
@@ -593,11 +587,10 @@ jobs:
             for f in "$DEB_FILE" "$RPM_FILE"; do
               if [[ -n "$f" && -f "$f" ]]; then
                 base="$(basename "$f")"
-                # GitHub stores release asset names with '~' normalized to '.'.
-                # Current package file names embed the raw tag and contain no
-                # '~', but older releases may still ship such assets, so the
-                # checksum entries must reference the name as stored on the
-                # release.
+                # GitHub stores release asset names with '~' normalized to '.'
+                # (e.g. rustfs_1.0.0~rc.2_amd64.deb is stored as
+                # rustfs_1.0.0.rc.2_amd64.deb), so checksum entries must
+                # reference the name as stored on the release.
                 github_base="${base//\~/.}"
                 # Remove any stale entry (both naming variants), then append
                 grep -Fv -- "$base" "$checksum_file" > "${checksum_file}.tmp" || true
@@ -619,7 +612,7 @@ jobs:
     name: Summary
     needs: [ resolve, package ]
     if: always()
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Print summary

.github/workflows/performance-ab.yml

@@ -49,7 +49,6 @@ env:
 
 jobs:
   warp-ab:
-    if: github.repository == 'rustfs/rustfs'
     name: Warp A/B budget gate
     runs-on: sm-standard-2
     # A normal nightly restores the last successful binary and builds only the
@@ -58,7 +57,7 @@ jobs:
     timeout-minutes: 180
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           fetch-depth: 0 # baseline may be an earlier successful scheduled head
@@ -95,7 +94,7 @@ jobs:
       - name: Find last successful scheduled baseline
         id: scheduled_baseline
         if: github.event_name == 'schedule'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           result-encoding: string
           script: |
@@ -272,7 +271,7 @@ jobs:
 
       - name: Upload A/B results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: hotpath-warp-ab-${{ github.run_number }}
           # Includes per-cell median_summary.csv / baseline_compare.csv, both gates,
@@ -365,20 +364,18 @@ jobs:
     # composite action already reports cancelled/timed-out jobs in the issue
     # body.
     if: >-
-      github.repository == 'rustfs/rustfs' && (
-        always() && github.event_name == 'schedule' &&
-        (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
-      )
+      always() && github.event_name == 'schedule' &&
+      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/runner-hygiene.yml

@@ -42,13 +42,12 @@ concurrency:
 
 jobs:
   check-ephemerality:
-    if: github.repository == 'rustfs/rustfs'
     name: Check runner ephemerality
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -66,17 +65,17 @@ jobs:
     # Same ci-8 mechanism as coverage.yml, audit.yml and the nightly lanes:
     # scheduled runs file a tracking issue, manual dispatch stays quiet so
     # debugging never produces a spurious alert.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/rustfs-fault-tolerance-matrix.yml

@@ -1,221 +0,0 @@
-# RustFS Fault-Tolerance (degradation) Matrix Sweep
-#
-# Exhaustive topology x EC outage sweep, complementary to the scenario suite
-# (rustfs-fault-tolerance-test.yml). For each topology (nodes x drives per
-# node) and each EC level P in 1..N*drives/2 the runner installs that exact
-# cluster shape and drives progressive node outages plus recovery:
-#
-#   M-<topo>EC<P>-full   full-capacity reads/writes must succeed
-#   M-<topo>EC<P>-n<k>   with k nodes online: reads succeed iff the online
-#                        drives cover the read quorum (N-P), writes iff they
-#                        cover the write quorum (N-P+1); probes below quorum
-#                        assert the expected outage
-#   M-<topo>EC<P>-rec    after restoring every node, reads/writes succeed
-#
-# 9 topologies x EC levels = 36 combinations, 300 cases. The full sweep runs
-# 3-5 hours and is dispatched on demand (e.g. after a nightly chain goes
-# green), not nightly. Case ids and expectations come from product source
-# (default_parity_count, erasure set sizing) via rustfs/auto-testing.
-
-name: RustFS Fault-Tolerance Matrix
-
-on:
-  workflow_dispatch:
-    inputs:
-      package_url:
-        description: 'Direct .deb URL. Required unless the nightly default is wanted.'
-        required: false
-        type: string
-      auto_testing_ref:
-        description: 'auto-testing branch, tag, or SHA (defaults to main)'
-        required: false
-        default: main
-        type: string
-      matrix_topo:
-        description: 'Topology filter like 4x2; empty sweeps all nine topologies'
-        required: false
-        default: ''
-        type: string
-      matrix_ec:
-        description: 'EC/parity filter; empty sweeps every EC level'
-        required: false
-        default: ''
-        type: string
-      cleanup_before:
-        description: 'Reset the nodes before the test (DESTROYS existing data/config)'
-        type: boolean
-        default: true
-      cleanup_after:
-        description: 'Reset the nodes after the test (DESTROYS test data/config)'
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-# The suite stops services and revokes drive access on the shared fleet; only one
-# functional suite may touch the environment at a time.
-concurrency:
-  group: rustfs-shared-functional-tests-v2
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-
-jobs:
-  fault-tolerance-matrix:
-    runs-on: smoke-testing
-    # The full 38-combination sweep takes 3-5h; 360 is the runner job ceiling.
-    timeout-minutes: 360
-    steps:
-      - name: Initialize functional evidence
-        id: evidence
-        run: |
-          set -euo pipefail
-          umask 077
-          FUNCTIONAL_ARTIFACTS_DIR="${RUNNER_TEMP}/rustfs-fault-tolerance-matrix-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          mkdir -- "${FUNCTIONAL_ARTIFACTS_DIR}" "${FUNCTIONAL_ARTIFACTS_DIR}-scratch" "${FUNCTIONAL_ARTIFACTS_DIR}/evidence"
-          {
-            printf 'FUNCTIONAL_ARTIFACTS_DIR=%s\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'LOG_FILE=%s/suite.log\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'REPORT_FILE=%s/report.md\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'RESULTS_FILE=%s/results.json\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'EVIDENCE_DIR=%s/evidence\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-          } >> "${GITHUB_ENV}"
-
-      - name: Checkout auto-testing scripts
-        timeout-minutes: 5
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ inputs.auto_testing_ref }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
-
-      - name: Record auto-testing revision
-        run: |
-          set -euo pipefail
-          AUTO_TESTING_SHA="$(git -C auto-testing rev-parse HEAD)"
-          printf 'AUTO_TESTING_SHA=%s\n' "${AUTO_TESTING_SHA}" >> "${GITHUB_ENV}"
-          echo "auto-testing revision: ${AUTO_TESTING_SHA}"
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          aws --version
-          echo "auto-testing: ${AUTO_TESTING_SHA}"
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        timeout-minutes: 5
-        if: ${{ inputs.cleanup_before != 'false' }}
-        run: |
-          ./auto-testing/rustfs-fault-tolerance-test.sh --cleanup -y --log-file "${LOG_FILE}"
-
-      - name: Run matrix sweep (topology x EC outage combinations)
-        timeout-minutes: 350
-        id: test
-        # No continue-on-error: an UNEXPECTED verdict (a probe that should
-        # fail by quorum math but passes, or vice versa) is the finding this
-        # sweep exists to surface, and the red run is the signal until matrix
-        # runs get backlog integration like the scenario suite has.
-        env:
-          MATRIX_EC: ${{ inputs.matrix_ec }}
-        run: |
-          set -euo pipefail
-          ARGS=(--matrix -y --package-url "${{ inputs.package_url || env.RUSTFS_NIGHTLY_PACKAGE_URL }}" --log-file "${LOG_FILE}" --results-file "${RESULTS_FILE}")
-          if [ -n "${{ inputs.matrix_topo }}" ]; then
-            # Trailing value form: consumed as `--matrix-topo <topo> [ec]`.
-            ARGS+=(--matrix-topo "${{ inputs.matrix_topo }}")
-            if [ -n "${MATRIX_EC}" ]; then
-              ARGS+=("${MATRIX_EC}")
-            fi
-          fi
-          ./auto-testing/rustfs-fault-tolerance-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        timeout-minutes: 2
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        run: |
-          set -euo pipefail
-          {
-            echo "# RustFS fault-tolerance matrix report"
-            echo ""
-            echo "- Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-            echo "- Package: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-            echo "- auto-testing: \`${AUTO_TESTING_SHA}\`"
-            echo "- Topology filter: ${{ inputs.matrix_topo || 'all (10 topologies)' }}"
-            echo "- EC filter: ${{ inputs.matrix_ec || 'all levels' }}"
-            echo ""
-            echo "## Per-probe results"
-            echo ""
-            echo '```'
-            grep -E '^FT-(CASE|COMPLETE|SUMMARY|REPORT)' "${LOG_FILE}" || echo "(no FT-CASE lines found)"
-            echo '```'
-            echo ""
-            echo "## Health snapshots"
-            echo ""
-            for f in "${FUNCTIONAL_ARTIFACTS_DIR}"/evidence/*.code; do
-              [ -e "${f}" ] || continue
-              printf '%s -> %s\n' "$(basename "${f}" .code)" "$(cat "${f}")"
-            done
-          } > "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-          # An unfiltered sweep must land exactly 300 cases (36 topology x EC
-          # combinations at 2*(nodes+1) cases each); filtered sweeps are held
-          # to internal consistency. Missing/harness-error rows always fail.
-          EXPECTED_TOTAL=""
-          if [ -z "${{ inputs.matrix_topo }}" ] && [ -z "${MATRIX_EC}" ]; then
-            EXPECTED_TOTAL=300
-          fi
-          jq -e --arg testing_sha "${AUTO_TESTING_SHA}" --argjson expected_total "${EXPECTED_TOTAL:-null}" '
-            .schema_version == 1 and
-            .auto_testing_sha == $testing_sha and
-            .complete == true and
-            .counts.expected == ($expected_total // .counts.expected) and
-            .counts.expected == .counts.seen and
-            .counts.harness_errors == 0 and
-            (.expected_cases | length) == .counts.expected and
-            (.expected_cases | unique | length) == .counts.expected and
-            (.seen_cases | length) == .counts.seen and
-            (.missing_cases | length) == 0 and
-            (.harness_errors | length) == 0 and
-            (.cases | length) == .counts.seen and
-            ([.cases[].case_id] | unique | length) == .counts.seen and
-            ([.cases[].case_id] | sort) == (.expected_cases | sort) and
-            all(.cases[]; (.case_id | startswith("M-")) and (.verdict == "pass" or .verdict == "known-divergence" or .verdict == "UNEXPECTED")) and
-            .counts.unexpected == ([.cases[] | select(.verdict == "UNEXPECTED")] | length) and
-            .counts.known_divergence == ([.cases[] | select(.verdict == "known-divergence")] | length)
-          ' "${RESULTS_FILE}" >/dev/null
-
-      - name: Upload test logs & evidence
-        timeout-minutes: 2
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: rustfs-fault-tolerance-matrix-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/report.md
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/results.json
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/suite.log
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/evidence/
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        timeout-minutes: 5
-        if: ${{ always() && inputs.cleanup_after != 'false' }}
-        run: |
-          ./auto-testing/rustfs-fault-tolerance-test.sh --cleanup -y --log-file "${LOG_FILE}" || true

.github/workflows/rustfs-fault-tolerance-test.yml

@@ -1,393 +0,0 @@
-# RustFS Fault-Tolerance (degradation) Test
-#
-# Scenario suite for the 2026-09 degradation report: verifies read/write
-# behavior under drive and node loss against the erasure-coding contract and
-# snapshots health-endpoint responses at every tier.
-#
-#   A  single-node 4 drives (SNMD): revoke access to 1/2/3 drives, restore
-#   B  multi-node 4x1 (one drive per node): stop 1/2/3 nodes, restore
-#   C  multi-node 4x4 (16 drives, EC:4): stop 1 node (read-quorum boundary),
-#      stop 2 nodes, restore
-#   C2 multi-node 4x4 with EC:8: 2 nodes down puts 8 drives online -- reads
-#      satisfy the EC read quorum while the lock majority is broken (the
-#      reported divergence window: reads 503 with lock_quorum_unavailable)
-#   D  multi-node 4x1: stop 1/2 nodes, then restore
-#
-# Expectations come from product source (default_parity_count, erasure set
-# sizing). By default a "reads refused although the read quorum is met"
-# observation is reported as known-divergence without failing the suite; the
-# strict input turns those into failures once the product behavior changes.
-
-name: RustFS Fault-Tolerance Test
-
-on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
-  workflow_dispatch:
-    inputs:
-      package_url:
-        description: 'Direct .deb URL. Required unless the nightly default is wanted.'
-        required: false
-        type: string
-      auto_testing_ref:
-        description: 'auto-testing branch, tag, or SHA (defaults to main)'
-        required: false
-        default: main
-        type: string
-      strict:
-        description: 'Fail the suite when reads are refused despite a met read quorum'
-        type: boolean
-        default: false
-      cleanup_before:
-        description: 'Reset the nodes before the test (DESTROYS existing data/config)'
-        type: boolean
-        default: true
-      cleanup_after:
-        description: 'Reset the nodes after the test (DESTROYS test data/config)'
-        type: boolean
-        default: true
-  repository_dispatch:
-    # Chain handoff: dispatched when the replication suite finishes, ahead of
-    # the performance suite.
-    types: [rustfs-chain-fault-tolerance]
-
-permissions:
-  contents: read
-
-# The suite stops services and revokes drive access on the shared fleet; only one
-# functional suite may touch the environment at a time.
-concurrency:
-  group: rustfs-shared-functional-tests-v2
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-
-jobs:
-  fault-tolerance-test:
-    runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Initialize functional evidence
-        id: evidence
-        run: |
-          set -euo pipefail
-          umask 077
-          FUNCTIONAL_ARTIFACTS_DIR="${RUNNER_TEMP}/rustfs-fault-tolerance-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          mkdir -- "${FUNCTIONAL_ARTIFACTS_DIR}" "${FUNCTIONAL_ARTIFACTS_DIR}-scratch" "${FUNCTIONAL_ARTIFACTS_DIR}/evidence"
-          {
-            printf 'FUNCTIONAL_ARTIFACTS_DIR=%s\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'LOG_FILE=%s/suite.log\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'REPORT_FILE=%s/report.md\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'RESULTS_FILE=%s/results.json\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'EVIDENCE_DIR=%s/evidence\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-          } >> "${GITHUB_ENV}"
-
-      # Pin the private suite checkout when the chain supplies a candidate.
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        timeout-minutes: 5
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || inputs.auto_testing_ref || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
-
-      - name: Record auto-testing revision
-        run: |
-          set -euo pipefail
-          AUTO_TESTING_SHA="$(git -C auto-testing rev-parse HEAD)"
-          printf 'AUTO_TESTING_SHA=%s\n' "${AUTO_TESTING_SHA}" >> "${GITHUB_ENV}"
-          echo "auto-testing revision: ${AUTO_TESTING_SHA}"
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          aws --version
-          echo "auto-testing: ${AUTO_TESTING_SHA}"
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        timeout-minutes: 5
-        if: ${{ inputs.cleanup_before != 'false' }}
-        run: |
-          ./auto-testing/rustfs-fault-tolerance-test.sh --cleanup -y --log-file "${LOG_FILE}"
-
-      - name: Stage verified candidate package
-        id: chain_package
-        if: ${{ inputs.chain_manifest != '' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/prepare_functional_package.py prepare
-
-      - name: Run fault-tolerance scenarios (A, B, C, C2, D, E)
-        timeout-minutes: 45
-        id: test
-        # Standalone case failures are reported by the backlog manager.
-        # Chain evidence separately requires complete passing cases.
-        continue-on-error: true
-        run: |
-          ARGS=(--all -y --package-url "${{ steps.chain_package.outputs.package_url || inputs.package_url || env.RUSTFS_NIGHTLY_PACKAGE_URL }}" --log-file "${LOG_FILE}" --results-file "${RESULTS_FILE}")
-          if [ "${{ inputs.strict }}" = "true" ]; then
-            ARGS+=(--strict)
-          fi
-          ./auto-testing/rustfs-fault-tolerance-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        timeout-minutes: 2
-        id: chain_report
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        run: |
-          set -euo pipefail
-          {
-            echo "# RustFS fault-tolerance test report"
-            echo ""
-            echo "- Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-            echo "- Package: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-            echo "- auto-testing: \`${AUTO_TESTING_SHA}\`"
-            echo "- Strict mode: ${{ inputs.strict || 'false' }}"
-            echo ""
-            echo "## Per-probe results"
-            echo ""
-            echo '```'
-            grep -E '^FT-(CASE|COMPLETE|SUMMARY|REPORT)' "${LOG_FILE}" || echo "(no FT-CASE lines found)"
-            echo '```'
-            echo ""
-            echo "## Health snapshots"
-            echo ""
-            for f in "${FUNCTIONAL_ARTIFACTS_DIR}"/evidence/*.code; do
-              [ -e "${f}" ] || continue
-              printf '%s -> %s\n' "$(basename "${f}" .code)" "$(cat "${f}")"
-            done
-          } > "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          printf 'complete=false\n' >> "${GITHUB_OUTPUT}"
-          jq -e --arg testing_sha "${AUTO_TESTING_SHA}" '
-            .schema_version == 1 and
-            .auto_testing_sha == $testing_sha and
-            .selected_scenarios == ["A", "B", "C", "C2", "D", "E"] and
-            .complete == true and
-            .counts.expected == 44 and
-            .counts.seen == 44 and
-            .counts.harness_errors == 0 and
-            (.expected_cases | length) == 44 and
-            (.expected_cases | unique | length) == 44 and
-            (.seen_cases | length) == 44 and
-            (.seen_cases | unique | length) == 44 and
-            (.seen_cases | sort) == (.expected_cases | sort) and
-            (.missing_cases | length) == 0 and
-            (.harness_errors | length) == 0 and
-            (.cases | length) == 44 and
-            ([.cases[].case_id] | sort) == (.expected_cases | sort) and
-            ([.cases[].case_id] | unique | length) == 44 and
-            all(.cases[]; .verdict == "pass" or .verdict == "known-divergence" or .verdict == "UNEXPECTED") and
-            .counts.unexpected == ([.cases[] | select(.verdict == "UNEXPECTED")] | length) and
-            .counts.known_divergence == ([.cases[] | select(.verdict == "known-divergence")] | length)
-          ' "${RESULTS_FILE}" >/dev/null
-          printf 'complete=true\n' >> "${GITHUB_OUTPUT}"
-
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Signal-based lifecycle: dedups against open issues by label
-        # (fault-tolerance + FT case), labels new issues (functional-test,
-        # category, case IDs, env), and closes fixed issues after a fully
-        # green run. Never acts on cancelled runs. Logic lives in
-        # auto-testing/scripts/issue_manager.py, which parses the
-        # FT-CASE verdict lines from the suite log.
-        if: ${{ always() && steps.evidence.outcome == 'success' && steps.chain_report.outputs.complete == 'true' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'fault-tolerance'
-          SUITE_LABEL: 'Fault-Tolerance'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
-            exit 0
-          fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
-            exit 0
-          fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
-
-      - name: Upload functional report to dashboard
-        timeout-minutes: 2
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: ${{ env.REPORT_FILE }}
-          SUITE: fault-tolerance
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          B64_FILE="$(mktemp)"
-          python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}" > "${B64_FILE}"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" --arg sha "${SHA}" \
-              '{message:$msg, content:($content|rtrimstr("\n")), sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" \
-              '{message:$msg, content:($content|rtrimstr("\n"))}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-          echo "dashboard updated: ${REPORT_PATH}"
-
-      - name: Upload test logs & evidence
-        timeout-minutes: 2
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: rustfs-fault-tolerance-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/report.md
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/results.json
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/suite.log
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/evidence/
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        timeout-minutes: 5
-        if: ${{ always() && inputs.cleanup_after != 'false' }}
-        run: |
-          ./auto-testing/rustfs-fault-tolerance-test.sh --cleanup -y --log-file "${LOG_FILE}" || true
-
-      - name: "Continue functional chain (next: Performance)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff retries, then files an alert issue in rustfs/backlog.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-performance' \
-              -F 'client_payload[from_suite]=fault-tolerance'; then
-              echo "dispatched next suite Performance (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Performance after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after fault-tolerance (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **fault-tolerance** to **Performance** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-performance'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-performance'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS fault-tolerance test failed"
-          echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-          echo "See the uploaded log artifact and FT-CASE lines for details."
-
-      - name: Remove verified candidate package
-        if: ${{ always() && inputs.chain_manifest != '' && steps.chain.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/prepare_functional_package.py cleanup
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite fault-tolerance
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/suite.log"
-          --output "${RUNNER_TEMP}/chain-fault-tolerance-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/fault-tolerance.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-fault-tolerance-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-fault-tolerance-${{ github.run_id }}-${{ github.run_attempt }}/fault-tolerance.json
-          if-no-files-found: error

.github/workflows/rustfs-functional-chain.yml

@@ -12,227 +12,50 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Reusable workflows run from this driver's commit in one Actions run. Each
-# suite still runs after an earlier suite fails; the final job requires all twelve.
+# Functional chain driver: runs the ten functional suites in a fixed order
+# (upgrade -> s3 -> kms -> tier -> storage -> heal -> pool -> security ->
+# replication -> performance). Each suite attempts the next handoff even
+# when its tests fail.
+#
+# Each suite workflow can still be dispatched standalone (workflow_dispatch);
+# only chain-triggered runs forward to the next suite via repository_dispatch,
+# so a standalone run never drags the rest of the chain behind it.
+#
+# Why not workflow_run chaining: GitHub does not guarantee delivery of
+# workflow_run events (they are fire-and-forget), and the head-SHA filter made
+# newly added suites (storage) unable to trigger at all. Explicit
+# repository_dispatch handoffs are verifiable and re-drivable.
+
 name: RustFS Functional Chain
 
 on:
   workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful nightly build run on main
-        type: string
-        required: true
-      build_run_attempt:
-        description: Exact successful build attempt
-        type: string
-        required: true
   workflow_run:
+    # Entry point: start the chain after the nightly build completes. The
+    # build's own conclusion does not gate the chain; each suite reports its
+    # own result to rustfs/backlog and the dashboard.
     workflows: ["Nightly GNU Build"]
     types: [completed]
 
 permissions:
   contents: read
-  actions: read
-
-concurrency:
-  group: rustfs-functional-chain-runs
-  cancel-in-progress: false
 
 jobs:
-  prepare:
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.event == 'schedule' }}
-    runs-on: smoke-testing
+  start-chain:
+    name: Start functional chain (upgrade first)
+    runs-on: ubuntu-latest
     timeout-minutes: 10
-    outputs:
-      manifest: ${{ steps.candidate.outputs.manifest }}
-      performance_ready: ${{ steps.perf_probe.outputs.performance_ready }}
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.event == 'schedule') }}
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Resolve published candidate
-        id: candidate
-        env:
-          # The staleness probe in resolve_functional_candidate.py reads the
-          # private rustfs/auto-testing repo; github.token cannot, and a probe
-          # failure silently keeps a stale testing_sha pinned for the chain.
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          BUILD_RUN_ATTEMPT: ${{ inputs.build_run_attempt }}
-          CHAIN_OUTPUT: ${{ runner.temp }}/chain-candidate.json
-        run: python3 scripts/resolve_functional_candidate.py
-      - name: Retain candidate identity
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-candidate-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-candidate.json
-          if-no-files-found: error
-
-      - name: Check shared functional fleet runner before scheduling suites
-        # The eleven functional suites run on the smoke-testing fleet; a hard
-        # requirement. The performance lane runs on pf-testing, which is a
-        # separate fleet - probe it without failing the whole chain so an
-        # offline performance runner skips only the performance lane.
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: python3 scripts/check_functional_runners.py smoke-testing
-
-      - name: Probe performance fleet runner
-        id: perf_probe
+      - name: Dispatch first suite (upgrade)
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
         run: |
-          if python3 scripts/check_functional_runners.py pf-testing; then
-            echo "performance_ready=online" >> "$GITHUB_OUTPUT"
-          else
-            echo "performance_ready=offline" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "PF_TESTING_GH_TOKEN is not configured; cannot start the functional chain" >&2
+            exit 1
           fi
-
-  upgrade:
-    needs: [prepare]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-upgrade-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  s3:
-    needs: [prepare, upgrade]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-s3-compat-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  kms:
-    needs: [prepare, s3]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-kms-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  tier:
-    needs: [prepare, kms]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-tier-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  storage:
-    needs: [prepare, tier]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-storage-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  heal:
-    needs: [prepare, storage]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-heal-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  pool:
-    needs: [prepare, heal]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-pool-expand-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  security:
-    needs: [prepare, pool]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-security-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  replication:
-    needs: [prepare, security]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-replication-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  fault-tolerance:
-    needs: [prepare, replication]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-fault-tolerance-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  table:
-    needs: [prepare, fault-tolerance]
-    if: ${{ always() && needs.prepare.result == 'success' }}
-    uses: ./.github/workflows/rustfs-table-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  performance:
-    needs: [prepare, table]
-    if: ${{ always() && needs.prepare.result == 'success' && needs.prepare.outputs.performance_ready == 'online' }}
-    uses: ./.github/workflows/rustfs-performance-test.yml
-    with:
-      chain_manifest: ${{ needs.prepare.outputs.manifest }}
-    secrets: inherit
-
-  complete-chain:
-    needs: [prepare, upgrade, s3, kms, tier, storage, heal, pool, security, replication, fault-tolerance, table, performance]
-    if: ${{ always() && needs.prepare.result != 'skipped' }}
-    runs-on: smoke-testing
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Download suite evidence
-        id: download
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: functional-chain-*-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-evidence
-          merge-multiple: true
-      - name: Summarize every suite including failures and missing evidence
-        if: always()
-        env:
-          CHAIN_MANIFEST: ${{ needs.prepare.outputs.manifest }}
-          CHAIN_NEEDS: ${{ toJSON(needs) }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py summarize
-          --directory "${RUNNER_TEMP}/chain-evidence"
-          --output "${RUNNER_TEMP}/chain-report.json"
-      - name: Retain chain report regardless of test verdict
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-report-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            ${{ runner.temp }}/chain-report.json
-            ${{ runner.temp }}/chain-report.md
-          if-no-files-found: error
-      - name: Verify every required suite
-        if: always()
-        env:
-          CHAIN_MANIFEST: ${{ needs.prepare.outputs.manifest }}
-          CHAIN_NEEDS: ${{ toJSON(needs) }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py aggregate
-          --allow-skipped "${{ needs.prepare.outputs.performance_ready == 'online' && '' || 'performance' }}"
-          --directory "${RUNNER_TEMP}/chain-evidence"
-          --output "${RUNNER_TEMP}/chain-complete.json"
-      - name: Upload complete-chain evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-complete-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-complete.json
-          if-no-files-found: error
+          gh api --method POST repos/rustfs/rustfs/dispatches \
+            -f event_type='rustfs-chain-upgrade' \
+            -F 'client_payload[from_suite]=nightly-build'

.github/workflows/rustfs-heal-test.yml

@@ -1,12 +1,6 @@
 name: RustFS Heal Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       package_url:
@@ -41,7 +35,7 @@ permissions:
 # Only one test at a time: both this and the pool-expansion workflow mutate
 # the same test environment, so they share one concurrency group.
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -60,16 +54,11 @@ env:
 jobs:
   heal-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
+    timeout-minutes: 480
     # Standalone manual run, or one link of the nightly functional chain
     # (storage -> heal -> pool). Pool expansion no longer re-runs heal.
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
-      - name: Checkout chain tooling
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
       - name: Initialize functional evidence
         id: evidence
         run: |
@@ -85,21 +74,25 @@ jobs:
             printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -110,7 +103,6 @@ jobs:
           df -h /data | tail -1
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         if: ${{ inputs.cleanup_before != 'false' }}
         run: |
           set -euo pipefail
@@ -130,7 +122,6 @@ jobs:
           done
 
       - name: Install RustFS package & start cluster
-        timeout-minutes: 5
         run: |
           ARGS=(--steps "1,2" -y --endpoint "${{ env.RUSTFS_API_ENDPOINT }}")
           if [ -n "${{ inputs.package_url }}" ]; then
@@ -141,7 +132,6 @@ jobs:
           ./auto-testing/rustfs_heal_test.sh "${ARGS[@]}" --log-file "${LOG_FILE}"
 
       - name: Preflight checks
-        timeout-minutes: 5
         run: |
           ARGS=(--preflight --endpoint "${{ env.RUSTFS_API_ENDPOINT }}")
           if [ -n "${{ inputs.package_url }}" ]; then
@@ -152,11 +142,7 @@ jobs:
           ./auto-testing/rustfs_heal_test.sh "${ARGS[@]}" --log-file "${LOG_FILE}"
 
       - name: Run heal test (write -> outage -> heal -> verify)
-        timeout-minutes: 45
         id: test
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         run: |
           ./auto-testing/rustfs_heal_test.sh \
             --steps "3,4,5,6,7" -y \
@@ -166,8 +152,6 @@ jobs:
             --log-file "${LOG_FILE}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
           set -euo pipefail
@@ -240,20 +224,6 @@ jobs:
           if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
             RESULT=success
           fi
-
-          # Product gate: failing steps keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns turn the workflow red.
-          STEPS_TOTAL="$(grep -cE '^\[HEAL-STEP\]' "${LOG_FILE}" 2>/dev/null || true)"
-          STEPS_FAIL="$(grep -cE '^\[HEAL-STEP\].* FAIL$' "${LOG_FILE}" 2>/dev/null || true)"
-          STEPS_TOTAL=$(( ${STEPS_TOTAL:-0} + 0 )); STEPS_FAIL=$(( ${STEPS_FAIL:-0} + 0 ))
-          STEPS_PASS=$(( STEPS_TOTAL - STEPS_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${STEPS_TOTAL}" -gt 0 ] && [ "${STEPS_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS heal test report"
             echo ""
@@ -265,27 +235,21 @@ jobs:
             echo "- Test Step Outcome: ${RESULT}"
             echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
             echo ""
-            if [ -s "${STEPS_TABLE}" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${STEPS_TABLE}"
               echo ""
-            fi
-            echo "- Product result: ${STEPS_PASS} passed, ${STEPS_FAIL} failed (failing steps are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${STEPS_TABLE}" ]; then
               echo "## Log tail"
               echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
+              tail -n 200 "${LOG_FILE}"
               echo '```'
             else
               echo "The suite or evidence validation failed. See this run's artifact for partial step results and suite.log."
             fi
           } | tee "${REPORT_FILE}"
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; step failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -316,57 +280,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 'heal'
           SUITE_LABEL: 'Heal'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload test logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-heal-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -377,7 +353,6 @@ jobs:
           if-no-files-found: error
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: ${{ always() && inputs.cleanup_after != 'false' }}
         run: |
           set -euo pipefail
@@ -451,24 +426,3 @@ jobs:
           echo "RustFS heal test failed"
           echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
           echo "See the uploaded log artifact for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite heal
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/steps.md"
-          --output "${RUNNER_TEMP}/chain-heal-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/heal.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-heal-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-heal-${{ github.run_id }}-${{ github.run_attempt }}/heal.json
-          if-no-files-found: error

.github/workflows/rustfs-kms-test.yml

@@ -1,18 +1,12 @@
 name: RustFS KMS Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test. Leave empty for nightly.'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
         required: false
-        default: ''
+        default: '1.0.0-rc.4-preview.1'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -37,7 +31,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -55,11 +49,11 @@ env:
 jobs:
   kms-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 420
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
       - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -77,21 +71,25 @@ jobs:
             printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -101,7 +99,6 @@ jobs:
           docker --version || true
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         run: |
           set -euo pipefail
           read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
@@ -130,10 +127,6 @@ jobs:
 
       - name: Run KMS suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         run: |
           set -euo pipefail
           chmod +x auto-testing/rustfs-kms-test.sh
@@ -163,8 +156,6 @@ jobs:
           ./auto-testing/rustfs-kms-test.sh "${ARGS[@]}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
           set -euo pipefail
@@ -184,21 +175,6 @@ jobs:
           if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
             RESULT=success
           fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns (the suite never reached case level, or a wholesale
-          # failure with zero passes) turn the workflow red.
-          CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-          CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS KMS test report"
             echo ""
@@ -210,27 +186,21 @@ jobs:
             echo "- Test Step Outcome: ${RESULT}"
             echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
             echo ""
-            if [ -s "${CASE_TABLE}" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${CASE_TABLE}"
               echo ""
-            fi
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
               echo "## Log tail"
               echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
+              tail -n 200 "${LOG_FILE}"
               echo '```'
             else
               echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
             fi
           } | tee "${REPORT_FILE}"
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -261,61 +231,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 'kms'
           SUITE_LABEL: 'KMS'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-kms-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -325,7 +303,6 @@ jobs:
           if-no-files-found: error
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: always()
         run: |
           set -euo pipefail
@@ -398,24 +375,3 @@ jobs:
         run: |
           echo "RustFS KMS suite failed"
           echo "See the uploaded report and log artifacts for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite kms
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          --output "${RUNNER_TEMP}/chain-kms-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/kms.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-kms-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-kms-${{ github.run_id }}-${{ github.run_attempt }}/kms.json
-          if-no-files-found: error

.github/workflows/rustfs-performance-test.yml

@@ -1,12 +1,6 @@
 name: RustFS Performance Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       package_url:
@@ -61,13 +55,10 @@ on:
 permissions:
   contents: read
 
-# Workflow-level so the lock is held through cleanup as well.
+# The default performance nodes overlap the other suites' remote VMs, even
+# though the runner differs. Hold the shared lock through cleanup as well.
 concurrency:
-  # Own group: the performance suite runs on the pf-testing fleet - a fully
-  # separate environment from the smoke-testing fleet the functional suites
-  # use. No shared node, no shared runner: it must never queue behind them
-  # (or block them).
-  group: rustfs-performance-suite
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -88,21 +79,7 @@ env:
   PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
 
 jobs:
-  runner-check:
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    runs-on: sm-standard-2
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Check performance runner before entering its queue
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: python3 scripts/check_functional_runners.py pf-testing
-
   performance-test:
-    needs: runner-check
     runs-on: pf-testing
     timeout-minutes: 900
     env:
@@ -113,13 +90,8 @@ jobs:
       RUSTFS_WARP_CONCURRENCY: ${{ inputs.warp_concurrency || '64' }}
     # Run on manual dispatch, or when the nightly build completed successfully.
     # Skipped when nightly failed.
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
-      - name: Checkout chain tooling
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
       - name: Initialize functional evidence
         id: evidence
         run: |
@@ -136,21 +108,25 @@ jobs:
             printf 'VERSION_FILE=%s/version.txt\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -216,7 +192,6 @@ jobs:
           } > "${VERSION_FILE}"
 
       - name: Upload report to dashboard (reports/YYYY-MM-DD.md)
-        id: chain_report
         if: ${{ steps.benchmark.conclusion == 'success' }}
         env:
           GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
@@ -262,52 +237,69 @@ jobs:
             echo "created ${REPORT_PATH} in rustfs/dashboard"
           fi
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        # Signal-based lifecycle: dedups against open issues by label,
-        # labels new issues (functional-test, category, case IDs, env),
-        # closes fixed issues after a fully green run. Never acts on
-        # cancelled runs. Logic lives in auto-testing/scripts/.
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.benchmark.outcome == 'failure' || steps.benchmark.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 'performance'
           SUITE_LABEL: 'Performance'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.benchmark.outcome }}" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload test logs & results
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-perf-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -333,24 +325,3 @@ jobs:
           echo "RustFS performance test failed"
           echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
           echo "See the uploaded log artifact for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.benchmark.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite performance
-          --report "${RUSTFS_RESULT_DIR}/summary.tsv"
-          --output "${RUNNER_TEMP}/chain-performance-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/performance.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-performance-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-performance-${{ github.run_id }}-${{ github.run_attempt }}/performance.json
-          if-no-files-found: error

.github/workflows/rustfs-pool-expand-test.yml

@@ -1,17 +1,6 @@
 name: RustFS Pool Expansion Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
-      pool_timeout_minutes:
-        description: Wall-clock budget (minutes) for the pool run step
-        type: string
-        required: false
-        default: '240'
   workflow_dispatch:
     inputs:
       rustfs_version:
@@ -44,10 +33,6 @@ on:
         description: 'Run the pool decommission step (3-pool topology only)'
         type: boolean
         default: true
-      pool_timeout_minutes:
-        description: 'Wall-clock budget (minutes) for the whole pool run: fill + rebalance wait + decommission'
-        required: false
-        default: '240'
       cleanup_before:
         description: 'Reset the nodes before the test (DESTROYS existing data/config)'
         type: boolean
@@ -67,7 +52,7 @@ permissions:
 # environment (vm000/vm001/vm002), so concurrent runs must not clobber each
 # other.
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -78,7 +63,7 @@ env:
   RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
   RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
   RUSTFS_API_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || vars.RUSTFS_RC_ENDPOINT }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES || 'vm000 vm001 vm002' }}
+  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
   RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
   PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
   # Package used by the nightly run (workflow_dispatch inputs are empty for
@@ -91,39 +76,36 @@ jobs:
   pool-expansion-test:
     name: Pool expansion / decommission test
     runs-on: smoke-testing
-    # Leave setup and finalizer headroom beyond the default 240-minute test.
     timeout-minutes: 360
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     env:
       RUSTFS_POOL_ADMIN_ENDPOINT: ${{ secrets.RUSTFS_POOL_ADMIN_ENDPOINT || vars.RUSTFS_POOL_ADMIN_ENDPOINT || 'http://rustfs-node1:9000' }}
       RUSTFS_POOL_PROXY_ENDPOINT: http://127.0.0.1:19000
       RUSTFS_POOL_WARP_ENDPOINT: http://127.0.0.1:19000
       RUSTFS_SHARED_PROXY_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || vars.RUSTFS_RC_ENDPOINT }}
-      RUSTFS_POOL_NODE_ENDPOINTS: ${{ secrets.RUSTFS_POOL_NODE_ENDPOINTS || vars.RUSTFS_POOL_NODE_ENDPOINTS || 'http://rustfs-node1:9000 http://rustfs-node2:9000 http://rustfs-node3:9000 http://rustfs-node4:9000' }}
+      RUSTFS_POOL_NODE_ENDPOINTS: ${{ secrets.RUSTFS_POOL_NODE_ENDPOINTS || vars.RUSTFS_POOL_NODE_ENDPOINTS || 'http://rustfs-node1:9000 http://rustfs-node2:9000 http://rustfs-node3:9000' }}
     steps:
-      - name: Checkout chain tooling
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Initialize pool test artifacts
-        id: evidence
         run: |
           set -euo pipefail
           ARTIFACT_DIR="${RUNNER_TEMP}/rustfs-pool-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
@@ -138,19 +120,7 @@ jobs:
           warp --version || true
           df -h /data | tail -1
 
-      - name: Validate pool topology before destructive cleanup
-        id: topology
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES}"
-          read -r -a ENDPOINTS <<< "${RUSTFS_POOL_NODE_ENDPOINTS}"
-          if [ "${#NODES[@]}" -lt 3 ] || [ "${#ENDPOINTS[@]}" -lt "${#NODES[@]}" ]; then
-            echo "Pool tests require at least three nodes and a direct endpoint for every node" >&2
-            exit 1
-          fi
-
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         if: ${{ inputs.cleanup_before != 'false' }}
         run: |
           set -euo pipefail
@@ -170,7 +140,6 @@ jobs:
           done
 
       - name: Install RustFS package & start cluster
-        timeout-minutes: 5
         run: |
           ARGS=(--steps "1,2,3" -y \
             --admin-endpoint "${RUSTFS_POOL_ADMIN_ENDPOINT}" \
@@ -187,7 +156,6 @@ jobs:
           ./auto-testing/rustfs_pool_expand.sh "${ARGS[@]}"
 
       - name: Preflight checks
-        timeout-minutes: 5
         run: |
           ARGS=(--preflight \
             --admin-endpoint "${RUSTFS_POOL_ADMIN_ENDPOINT}" \
@@ -204,7 +172,6 @@ jobs:
           ./auto-testing/rustfs_pool_expand.sh "${ARGS[@]}"
 
       - name: Reset dedicated pool proxy
-        timeout-minutes: 2
         run: |
           set -euo pipefail
           RUSTFS_POOL_NGINX_CONFIG_PATH=/etc/nginx/conf.d/rustfs-pool-test.conf \
@@ -214,7 +181,6 @@ jobs:
             ./auto-testing/rustfs_pool_nginx_stage.sh cleanup
 
       - name: Capture pool test baseline
-        timeout-minutes: 2
         run: |
           set -uo pipefail
           BASELINE_FILE="${POOL_ARTIFACT_DIR}/pool-baseline.log"
@@ -261,18 +227,6 @@ jobs:
 
       - name: Run pool expansion & decommission test
         id: pool_test
-        # The suite budgets up to 24h each for rebalance and decommission
-        # (REBALANCE_TIMEOUT / DECOMMISSION_TIMEOUT in rustfs_pool_expand.sh);
-        # the previous 45m step cap killed four consecutive runs mid-rebalance
-        # with steps 1-7 green. 240m covers the observed pace (rebalance 1/4
-        # in ~21m) plus one decommission pass; override per dispatch.
-        # fromJSON coerces the string dispatch input to the number that
-        # timeout-minutes requires; the bare || form yielded the string '240'
-        # and the runner rejected the template (Unexpected value '240').
-        timeout-minutes: ${{ fromJSON(inputs.pool_timeout_minutes || '240') }}
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         run: |
           set -o pipefail
           STEPS="4,5,6"
@@ -309,7 +263,6 @@ jobs:
             ./auto-testing/rustfs_pool_expand.sh "${ARGS[@]}"
 
       - name: Collect pool test diagnostics
-        timeout-minutes: 2
         if: always()
         run: |
           set -uo pipefail
@@ -410,8 +363,6 @@ jobs:
           fi
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: always()
         run: |
           set -euo pipefail
@@ -499,7 +450,6 @@ jobs:
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
 
       - name: Validate pool diagnostic completeness
-        timeout-minutes: 2
         if: always()
         run: |
           set -euo pipefail
@@ -521,11 +471,7 @@ jobs:
           }
 
           require_nonempty "${POOL_ARTIFACT_DIR}/pool-test.log"
-          # warp is stopped early (SIGINT/SIGTERM) once the storage threshold
-          # is reached, and it only writes its final report on a clean exit —
-          # an empty warp.log is the expected shape of a healthy run, so only
-          # require that the redirect target exists.
-          require_available "${POOL_ARTIFACT_DIR}/warp.log"
+          require_nonempty "${POOL_ARTIFACT_DIR}/warp.log"
           require_nonempty "${POOL_ARTIFACT_DIR}/pool-report.md"
           require_nonempty "${POOL_ARTIFACT_DIR}/pool-baseline.log"
           require_nonempty "${POOL_ARTIFACT_DIR}/nginx-config-redacted.txt"
@@ -576,20 +522,9 @@ jobs:
             echo "dedicated proxy error log contains an upstream timeout or connection failure" >&2
             failed=1
           fi
-          # A mid-script abort is a product/harness signal: the run step's
-          # continue-on-error would otherwise keep the workflow green, so the
-          # validator must turn it red. Aborts go through die(), which prints
-          # an [ERROR] line; a step that dies never emits its [POOL-STEP]
-          # verdict, so "any FAIL verdict" cannot be the trigger.
-          if grep -q '^\[POOL-STEP\] .* FAIL' "${POOL_ARTIFACT_DIR}/pool-test.log" 2>/dev/null \
-            || grep -q '\[ERROR\]' "${POOL_ARTIFACT_DIR}/pool-test.log" 2>/dev/null; then
-            echo "pool test script reported a failure (step FAIL verdict or die() abort)" >&2
-            failed=1
-          fi
           [ "${failed}" -eq 0 ] || exit 1
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: always()
         continue-on-error: true
         env:
@@ -621,67 +556,74 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.pool_test.outcome == 'failure' || steps.pool_test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
           SUITE: 'pool'
           SUITE_LABEL: 'Pool expansion'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          REPORT_FILE: '${{ env.POOL_ARTIFACT_DIR }}/pool-report.md'
+          LOG_FILE: '${{ env.POOL_ARTIFACT_DIR }}/pool-test.log'
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.pool_test.outcome }}" \
-            --report-file "${POOL_ARTIFACT_DIR}/pool-report.md" \
-            --log "${POOL_ARTIFACT_DIR}/pool-test.log" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload test logs
-        timeout-minutes: 2
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-pool-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/rustfs-pool-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: warn
 
       - name: Restore dedicated pool proxy
-        timeout-minutes: 2
         if: always()
         run: |
           set -euo pipefail
@@ -692,8 +634,7 @@ jobs:
             ./auto-testing/rustfs_pool_nginx_stage.sh cleanup
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
-        if: ${{ always() && steps.topology.outcome == 'success' && inputs.cleanup_after != 'false' }}
+        if: ${{ always() && inputs.cleanup_after != 'false' }}
         run: |
           set -euo pipefail
           read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
@@ -766,24 +707,3 @@ jobs:
           echo "RustFS pool expansion test failed"
           echo "Package source: ${{ inputs.package_url || inputs.rustfs_version || 'nightly (R2 latest)' }}"
           echo "See the uploaded log artifact for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.pool_test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite pool
-          --report "${POOL_ARTIFACT_DIR}/pool-steps.md"
-          --output "${RUNNER_TEMP}/chain-pool-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/pool.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-pool-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-pool-${{ github.run_id }}-${{ github.run_attempt }}/pool.json
-          if-no-files-found: error

.github/workflows/rustfs-replication-test.yml

@@ -15,18 +15,12 @@
 name: RustFS Replication Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test. Leave empty for nightly.'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
         required: false
-        default: ''
+        default: '1.0.0-rc.4-preview.1'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -49,7 +43,7 @@ permissions:
 # The replication suite uses the same shared VMs as the other functional
 # tests, so it must serialize with them instead of running in parallel.
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -67,11 +61,11 @@ env:
 jobs:
   replication-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 360
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
       - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -89,21 +83,25 @@ jobs:
             printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -114,7 +112,6 @@ jobs:
           df -h /data | tail -1 || true
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         run: |
           set -euo pipefail
           read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
@@ -134,10 +131,6 @@ jobs:
 
       - name: Run replication suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         run: |
           set -euo pipefail
           chmod +x auto-testing/rustfs-replication-test.sh
@@ -160,8 +153,6 @@ jobs:
           ./auto-testing/rustfs-replication-test.sh "${ARGS[@]}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
           set -euo pipefail
@@ -191,21 +182,6 @@ jobs:
           if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
             RESULT=success
           fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns (the suite never reached case level, or a wholesale
-          # failure with zero passes) turn the workflow red.
-          CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-          CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS replication test report"
             echo ""
@@ -218,27 +194,21 @@ jobs:
             echo "- Test Step Outcome: ${RESULT}"
             echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
             echo ""
-            if [ -s "${CASE_TABLE}" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${CASE_TABLE}"
               echo ""
-            fi
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
               echo "## Log tail"
               echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
+              tail -n 200 "${LOG_FILE}"
               echo '```'
             else
               echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
             fi
           } | tee "${REPORT_FILE}"
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -269,61 +239,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 'replication'
           SUITE_LABEL: 'Replication (bucket + site)'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-replication-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -333,7 +311,6 @@ jobs:
           if-no-files-found: error
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: always()
         run: |
           set -euo pipefail
@@ -352,7 +329,7 @@ jobs:
             '
           done
 
-      - name: "Continue functional chain (next: Fault tolerance)"
+      - name: "Continue functional chain (next: Performance)"
         if: ${{ always() && github.event_name == 'repository_dispatch' }}
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
@@ -365,9 +342,9 @@ jobs:
           DISPATCHED=0
           for attempt in 1 2 3; do
             if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-fault-tolerance' \
+              -f event_type='rustfs-chain-performance' \
               -F 'client_payload[from_suite]=replication'; then
-              echo "dispatched next suite Fault tolerance (attempt ${attempt})"
+              echo "dispatched next suite Performance (attempt ${attempt})"
               DISPATCHED=1
               break
             fi
@@ -375,19 +352,19 @@ jobs:
             sleep "${attempt}0"
           done
           if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Fault tolerance after 3 attempts" >&2
+            echo "ERROR: functional chain stalled: could not dispatch Performance after 3 attempts" >&2
             TITLE="[functional][chain] stalled after replication (run ${GITHUB_RUN_ID})"
             BODY_FILE="$(mktemp)"
             trap 'rm -f "${BODY_FILE}"' EXIT
             {
-              echo "The functional chain could not hand off from **replication** to **Fault tolerance** after 3 attempts."
+              echo "The functional chain could not hand off from **replication** to **Performance** after 3 attempts."
               echo ""
               echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-fault-tolerance'"
+              echo "- Expected next event: 'rustfs-chain-performance'"
               echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
               echo "- Recovery: re-dispatch manually with"
               FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-fault-tolerance'"
+              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-performance'"
               FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
             } > "${BODY_FILE}"
             gh issue create -R rustfs/backlog --title "${TITLE}" \
@@ -403,24 +380,3 @@ jobs:
           echo "RustFS replication suite failed"
           echo "Package source: ${{ inputs.package_url || inputs.rustfs_version || 'nightly (R2 latest)' }}"
           echo "See the uploaded report and log artifacts for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite replication
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          --output "${RUNNER_TEMP}/chain-replication-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/replication.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-replication-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-replication-${{ github.run_id }}-${{ github.run_attempt }}/replication.json
-          if-no-files-found: error

.github/workflows/rustfs-s3-compat-test.yml

@@ -1,18 +1,12 @@
 name: RustFS S3 Compatibility Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test. Leave empty for nightly.'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
         required: false
-        default: ''
+        default: '1.0.0-rc.4-preview.1'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -25,7 +19,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -43,11 +37,11 @@ env:
 jobs:
   s3-compat-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 360
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
       - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -65,21 +59,25 @@ jobs:
             printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -89,7 +87,6 @@ jobs:
           df -h /data | tail -1
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         run: |
           set -euo pipefail
           read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
@@ -109,10 +106,6 @@ jobs:
 
       - name: Run S3 compatibility suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         run: |
           set -euo pipefail
           chmod +x auto-testing/rustfs-s3-compat-test.sh
@@ -129,8 +122,6 @@ jobs:
           ./auto-testing/rustfs-s3-compat-test.sh "${ARGS[@]}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
           set -euo pipefail
@@ -160,21 +151,6 @@ jobs:
           if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
             RESULT=success
           fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns (the suite never reached case level, or a wholesale
-          # failure with zero passes) turn the workflow red.
-          CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-          CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS S3 compatibility test report"
             echo ""
@@ -187,27 +163,21 @@ jobs:
             echo "- Test Step Outcome: ${RESULT}"
             echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
             echo ""
-            if [ -s "${CASE_TABLE}" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${CASE_TABLE}"
               echo ""
-            fi
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
               echo "## Log tail"
               echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
+              tail -n 200 "${LOG_FILE}"
               echo '```'
             else
               echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
             fi
           } | tee "${REPORT_FILE}"
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -238,61 +208,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 's3'
           SUITE_LABEL: 'S3 compatibility'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-s3-compat-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -302,7 +280,6 @@ jobs:
           if-no-files-found: error
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: always()
         run: |
           set -euo pipefail
@@ -375,24 +352,3 @@ jobs:
         run: |
           echo "RustFS S3 compatibility suite failed"
           echo "See the uploaded report and log artifacts for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite s3
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          --output "${RUNNER_TEMP}/chain-s3-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/s3.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-s3-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-s3-${{ github.run_id }}-${{ github.run_attempt }}/s3.json
-          if-no-files-found: error

.github/workflows/rustfs-security-test.yml

@@ -15,18 +15,12 @@
 name: RustFS Security Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test. Leave empty for nightly.'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
         required: false
-        default: ''
+        default: '1.0.0-rc.4-preview.1'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -62,7 +56,7 @@ permissions:
 # The security suite uses the same shared VMs as the other functional tests,
 # so it must serialize with them instead of running in parallel.
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -80,14 +74,14 @@ env:
 jobs:
   security-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 360
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
       # Checkout the repository into its own subdirectory. Checking out at
       # the workspace root would wipe the auto-testing clone above (that is
       # exactly how run 33934141181 lost rustfs-security-test.sh).
       - name: Checkout repository (for the OIDC live gate script)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           path: rustfs-repo
@@ -101,21 +95,25 @@ jobs:
           mkdir -- "${SECURITY_ARTIFACTS_DIR}" "${SECURITY_ARTIFACTS_DIR}-scratch"
           printf 'SECURITY_ARTIFACTS_DIR=%s\n' "${SECURITY_ARTIFACTS_DIR}" >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 rustfs-repo/scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -127,7 +125,6 @@ jobs:
           df -h /data | tail -1
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         if: ${{ inputs.cleanup_before != 'false' || github.event_name != 'workflow_dispatch' }}
         run: |
           set -euo pipefail
@@ -148,9 +145,6 @@ jobs:
 
       - name: Run security suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
         continue-on-error: true
         env:
           REPORT_FILE: ${{ env.SECURITY_ARTIFACTS_DIR }}/suite-report.md
@@ -182,37 +176,15 @@ jobs:
 
       - name: Generate report
         id: report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         env:
           TEST_OUTCOME: ${{ steps.test.outcome }}
         run: |
           set -euo pipefail
-          LOG_FILE="${SECURITY_ARTIFACTS_DIR}/suite.log"
           RESULT=failure
           if [ "${TEST_OUTCOME}" = "success" ] && [ -s "${SECURITY_ARTIFACTS_DIR}/suite-report.md" ]; then
             RESULT=success
           fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns turn the workflow red. The suite log lines carry ANSI
-          # color escapes both before and after the verdict tag
-          # (e.g. "\e[1;31m[FAIL]\e[0m STS-105 ..."), so the pattern allows
-          # any number of escapes on each side of it.
-          ESC=$'\033'
-          VERDICTS_TOTAL="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[(PASS|FAIL|UNSUPPORTED)\](${ESC}\[[0-9;]*m)* [A-Z]" "${LOG_FILE}" 2>/dev/null || true)"
-          VERDICTS_FAIL="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[FAIL\](${ESC}\[[0-9;]*m)* [A-Z]" "${LOG_FILE}" 2>/dev/null || true)"
-          VERDICTS_TOTAL=$(( ${VERDICTS_TOTAL:-0} + 0 )); VERDICTS_FAIL=$(( ${VERDICTS_FAIL:-0} + 0 ))
-          VERDICTS_PASS=$(( VERDICTS_TOTAL - VERDICTS_FAIL ))
-          VERDICTS_SKIPPED="$(grep -cE "^(${ESC}\[[0-9;]*m)*\[SKIP\](${ESC}\[[0-9;]*m)* [A-Z]" "${LOG_FILE}" 2>/dev/null || true)"
-          VERDICTS_SKIPPED=$(( ${VERDICTS_SKIPPED:-0} + 0 ))
-          HARNESS_OK=0
-          if [ "${TEST_OUTCOME}" = "success" ]; then
-            HARNESS_OK=1
-          elif [ "${TEST_OUTCOME}" = "failure" ] && [ "${VERDICTS_TOTAL}" -gt 0 ] && [ "${VERDICTS_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS security test report"
             echo ""
@@ -225,22 +197,18 @@ jobs:
             echo ""
             # The dashboard prioritizes case rows over the step outcome.
             # Keep partial case results in the artifact when the suite fails.
-            if [ -s "${SECURITY_ARTIFACTS_DIR}/suite-report.md" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${SECURITY_ARTIFACTS_DIR}/suite-report.md"
-              echo ""
-            fi
-            if [ "${VERDICTS_SKIPPED}" -gt 0 ]; then
-              echo "- Product result: ${VERDICTS_PASS} passed, ${VERDICTS_FAIL} failed, ${VERDICTS_SKIPPED} skipped (failing cases are tracked in rustfs/backlog)"
+            elif [ -s "${SECURITY_ARTIFACTS_DIR}/suite-report.md" ]; then
+              echo "The suite did not complete successfully. See suite-report.md in this run's artifact for diagnostics."
             else
-              echo "- Product result: ${VERDICTS_PASS} passed, ${VERDICTS_FAIL} failed (failing cases are tracked in rustfs/backlog)"
+              echo "The suite did not produce a non-empty report."
             fi
           } > "${SECURITY_ARTIFACTS_DIR}/report.md"
           cat "${SECURITY_ARTIFACTS_DIR}/report.md" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -272,60 +240,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
           SUITE: 'security'
           SUITE_LABEL: 'Security'
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          REPORT_FILE: ${{ env.SECURITY_ARTIFACTS_DIR }}/report.md
+          LOG_FILE: ''
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report-file "${SECURITY_ARTIFACTS_DIR}/report.md" \
-            --log "${SECURITY_ARTIFACTS_DIR}/suite.log" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-security-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -336,7 +313,6 @@ jobs:
           retention-days: 3
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: ${{ always() && (inputs.cleanup_after != 'false' || github.event_name != 'workflow_dispatch') }}
         run: |
           set -euo pipefail
@@ -379,24 +355,3 @@ jobs:
           echo "RustFS security test failed"
           echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
           echo "See the uploaded report and logs for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.report.outcome }}
-        run: >-
-          python3 rustfs-repo/scripts/functional_chain_evidence.py record --suite security
-          --report "${SECURITY_ARTIFACTS_DIR}/suite-report.md"
-          --output "${RUNNER_TEMP}/chain-security-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/security.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-security-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-security-${{ github.run_id }}-${{ github.run_attempt }}/security.json
-          if-no-files-found: error

.github/workflows/rustfs-storage-test.yml

@@ -1,18 +1,12 @@
 name: RustFS Storage Engine Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test. Leave empty for nightly.'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
         required: false
-        default: ''
+        default: '1.0.0-rc.4-preview.1'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -34,7 +28,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -52,11 +46,11 @@ env:
 jobs:
   storage-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 360
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
       - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -74,21 +68,25 @@ jobs:
             printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -98,7 +96,6 @@ jobs:
           df -h /data | tail -1
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         run: |
           set -euo pipefail
           read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
@@ -118,10 +115,6 @@ jobs:
 
       - name: Run storage engine suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         run: |
           set -euo pipefail
           chmod +x auto-testing/rustfs-storage-test.sh
@@ -144,8 +137,6 @@ jobs:
           ./auto-testing/rustfs-storage-test.sh "${ARGS[@]}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
           set -euo pipefail
@@ -175,21 +166,6 @@ jobs:
           if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
             RESULT=success
           fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns (the suite never reached case level, or a wholesale
-          # failure with zero passes) turn the workflow red.
-          CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-          CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS storage engine test report"
             echo ""
@@ -202,27 +178,21 @@ jobs:
             echo "- Test Step Outcome: ${RESULT}"
             echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
             echo ""
-            if [ -s "${CASE_TABLE}" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${CASE_TABLE}"
               echo ""
-            fi
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
               echo "## Log tail"
               echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
+              tail -n 200 "${LOG_FILE}"
               echo '```'
             else
               echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
             fi
           } | tee "${REPORT_FILE}"
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -253,61 +223,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 'storage'
           SUITE_LABEL: 'Storage engine'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-storage-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -317,7 +295,6 @@ jobs:
           if-no-files-found: error
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: always()
         run: |
           set -euo pipefail
@@ -390,24 +367,3 @@ jobs:
         run: |
           echo "RustFS storage engine suite failed"
           echo "See the uploaded report and log artifacts for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite storage
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          --output "${RUNNER_TEMP}/chain-storage-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/storage.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-storage-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-storage-${{ github.run_id }}-${{ github.run_attempt }}/storage.json
-          if-no-files-found: error

.github/workflows/rustfs-table-test.yml

@@ -1,360 +0,0 @@
-name: RustFS Table Test
-
-on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
-  workflow_dispatch:
-    inputs:
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-      rustfs_version:
-        description: 'RustFS release tag to test (leave empty to use the latest nightly deb)'
-        required: false
-        type: string
-      skip_smoke:
-        description: 'Skip the PyIceberg end-to-end case (TBL-101)'
-        required: false
-        type: boolean
-        default: false
-
-concurrency:
-  group: rustfs-shared-functional-tests-v2
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-env:
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES || 'vm000 vm001 vm002 vm003' }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER || 'azureuser' }}
-  RUSTFS_API_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || 'http://rustfs-node1:9000' }}
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  table-test:
-    name: table-test
-    runs-on: smoke-testing
-    timeout-minutes: 60
-    steps:
-      - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Initialize functional evidence
-        id: evidence
-        run: |
-          set -euo pipefail
-          umask 077
-          FUNCTIONAL_ARTIFACTS_DIR="${RUNNER_TEMP}/rustfs-table-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          mkdir -- "${FUNCTIONAL_ARTIFACTS_DIR}" "${FUNCTIONAL_ARTIFACTS_DIR}-scratch"
-          {
-            printf 'FUNCTIONAL_ARTIFACTS_DIR=%s\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'LOG_FILE=%s/suite.log\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'REPORT_FILE=%s/report.md\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-            printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
-          } >> "${GITHUB_ENV}"
-
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        timeout-minutes: 5
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
-
-      - name: Show environment
-        run: |
-          set -euo pipefail
-          echo "nodes: ${RUSTFS_NODES}"
-          echo "endpoint: ${RUSTFS_API_ENDPOINT}"
-          aws --version
-          python3 --version
-
-      - name: Cleanup environment (before)
-        timeout-minutes: 5
-        continue-on-error: true
-        run: |
-          set -uo pipefail
-          for node in ${RUSTFS_NODES}; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 "${RUSTFS_SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            ' || echo "pre-cleanup failed on ${node} (continuing)"
-          done
-
-      - name: Stage verified candidate package
-        id: chain_package
-        if: ${{ inputs.chain_manifest != '' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/prepare_functional_package.py prepare
-
-      - name: Run table suite
-        id: test
-        timeout-minutes: 45
-        # Standalone case failures are reported by the backlog manager.
-        # Chain evidence separately requires complete passing cases.
-        continue-on-error: true
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-table-test.sh
-          PACKAGE_URL='${{ steps.chain_package.outputs.package_url || inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          SMOKE_PATH="${GITHUB_WORKSPACE:-$PWD}/scripts/table-catalog/pyiceberg_smoke.py"
-          ARGS=(-y --smoke-script "${SMOKE_PATH}")
-          if [ '${{ inputs.skip_smoke }}' = 'true' ]; then
-            ARGS+=(--skip-smoke)
-          fi
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
-            ARGS+=(--package-url "https://github.com/rustfs/rustfs/releases/download/${RUSTFS_VERSION}/rustfs-linux-x86_64-gnu-v${RUSTFS_VERSION}.deb")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          ./auto-testing/rustfs-table-test.sh "${ARGS[@]}" --log-file "${LOG_FILE}"
-
-      - name: Generate report
-        timeout-minutes: 2
-        id: chain_report
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        run: |
-          set -euo pipefail
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          CASE_TABLE="${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          CASE_RESULT=success
-          python3 scripts/functional_case_report.py "${LOG_FILE}" "${CASE_TABLE}" || CASE_RESULT=failure
-          RESULT=failure
-          if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
-            RESULT=success
-          fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns (the suite never reached case level, or a wholesale
-          # failure with zero passes) turn the workflow red.
-          CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-          CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
-          {
-            echo "# RustFS S3 Tables (Iceberg REST Catalog) test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
-            echo "- Workflow Commit: ${GITHUB_SHA}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- Test Step Outcome: ${RESULT}"
-            echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
-              cat "${CASE_TABLE}"
-              echo ""
-            fi
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
-              echo "## Log tail"
-              echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
-              echo '```'
-            else
-              echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
-            fi
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
-
-      - name: Upload functional report to dashboard
-        timeout-minutes: 2
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: ${{ env.REPORT_FILE }}
-          SUITE: table
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          B64_FILE="$(mktemp)"
-          python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}" > "${B64_FILE}"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" --arg sha "${SHA}" \
-              '{message:$msg, content:($content|rtrimstr("\n")), sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --rawfile content "${B64_FILE}" \
-              '{message:$msg, content:($content|rtrimstr("\n"))}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-          echo "dashboard updated: ${REPORT_PATH}"
-
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
-            exit 0
-          fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found; skipping backlog issue management"
-            exit 0
-          fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          if [ -n "${PACKAGE_URL}" ]; then PACKAGE_SOURCE="${PACKAGE_URL}"; fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --outcome "${{ steps.test.outcome }}" \
-            --suite table --category table --suite-label "S3 Tables" \
-            --outcome '${{ steps.test.outcome }}' \
-            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
-            --run-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${GITHUB_EVENT_NAME}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --date "$(date -u +%Y-%m-%d)"
-
-      - name: Upload report and logs
-        timeout-minutes: 2
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: rustfs-table-test-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/report.md
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/cases.md
-            ${{ env.FUNCTIONAL_ARTIFACTS_DIR }}/suite.log
-          if-no-files-found: error
-          retention-days: 30
-
-      - name: Cleanup environment (after)
-        timeout-minutes: 5
-        if: always()
-        continue-on-error: true
-        run: |
-          set -uo pipefail
-          for node in ${RUSTFS_NODES}; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 "${RUSTFS_SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -f /etc/default/rustfs
-            ' || echo "cleanup failed on ${node} (continuing)"
-          done
-
-      - name: "Continue functional chain (next: Performance)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          echo "Dispatching next functional suite: Performance"
-          gh api --method POST repos/rustfs/rustfs/dispatches \
-            -f event_type='rustfs-chain-performance' \
-            -F 'client_payload[from_suite]=table'
-
-      - name: Notify on failure
-        if: failure()
-        run: echo "RustFS table test workflow failed (harness/environment breakdown); see logs and report artifact."
-
-      - name: Remove verified candidate package
-        if: ${{ always() && inputs.chain_manifest != '' && steps.chain.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/prepare_functional_package.py cleanup
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite table
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          --output "${RUNNER_TEMP}/chain-table-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/table.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-table-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-table-${{ github.run_id }}-${{ github.run_attempt }}/table.json
-          if-no-files-found: error

.github/workflows/rustfs-tier-test.yml

@@ -1,18 +1,12 @@
 name: RustFS Tier Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test. Leave empty for nightly.'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
         required: false
-        default: ''
+        default: '1.0.0-rc.4-preview.1'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -45,7 +39,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -67,14 +61,9 @@ env:
 jobs:
   tier-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 420
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
-      - name: Checkout chain tooling
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
       - name: Initialize run evidence directory
         id: evidence
         run: |
@@ -87,24 +76,27 @@ jobs:
           test -d "${TIER_ARTIFACTS_DIR}"
           test ! -L "${TIER_ARTIFACTS_DIR}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Prepare pinned RustFS CLI
-        timeout-minutes: 5
         id: rc
         run: |
           set -euo pipefail
@@ -217,7 +209,6 @@ jobs:
           df -h /data | tail -1
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         run: |
           set -euo pipefail
           sudo docker rm -f rustfs-test-mqtt >/dev/null 2>&1 || true
@@ -238,7 +229,6 @@ jobs:
           done
 
       - name: Ensure MQTT broker + clients
-        timeout-minutes: 5
         run: |
           set -euo pipefail
           if ! command -v mosquitto_sub >/dev/null 2>&1; then
@@ -268,9 +258,6 @@ jobs:
 
       - name: Run tier suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
         continue-on-error: true
         env:
           PACKAGE_URL_INPUT: ${{ inputs.package_url }}
@@ -312,8 +299,6 @@ jobs:
           mv "${TMP_FILE}" "${RESULT_FILE}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         env:
           PACKAGE_URL_INPUT: ${{ inputs.package_url }}
@@ -358,20 +343,6 @@ jobs:
               echo "Structured report generation failed before producing output (exit ${CASE_GATE_RC})."
             } > "${CASE_TABLE}"
           fi
-          # The tier case table carries a "## Case Summary" bullet list
-          # (Total/PASS/FAIL/...); parse the counts from there. Fall back to
-          # the case-ID table rows if the bullets are absent.
-          CASES_FAIL="$(grep -m1 -E '^- FAIL: [0-9]+' "${CASE_TABLE}" 2>/dev/null | grep -oE '[0-9]+' || true)"
-          if [ -n "${CASES_FAIL}" ]; then
-            CASES_PASS="$(grep -m1 -E '^- PASS: [0-9]+' "${CASE_TABLE}" 2>/dev/null | grep -oE '[0-9]+' || true)"
-            CASES_PASS=$(( ${CASES_PASS:-0} + 0 ))
-          else
-            CASES_TOTAL="$(grep -cE '^\| [A-Za-z0-9_.-]+ \| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-            CASES_FAIL="$(grep -cE '^\| [A-Za-z0-9_.-]+ \| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-            CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-            CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          fi
-          CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
           {
             echo "# RustFS tier test report"
             echo ""
@@ -384,8 +355,6 @@ jobs:
             echo ""
             cat "${CASE_TABLE}"
             echo ""
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
             echo "## Log tail"
             echo '```text'
             tail -n 200 "${LOG_FILE}" || true
@@ -394,7 +363,6 @@ jobs:
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -427,7 +395,6 @@ jobs:
           rm -f "${B64_FILE}"
 
       - name: Verify required tier evidence
-        timeout-minutes: 2
         id: evidence_verify
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
@@ -458,16 +425,14 @@ jobs:
           [ "${failed}" -eq 0 ]
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-tier-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ env.TIER_ARTIFACTS_DIR }}/
           if-no-files-found: error
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: always()
         run: |
           set -euo pipefail
@@ -489,7 +454,6 @@ jobs:
           done
 
       - name: Cleanup pinned RustFS CLI
-        timeout-minutes: 2
         if: always()
         run: |
           set -euo pipefail
@@ -532,8 +496,7 @@ jobs:
           [ "${failed}" -eq 0 ]
 
       - name: File failure issue in rustfs/backlog
-        timeout-minutes: 2
-        if: ${{ always() && (steps.evidence.outcome != 'success' || steps.test.outcome == 'cancelled' || steps.evidence_verify.outcome == 'failure' || steps.evidence_verify.outcome == 'cancelled' || (steps.gate.outcome == 'failure' && steps.test.outcome != 'failure') || steps.gate.outcome == 'cancelled') }}
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled' || steps.evidence_verify.outcome == 'failure' || steps.evidence_verify.outcome == 'cancelled' || steps.gate.outcome == 'failure' || steps.gate.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
@@ -552,10 +515,10 @@ jobs:
             echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID}, attempt ${GITHUB_RUN_ATTEMPT})"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
           EXISTING="$(gh issue list -R rustfs/backlog --state all \
             --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number,title --jq ".[] | select(.title == \"${TITLE}\") | .number")"
+            --json number --jq '.[].number' || true)"
           if [ -n "${EXISTING}" ]; then
             echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
@@ -602,68 +565,6 @@ jobs:
           fi
           echo "filed backlog issue for suite ${SUITE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Case-level issue management complements the infrastructure failure report:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          TEST_OUTCOME: ${{ steps.test.outcome }}
-          VERIFY_OUTCOME: ${{ steps.evidence_verify.outcome }}
-          GATE_OUTCOME: ${{ steps.gate.outcome }}
-          SUITE: 'tier'
-          SUITE_LABEL: 'Tier'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
-            exit 0
-          fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
-            exit 0
-          fi
-          if [ ! -d "${TIER_ARTIFACTS_DIR}" ] || [ -L "${TIER_ARTIFACTS_DIR}" ]; then
-            echo "tier evidence directory is missing or unsafe; skipping backlog issue management" >&2
-            exit 1
-          fi
-          OUTCOME="${TEST_OUTCOME}"
-          if [ "${OUTCOME}" != "cancelled" ] && { [ "${VERIFY_OUTCOME}" != "success" ] || [ "${GATE_OUTCOME}" != "success" ]; }; then
-            OUTCOME=failure
-          fi
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${OUTCOME}" \
-            --report "${TIER_ARTIFACTS_DIR}/rustfs-tier-cases.md" \
-            --report-file "${TIER_ARTIFACTS_DIR}/rustfs-tier-report.md" \
-            --log "${TIER_ARTIFACTS_DIR}/rustfs-tier.log" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
-
       - name: "Continue functional chain (next: Storage engine)"
         # Only chain-triggered runs forward to the next suite; standalone
         # workflow_dispatch runs stop after their own cleanup. A failed
@@ -718,24 +619,3 @@ jobs:
         run: |
           echo "RustFS tier suite failed"
           echo "See the uploaded report and log artifacts for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite tier
-          --report "${TIER_ARTIFACTS_DIR}/rustfs-tier-cases.md"
-          --output "${RUNNER_TEMP}/chain-tier-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/tier.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-tier-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-tier-${{ github.run_id }}-${{ github.run_attempt }}/tier.json
-          if-no-files-found: error

.github/workflows/rustfs-upgrade-test.yml

@@ -15,12 +15,6 @@
 name: RustFS Upgrade Test
 
 on:
-  workflow_call:
-    inputs:
-      chain_manifest:
-        description: Verified candidate and chain attempt from the chain driver
-        type: string
-        required: true
   workflow_dispatch:
     inputs:
       from_version:
@@ -67,7 +61,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: rustfs-shared-functional-tests-v2
+  group: rustfs-shared-functional-tests
   cancel-in-progress: false
 
 defaults:
@@ -85,11 +79,11 @@ env:
 jobs:
   upgrade-test:
     runs-on: smoke-testing
-    timeout-minutes: 60
-    if: ${{ inputs.chain_manifest != '' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
+    timeout-minutes: 420
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
     steps:
       - name: Checkout repository (for report parser)
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -107,21 +101,25 @@ jobs:
             printf 'TMPDIR=%s-scratch\n' "${FUNCTIONAL_ARTIFACTS_DIR}"
           } >> "${GITHUB_ENV}"
 
-      - name: Bind functional candidate
-        id: chain
-        if: ${{ inputs.chain_manifest != '' }}
+      # auto-testing is private: clone it with the dedicated PF token (not
+      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+      - name: Checkout auto-testing scripts (with retry)
         env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-        run: python3 scripts/functional_chain_evidence.py consume
-
-      - name: Checkout auto-testing scripts
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/auto-testing
-          ref: ${{ steps.chain.outputs.testing_sha || 'main' }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          path: auto-testing
-          persist-credentials: false
+          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          rm -rf auto-testing
+          for attempt in 1 2 3 4 5; do
+            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
+              echo "auto-testing cloned (attempt ${attempt})"
+              exit 0
+            fi
+            rm -rf auto-testing
+            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
+            sleep $((attempt * 15))
+          done
+          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
+          exit 1
 
       - name: Show environment
         run: |
@@ -133,7 +131,6 @@ jobs:
           df -h /data | tail -1
 
       - name: Cleanup environment (before)
-        timeout-minutes: 5
         if: ${{ inputs.cleanup_before != 'false' || github.event_name != 'workflow_dispatch' }}
         run: |
           set -euo pipefail
@@ -153,7 +150,6 @@ jobs:
           done
 
       - name: Ensure docker (Vault container)
-        timeout-minutes: 5
         run: |
           if ! command -v docker >/dev/null 2>&1; then
             sudo apt-get update
@@ -164,10 +160,6 @@ jobs:
 
       - name: Run upgrade compatibility suite
         id: test
-        timeout-minutes: 45
-        # Case failures keep the run green: the report and the backlog
-        # issue manager carry the product signal.
-        continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
         run: |
@@ -207,7 +199,7 @@ jobs:
             local version="$1" tag asset url
             [ -n "${version}" ] && [ "${version}" != "null" ] || return 0
             tag="${version#v}"
-            asset="rustfs-linux-x86_64-gnu-v${tag}.deb"
+            asset="rustfs_${tag//-/.}_amd64.deb"
             url="https://github.com/rustfs/rustfs/releases/download/${tag}/${asset}"
             if ! gh api "repos/rustfs/rustfs/releases/tags/${tag}" --jq '.assets[].name' 2>/dev/null | grep -qxF "${asset}"; then
               echo "ERROR: release ${tag} has no downloadable asset ${asset}:" >&2
@@ -226,8 +218,6 @@ jobs:
           ./auto-testing/rustfs-upgrade-test.sh "${ARGS[@]}"
 
       - name: Generate report
-        id: chain_report
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         run: |
           set -euo pipefail
@@ -257,21 +247,6 @@ jobs:
           if [ '${{ steps.test.outcome }}' = 'success' ] && [ "${CASE_RESULT}" = 'success' ]; then
             RESULT=success
           fi
-
-          # Product gate: failing cases keep the run green — they are reported
-          # below and tracked in rustfs/backlog. Only harness/environment
-          # breakdowns (the suite never reached case level, or a wholesale
-          # failure with zero passes) turn the workflow red.
-          CASES_TOTAL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| (PASS|FAIL|UNSUPPORTED|RUNNING) \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_FAIL="$(grep -cE '^\| [A-Z][A-Z0-9]*-[0-9]+ .*\| FAIL \|' "${CASE_TABLE}" 2>/dev/null || true)"
-          CASES_TOTAL=$(( ${CASES_TOTAL:-0} + 0 )); CASES_FAIL=$(( ${CASES_FAIL:-0} + 0 ))
-          CASES_PASS=$(( CASES_TOTAL - CASES_FAIL ))
-          HARNESS_OK=0
-          if [ '${{ steps.test.outcome }}' = 'success' ]; then
-            HARNESS_OK=1
-          elif [ '${{ steps.test.outcome }}' = 'failure' ] && [ "${CASES_TOTAL}" -gt 0 ] && [ "${CASES_PASS}" -ge 1 ]; then
-            HARNESS_OK=1
-          fi
           {
             echo "# RustFS upgrade compatibility report"
             echo ""
@@ -284,31 +259,23 @@ jobs:
             echo "- Test Step Outcome: ${RESULT}"
             echo "- Suite Step Outcome: ${{ steps.test.outcome }}"
             echo ""
-            if [ -s "${MATRIX_TABLE}" ]; then
+            if [ "${RESULT}" = "success" ]; then
               cat "${MATRIX_TABLE}"
               echo ""
-            fi
-            if [ -s "${CASE_TABLE}" ]; then
               cat "${CASE_TABLE}"
               echo ""
-            fi
-            echo "- Product result: ${CASES_PASS} passed, ${CASES_FAIL} failed (failing cases are tracked in rustfs/backlog)"
-            echo ""
-            if [ -s "${CASE_TABLE}" ]; then
               echo "## Log tail"
               echo '```text'
-              tail -n 200 "${LOG_FILE}" 2>/dev/null || true
+              tail -n 200 "${LOG_FILE}"
               echo '```'
             else
               echo "The suite or evidence validation failed. See this run's artifact for partial case results and suite.log."
             fi
           } | tee "${REPORT_FILE}"
           cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-          # Red only for harness/environment breakdowns; case failures stay green.
-          [ "${HARNESS_OK}" = "1" ]
+          [ "${RESULT}" = "success" ]
 
       - name: Upload functional report to dashboard
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
         continue-on-error: true
         env:
@@ -339,68 +306,69 @@ jobs:
           fi
           rm -f "${B64_FILE}"
 
-      - name: Manage backlog issues (dedup / label / auto-close)
-        timeout-minutes: 2
-        # Replaces the old per-run failure filing. One entry point that:
-        # - dedups by signal: failing cases are matched against open backlog
-        #   issues by label (category + case ID); covered cases become a
-        #   comment on the existing issue, only uncovered cases file a new one
-        # - labels new issues (functional-test, category, case IDs, env)
-        # - closes fixed issues after a fully green run
-        # - never files or closes on cancelled runs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
+      - name: File failure issue in rustfs/backlog
+        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
           SUITE: 'upgrade'
           SUITE_LABEL: 'Upgrade compatibility'
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set -euo pipefail
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue management"
+            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
             exit 0
           fi
-          if [ ! -f auto-testing/scripts/issue_manager.py ]; then
-            echo "issue_manager.py not found in auto-testing checkout; skipping"
+          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
+          EXISTING="$(gh issue list -R rustfs/backlog --state all \
+            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
+            --json number --jq '.[].number' || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
             exit 0
           fi
-          FROM_URL='${{ inputs.from_url }}'
-          FROM_VERSION='${{ inputs.from_version }}'
-          TO_URL='${{ inputs.to_url }}'
-          TO_VERSION='${{ inputs.to_version }}'
-          PACKAGE_SOURCE=""
-          if [ -n "${TO_URL}" ]; then
-            PACKAGE_SOURCE="to ${TO_URL}"
-          elif [ -n "${TO_VERSION}" ]; then
-            PACKAGE_SOURCE="to version ${TO_VERSION}"
-          else
-            PACKAGE_SOURCE="to ${RUSTFS_NIGHTLY_PACKAGE_URL}"
+          redact() {
+            sed -E \
+              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
+              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
+              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
+          }
+          BODY_FILE="$(mktemp)"
+          {
+            echo "The **${SUITE_LABEL}** functional suite failed."
+            echo ""
+            echo "- Suite: \`${SUITE}\`"
+            echo "- Run: ${RUN_URL}"
+            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
+            echo "- Workflow Commit: ${GITHUB_SHA}"
+            echo "- Trigger: ${GITHUB_EVENT_NAME}"
+            echo "- Date: $(date -u +%Y-%m-%d)"
+            echo ""
+            echo "## Report (errors and symptoms)"
+            echo ""
+            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
+              redact < "${REPORT_FILE}"
+            elif [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${LOG_FILE:-}" ]; then
+              echo "(report file missing; log tail below)"
+              echo ""
+              tail -n 200 "${LOG_FILE}" | redact
+            else
+              echo "(no report or log file was produced)"
+            fi
+          } | head -c 55000 > "${BODY_FILE}"
+          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
+          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
+              --body-file "${BODY_FILE}" --label functional-test; then
+            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
           fi
-          if [ -n "${FROM_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_SOURCE}; from ${FROM_URL}"
-          elif [ -n "${FROM_VERSION}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_SOURCE}; from version ${FROM_VERSION}"
-          fi
-          python3 auto-testing/scripts/issue_manager.py handle \
-            --repo rustfs/backlog \
-            --suite "${SUITE}" --category "${SUITE}" --suite-label "${SUITE_LABEL}" \
-            --outcome "${{ steps.test.outcome }}" \
-            --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md" \
-            --report-file "${REPORT_FILE}" \
-            --log "${LOG_FILE}" \
-            --run-url "${RUN_URL}/attempts/${GITHUB_RUN_ATTEMPT}#summary" \
-            --run-id "${GITHUB_RUN_ID}" \
-            --attempt "${GITHUB_RUN_ATTEMPT}" \
-            --commit "${GITHUB_SHA}" \
-            --trigger "${{ github.event_name }}" \
-            --package-source "${PACKAGE_SOURCE}" \
-            --date "$(date -u +%Y-%m-%d)"
+          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload report and logs
-        timeout-minutes: 2
         if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-upgrade-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -412,7 +380,6 @@ jobs:
           retention-days: 3
 
       - name: Cleanup environment (after)
-        timeout-minutes: 5
         if: ${{ always() && (inputs.cleanup_after != 'false' || github.event_name != 'workflow_dispatch') }}
         run: |
           set -euo pipefail
@@ -487,24 +454,3 @@ jobs:
           echo "From: ${{ inputs.from_url || inputs.from_version || 'release (default)' }}"
           echo "To: ${{ inputs.to_url || inputs.to_version || 'nightly (R2 latest)' }}"
           echo "See the uploaded report and logs for details."
-
-      - name: Record chain evidence
-        id: chain_record
-        if: ${{ always() && inputs.chain_manifest != '' && steps.evidence.outcome == 'success' }}
-        env:
-          CHAIN_MANIFEST: ${{ inputs.chain_manifest }}
-          CHAIN_JOB_STATUS: ${{ job.status }}
-          CHAIN_TEST_OUTCOME: ${{ steps.test.outcome }}
-          CHAIN_REPORT_OUTCOME: ${{ steps.chain_report.outcome }}
-        run: >-
-          python3 scripts/functional_chain_evidence.py record --suite upgrade
-          --report "${FUNCTIONAL_ARTIFACTS_DIR}/cases.md"
-          --output "${RUNNER_TEMP}/chain-upgrade-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/upgrade.json"
-
-      - name: Upload chain evidence
-        if: ${{ always() && steps.chain_record.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: functional-chain-upgrade-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/chain-upgrade-${{ github.run_id }}-${{ github.run_attempt }}/upgrade.json
-          if-no-files-found: error

.github/workflows/schedule-failure-alert-drill.yml

@@ -19,9 +19,7 @@
 # 'failure')` wiring used by the real consumers (e2e-s3tests, mint, fuzz,
 # performance-ab). Dispatch it twice to verify both the issue-creation and
 # the dedupe-comment paths, then close the resulting
-# "[scheduled-failure] Schedule Failure Alert Drill" issue in rustfs/backlog
-# (the default target repository). Requires the BACKLOG_ISSUE_TOKEN secret
-# (a token with issues:write on rustfs/backlog).
+# "[scheduled-failure] Schedule Failure Alert Drill" issue.
 #
 # The run itself is expected to end red (the forced failure); only the
 # alert-on-failure job result matters.
@@ -44,7 +42,7 @@ permissions:
 jobs:
   forced-failure:
     name: Forced failure
-    runs-on: sm-standard-2
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Fail on purpose
@@ -64,10 +62,10 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}