test(ecstore): accept quorum-persisted fencing epochs

.agents/skills/adversarial-validation/references/compatibility.md

@@ -22,17 +22,3 @@
   fixtures and encrypted migration data.
 - Compatibility shims use `RUSTFS_COMPAT_TODO(<task-id>)`, have a removal
   condition, and default toward reading old data safely.
-
-## Outbound targets
-
-- A change to what the replication or migration client sends by default
-  (checksum policy, payload framing, headers, version-id addressing) is judged
-  against every target class, not the one it fixes. Name each target-side rule
-  the current default satisfies — checksum required with Object Lock
-  parameters, `aws-chunked` decoding, version-id adoption, ETag equals content
-  MD5 — and show which cell of
-  `crates/e2e_test/src/replication_target_matrix_test.rs` covers each.
-- A test that asserts the fix ("no trailer header") is not evidence; the
-  matrix cell that asserts the target accepted and stored the object is.
-- Every new environment escape hatch appears in
-  `docs/operations/replication-outbound-transport.md` in the same diff.

.agents/skills/arch-checks/SKILL.md

@@ -50,11 +50,10 @@ consider adding it to the script's `checked_files` list.
 
 ## `check_doc_paths.sh`
 
-Instruction docs (`AGENTS.md`, `CLAUDE.md`, `ARCHITECTURE.md`) and every
+Instruction/architecture docs (`AGENTS.md`, `CLAUDE.md`, `ARCHITECTURE.md`,
-Markdown file under `docs/` (architecture, operations, testing, index) must not
+`docs/architecture/*.md`) must not reference repo file paths that no longer
-reference repo file paths that no longer exist. If your refactor moved code,
+exist. If your refactor moved code, update the docs that point at it — the
-update the docs that point at it — the error message lists `doc -> stale-path`
+error message lists `doc -> stale-path` pairs.
-pairs. Cite paths plus symbol names, never line numbers (see `docs/README.md`).
 
 ## `check_no_planning_docs.sh`
 

.agents/skills/rustfs-release-publish/SKILL.md

@@ -6,7 +6,7 @@ description: "Run the end-to-end RustFS console gate, version bump, preview vali
 
 This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (which only edits version files and opens the PR) with a mandatory preview-tag validation loop before the final tag is published.
 
-Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. A preview tag creates a visible GitHub Release marked Prerelease and uploads versioned assets, but it never becomes GitHub Latest and never updates `*-latest`, `latest.json`, R2, Docker, or Helm channels. That Release is temporary: `build.yml` deletes it automatically once the final tag's Release is published, so the Releases page ends up carrying deliverables only while the `-preview.N` tags stay behind as the traceability record. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and preview classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.
+Core design: **version files never carry a `-preview.N` suffix**. The preview suffix exists only in tag names. A preview tag creates a visible GitHub Release marked Prerelease and uploads versioned assets, but it never becomes GitHub Latest and never updates `*-latest`, `latest.json`, R2, Docker, or Helm channels. This works because the binary self-reports the git tag it was built from (`build::TAG` via shadow_rs, see `rustfs/src/config/cli.rs` `SHORT_VERSION`), and `build.yml` derives artifact names and preview classification from the tag name — Cargo.toml's version is only a no-tag fallback. Therefore the preview tag and the final tag can (and MUST) point at the exact same commit: what you validated is byte-for-byte the source that ships.
 
 Pipeline shape:
 
@@ -19,7 +19,6 @@ check console main against its latest Release
   -> validate with latest rc client
   -> report preview acceptance results -> STOP for explicit human confirmation
   -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
-  -> CI deletes the <target>-preview.N Releases (tags kept)
 ```
 
 On validation failure: fix lands on main via normal PR (version files are already at `<target>`, no new bump PR), then tag `<preview-tag N+1>` at the new main commit and restart from Phase 2.
@@ -52,16 +51,14 @@ Rules:
 - Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
 - The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
 - A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Docker, or Helm publication is a pipeline failure.
-- Preview Releases are cleaned up by the `cleanup-preview-releases` job after `publish-release` succeeds for the deliverable tag. It deletes every Release whose tag is exactly `<target>-preview.<digits>` and never passes `--cleanup-tag`, so the tags survive.
 
 ## Hard rules
 
 - Version files (Cargo.toml, Cargo.lock, README, flake.nix, Chart.yaml, rustfs.spec) are bumped ONCE, directly to `<target>`. Never write a `-preview.N` suffix into any version file. If `rustfs-release-version-bump` is ever asked for a `-preview` version, that is a pipeline bug — stop.
-- Preview Release assets are versioned and intentionally visible on the Releases page for the duration of validation. Do not label them Latest or use them to update any latest distribution channel.
+- Preview Release assets are versioned and intentionally visible on the Releases page. Do not label them Latest or use them to update any latest distribution channel.
-- Never delete a preview Release by hand before Phase 6 finishes — Phase 4 downloads its assets and the final Release notes are generated while it still exists. Cleanup is CI's job; only step in manually (`gh release delete "<preview-tag>" --yes`, never `--cleanup-tag`) if `cleanup-preview-releases` failed.
 - Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
 - The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD (commits merged after validation are unvalidated), and never create an extra version-bump commit between preview and final.
-- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag — cleanup runs after the notes are generated, so the preview Release is still present and would otherwise be picked as the baseline. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
+- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
 - Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
 - Phases run in order; a failure in any phase blocks everything after it. After the fix lands on main, restart from Phase 2 with the next preview iteration against the new `origin/main` hash — do not resume mid-pipeline against a stale hash.
 - Completing preview acceptance does not authorize the final tag. After Phases 3–5 pass, report the acceptance evidence and stop until the user explicitly confirms continuation. The original release request, an earlier confirmation, silence, or an automated follow-up does not satisfy this gate.
@@ -233,7 +230,6 @@ git push origin "<target>"
 - CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
 - Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
 - Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
-- Verify the preview cleanup: `cleanup-preview-releases` must succeed, `gh release view "<preview-tag>"` must then report `release not found` for every preview iteration of this target, and `git rev-parse "<preview-tag>^{commit}"` must still resolve to `PREVIEW_HASH` (the tag is kept). If the job failed, delete the leftover Releases manually with `gh release delete "<preview-tag>" --yes` and report it.
 - Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.
 
 ## Output contract
@@ -243,5 +239,5 @@ Always report:
 - Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
 - Target version, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
 - Manual confirmation gate status (`WAITING_FOR_CONFIRMATION` or `CONFIRMED`) and its exact target, preview tag, and `PREVIEW_HASH`.
-- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, the rc command matrix, and the preview-Release cleanup result (deleted Releases plus surviving tags).
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, and the rc command matrix.
 - Any deviation from this pipeline and why the user approved it.

.agents/skills/security-advisory-lessons/references/advisory-patterns.md

@@ -48,7 +48,6 @@ Update this file only when an advisory adds or changes a reusable lesson, affect
 
 ### S3 object actions, copy, multipart, and upload policy validation
 
-- `GHSA-g8w9-qw9q-fghr`: a valid presigned `PutObject` accepted extra `x-amz-tagging`, website redirect, and storage-class headers omitted from `SignedHeaders`. Lesson: a presigned URL is a bounded capability; reject `x-amz-*` headers that are not cryptographically bound by the signature so unsigned metadata cannot change authorization, lifecycle, redirect, cost, or durability semantics.
 - `GHSA-3ppv-fx5m-m749`: explicit `versionId` reads and copy sources authorized `s3:GetObject` instead of `s3:GetObjectVersion`. Lesson: version-specific object access must select version-specific actions for direct reads, `CopyObject`, and `UploadPartCopy`, with tests proving the backend is not reached on denial.
 - `GHSA-x298-9x87-fvjq`: anonymous `ListObjectVersions` fell back to `ListBucket` and returned before public-access-block gates. Lesson: compatibility fallbacks must converge on the same post-authorization checks as direct grants, especially `RestrictPublicBuckets` and anonymous data-plane denies.
 - `GHSA-mx42-j6wv-px98`: `UploadPartCopy` missed source authorization and allowed cross-bucket object exfiltration. Lesson: multipart copy must enforce the same source and destination contract as `CopyObject`.
@@ -120,7 +119,7 @@ Use these targeted searches when a diff touches security-sensitive code:
 ```bash
 rg -n "validate_admin_request|check_permissions|AdminAction::|deny_only|is_allowed" rustfs crates
 rg -n "authorize_operation|FtpsDriver|SftpDriver|RETR|MKD|SIZE|MDTM|CreateBucket|GetObject|HeadObject" crates/protocols rustfs
-rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|presign|SignedHeaders|content-length-range|starts-with" rustfs crates
+rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|content-length-range|starts-with" rustfs crates
 rg -n "ListBucketVersions|GetObjectVersion|versionId|VersionId|ExistingObjectTag|ForAllValues|ForAnyValue|POLICY_PLUGIN|opa" rustfs crates
 rg -n "normalize_extract_entry_key|Snowball|auto-extract|PathBuf::join|canonicalize|\\.\\.|x-forwarded-for|x-real-ip|SourceIp" rustfs crates
 rg -n "DEFAULT_SECRET|DEFAULT_ACCESS|TEST_PRIVATE_KEY|rustfs rpc|RUSTFS_RPC_SECRET" rustfs crates
@@ -137,7 +136,6 @@ rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
 - Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases, and assert denied paths do not reach the storage backend.
 - IAM fixes: include import/update/list service-account cases with attacker-controlled parent, claims, access key, secret key, and policy.
 - Copy/upload fixes: include cross-bucket, cross-user, source-denied, destination-denied, copy-source-condition, and multipart completion cases.
-- Presigned upload fixes: include a valid presign with extra unsigned tagging, redirect, and storage-class headers; require rejection before storage access, and verify explicitly signed equivalents still work.
 - Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, and multipart-copy source cases.
 - Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, plugin mode, and built-in policy mode.
 - Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks.

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=85ee9b9e66e916dbf51857298637b6bcd1c23c2b066aaa4c171ce961c2d002b5
+sha256-darwin=d6aa36cfaae2c4d8590482c7e47138c5965b335b34a75f50d11ffc3366e9021e
-sha256-linux=a2933d83dfe74ffa03410a0959333a1c48288b8469ca9f17273d449d7510c24b
+sha256-linux=c8315465f50c194faee36141cdbb1e15e59271e524d948564a69e2d5eb408f2a

.config/e2e-nightly-selection.txt

@@ -1,2 +1 @@
-sha256-darwin=a5665318c9bdc0947514fb7008ba1b83b114b739fac775c3c446f207058b7c7a
+sha256=9b9bc336b43b70d0e06e0adb5455bf035bb18945d85d60936eb6fe4d48e0e680
-sha256-linux=45d80e1723de5d25bb5b81f3ef5c82f583efc3e4f036a8cd2bb99e4f1eca9e51

.config/e2e-odm-interop-selection.txt

@@ -1 +0,0 @@
-sha256=87c05c46d611ea7ed3feb5f7276bda8e5a0f70d72165d305d73a457907e7ba79

.config/e2e-repl-nightly-selection.txt

@@ -1 +1 @@
-sha256=95c8adc016bbc0df9fb2afa24a108bcdf6567ec4d0518725a6cae301593ab556
+sha256=655a3f3c1d042e694339d15caba7580518320322d1bac0f09450b37e6c09e2e7

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=a2542dc86bbff56b2177efc621785c56fa7e8d813b209b7d935e1e41a9f0ad15
+sha256=294350518743cac8d7c41880a2835216e4b697908d7b0b1bc92b62816d94c59d

.config/ecstore-required-tests.json

@@ -1,72 +0,0 @@
-{
-  "lane": "ci/test-and-lint",
-  "tests": [
-    {
-      "invariant": "write-quorum",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::inline_put_commit_path_tests::inline_put_direct_commit_accepts_exact_quorum_and_rejects_quorum_minus_one"
-    },
-    {
-      "invariant": "metadata-rollback",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::write_unique_file_info_reverts_metadata_when_write_quorum_fails"
-    },
-    {
-      "invariant": "stale-writer",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::put_object_no_lock_aborts_after_outer_namespace_lock_loss"
-    },
-    {
-      "invariant": "range-body",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::transition_upload_integrity_tests::transitioned_compressed_object_range_get_returns_plaintext_slice"
-    },
-    {
-      "invariant": "multipart-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::cancelled_complete_keeps_upload_lock_through_tail_cleanup"
-    },
-    {
-      "invariant": "list-uncommitted-version",
-      "suite": "rustfs-filemeta",
-      "name": "metacache::tests::resolve_with_write_quorum_slack_keeps_partial_latest_hidden_during_merge"
-    },
-    {
-      "invariant": "minio-object-fixture",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::parses_real_minio_object_xlmeta"
-    },
-    {
-      "invariant": "corrupt-part-arrays",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::crc_valid_but_part_arrays_corrupt_into_fileinfo_errors_not_panics"
-    }
-  ],
-  "fixtures": [
-    {
-      "path": "crates/filemeta/tests/fixtures/minio/object_large_bin.xlmeta.hex",
-      "sha256": "e8093767806d701e639b48d023190e858fbc4cde69bcfd83c22af8cba8452ce5",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/minio/object_small_txt.xlmeta.hex",
-      "sha256": "2a415ad3a3be5a9440035d4026ff880e0e8c1ec1701be9f4e077734e8dce03da",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/minio/object_versioned_txt.xlmeta.hex",
-      "sha256": "7f21f50c326dd8b0228deb6dbdb7052b3d0a3f8ee6c85d43486f0e6bb7a97261",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/minio/bucket_metadata.blob.hex",
-      "sha256": "f2b6e260aff106adf6039feb1c645686e84e75404ff725491fb18668be5db203",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/minio/bucket_metadata_full.xlmeta.hex",
-      "sha256": "3b6de589519c08a1614c8bd409bb8199c17d42043861b07bce513075e6fbfc12",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    }
-  ]
-}

.config/make/coverage.mak

@@ -23,4 +23,4 @@ coverage: core-deps ## Workspace line coverage (cargo-llvm-cov + nextest; slow,
 	@mkdir -p target/llvm-cov
 	cargo llvm-cov report --lcov --output-path target/llvm-cov/lcov.info
 	cargo llvm-cov report --json --output-path target/llvm-cov/coverage.json
-	$(RUSTFS_PYTHON_BIN) scripts/coverage_per_crate.py target/llvm-cov/coverage.json
+	python3 scripts/coverage_per_crate.py target/llvm-cov/coverage.json

.config/make/lint-fmt.mak

@@ -88,7 +88,7 @@ offline-enrollment-e2e-check: core-deps ## Build and exercise the dedicated offl
 .PHONY: test-wiring-check
 test-wiring-check: ## Check tests stay registered and selected by their intended runners
 	@echo "🧪 Checking test wiring..."
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py
+	python3 ./scripts/check_test_wiring.py
 
 .PHONY: log-analyzer-rules-check
 log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source

.config/make/tests.mak

@@ -35,16 +35,13 @@ script-tests: ## Run shell script tests
 	./scripts/test_pinned_paired_abba_bench.sh
 	./scripts/test_manual_transition_runbooks.sh
 	./scripts/test_fuzz_runner.sh
-	./scripts/test_python_bin.sh
 	./scripts/check_embedded_secrets.sh --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py --self-test
+	python3 ./scripts/check_test_wiring.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_e2e_binary.py
+	python3 ./scripts/check_security_coverage.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_security_coverage.py --self-test
+	python3 ./scripts/check_scheduled_validation_freshness.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_scheduled_validation_freshness.py --self-test
+	python3 ./scripts/s3-tests/test_report_compat.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_security_workflow.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_report_compat.py
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_object_data_cache_follower_samples.py --self-test
+	python3 ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test
 
 .PHONY: test

.config/nextest.toml

@@ -46,11 +46,6 @@ e2e-reliability = { max-threads = 1 }
 e2e-inline-boundaries = { max-threads = 1 }
 e2e-cluster-nightly = { max-threads = 1 }
 
-# Deep async storage futures are composed into tests across several crates.
-# Keep the test stack bounded but above libtest's 2 MiB default.
-[scripts.setup.ecstore-base-stack]
-command = ['sh', '-c', 'echo RUST_MIN_STACK=4194304 >> "$NEXTEST_ENV"']
-
 # These exact regression scenarios build deep async storage futures that exceed
 # libtest's 2 MiB spawned-thread stack on Linux. Give only their test processes
 # the same 32 MiB stack already used by the crate's dedicated large-stack tests.
@@ -65,13 +60,9 @@ command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 
 # --- default profile (local): serialize the flaky groups, never retry --------
 [[profile.default.scripts]]
-filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
+filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|prepared_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)))$/)'
 setup = 'ecstore-large-stack'
 
-[[profile.default.scripts]]
-filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
-setup = 'ecstore-base-stack'
-
 [[profile.default.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
@@ -89,29 +80,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the heal result-report tests. Every test in the module builds a
-# real-disk (TempDir-backed) hermetic erasure set and drives MiB-scale writes
-# plus deep-scan heal — the same load-sensitive cross-disk IO shape as the
-# crash_consistency scenarios above. Under a heavily parallel run a single
-# disk's IO can fail while write quorum still holds, which flips per-disk
-# readback and aggregate-outcome assertions nondeterministically (different
-# tests each round; all pass standalone). Preventive serialization only, no
-# retries. The matching ci-profile override is after [profile.ci].
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::heal::heal_result_report_tests::/)'
-test-group = 'ecstore-serial-flaky'
-
-# Serialize the metadata-cache generation-retirement pair. Both carry
-# #[serial(metadata_cache_invalidation_probe)] — a no-op across nextest's
-# process boundary — and assert get_object_metadata_cache generation
-# semantics on a 4-disk hermetic set, the same load-sensitive shape that
-# forced the transition matrix tests into this group. Preventive
-# serialization only, no retries. The matching ci-profile override is after
-# [profile.ci].
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(retires_cached_snapshot)'
-test-group = 'ecstore-serial-flaky'
-
 # The production-handler relocation regression builds an isolated 8-disk,
 # 2-pool store and commits a 72 MiB multipart object. Keep that cross-disk IO
 # from overlapping the ecstore commit fixtures above.
@@ -132,29 +100,12 @@ test-group = 'embedded-test-ports'
 filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the transition matrix tests. They build a 4-disk hermetic erasure
-# set, populate the get_object_metadata_cache, and assert generation lifecycle
-# semantics. serial_test's #[serial] has no effect across nextest's process
-# boundary, so concurrent execution races the shared metadata-cache generation
-# counter and causes spurious "metadata read should publish the generation"
-# panics. Preventive serialization, no retries.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(set_disk::transition_matrix_tests::)'
-test-group = 'ecstore-serial-flaky'
-
 # The durable ILM decommission regressions build isolated multi-pool stores and
 # deliberately take source or target disks offline while checking fencing.
 [[profile.default.overrides]]
 filter = 'package(rustfs-ecstore) & (test(decommission_migrates_and_verifies_registered_durable_ilm_records) | test(decommission_durable_ilm_target_read_error_is_not_masked_by_peer_success) | test(decommission_durable_ilm_terminal_receipt_recovers_failed_source_cleanup) | test(decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page) | test(decommission_durable_ilm_recovery_keeps_multiple_active_sources))'
 test-group = 'ecstore-serial-flaky'
 
-# Decommission entry and marker/barrier tests share process-wide fault hooks and
-# deterministic commit barriers. Keep the whole init decommission family in one
-# nextest group; serial_test alone cannot isolate separate test processes.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_|suspended_.*decommission)$/)'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the bucket-incarnation / lifecycle-fence tests. They drive
 # init_bucket_metadata_sys and bucket_metadata_sys_of, i.e. process-global
 # OnceLock state that serial_test's #[serial] cannot protect across nextest's
@@ -206,13 +157,9 @@ fail-fast = false
 path = "junit.xml"
 
 [[profile.ci.scripts]]
-filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
+filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|prepared_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)))$/)'
 setup = 'ecstore-large-stack'
 
-[[profile.ci.scripts]]
-filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
-setup = 'ecstore-base-stack'
-
 [[profile.ci.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
@@ -258,6 +205,16 @@ retries = 2
 filter = 'package(rustfs) & test(execute_get_object_resumes_from_relocated_pool_without_splicing_body)'
 test-group = 'ecstore-serial-flaky'
 
+# QUARANTINE: OPEN rustfs#6711 — the multipart fencing test's epoch helper
+# reads xl.meta back from EVERY disk, but a multipart commit only guarantees
+# quorum-many disks have persisted; a lagging disk under CI load panics the
+# read-back with "file not found" (observed on the rio-v2 leg of a
+# nextest-config-only PR; same all-disk-materialization assumption as the
+# relocated-pool fixture fixed by #6707).
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & test(object_transaction_fencing_persists_epoch_on_multipart_commit)'
+retries = 2
+
 # Serialize the 4-disk reliability / degraded-read e2e tests under the ci
 # profile too (see the e2e-reliability test-group note near the top). Not a
 # quarantine: no retries, just single-threaded so several 4-disk servers never
@@ -273,20 +230,6 @@ test-group = 'e2e-reliability'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::multipart::tests::crash_consistency::/)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the heal result-report tests under the ci profile too (see the
-# matching default-profile override near the top). Not a quarantine: no
-# retries, just serialized real-disk heal IO.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::heal::heal_result_report_tests::/)'
-test-group = 'ecstore-serial-flaky'
-
-# Serialize the metadata-cache generation-retirement pair under the ci
-# profile too (see the matching default-profile override near the top). Not a
-# quarantine: no retries.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(retires_cached_snapshot)'
-test-group = 'ecstore-serial-flaky'
-
 # Match the default-profile embedded test isolation without quarantining or
 # retrying failures in CI.
 [[profile.ci.overrides]]
@@ -299,20 +242,10 @@ test-group = 'embedded-test-ports'
 filter = 'package(rustfs-ecstore) & test(manual_transition_page_checkpoint_persists_durable_job_progress)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the transition matrix tests under the ci profile too (see the
-# matching default-profile override near the top). No retries.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(set_disk::transition_matrix_tests::)'
-test-group = 'ecstore-serial-flaky'
-
 [[profile.ci.overrides]]
 filter = 'package(rustfs-ecstore) & (test(decommission_migrates_and_verifies_registered_durable_ilm_records) | test(decommission_durable_ilm_target_read_error_is_not_masked_by_peer_success) | test(decommission_durable_ilm_terminal_receipt_recovers_failed_source_cleanup) | test(decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page) | test(decommission_durable_ilm_recovery_keeps_multiple_active_sources))'
 test-group = 'ecstore-serial-flaky'
 
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_|suspended_.*decommission)$/)'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the bucket-incarnation / lifecycle-fence tests under the ci profile
 # too (see the matching default-profile override near the top). No retries.
 [[profile.ci.overrides]]
@@ -355,8 +288,7 @@ test-group = 'ecstore-serial-flaky'
 # allowlist", so any new replication test lands in nightly by default (never
 # silently unrun) until it is explicitly blessed as fast here. Keep the two
 # regexes byte-identical. The committed profile selection digests make changes
-# visible in CI; list current membership with `cargo nextest list -p e2e_test
+# visible in CI; current counts live in docs/testing/e2e-suite-inventory.md.
-# --profile <profile>` (platform-dependent; see docs/testing/README.md).
 # HISTORY (2026-07-11): the 20 fast tests were briefly pulled out of this lane
 # (#4724) because they set a loopback (127.0.0.1) replication target that the
 # SSRF egress guard rejected on every PR after repl-1 (#4712). That is fixed —
@@ -394,32 +326,13 @@ test-group = 'ecstore-serial-flaky'
 # rustfs/rustfs#5169 disabled them) have PR-lane signal, not just merge-gate.
 # Single-node servers on random ports with isolated temp dirs — meets the
 # admission criteria unchanged.
-#
-# On-demand migration GA (backlog#2163 ODM-16): three named cases join the
-# lane, one per user-visible contract of the feature — a GET miss that pulls
-# the object and persists it locally, a HEAD miss that answers from the source
-# and stores nothing, and the admin config/status pair that must redact the
-# source secret. Each spawns one single-node rustfs server plus the in-process
-# fake S3 source (`fake_s3_target`, already in the first clause), so they meet
-# the admission criteria unchanged; measured at 15.8 s / 15.8 s / 15.9 s, which
-# is entirely the shared server startup and overlaps the lane's other tests.
-# The rest of `on_demand_migration::{get_basic,interaction,backfill,
-# harness_self}_test` stays in e2e-full and the fault / concurrency /
-# real-source modules stay in e2e-nightly; this is an allowlist, not a module
-# clause, so a new ODM test never lands here silently.
-#
-# Scanner authoritative usage publication (backlog#2213): data_usage_test is
-# the PR-lane e2e coverage for scanner usage snapshots consumed by quota and
-# admin surfaces. It uses the same single-node, random-port, isolated-temp-dir
-# fixture as the existing smoke modules.
 [profile.e2e-smoke]
 default-filter = """
     package(e2e_test) & (
-        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|compression|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat|data_usage)_test::|^fake_s3_target::/)
+        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|compression|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat)_test::|^fake_s3_target::/)
         | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
         | test(/^reliant::lifecycle::/)
         | test(/^reliant::tiering::/)
-        | test(/^on_demand_migration::(get_basic_test::(get_miss_pulls_inline_and_serves_locally_afterwards|head_miss_answers_from_the_source_without_persisting)|interaction_test::test_odm_admin_config_is_redacted_and_status_counts_match_the_source)$/)
     )
 """
 fail-fast = false
@@ -459,10 +372,6 @@ slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
 # until it is explicitly promoted to the fast PR subset — no replication test
 # is ever silently left out of CI.
 #
-# replication_target_matrix_test (the outbound target matrix: every object
-# shape against every remote-target failure mode the fake target models) runs
-# here in full; its expectation table pins known-red cells to open issues.
-#
 # #[serial] does NOT serialize under nextest (process-per-test; see the file
 # header). These tests need no cross-test serialization: each spawns its own
 # server(s) on random ports with isolated temp dirs, so they are parallel-safe
@@ -480,7 +389,7 @@ slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
 [profile.e2e-repl-nightly]
 default-filter = """
     package(e2e_test)
-    & (test(/^replication_extension_test::/) | test(/^replication_target_matrix_test::/))
+    & test(/^replication_extension_test::/)
     & !test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
 """
 fail-fast = false
@@ -493,29 +402,15 @@ path = "junit.xml"
 # ---------------------------------------------------------------------------
 # e2e-nightly profile — destructive multi-process cluster fault domains
 # ---------------------------------------------------------------------------
-# These eight modules are deliberately outside e2e-full's merge budget. Each
+# These seven modules are deliberately outside e2e-full's merge budget. Each
 # starts a real multi-process or multi-disk topology and exercises node/disk
 # loss, quorum, cleanup, notification fan-in, or admin-timeout behavior. The
 # consolidated nightly workflow runs them serially to avoid resource
 # starvation; failures are never retried.
-#
-# heal_erasure_disk_rebuild_test also runs in e2e-full so core heal rebuild
-# regressions are caught no later than the merge/main lane. It remains here for
-# nightly serial coverage with the other cluster fault domains.
-#
-# On-demand migration (backlog#2158 ODM-11) joins by the second clause: the
-# fault matrix waits out the 30 s circuit-breaker window, the concurrency
-# matrix drives 100-deep bursts, and the real-source cases start a second
-# (loop guard: a third) RustFS process. They are too slow or too heavy for
-# the merge budget; `on_demand_migration::{get_basic,interaction}_test` stay
-# in e2e-full, which excludes exactly these three modules.
 [profile.e2e-nightly]
 default-filter = """
     package(e2e_test)
-    & (
+    & test(/^(admin_timeout_regression_test|cluster_concurrency_test|cluster_multidrive_pool_test|heal_erasure_disk_rebuild_test|namespace_lock_quorum_test|object_lambda_test|stale_multipart_cleanup_cluster_test)::/)
-        test(/^(admin_timeout_regression_test|cluster_concurrency_test|cluster_multidrive_pool_test|degraded_listing_availability_test|heal_erasure_disk_rebuild_test|namespace_lock_quorum_test|object_lambda_test|stale_multipart_cleanup_cluster_test)::/)
-        | test(/^on_demand_migration::(concurrency_test|fault_test|real_source_test)::/)
-    )
 """
 fail-fast = false
 
@@ -526,34 +421,6 @@ path = "junit.xml"
 filter = 'package(e2e_test)'
 test-group = 'e2e-cluster-nightly'
 
-# ---------------------------------------------------------------------------
-# e2e-odm-interop profile — on-demand migration provider interop lane (ODM-20)
-# ---------------------------------------------------------------------------
-# backlog#2167. Report-only, scheduled, never a required check; wired by
-# .github/workflows/on-demand-migration-interop.yml.
-#
-# The four cases in `on_demand_migration::interop_test` take their source from
-# the environment (`RUSTFS_ODM_INTEROP_*`, documented on the constants in
-# `crates/e2e_test/src/on_demand_migration/common.rs`), so the same bodies run
-# against the in-process fake source locally and against a MinIO container or a
-# real cloud provider in the lane. The cloud jobs narrow this profile with their
-# own `-E` filter to the three-case minimum (GET miss, HEAD miss, merged list
-# pagination) and pass `--no-tests=fail` so a rename cannot silently select
-# nothing; the MinIO job runs the whole profile, backfill included.
-#
-# These cases are deliberately absent from every other lane: without an
-# interop source they only re-prove what `get_basic_test` and
-# `list_through_test` already cover in e2e-smoke and e2e-full. The committed
-# selection digest is the guard against a rename dropping one of them.
-[profile.e2e-odm-interop]
-default-filter = 'package(e2e_test) & test(/^on_demand_migration::interop_test::/)'
-fail-fast = false
-
-[profile.e2e-odm-interop.junit]
-# Emitted to target/nextest/e2e-odm-interop/junit.xml; the lane uploads it and
-# reconciles it against the per-case JSON report entries.
-path = "junit.xml"
-
 # ---------------------------------------------------------------------------
 # e2e-protocols profile — serial protocol lane
 # ---------------------------------------------------------------------------
@@ -574,23 +441,16 @@ path = "junit.xml"
 # quota, checksum, encryption,
 # security-boundary, ... — that the fast PR `e2e-smoke` subset deliberately
 # skips. Budget <= 45 min; authority for the suite count is `cargo nextest list
-# --profile e2e-full -p e2e_test` (platform-dependent; see docs/testing/README.md).
+# --profile e2e-full` (see docs/testing/e2e-suite-inventory.md).
 #
 # The filter is "the whole e2e_test crate MINUS the sets owned by other lanes":
 #   * protocols:: — FTPS/SFTP/WebDAV, run from the dedicated protocol profile
 #     with one worker because the suite owns fixed ports.
-#   * cluster suites that spin up a RustFSTestClusterEnvironment
+#   * the 7 cluster suites that spin up a RustFSTestClusterEnvironment
 #     (cluster_concurrency, cluster_multidrive_pool, stale_multipart_cleanup_cluster,
-#     namespace_lock_quorum, admin_timeout_regression, object_lambda) — too
+#     namespace_lock_quorum, heal_erasure_disk_rebuild, admin_timeout_regression,
-#     heavy for the merge budget; they run in the e2e-nightly serial
+#     object_lambda) — too heavy for the merge budget; they run in the
-#     cluster-fault lane. heal_erasure_disk_rebuild is intentionally not
+#     e2e-nightly serial cluster-fault lane.
-#     excluded here because backlog#2213 promotes core heal rebuild coverage to
-#     this merge/main lane while retaining nightly coverage.
-#   * on_demand_migration::interop_test — the ODM-20 provider interoperability
-#     cases, which are meaningless without a source: they run in the dedicated
-#     [profile.e2e-odm-interop] lane below, where the workflow points them at a
-#     MinIO container or a real cloud provider. Excluding them here also keeps
-#     this profile's committed selection digest stable.
 #   * replication_extension_test — repl-1 already splits it into the PR
 #     `e2e-smoke` (20 fast) and `e2e-repl-nightly` (56 slow) lanes and reserves
 #     it for those, so e2e-full does not double-run it.
@@ -602,14 +462,23 @@ path = "junit.xml"
 # parallel-safe — the same property e2e-smoke relies on. The exceptions are the
 # 4-disk reliability / degraded-read fault-injection tests and the fixed-port
 # Vault tests, both serialized below.
+# KNOWN-FAILURE EXCLUSIONS (characterization run 29381309848, 2026-07-15:
+# 341 ran / 32 failed on the suites' first automated run ever). Deterministic
+# product failures cannot be quarantined away with retries, so each family is
+# excluded here with its tracking issue, under the same discipline as the
+# ci-profile quarantine (docs/testing/README.md): every entry MUST cite one
+# OPEN issue, and the fixing PR MUST delete the exclusion. The passing
+# negative-path siblings of each family stay in as regression guards.
+#   * rustfs#4843 — over-limit archive entry paths hard-reject the whole
+#     archive even under ignore-errors semantics.
 [profile.e2e-full]
 default-filter = """
     package(e2e_test)
     & !test(/^protocols::/)
-    & !test(/^(admin_timeout_regression_test|cluster_concurrency_test|cluster_multidrive_pool_test|degraded_listing_availability_test|namespace_lock_quorum_test|object_lambda_test|stale_multipart_cleanup_cluster_test)::/)
+    & !test(/^(admin_timeout_regression_test|cluster_concurrency_test|cluster_multidrive_pool_test|heal_erasure_disk_rebuild_test|namespace_lock_quorum_test|object_lambda_test|stale_multipart_cleanup_cluster_test)::/)
     & !test(/^replication_extension_test::/)
-    & !test(/^replication_target_matrix_test::/)
+    & !test(/^multipart_auth_test::test_signed_put_object_extract_skips_invalid_entry_when_ignore_errors_enabled$/)
-    & !test(/^on_demand_migration::(concurrency_test|fault_test|interop_test|real_source_test)::/)
+    & !test(/^snowball_auto_extract_test::tests::snowball_auto_extract_(ignores_invalid_entries_when_requested|supports_standard_headers_with_combined_extract_options)$/)
 """
 fail-fast = false
 

.github/actionlint.yaml

@@ -5,5 +5,3 @@ self-hosted-runner:
     - sm-standard-2
     - sm-standard-4
     - dind-sm-standard-2
-    - smoke-testing
-    - pf-testing

.github/actions/odm-interop-report/action.yml

@@ -1,100 +0,0 @@
-name: On-demand migration interop report
-description: >-
-  Merge the per-case JSON entries an on-demand-migration interop run wrote with
-  the nextest JUnit result into one provider report, and summarise it.
-
-inputs:
-  provider:
-    description: Provider the run addressed (minio, aws, r2, gcs).
-    required: true
-  cases-dir:
-    description: Directory the cases wrote their JSON entries into.
-    required: true
-  junit:
-    description: nextest JUnit XML of the run.
-    required: true
-  output:
-    description: Path of the merged JSON report to write.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    # The JUnit file is authoritative for which cases ran and how they ended:
-    # a case that fails or panics never reaches its own report entry, so
-    # trusting the entries alone would silently shorten the report exactly when
-    # something went wrong. The entries only add what JUnit cannot know — the
-    # source request accounting and the bucket's migration counters.
-    - name: Merge interop case reports
-      shell: bash
-      env:
-        ODM_REPORT_PROVIDER: ${{ inputs.provider }}
-        ODM_REPORT_CASES_DIR: ${{ inputs.cases-dir }}
-        ODM_REPORT_JUNIT: ${{ inputs.junit }}
-        ODM_REPORT_OUTPUT: ${{ inputs.output }}
-      run: |
-        python3 - <<'PY'
-        import json
-        import os
-        import pathlib
-        import xml.etree.ElementTree as ElementTree
-
-        provider = os.environ["ODM_REPORT_PROVIDER"]
-        cases_dir = pathlib.Path(os.environ["ODM_REPORT_CASES_DIR"])
-        junit = pathlib.Path(os.environ["ODM_REPORT_JUNIT"])
-        output = pathlib.Path(os.environ["ODM_REPORT_OUTPUT"])
-
-        entries = {}
-        if cases_dir.is_dir():
-            for path in sorted(cases_dir.glob("*.json")):
-                entry = json.loads(path.read_text())
-                entries[entry["case"]] = entry
-
-        cases = []
-        for case in ElementTree.parse(junit).getroot().iter("testcase"):
-            name = case.get("name", "")
-            failed = [child for child in case if child.tag in ("failure", "error")]
-            skipped = [child for child in case if child.tag == "skipped"]
-            outcome = "failed" if failed else "skipped" if skipped else "passed"
-            entry = entries.get(name.rsplit("::", 1)[-1], {})
-            cases.append(
-                {
-                    "name": name,
-                    "outcome": outcome,
-                    "junit_duration_ms": round(float(case.get("time", "0")) * 1000),
-                    "case_duration_ms": entry.get("duration_ms"),
-                    "source_requests": entry.get("source_requests"),
-                    "odm_counters": entry.get("odm_counters"),
-                }
-            )
-
-        report = {
-            "provider": provider,
-            "repository": os.environ.get("GITHUB_REPOSITORY", ""),
-            "sha": os.environ.get("GITHUB_SHA", ""),
-            "run_id": os.environ.get("GITHUB_RUN_ID", ""),
-            "cases": cases,
-            "totals": {
-                "cases": len(cases),
-                "passed": sum(1 for case in cases if case["outcome"] == "passed"),
-                "failed": sum(1 for case in cases if case["outcome"] == "failed"),
-            },
-        }
-        output.parent.mkdir(parents=True, exist_ok=True)
-        output.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
-
-        summary = [f"### On-demand migration interop: `{provider}`", "", "| Case | Outcome | Duration | Source requests |", "|---|---|---|---|"]
-        for case in cases:
-            requests = case["source_requests"]
-            counted = f"{requests['total']} ({requests['counted_by']})" if requests else "not reported"
-            summary.append(f"| `{case['name']}` | {case['outcome']} | {case['junit_duration_ms']} ms | {counted} |")
-        with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as handle:
-            handle.write("\n".join(summary) + "\n\n")
-
-        # A passed case with no entry of its own means the harness stopped
-        # writing one: the report would keep looking complete while silently
-        # losing its request accounting.
-        unreported = [case["name"] for case in cases if case["outcome"] == "passed" and case["source_requests"] is None]
-        if unreported:
-            raise SystemExit(f"passed cases wrote no interop report entry: {', '.join(unreported)}")
-        PY

.github/actions/quick-checks/action.yml

@@ -1,116 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Quick Checks
-description: Run the shared compile-free RustFS quality checks.
-
-runs:
-  using: composite
-  steps:
-    - name: Install quality tools
-      uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
-      with:
-        tool: |
-          ripgrep@15.2.0
-          shellcheck@0.11.0
-
-    - name: Install actionlint
-      shell: bash
-      run: |
-        actionlint_dir="$(mktemp -d "${RUNNER_TEMP}/actionlint.XXXXXX")"
-        curl --fail --location --silent --show-error \
-          --output "$actionlint_dir/actionlint.tar.gz" \
-          https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
-        echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $actionlint_dir/actionlint.tar.gz" | sha256sum --check --status
-        tar -xzf "$actionlint_dir/actionlint.tar.gz" -C "$actionlint_dir" actionlint
-        rm "$actionlint_dir/actionlint.tar.gz"
-        echo "$actionlint_dir" >> "$GITHUB_PATH"
-
-    - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-      with:
-        components: rustfmt
-
-    - name: Check workflow syntax and shell scripts
-      shell: bash
-      run: shellcheck --version && actionlint
-
-    - name: Check code formatting
-      shell: bash
-      run: cargo fmt --all --check
-
-    - name: Check unsafe code allowances
-      shell: bash
-      run: ./scripts/check_unsafe_code_allowances.sh
-
-    - name: Check layered dependencies
-      shell: bash
-      run: ./scripts/check_layer_dependencies.sh
-
-    - name: Check architecture migration rules
-      shell: bash
-      run: ./scripts/check_architecture_migration_rules.sh
-
-    - name: Check logging guardrails
-      shell: bash
-      run: ./scripts/check_logging_guardrails.sh
-
-    - name: Check error other(format!) ratchet
-      shell: bash
-      run: ./scripts/check_error_other_format_ratchet.sh
-
-    - name: Check tokio io-uring feature guard
-      shell: bash
-      run: ./scripts/check_no_tokio_io_uring.sh
-
-    - name: Check extension schema boundaries
-      shell: bash
-      run: ./scripts/check_extension_schema_boundaries.sh
-
-    - name: Check body-cache whitelist guard
-      shell: bash
-      run: ./scripts/check_body_cache_whitelist.sh
-
-    - name: Check s3s footprint ratchet
-      shell: bash
-      run: ./scripts/check_s3s_footprint.sh
-
-    - name: Check cryptographic capability wording
-      shell: bash
-      run: ./scripts/check_fips_wording.sh
-
-    - name: Check no embedded secret material
-      shell: bash
-      run: ./scripts/check_embedded_secrets.sh
-
-    - name: Check test wiring
-      shell: bash
-      run: |
-        python3 ./scripts/check_test_wiring.py --self-test
-        python3 ./scripts/test_e2e_binary.py
-        python3 ./scripts/check_scheduled_validation_freshness.py --self-test
-        python3 ./scripts/test_security_workflow.py
-        python3 ./scripts/check_test_wiring.py
-
-    - name: Check no planning docs committed
-      shell: bash
-      run: ./scripts/check_no_planning_docs.sh
-
-    - name: Check CI paths stay in sync
-      shell: bash
-      run: ./scripts/check_ci_paths_sync.sh
-
-    - name: Check io_uring lane --lib precondition
-      shell: bash
-      run: ./scripts/check_uring_lane_lib_only.sh

.github/pull_request_template.md

@@ -10,16 +10,16 @@ Use N/A when there is no related issue.
 
 ## Summary of Changes
 <!--
-Describe the concrete problem and resulting behavior. For a behavior change, name the input or state that triggers it and the expected outcome. Explain any new dependency or abstraction that the change needs.
+Briefly explain what changed and why reviewers should accept it.
+Focus on behavior, compatibility, and review-relevant context.
 -->
 
 ## Verification
 <!--
-Give 1–3 concrete pieces of evidence for the changed behavior: the test or command, its observed result, and the regression it catches. For a bug fix, record a failing-before/passing-after check or explain why it was unavailable.
+List the commands or checks you ran, for example:
+- `make pre-commit`
 
-Identify the tested commit and any local changes. When testing a prebuilt binary or external service, include its source/version and artifact identity; a successful run against a different build is not evidence for this change.
+Use N/A only when verification is not applicable.
-
-List relevant checks not run and the remaining risk. Use the validation tier in AGENTS.md; do not run broader checks solely to fill this section. For documentation-only changes, list the applicable documentation checks. Use N/A only when verification is not applicable.
 -->
 
 ## Impact

.github/scheduled-validations.json

@@ -7,11 +7,6 @@
   { "workflow": ".github/workflows/e2e-s3tests.yml", "max_age_hours": 192 },
   { "workflow": ".github/workflows/fuzz.yml", "max_age_hours": 36 },
   { "workflow": ".github/workflows/mint.yml", "max_age_hours": 192 },
-  {
-    "workflow": ".github/workflows/minio-interop.yml",
-    "max_age_hours": 36,
-    "never_ran_grace_until": "2026-09-08T00:00:00Z"
-  },
   { "workflow": ".github/workflows/nightly-gnu.yml", "max_age_hours": 36 },
   { "workflow": ".github/workflows/performance-ab.yml", "max_age_hours": 36 },
   {

.github/workflows/audit.yml

@@ -24,11 +24,8 @@ on:
       - '.github/actions/**'
       - '.github/workflows/**'
       - 'scripts/release/create_or_update_release.sh'
-      - 'scripts/release/package_versions.sh'
-      - 'scripts/test_package_versions.sh'
       - 'scripts/security/check_performance_ab_workflow.sh'
       - 'scripts/security/check_preview_release_workflow.sh'
-      - 'scripts/security/check_tier_artifact_workflow.sh'
       - 'scripts/security/check_workflow_pins.sh'
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
@@ -40,11 +37,8 @@ on:
       - '.github/actions/**'
       - '.github/workflows/**'
       - 'scripts/release/create_or_update_release.sh'
-      - 'scripts/release/package_versions.sh'
-      - 'scripts/test_package_versions.sh'
       - 'scripts/security/check_performance_ab_workflow.sh'
       - 'scripts/security/check_preview_release_workflow.sh'
-      - 'scripts/security/check_tier_artifact_workflow.sh'
       - 'scripts/security/check_workflow_pins.sh'
   schedule:
     # Daily, not weekly. This schedule exists to catch RustSec advisories
@@ -152,12 +146,6 @@ jobs:
       - name: Check performance A/B workflow trust boundary
         run: ./scripts/security/check_performance_ab_workflow.sh
 
-      - name: Check tier evidence workflow isolation
-        run: ./scripts/security/check_tier_artifact_workflow.sh
-
-      - name: Check package version contract
-        run: ./scripts/test_package_versions.sh
-
   dependency-review:
     name: Dependency Review
     runs-on: ubuntu-latest

.github/workflows/build.yml

@@ -244,7 +244,7 @@ jobs:
     needs: [ build-check, prepare-platform-matrix ]
     if: needs.build-check.outputs.should_build == 'true' && needs.prepare-platform-matrix.result == 'success'
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 180
+    timeout-minutes: 150
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       # Release binaries ship without dial9 telemetry and therefore do not need
@@ -408,9 +408,9 @@ jobs:
 
           if [[ "${{ matrix.cross }}" == "true" ]]; then
             # All cross targets in the matrix are Linux; zigbuild handles them.
-            cargo zigbuild --release --target ${{ matrix.target }} -p rustfs --bin rustfs
+            cargo zigbuild --release --target ${{ matrix.target }} -p rustfs --bins
           else
-            cargo build --release --target ${{ matrix.target }} -p rustfs --bin rustfs
+            cargo build --release --target ${{ matrix.target }} -p rustfs --bins
           fi
 
       - name: Create release package
@@ -1033,55 +1033,6 @@ jobs:
           echo "🎉 Released $TAG successfully!"
           echo "📄 Release URL: ${{ needs.create-release.outputs.release_url }}"
 
-  # Remove the internal preview releases once the deliverable release is live.
-  # Only the Releases are deleted; the -preview.N tags stay so the validated
-  # commit remains traceable.
-  cleanup-preview-releases:
-    name: Cleanup Preview Releases
-    needs: [ build-check, publish-release ]
-    if: startsWith(github.ref, 'refs/tags/') && (needs.build-check.outputs.build_type == 'release' || needs.build-check.outputs.build_type == 'prerelease')
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-    steps:
-      - name: Delete preview releases for this target
-        env:
-          GH_TOKEN: ${{ github.token }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          TAG="${{ needs.build-check.outputs.version }}"
-          RELEASES_JSON="${RUNNER_TEMP}/releases.json"
-
-          # Fetch before filtering: a failed listing must abort here instead of
-          # looking like "nothing to clean up".
-          gh api --paginate "repos/${GITHUB_REPOSITORY}/releases?per_page=100" > "$RELEASES_JSON"
-
-          # Match only <target>-preview.<digits>. String operations, not a
-          # regex over the tag, so dots in the version cannot widen the match.
-          DELETED=0
-          while IFS= read -r preview_tag; do
-            [[ -n "$preview_tag" ]] || continue
-            echo "🧹 Deleting preview release $preview_tag (tag kept)"
-            gh release delete "$preview_tag" --repo "${GITHUB_REPOSITORY}" --yes
-            DELETED=$((DELETED + 1))
-          done < <(
-            jq -r --arg tag "$TAG" '
-              .[]
-              | select(.tag_name | startswith($tag + "-preview."))
-              | select(.tag_name | ltrimstr($tag + "-preview.") | test("^[0-9]+$"))
-              | .tag_name
-            ' "$RELEASES_JSON"
-          )
-
-          if [[ "$DELETED" -eq 0 ]]; then
-            echo "ℹ️  No preview releases to clean up for $TAG"
-          else
-            echo "✅ Removed $DELETED preview release(s) for $TAG"
-          fi
-
   alert-on-failure:
     name: Alert on scheduled failure
     needs: [build-check, prepare-platform-matrix, build-rustfs, build-summary]

.github/workflows/ci-docs-only.yml

@@ -12,10 +12,24 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Reports the existing required checks for paths excluded by ci.yml.
+# Companion to ci.yml for required status checks.
-# Mixed PRs can trigger both workflows; their Quick Checks jobs use one shared
+#
-# action to keep validation coverage aligned. Keep this paths list in sync with
+# ci.yml skips docs-only pull requests via paths-ignore, but the branch ruleset
-# ci.yml's pull_request.paths-ignore via scripts/check_ci_paths_sync.sh.
+# requires a check named "Test and Lint" — without this workflow a docs-only PR
+# would wait on it forever. This workflow triggers on exactly the paths ci.yml
+# ignores and reports success under the same job name. Mixed PRs trigger both
+# workflows and the real check still gates: a required check with any failing
+# run blocks the merge.
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# "Quick Checks" is mirrored here ahead of the ruleset change that will make it
+# required too (rustfs/backlog#1599). Until that change lands this job is
+# inert; mirroring it first is what lets the ruleset change happen without
+# stranding docs-only PRs on a check nobody reports.
+#
+# Keep the paths list below in sync with the pull_request paths-ignore list
+# in ci.yml, and keep the quick-checks steps below byte-identical to the
+# quick-checks job in ci.yml.
 
 name: Continuous Integration (docs only)
 
@@ -45,6 +59,19 @@ permissions:
   contents: read
 
 jobs:
+  # Deliberately NOT a bare `echo`. Once "Quick Checks" becomes a required
+  # check, ci.yml gates every expensive job behind it, so a mixed PR reports
+  # two check runs with this name: the real one (45-51s) and this companion.
+  # GitHub has no written contract for how it picks between same-named
+  # required check runs ("latest wins" vs "any failure blocks"), so instead of
+  # relying on ordering we make both runs execute the same commands against
+  # the same merge ref — their conclusions are then necessarily identical and
+  # the choice does not matter. Keep these steps byte-identical to the
+  # quick-checks job in ci.yml (a guard script that asserts this, and the paths
+  # sync below, is tracked in rustfs/backlog#1603).
+  #
+  # For a genuinely docs-only PR this adds no strictness (no code changed, so
+  # fmt and the guards always pass) and costs ~50s of ubuntu-latest.
   quick-checks:
     name: Quick Checks
     runs-on: ubuntu-latest
@@ -55,8 +82,63 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Run shared quick checks
+      - name: Install ripgrep
-        uses: ./.github/actions/quick-checks
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: rustfmt
+
+      - name: Check code formatting
+        run: cargo fmt --all --check
+
+      - name: Check unsafe code allowances
+        run: ./scripts/check_unsafe_code_allowances.sh
+
+      - name: Check layered dependencies
+        run: ./scripts/check_layer_dependencies.sh
+
+      - name: Check architecture migration rules
+        run: ./scripts/check_architecture_migration_rules.sh
+
+      - name: Check logging guardrails
+        run: ./scripts/check_logging_guardrails.sh
+
+      - name: Check tokio io-uring feature guard
+        run: ./scripts/check_no_tokio_io_uring.sh
+
+      - name: Check extension schema boundaries
+        run: ./scripts/check_extension_schema_boundaries.sh
+
+      - name: Check body-cache whitelist guard
+        run: ./scripts/check_body_cache_whitelist.sh
+
+      - name: Check s3s footprint ratchet
+        run: ./scripts/check_s3s_footprint.sh
+
+      - name: Check cryptographic capability wording
+        run: ./scripts/check_fips_wording.sh
+
+      - name: Check no embedded secret material
+        run: ./scripts/check_embedded_secrets.sh
+
+      - name: Check test wiring
+        run: |
+          python3 ./scripts/check_test_wiring.py --self-test
+          python3 ./scripts/check_scheduled_validation_freshness.py --self-test
+          python3 ./scripts/check_test_wiring.py
+
+      - name: Check no planning docs committed
+        run: ./scripts/check_no_planning_docs.sh
+
+      - name: Check CI paths stay in sync
+        run: ./scripts/check_ci_paths_sync.sh
+
+      - name: Check io_uring lane --lib precondition
+        run: ./scripts/check_uring_lane_lib_only.sh
 
   test-and-lint:
     name: Test and Lint

.github/workflows/ci.yml

@@ -100,7 +100,12 @@ jobs:
       - name: Typos check with custom config file
         uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master
 
-  # Fail early with compile-free checks shared with docs-only CI.
+  # Fast, compile-free checks that fail early so contributors get feedback in
+  # ~1 minute instead of waiting for the full test job.
+  #
+  # These steps are mirrored byte-for-byte in ci-docs-only.yml so that a mixed
+  # PR, which reports two check runs named "Quick Checks", cannot get one red
+  # and one green. Edit both jobs together.
   quick-checks:
     name: Quick Checks
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -112,8 +117,66 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Run shared quick checks
+      - name: Install ripgrep
-        uses: ./.github/actions/quick-checks
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          components: rustfmt
+
+      - name: Check code formatting
+        run: cargo fmt --all --check
+
+      - name: Check unsafe code allowances
+        run: ./scripts/check_unsafe_code_allowances.sh
+
+      - name: Check layered dependencies
+        run: ./scripts/check_layer_dependencies.sh
+
+      - name: Check architecture migration rules
+        run: ./scripts/check_architecture_migration_rules.sh
+
+      - name: Check logging guardrails
+        run: ./scripts/check_logging_guardrails.sh
+
+      - name: Check error other(format!) ratchet
+        run: ./scripts/check_error_other_format_ratchet.sh
+
+      - name: Check tokio io-uring feature guard
+        run: ./scripts/check_no_tokio_io_uring.sh
+
+      - name: Check extension schema boundaries
+        run: ./scripts/check_extension_schema_boundaries.sh
+
+      - name: Check body-cache whitelist guard
+        run: ./scripts/check_body_cache_whitelist.sh
+
+      - name: Check s3s footprint ratchet
+        run: ./scripts/check_s3s_footprint.sh
+
+      - name: Check cryptographic capability wording
+        run: ./scripts/check_fips_wording.sh
+
+      - name: Check no embedded secret material
+        run: ./scripts/check_embedded_secrets.sh
+
+      - name: Check test wiring
+        run: |
+          python3 ./scripts/check_test_wiring.py --self-test
+          python3 ./scripts/check_scheduled_validation_freshness.py --self-test
+          python3 ./scripts/check_test_wiring.py
+
+      - name: Check no planning docs committed
+        run: ./scripts/check_no_planning_docs.sh
+
+      - name: Check CI paths stay in sync
+        run: ./scripts/check_ci_paths_sync.sh
+
+      - name: Check io_uring lane --lib precondition
+        run: ./scripts/check_uring_lane_lib_only.sh
 
   test-and-lint:
     name: Test and Lint
@@ -206,7 +269,6 @@ jobs:
           CARGO_BUILD_JOBS: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && '3' || '2' }}
         run: |
           mkdir -p artifacts/test-and-lint
-          rm -f target/nextest/ci/junit.xml
           ./scripts/ci/resource_sampler.sh start nextest
           trap './scripts/ci/resource_sampler.sh stop' EXIT
           set +e
@@ -215,12 +277,6 @@ jobs:
             --status-level all --final-status-level all \
             2>&1 | tee artifacts/test-and-lint/nextest.log
           status=${PIPESTATUS[0]}
-          if [[ "${status}" -eq 0 ]]; then
-            cargo nextest list --profile ci --all --exclude e2e_test --message-format json \
-              > artifacts/test-and-lint/core-test-listing.json \
-              && python3 scripts/check_test_wiring.py --check-core artifacts/test-and-lint/core-test-listing.json \
-              && test -s target/nextest/ci/junit.xml || status=$?
-          fi
           {
             echo "command=cargo nextest run --profile ci --all --exclude e2e_test"
             echo "exit_status=${status}"
@@ -582,15 +638,13 @@ jobs:
           install-build-packaging-tools: 'false'
 
       - name: Build debug binary
-        run: python3 scripts/e2e_binary.py build --bins --features e2e-test-hooks
+        run: cargo build -p rustfs --bins --features e2e-test-hooks
 
       - name: Upload debug binary
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-debug-binary
-          path: |
+          path: target/debug/rustfs
-            target/debug/rustfs
-            target/debug/rustfs.e2e.json
           if-no-files-found: error
           retention-days: 1
 
@@ -622,15 +676,13 @@ jobs:
           install-build-packaging-tools: 'false'
 
       - name: Build debug binary with rio-v2
-        run: python3 scripts/e2e_binary.py build --bins --features rio-v2,e2e-test-hooks
+        run: cargo build -p rustfs --bins --features rio-v2,e2e-test-hooks
 
       - name: Upload debug binary
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rustfs-debug-binary-rio-v2
-          path: |
+          path: target/debug/rustfs
-            target/debug/rustfs
-            target/debug/rustfs.e2e.json
           if-no-files-found: error
           retention-days: 1
 
@@ -779,7 +831,7 @@ jobs:
           NEXTEST_ARCHIVE: ${{ runner.temp }}/rustfs-e2e-smoke.tar.zst
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-smoke-logs
         run: |
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
+          cargo nextest run --profile e2e-smoke --archive-file "${NEXTEST_ARCHIVE}" \
             --status-level all --final-status-level all --failure-output final
 
       - name: Upload e2e smoke diagnostics
@@ -815,7 +867,7 @@ jobs:
           RUSTFS_TEST_PORT="$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1]); s.close()')"
           RUSTFS_TEST_PORT="${RUSTFS_TEST_PORT}" \
           RUSTFS_TEST_LOG="${RUN_ROOT}/rustfs.log" \
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- ./scripts/e2e-run.sh ./target/debug/rustfs "${RUN_ROOT}/data"
+          ./scripts/e2e-run.sh ./target/debug/rustfs "${RUN_ROOT}/data"
 
       - name: Upload test logs
         if: failure()
@@ -917,7 +969,7 @@ jobs:
       # extend that filter, never add ad-hoc e2e jobs here. Reuses the downloaded
       # debug binary; each test spawns its own rustfs server on a random port.
       - name: Run e2e full suite
-        run: python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-full -p e2e_test
+        run: cargo nextest run --profile e2e-full -p e2e_test
 
       - name: Upload junit
         if: always()
@@ -978,7 +1030,7 @@ jobs:
       - name: Run end-to-end tests
         run: |
           s3s-e2e --version
-          python3 scripts/e2e_binary.py run --features rio-v2,e2e-test-hooks -- ./scripts/e2e-run.sh ./target/debug/rustfs /tmp/rustfs
+          ./scripts/e2e-run.sh ./target/debug/rustfs /tmp/rustfs
 
       - name: Upload test logs
         if: failure()
@@ -1021,7 +1073,7 @@ jobs:
           S3_PORT="${S3_PORT}" \
           DATA_ROOT="${RUN_ROOT}" \
           S3TESTS_CONF=artifacts/s3tests-single/s3tests.conf \
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- ./scripts/s3-tests/run.sh
+          ./scripts/s3-tests/run.sh
 
       - name: Upload s3 test artifacts
         if: always()
@@ -1103,7 +1155,7 @@ jobs:
           S3_PORT="${S3_PORT}" \
           DATA_ROOT="${RUN_ROOT}" \
           S3TESTS_CONF=artifacts/s3tests-single/s3tests.conf \
-          python3 scripts/e2e_binary.py run --features e2e-test-hooks -- ./scripts/s3-tests/run.sh
+          ./scripts/s3-tests/run.sh
 
       - name: Upload s3 test artifacts
         if: always()

.github/workflows/e2e-replication-nightly.yml

@@ -89,10 +89,14 @@ jobs:
       - name: Verify awscurl
         run: test -x "$AWSCURL_PATH"
 
-      # Build once and carry its source/binary identity into the test invocation.
+      # Build the rustfs binary once up front. The e2e tests spawn it as a
+      # child process (crates/e2e_test/src/common.rs) and will build it on
+      # demand otherwise, but a single explicit build avoids several parallel
+      # nextest test processes racing to build it at once.
       - name: Build rustfs binary
         run: |
-          python3 scripts/e2e_binary.py build --bins
+          cargo build -p rustfs --bins
+          : > target/debug/rustfs.features
 
       - name: Verify replication e2e membership
         env:
@@ -104,7 +108,7 @@ jobs:
       - name: Run replication e2e nightly suite
         env:
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-repl-nightly-logs
-        run: python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-repl-nightly -p e2e_test
+        run: cargo nextest run --profile e2e-repl-nightly -p e2e_test
 
       - name: Upload nextest junit report
         if: always()
@@ -140,7 +144,8 @@ jobs:
 
       - name: Build rustfs binary
         run: |
-          python3 scripts/e2e_binary.py build --bins --features e2e-test-hooks
+          cargo build -p rustfs --bins --features e2e-test-hooks
+          : > target/debug/rustfs.features
 
       - name: Verify cluster fault e2e membership
         env:
@@ -152,7 +157,7 @@ jobs:
       - name: Run cluster fault e2e nightly suite
         env:
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-e2e-nightly-logs
-        run: python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-nightly -p e2e_test
+        run: cargo nextest run --profile e2e-nightly -p e2e_test
 
       - name: Upload cluster fault diagnostics
         if: always()
@@ -193,9 +198,6 @@ jobs:
           sudo apt-get install -y -qq iproute2
           ss -tn state CLOSE-WAIT >/dev/null
 
-      - name: Build protocol server
-        run: python3 scripts/e2e_binary.py build --features "$RUSTFS_BUILD_FEATURES"
-
       # The suite owns fixed protocol ports and serializes its internal cases.
       - name: Verify protocol e2e membership
         env:
@@ -208,7 +210,7 @@ jobs:
         env:
           RUSTFS_E2E_LOG_DIR: ${{ runner.temp }}/rustfs-protocol-e2e-logs
         run: >-
-          python3 scripts/e2e_binary.py run --features "$RUSTFS_BUILD_FEATURES" -- cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
+          cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
 
       - name: Upload protocol diagnostics
         if: always()

.github/workflows/e2e-upgrade.yml

@@ -49,20 +49,8 @@ env:
   UPGRADE_SOURCE_SHA256: 7c789386bf85278f865b8e0d359bf4edb84d5aa408cc3fa54a18c25ca74cd6e7
 
 jobs:
-  upgrade:
+  direct-upgrade:
-    name: ${{ matrix.name }}
+    name: Direct upgrade from rc.2
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Direct upgrade from rc.2
-            cache_key: e2e-direct-upgrade
-            test: direct_upgrade_from_rc2_preserves_object_contracts
-            artifact: direct-upgrade
-          - name: Mixed-version rolling upgrade from rc.2
-            cache_key: e2e-mixed-version-upgrade
-            test: rolling_upgrade_from_rc2_preserves_mixed_version_contracts
-            artifact: mixed-version-upgrade
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
@@ -76,7 +64,7 @@ jobs:
       - name: Setup Rust environment
         uses: ./.github/actions/setup
         with:
-          cache-shared-key: ${{ matrix.cache_key }}
+          cache-shared-key: e2e-direct-upgrade
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
           install-build-packaging-tools: "false"
 
@@ -98,19 +86,20 @@ jobs:
 
       - name: Build current RustFS binary
         run: |
-          python3 scripts/e2e_binary.py build
+          cargo build --locked -p rustfs --bin rustfs
+          : > target/debug/rustfs.features
 
-      - name: Run upgrade compatibility test
+      - name: Run direct-upgrade compatibility test
         run: |
-          python3 scripts/e2e_binary.py run -- cargo test --locked -p e2e_test \
+          cargo test --locked -p e2e_test \
-            "upgrade_compatibility_test::${{ matrix.test }}" \
+            upgrade_compatibility_test::direct_upgrade_from_rc2_preserves_object_contracts \
             -- --ignored --exact --nocapture
 
       - name: Upload server logs
         if: always()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: ${{ matrix.artifact }}-server-logs-${{ github.run_number }}
+          name: direct-upgrade-server-logs-${{ github.run_number }}
           path: ${{ runner.temp }}/rustfs-upgrade-logs
           if-no-files-found: warn
           retention-days: 14

.github/workflows/minio-interop.yml

@@ -20,27 +20,27 @@
 # each run with Docker and then runs the `#[ignore]` reader tests in
 # rustfs/src/storage/minio_generated_read_test.rs.
 #
-# Scope: MinIO-to-RustFS SSE read interop is implemented behind the `rio-v2`
+# Scope: end-to-end MinIO-to-RustFS SSE interop is NOT implemented yet. Both
-# feature for MinIO's builtin static-KMS deployments — SSE-S3 and SSE-KMS
+# envelope parsers reject MinIO's own wrapped-DEK shape — see
-# (single- and multipart) since rustfs/rustfs#6191, SSE-C detection since the
+# `is_data_key_envelope` in crates/kms/src/encryption/dek.rs and the
-# rustfs/backlog#1638 D2 close-out. This job is the standing evidence: it
+# `deny_unknown_fields` `LocalSseDekEnvelope` in rustfs/src/storage/sse.rs — and
-# regenerates real MinIO backend trees and proves byte-identical plaintext
+# closing that gap is tracked in rustfs/backlog#1638. Treat this job as the
-# reconstruction. KES/MinKMS-backed MinIO objects remain unreadable by design
+# harness for #1638, not as standing evidence that a MinIO migration reads back.
-# (their envelopes are sealed by the KES service, not by a key RustFS can
-# hold), and default RustFS builds do not include the read path — it is a
-# special-purpose migration capability, not a default-build feature.
 #
 # Runner: GitHub-hosted `ubuntu-latest`. It reliably ships Docker + Python,
 # unlike the self-hosted fleet, whose pods drift in Docker/pip availability
 # (see the infra note in e2e-s3tests.yml). Nightly + manual only.
+# DISABLED. This workflow is switched off in the repository's Actions settings
+# (state: disabled_manually) and does not run on any trigger, including its cron
+# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
+# reading this file, which has already misled at least one audit — hence this
+# banner. Re-enabling is a UI action; anyone doing so should first check that the
+# workflow still matches the current CI layout. See rustfs/backlog#1603.
 #
-# Enablement: this workflow was long disabled in the repository's Actions
+# While disabled, this workflow is deliberately absent from
-# settings (state: disabled_manually — a state that lives in GitHub's UI and is
+# .github/scheduled-validations.json — a disabled workflow can never satisfy the
-# invisible in this file). The change that updated this banner also re-added
+# freshness check. Whoever re-enables it must re-add the entry in the same
-# the .github/scheduled-validations.json entry; both only make sense together
+# change so the freshness gate covers it again.
-# with re-enabling the workflow in the Actions settings. If it is ever disabled
-# again, remove the scheduled-validations entry in the same change — a disabled
-# workflow can never satisfy the freshness check. See rustfs/backlog#1603.
 #
 name: minio-interop
 

.github/workflows/nix.yml

@@ -27,7 +27,6 @@ on:
     paths:
       - 'flake.nix'
       - 'flake.lock'
-      - 'nix/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.github/workflows/nix.yml'
@@ -37,7 +36,6 @@ on:
     paths:
       - 'flake.nix'
       - 'flake.lock'
-      - 'nix/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.github/workflows/nix.yml'

.github/workflows/on-demand-migration-interop.yml

@@ -1,315 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# On-demand migration provider interop (rustfs/backlog#2167, ODM-20).
-#
-# The in-process fake source that the merge-gate ODM suite runs against covers
-# the protocol semantics, but real implementations differ in path-style vs
-# virtual-host addressing, region handling, ETag shape, list pagination and
-# rate limiting. This lane runs the same case bodies
-# (crates/e2e_test/src/on_demand_migration/interop_test.rs) against real
-# sources; the source is injected through RUSTFS_ODM_INTEROP_* environment
-# variables, so nothing about the cases is duplicated per provider.
-#
-# Report-only and scheduled. It is never a required check and must not be
-# promoted to one: it depends on third-party endpoints and on repository
-# secrets that a fork does not have.
-#
-# Jobs:
-#   * minio-source runs the whole e2e-odm-interop profile — read-through,
-#     HEAD passthrough, merged list pagination and a backfill — against a
-#     pinned MinIO container. The backfill is sized at 5,000 objects here: the
-#     fake source retains at most 4,096 object versions and 4,096 journal
-#     entries, so the merge-gate backfill coverage cannot go past that, and a
-#     real source is where a production-shaped batch belongs.
-#   * cloud-source runs the three-case minimum (GET miss, HEAD miss, merged
-#     list pagination) against AWS S3, Cloudflare R2 and the GCS XML
-#     interoperability API. Each provider is skipped with a summary note when
-#     its ODM_INTEROP_* repository secrets are absent, which is the normal
-#     state on a fork and in any clone of this repository.
-#
-# Every job uploads one JSON report per provider naming the cases, their
-# timings and the source request accounting.
-name: on-demand-migration-interop
-
-on:
-  workflow_dispatch:
-  schedule:
-    # Nightly at 05:23 UTC, offset from the other nightly lanes.
-    - cron: "23 5 * * *"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-  # The three cases a cloud provider is asked for. Named individually rather
-  # than by module so adding a fourth case does not silently start billing a
-  # cloud account for it.
-  CLOUD_CASE_FILTER: >-
-    package(e2e_test) & test(/^on_demand_migration::interop_test::(interop_get_miss_pulls_from_the_source_and_serves_locally|interop_head_miss_answers_from_the_source_without_persisting|interop_list_through_pages_the_source_namespace)$/)
-  CLOUD_CASE_COUNT: "3"
-
-jobs:
-  minio-source:
-    name: MinIO source (read-through, list-through, backfill)
-    # Skip on forks: needs this repository's runners and is not a contributor
-    # gate.
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    env:
-      NO_PROXY: 127.0.0.1,localhost
-      # Fixed credentials of the container this job starts and throws away;
-      # not a secret and deliberately not read from one, so the lane runs
-      # unattended in any clone that enables it.
-      MINIO_ROOT_USER: rustfsodminterop
-      MINIO_ROOT_PASSWORD: rustfsodminteropsecret
-      RUSTFS_ODM_INTEROP_PROVIDER: minio
-      RUSTFS_ODM_INTEROP_ENDPOINT: http://127.0.0.1:9100
-      RUSTFS_ODM_INTEROP_REGION: auto
-      RUSTFS_ODM_INTEROP_BUCKET: odm-interop-source
-      RUSTFS_ODM_INTEROP_PATH_STYLE: path
-      RUSTFS_ODM_INTEROP_ACCESS_KEY: rustfsodminterop
-      RUSTFS_ODM_INTEROP_SECRET_KEY: rustfsodminteropsecret
-      RUSTFS_ODM_INTEROP_BACKFILL_OBJECTS: "5000"
-      RUSTFS_ODM_INTEROP_REPORT_DIR: ${{ github.workspace }}/artifacts/odm-interop/minio/cases
-      NEXTEST_LISTING: ${{ github.workspace }}/artifacts/odm-interop/minio/selection.json
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        uses: ./.github/actions/setup
-        with:
-          cache-shared-key: ci-odm-interop
-          cache-save-if: ${{ github.ref == 'refs/heads/main' }}
-          install-build-packaging-tools: 'false'
-
-      - name: Start MinIO source
-        run: |
-          set -euo pipefail
-          mkdir -p artifacts/odm-interop/minio
-          docker run -d --name rustfs-odm-interop-minio \
-            -e "MINIO_ROOT_USER=${MINIO_ROOT_USER}" \
-            -e "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}" \
-            -p 9100:9000 \
-            minio/minio:RELEASE.2025-09-07T16-13-09Z server /data
-          for _ in $(seq 1 120); do
-            curl -fsS http://127.0.0.1:9100/minio/health/live >/dev/null 2>&1 && break
-            sleep 1
-          done
-          curl -fsS http://127.0.0.1:9100/minio/health/live
-
-      # The harness never creates a bucket, so that pointing it at a cloud
-      # account cannot create one there either. The source bucket for the
-      # container is created here instead.
-      - name: Create the MinIO source bucket
-        env:
-          AWS_ACCESS_KEY_ID: ${{ env.MINIO_ROOT_USER }}
-          AWS_SECRET_ACCESS_KEY: ${{ env.MINIO_ROOT_PASSWORD }}
-          AWS_DEFAULT_REGION: us-east-1
-        run: |
-          aws --endpoint-url "${RUSTFS_ODM_INTEROP_ENDPOINT}" \
-            s3api create-bucket --bucket "${RUSTFS_ODM_INTEROP_BUCKET}"
-
-      - name: Build the RustFS binary under test
-        run: python3 scripts/e2e_binary.py build --bins
-
-      # The lane selects tests by module, so a rename would quietly shrink it.
-      # The committed digest in .config/e2e-odm-interop-selection.txt fails
-      # closed on that.
-      - name: Verify interop lane membership
-        run: |
-          cargo nextest list --profile e2e-odm-interop -p e2e_test --message-format json > "${NEXTEST_LISTING}"
-          python3 ./scripts/check_test_wiring.py --check-profile e2e-odm-interop "${NEXTEST_LISTING}"
-
-      - name: Run the interop cases against MinIO
-        run: python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-odm-interop -p e2e_test --no-tests=fail
-
-      - name: Build the MinIO interop report
-        if: always()
-        uses: ./.github/actions/odm-interop-report
-        with:
-          provider: minio
-          cases-dir: ${{ env.RUSTFS_ODM_INTEROP_REPORT_DIR }}
-          junit: target/nextest/e2e-odm-interop/junit.xml
-          output: artifacts/odm-interop/minio/report.json
-
-      - name: Collect MinIO logs
-        if: always()
-        run: |
-          docker logs --tail 500 rustfs-odm-interop-minio \
-            > artifacts/odm-interop/minio/minio.log 2>&1 || true
-
-      - name: Stop MinIO source
-        if: always()
-        run: docker rm -f rustfs-odm-interop-minio >/dev/null 2>&1 || true
-
-      - name: Upload the MinIO interop report
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: odm-interop-minio-${{ github.run_number }}-${{ github.run_attempt }}
-          path: |
-            artifacts/odm-interop/minio
-            target/nextest/e2e-odm-interop/junit.xml
-          retention-days: 14
-
-  # Unlike a production migration source, which needs read access only, the
-  # credentials here also seed the objects each case reads back, so they need
-  # write and delete on the interop bucket. Every run seeds under
-  # `odm-interop/<case>/<uuid>/` and deletes what it seeded when the case
-  # passes; give the bucket an expiration lifecycle rule so the prefixes a
-  # failing case leaves behind cannot accumulate.
-  cloud-source:
-    name: ${{ matrix.provider }} source (three-case minimum)
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - provider: aws
-            secret_prefix: AWS
-            path_style: virtual
-          - provider: r2
-            secret_prefix: R2
-            path_style: virtual
-          - provider: gcs
-            secret_prefix: GCS_HMAC
-            path_style: virtual
-    env:
-      RUSTFS_ODM_INTEROP_PROVIDER: ${{ matrix.provider }}
-      RUSTFS_ODM_INTEROP_PATH_STYLE: ${{ matrix.path_style }}
-      RUSTFS_ODM_INTEROP_ENDPOINT: ${{ secrets[format('ODM_INTEROP_{0}_ENDPOINT', matrix.secret_prefix)] }}
-      RUSTFS_ODM_INTEROP_REGION: ${{ secrets[format('ODM_INTEROP_{0}_REGION', matrix.secret_prefix)] }}
-      RUSTFS_ODM_INTEROP_BUCKET: ${{ secrets[format('ODM_INTEROP_{0}_BUCKET', matrix.secret_prefix)] }}
-      RUSTFS_ODM_INTEROP_ACCESS_KEY: ${{ secrets[format('ODM_INTEROP_{0}_ACCESS_KEY_ID', matrix.secret_prefix)] }}
-      RUSTFS_ODM_INTEROP_SECRET_KEY: ${{ secrets[format('ODM_INTEROP_{0}_SECRET_ACCESS_KEY', matrix.secret_prefix)] }}
-      RUSTFS_ODM_INTEROP_REPORT_DIR: ${{ github.workspace }}/artifacts/odm-interop/${{ matrix.provider }}/cases
-      NEXTEST_LISTING: ${{ github.workspace }}/artifacts/odm-interop/${{ matrix.provider }}/selection.json
-    steps:
-      # Absent secrets are the normal state, not a failure: the lane reports
-      # which providers it could reach and skips the rest. An empty value is
-      # what an unset repository secret expands to, so it is checked, not the
-      # secret's existence.
-      - name: Check for provider credentials
-        id: credentials
-        run: |
-          set -euo pipefail
-          if [ -z "${RUSTFS_ODM_INTEROP_ENDPOINT}" ] \
-            || [ -z "${RUSTFS_ODM_INTEROP_REGION}" ] \
-            || [ -z "${RUSTFS_ODM_INTEROP_BUCKET}" ] \
-            || [ -z "${RUSTFS_ODM_INTEROP_ACCESS_KEY}" ] \
-            || [ -z "${RUSTFS_ODM_INTEROP_SECRET_KEY}" ]; then
-            echo "present=false" >> "$GITHUB_OUTPUT"
-            {
-              echo "### On-demand migration interop: \`${{ matrix.provider }}\`"
-              echo
-              echo "Skipped: the \`ODM_INTEROP_${{ matrix.secret_prefix }}_*\` repository secrets"
-              echo "(\`_ENDPOINT\`, \`_REGION\`, \`_BUCKET\`, \`_ACCESS_KEY_ID\`, \`_SECRET_ACCESS_KEY\`)"
-              echo "are not configured, so no real \`${{ matrix.provider }}\` source was reached."
-              echo
-            } >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "present=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Checkout repository
-        if: steps.credentials.outputs.present == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust environment
-        if: steps.credentials.outputs.present == 'true'
-        uses: ./.github/actions/setup
-        with:
-          cache-shared-key: ci-odm-interop
-          cache-save-if: 'false'
-          install-build-packaging-tools: 'false'
-
-      - name: Build the RustFS binary under test
-        if: steps.credentials.outputs.present == 'true'
-        run: python3 scripts/e2e_binary.py build --bins
-
-      # A filterset that matches nothing is valid, so the count is asserted
-      # rather than inferred from a green run.
-      - name: Verify the three-case minimum still selects three cases
-        if: steps.credentials.outputs.present == 'true'
-        run: |
-          set -euo pipefail
-          mkdir -p "$(dirname "${NEXTEST_LISTING}")"
-          cargo nextest list --profile e2e-odm-interop -p e2e_test \
-            -E "${CLOUD_CASE_FILTER}" --message-format json > "${NEXTEST_LISTING}"
-          selected="$(python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); print(sum(1 for suite in d.get("rust-suites", {}).values() for test in suite.get("testcases", {}).values() if test.get("filter-match", {}).get("status") == "matches"))' "${NEXTEST_LISTING}")"
-          echo "cloud interop cases selected: ${selected}"
-          if [ "${selected}" != "${CLOUD_CASE_COUNT}" ]; then
-            echo "::error::CLOUD_CASE_FILTER selected ${selected} cases, expected ${CLOUD_CASE_COUNT}; the interop cases were renamed or moved. Context: rustfs/backlog#2167."
-            exit 1
-          fi
-
-      - name: Run the three-case minimum
-        if: steps.credentials.outputs.present == 'true'
-        run: |
-          python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-odm-interop -p e2e_test \
-            -E "${CLOUD_CASE_FILTER}" --no-tests=fail
-
-      - name: Build the ${{ matrix.provider }} interop report
-        if: always() && steps.credentials.outputs.present == 'true'
-        uses: ./.github/actions/odm-interop-report
-        with:
-          provider: ${{ matrix.provider }}
-          cases-dir: ${{ env.RUSTFS_ODM_INTEROP_REPORT_DIR }}
-          junit: target/nextest/e2e-odm-interop/junit.xml
-          output: artifacts/odm-interop/${{ matrix.provider }}/report.json
-
-      - name: Upload the ${{ matrix.provider }} interop report
-        if: always() && steps.credentials.outputs.present == 'true'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: odm-interop-${{ matrix.provider }}-${{ github.run_number }}-${{ github.run_attempt }}
-          path: |
-            artifacts/odm-interop/${{ matrix.provider }}
-            target/nextest/e2e-odm-interop/junit.xml
-          retention-days: 14
-
-  alert-on-failure:
-    name: Alert on scheduled failure
-    needs: [minio-source, cloud-source]
-    if: >-
-      always() && github.event_name == 'schedule' &&
-      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Open or update failure-tracking issue
-        uses: ./.github/actions/schedule-failure-issue
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package.yml

@@ -21,10 +21,10 @@
 # - workflow_run: automatically package after "Build and Release" completes
 #   for a release tag (the mac/windows/linux binaries are already uploaded
 #   to the GitHub release before packaging starts)
-# - workflow_dispatch: manual fallback with a release tag and/or exact build run ID
+# - workflow_dispatch: manual fallback (backfill / re-run) with optional tag/run_id
 #
 # Flow:
-# 1. Resolve and validate the selected Build workflow run and source identity
+# 1. Resolve the triggering Build workflow run for the release tag
 # 2. Download Linux binaries (x86_64-gnu, aarch64-gnu) from build artifacts
 # 3. Build DEB packages for amd64 and arm64
 # 4. Build RPM packages for x86_64 and aarch64
@@ -51,7 +51,7 @@ on:
         required: false
         type: string
       build_run_id:
-        description: "Build workflow run ID (when combined with tag, both must identify the same release commit)"
+        description: "Build workflow run ID (overrides tag lookup)"
         required: false
         type: string
 
@@ -82,9 +82,6 @@ jobs:
       version: ${{ steps.resolve.outputs.version }}
       build_type: ${{ steps.resolve.outputs.build_type }}
       build_run_id: ${{ steps.resolve.outputs.build_run_id }}
-      build_run_number: ${{ steps.resolve.outputs.build_run_number }}
-      head_sha: ${{ steps.resolve.outputs.head_sha }}
-      dev_sequence: ${{ steps.resolve.outputs.dev_sequence }}
       tag: ${{ steps.resolve.outputs.tag }}
     steps:
       - name: Resolve build run
@@ -92,129 +89,90 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          EVENT_NAME: ${{ github.event_name }}
-          REPOSITORY: ${{ github.repository }}
           INPUT_TAG: ${{ github.event.inputs.tag }}
           INPUT_RUN_ID: ${{ github.event.inputs.build_run_id }}
         run: |
           set -euo pipefail
 
-          fail() {
+          # Determine tag
-            echo "❌ $1" >&2
+          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
-            exit 1
+            TAG="${HEAD_BRANCH}"
-          }
+          elif [[ -n "$INPUT_TAG" ]]; then
-
+            TAG="$INPUT_TAG"
-          TAG=""
-          BUILD_RUN_ID=""
-          case "$EVENT_NAME" in
-            workflow_run)
-              TAG="$HEAD_BRANCH"
-              BUILD_RUN_ID="$WORKFLOW_RUN_ID"
-              ;;
-            workflow_dispatch)
-              TAG="$INPUT_TAG"
-              BUILD_RUN_ID="$INPUT_RUN_ID"
-              ;;
-            *) fail "unsupported event: $EVENT_NAME" ;;
-          esac
-
-          # Validate and classify tags before using them in API paths or logs.
-          semver_core='(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)'
-          prerelease_id='(alpha|beta|rc)\.(0|[1-9][0-9]*)'
-          if [[ -n "$TAG" ]]; then
-            if [[ "$TAG" =~ ^${semver_core}-${prerelease_id}-preview\.(0|[1-9][0-9]*)$ ]]; then
-              BUILD_TYPE=preview
-            elif [[ "$TAG" =~ ^${semver_core}-${prerelease_id}$ ]]; then
-              BUILD_TYPE=prerelease
-            elif [[ "$TAG" =~ ^${semver_core}$ ]]; then
-              BUILD_TYPE=release
-            else
-              fail "tag is not a supported strict package version"
-            fi
           else
-            BUILD_TYPE=development
+            TAG=""
           fi
 
-          if [[ -n "$BUILD_RUN_ID" ]]; then
+          echo "Tag: ${TAG:-<none>}"
-            [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ ]] || fail "build run ID must be a positive decimal integer"
-            echo "Using selected build run: $BUILD_RUN_ID"
-          elif [[ -n "$TAG" ]]; then
-            echo "Looking for build run for tag: $TAG"
-            BUILD_RUN_ID=$(gh api --method GET \
-              "repos/${REPOSITORY}/actions/workflows/build.yml/runs" \
-              -f branch="$TAG" -f status=success -F per_page=1 \
-              --jq '.workflow_runs[0].id // empty' 2>/dev/null || true)
 
-            if [[ -z "$BUILD_RUN_ID" ]]; then
+          # Determine build run ID
-              BUILD_RUN_ID=$(gh api --method GET \
+          BUILD_RUN_ID=""
-                "repos/${REPOSITORY}/actions/workflows/build.yml/runs" \
+
-                -f event=push -f status=success -F per_page=100 2>/dev/null |
+          if [[ -n "$INPUT_RUN_ID" ]]; then
-                jq -r --arg tag "$TAG" \
+            # Explicit run ID takes priority
-                  '[.workflow_runs[] | select(.head_branch == $tag)][0].id // empty' || true)
+            BUILD_RUN_ID="$INPUT_RUN_ID"
+            echo "Using explicit build run ID: $BUILD_RUN_ID"
+
+          elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
+            # Use the Build and Release run that triggered this workflow
+            BUILD_RUN_ID="${WORKFLOW_RUN_ID}"
+            echo "Using triggering workflow run: $BUILD_RUN_ID"
+
+          elif [[ -n "$TAG" ]]; then
+            # Find the build run that produced this tag
+            echo "Looking for build run for tag: $TAG"
+            BUILD_RUN_ID=$(gh api \
+              "repos/${{ github.repository }}/actions/workflows/build.yml/runs?branch=${TAG}&status=success&per_page=1" \
+              --jq '.workflow_runs[0].id' 2>/dev/null || echo "")
+
+            if [[ -z "$BUILD_RUN_ID" || "$BUILD_RUN_ID" == "null" ]]; then
+              # Tag might not be a branch; try event=push with head_branch matching
+              BUILD_RUN_ID=$(gh api \
+                "repos/${{ github.repository }}/actions/workflows/build.yml/runs?event=push&status=success&per_page=100" \
+                --jq ".workflow_runs[] | select(.head_branch == \"$TAG\") | .id" 2>/dev/null | head -1 || echo "")
+            fi
+
+            if [[ -z "$BUILD_RUN_ID" || "$BUILD_RUN_ID" == "null" ]]; then
+              echo "❌ No successful build run found for tag: $TAG"
+              exit 1
             fi
-            [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ ]] || fail "no successful build run found for tag"
             echo "Found build run: $BUILD_RUN_ID"
+
           else
+            # No tag — latest successful main build
             echo "No tag specified, looking for latest main build"
-            BUILD_RUN_ID=$(gh api --method GET \
+            BUILD_RUN_ID=$(gh api \
-              "repos/${REPOSITORY}/actions/workflows/build.yml/runs" \
+              "repos/${{ github.repository }}/actions/workflows/build.yml/runs?branch=main&status=success&per_page=1" \
-              -f branch=main -f status=success -F per_page=1 \
+              --jq '.workflow_runs[0].id' 2>/dev/null || echo "")
-              --jq '.workflow_runs[0].id // empty' 2>/dev/null || true)
+
-            [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ ]] || fail "no successful main build found"
+            if [[ -z "$BUILD_RUN_ID" || "$BUILD_RUN_ID" == "null" ]]; then
+              echo "❌ No successful main build found"
+              exit 1
+            fi
             echo "Latest main build: $BUILD_RUN_ID"
           fi
 
-          # Fetch once and use the same immutable run metadata for identity,
+          # Determine version and build type
-          # ordering, workflow provenance, and release-channel validation.
-          RUN_JSON=$(gh api "repos/${REPOSITORY}/actions/runs/${BUILD_RUN_ID}") ||
-            fail "cannot read selected build run"
-          RUN_ID=$(jq -r '.id // empty' <<<"$RUN_JSON")
-          RUN_NUMBER=$(jq -r '.run_number // empty' <<<"$RUN_JSON")
-          RUN_STATUS=$(jq -r '.status // empty' <<<"$RUN_JSON")
-          RUN_CONCLUSION=$(jq -r '.conclusion // empty' <<<"$RUN_JSON")
-          RUN_PATH=$(jq -r '.path // empty' <<<"$RUN_JSON")
-          HEAD_SHA=$(jq -r '.head_sha // empty' <<<"$RUN_JSON")
-          RUN_HEAD_BRANCH=$(jq -r '.head_branch // empty' <<<"$RUN_JSON")
-
-          [[ "$RUN_ID" == "$BUILD_RUN_ID" ]] || fail "run metadata ID mismatch"
-          [[ "$RUN_NUMBER" =~ ^[1-9][0-9]*$ ]] || fail "build run number must be a positive decimal integer"
-          [[ "$RUN_STATUS" == completed && "$RUN_CONCLUSION" == success ]] || fail "selected build run is not successful"
-          [[ "$RUN_PATH" == .github/workflows/build.yml ]] || fail "selected run is not Build and Release"
-          [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] || fail "selected build run has an invalid head SHA"
-          [[ "$RUN_HEAD_BRANCH" != *$'\n'* && -n "$RUN_HEAD_BRANCH" ]] || fail "selected build run has an invalid head branch"
-
           if [[ -n "$TAG" ]]; then
-            [[ "$RUN_HEAD_BRANCH" == "$TAG" ]] || fail "tag and build run head branch do not match"
-
-            TAG_REF_JSON=$(gh api "repos/${REPOSITORY}/git/ref/tags/${TAG}") ||
-              fail "cannot resolve release tag ref"
-            TAG_OBJECT_TYPE=$(jq -r '.object.type // empty' <<<"$TAG_REF_JSON")
-            TAG_OBJECT_SHA=$(jq -r '.object.sha // empty' <<<"$TAG_REF_JSON")
-            depth=0
-            while [[ "$TAG_OBJECT_TYPE" == tag && $depth -lt 5 ]]; do
-              TAG_OBJECT_JSON=$(gh api "repos/${REPOSITORY}/git/tags/${TAG_OBJECT_SHA}") ||
-                fail "cannot peel annotated release tag"
-              TAG_OBJECT_TYPE=$(jq -r '.object.type // empty' <<<"$TAG_OBJECT_JSON")
-              TAG_OBJECT_SHA=$(jq -r '.object.sha // empty' <<<"$TAG_OBJECT_JSON")
-              depth=$((depth + 1))
-            done
-            [[ "$TAG_OBJECT_TYPE" == commit && "$TAG_OBJECT_SHA" =~ ^[0-9a-f]{40}$ ]] ||
-              fail "release tag does not resolve to a commit"
-            [[ "$TAG_OBJECT_SHA" == "$HEAD_SHA" ]] || fail "release tag commit and build run head SHA do not match"
             VERSION="$TAG"
-            DEV_SEQUENCE=""
+            if [[ "$TAG" == *"-preview"* ]]; then
+              BUILD_TYPE="preview"
+            elif [[ "$TAG" == *"alpha"* || "$TAG" == *"beta"* || "$TAG" == *"rc"* ]]; then
+              BUILD_TYPE="prerelease"
+            else
+              BUILD_TYPE="release"
+            fi
           else
-            VERSION="dev-${HEAD_SHA}"
+            SHORT_SHA=$(gh api "repos/${{ github.repository }}/actions/runs/${BUILD_RUN_ID}" \
-            DEV_SEQUENCE="$RUN_NUMBER"
+              --jq '.head_sha' 2>/dev/null | head -c 7)
+            VERSION="dev-${SHORT_SHA}"
+            BUILD_TYPE="development"
           fi
 
           {
             echo "version=$VERSION"
             echo "build_type=$BUILD_TYPE"
             echo "build_run_id=$BUILD_RUN_ID"
-            echo "build_run_number=$RUN_NUMBER"
-            echo "head_sha=$HEAD_SHA"
-            echo "dev_sequence=$DEV_SEQUENCE"
             echo "tag=${TAG}"
           } >> "$GITHUB_OUTPUT"
 
@@ -222,7 +180,6 @@ jobs:
           echo "  Version: $VERSION"
           echo "  Build type: $BUILD_TYPE"
           echo "  Build run ID: $BUILD_RUN_ID"
-          echo "  Build run number: $RUN_NUMBER"
 
   # Build DEB and RPM packages for each architecture
   package:
@@ -249,22 +206,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Normalize package metadata
-        id: versions
-        shell: bash
-        env:
-          BUILD_TYPE: ${{ needs.resolve.outputs.build_type }}
-          SOURCE_VERSION: ${{ needs.resolve.outputs.version }}
-          DEV_SEQUENCE: ${{ needs.resolve.outputs.dev_sequence }}
-          DEB_ARCH: ${{ matrix.deb_arch }}
-          RPM_ARCH: ${{ matrix.rpm_arch }}
-        run: |
-          set -euo pipefail
-
-          normalized=$(./scripts/release/package_versions.sh \
-            "$BUILD_TYPE" "$SOURCE_VERSION" "$DEV_SEQUENCE" "$DEB_ARCH" "$RPM_ARCH")
-          printf '%s\n' "$normalized" >> "$GITHUB_OUTPUT"
-
       - name: Download binary artifact from build run
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
@@ -283,7 +224,7 @@ jobs:
           ZIP_FILE=$(find ./binary-artifact -name "*.zip" -type f | head -1)
           if [[ -z "$ZIP_FILE" ]]; then
             echo "❌ No binary artifact found"
-            find ./binary-artifact -mindepth 1 -maxdepth 1 -print 2>/dev/null || true
+            ls -la ./binary-artifact/ || true
             exit 1
           fi
 
@@ -298,22 +239,24 @@ jobs:
           fi
 
           chmod +x ./bin/rustfs
-          stat --printf='%n %s bytes\n' ./bin/rustfs
+          ls -lh ./bin/rustfs
           echo "✅ Binary extracted"
 
       - name: Build DEB package
         id: deb
         shell: bash
-        env:
-          DEB_VERSION: ${{ steps.versions.outputs.deb_version }}
-          DEB_ARCH: ${{ matrix.deb_arch }}
-          DEB_FILE: ${{ steps.versions.outputs.deb_file }}
         run: |
           set -euo pipefail
 
-          PKG_DIR="${DEB_FILE%.deb}"
+          VERSION="${{ needs.resolve.outputs.version }}"
+          DEB_ARCH="${{ matrix.deb_arch }}"
+          # DEB version: replace - with ~ (1.0.0-beta.12 -> 1.0.0~beta.12)
+          # Use a variable for ~ to prevent tilde expansion by bash
+          TILDE='~'
+          DEB_VERSION="${VERSION/-/$TILDE}"
+          PKG_DIR="rustfs_${DEB_VERSION}_${DEB_ARCH}"
 
-          echo "Building DEB: ${DEB_FILE}"
+          echo "Building DEB: ${PKG_DIR}.deb"
 
           mkdir -p "${PKG_DIR}/DEBIAN"
           mkdir -p "${PKG_DIR}/usr/bin"
@@ -390,32 +333,26 @@ jobs:
           cp LICENSE "${PKG_DIR}/usr/share/doc/rustfs/"
           cp README.md "${PKG_DIR}/usr/share/doc/rustfs/"
 
-          fakeroot dpkg-deb --build "${PKG_DIR}" "$DEB_FILE"
+          fakeroot dpkg-deb --build "${PKG_DIR}"
 
-          [[ $(dpkg-deb -f "$DEB_FILE" Package) == rustfs ]]
+          DEB_FILE="${PKG_DIR}.deb"
-          [[ $(dpkg-deb -f "$DEB_FILE" Version) == "$DEB_VERSION" ]]
+          ls -lh "$DEB_FILE"
-          [[ $(dpkg-deb -f "$DEB_FILE" Architecture) == "$DEB_ARCH" ]]
-          dpkg-deb --fsys-tarfile "$DEB_FILE" | tar -tf - | grep -Fx './usr/bin/rustfs' >/dev/null
-          stat --printf='%n %s bytes\n' "$DEB_FILE"
           echo "deb_file=$DEB_FILE" >> "$GITHUB_OUTPUT"
           echo "✅ DEB built: $DEB_FILE"
 
       - name: Build RPM package
         id: rpm
         shell: bash
-        env:
-          RPM_VERSION: ${{ steps.versions.outputs.rpm_version }}
-          RPM_RELEASE: ${{ steps.versions.outputs.rpm_release }}
-          RPM_ARCH: ${{ matrix.rpm_arch }}
-          RPM_FILE: ${{ steps.versions.outputs.rpm_file }}
         run: |
           set -euo pipefail
 
+          VERSION="${{ needs.resolve.outputs.version }}"
+          RPM_ARCH="${{ matrix.rpm_arch }}"
+
           echo "Building RPM for ${RPM_ARCH}"
 
-          sudo apt-get update && sudo apt-get install -y ruby ruby-dev build-essential rpm
+          sudo apt-get update && sudo apt-get install -y ruby ruby-dev build-essential
           sudo gem install fpm
-          ./scripts/test_package_versions.sh --require-package-managers
 
           # Create config file for fpm (DEB build creates it in its package dir structure,
           # but fpm needs the file to exist before packaging)
@@ -430,10 +367,8 @@ jobs:
 
           fpm -s dir -t rpm \
             --name rustfs \
-            --version "$RPM_VERSION" \
+            --version "$VERSION" \
-            --iteration "$RPM_RELEASE" \
             --architecture "$RPM_ARCH" \
-            --package "$RPM_FILE" \
             --depends "glibc >= 2.31" \
             --maintainer "RustFS Team <support@rustfs.com>" \
             --description "High-performance distributed object storage" \
@@ -475,16 +410,13 @@ jobs:
             LICENSE=/usr/share/doc/rustfs/LICENSE \
             README.md=/usr/share/doc/rustfs/README.md
 
-          if [[ ! -f "$RPM_FILE" ]]; then
+          RPM_FILE=$(ls -1 rustfs-*.rpm 2>/dev/null | head -1)
+          if [[ -z "$RPM_FILE" ]]; then
             echo "❌ RPM build failed"
             exit 1
           fi
 
-          RPM_METADATA=$(rpm -qp --qf '%{NAME}\n%{VERSION}\n%{RELEASE}\n%{ARCH}\n' "$RPM_FILE")
+          ls -lh "$RPM_FILE"
-          EXPECTED_METADATA=$(printf 'rustfs\n%s\n%s\n%s' "$RPM_VERSION" "$RPM_RELEASE" "$RPM_ARCH")
-          [[ "$RPM_METADATA" == "$EXPECTED_METADATA" ]]
-          rpm -qpl "$RPM_FILE" | grep -Fx '/usr/bin/rustfs' >/dev/null
-          stat --printf='%n %s bytes\n' "$RPM_FILE"
           echo "rpm_file=$RPM_FILE" >> "$GITHUB_OUTPUT"
           echo "✅ RPM built: $RPM_FILE"
 
@@ -505,9 +437,6 @@ jobs:
           R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
           AWS_EC2_METADATA_DISABLED: true
-          BUILD_TYPE: ${{ needs.resolve.outputs.build_type }}
-          DEB_FILE: ${{ steps.deb.outputs.deb_file }}
-          RPM_FILE: ${{ steps.rpm.outputs.rpm_file }}
         shell: bash
         run: |
           set -euo pipefail
@@ -525,6 +454,7 @@ jobs:
           export AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY"
           export AWS_DEFAULT_REGION="auto"
 
+          BUILD_TYPE="${{ needs.resolve.outputs.build_type }}"
           if [[ "$BUILD_TYPE" == "development" ]]; then
             R2_PREFIX="artifacts/rustfs/packages/dev"
           else
@@ -534,6 +464,9 @@ jobs:
 
           echo "📤 Uploading to $R2_PATH"
 
+          DEB_FILE="${{ steps.deb.outputs.deb_file }}"
+          RPM_FILE="${{ steps.rpm.outputs.rpm_file }}"
+
           for f in "$DEB_FILE" "$RPM_FILE"; do
             if [[ -n "$f" && -f "$f" ]]; then
               echo "Uploading: $f"
@@ -559,13 +492,14 @@ jobs:
         if: needs.resolve.outputs.tag != ''
         env:
           GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-          DEB_FILE: ${{ steps.deb.outputs.deb_file }}
-          RPM_FILE: ${{ steps.rpm.outputs.rpm_file }}
         shell: bash
         run: |
           set -euo pipefail
 
+          TAG="${{ needs.resolve.outputs.tag }}"
+          DEB_FILE="${{ steps.deb.outputs.deb_file }}"
+          RPM_FILE="${{ steps.rpm.outputs.rpm_file }}"
+
           # Upload the packages, then refresh the release checksums so the new
           # assets are covered, matching the binary release flow.
           for f in "$DEB_FILE" "$RPM_FILE"; do
@@ -617,19 +551,12 @@ jobs:
     steps:
       - name: Print summary
         shell: bash
-        env:
-          SUMMARY_VERSION: ${{ needs.resolve.outputs.version }}
-          SUMMARY_BUILD_TYPE: ${{ needs.resolve.outputs.build_type }}
-          SUMMARY_BUILD_RUN_ID: ${{ needs.resolve.outputs.build_run_id }}
-          SUMMARY_PACKAGE_STATUS: ${{ needs.package.result }}
         run: |
-          {
+          echo "## 📦 Package Summary" >> "$GITHUB_STEP_SUMMARY"
-            echo "## 📦 Package Summary"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo ""
+          echo "| Item | Value |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Item | Value |"
+          echo "|------|-------|" >> "$GITHUB_STEP_SUMMARY"
-            echo "|------|-------|"
+          echo "| Version | \`${{ needs.resolve.outputs.version }}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Version | \`${SUMMARY_VERSION}\` |"
+          echo "| Build Type | ${{ needs.resolve.outputs.build_type }} |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Build Type | ${SUMMARY_BUILD_TYPE} |"
+          echo "| Build Run | #${{ needs.resolve.outputs.build_run_id }} |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Build Run | #${SUMMARY_BUILD_RUN_ID} |"
+          echo "| Package Status | ${{ needs.package.result }} |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Package Status | ${SUMMARY_PACKAGE_STATUS} |"
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/rustfs-functional-chain.yml

@@ -1,74 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Functional chain driver: runs the ten functional suites in a fixed order
-# (upgrade -> s3 -> kms -> tier -> storage -> heal -> pool -> security ->
-# replication, with performance on its own runner in parallel) and guarantees
-# the chain keeps moving even when individual suites fail.
-#
-# Each suite workflow can still be dispatched standalone (workflow_dispatch);
-# only chain-triggered runs forward to the next suite via repository_dispatch,
-# so a standalone run never drags the rest of the chain behind it.
-#
-# Why not workflow_run chaining: GitHub does not guarantee delivery of
-# workflow_run events (they are fire-and-forget), and the head-SHA filter made
-# newly added suites (storage) unable to trigger at all. Explicit
-# repository_dispatch handoffs are verifiable and re-drivable.
-
-name: RustFS Functional Chain
-
-on:
-  workflow_dispatch:
-  workflow_run:
-    # Entry point: start the chain after the nightly build completes. The
-    # build's own conclusion does not gate the chain; each suite reports its
-    # own result to rustfs/backlog and the dashboard.
-    workflows: ["Nightly GNU Build"]
-    types: [completed]
-
-permissions:
-  contents: read
-
-jobs:
-  start-chain:
-    name: Start functional chain (upgrade first)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.event == 'schedule') }}
-    steps:
-      - name: Dispatch first suite (upgrade)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot start the functional chain" >&2
-            exit 1
-          fi
-          gh api --method POST repos/rustfs/rustfs/dispatches \
-            -f event_type='rustfs-chain-upgrade' \
-            -F 'client_payload[from_suite]=nightly-build'
-
-      - name: Dispatch performance suite (parallel, own runner)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch performance" >&2
-            exit 1
-          fi
-          gh api --method POST repos/rustfs/rustfs/dispatches \
-            -f event_type='rustfs-chain-performance' \
-            -F 'client_payload[from_suite]=nightly-build'

.github/workflows/rustfs-heal-test.yml

@@ -1,395 +0,0 @@
-name: RustFS Heal Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      package_url:
-        description: 'Direct .deb URL (nightly/R2). Defaults to the latest nightly deb.'
-        required: false
-        type: string
-      stop_node_gb:
-        description: 'Stop the outage node when surviving nodes reach N GiB'
-        required: false
-        default: '15'
-      warp_stop_gb:
-        description: 'Stop warp when surviving nodes reach N GiB'
-        required: false
-        default: '40'
-      cleanup_before:
-        description: 'Reset the nodes before the test (DESTROYS existing data/config)'
-        type: boolean
-        default: true
-      cleanup_after:
-        description: 'Reset the nodes after the test (DESTROYS test data/config)'
-        type: boolean
-        default: true
-  repository_dispatch:
-    # Chain handoff: dispatched when the storage suite finishes. Heal runs
-    # exactly once per chain; the pool expansion workflow no longer embeds
-    # its own heal pass.
-    types: [rustfs-chain-heal]
-
-permissions:
-  contents: read
-
-# Only one test at a time: both this and the pool-expansion workflow mutate
-# the same test environment, so they share one concurrency group.
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_API_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || vars.RUSTFS_RC_ENDPOINT }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-
-jobs:
-  heal-test:
-    runs-on: smoke-testing
-    # Requirement: a failing suite must not fail the workflow; failures
-    # are filed to rustfs/backlog and the chain continues.
-    continue-on-error: true
-    timeout-minutes: 480
-    # Standalone manual run, or one link of the nightly functional chain
-    # (storage -> heal -> pool). Pool expansion no longer re-runs heal.
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          warp --version || true
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        if: ${{ inputs.cleanup_before != 'false' }}
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: Install RustFS package & start cluster
-        run: |
-          ARGS=(--steps "1,2" -y --endpoint "${{ env.RUSTFS_API_ENDPOINT }}")
-          if [ -n "${{ inputs.package_url }}" ]; then
-            ARGS+=(--package-url "${{ inputs.package_url }}")
-          else
-            ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
-          fi
-          ./auto-testing/rustfs_heal_test.sh "${ARGS[@]}"
-
-      - name: Preflight checks
-        run: |
-          ARGS=(--preflight --endpoint "${{ env.RUSTFS_API_ENDPOINT }}")
-          if [ -n "${{ inputs.package_url }}" ]; then
-            ARGS+=(--package-url "${{ inputs.package_url }}")
-          else
-            ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
-          fi
-          ./auto-testing/rustfs_heal_test.sh "${ARGS[@]}"
-
-      - name: Run heal test (write -> outage -> heal -> verify)
-        id: test
-        run: |
-          ./auto-testing/rustfs_heal_test.sh \
-            --steps "3,4,5,6,7" -y \
-            --endpoint "${{ env.RUSTFS_API_ENDPOINT }}" \
-            --stop-node-gb "${{ inputs.stop_node_gb || '15' }}" \
-            --warp-stop-gb "${{ inputs.warp_stop_gb || '40' }}" \
-            --log-file /tmp/rustfs-heal-test.log
-
-      - name: Generate report
-        if: always()
-        env:
-          LOG_FILE: /tmp/rustfs-heal-test.log
-          REPORT_FILE: /tmp/rustfs-heal-report.md
-        run: |
-          set -euo pipefail
-          PACKAGE_URL='${{ inputs.package_url }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          STEPS_TABLE="/tmp/rustfs-heal-steps.md"
-          python3 - "${LOG_FILE}" "${STEPS_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file = sys.argv[1], sys.argv[2]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          step_re = re.compile(r'^\[HEAL-STEP\]\s+(\d+)\s+(.+?)\s+(PASS|FAIL|SKIP)\s*$')
-          ver_re = re.compile(r'^\[HEAL-VERSION\]\s+(\S+)(?:\s+\(node\s+(\S+)\))?\s*$')
-          result_re = re.compile(r'^\[HEAL-RESULT\]\s+(PASS|FAIL)\s+(.*)$')
-
-          steps = {}
-          order = []
-          version = None
-          version_node = None
-          verdict = None
-          verdict_detail = ''
-          try:
-              with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-                  for raw in fh:
-                      line = ansi.sub('', raw).strip()
-                      m = step_re.match(line)
-                      if m:
-                          n, desc, status = m.group(1), m.group(2), m.group(3)
-                          if n not in steps:
-                              order.append(n)
-                          steps[n] = (desc, status)  # later lines win (fail after pass)
-                          continue
-                      m = ver_re.match(line)
-                      if m:
-                          version, version_node = m.group(1), m.group(2)
-                          continue
-                      m = result_re.match(line)
-                      if m:
-                          verdict, verdict_detail = m.group(1), m.group(2)
-          except FileNotFoundError:
-              pass
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-              out.write('## Step Results\n\n')
-              if version:
-                  node_note = f' (captured via `rustfs --version` on {version_node})' if version_node else ''
-                  out.write(f'- Version under test: **{version}**{node_note}\n')
-              if verdict:
-                  out.write(f'- Overall result: **{verdict}** — {verdict_detail}\n')
-              out.write('\n')
-              out.write('| Step | Description | Result |\n')
-              out.write('| --- | --- | --- |\n')
-              for n in sorted(order, key=int):
-                  desc, status = steps[n]
-                  out.write(f'| {n} | {desc} | {status} |\n')
-              if not order:
-                  out.write('| - | - | NOT RUN (no step result lines found) |\n')
-          PY
-          {
-            echo "# RustFS heal test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- Test Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            cat "${STEPS_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: /tmp/rustfs-heal-report.md
-          SUITE: heal
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'heal'
-          SUITE_LABEL: 'Heal'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-heal-report.md'
-          LOG_FILE: '/tmp/rustfs-heal-test.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload test logs
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-heal-test-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-heal-test*.log
-            /tmp/rustfs-warp.*.log
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        if: ${{ always() && inputs.cleanup_after != 'false' }}
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: "Continue functional chain (next: Pool expansion)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-pool' \
-              -F 'client_payload[from_suite]=heal'; then
-              echo "dispatched next suite Pool expansion (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Pool expansion after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after heal (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **heal** to **Pool expansion** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-pool'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-pool'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS heal test failed"
-          echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-          echo "See the uploaded log artifact for details."

.github/workflows/rustfs-kms-test.yml

@@ -1,394 +0,0 @@
-name: RustFS KMS Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      rustfs_version:
-        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
-        required: false
-        default: '1.0.0-rc.4-preview.1'
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-      enforce_sse_key_policy:
-        description: 'Enable RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY (runs KMS-401/402)'
-        type: boolean
-        default: false
-      frame_v2:
-        description: 'Enable RUSTFS_ENCRYPTION_FRAME_V2 (runs KMS-318)'
-        type: boolean
-        default: false
-      config_secret:
-        description: 'Set RUSTFS_KMS_CONFIG_SECRET (runs KMS-107 config sealing)'
-        required: false
-        type: string
-  repository_dispatch:
-    # Chain handoff: dispatched when the S3 compatibility suite finishes.
-    types: [rustfs-chain-kms]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  kms-test:
-    runs-on: smoke-testing
-    continue-on-error: true
-    timeout-minutes: 420
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          docker --version || true
-
-      - name: Cleanup environment (before)
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: Ensure docker (Vault container)
-        run: |
-          if ! command -v docker >/dev/null 2>&1; then
-            sudo apt-get update
-            sudo apt-get install -y docker.io
-          fi
-          sudo systemctl enable --now docker
-          docker info >/dev/null 2>&1 || sudo docker info >/dev/null 2>&1
-
-      - name: Run KMS suite
-        id: test
-        continue-on-error: true
-        env:
-          LOG_FILE: /tmp/rustfs-kms.log
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-kms-test.sh
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          ARGS=(--all-topologies --backends "local,vault-kv2" -y --log-file "${LOG_FILE}")
-          EXTRA_ENV=""
-          if [ "${{ inputs.enforce_sse_key_policy }}" = "true" ]; then
-            EXTRA_ENV+="RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY=true"$'\n'
-          fi
-          if [ "${{ inputs.frame_v2 }}" = "true" ]; then
-            EXTRA_ENV+="RUSTFS_ENCRYPTION_FRAME_V2=true"$'\n'
-          fi
-          if [ -n "${{ inputs.config_secret }}" ]; then
-            EXTRA_ENV+="RUSTFS_KMS_CONFIG_SECRET=${{ inputs.config_secret }}"$'\n'
-          fi
-          if [ -n "${EXTRA_ENV}" ]; then
-            ARGS+=(--extra-env "${EXTRA_ENV}")
-          fi
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            ARGS+=(--version "${RUSTFS_VERSION}")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          ./auto-testing/rustfs-kms-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        if: always()
-        env:
-          LOG_FILE: /tmp/rustfs-kms.log
-          REPORT_FILE: /tmp/rustfs-kms-report.md
-        run: |
-          set -euo pipefail
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          CASE_TABLE="/tmp/rustfs-kms-cases.md"
-          python3 - "${LOG_FILE}" "${CASE_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file = sys.argv[1], sys.argv[2]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          start_re = re.compile(r'^---\s+([A-Z]+-[0-9]+)\s+(.+?)\s+---$')
-          done_re = re.compile(r'^\[(PASS|FAIL|UNSUPPORTED)\]\s+([A-Z]+-[0-9]+)\b')
-
-          rows = []
-          index = {}
-          try:
-            with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-              for raw in fh:
-                line = ansi.sub('', raw).strip()
-                m = start_re.match(line)
-                if m:
-                  case_id, name = m.group(1), m.group(2)
-                  if case_id not in index:
-                    index[case_id] = len(rows)
-                    rows.append([case_id, name, 'RUNNING'])
-                  continue
-                m = done_re.match(line)
-                if m:
-                  status, case_id = m.group(1), m.group(2)
-                  if case_id in index:
-                    rows[index[case_id]][2] = status
-                  else:
-                    rows.append([case_id, case_id, status])
-                    index[case_id] = len(rows) - 1
-          except FileNotFoundError:
-            rows = []
-
-          counts = {'PASS': 0, 'FAIL': 0, 'UNSUPPORTED': 0, 'RUNNING': 0}
-          for _, _, status in rows:
-            counts[status] = counts.get(status, 0) + 1
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-            out.write('## Case Summary\n\n')
-            out.write(f"- Total: {len(rows)}\\n")
-            out.write(f"- PASS: {counts.get('PASS', 0)}\\n")
-            out.write(f"- FAIL: {counts.get('FAIL', 0)}\\n")
-            out.write(f"- UNSUPPORTED: {counts.get('UNSUPPORTED', 0)}\\n")
-            out.write('\\n')
-            out.write('| Case | Name | Status |\\n')
-            out.write('| --- | --- | --- |\\n')
-            for case_id, name, status in rows:
-              out.write(f'| {case_id} | {name} | {status} |\\n')
-          PY
-          {
-            echo "# RustFS KMS test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- Test Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            cat "${CASE_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: /tmp/rustfs-kms-report.md
-          SUITE: kms
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'kms'
-          SUITE_LABEL: 'KMS'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-kms-report.md'
-          LOG_FILE: '/tmp/rustfs-kms.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload report and logs
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-kms-test-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-kms.log
-            /tmp/rustfs-kms-report.md
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        if: always()
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: "Continue functional chain (next: Tier)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-tier' \
-              -F 'client_payload[from_suite]=kms'; then
-              echo "dispatched next suite Tier (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Tier after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after kms (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **kms** to **Tier** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-tier'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-tier'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS KMS suite failed"
-          echo "See the uploaded report and log artifacts for details."

.github/workflows/rustfs-performance-test.yml

@@ -1,309 +0,0 @@
-name: RustFS Performance Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      package_url:
-        description: 'Direct .deb URL (nightly/R2). Defaults to the latest nightly deb.'
-        required: false
-        type: string
-      test_method:
-        description: 'Benchmark method(s) to run (manual runs only; "all" = GET+PUT+MIXED)'
-        type: choice
-        options:
-          - all
-          - get
-          - put
-          - mixed
-        default: 'all'
-      object_size:
-        description: 'Object size(s) to test (manual runs only; "all" = all 10 sizes)'
-        type: choice
-        options:
-          - all
-          - 1KiB
-          - 4KiB
-          - 16KiB
-          - 128KiB
-          - 1MiB
-          - 4MiB
-          - 8MiB
-          - 16MiB
-          - 32MiB
-          - 64MiB
-        default: 'all'
-      warp_duration:
-        description: 'warp duration per round (e.g. 5m, 30s)'
-        required: false
-        default: '5m'
-      warp_concurrency:
-        description: 'warp concurrency'
-        required: false
-        default: '64'
-      cleanup_before:
-        description: 'Reset the nodes before the test (DESTROYS existing data/config)'
-        type: boolean
-        default: true
-      cleanup_after:
-        description: 'Reset the nodes after the test (DESTROYS test data/config)'
-        type: boolean
-        default: true
-  repository_dispatch:
-    # Chain entry: dispatched by rustfs-functional-chain.yml (runs on its own
-    # pf-testing runner, in parallel with the shared-VM chain).
-    types: [rustfs-chain-performance]
-
-permissions:
-  contents: read
-
-# Dedicated pf-testing runner/environment: own concurrency group so perf runs
-# never block (or are blocked by) the pool-expansion / heal tests.
-concurrency:
-  group: rustfs-performance-test
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  # Performance test uses its own node list (4 nodes); the shared
-  # RUSTFS_NODES secret is used by the 3-node pool-expansion / heal tests.
-  RUSTFS_NODES: ${{ secrets.RUSTFS_PERF_NODES || vars.RUSTFS_PERF_NODES || 'vm000 vm001 vm002 vm003' }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  # Package used by the nightly run (workflow_dispatch inputs are empty for
-  # workflow_run events), i.e. the latest nightly deb published by nightly-gnu.yml.
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  # Fixed benchmark result directory so later steps can read summary.md
-  RUSTFS_RESULT_DIR: /tmp/rustfs-perf-results
-  # Cross-repo token for uploading reports to rustfs/dashboard (set in repo settings)
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  performance-test:
-    runs-on: pf-testing
-    # Requirement: a failing benchmark must not fail the workflow;
-    # failures are filed to rustfs/backlog.
-    continue-on-error: true
-    timeout-minutes: 900
-    # Run on manual dispatch, or when the nightly build completed successfully.
-    # Skipped when nightly failed.
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          warp --version || true
-          df -h /data | tail -1
-
-      - name: Reset test environment (before)
-        if: ${{ inputs.cleanup_before != 'false' }}
-        run: |
-          chmod +x auto-testing/rustfs_performance_test.sh
-          ./auto-testing/rustfs_performance_test.sh --step 1 -y
-
-      - name: Install RustFS package & start cluster (4x4)
-        run: |
-          ARGS=(--steps "2,3,4" -y)
-          if [ -n "${{ inputs.package_url }}" ]; then
-            ARGS+=(--package-url "${{ inputs.package_url }}")
-          else
-            ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
-          fi
-          ./auto-testing/rustfs_performance_test.sh "${ARGS[@]}"
-
-      - name: Preflight checks
-        run: |
-          ARGS=(--preflight)
-          if [ -n "${{ inputs.package_url }}" ]; then
-            ARGS+=(--package-url "${{ inputs.package_url }}")
-          else
-            ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
-          fi
-          ./auto-testing/rustfs_performance_test.sh "${ARGS[@]}"
-
-      - name: Run benchmark (GET/PUT/MIXED)
-        id: benchmark
-        run: |
-          # Empty on automatic (workflow_run) runs -> full 30 rounds.
-          # Manual dispatch can restrict method(s)/size(s).
-          export WARP_METHODS="${{ inputs.test_method }}"
-          export WARP_SIZES="${{ inputs.object_size }}"
-          ./auto-testing/rustfs_performance_test.sh \
-            --step 5 -y \
-            --warp-duration "${{ inputs.warp_duration || '5m' }}" \
-            --warp-concurrency "${{ inputs.warp_concurrency || '64' }}" \
-            --log-file /tmp/rustfs-perf-test.log
-
-      - name: Analyze results
-        if: ${{ steps.benchmark.conclusion == 'success' }}
-        run: |
-          ./auto-testing/rustfs_performance_test.sh --step 6 -y
-
-      - name: Collect RustFS version info
-        if: ${{ steps.benchmark.conclusion == 'success' }}
-        env:
-          VERSION_FILE: /tmp/rustfs-version.txt
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES}"
-          [ "${#NODES[@]}" -gt 0 ] || { echo "RUSTFS_NODES is empty"; exit 1; }
-          NODE="${NODES[0]}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          {
-            echo "Node: ${NODE}"
-            echo "Command: rustfs --version"
-            echo ""
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
-              "${SSH_USER}@${NODE}" 'rustfs --version'
-          } > "${VERSION_FILE}"
-
-      - name: Upload report to dashboard (reports/YYYY-MM-DD.md)
-        if: ${{ steps.benchmark.conclusion == 'success' }}
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          RESULT_DIR: ${{ env.RUSTFS_RESULT_DIR }}
-          VERSION_FILE: /tmp/rustfs-version.txt
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping report upload"
-            exit 0
-          fi
-          SUMMARY="${RESULT_DIR}/summary.md"
-          [ -f "${SUMMARY}" ] || { echo "summary.md not found at ${SUMMARY}"; exit 1; }
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="reports/${DATE}.md"
-          {
-            echo "# RustFS nightly build performance testing report"
-            echo ""
-            echo "- **Date**: ${DATE}"
-            echo "- **Run**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- **Trigger**: ${{ github.event_name }}"
-            echo "- **Package**: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-            echo ""
-            cat "${SUMMARY}"
-            echo ""
-            echo "## RustFS version"
-            echo '```text'
-            cat "${VERSION_FILE}"
-            echo '```'
-          } > /tmp/rustfs-perf-report.md
-          CONTENT="$(python3 -c 'import base64; print(base64.b64encode(open("/tmp/rustfs-perf-report.md","rb").read()).decode())')"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report: ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-            echo "updated ${REPORT_PATH} in rustfs/dashboard"
-          else
-            jq -n --arg msg "report: ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-            echo "created ${REPORT_PATH} in rustfs/dashboard"
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.benchmark.outcome == 'failure' || steps.benchmark.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'performance'
-          SUITE_LABEL: 'Performance'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-perf-report.md'
-          LOG_FILE: '/tmp/rustfs-perf-test.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload test logs & results
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-perf-test-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-perf-test*.log
-            /tmp/rustfs-perf-results/**
-            /tmp/rustfs-version.txt
-          if-no-files-found: warn
-
-      - name: Reset test environment (after)
-        if: ${{ always() && inputs.cleanup_after != 'false' }}
-        run: |
-          ./auto-testing/rustfs_performance_test.sh --step 7 -y
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS performance test failed"
-          echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-          echo "See the uploaded log artifact for details."

.github/workflows/rustfs-pool-expand-test.yml

@@ -1,11 +1,12 @@
-name: RustFS Pool Expansion Test
+name: RustFS Pool Expansion / Decommission Test
 
 on:
   workflow_dispatch:
     inputs:
       rustfs_version:
-        description: 'RustFS release tag to test (leave empty to use the latest nightly deb)'
+        description: 'RustFS release tag to test (e.g. 1.0.0-rc.3)'
         required: false
+        default: '1.0.0-rc.3'
       package_url:
         description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
         required: false
@@ -25,10 +26,6 @@ on:
         description: 'warp write duration (e.g. 5m, 10m)'
         required: false
         default: '10m'
-      warp_concurrent:
-        description: 'Pool fill: concurrent warp operations'
-        required: false
-        default: '32'
       run_decommission:
         description: 'Run the pool decommission step (3-pool topology only)'
         type: boolean
@@ -41,18 +38,17 @@ on:
         description: 'Reset the nodes after the test (DESTROYS test data/config)'
         type: boolean
         default: true
-  repository_dispatch:
+  schedule:
-    # Chain handoff: dispatched when the heal suite finishes.
+    # Nightly regression run; remove if you do not want a schedule.
-    types: [rustfs-chain-pool]
+    - cron: '0 21 * * *'
 
 permissions:
   contents: read
 
-# Only one test run at a time: the job mutates the same shared test
+# Only one pool-expansion test at a time: the workflow mutates a shared
-# environment (vm000/vm001/vm002), so concurrent runs must not clobber each
+# test environment, so concurrent runs must not clobber each other.
-# other.
 concurrency:
-  group: rustfs-shared-functional-tests
+  group: rustfs-pool-expansion-test
   cancel-in-progress: false
 
 defaults:
@@ -65,55 +61,19 @@ env:
   RUSTFS_API_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || vars.RUSTFS_RC_ENDPOINT }}
   RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
   RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
+  # Package used by the scheduled run (workflow_dispatch inputs are empty for
-  # Package used by the nightly run (workflow_dispatch inputs are empty for
+  # schedule events), i.e. the latest nightly deb published by nightly-gnu.yml.
-  # workflow_run events), i.e. the latest nightly deb published by nightly-gnu.yml.
   RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
 
 jobs:
-  # Pool expansion: dispatched by the heal suite's chain handoff. Heal
-  # itself lives in rustfs-heal-test.yml and runs exactly once per chain.
   pool-expansion-test:
-    name: Pool expansion / decommission test
     runs-on: smoke-testing
-    # Requirement: a failing suite must not fail the workflow; failures
-    # are filed to rustfs/backlog and the chain continues.
-    continue-on-error: true
     timeout-minutes: 360
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    env:
-      RUSTFS_POOL_ADMIN_ENDPOINT: ${{ secrets.RUSTFS_POOL_ADMIN_ENDPOINT || vars.RUSTFS_POOL_ADMIN_ENDPOINT || 'http://rustfs-node1:9000' }}
-      RUSTFS_POOL_PROXY_ENDPOINT: http://127.0.0.1:19000
-      RUSTFS_POOL_WARP_ENDPOINT: http://127.0.0.1:19000
-      RUSTFS_SHARED_PROXY_ENDPOINT: ${{ secrets.RUSTFS_API_ENDPOINT || vars.RUSTFS_API_ENDPOINT || vars.RUSTFS_RC_ENDPOINT }}
-      RUSTFS_POOL_NODE_ENDPOINTS: ${{ secrets.RUSTFS_POOL_NODE_ENDPOINTS || vars.RUSTFS_POOL_NODE_ENDPOINTS || 'http://rustfs-node1:9000 http://rustfs-node2:9000 http://rustfs-node3:9000' }}
     steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
+      - name: Checkout
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - name: Checkout auto-testing scripts (with retry)
+        with:
-        env:
+          persist-credentials: false
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Initialize pool test artifacts
-        run: |
-          set -euo pipefail
-          ARTIFACT_DIR="${RUNNER_TEMP}/rustfs-pool-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          mkdir -p "${ARTIFACT_DIR}"
-          echo "POOL_ARTIFACT_DIR=${ARTIFACT_DIR}" >> "${GITHUB_ENV}"
 
       - name: Show environment
         run: |
@@ -123,32 +83,15 @@ jobs:
           warp --version || true
           df -h /data | tail -1
 
-      - name: Cleanup environment (before)
+      - name: Reset test environment (before)
         if: ${{ inputs.cleanup_before != 'false' }}
         run: |
-          set -euo pipefail
+          chmod +x scripts/test/rustfs_pool_expand.sh
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
+          ./scripts/test/rustfs_pool_expand.sh --reset -y
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
 
-      - name: Install RustFS package & start cluster
+      - name: Install RustFS package & start first pool
         run: |
-          ARGS=(--steps "1,2,3" -y \
+          ARGS=(--steps 1,2,3 -y --endpoint "${{ env.RUSTFS_API_ENDPOINT }}")
-            --admin-endpoint "${RUSTFS_POOL_ADMIN_ENDPOINT}" \
-            --warp-endpoint "${RUSTFS_POOL_WARP_ENDPOINT}" \
-            --node-endpoints "${RUSTFS_POOL_NODE_ENDPOINTS}" \
-            --log-file "${POOL_ARTIFACT_DIR}/pool-test.log")
           if [ -n "${{ inputs.package_url }}" ]; then
             ARGS+=(--package-url "${{ inputs.package_url }}")
           elif [ -n "${{ inputs.rustfs_version }}" ]; then
@@ -156,15 +99,11 @@ jobs:
           else
             ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
           fi
-          ./auto-testing/rustfs_pool_expand.sh "${ARGS[@]}"
+          ./scripts/test/rustfs_pool_expand.sh "${ARGS[@]}"
 
       - name: Preflight checks
         run: |
-          ARGS=(--preflight \
+          ARGS=(--preflight --endpoint "${{ env.RUSTFS_API_ENDPOINT }}")
-            --admin-endpoint "${RUSTFS_POOL_ADMIN_ENDPOINT}" \
-            --warp-endpoint "${RUSTFS_POOL_WARP_ENDPOINT}" \
-            --node-endpoints "${RUSTFS_POOL_NODE_ENDPOINTS}" \
-            --log-file "${POOL_ARTIFACT_DIR}/pool-test.log")
           if [ -n "${{ inputs.package_url }}" ]; then
             ARGS+=(--package-url "${{ inputs.package_url }}")
           elif [ -n "${{ inputs.rustfs_version }}" ]; then
@@ -172,61 +111,7 @@ jobs:
           else
             ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
           fi
-          ./auto-testing/rustfs_pool_expand.sh "${ARGS[@]}"
+          ./scripts/test/rustfs_pool_expand.sh "${ARGS[@]}"
-
-      - name: Reset dedicated pool proxy
-        run: |
-          set -euo pipefail
-          RUSTFS_POOL_NGINX_CONFIG_PATH=/etc/nginx/conf.d/rustfs-pool-test.conf \
-          RUSTFS_POOL_NGINX_LISTEN="${RUSTFS_POOL_PROXY_ENDPOINT#http://}" \
-          RUSTFS_POOL_NGINX_ACCESS_LOG=/var/log/nginx/rustfs-pool-test-access.log \
-          RUSTFS_POOL_NGINX_ERROR_LOG=/var/log/nginx/rustfs-pool-test-error.log \
-            ./auto-testing/rustfs_pool_nginx_stage.sh cleanup
-
-      - name: Capture pool test baseline
-        run: |
-          set -uo pipefail
-          BASELINE_FILE="${POOL_ARTIFACT_DIR}/pool-baseline.log"
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          read -r -a DIRECT_ENDPOINTS <<< "${RUSTFS_POOL_NODE_ENDPOINTS}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          failed=0
-          : > "${BASELINE_FILE}"
-
-          if [ "${#DIRECT_ENDPOINTS[@]}" -lt "${#NODES[@]}" ]; then
-            echo "not enough direct endpoints for the configured nodes" | tee -a "${BASELINE_FILE}" >&2
-            exit 1
-          fi
-
-          for index in "${!NODES[@]}"; do
-            node="${NODES[$index]}"
-            endpoint="${DIRECT_ENDPOINTS[$index]}"
-            body_file="${POOL_ARTIFACT_DIR}/ready-baseline-$((index + 1)).body"
-            {
-              echo "--- node=${node} endpoint=${endpoint} ---"
-              if ! ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
-                "${SSH_USER}@${node}" '
-                  set -euo pipefail
-                  SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-                  echo "--- rustfs version ---"
-                  rustfs --version
-                  echo "--- systemd state ---"
-                  ${SUDO} systemctl show rustfs --no-pager \
-                    --property=ActiveState,SubState,Result,ExecMainPID,ExecMainStartTimestamp,NRestarts
-                '; then
-                echo "baseline collection failed for ${node}"
-                failed=1
-              fi
-              curl -sS --connect-timeout 5 --max-time 15 -o "${body_file}" \
-                -w "baseline_ready=${endpoint} http=%{http_code} connect=%{time_connect} ttfb=%{time_starttransfer} total=%{time_total}\n" \
-                "${endpoint%/}/health/ready" || true
-              echo "--- readiness body ---"
-              cat "${body_file}" 2>/dev/null || true
-              echo
-            } >> "${BASELINE_FILE}" 2>&1
-          done
-
-          [ "${failed}" -eq 0 ] || exit 1
 
       - name: Run pool expansion & decommission test
         id: pool_test
@@ -239,465 +124,27 @@ jobs:
               STEPS="$STEPS,9"
             fi
           fi
-          ARGS=(--steps "$STEPS" --with-warp -y \
+          ./scripts/test/rustfs_pool_expand.sh \
-            --admin-endpoint "${RUSTFS_POOL_ADMIN_ENDPOINT}" \
+            --steps "$STEPS" --with-warp -y \
-            --warp-endpoint "${RUSTFS_POOL_WARP_ENDPOINT}" \
+            --endpoint "${{ env.RUSTFS_API_ENDPOINT }}" \
-            --node-endpoints "${RUSTFS_POOL_NODE_ENDPOINTS}" \
             --storage-threshold "${{ inputs.storage_threshold || '50' }}" \
             --warp-duration "${{ inputs.warp_duration || '10m' }}" \
-            --warp-concurrent "${{ inputs.warp_concurrent || '32' }}" \
+            --log-file /tmp/rustfs-pool-test.log
-            --log-file "${POOL_ARTIFACT_DIR}/pool-test.log")
-          if [ -n "${RUSTFS_POOL_PROXY_ENDPOINT}" ]; then
-            ARGS+=(--proxy-endpoint "${RUSTFS_POOL_PROXY_ENDPOINT}")
-          fi
-          if [ -n "${{ inputs.package_url }}" ]; then
-            ARGS+=(--package-url "${{ inputs.package_url }}")
-          elif [ -n "${{ inputs.rustfs_version }}" ]; then
-            ARGS+=(--version "${{ inputs.rustfs_version }}")
-          else
-            ARGS+=(--package-url "${{ env.RUSTFS_NIGHTLY_PACKAGE_URL }}")
-          fi
-          RUSTFS_WARP_LOG_FILE="${POOL_ARTIFACT_DIR}/warp.log" \
-          RUSTFS_PROXY_STAGE_HOOK=./auto-testing/rustfs_pool_nginx_stage.sh \
-          RUSTFS_POOL_NGINX_CONFIG_PATH=/etc/nginx/conf.d/rustfs-pool-test.conf \
-          RUSTFS_POOL_NGINX_LISTEN="${RUSTFS_POOL_PROXY_ENDPOINT#http://}" \
-          RUSTFS_POOL_NGINX_ACCESS_LOG=/var/log/nginx/rustfs-pool-test-access.log \
-          RUSTFS_POOL_NGINX_ERROR_LOG=/var/log/nginx/rustfs-pool-test-error.log \
-            ./auto-testing/rustfs_pool_expand.sh "${ARGS[@]}"
-
-      - name: Collect pool test diagnostics
-        if: always()
-        run: |
-          set -uo pipefail
-          ARTIFACT_DIR="${POOL_ARTIFACT_DIR:-${RUNNER_TEMP}/rustfs-pool-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}}"
-          mkdir -p "${ARTIFACT_DIR}"
-          echo "POOL_ARTIFACT_DIR=${ARTIFACT_DIR}" >> "${GITHUB_ENV}"
-
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)=).*/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(proxy_set_header[[:space:]]+Authorization[[:space:]]+).*/\1[REDACTED];/Ig' \
-              -e 's/^.*(password|secret|token).*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-
-          if [ "$(id -u)" -eq 0 ]; then
-            SUDO=()
-          else
-            SUDO=(sudo -n)
-          fi
-
-          {
-            echo "captured_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-            echo "run_id=${GITHUB_RUN_ID}"
-            echo "run_attempt=${GITHUB_RUN_ATTEMPT}"
-            if command -v nginx >/dev/null 2>&1; then
-              "${SUDO[@]}" nginx -T 2>&1 || echo "nginx -T failed"
-            else
-              echo "nginx is not installed on the runner"
-            fi
-          } | redact > "${ARTIFACT_DIR}/nginx-config-redacted.txt"
-
-          for log_path in \
-            /var/log/nginx/access.log \
-            /var/log/nginx/error.log \
-            /var/log/nginx/rustfs-pool-test-access.log \
-            /var/log/nginx/rustfs-pool-test-error.log; do
-            log_name="$(basename "${log_path}")"
-            if "${SUDO[@]}" test -r "${log_path}" 2>/dev/null; then
-              "${SUDO[@]}" cat "${log_path}" 2>&1 | redact \
-                > "${ARTIFACT_DIR}/nginx-${log_name%.log}-redacted.log"
-            else
-              echo "unavailable: ${log_path}" > "${ARTIFACT_DIR}/nginx-${log_name%.log}-redacted.log"
-            fi
-          done
-          "${SUDO[@]}" journalctl -u nginx --no-pager -n 5000 2>&1 | redact \
-            > "${ARTIFACT_DIR}/nginx-journal-redacted.log" || true
-
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            safe_node="${node//[^A-Za-z0-9_.-]/_}"
-            {
-              if ! ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
-                "${SSH_USER}@${node}" '
-                  SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-                  echo "--- rustfs version ---"
-                  rustfs --version 2>&1 || true
-                  echo "--- systemd state ---"
-                  ${SUDO} systemctl show rustfs --no-pager \
-                    --property=ActiveState,SubState,Result,ExecMainPID,ExecMainStartTimestamp,NRestarts 2>&1 || true
-                  echo "--- rustfs journal ---"
-                  ${SUDO} journalctl -u rustfs --no-pager -n 10000 2>&1 || true
-                  echo "--- rustfs file logs ---"
-                  if ${SUDO} test -d /var/log/rustfs; then
-                    ${SUDO} find /var/log/rustfs -maxdepth 2 -type f -print 2>/dev/null | while IFS= read -r file; do
-                      echo "--- ${file} (last 5000 lines) ---"
-                      ${SUDO} tail -n 5000 "${file}" 2>&1 || true
-                    done
-                  else
-                    echo "/var/log/rustfs is unavailable"
-                  fi
-                '; then
-                echo "SSH diagnostics failed for ${node}"
-              fi
-            } 2>&1 | redact > "${ARTIFACT_DIR}/${safe_node}-rustfs-redacted.log"
-          done
-
-          : > "${ARTIFACT_DIR}/endpoint-ready-probes.log"
-          read -r -a DIRECT_ENDPOINTS <<< "${RUSTFS_POOL_NODE_ENDPOINTS}"
-          probe_index=0
-          for endpoint in "${DIRECT_ENDPOINTS[@]}"; do
-            probe_index=$((probe_index + 1))
-            curl -sS --connect-timeout 5 --max-time 15 -o "${ARTIFACT_DIR}/ready-direct-${probe_index}.body" \
-              -w "direct[${probe_index}]=${endpoint} http=%{http_code} connect=%{time_connect} ttfb=%{time_starttransfer} total=%{time_total}\n" \
-              "${endpoint%/}/health/ready" >> "${ARTIFACT_DIR}/endpoint-ready-probes.log" 2>&1 || true
-          done
-          if [ -n "${RUSTFS_POOL_PROXY_ENDPOINT}" ]; then
-            curl -sS --connect-timeout 5 --max-time 15 -o "${ARTIFACT_DIR}/ready-proxy.body" \
-              -w "proxy=${RUSTFS_POOL_PROXY_ENDPOINT} http=%{http_code} connect=%{time_connect} ttfb=%{time_starttransfer} total=%{time_total}\n" \
-              "${RUSTFS_POOL_PROXY_ENDPOINT%/}/health/ready" >> "${ARTIFACT_DIR}/endpoint-ready-probes.log" 2>&1 || true
-          fi
-          if [ -n "${RUSTFS_SHARED_PROXY_ENDPOINT}" ]; then
-            curl -sS --connect-timeout 5 --max-time 15 -o "${ARTIFACT_DIR}/ready-shared-proxy.body" \
-              -w "shared_proxy=${RUSTFS_SHARED_PROXY_ENDPOINT} http=%{http_code} connect=%{time_connect} ttfb=%{time_starttransfer} total=%{time_total}\n" \
-              "${RUSTFS_SHARED_PROXY_ENDPOINT%/}/health/ready" >> "${ARTIFACT_DIR}/endpoint-ready-probes.log" 2>&1 || true
-          fi
-
-      - name: Generate report
-        if: always()
-        run: |
-          set -euo pipefail
-          LOG_FILE="${POOL_ARTIFACT_DIR}/pool-test.log"
-          REPORT_FILE="${POOL_ARTIFACT_DIR}/pool-report.md"
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          STEPS_TABLE="${POOL_ARTIFACT_DIR}/pool-steps.md"
-          python3 - "${LOG_FILE}" "${STEPS_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file = sys.argv[1], sys.argv[2]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          step_re = re.compile(r'^\[POOL-STEP\]\s+(\d+)\s+(.+?)\s+(PASS|FAIL|SKIP)\s*$')
-          ver_re = re.compile(r'^\[POOL-VERSION\]\s+(\S+)(?:\s+\(node\s+(\S+)\))?\s*$')
-          result_re = re.compile(r'^\[POOL-RESULT\]\s+(PASS|FAIL)\s+(.*)$')
-
-          steps = {}
-          order = []
-          version = None
-          version_node = None
-          verdict = None
-          verdict_detail = ''
-          try:
-              with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-                  for raw in fh:
-                      line = ansi.sub('', raw).strip()
-                      m = step_re.match(line)
-                      if m:
-                          n, desc, status = m.group(1), m.group(2), m.group(3)
-                          if n not in steps:
-                              order.append(n)
-                          steps[n] = (desc, status)  # later lines win (fail after pass)
-                          continue
-                      m = ver_re.match(line)
-                      if m:
-                          version, version_node = m.group(1), m.group(2)
-                          continue
-                      m = result_re.match(line)
-                      if m:
-                          verdict, verdict_detail = m.group(1), m.group(2)
-          except FileNotFoundError:
-              pass
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-              out.write('## Step Results\n\n')
-              if version:
-                  node_note = f' (captured via `rustfs --version` on {version_node})' if version_node else ''
-                  out.write(f'- Version under test: **{version}**{node_note}\n')
-              if verdict:
-                  out.write(f'- Overall result: **{verdict}** — {verdict_detail}\n')
-              out.write('\n')
-              out.write('| Step | Description | Result |\n')
-              out.write('| --- | --- | --- |\n')
-              for n in sorted(order, key=int):
-                  desc, status = steps[n]
-                  out.write(f'| {n} | {desc} | {status} |\n')
-              if not order:
-                  out.write('| - | - | NOT RUN (no step result lines found) |\n')
-          PY
-          {
-            echo "# RustFS pool expansion test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- Warp concurrent: ${{ inputs.warp_concurrent || '32' }}"
-            echo "- Test Step Outcome: ${{ steps.pool_test.outcome }}"
-            echo ""
-            cat "${STEPS_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Validate pool diagnostic completeness
-        if: always()
-        run: |
-          set -euo pipefail
-          failed=0
-          require_nonempty() {
-            if [ ! -s "$1" ]; then
-              echo "required diagnostic is missing or empty: $1" >&2
-              failed=1
-            fi
-          }
-          require_available() {
-            if [ ! -e "$1" ]; then
-              echo "required diagnostic is missing: $1" >&2
-              failed=1
-            elif grep -Fq 'unavailable:' "$1" 2>/dev/null; then
-              echo "required diagnostic could not be collected: $1" >&2
-              failed=1
-            fi
-          }
-
-          require_nonempty "${POOL_ARTIFACT_DIR}/pool-test.log"
-          require_nonempty "${POOL_ARTIFACT_DIR}/warp.log"
-          require_nonempty "${POOL_ARTIFACT_DIR}/pool-report.md"
-          require_nonempty "${POOL_ARTIFACT_DIR}/pool-baseline.log"
-          require_nonempty "${POOL_ARTIFACT_DIR}/nginx-config-redacted.txt"
-          require_nonempty "${POOL_ARTIFACT_DIR}/nginx-rustfs-pool-test-access-redacted.log"
-          require_available "${POOL_ARTIFACT_DIR}/nginx-rustfs-pool-test-access-redacted.log"
-          require_available "${POOL_ARTIFACT_DIR}/nginx-rustfs-pool-test-error-redacted.log"
-          require_nonempty "${POOL_ARTIFACT_DIR}/endpoint-ready-probes.log"
-
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          if grep -Fq 'baseline collection failed' "${POOL_ARTIFACT_DIR}/pool-baseline.log" 2>/dev/null; then
-            echo "one or more node baselines could not be collected" >&2
-            failed=1
-          fi
-          for node in "${NODES[@]}"; do
-            safe_node="${node//[^A-Za-z0-9_.-]/_}"
-            node_log="${POOL_ARTIFACT_DIR}/${safe_node}-rustfs-redacted.log"
-            require_nonempty "${node_log}"
-            if grep -Fq "SSH diagnostics failed for ${node}" "${node_log}" 2>/dev/null; then
-              echo "node diagnostics failed: ${node_log}" >&2
-              failed=1
-            fi
-            if ! grep -Eq '^rustfs @' "${node_log}" 2>/dev/null \
-              || ! grep -Eq '^NRestarts=[0-9]+$' "${node_log}" 2>/dev/null; then
-              echo "node version or restart evidence is incomplete: ${node_log}" >&2
-              failed=1
-            elif grep -Eq '^NRestarts=[1-9][0-9]*$' "${node_log}"; then
-              echo "RustFS restarted unexpectedly during the run: ${node_log}" >&2
-              failed=1
-            fi
-          done
-
-          if ! grep -Fq "upstream_status=\"\$upstream_status\"" \
-            "${POOL_ARTIFACT_DIR}/nginx-config-redacted.txt"; then
-            echo "Nginx config does not expose upstream status fields" >&2
-            failed=1
-          fi
-          if ! grep -Eq '^proxy=.* http=200([[:space:]]|$)' "${POOL_ARTIFACT_DIR}/endpoint-ready-probes.log"; then
-            echo "dedicated proxy readiness probe did not return HTTP 200" >&2
-            failed=1
-          fi
-          if grep -Eq 'status=50(2|4)|upstream_status="[^"]*50(2|4)' \
-            "${POOL_ARTIFACT_DIR}/nginx-rustfs-pool-test-access-redacted.log"; then
-            echo "dedicated proxy access log contains a 502/504 response" >&2
-            failed=1
-          fi
-          if grep -Eiq 'upstream prematurely closed connection|upstream timed out|(connect\(\)|recv\(\)|send\(\)) failed.*upstream|connection reset by peer.*upstream' \
-            "${POOL_ARTIFACT_DIR}/nginx-rustfs-pool-test-error-redacted.log"; then
-            echo "dedicated proxy error log contains an upstream timeout or connection failure" >&2
-            failed=1
-          fi
-          [ "${failed}" -eq 0 ] || exit 1
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          SUITE: pool
-        run: |
-          set -euo pipefail
-          REPORT_FILE="${POOL_ARTIFACT_DIR}/pool-report.md"
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.pool_test.outcome == 'failure' || steps.pool_test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'pool'
-          SUITE_LABEL: 'Pool expansion'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '${{ env.POOL_ARTIFACT_DIR }}/pool-report.md'
-          LOG_FILE: '${{ env.POOL_ARTIFACT_DIR }}/pool-test.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
 
       - name: Upload test logs
         if: always()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: rustfs-pool-test-${{ github.run_id }}-${{ github.run_attempt }}
+          name: rustfs-pool-test-${{ github.run_id }}
-          path: ${{ runner.temp }}/rustfs-pool-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            /tmp/rustfs-pool-test.log
+            /tmp/rustfs-warp.log
           if-no-files-found: warn
 
-      - name: Restore dedicated pool proxy
+      - name: Reset test environment (after)
-        if: always()
-        run: |
-          set -euo pipefail
-          RUSTFS_POOL_NGINX_CONFIG_PATH=/etc/nginx/conf.d/rustfs-pool-test.conf \
-          RUSTFS_POOL_NGINX_LISTEN="${RUSTFS_POOL_PROXY_ENDPOINT#http://}" \
-          RUSTFS_POOL_NGINX_ACCESS_LOG=/var/log/nginx/rustfs-pool-test-access.log \
-          RUSTFS_POOL_NGINX_ERROR_LOG=/var/log/nginx/rustfs-pool-test-error.log \
-            ./auto-testing/rustfs_pool_nginx_stage.sh cleanup
-
-      - name: Cleanup environment (after)
         if: ${{ always() && inputs.cleanup_after != 'false' }}
         run: |
-          set -euo pipefail
+          ./scripts/test/rustfs_pool_expand.sh --reset -y
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: "Continue functional chain (next: Security)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-security' \
-              -F 'client_payload[from_suite]=pool'; then
-              echo "dispatched next suite Security (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Security after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after pool (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **pool** to **Security** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-security'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-security'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
 
       - name: Notify on failure
         if: failure()

.github/workflows/rustfs-replication-test.yml

@@ -1,365 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: RustFS Replication Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      rustfs_version:
-        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
-        required: false
-        default: '1.0.0-rc.4-preview.1'
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-      suite:
-        description: 'Suite to run (all = bucket REP-* then site SITE-*)'
-        type: choice
-        options:
-          - all
-          - bucket
-          - site
-        default: all
-  repository_dispatch:
-    # Chain handoff: dispatched when the security suite finishes. This is the
-    # last link of the functional chain.
-    types: [rustfs-chain-replication]
-
-permissions:
-  contents: read
-
-# The replication suite uses the same shared VMs as the other functional
-# tests, so it must serialize with them instead of running in parallel.
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  replication-test:
-    runs-on: smoke-testing
-    # A failed replication run must not break the chain or the workflow: the
-    # failure is reported to rustfs/backlog instead (see the issue step).
-    continue-on-error: true
-    timeout-minutes: 360
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          aws --version
-          df -h /data | tail -1 || true
-
-      - name: Cleanup environment (before)
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs rustfs-rep2 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /data/rustfs-rep2 /var/log/rustfs /var/log/rustfs-rep2 /var/lib/rustfs/kms
-            '
-          done
-
-      - name: Run replication suite
-        id: test
-        continue-on-error: true
-        env:
-          LOG_FILE: /tmp/rustfs-replication.log
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-replication-test.sh
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          SUITE='${{ inputs.suite }}'
-          ARGS=(-y --log-file "${LOG_FILE}")
-          if [ "${SUITE}" = "all" ] || [ -z "${SUITE}" ] || [ "${SUITE}" = "null" ]; then
-            ARGS+=(--suite all)
-          else
-            ARGS+=(--suite "${SUITE}")
-          fi
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
-            ARGS+=(--version "${RUSTFS_VERSION}")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          ./auto-testing/rustfs-replication-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        if: always()
-        env:
-          LOG_FILE: /tmp/rustfs-replication.log
-          REPORT_FILE: /tmp/rustfs-replication-report.md
-        run: |
-          set -euo pipefail
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          RUSTFS_VERSION_INFO="N/A"
-          if [ "${#NODES[@]}" -gt 0 ]; then
-            DETECTED_VERSION="$(ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
-              "${SSH_USER}@${NODES[0]}" 'rustfs --version' 2>/dev/null | tr -d '\r' | head -n 1 || true)"
-            if [ -n "${DETECTED_VERSION}" ]; then
-              RUSTFS_VERSION_INFO="${DETECTED_VERSION}"
-            fi
-          fi
-          CASE_TABLE="/tmp/rustfs-replication-cases.md"
-          python3 - "${LOG_FILE}" "${CASE_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file = sys.argv[1], sys.argv[2]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          start_re = re.compile(r'^---\s+([A-Z0-9]+-[0-9]+)\s+(.+?)\s+---$')
-          done_re = re.compile(r'^\[(PASS|FAIL|UNSUPPORTED)\]\s+([A-Z0-9]+-[0-9]+)\b')
-
-          rows = []
-          index = {}
-          try:
-              with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-                  for raw in fh:
-                      line = ansi.sub('', raw).strip()
-                      m = start_re.match(line)
-                      if m:
-                          case_id, name = m.group(1), m.group(2)
-                          if case_id not in index:
-                              index[case_id] = len(rows)
-                              rows.append([case_id, name, 'RUNNING'])
-                          continue
-                      m = done_re.match(line)
-                      if m:
-                          status, case_id = m.group(1), m.group(2)
-                          if case_id in index:
-                              rows[index[case_id]][2] = status
-                          else:
-                              rows.append([case_id, case_id, status])
-                              index[case_id] = len(rows) - 1
-          except FileNotFoundError:
-              rows = []
-
-          counts = {'PASS': 0, 'FAIL': 0, 'UNSUPPORTED': 0, 'RUNNING': 0}
-          for _, _, status in rows:
-              counts[status] = counts.get(status, 0) + 1
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-              out.write('## Case Summary\n\n')
-              out.write(f"- Total: {len(rows)}\\n")
-              out.write(f"- PASS: {counts.get('PASS', 0)}\\n")
-              out.write(f"- FAIL: {counts.get('FAIL', 0)}\\n")
-              out.write(f"- UNSUPPORTED: {counts.get('UNSUPPORTED', 0)}\\n")
-              out.write('\\n')
-              out.write('| Case | Name | Status |\\n')
-              out.write('| --- | --- | --- |\\n')
-              for case_id, name, status in rows:
-                  out.write(f'| {case_id} | {name} | {status} |\\n')
-          PY
-          {
-            echo "# RustFS replication test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- RustFS Version: ${RUSTFS_VERSION_INFO}"
-            echo "- Test Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            cat "${CASE_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: /tmp/rustfs-replication-report.md
-          SUITE: replication
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'replication'
-          SUITE_LABEL: 'Replication (bucket + site)'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-replication-report.md'
-          LOG_FILE: '/tmp/rustfs-replication.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload report and logs
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-replication-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-replication.log
-            /tmp/rustfs-replication-report.md
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        if: always()
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs rustfs-rep2 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /data/rustfs-rep2 /var/log/rustfs /var/log/rustfs-rep2
-            '
-          done
-
-      - name: Chain complete
-        # Replication is the last link of the functional chain: nothing to
-        # dispatch after it. This step just records that the chain finished.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        run: |
-          echo "Functional chain complete: replication (final suite) finished."
-          echo "from_suite=security trigger=${{ github.event_name }} outcome=${{ steps.test.outcome }}"
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS replication suite failed"
-          echo "Package source: ${{ inputs.package_url || inputs.rustfs_version || 'nightly (R2 latest)' }}"
-          echo "See the uploaded report and log artifacts for details."

.github/workflows/rustfs-s3-compat-test.yml

@@ -1,374 +0,0 @@
-name: RustFS S3 Compatibility Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      rustfs_version:
-        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
-        required: false
-        default: '1.0.0-rc.4-preview.1'
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-  repository_dispatch:
-    # Chain handoff: dispatched when the upgrade suite finishes.
-    types: [rustfs-chain-s3]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  s3-compat-test:
-    runs-on: smoke-testing
-    continue-on-error: true
-    timeout-minutes: 360
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs
-            '
-          done
-
-      - name: Run S3 compatibility suite
-        id: test
-        continue-on-error: true
-        env:
-          LOG_FILE: /tmp/rustfs-s3-compat.log
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-s3-compat-test.sh
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          ARGS=(--all-topologies -y --log-file "${LOG_FILE}")
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            ARGS+=(--version "${RUSTFS_VERSION}")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          ./auto-testing/rustfs-s3-compat-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        if: always()
-        env:
-          LOG_FILE: /tmp/rustfs-s3-compat.log
-          REPORT_FILE: /tmp/rustfs-s3-compat-report.md
-        run: |
-          set -euo pipefail
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          RUSTFS_VERSION_INFO="N/A"
-          if [ "${#NODES[@]}" -gt 0 ]; then
-            DETECTED_VERSION="$(ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
-              "${SSH_USER}@${NODES[0]}" 'rustfs --version' 2>/dev/null | tr -d '\r' | head -n 1 || true)"
-            if [ -n "${DETECTED_VERSION}" ]; then
-              RUSTFS_VERSION_INFO="${DETECTED_VERSION}"
-            fi
-          fi
-          CASE_TABLE="/tmp/rustfs-s3-compat-cases.md"
-          python3 - "${LOG_FILE}" "${CASE_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file = sys.argv[1], sys.argv[2]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          start_re = re.compile(r'^---\s+([A-Z0-9]+-[0-9]+)\s+(.+?)\s+---$')
-          done_re = re.compile(r'^\[(PASS|FAIL|UNSUPPORTED)\]\s+([A-Z0-9]+-[0-9]+)\b')
-
-          rows = []
-          index = {}
-          current = None
-          try:
-            with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-              for raw in fh:
-                line = ansi.sub('', raw).strip()
-                m = start_re.match(line)
-                if m:
-                  case_id, name = m.group(1), m.group(2)
-                  current = case_id
-                  if case_id not in index:
-                    index[case_id] = len(rows)
-                    rows.append([case_id, name, 'RUNNING'])
-                  continue
-                m = done_re.match(line)
-                if m:
-                  status, case_id = m.group(1), m.group(2)
-                  if case_id in index:
-                    rows[index[case_id]][2] = status
-                  else:
-                    rows.append([case_id, case_id, status])
-                    index[case_id] = len(rows) - 1
-                  current = None
-          except FileNotFoundError:
-            rows = []
-
-          counts = {'PASS': 0, 'FAIL': 0, 'UNSUPPORTED': 0, 'RUNNING': 0}
-          for _, _, status in rows:
-            counts[status] = counts.get(status, 0) + 1
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-            out.write('## Case Summary\n\n')
-            out.write(f"- Total: {len(rows)}\\n")
-            out.write(f"- PASS: {counts.get('PASS', 0)}\\n")
-            out.write(f"- FAIL: {counts.get('FAIL', 0)}\\n")
-            out.write(f"- UNSUPPORTED: {counts.get('UNSUPPORTED', 0)}\\n")
-            out.write('\\n')
-            out.write('| Case | Name | Status |\\n')
-            out.write('| --- | --- | --- |\\n')
-            for case_id, name, status in rows:
-              out.write(f'| {case_id} | {name} | {status} |\\n')
-          PY
-          {
-            echo "# RustFS S3 compatibility test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- RustFS Version: ${RUSTFS_VERSION_INFO}"
-            echo "- Test Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            cat "${CASE_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: /tmp/rustfs-s3-compat-report.md
-          SUITE: s3
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 's3'
-          SUITE_LABEL: 'S3 compatibility'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-s3-compat-report.md'
-          LOG_FILE: '/tmp/rustfs-s3-compat.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload report and logs
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-s3-compat-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-s3-compat.log
-            /tmp/rustfs-s3-compat-report.md
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        if: always()
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs
-            '
-          done
-
-      - name: "Continue functional chain (next: KMS)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-kms' \
-              -F 'client_payload[from_suite]=s3'; then
-              echo "dispatched next suite KMS (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch KMS after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after s3 (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **s3** to **KMS** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-kms'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-kms'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS S3 compatibility suite failed"
-          echo "See the uploaded report and log artifacts for details."

.github/workflows/rustfs-security-test.yml

@@ -1,345 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: RustFS Security Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      rustfs_version:
-        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
-        required: false
-        default: '1.0.0-rc.4-preview.1'
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-      topology:
-        description: 'Topology to run (all = SNSD, SNMD, MNMD)'
-        type: choice
-        options:
-          - all
-          - single-single
-          - single-multi
-          - multi-multi
-        default: all
-      oidc_live:
-        description: 'Run the live Keycloak OIDC/SSO gate as part of the suite'
-        type: boolean
-        default: true
-      cleanup_before:
-        description: 'Reset the nodes before the test (DESTROYS existing data/config)'
-        type: boolean
-        default: true
-      cleanup_after:
-        description: 'Reset the nodes after the test (DESTROYS test data/config)'
-        type: boolean
-        default: true
-  repository_dispatch:
-    # Chain handoff: dispatched when the pool expansion suite finishes.
-    types: [rustfs-chain-security]
-
-permissions:
-  contents: read
-
-# The security suite uses the same shared VMs as the other functional tests,
-# so it must serialize with them instead of running in parallel.
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  security-test:
-    runs-on: smoke-testing
-    timeout-minutes: 360
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      - name: Checkout repository (for the OIDC live gate script)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Initialize security evidence
-        id: evidence
-        run: |
-          set -euo pipefail
-          umask 077
-          SECURITY_ARTIFACTS_DIR="${RUNNER_TEMP}/rustfs-security-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          mkdir -- "${SECURITY_ARTIFACTS_DIR}"
-          printf 'SECURITY_ARTIFACTS_DIR=%s\n' "${SECURITY_ARTIFACTS_DIR}" >> "${GITHUB_ENV}"
-
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          aws --version || true
-          docker --version || true
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        if: ${{ inputs.cleanup_before != 'false' || github.event_name != 'workflow_dispatch' }}
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms
-            '
-          done
-
-      - name: Run security suite
-        id: test
-        continue-on-error: true
-        env:
-          REPORT_FILE: ${{ env.SECURITY_ARTIFACTS_DIR }}/suite-report.md
-          TMPDIR: ${{ env.SECURITY_ARTIFACTS_DIR }}
-          RUSTFS_SECURITY_OIDC_LIVE_SCRIPT: ${{ github.workspace }}/scripts/test/oidc_keycloak_live.sh
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-security-test.sh
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          TOPOLOGY='${{ inputs.topology }}'
-          ARGS=(-y)
-          if [ "${TOPOLOGY}" = "all" ] || [ -z "${TOPOLOGY}" ] || [ "${TOPOLOGY}" = "null" ]; then
-            ARGS+=(--all-topologies)
-          else
-            ARGS+=(--topology "${TOPOLOGY}")
-          fi
-          if [ "${{ inputs.oidc_live }}" = "true" ] || [ "${{ github.event_name }}" != "workflow_dispatch" ]; then
-            ARGS+=(--oidc-live)
-          fi
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ] && [ "${RUSTFS_VERSION}" != "null" ]; then
-            ARGS+=(--version "${RUSTFS_VERSION}")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          GITHUB_STEP_SUMMARY=/dev/null ./auto-testing/rustfs-security-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        id: report
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        env:
-          TEST_OUTCOME: ${{ steps.test.outcome }}
-        run: |
-          set -euo pipefail
-          RESULT=failure
-          if [ "${TEST_OUTCOME}" = "success" ] && [ -s "${SECURITY_ARTIFACTS_DIR}/suite-report.md" ]; then
-            RESULT=success
-          fi
-          {
-            echo "# RustFS security test report"
-            echo ""
-            echo "- Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-            echo "- Attempt: ${GITHUB_RUN_ATTEMPT}"
-            echo "- Workflow Commit: ${GITHUB_SHA}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Test Step Outcome: ${RESULT}"
-            echo "- Suite Step Outcome: ${TEST_OUTCOME}"
-            echo ""
-            # The dashboard prioritizes case rows over the step outcome.
-            # Keep partial case results in the artifact when the suite fails.
-            if [ "${RESULT}" = "success" ]; then
-              cat "${SECURITY_ARTIFACTS_DIR}/suite-report.md"
-            elif [ -s "${SECURITY_ARTIFACTS_DIR}/suite-report.md" ]; then
-              echo "The suite did not complete successfully. See suite-report.md in this run's artifact for diagnostics."
-            else
-              echo "The suite did not produce a non-empty report."
-            fi
-          } > "${SECURITY_ARTIFACTS_DIR}/report.md"
-          cat "${SECURITY_ARTIFACTS_DIR}/report.md" >> "${GITHUB_STEP_SUMMARY}"
-          [ "${RESULT}" = "success" ]
-
-      - name: Upload functional report to dashboard
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: ${{ env.SECURITY_ARTIFACTS_DIR }}/report.md
-          SUITE: security
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'security'
-          SUITE_LABEL: 'Security'
-          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: ${{ env.SECURITY_ARTIFACTS_DIR }}/report.md
-          LOG_FILE: ''
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ "${EVIDENCE_OUTCOME}" = "success" ] && [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload report and logs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-security-test-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ env.SECURITY_ARTIFACTS_DIR }}/
-          if-no-files-found: error
-          retention-days: 3
-
-      - name: Cleanup environment (after)
-        if: ${{ always() && (inputs.cleanup_after != 'false' || github.event_name != 'workflow_dispatch') }}
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms
-            '
-          done
-
-      - name: "Continue functional chain (next: Replication)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          echo "Dispatching next functional suite: Replication"
-          gh api --method POST repos/rustfs/rustfs/dispatches \
-            -f event_type='rustfs-chain-replication' \
-            -F 'client_payload[from_suite]=security'
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS security test failed"
-          echo "Package source: ${{ inputs.package_url || 'nightly (R2 latest)' }}"
-          echo "See the uploaded report and logs for details."

.github/workflows/rustfs-storage-test.yml

@@ -1,389 +0,0 @@
-name: RustFS Storage Engine Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      rustfs_version:
-        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
-        required: false
-        default: '1.0.0-rc.4-preview.1'
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-      topology:
-        description: 'Topology to run (all = SNSD, SNMD, MNMD)'
-        type: choice
-        options:
-          - all
-          - single-single
-          - single-multi
-          - multi-multi
-        default: all
-  repository_dispatch:
-    # Chain handoff: dispatched when the tier suite finishes.
-    types: [rustfs-chain-storage]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  storage-test:
-    runs-on: smoke-testing
-    continue-on-error: true
-    timeout-minutes: 360
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: Run storage engine suite
-        id: test
-        continue-on-error: true
-        env:
-          LOG_FILE: /tmp/rustfs-storage.log
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-storage-test.sh
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          TOPOLOGY='${{ inputs.topology }}'
-          ARGS=(-y --log-file "${LOG_FILE}")
-          if [ "${TOPOLOGY}" = "all" ] || [ -z "${TOPOLOGY}" ] || [ "${TOPOLOGY}" = "null" ]; then
-            ARGS+=(--all-topologies)
-          else
-            ARGS+=(--topology "${TOPOLOGY}")
-          fi
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            ARGS+=(--version "${RUSTFS_VERSION}")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          ./auto-testing/rustfs-storage-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        if: always()
-        env:
-          LOG_FILE: /tmp/rustfs-storage.log
-          REPORT_FILE: /tmp/rustfs-storage-report.md
-        run: |
-          set -euo pipefail
-          PACKAGE_URL='${{ inputs.package_url }}'
-          RUSTFS_VERSION='${{ inputs.rustfs_version }}'
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          RUSTFS_VERSION_INFO="N/A"
-          if [ "${#NODES[@]}" -gt 0 ]; then
-            DETECTED_VERSION="$(ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
-              "${SSH_USER}@${NODES[0]}" 'rustfs --version' 2>/dev/null | tr -d '\r' | head -n 1 || true)"
-            if [ -n "${DETECTED_VERSION}" ]; then
-              RUSTFS_VERSION_INFO="${DETECTED_VERSION}"
-            fi
-          fi
-          CASE_TABLE="/tmp/rustfs-storage-cases.md"
-          python3 - "${LOG_FILE}" "${CASE_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file = sys.argv[1], sys.argv[2]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          start_re = re.compile(r'^---\s+([A-Z0-9]+-[0-9]+)\s+(.+?)\s+---$')
-          done_re = re.compile(r'^\[(PASS|FAIL|UNSUPPORTED)\]\s+([A-Z0-9]+-[0-9]+)\b')
-
-          rows = []
-          index = {}
-          current = None
-          try:
-            with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-              for raw in fh:
-                line = ansi.sub('', raw).strip()
-                m = start_re.match(line)
-                if m:
-                  case_id, name = m.group(1), m.group(2)
-                  current = case_id
-                  if case_id not in index:
-                    index[case_id] = len(rows)
-                    rows.append([case_id, name, 'RUNNING'])
-                  continue
-                m = done_re.match(line)
-                if m:
-                  status, case_id = m.group(1), m.group(2)
-                  if case_id in index:
-                    rows[index[case_id]][2] = status
-                  else:
-                    rows.append([case_id, case_id, status])
-                    index[case_id] = len(rows) - 1
-                  current = None
-          except FileNotFoundError:
-            rows = []
-
-          counts = {'PASS': 0, 'FAIL': 0, 'UNSUPPORTED': 0, 'RUNNING': 0}
-          for _, _, status in rows:
-            counts[status] = counts.get(status, 0) + 1
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-            out.write('## Case Summary\n\n')
-            out.write(f"- Total: {len(rows)}\\n")
-            out.write(f"- PASS: {counts.get('PASS', 0)}\\n")
-            out.write(f"- FAIL: {counts.get('FAIL', 0)}\\n")
-            out.write(f"- UNSUPPORTED: {counts.get('UNSUPPORTED', 0)}\\n")
-            out.write('\\n')
-            out.write('| Case | Name | Status |\\n')
-            out.write('| --- | --- | --- |\\n')
-            for case_id, name, status in rows:
-              out.write(f'| {case_id} | {name} | {status} |\\n')
-          PY
-          {
-            echo "# RustFS storage engine test report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- RustFS Version: ${RUSTFS_VERSION_INFO}"
-            echo "- Test Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            cat "${CASE_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: /tmp/rustfs-storage-report.md
-          SUITE: storage
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'storage'
-          SUITE_LABEL: 'Storage engine'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-storage-report.md'
-          LOG_FILE: '/tmp/rustfs-storage.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload report and logs
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-storage-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-storage.log
-            /tmp/rustfs-storage-report.md
-          if-no-files-found: warn
-
-      - name: Cleanup environment (after)
-        if: always()
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs
-            '
-          done
-
-      - name: "Continue functional chain (next: Heal)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-heal' \
-              -F 'client_payload[from_suite]=storage'; then
-              echo "dispatched next suite Heal (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Heal after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after storage (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **storage** to **Heal** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-heal'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-heal'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS storage engine suite failed"
-          echo "See the uploaded report and log artifacts for details."

.github/workflows/rustfs-tier-test.yml

@@ -1,619 +0,0 @@
-name: RustFS Tier Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      rustfs_version:
-        description: 'RustFS release tag to test (e.g. 1.0.0-rc.4-preview.1)'
-        required: false
-        default: '1.0.0-rc.4-preview.1'
-      package_url:
-        description: 'Direct .deb URL (nightly/R2/dev). Overrides rustfs_version.'
-        required: false
-        type: string
-      rc_archive_url:
-        description: 'Exact RustFS CLI Linux archive URL.'
-        required: false
-        default: 'https://github.com/rustfs/cli/releases/download/v0.1.32/rustfs-cli-linux-amd64-v0.1.32.tar.gz'
-        type: string
-      rc_archive_sha256:
-        description: 'Expected SHA-256 of the RustFS CLI archive.'
-        required: false
-        default: 'ab00d937079dcb6f1c7b41d34bbfaad0eb0bd4f7218672cbcb7c33652d1c46df'
-        type: string
-      rc_sha256:
-        description: 'Expected SHA-256 of the extracted RustFS CLI binary.'
-        required: false
-        default: '320bdd4223a4d1986c1a098165f2198e92c35c4042b9a4d5e6fa33e9152477df'
-        type: string
-      force_case_failure:
-        description: 'Diagnostic only: rewrite single-single/TIER-101 to FAIL after execution to verify artifact and final-gate behavior.'
-        required: false
-        default: false
-        type: boolean
-  repository_dispatch:
-    # Chain handoff: dispatched when the KMS suite finishes.
-    types: [rustfs-chain-tier]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  RUSTFS_RC_ARCHIVE_URL: ${{ inputs.rc_archive_url || 'https://github.com/rustfs/cli/releases/download/v0.1.32/rustfs-cli-linux-amd64-v0.1.32.tar.gz' }}
-  RUSTFS_RC_ARCHIVE_SHA256: ${{ inputs.rc_archive_sha256 || 'ab00d937079dcb6f1c7b41d34bbfaad0eb0bd4f7218672cbcb7c33652d1c46df' }}
-  RUSTFS_EXPECTED_RC_SHA256: ${{ inputs.rc_sha256 || '320bdd4223a4d1986c1a098165f2198e92c35c4042b9a4d5e6fa33e9152477df' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-  TIER_ARTIFACTS_DIR: /tmp/rustfs-tier-artifacts-${{ github.run_id }}-${{ github.run_attempt }}
-
-jobs:
-  tier-test:
-    runs-on: smoke-testing
-    # Requirement: a failing suite must not fail the workflow; failures
-    # are filed to rustfs/backlog and the chain continues.
-    continue-on-error: true
-    timeout-minutes: 420
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      - name: Initialize run evidence directory
-        id: evidence
-        run: |
-          set -euo pipefail
-          umask 077
-          if ! mkdir -- "${TIER_ARTIFACTS_DIR}"; then
-            echo "refusing to reuse tier evidence path: ${TIER_ARTIFACTS_DIR}" >&2
-            exit 1
-          fi
-          test -d "${TIER_ARTIFACTS_DIR}"
-          test ! -L "${TIER_ARTIFACTS_DIR}"
-
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Prepare pinned RustFS CLI
-        id: rc
-        run: |
-          set -euo pipefail
-          umask 077
-
-          case "${RUSTFS_RC_ARCHIVE_URL}" in
-            https://*) ;;
-            *)
-              echo "RustFS CLI archive URL must use HTTPS" >&2
-              exit 1
-              ;;
-          esac
-
-          EXPECTED_ARCHIVE_SHA256="$(printf '%s' "${RUSTFS_RC_ARCHIVE_SHA256}" | tr '[:upper:]' '[:lower:]')"
-          EXPECTED_RC_SHA256="$(printf '%s' "${RUSTFS_EXPECTED_RC_SHA256}" | tr '[:upper:]' '[:lower:]')"
-          if ! [[ "${EXPECTED_ARCHIVE_SHA256}" =~ ^[0-9a-f]{64}$ ]]; then
-            echo "invalid RustFS CLI archive SHA-256" >&2
-            exit 1
-          fi
-          if ! [[ "${EXPECTED_RC_SHA256}" =~ ^[0-9a-f]{64}$ ]]; then
-            echo "invalid RustFS CLI binary SHA-256" >&2
-            exit 1
-          fi
-
-          RC_ROOT="${RUNNER_TEMP}/rustfs-tier-rc-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          RC_ARCHIVE="${RC_ROOT}/rustfs-cli.tar.gz"
-          RC_BIN="${RC_ROOT}/rc"
-          if ! mkdir -- "${RC_ROOT}"; then
-            echo "refusing to reuse RustFS CLI directory: ${RC_ROOT}" >&2
-            exit 1
-          fi
-
-          curl --fail --location --retry 3 --retry-all-errors \
-            --connect-timeout 15 --max-time 180 \
-            --proto '=https' --proto-redir '=https' \
-            --output "${RC_ARCHIVE}" "${RUSTFS_RC_ARCHIVE_URL}"
-          RC_ARCHIVE_SIZE="$(wc -c < "${RC_ARCHIVE}" | tr -d '[:space:]')"
-          if [ "${RC_ARCHIVE_SIZE}" -eq 0 ] || [ "${RC_ARCHIVE_SIZE}" -gt 33554432 ]; then
-            echo "RustFS CLI archive size is outside the accepted range: ${RC_ARCHIVE_SIZE}" >&2
-            exit 1
-          fi
-          if ! ACTUAL_ARCHIVE_SHA256="$(openssl dgst -sha256 -r "${RC_ARCHIVE}" | awk '{print $1}')"; then
-            echo "failed to calculate RustFS CLI archive SHA-256" >&2
-            exit 1
-          fi
-          if [ "${ACTUAL_ARCHIVE_SHA256}" != "${EXPECTED_ARCHIVE_SHA256}" ]; then
-            echo "RustFS CLI archive SHA-256 mismatch: expected ${EXPECTED_ARCHIVE_SHA256}, got ${ACTUAL_ARCHIVE_SHA256}" >&2
-            exit 1
-          fi
-
-          ARCHIVE_MEMBERS="$(tar -tzf "${RC_ARCHIVE}")"
-          if ! grep -Fxq 'rc' <<< "${ARCHIVE_MEMBERS}"; then
-            echo "RustFS CLI archive does not contain the rc entry" >&2
-            exit 1
-          fi
-          if ! tar -xOzf "${RC_ARCHIVE}" rc > "${RC_BIN}"; then
-            echo "failed to extract the RustFS CLI binary" >&2
-            exit 1
-          fi
-          chmod 0700 "${RC_BIN}"
-          if ! ACTUAL_RC_SHA256="$(openssl dgst -sha256 -r "${RC_BIN}" | awk '{print $1}')"; then
-            echo "failed to calculate RustFS CLI binary SHA-256" >&2
-            exit 1
-          fi
-          if [ "${ACTUAL_RC_SHA256}" != "${EXPECTED_RC_SHA256}" ]; then
-            echo "RustFS CLI binary SHA-256 mismatch: expected ${EXPECTED_RC_SHA256}, got ${ACTUAL_RC_SHA256}" >&2
-            exit 1
-          fi
-          if ! RC_VERSION_OUTPUT="$(timeout 30 "${RC_BIN}" --version 2>&1)"; then
-            echo "failed to execute the pinned RustFS CLI" >&2
-            exit 1
-          fi
-          RC_VERSION="${RC_VERSION_OUTPUT%%$'\n'*}"
-          if [ -z "${RC_VERSION}" ]; then
-            echo "pinned RustFS CLI returned an empty version" >&2
-            exit 1
-          fi
-
-          jq -n \
-            --arg schema_version '1' \
-            --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-            --arg archive_url "${RUSTFS_RC_ARCHIVE_URL}" \
-            --arg archive_sha256 "${ACTUAL_ARCHIVE_SHA256}" \
-            --arg archive_size "${RC_ARCHIVE_SIZE}" \
-            --arg path "${RC_BIN}" \
-            --arg version "${RC_VERSION}" \
-            --arg sha256 "${ACTUAL_RC_SHA256}" \
-            '{
-              schema_version: ($schema_version | tonumber),
-              generated_at: $generated_at,
-              archive: {
-                url: $archive_url,
-                sha256: $archive_sha256,
-                size: ($archive_size | tonumber)
-              },
-              binary: {
-                path: $path,
-                version: $version,
-                sha256: $sha256
-              }
-            }' > "${TIER_ARTIFACTS_DIR}/rc-bootstrap.json"
-          printf 'path=%s\n' "${RC_BIN}" >> "${GITHUB_OUTPUT}"
-          echo "RustFS CLI ready: ${RC_VERSION} (${ACTUAL_RC_SHA256})"
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        run: |
-          set -euo pipefail
-          sudo docker rm -f rustfs-test-mqtt >/dev/null 2>&1 || true
-          sudo rm -f /tmp/rustfs-mosquitto.conf
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms
-            '
-          done
-
-      - name: Ensure MQTT broker + clients
-        run: |
-          set -euo pipefail
-          if ! command -v mosquitto_sub >/dev/null 2>&1; then
-            sudo apt-get update
-            sudo apt-get install -y mosquitto-clients
-          fi
-          command -v docker >/dev/null 2>&1 || { echo 'docker not found on runner'; exit 1; }
-          sudo docker rm -f rustfs-test-mqtt >/dev/null 2>&1 || true
-          cat <<'EOF' | sudo tee /tmp/rustfs-mosquitto.conf >/dev/null
-          listener 1883 0.0.0.0
-          allow_anonymous true
-          EOF
-          sudo docker run -d --name rustfs-test-mqtt -p 1883:1883 \
-            -v /tmp/rustfs-mosquitto.conf:/mosquitto/config/mosquitto.conf:ro \
-            eclipse-mosquitto:2 >/dev/null
-          for _ in {1..10}; do
-            if ss -tln 2>/dev/null | grep -q ':1883'; then
-              break
-            fi
-            sleep 1
-          done
-          ss -tln 2>/dev/null | grep -q ':1883' || {
-            echo 'mosquitto container is not listening on 1883'
-            sudo docker logs rustfs-test-mqtt || true
-            exit 1
-          }
-
-      - name: Run tier suite
-        id: test
-        continue-on-error: true
-        env:
-          PACKAGE_URL_INPUT: ${{ inputs.package_url }}
-          RC_BIN: ${{ steps.rc.outputs.path }}
-          RUSTFS_VERSION_INPUT: ${{ inputs.rustfs_version }}
-        run: |
-          set -euo pipefail
-          LOG_FILE="${TIER_ARTIFACTS_DIR}/rustfs-tier.log"
-          chmod +x auto-testing/rustfs-tier-test.sh
-          PACKAGE_URL="${PACKAGE_URL_INPUT}"
-          RUSTFS_VERSION="${RUSTFS_VERSION_INPUT}"
-          ARGS=(
-            --all-topologies
-            -y
-            --log-file "${LOG_FILE}"
-            --rc-bin "${RC_BIN}"
-            --artifacts-dir "${TIER_ARTIFACTS_DIR}"
-          )
-          if [ -n "${RUSTFS_EXPECTED_RC_SHA256}" ]; then
-            ARGS+=(--expected-rc-sha256 "${RUSTFS_EXPECTED_RC_SHA256}")
-          fi
-          if [ -n "${PACKAGE_URL}" ]; then
-            ARGS+=(--package-url "${PACKAGE_URL}")
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            ARGS+=(--version "${RUSTFS_VERSION}")
-          else
-            ARGS+=(--package-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          ./auto-testing/rustfs-tier-test.sh "${ARGS[@]}"
-
-      - name: Inject diagnostic case failure
-        if: ${{ always() && steps.evidence.outcome == 'success' && inputs.force_case_failure }}
-        run: |
-          set -euo pipefail
-          RESULT_FILE="${TIER_ARTIFACTS_DIR}/cases/single-single--TIER-101.json"
-          test -s "${RESULT_FILE}"
-          TMP_FILE="$(mktemp "${TIER_ARTIFACTS_DIR}/cases/.forced.XXXXXX")"
-          jq '.status = "FAIL" | .case_rc = 97' "${RESULT_FILE}" > "${TMP_FILE}"
-          mv "${TMP_FILE}" "${RESULT_FILE}"
-
-      - name: Generate report
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        env:
-          PACKAGE_URL_INPUT: ${{ inputs.package_url }}
-          RUSTFS_VERSION_INPUT: ${{ inputs.rustfs_version }}
-          TEST_OUTCOME: ${{ steps.test.outcome }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          TRIGGER_NAME: ${{ github.event_name }}
-        run: |
-          set -euo pipefail
-          test -d "${TIER_ARTIFACTS_DIR}"
-          test ! -L "${TIER_ARTIFACTS_DIR}"
-          LOG_FILE="${TIER_ARTIFACTS_DIR}/rustfs-tier.log"
-          REPORT_FILE="${TIER_ARTIFACTS_DIR}/rustfs-tier-report.md"
-          CASE_TABLE="${TIER_ARTIFACTS_DIR}/rustfs-tier-cases.md"
-          GATE_RC_FILE="${TIER_ARTIFACTS_DIR}/rustfs-tier-gate.rc"
-          PACKAGE_URL="${PACKAGE_URL_INPUT}"
-          RUSTFS_VERSION="${RUSTFS_VERSION_INPUT}"
-          if [ -n "${PACKAGE_URL}" ]; then
-            PACKAGE_SOURCE="${PACKAGE_URL}"
-          elif [ -n "${RUSTFS_VERSION}" ]; then
-            PACKAGE_SOURCE="version ${RUSTFS_VERSION}"
-          else
-            PACKAGE_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          if RC_BOOTSTRAP_SUMMARY="$(jq -r '.binary | "\(.version) / \(.sha256)"' "${TIER_ARTIFACTS_DIR}/rc-bootstrap.json" 2>/dev/null)"; then
-            :
-          else
-            RC_BOOTSTRAP_SUMMARY="missing or invalid"
-          fi
-          set +e
-          python3 auto-testing/rustfs_tier_report.py \
-            --results-dir "${TIER_ARTIFACTS_DIR}/cases" \
-            --provenance "${TIER_ARTIFACTS_DIR}/provenance.json" \
-            --output "${CASE_TABLE}"
-          CASE_GATE_RC=$?
-          set -e
-          printf '%s\n' "${CASE_GATE_RC}" > "${GATE_RC_FILE}"
-          if [ ! -s "${CASE_TABLE}" ]; then
-            {
-              echo "## Case Summary"
-              echo ""
-              echo "Structured report generation failed before producing output (exit ${CASE_GATE_RC})."
-            } > "${CASE_TABLE}"
-          fi
-          {
-            echo "# RustFS tier test report"
-            echo ""
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${TRIGGER_NAME}"
-            echo "- Package: ${PACKAGE_SOURCE}"
-            echo "- Client bootstrap: ${RC_BOOTSTRAP_SUMMARY}"
-            echo "- Test Step Outcome: ${TEST_OUTCOME}"
-            echo "- Structured Gate Exit: ${CASE_GATE_RC}"
-            echo ""
-            cat "${CASE_TABLE}"
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: ${{ env.TIER_ARTIFACTS_DIR }}/rustfs-tier-report.md
-          SUITE: tier
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: Verify required tier evidence
-        id: evidence_verify
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        run: |
-          set -euo pipefail
-          failed=0
-          for name in \
-            rustfs-tier.log \
-            rustfs-tier-report.md \
-            rustfs-tier-cases.md \
-            rustfs-tier-gate.rc \
-            rc-bootstrap.json \
-            provenance.json; do
-            if [ ! -s "${TIER_ARTIFACTS_DIR}/${name}" ]; then
-              echo "required tier evidence is missing or empty: ${name}" >&2
-              failed=1
-            fi
-          done
-          for name in cases logs; do
-            if [ ! -d "${TIER_ARTIFACTS_DIR}/${name}" ]; then
-              echo "required tier evidence directory is missing: ${name}" >&2
-              failed=1
-            fi
-          done
-          if ! find "${TIER_ARTIFACTS_DIR}/cases" -maxdepth 1 -type f -name '*.json' -print -quit 2>/dev/null | grep -q .; then
-            echo "no atomic tier case result was produced" >&2
-            failed=1
-          fi
-          [ "${failed}" -eq 0 ]
-
-      - name: Upload report and logs
-        if: ${{ always() && steps.evidence.outcome == 'success' }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-tier-test-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ env.TIER_ARTIFACTS_DIR }}/
-          if-no-files-found: error
-
-      - name: Cleanup environment (after)
-        if: always()
-        run: |
-          set -euo pipefail
-          sudo docker rm -f rustfs-test-mqtt >/dev/null 2>&1 || true
-          sudo rm -f /tmp/rustfs-mosquitto.conf
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms
-            '
-          done
-
-      - name: Cleanup pinned RustFS CLI
-        if: always()
-        run: |
-          set -euo pipefail
-          RC_ROOT="${RUNNER_TEMP}/rustfs-tier-rc-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          rm -f -- "${RC_ROOT}/rustfs-cli.tar.gz" "${RC_ROOT}/rc"
-          if [ -d "${RC_ROOT}" ]; then
-            rmdir -- "${RC_ROOT}"
-          fi
-
-      - name: Enforce tier suite result
-        id: gate
-        if: always()
-        env:
-          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
-          TEST_OUTCOME: ${{ steps.test.outcome }}
-          GATE_RC_FILE: ${{ env.TIER_ARTIFACTS_DIR }}/rustfs-tier-gate.rc
-        run: |
-          set -euo pipefail
-          failed=0
-          if [ "${EVIDENCE_OUTCOME}" != "success" ]; then
-            echo "tier evidence directory initialization is ${EVIDENCE_OUTCOME}, expected success" >&2
-            failed=1
-          fi
-          if [ "${TEST_OUTCOME}" != "success" ]; then
-            echo "tier suite step outcome is ${TEST_OUTCOME}, expected success" >&2
-            failed=1
-          fi
-          if [ "${EVIDENCE_OUTCOME}" != "success" ]; then
-            echo "structured gate result is unavailable because evidence initialization failed" >&2
-          elif [ ! -s "${GATE_RC_FILE}" ]; then
-            echo "structured gate result is missing" >&2
-            failed=1
-          else
-            GATE_RC="$(tr -d '[:space:]' < "${GATE_RC_FILE}")"
-            if ! [[ "${GATE_RC}" =~ ^[0-9]+$ ]] || [ "${GATE_RC}" -ne 0 ]; then
-              echo "structured 56-case gate failed with exit ${GATE_RC:-invalid}" >&2
-              failed=1
-            fi
-          fi
-          [ "${failed}" -eq 0 ]
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled' || steps.evidence_verify.outcome == 'failure' || steps.evidence_verify.outcome == 'cancelled' || steps.gate.outcome == 'failure' || steps.gate.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'tier'
-          SUITE_LABEL: 'Tier'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          EVIDENCE_DIR: ${{ env.TIER_ARTIFACTS_DIR }}
-          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
-          VERIFY_OUTCOME: ${{ steps.evidence_verify.outcome }}
-          GATE_OUTCOME: ${{ steps.gate.outcome }}
-          REPORT_FILE: ${{ env.TIER_ARTIFACTS_DIR }}/rustfs-tier-report.md
-          LOG_FILE: ${{ env.TIER_ARTIFACTS_DIR }}/rustfs-tier.log
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo "- Evidence initialization: ${EVIDENCE_OUTCOME}"
-            echo "- Evidence verification: ${VERIFY_OUTCOME}"
-            echo "- Final gate: ${GATE_OUTCOME}"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ "${EVIDENCE_OUTCOME}" != "success" ]; then
-              echo "(the run evidence directory was rejected; its contents were not read)"
-            elif [ ! -d "${EVIDENCE_DIR}" ] || [ -L "${EVIDENCE_DIR}" ]; then
-              echo "(the run evidence directory is missing or unsafe; its contents were not read)"
-            elif [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: "Continue functional chain (next: Storage engine)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-storage' \
-              -F 'client_payload[from_suite]=tier'; then
-              echo "dispatched next suite Storage engine (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch Storage engine after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after tier (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **tier** to **Storage engine** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-storage'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-storage'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS tier suite failed"
-          echo "See the uploaded report and log artifacts for details."

.github/workflows/rustfs-upgrade-test.yml

@@ -1,491 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: RustFS Upgrade Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      from_version:
-        description: 'OLD RustFS release tag, e.g. 1.0.0-rc.3 (its release must ship a .deb asset). Leave empty for the default.'
-        required: false
-        default: '1.0.0-rc.3'
-      from_url:
-        description: 'OLD .deb URL. Overrides from_version.'
-        required: false
-        type: string
-      to_version:
-        description: 'NEW RustFS release tag, e.g. 1.0.0-rc.5 (any version with a .deb asset). Leave empty for latest nightly.'
-        required: false
-      to_url:
-        description: 'NEW .deb URL. Overrides to_version / nightly default.'
-        required: false
-        type: string
-      topology:
-        description: 'Topology to run (all = SNSD, SNMD, MNMD)'
-        type: choice
-        options:
-          - all
-          - single-single
-          - single-multi
-          - multi-multi
-        default: all
-      backends:
-        description: 'KMS backends to run (local,vault-kv2)'
-        required: false
-        default: 'local,vault-kv2'
-      cleanup_before:
-        description: 'Reset the nodes before the test (DESTROYS existing data/config)'
-        type: boolean
-        default: true
-      cleanup_after:
-        description: 'Reset the nodes after the test (DESTROYS test data/config)'
-        type: boolean
-        default: true
-  repository_dispatch:
-    # Functional-chain entry: dispatched by rustfs-functional-chain.yml.
-    types: [rustfs-chain-upgrade]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: rustfs-shared-functional-tests
-  cancel-in-progress: false
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
-  RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
-  RUSTFS_NODES: ${{ secrets.RUSTFS_NODES || vars.RUSTFS_NODES }}
-  RUSTFS_SSH_USER: ${{ secrets.RUSTFS_SSH_USER || vars.RUSTFS_SSH_USER }}
-  RUSTFS_NIGHTLY_PACKAGE_URL: ${{ vars.RUSTFS_NIGHTLY_PACKAGE_URL || 'https://dl.rustfs.com/artifacts/rustfs/packages/nightly/rustfs-nightly-latest.deb' }}
-  PF_TESTING_GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-jobs:
-  upgrade-test:
-    runs-on: smoke-testing
-    continue-on-error: true
-    timeout-minutes: 420
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
-    steps:
-      # auto-testing is private: clone it with the dedicated PF token (not
-      # GITHUB_TOKEN) and retry transient GitHub/network failures.
-      - name: Checkout auto-testing scripts (with retry)
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          rm -rf auto-testing
-          for attempt in 1 2 3 4 5; do
-            if gh repo clone rustfs/auto-testing auto-testing -- --depth 1 --quiet; then
-              echo "auto-testing cloned (attempt ${attempt})"
-              exit 0
-            fi
-            rm -rf auto-testing
-            echo "clone attempt ${attempt} failed; retrying in $((attempt * 15))s" >&2
-            sleep $((attempt * 15))
-          done
-          echo "ERROR: unable to clone rustfs/auto-testing after 5 attempts" >&2
-          exit 1
-
-      - name: Show environment
-        run: |
-          uname -a
-          jq --version
-          openssl version
-          aws --version || true
-          docker --version || true
-          df -h /data | tail -1
-
-      - name: Cleanup environment (before)
-        if: ${{ inputs.cleanup_before != 'false' || github.event_name != 'workflow_dispatch' }}
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: Ensure docker (Vault container)
-        run: |
-          if ! command -v docker >/dev/null 2>&1; then
-            sudo apt-get update
-            sudo apt-get install -y docker.io
-          fi
-          sudo systemctl enable --now docker
-          docker info >/dev/null 2>&1 || sudo docker info >/dev/null 2>&1
-
-      - name: Run upgrade compatibility suite
-        id: test
-        continue-on-error: true
-        env:
-          LOG_FILE: /tmp/rustfs-upgrade.log
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-          chmod +x auto-testing/rustfs-upgrade-test.sh
-          FROM_URL='${{ inputs.from_url }}'
-          FROM_VERSION='${{ inputs.from_version }}'
-          TO_URL='${{ inputs.to_url }}'
-          TO_VERSION='${{ inputs.to_version }}'
-          TOPOLOGY='${{ inputs.topology }}'
-          BACKENDS='${{ inputs.backends }}'
-          ARGS=(-y --log-file "${LOG_FILE}")
-          if [ "${TOPOLOGY}" = "all" ] || [ -z "${TOPOLOGY}" ] || [ "${TOPOLOGY}" = "null" ]; then
-            ARGS+=(--all-topologies)
-          else
-            ARGS+=(--topology "${TOPOLOGY}")
-          fi
-          if [ -n "${BACKENDS}" ] && [ "${BACKENDS}" != "null" ]; then
-            ARGS+=(--backends "${BACKENDS}")
-          fi
-          if [ -n "${FROM_URL}" ]; then
-            ARGS+=(--from-url "${FROM_URL}")
-          elif [ -n "${FROM_VERSION}" ] && [ "${FROM_VERSION}" != "null" ]; then
-            ARGS+=(--from-version "${FROM_VERSION}")
-          fi
-          if [ -n "${TO_URL}" ]; then
-            ARGS+=(--to-url "${TO_URL}")
-          elif [ -n "${TO_VERSION}" ] && [ "${TO_VERSION}" != "null" ]; then
-            ARGS+=(--to-version "${TO_VERSION}")
-          else
-            ARGS+=(--to-url "${RUSTFS_NIGHTLY_PACKAGE_URL}")
-          fi
-          # Fail fast with a clear message when a requested release tag has
-          # no .deb asset (e.g. 1.0.0-rc.4 ships only zips), instead of
-          # letting the suite die mid-run on a 404.
-          check_release_asset() {
-            local version="$1" tag asset url
-            [ -n "${version}" ] && [ "${version}" != "null" ] || return 0
-            tag="${version#v}"
-            asset="rustfs_${tag//-/.}_amd64.deb"
-            url="https://github.com/rustfs/rustfs/releases/download/${tag}/${asset}"
-            if ! gh api "repos/rustfs/rustfs/releases/tags/${tag}" --jq '.assets[].name' 2>/dev/null | grep -qxF "${asset}"; then
-              echo "ERROR: release ${tag} has no downloadable asset ${asset}:" >&2
-              echo "       ${url}" >&2
-              echo "Pick a tag whose release ships a .deb (check its release assets)." >&2
-              exit 1
-            fi
-            echo "resolved ${tag} -> ${url}"
-          }
-          if [ -z "${FROM_URL}" ]; then
-            check_release_asset "${FROM_VERSION}"
-          fi
-          if [ -z "${TO_URL}" ]; then
-            check_release_asset "${TO_VERSION}"
-          fi
-          ./auto-testing/rustfs-upgrade-test.sh "${ARGS[@]}"
-
-      - name: Generate report
-        if: always()
-        env:
-          LOG_FILE: /tmp/rustfs-upgrade.log
-          REPORT_FILE: /tmp/rustfs-upgrade-report.md
-        run: |
-          set -euo pipefail
-          FROM_URL='${{ inputs.from_url }}'
-          FROM_VERSION='${{ inputs.from_version }}'
-          TO_URL='${{ inputs.to_url }}'
-          TO_VERSION='${{ inputs.to_version }}'
-          if [ -n "${FROM_URL}" ]; then
-            FROM_SOURCE="${FROM_URL}"
-          elif [ -n "${FROM_VERSION}" ]; then
-            FROM_SOURCE="version ${FROM_VERSION}"
-          else
-            FROM_SOURCE="release (default)"
-          fi
-          if [ -n "${TO_URL}" ]; then
-            TO_SOURCE="${TO_URL}"
-          elif [ -n "${TO_VERSION}" ]; then
-            TO_SOURCE="version ${TO_VERSION}"
-          else
-            TO_SOURCE="${RUSTFS_NIGHTLY_PACKAGE_URL}"
-          fi
-          CASE_TABLE="/tmp/rustfs-upgrade-cases.md"
-          MATRIX_TABLE="/tmp/rustfs-upgrade-matrix.md"
-          python3 - "${LOG_FILE}" "${CASE_TABLE}" "${MATRIX_TABLE}" <<'PY'
-          import re
-          import sys
-
-          log_file, out_file, matrix_file = sys.argv[1], sys.argv[2], sys.argv[3]
-          ansi = re.compile(r'\x1b\[[0-9;]*m')
-          start_re = re.compile(r'^---\s+([A-Z]+-[0-9]+)\s+(.+?)\s+---$')
-          done_re = re.compile(r'^\[(PASS|FAIL|UNSUPPORTED)\]\s+([A-Z]+-[0-9]+)\b')
-          topo_re = re.compile(
-              r'^\[UPG-TOPO\]\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+PASS=(\d+)\s+FAIL=(\d+)\s*$')
-
-          rows = []
-          index = {}
-          topo_rows = []
-          try:
-              with open(log_file, 'r', encoding='utf-8', errors='replace') as fh:
-                  for raw in fh:
-                      line = ansi.sub('', raw).strip()
-                      m = topo_re.match(line)
-                      if m:
-                          topo_rows.append(m.groups())
-                          continue
-                      m = start_re.match(line)
-                      if m:
-                          case_id, name = m.group(1), m.group(2)
-                          if case_id not in index:
-                              index[case_id] = len(rows)
-                              rows.append([case_id, name, 'RUNNING'])
-                          continue
-                      m = done_re.match(line)
-                      if m:
-                          status, case_id = m.group(1), m.group(2)
-                          if case_id in index:
-                              rows[index[case_id]][2] = status
-                          else:
-                              rows.append([case_id, case_id, status])
-                              index[case_id] = len(rows) - 1
-          except FileNotFoundError:
-              rows = []
-
-          counts = {'PASS': 0, 'FAIL': 0, 'UNSUPPORTED': 0, 'RUNNING': 0}
-          for _, _, status in rows:
-              counts[status] = counts.get(status, 0) + 1
-
-          with open(out_file, 'w', encoding='utf-8') as out:
-              out.write('## Case Summary\n\n')
-              out.write(f"- Total: {len(rows)}\\n")
-              out.write(f"- PASS: {counts.get('PASS', 0)}\\n")
-              out.write(f"- FAIL: {counts.get('FAIL', 0)}\\n")
-              out.write(f"- UNSUPPORTED: {counts.get('UNSUPPORTED', 0)}\\n")
-              out.write('\\n')
-              out.write('| Case | Name | Status |\\n')
-              out.write('| --- | --- | --- |\\n')
-              for case_id, name, status in rows:
-                  out.write(f'| {case_id} | {name} | {status} |\\n')
-
-          # Upgrade matrix: one row per topology/backend with the versions
-          # captured on the nodes (rustfs --version) and the aggregated
-          # result. The dashboard renders this table directly.
-          with open(matrix_file, 'w', encoding='utf-8') as out:
-              out.write('## Upgrade Matrix\n\n')
-              out.write('| Topology | KMS Backend | From Version | To Version | Result |\n')
-              out.write('| --- | --- | --- | --- | --- |\n')
-              for topo, backend, old_v, new_v, npass, nfail in topo_rows:
-                  result = 'PASS' if nfail == '0' else 'FAIL'
-                  out.write(f'| {topo} | {backend} | {old_v} | {new_v} | {result} (PASS={npass} FAIL={nfail}) |\n')
-              if not topo_rows:
-                  out.write('| - | - | - | - | NOT RUN (suite failed before upgrade) |\n')
-          PY
-          {
-            echo "# RustFS upgrade compatibility report"
-            echo ""
-            echo "- Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            echo "- Trigger: ${{ github.event_name }}"
-            echo "- From: ${FROM_SOURCE}"
-            echo "- To: ${TO_SOURCE}"
-            echo "- Test Step Outcome: ${{ steps.test.outcome }}"
-            echo ""
-            cat "${MATRIX_TABLE}" || true
-            echo ""
-            cat "${CASE_TABLE}" || true
-            echo ""
-            echo "## Log tail"
-            echo '```text'
-            tail -n 200 "${LOG_FILE}" || true
-            echo '```'
-          } | tee "${REPORT_FILE}"
-          cat "${REPORT_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Upload functional report to dashboard
-        if: always()
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ env.PF_TESTING_GH_TOKEN }}
-          REPORT_FILE: /tmp/rustfs-upgrade-report.md
-          SUITE: upgrade
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping dashboard upload"
-            exit 0
-          fi
-          DATE="$(date -u +%Y-%m-%d)"
-          REPORT_PATH="functional-reports/${SUITE}/${DATE}.md"
-          CONTENT="$(python3 -c 'import base64,sys;print(base64.b64encode(open(sys.argv[1],"rb").read()).decode())' "${REPORT_FILE}")"
-          SHA="$(gh api "repos/rustfs/dashboard/contents/${REPORT_PATH}" -q '.sha' 2>/dev/null || true)"
-          if [ -n "${SHA}" ]; then
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" --arg sha "${SHA}" \
-              '{message:$msg, content:$content, sha:$sha}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          else
-            jq -n --arg msg "report(${SUITE}): ${DATE}" --arg content "${CONTENT}" \
-              '{message:$msg, content:$content}' \
-              | gh api --method PUT "repos/rustfs/dashboard/contents/${REPORT_PATH}" --input - >/dev/null
-          fi
-
-      - name: File failure issue in rustfs/backlog
-        if: ${{ always() && (failure() || steps.test.outcome == 'failure' || steps.test.outcome == 'cancelled') }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-          SUITE: 'upgrade'
-          SUITE_LABEL: 'Upgrade compatibility'
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          REPORT_FILE: '/tmp/rustfs-upgrade-report.md'
-          LOG_FILE: '/tmp/rustfs-upgrade.log'
-        run: |
-          set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; skipping backlog issue"
-            exit 0
-          fi
-          TITLE="[functional][${SUITE}] ${SUITE_LABEL} suite failed (run ${GITHUB_RUN_ID})"
-          EXISTING="$(gh issue list -R rustfs/backlog --state all \
-            --search "in:title \"run ${GITHUB_RUN_ID}\"" \
-            --json number --jq '.[].number' || true)"
-          if [ -n "${EXISTING}" ]; then
-            echo "backlog issue already exists for run ${GITHUB_RUN_ID}; skipping"
-            exit 0
-          fi
-          redact() {
-            sed -E \
-              -e 's/(RUSTFS_(ACCESS_KEY|SECRET_KEY)[=: ]+)[^[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/(Authorization:).*/\1 [REDACTED]/Ig' \
-              -e 's/(X-Amz-Signature=)[^&[:space:]]+/\1[REDACTED]/Ig' \
-              -e 's/^.*(password|secret|token)[=: ].*/[REDACTED SENSITIVE LINE]/Ig'
-          }
-          BODY_FILE="$(mktemp)"
-          {
-            echo "The **${SUITE_LABEL}** functional suite failed."
-            echo ""
-            echo "- Suite: \`${SUITE}\`"
-            echo "- Run: ${RUN_URL}"
-            echo "- Trigger: ${GITHUB_EVENT_NAME}"
-            echo "- Date: $(date -u +%Y-%m-%d)"
-            echo ""
-            echo "## Report (errors and symptoms)"
-            echo ""
-            if [ -s "${REPORT_FILE}" ]; then
-              redact < "${REPORT_FILE}"
-            elif [ -s "${LOG_FILE:-}" ]; then
-              echo "(report file missing; log tail below)"
-              echo ""
-              tail -n 200 "${LOG_FILE}" | redact
-            else
-              echo "(no report or log file was produced)"
-            fi
-          } | head -c 55000 > "${BODY_FILE}"
-          gh label create functional-test -R rustfs/backlog --color d73a4a 2>/dev/null || true
-          if ! gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test; then
-            gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}"
-          fi
-          echo "filed backlog issue for suite ${SUITE}"
-
-      - name: Upload report and logs
-        if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: rustfs-upgrade-test-${{ github.run_id }}
-          path: |
-            /tmp/rustfs-upgrade-report.md
-            /tmp/rustfs-upgrade.*/*
-          if-no-files-found: ignore
-          retention-days: 3
-
-      - name: Cleanup environment (after)
-        if: ${{ always() && (inputs.cleanup_after != 'false' || github.event_name != 'workflow_dispatch') }}
-        run: |
-          set -euo pipefail
-          read -r -a NODES <<< "${RUSTFS_NODES:-vm000 vm001 vm002}"
-          SSH_USER="${RUSTFS_SSH_USER:-azureuser}"
-          for node in "${NODES[@]}"; do
-            ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${SSH_USER}@${node}" '
-              set -euo pipefail
-              SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo -n"
-              ${SUDO} systemctl stop rustfs 2>/dev/null || true
-              if ${SUDO} dpkg -l rustfs 2>/dev/null | grep -q "^ii"; then
-                ${SUDO} dpkg -P rustfs
-              fi
-              for i in 1 2 3 4; do ${SUDO} rm -rf /data/rustfs${i}/mnmd; done
-              ${SUDO} rm -rf /var/log/rustfs /var/lib/rustfs/kms /var/lib/rustfs/kms-backup
-            '
-          done
-
-      - name: "Continue functional chain (next: S3 compatibility)"
-        # Only chain-triggered runs forward to the next suite; standalone
-        # workflow_dispatch runs stop after their own cleanup. A failed
-        # handoff must never pass silently: it retries, then files an alert
-        # issue in rustfs/backlog so a stalled chain is visible.
-        if: ${{ always() && github.event_name == 'repository_dispatch' }}
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.PF_TESTING_GH_TOKEN }}
-        run: |
-          set -uo pipefail
-          if [ -z "${GH_TOKEN:-}" ]; then
-            echo "PF_TESTING_GH_TOKEN is not configured; cannot dispatch the next suite" >&2
-            exit 1
-          fi
-          DISPATCHED=0
-          for attempt in 1 2 3; do
-            if gh api --method POST repos/rustfs/rustfs/dispatches \
-              -f event_type='rustfs-chain-s3' \
-              -F 'client_payload[from_suite]=upgrade'; then
-              echo "dispatched next suite S3 compatibility (attempt ${attempt})"
-              DISPATCHED=1
-              break
-            fi
-            echo "dispatch attempt ${attempt} failed; retrying in ${attempt}0s" >&2
-            sleep "${attempt}0"
-          done
-          if [ "${DISPATCHED:-0}" -ne 1 ]; then
-            echo "ERROR: functional chain stalled: could not dispatch S3 compatibility after 3 attempts" >&2
-            TITLE="[functional][chain] stalled after upgrade (run ${GITHUB_RUN_ID})"
-            BODY_FILE="$(mktemp)"
-            {
-              echo "The functional chain could not hand off from **upgrade** to **S3 compatibility** after 3 attempts."
-              echo ""
-              echo "- Failed suite job: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-              echo "- Expected next event: 'rustfs-chain-s3'"
-              echo "- Likely cause: PF_TESTING_GH_TOKEN lacks contents:write on rustfs/rustfs, or the GitHub API was unavailable."
-              echo "- Recovery: re-dispatch manually with"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-              echo "  gh api --method POST repos/rustfs/rustfs/dispatches -f event_type='rustfs-chain-s3'"
-              FENCE="$(printf "\x60\x60\x60")"; echo "  ${FENCE}"
-            } > "${BODY_FILE}"
-            gh issue create -R rustfs/backlog --title "${TITLE}" \
-              --body-file "${BODY_FILE}" --label functional-test \
-              || gh issue create -R rustfs/backlog --title "${TITLE}" --body-file "${BODY_FILE}" \
-              || echo "could not file the stall alert issue either; check the token" >&2
-            exit 1
-          fi
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          echo "RustFS upgrade compatibility test failed"
-          echo "From: ${{ inputs.from_url || inputs.from_version || 'release (default)' }}"
-          echo "To: ${{ inputs.to_url || inputs.to_version || 'nightly (R2 latest)' }}"
-          echo "See the uploaded report and logs for details."

.github/workflows/scheduled-validation-freshness.yml

@@ -42,7 +42,6 @@ jobs:
       - name: Check latest scheduled runs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RUSTFS_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           set +e
           python3 scripts/check_scheduled_validation_freshness.py \

.github/workflows/star-history.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: overtrue/repo-visuals-action@fd79cba437ecfac933d00a69add17eb95d3939c3 # v1.3.1
+      - uses: overtrue/repo-visuals-action@72f34d24769ff5d341956da2f23952594ef2f1e2 # v1.3.0
         with:
           github-token: ${{ github.token }}
           output-branch: star-history

.gitignore

@@ -33,7 +33,6 @@ profile.json
 *.zst
 .secrets
 *.go
-!crates/zip/tests/fixtures/snowball/**/generate/*.go
 *.pb
 *.svg
 deploy/logs/*.log.*
@@ -56,10 +55,11 @@ docs/*
 !docs/architecture/**
 !docs/operations/
 !docs/operations/**
-!docs/postmortems/
-!docs/postmortems/**
 !docs/testing/
 !docs/testing/**
+docs/heal-scanner-logging-governance.md
+docs/benchmark/rustfs-target-bench/
+docs/benchmark/*.md
 .codegraph/*
 .docker/test/compat/data/*
 .docker/test/compat/kms/*
@@ -83,8 +83,6 @@ worktrees/*
 
 # Local AI-agent review artifacts (omo evidence dumps)
 .omo/
-# Legacy per-tool skill dir; skills live in .agents/skills (shared by all agents)
-.mimocode/
 
 # insta scratch files; the accepted .snap files ARE the assertions and are committed
 *.snap.new

AGENTS.md

@@ -31,13 +31,8 @@ This file contains repository-wide rules. Use the nearest subdirectory
 - An existing clean, isolated task worktree is sufficient. Create another
   worktree only when the current checkout is shared, dirty with unrelated work,
   or belongs to another task.
-- Never commit from a shared checkout.
+- Never commit from a shared checkout. Use an `overtrue/` feature branch unless
-- Use a task-specific branch named `<type>/<topic>`, such as `fix/...`,
+  the user requests another name.
-  `feat/...`, `test/...`, or `docs/...`, unless the user specifies a name.
-- Do not include agent, tool, contributor, account, or organization names in
-  branch names.
-- Push to the user-requested remote or the repository's configured push remote.
-  Do not hard-code or infer a remote from an account name.
 - Check free space before artifact-heavy builds, tests, coverage, or downloads.
   Re-check before a broad gate when space is tight.
 - Remove only task-owned temporary/build artifacts. Never delete another task's
@@ -86,7 +81,6 @@ This file contains repository-wide rules. Use the nearest subdirectory
 - CI gates: `.github/workflows/ci.yml`.
 - PR format: `.github/pull_request_template.md`.
 - Architecture routing: `ARCHITECTURE.md` and `docs/architecture/README.md`.
-- Knowledge-base index and documentation rules: `docs/architecture/README.md`.
 - Agent skills: `.agents/skills/*/SKILL.md`.
 
 Do not commit one-shot plans, trackers, migration ledgers, benchmark snapshots,
@@ -124,13 +118,12 @@ runtime/build output:
 - Use `make pre-commit` only when its repository-wide fast checks add confidence
   beyond the focused checks.
 
-### Broad Cross-Module Changes
+### Broad or High-Risk Changes
 
-Do not run `make pre-pr` by default before opening a PR. Consider it only when
+After the required adversarial review, run `make pre-pr` when targeted coverage
-the final diff is broad, spans multiple modules, and targeted checks cannot
+cannot bound the impact, including dependency/toolchain/build-matrix changes,
-bound the impact. Decide dynamically from the affected boundaries and risks;
+unbounded cross-crate APIs, or locking, durability, erasure coding, replication,
-otherwise use the scoped formatting, linting, compilation, and test checks
+RPC, IAM/KMS/auth, cryptography, on-disk/on-wire, and S3-visible behavior.
-above.
 
 `make pre-pr` includes `make pre-commit`; never run both for the same unchanged
 diff. Do not repeat a check already covered by a successful umbrella gate.
@@ -162,12 +155,6 @@ Risk and review shape:
   S3-visible semantics. Cover all applicable lenses using exactly two
   independent reviewers when delegation is explicitly authorized. Split the
   lenses between them. Otherwise perform two fresh sequential passes.
-- **Outbound client defaults:** what `TargetClient`, `PutObjectOptions`, or
-  the remote SDK configuration sends to every replication or migration target
-  is high risk for every target class even when the change fixes one. Follow
-  the SOP in `docs/postmortems/2026-09-03-replication-checksum-default-regression.md`:
-  run the outbound target matrix, document each new env knob in the same PR,
-  and list verified and unverified target classes in the PR Impact section.
 
 Available domain lenses are security, concurrency/durability, compatibility,
 and performance. Select `.agents/skills/adversarial-validation/SKILL.md` for an

ARCHITECTURE.md

@@ -62,7 +62,7 @@ rustfs/                      # Workspace root (virtual manifest)
 │   ├── utils/               # Pure utility functions
 │   ├── ...                  # (see "Crate Reference" below)
 │   └── e2e_test/            # End-to-end integration tests
-└── docs/                    # Agent knowledge base: contracts, runbooks, testing rules (index: docs/architecture/README.md)
+└── docs/                    # Design documents and analysis
 ```
 
 ### Main Crate Layers (`rustfs/src/`)
@@ -92,7 +92,7 @@ refactors.
 
 | Domain | Current workspace crates | Responsibility |
 |--------|--------------------------|----------------|
-| Foundation | `checksums`, `common`, `config`, `data-usage`, `heal-contracts`, `scanner-metrics`, `utils` | Shared configuration, data-usage models, heal domain contracts, scanner telemetry types, utilities, and checksums. |
+| Foundation | `checksums`, `common`, `config`, `data-usage`, `heal-contracts`, `scanner-contracts`, `utils` | Shared configuration, data-usage models, heal/scanner domain contracts, utilities, and checksums. |
 | I/O and storage | `concurrency`, `ecstore`, `filemeta`, `heal`, `io-core`, `io-metrics`, `lifecycle`, `lock`, `object-capacity`, `object-data-cache`, `replication`, `rio`, `rio-v2`, `s3-client`, `scanner`, `storage-api` | Erasure-coded object storage, metadata, recovery, lifecycle, replication, locking, cache, I/O pipelines, and the engine-side S3 client for remote tier/transition targets. |
 | Security and identity | `credentials`, `crypto`, `iam`, `keystone`, `kms`, `policy`, `security-governance`, `signer`, `tls-runtime`, `trusted-proxies` | Credentials, authentication, authorization, encryption, key management, TLS, and security contracts. |
 | Protocols and contracts | `extension-schema`, `madmin`, `protos`, `protocols`, `s3-ops`, `s3-types`, `s3select-api`, `s3select-query` | Admin, inter-node, S3, S3 Select, and optional protocol contracts. |
@@ -135,7 +135,7 @@ default build (lifecycle:
      `crates/ecstore/src/bucket/replication/replication_state.rs`) — a naming
      collision, not copies; renaming is tracked in rustfs/backlog#1847.
    - `LastMinuteLatency` has two deliberately different implementations: the
-     per-second bucketed accumulator in `crates/scanner-metrics/src/last_minute.rs` and
+     per-second bucketed accumulator in `crates/scanner-contracts/src/last_minute.rs` and
      the in-memory endpoint-health sample tracker in
      `crates/ecstore/src/bucket/bucket_target_sys.rs` (its doc comment explains
      why it stays local).

CHANGELOG.md

@@ -12,13 +12,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Per-pool erasure parity**: Erasure parity (STANDARD and reduced-redundancy) is now resolved independently for every pool instead of reusing the first pool's value. A heterogeneous topology — for example a 4-drive pool plus a 2-drive pool created during expansion — previously inherited the first pool's parity and could resolve to zero data shards in the smaller pool, panicking Reed-Solomon construction on write. Automatic parity now resolves per pool (for example `2+2` in the 4-drive pool and `1+1` in the 2-drive pool). Fixes #4801.
 
 ### Added
-- **On-Demand Migration**: Lazy, pull-style migration of an existing S3-compatible bucket into RustFS. A local bucket is attached to an external source bucket; a GET for a key that does not exist locally fetches it from the source, streams it to the client, and stores it locally in the same pass, so every later read is served locally. The module is on by default; set `RUSTFS_ON_DEMAND_MIGRATION_ENABLED=false` on every node to turn it off. A bucket with no source configured behaves exactly as before — the runtime never intervenes on its reads and makes no outbound call. Operator guide at `docs/operations/on-demand-migration.md`.
-  - Per-bucket configuration persisted as `on-demand-migration.json` in the bucket metadata: source provider (`s3`, `aws`, `minio`, `rustfs`, `r2`, `gcs`), endpoint, region, addressing style, credentials and TLS material, an optional key-prefix filter and source-prefix rewrite, and a policy block covering the inline size threshold, multipart part size, concurrency, queue capacity, timeouts, bandwidth limit and negative-cache TTL
-  - Admin routes under `/rustfs/admin/v3/on-demand-migration/{bucket}`: `PUT` (with `?dry-run=true` to validate and probe the source without saving), `GET`, `DELETE`, `GET .../status`, plus `POST .../backfill?op=start|cancel` and `GET .../backfill` for the background full-backfill job with its resumable checkpoint. Authorized by the new `admin:GetBucketOnDemandMigration` and `admin:SetBucketOnDemandMigration` actions; every response redacts `secret_key` and `session_token`
-  - Read paths: an object at or below `policy.inline_max_bytes` (16 MiB by default) is teed to the client and to the local store in a single source read; a larger object or a Range read streams through and a background pull stores the whole object. A HEAD miss is proxied to the source and stores nothing (`policy.head = local_only` disables it). Every source-backed response carries `x-rustfs-on-demand-migration: source`
-  - Protections: a per-source circuit breaker, a per-key negative cache, singleflight per key, a concurrency limit and a bounded pull queue shared by the inline and background paths, an optional bandwidth limit, an anti-loop request marker, and the shared outbound-endpoint (SSRF) policy
-  - Metrics under `rustfs_on_demand_migration_*` (`requests_total`, `pulled_bytes_total`, `pulled_objects_total`, `pull_failures_total`, `inflight_pulls`, `queue_depth`, `source_latency_seconds_*`, `breaker_state`), mirrored per node by the admin status route
-  - Limitations: listings show only local objects (the source is not merged into `ListObjectsV2`); PUT and DELETE never reach the source; a source object updated after it was pulled is not re-fetched; SSE-C source objects are unsupported and answer 424; `Last-Modified` on a pulled object is the local write time, with the source timestamp kept in metadata
 - **NATS JetStream Publish Path**: Opt-in at-least-once delivery for the NATS notify and audit targets. A NATS Core publish flushes to the connection without awaiting a broker acknowledgement, so an event can be lost across a broker restart or a reconnect after the send queue has already cleared it. A queued event now clears only after the JetStream `PublishAck`, so bucket notifications survive those interruptions. Off by default and byte-identical to the NATS Core path when disabled.
   - Three configuration keys per target: `JETSTREAM_ENABLE`, `JETSTREAM_STREAM_NAME`, and `JETSTREAM_ACK_TIMEOUT_SECS`, under the `RUSTFS_NOTIFY_NATS_` and `RUSTFS_AUDIT_NATS_` prefixes
   - Durable store-and-forward with a stable dedup id sent as the `Nats-Msg-Id` header, so a replay after a crash is collapsed by the server duplicate window

CLAUDE.md

@@ -15,7 +15,7 @@ cargo check -p <crate>               # fast type-check one crate
 cargo test -p <crate>                # test one crate
 cargo fmt --all                      # format (required before PR)
 make pre-commit                      # fast gate: fmt + arch checks + quick-check (NO clippy/tests)
-make pre-pr                          # optional full gate for broad cross-module changes
+make pre-pr                          # full pre-PR gate: fmt + arch checks + clippy + tests
 make build-docker BUILD_OS=ubuntu22.04
 ```
 
@@ -27,7 +27,6 @@ make build-docker BUILD_OS=ubuntu22.04
 
 ## Where to look (do not duplicate here)
 
-- Agent knowledge base index and doc-writing rules: [docs/architecture/README.md](docs/architecture/README.md)
 - Crate membership: `Cargo.toml` `[workspace].members`
 - Architecture, layering, crate map: [ARCHITECTURE.md](ARCHITECTURE.md)
 - Migration guardrails & readiness contracts: [docs/architecture/](docs/architecture/README.md)

CONTRIBUTING.md

@@ -62,20 +62,12 @@ make test
 # Fast pre-commit gate — see below for exactly what it runs
 make pre-commit
 
-# Optional full gate for broad cross-module changes (pre-commit + clippy + tests)
+# Full pre-PR gate (pre-commit gates + clippy + tests)
 make pre-pr
 ```
 
 > `make test` requires [cargo-nextest](https://nexte.st) (CI runs it and only nextest honours `.config/nextest.toml` test-groups). Install it with `cargo install cargo-nextest --locked` or a prebuilt binary (see https://nexte.st/docs/installation/). To run the plain `cargo test` fallback anyway (results not authoritative — serialization semantics differ from CI), set `RUSTFS_ALLOW_CARGO_TEST_FALLBACK=1`.
 
-> Some guard checks are Python (`test-wiring-check` in `make pre-commit`, plus the
-> security-coverage and scheduled-validation self-tests in `make test`) and import
-> `tomllib`, so they need **Python 3.11+**. Make resolves the interpreter through
-> `scripts/python_bin.sh`, which prefers a `python3.11`+ on `PATH` and otherwise falls
-> back to `uv run --python 3.12`. macOS ships `/usr/bin/python3` at 3.9, so install a
-> newer one (`brew install python@3.12`) or [uv](https://docs.astral.sh/uv/); pin a
-> specific interpreter with `RUSTFS_PYTHON=/path/to/python3.12`.
-
 > For the full test-layer taxonomy (unit / ecstore black-box / e2e / s3s-e2e / S3 compatibility / chaos / fuzz / bench), each layer's entry command, the naming conventions the migration gate depends on, and the serial/nextest rules, see [docs/testing/README.md](docs/testing/README.md).
 
 > For the event, timeout, required-status, and local reproduction matrix, see [docs/testing/ci-gates.md](docs/testing/ci-gates.md).
@@ -96,16 +88,14 @@ make pre-pr
 8. `quick-check` — `cargo check --workspace --exclude e2e_test`
 
 **`make pre-commit` does NOT run clippy and does NOT run any tests.**
-It does not replace the scoped Clippy and test checks applicable to a change.
+A green `make pre-commit` is not enough to open a pull request.
 
 `make pre-pr` is the **full** gate: it runs all of the guard checks above,
 then `clippy-check` (`cargo clippy --all-targets --all-features -- -D warnings`)
 and `test` (shell script tests, workspace tests excluding `e2e_test`, and doc
 tests). Complete the applicable multi-role adversarial review described in
-`AGENTS.md` first. Do not run `make pre-pr` locally by default before opening or
+`AGENTS.md` before running `make pre-pr`; then run the gate before opening or
-updating a pull request. Consider it only for a broad change that spans multiple
+updating a pull request. This is what CI enforces.
-modules and whose impact cannot be bounded by targeted checks; decide from the
-affected boundaries and risks. CI still runs its configured repository gates.
 
 ### 🔒 Git Pre-commit Hooks (optional)
 
@@ -124,9 +114,8 @@ Or manually:
 chmod +x .git/hooks/pre-commit
 ```
 
-With or without a hook, follow the verification tiers in `AGENTS.md`. Run the
+With or without a hook, the expectation is the same: run `make pre-commit`
-applicable scoped checks, and reserve `make pre-pr` for broad cross-module
+before committing and `make pre-pr` before opening a pull request.
-changes whose impact cannot be bounded by those checks.
 
 ### 📝 Formatting Configuration
 
@@ -165,9 +154,7 @@ Example output when formatting fails:
 3. **Run the fast gate**: `make pre-commit` (no clippy, no tests)
 4. **Commit your changes**: `git commit -m "your message"`
 5. **Complete the applicable multi-role adversarial review** for non-exempt changes (see `AGENTS.md`)
-6. **Run applicable scoped checks before opening/updating a PR**; consider
+6. **Run the full gate before opening/updating a PR**: `make pre-pr` (clippy + tests)
-   `make pre-pr` only for broad cross-module changes whose impact cannot be
-   bounded by targeted checks
 7. **Push to your branch**: `git push`
 
 ### 🛠️ IDE Integration

Cargo.toml

@@ -29,7 +29,6 @@ members = [
     "crates/heal-contracts", # Heal request/response channel contracts
     "crates/iam", # Identity and Access Management
     "crates/keystone", # OpenStack Keystone integration
-    "crates/license", # License and entitlement provider contracts
     "crates/lifecycle", # Lifecycle rule evaluation contracts
     "crates/kms", # Key Management Service
     "crates/lock", # Distributed locking implementation
@@ -52,7 +51,7 @@ members = [
     "crates/s3select-api", # S3 Select API interface
     "crates/s3select-query", # S3 Select query engine
     "crates/scanner", # Scanner for data integrity checks and health monitoring
-    "crates/scanner-metrics", # Scanner metrics and cycle telemetry
+    "crates/scanner-contracts", # Scanner metrics and cycle contracts
     "crates/security-governance", # Security governance contracts
     "crates/extension-schema", # Extension schema contracts
     "crates/signer", # client signer
@@ -72,8 +71,8 @@ resolver = "3"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
-rust-version = "1.98.0"
+rust-version = "1.97.1"
-version = "1.0.0-rc.5"
+version = "1.0.0-rc.4"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -90,62 +89,61 @@ redundant_clone = "warn"
 
 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-rc.5" }
+rustfs = { path = "./rustfs", version = "1.0.0-rc.4" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.5" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-rc.4" }
-rustfs-heal-contracts = { path = "crates/heal-contracts", version = "1.0.0-rc.5" }
+rustfs-heal-contracts = { path = "crates/heal-contracts", version = "1.0.0-rc.4" }
-rustfs-scanner-metrics = { path = "crates/scanner-metrics", version = "1.0.0-rc.5" }
+rustfs-scanner-contracts = { path = "crates/scanner-contracts", version = "1.0.0-rc.4" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.5" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-rc.4" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.5" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-rc.4" }
-rustfs-common = { path = "crates/common", version = "1.0.0-rc.5" }
+rustfs-common = { path = "crates/common", version = "1.0.0-rc.4" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.5" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-rc.4" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-rc.5" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-rc.4" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.5" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-rc.4" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.5" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-rc.4" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.5" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-rc.4" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.5" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-rc.4" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.5" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-rc.4" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.5" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-rc.4" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.5" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-rc.4" }
-rustfs-license = { path = "crates/license", version = "1.0.0-rc.5" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.4" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-rc.5" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.4" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-rc.5" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.4" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-rc.5" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.4" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-rc.5" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.4" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-rc.5" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.4" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-rc.5" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.4" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-rc.5" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.4" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-rc.5" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.4", default-features = false }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-rc.5", default-features = false }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.4" }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-rc.5" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.4" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-rc.5" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.4" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-rc.5" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.4" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-rc.5" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.4" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-rc.5" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.4" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-rc.5" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.4" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-rc.5" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.4" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-rc.5" }
+rustfs-s3-client = { path = "crates/s3-client", version = "1.0.0-rc.4" }
-rustfs-s3-client = { path = "crates/s3-client", version = "1.0.0-rc.5" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.4" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-rc.5" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.4" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-rc.5" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.4" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-rc.5" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.4" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-rc.5" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.4" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-rc.5" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.4" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-rc.5" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.4" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-rc.5" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.4" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-rc.5" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.4" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-rc.5" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.4" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-rc.5" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.4" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-rc.5" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.4" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-rc.5" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.4" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-rc.5" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.4" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-rc.5" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.4" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-rc.5" }
 
 # Async Runtime and Networking
 async-channel = "2.5.0"
 async_zip = { default-features = false, version = "0.0.19" }
-mysql_async = { default-features = false, version = "0.37.1" }
+mysql_async = { default-features = false, version = "0.37" }
-async-compression = { version = "0.4.44" }
+async-compression = { version = "0.4.43" }
 async-recursion = "1.1.1"
 async-trait = "0.1.92"
 async-nats = { version = "0.50.0", default-features = false }
@@ -157,7 +155,7 @@ futures-util = "0.3.34"
 pollster = "1.0.1"
 pulsar = { default-features = false, version = "6.9.0" }
 lapin = { default-features = false, version = "4.10.0" }
-hyper = { version = "1.11.1" }
+hyper = { version = "1.11.0" }
 hyper-rustls = { default-features = false, version = "0.27.9" }
 hyper-util = { version = "0.1.20" }
 http = "1.5.0"
@@ -165,10 +163,10 @@ http-body = "1.1.0"
 http-body-util = "0.1.5"
 minlz = "1.2.3"
 reqwest = "0.13.4"
-rustfs-kafka-async = { version = "1.3.1" }
+rustfs-kafka-async = { version = "1.2.0" }
 socket2 = { version = "0.6.5" }
 tokio = { version = "1.53.1" }
-tokio-rustls = { default-features = false, version = "0.26.5" }
+tokio-rustls = { default-features = false, version = "0.26.4" }
 tokio-stream = { version = "0.1.19" }
 tokio-test = "0.4.5"
 tokio-util = { version = "0.7.19" }
@@ -176,7 +174,7 @@ tonic = { version = "0.14.6" }
 tonic-prost = { version = "0.14.6" }
 tonic-prost-build = { version = "0.14.6" }
 tower = { version = "0.5.3" }
-tower-http = { version = "0.7.1" }
+tower-http = { version = "0.7.0" }
 
 # Serialization and Data Formats
 apache-avro = { version = "0.22.0", features = ["snappy", "zstandard"] }
@@ -200,7 +198,7 @@ serde_urlencoded = "0.7.1"
 # have incompatible APIs. Keep them exact-pinned and monitor upstream for stable
 # releases.
 aes-gcm = { version = "=0.11.1" }
-argon2 = { version = "=0.6.0" }
+argon2 = { version = "=0.6.0-rc.8" }
 blake2 = "=0.11.0"
 chacha20poly1305 = { version = "=0.11.0" }
 crc-fast = "1.10.0"
@@ -234,27 +232,22 @@ tokio-postgres-rustls = "0.14.0"
 # Utilities and Tools
 anyhow = "1.0.104"
 arc-swap = "1.9.2"
-# RUSTFS_COMPAT_TODO(tokio-tar-extension-limits): keep the fork pin while Snowball and Swift still depend on it. Remove after Snowball uses a released tar-codec/tar-framing API that exposes precedence-resolved MinIO vendor records, RustFS preserves cancellation-safe ownership of large streamed members, footerless minio-go input is accepted only at an authenticated complete request boundary, the existing resource-limit, cancellation, and error-fuse regressions pass, and Swift no longer needs this fork.
+astral-tokio-tar = "0.6.4"
-astral-tokio-tar = { git = "https://github.com/cxymds/tokio-tar.git", rev = "603756478b7668436e464519c77ccac22a99ba96" }
-# Candidate Snowball parser versions exercised by rustfs-zip compatibility fixtures.
-tar-codec = "0.0.14"
-tar-framing = "0.0.14"
 atoi = "3.1.0"
 atomic_enum = "0.3.0"
-aws-config = { version = "1.12.0" }
+aws-config = { version = "1.11.0" }
 aws-credential-types = { version = "1.3.0" }
-aws-sdk-kms = { default-features = false, version = "1.118.0" }
+aws-sdk-kms = { default-features = false, version = "1.117.0" }
-aws-sdk-s3 = { default-features = false, version = "1.145.0" }
+aws-sdk-s3 = { default-features = false, version = "1.144.0" }
-aws-sdk-sts = { default-features = false, version = "1.114.0" }
+aws-sdk-sts = { default-features = false, version = "1.113.0" }
-aws-smithy-async = { version = "1.3.0" }
 aws-smithy-http-client = { default-features = false, version = "1.4.0" }
-aws-smithy-runtime-api = { version = "1.16.0" }
+aws-smithy-runtime-api = { version = "1.15.0" }
-aws-smithy-types = { version = "1.6.3" }
+aws-smithy-types = { version = "1.6.2" }
 base64-simd = "0.8.0"
-brotli = "9.0.0"
+brotli = "8.0.4"
 clap = { version = "4.6.6" }
 const-str = { version = "1.1.0" }
-convert_case = "0.12.0"
+convert_case = "0.11.0"
 criterion = { version = "0.8" }
 crossbeam-queue = "0.3.13"
 crossbeam-channel = "0.5.16"
@@ -264,10 +257,10 @@ datafusion = { default-features = false, version = "55.0.0" }
 derive_builder = "0.20.2"
 enumset = "1.1.14"
 faster-hex = "0.10.0"
-flate2 = "1.1.10"
+flate2 = "1.1.9"
 glob = "0.3.4"
-google-cloud-storage = "1.18.0"
+google-cloud-storage = "1.17.0"
-google-cloud-auth = "1.16.0"
+google-cloud-auth = "1.15.0"
 hashbrown = { version = "0.17.1" }
 # Base32 for RFC 6238 TOTP shared secrets (RFC 4648 unpadded, the alphabet
 # every authenticator app expects). Already in the graph transitively.
@@ -289,7 +282,7 @@ mime_guess = "2.0.5"
 moka = { version = "0.12.16" }
 netif = "0.1.6"
 num_cpus = { version = "1.17.0" }
-nvml-wrapper = "0.13.0"
+nvml-wrapper = "0.12.1"
 parking_lot = "0.12.5"
 path-absolutize = "4.0.1"
 percent-encoding = "2.3.2"
@@ -302,7 +295,7 @@ pretty_assertions = "1.4.1"
 rand = { version = "0.10.2" }
 ratelimit = "2.0.0"
 rayon = "1.12.0"
-rustfs-erasure-codec = { version = "8.0.2" }
+reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.2" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
 rumqttc = { package = "rumqttc-next", version = "0.34.0" }
@@ -311,11 +304,11 @@ rustify = { version = "0.7", default-features = false }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
-s3s = { git = "https://github.com/rustfs/s3s.git", rev = "bdcb6259339c41369f9f1c60e3a42b5ab8da607b", version = "0.15.0", features = ["minio"] }
+s3s = { git = "https://github.com/rustfs/s3s.git", rev = "f4dedc905ec621fa85a4686df6304190b55375f6", version = "0.15.0", features = ["minio"] }
 serial_test = "4.0.1"
 shadow-rs = { default-features = false, version = "2.0.0" }
 siphasher = "1.0.3"
-smallvec = { version = "1.16.0" }
+smallvec = { version = "1.15.2" }
 compact_str = "0.10.0"
 snap = "1.1.2"
 starshard = { version = "2.3.0" }
@@ -334,7 +327,7 @@ tracing-subscriber = { version = "0.3.23" }
 transform-stream = "0.3.1"
 url = "2.5.8"
 urlencoding = "2.1.3"
-uuid = { version = "1.26.0" }
+uuid = { version = "1.25.0" }
 vaultrs = { version = "0.8.0" }
 tar = "0.4.46"
 walkdir = "2.5.0"
@@ -348,7 +341,7 @@ zstd = "0.13.3"
 # Observability and Metrics
 metrics = "0.24.6"
 metrics-util = "0.20"
-dial9-tokio-telemetry = "0.5.0"
+dial9-tokio-telemetry = "0.3"
 opentelemetry = { version = "0.32.0" }
 opentelemetry-appender-tracing = { version = "0.32.0" }
 opentelemetry-otlp = { version = "0.32.0" }
@@ -361,17 +354,17 @@ pyroscope = { version = "2.1.1" }
 # FTP and SFTP
 libunftp = { version = "0.23.0" }
 unftp-core = "0.1.0"
-suppaftp = { version = "11.0.0" }
+suppaftp = { version = "10.0.2" }
-rcgen = { version = "0.14.10", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
+rcgen = { version = "0.14.9", default-features = false, features = ["aws_lc_rs", "crypto", "pem"] }
-russh = { version = "0.63.2" }
+russh = { version = "0.63.1" }
 russh-sftp = "2.4.0"
 
 # WebDAV
 dav-server = "0.11.0"
 
 # Performance Analysis and Memory Profiling
-rustfs-mimalloc = { version = "0.5.3" }
+rustfs-mimalloc = { version = "0.5.1" }
-hotpath = { version = "0.25.0", default-features = false }
+hotpath = { version = "0.24.0", default-features = false }
 # Snapshot testing for output format regression detection
 insta = { version = "1.48" }
 

Makefile

@@ -23,12 +23,6 @@ SHELL := $(shell which bash)
 .SHELLFLAGS = -eu -o pipefail -c
 
 DOCKER_CLI ?= docker
-# Python interpreter for the repository's helper scripts. They import tomllib
-# (Python 3.11+), while macOS still ships /usr/bin/python3 at 3.9, so calls go
-# through a resolver that picks a new-enough interpreter (or falls back to uv).
-# Override with RUSTFS_PYTHON=/path/to/python3.12, or replace the resolver via
-# RUSTFS_PYTHON_BIN=<command>.
-RUSTFS_PYTHON_BIN ?= ./scripts/python_bin.sh
 IMAGE_NAME ?= rustfs:v1.0.0
 CONTAINER_NAME ?= rustfs-dev
 # Docker build configurations

README.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://docs.rustfs.com/en/installation">Getting Started</a>
+  <a href="https://docs.rustfs.com/installation/">Getting Started</a>
   · <a href="https://docs.rustfs.com/">Docs</a>
   · <a href="https://github.com/rustfs/rustfs/issues">Bug reports</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">Discussions</a>
@@ -48,33 +48,16 @@ Unlike other storage systems, RustFS is released under the permissible Apache 2.
 - **Open Source**: Licensed under Apache 2.0, encouraging unrestricted community contributions and commercial usage.
 - **User-Friendly**: Designed with simplicity in mind for easy deployment and management.
 
-Status legend: ✅ Available — shipped and covered by CI gates; 🧪 Preview — shipped behind an opt-in flag or with a bounded compatibility claim.
+| Feature                 | Status       | Feature                  | Status           |
-
+| :---------------------- | :----------- | :----------------------- | :--------------- |
-| Feature                          | Status       | Feature                            | Status       |
+| **S3 Core Features**    | ✅ Available | **Bitrot Protection**    | ✅ Available     |
-| :------------------------------- | :----------- | :--------------------------------- | :----------- |
+| **Upload / Download**   | ✅ Available | **Single Node Mode**     | ✅ Available     |
-| **S3 Core Features**             | ✅ Available | **Distributed Mode**               | ✅ Available |
+| **Versioning**          | ✅ Available | **Bucket Replication**   | ✅ Available     |
-| **Upload / Download**            | ✅ Available | **Single Node Mode**               | ✅ Available |
+| **Logging**             | ✅ Available | **Lifecycle Management** | 🚧 Under Testing |
-| **Versioning**                   | ✅ Available | **Bitrot Protection**              | ✅ Available |
+| **Event Notifications** | ✅ Available | **Distributed Mode**     | 🚧 Under Testing |
-| **Object Lock (WORM)**           | ✅ Available | **Healing & Scanner**              | ✅ Available |
+| **K8s Helm Charts**     | ✅ Available | **RustFS KMS**           | 🚧 Under Testing |
-| **Server-Side Encryption**       | ✅ Available | **Pool Expansion / Decommission**  | ✅ Available |
+| **Keystone Auth**       | ✅ Available | **Multi-Tenancy**        | ✅ Available     |
-| **RustFS KMS**                   | ✅ Available | **Bucket Replication**             | ✅ Available |
+| **Swift API**           | ✅ Available | **Swift Metadata Ops**   | 🚧 Partial       |
-| **Lifecycle Management (ILM)**   | ✅ Available | **Site Replication**               | ✅ Available |
-| **ILM Tiering (Remote S3)**      | ✅ Available | **Bucket Quota**                   | ✅ Available |
-| **S3 Select**                    | ✅ Available | **Event Notifications**            | ✅ Available |
-| **S3 Tables (Iceberg REST)**     | 🧪 Preview   | **Audit Logging**                  | ✅ Available |
-| **IAM / Policies**               | ✅ Available | **Logging & Observability**        | ✅ Available |
-| **OIDC / SSO**                   | ✅ Available | **Web Console**                    | ✅ Available |
-| **Keystone Auth**                | ✅ Available | **K8s Helm Charts**                | ✅ Available |
-| **Swift API**                    | ✅ Available | **FTPS / WebDAV**                  | ✅ Available |
-| **Multi-Tenancy**                | ✅ Available | **SFTP**                           | ✅ Available |
-| **MinIO On-Disk Compatibility**  | 🧪 Preview   |                                    |              |
-
-Notes:
-
-- **RustFS KMS**: Vault (KV2 / Transit) and AWS KMS backends are supported for production. The `Local` and `Static` backends are for development and testing only. See [KMS backend security properties](docs/operations/kms-backend-security.md).
-- **Swift API / SFTP**: opt-in cargo features (`--features swift`, `--features sftp`, or `full`). FTPS and WebDAV are enabled in the default build.
-- **S3 Tables**: ships as an Iceberg REST Catalog with automated PyIceberg and DuckDB coverage; other engines and vendor profiles carry bounded claims listed in the [S3 Tables support matrix](docs/architecture/s3-tables-support-matrix.md).
-- **MinIO On-Disk Compatibility**: gated behind the `rio-v2` feature and not part of the default build. Objects MinIO encrypted are not readable by RustFS. See [MinIO file-format interoperability](docs/architecture/minio-file-format-compat.md).
 
 ## RustFS vs MinIO Performance
 
@@ -132,7 +115,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.5
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.4
 ```
 
 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -262,26 +245,6 @@ nix build
 nix run
 ```
 
-The flake also exports a NixOS module and the RustFS `rc` client. Add the
-module to your system and provide credentials through runtime files (for
-example, sops-nix or agenix) so secrets are never stored in the Nix store:
-
-```nix
-imports = [ inputs.rustfs.nixosModules.rustfs ];
-
-services.rustfs = {
-  enable = true;
-  accessKeyFile = "/run/secrets/rustfs-access-key";
-  secretKeyFile = "/run/secrets/rustfs-secret-key";
-  volumes = [ "/var/lib/rustfs" ];
-};
-```
-
-Install the S3-compatible client with
-`nix profile install github:rustfs/rustfs#rustfs-client` (the executable is named
-`rc`), or use `inputs.rustfs.packages.${pkgs.system}.rustfs-client` in a system
-configuration.
-
 ### 6\. X-CMD (Option 6)
 
 If you are an [x-cmd](https://www.x-cmd.com/install/rustfs) user:

README_ZH.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://docs.rustfs.com/zh/installation">快速开始</a>
+  <a href="https://docs.rustfs.com/installation/">快速开始</a>
   · <a href="https://docs.rustfs.com/">文档</a>
   · <a href="https://github.com/rustfs/rustfs/issues">报告 Bug</a>
   · <a href="https://github.com/rustfs/rustfs/discussions">社区讨论</a>
@@ -112,7 +112,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest
 
 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.5
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-rc.4
 ```
 
 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -191,12 +191,6 @@ nix build
 nix run
 ```
 
-该 Flake 同时提供 NixOS 模块和 RustFS `rc` 客户端。将
-`inputs.rustfs.nixosModules.rustfs` 加入 `imports`，并通过运行时密钥文件
-（例如 sops-nix 或 agenix）配置 `accessKeyFile` 与 `secretKeyFile`，避免密钥
-进入 Nix store。客户端包为
-`inputs.rustfs.packages.${pkgs.system}.rustfs-client`，安装后的命令名为 `rc`。
-
 ### 6\. X-CMD (Option 6)
 
 如果你是 [x-cmd](https://www.x-cmd.com/install/rustfs) 用户：

crates/audit/Cargo.toml

@@ -68,6 +68,7 @@ tracing = { workspace = true, features = ["std", "attributes"] }
 
 [dev-dependencies]
 rustfs-targets = { workspace = true, features = ["test-support"] }
+async-trait = { workspace = true }
 temp-env = { workspace = true }
 url = { workspace = true }
 

crates/concurrency/src/workload.rs

@@ -178,76 +178,6 @@ pub trait WorkloadAdmissionSnapshotProvider {
     fn workload_admission_snapshot(&self) -> WorkloadAdmissionRegistrySnapshot;
 }
 
-/// Foreground workload pressure observed against a configured utilization threshold.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct ForegroundPressure {
-    /// Foreground workload class whose utilization reached its threshold.
-    pub class: WorkloadClass,
-    /// Observed utilization percentage for the class.
-    pub usage_pct: usize,
-    /// Configured threshold percentage that the observed utilization reached.
-    pub threshold_pct: usize,
-}
-
-impl ForegroundPressure {
-    /// Return a stable reason label for logs and metrics.
-    pub const fn reason(self) -> &'static str {
-        match self.class {
-            WorkloadClass::ForegroundRead => "foreground_read_pressure",
-            WorkloadClass::ForegroundWrite => "foreground_write_pressure",
-            _ => "foreground_pressure",
-        }
-    }
-}
-
-/// Return the strongest foreground pressure in `snapshot`, if any.
-///
-/// A zero threshold disables its class. `Saturated` counts as full utilization
-/// regardless of the reported limit; otherwise a class contributes only when it
-/// reports a non-zero limit, with a missing active count read as zero. When both
-/// classes are above their threshold the higher utilization wins.
-///
-/// Callers own the enable switch: this function evaluates thresholds only.
-pub fn foreground_pressure(
-    snapshot: &WorkloadAdmissionRegistrySnapshot,
-    read_threshold_pct: usize,
-    write_threshold_pct: usize,
-) -> Option<ForegroundPressure> {
-    [
-        (WorkloadClass::ForegroundRead, read_threshold_pct),
-        (WorkloadClass::ForegroundWrite, write_threshold_pct),
-    ]
-    .into_iter()
-    .filter_map(|(class, threshold_pct)| {
-        if threshold_pct == 0 {
-            return None;
-        }
-
-        let entry = snapshot.get(class)?;
-        let usage_pct = if matches!(entry.state, AdmissionState::Saturated) {
-            100
-        } else {
-            let limit = entry.limit?;
-            if limit == 0 {
-                return None;
-            }
-            entry
-                .active
-                .unwrap_or(0)
-                .saturating_mul(100)
-                .checked_div(limit)
-                .unwrap_or(100)
-        };
-
-        (usage_pct >= threshold_pct).then_some(ForegroundPressure {
-            class,
-            usage_pct,
-            threshold_pct,
-        })
-    })
-    .max_by_key(|pressure| pressure.usage_pct)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -384,205 +314,4 @@ mod tests {
 
         assert!(err.to_string().contains("unexpected"));
     }
-
-    fn counted(
-        class: WorkloadClass,
-        state: AdmissionState,
-        active: Option<usize>,
-        limit: Option<usize>,
-    ) -> WorkloadAdmissionSnapshot {
-        WorkloadAdmissionSnapshot::new(class, state).with_counts(active, None, limit)
-    }
-
-    fn registry(entries: Vec<WorkloadAdmissionSnapshot>) -> WorkloadAdmissionRegistrySnapshot {
-        WorkloadAdmissionRegistrySnapshot::new(entries)
-    }
-
-    #[test]
-    fn foreground_pressure_reason_labels_cover_non_foreground_classes() {
-        let read = ForegroundPressure {
-            class: WorkloadClass::ForegroundRead,
-            usage_pct: 90,
-            threshold_pct: 80,
-        };
-        let write = ForegroundPressure {
-            class: WorkloadClass::ForegroundWrite,
-            usage_pct: 90,
-            threshold_pct: 80,
-        };
-        let repair = ForegroundPressure {
-            class: WorkloadClass::Repair,
-            usage_pct: 90,
-            threshold_pct: 80,
-        };
-
-        assert_eq!(read.reason(), "foreground_read_pressure");
-        assert_eq!(write.reason(), "foreground_write_pressure");
-        assert_eq!(repair.reason(), "foreground_pressure");
-    }
-
-    #[test]
-    fn foreground_pressure_is_disabled_when_both_thresholds_are_zero() {
-        let snapshot = registry(vec![
-            counted(WorkloadClass::ForegroundRead, AdmissionState::Saturated, Some(8), Some(8)),
-            counted(WorkloadClass::ForegroundWrite, AdmissionState::Saturated, Some(8), Some(8)),
-        ]);
-
-        assert_eq!(foreground_pressure(&snapshot, 0, 0), None);
-    }
-
-    #[test]
-    fn foreground_pressure_skips_only_the_class_whose_threshold_is_zero() {
-        let snapshot = registry(vec![
-            counted(WorkloadClass::ForegroundRead, AdmissionState::Open, Some(10), Some(10)),
-            counted(WorkloadClass::ForegroundWrite, AdmissionState::Open, Some(9), Some(10)),
-        ]);
-
-        assert_eq!(
-            foreground_pressure(&snapshot, 0, 80),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundWrite,
-                usage_pct: 90,
-                threshold_pct: 80,
-            })
-        );
-        assert_eq!(
-            foreground_pressure(&snapshot, 80, 0),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundRead,
-                usage_pct: 100,
-                threshold_pct: 80,
-            })
-        );
-    }
-
-    #[test]
-    fn foreground_pressure_ignores_missing_entries() {
-        let snapshot = registry(vec![counted(WorkloadClass::Scanner, AdmissionState::Saturated, Some(8), Some(8))]);
-
-        assert_eq!(foreground_pressure(&snapshot, 1, 1), None);
-    }
-
-    #[test]
-    fn foreground_pressure_ignores_missing_and_zero_limits() {
-        let missing_limit = registry(vec![counted(
-            WorkloadClass::ForegroundRead,
-            AdmissionState::Throttled,
-            Some(8),
-            None,
-        )]);
-        let zero_limit = registry(vec![counted(
-            WorkloadClass::ForegroundWrite,
-            AdmissionState::Throttled,
-            Some(8),
-            Some(0),
-        )]);
-
-        assert_eq!(foreground_pressure(&missing_limit, 1, 1), None);
-        assert_eq!(foreground_pressure(&zero_limit, 1, 1), None);
-    }
-
-    #[test]
-    fn foreground_pressure_treats_saturated_as_full_without_reading_limit() {
-        let snapshot = registry(vec![
-            counted(WorkloadClass::ForegroundRead, AdmissionState::Saturated, None, None),
-            counted(WorkloadClass::ForegroundWrite, AdmissionState::Saturated, Some(0), Some(0)),
-        ]);
-
-        assert_eq!(
-            foreground_pressure(&snapshot, 100, 0),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundRead,
-                usage_pct: 100,
-                threshold_pct: 100,
-            })
-        );
-        assert_eq!(
-            foreground_pressure(&snapshot, 0, 100),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundWrite,
-                usage_pct: 100,
-                threshold_pct: 100,
-            })
-        );
-    }
-
-    #[test]
-    fn foreground_pressure_reads_missing_active_as_zero() {
-        let snapshot = registry(vec![counted(WorkloadClass::ForegroundRead, AdmissionState::Open, None, Some(8))]);
-
-        assert_eq!(foreground_pressure(&snapshot, 1, 1), None);
-    }
-
-    #[test]
-    fn foreground_pressure_returns_the_higher_utilization_when_both_classes_exceed() {
-        let read_higher = registry(vec![
-            counted(WorkloadClass::ForegroundRead, AdmissionState::Open, Some(19), Some(20)),
-            counted(WorkloadClass::ForegroundWrite, AdmissionState::Open, Some(17), Some(20)),
-        ]);
-        let write_higher = registry(vec![
-            counted(WorkloadClass::ForegroundRead, AdmissionState::Open, Some(17), Some(20)),
-            counted(WorkloadClass::ForegroundWrite, AdmissionState::Open, Some(19), Some(20)),
-        ]);
-
-        assert_eq!(
-            foreground_pressure(&read_higher, 80, 80),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundRead,
-                usage_pct: 95,
-                threshold_pct: 80,
-            })
-        );
-        assert_eq!(
-            foreground_pressure(&write_higher, 80, 80),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundWrite,
-                usage_pct: 95,
-                threshold_pct: 80,
-            })
-        );
-    }
-
-    #[test]
-    fn foreground_pressure_breaks_utilization_ties_toward_the_write_class() {
-        let snapshot = registry(vec![
-            counted(WorkloadClass::ForegroundRead, AdmissionState::Open, Some(18), Some(20)),
-            counted(WorkloadClass::ForegroundWrite, AdmissionState::Open, Some(18), Some(20)),
-        ]);
-
-        assert_eq!(
-            foreground_pressure(&snapshot, 80, 80),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundWrite,
-                usage_pct: 90,
-                threshold_pct: 80,
-            })
-        );
-    }
-
-    #[test]
-    fn foreground_pressure_triggers_exactly_at_the_threshold_and_not_below() {
-        let at_threshold = registry(vec![counted(
-            WorkloadClass::ForegroundRead,
-            AdmissionState::Open,
-            Some(8),
-            Some(10),
-        )]);
-        let below_threshold = registry(vec![counted(
-            WorkloadClass::ForegroundRead,
-            AdmissionState::Open,
-            Some(7),
-            Some(10),
-        )]);
-
-        assert_eq!(
-            foreground_pressure(&at_threshold, 80, 80),
-            Some(ForegroundPressure {
-                class: WorkloadClass::ForegroundRead,
-                usage_pct: 80,
-                threshold_pct: 80,
-            })
-        );
-        assert_eq!(foreground_pressure(&below_threshold, 80, 80), None);
-    }
 }

crates/config/src/constants/capacity.rs

@@ -59,20 +59,20 @@ pub const ENV_CAPACITY_MAX_TIMEOUT: &str = "RUSTFS_CAPACITY_MAX_TIMEOUT";
 // ============================================================================
 
 /// Scheduled update interval in seconds
-/// Default: 600 seconds (10 minutes)
+/// Default: 120 seconds (2 minutes)
-pub const DEFAULT_SCHEDULED_UPDATE_INTERVAL_SECS: u64 = 600;
+pub const DEFAULT_SCHEDULED_UPDATE_INTERVAL_SECS: u64 = 120;
 
 /// Write trigger delay in seconds
-/// Default: 30 seconds
+/// Default: 5 seconds
-pub const DEFAULT_WRITE_TRIGGER_DELAY_SECS: u64 = 30;
+pub const DEFAULT_WRITE_TRIGGER_DELAY_SECS: u64 = 5;
 
 /// Write frequency threshold (writes per minute)
-/// Default: 20 writes/minute
+/// Default: 5 writes/minute
-pub const DEFAULT_WRITE_FREQUENCY_THRESHOLD: usize = 20;
+pub const DEFAULT_WRITE_FREQUENCY_THRESHOLD: usize = 5;
 
 /// Fast update threshold in seconds
-/// Default: 120 seconds
+/// Default: 30 seconds
-pub const DEFAULT_FAST_UPDATE_THRESHOLD_SECS: u64 = 120;
+pub const DEFAULT_FAST_UPDATE_THRESHOLD_SECS: u64 = 30;
 
 /// Maximum files threshold for sampling
 /// Default: 200,000 files
@@ -129,16 +129,4 @@ mod tests {
         assert_eq!(ENV_CAPACITY_MIN_TIMEOUT, "RUSTFS_CAPACITY_MIN_TIMEOUT");
         assert_eq!(ENV_CAPACITY_MAX_TIMEOUT, "RUSTFS_CAPACITY_MAX_TIMEOUT");
     }
-
-    #[test]
-    fn test_capacity_default_values() {
-        assert_eq!(DEFAULT_SCHEDULED_UPDATE_INTERVAL_SECS, 600);
-        assert_eq!(DEFAULT_WRITE_TRIGGER_DELAY_SECS, 30);
-        assert_eq!(DEFAULT_WRITE_FREQUENCY_THRESHOLD, 20);
-        assert_eq!(DEFAULT_FAST_UPDATE_THRESHOLD_SECS, 120);
-        assert_eq!(DEFAULT_MAX_FILES_THRESHOLD, 200_000);
-        assert_eq!(DEFAULT_STAT_TIMEOUT_SECS, 3);
-        assert_eq!(DEFAULT_SAMPLE_RATE, 200);
-        assert_eq!(DEFAULT_CAPACITY_METRICS_INTERVAL_SECS, 600);
-    }
 }

crates/config/src/constants/health.rs

@@ -40,14 +40,6 @@ pub const HEALTH_OBJECT_PROGRESS_LOCK_MARGIN_MS: u64 = 5_000;
 pub const ENV_HEALTH_CLUSTER_TIMEOUT_MS: &str = "RUSTFS_HEALTH_CLUSTER_TIMEOUT_MS";
 pub const DEFAULT_HEALTH_CLUSTER_TIMEOUT_MS: u64 = 2000;
 
-/// Timeout for one remote lock-client online check used by readiness (milliseconds).
-///
-/// This is intentionally shorter than the generic lock RPC timeout so
-/// `/health/ready` can report degradation instead of riding a dead peer's
-/// connect or HTTP/2 keepalive budget.
-pub const ENV_HEALTH_LOCK_ONLINE_TIMEOUT_MS: &str = "RUSTFS_HEALTH_LOCK_ONLINE_TIMEOUT_MS";
-pub const DEFAULT_HEALTH_LOCK_ONLINE_TIMEOUT_MS: u64 = 1000;
-
 /// Maximum time to wait for local node runtime readiness (storage / IAM / lock
 /// quorum) during startup before failing fast (seconds).
 ///

crates/config/src/constants/object.rs

@@ -197,27 +197,6 @@ pub const DEFAULT_POOL_META_V3_FLEET_CONFIRMED: bool = false;
 const _: () = assert!(!DEFAULT_POOL_META_V3_WRITE);
 const _: () = assert!(!DEFAULT_POOL_META_V3_FLEET_CONFIRMED);
 
-/// Maximum unpacked size accepted for one Snowball archive member.
-///
-/// The value is expressed in bytes. Invalid values use the default, while
-/// valid values are clamped to [`MAX_SNOWBALL_ENTRY_BYTES`].
-pub const ENV_SNOWBALL_MAX_ENTRY_BYTES: &str = "RUSTFS_SNOWBALL_MAX_ENTRY_BYTES";
-pub const DEFAULT_SNOWBALL_MAX_ENTRY_BYTES: u64 = 1024 * 1024 * 1024;
-pub const MAX_SNOWBALL_ENTRY_BYTES: u64 = 1024 * DEFAULT_SNOWBALL_MAX_ENTRY_BYTES;
-
-/// Maximum cumulative unpacked object bytes accepted from one Snowball
-/// archive request.
-///
-/// This does not include tar headers or bounded PAX metadata. The value is
-/// expressed in bytes and is clamped to
-/// [`MAX_SNOWBALL_UNPACKED_BYTES`].
-pub const ENV_SNOWBALL_MAX_UNPACKED_BYTES: &str = "RUSTFS_SNOWBALL_MAX_UNPACKED_BYTES";
-pub const DEFAULT_SNOWBALL_MAX_UNPACKED_BYTES: u64 = 10 * 1024 * 1024 * 1024;
-pub const MAX_SNOWBALL_UNPACKED_BYTES: u64 = 10 * 1024 * DEFAULT_SNOWBALL_MAX_ENTRY_BYTES;
-
-const _: () = assert!(DEFAULT_SNOWBALL_MAX_ENTRY_BYTES <= MAX_SNOWBALL_ENTRY_BYTES);
-const _: () = assert!(DEFAULT_SNOWBALL_MAX_UNPACKED_BYTES <= MAX_SNOWBALL_UNPACKED_BYTES);
-
 // =============================================================================
 // Concurrent Request Fix - Timeout and Backpressure Configuration
 // =============================================================================
@@ -309,49 +288,6 @@ pub const DEFAULT_PUT_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS: u64 = 0;
 
 const _: () = assert!(!DEFAULT_PUT_FOREGROUND_ADMISSION_ENABLE);
 
-/// Enable automatic foreground admission for large or unknown-size PutObject requests.
-///
-/// Unlike the strict experimental gate above, this default-on path only applies
-/// to requests that are large enough to create sustained erasure/RPC pressure.
-/// Small PUTs continue on the legacy path unless the strict gate is explicitly
-/// enabled.
-pub const ENV_PUT_LARGE_FOREGROUND_ADMISSION_ENABLE: &str = "RUSTFS_PUT_LARGE_FOREGROUND_ADMISSION_ENABLE";
-pub const DEFAULT_PUT_LARGE_FOREGROUND_ADMISSION_ENABLE: bool = true;
-
-/// Maximum automatic foreground write requests admitted concurrently per process.
-///
-/// `0` derives a conservative default from the local disk-read scheduler cap,
-/// currently clamped to protect the commit path without making ordinary high
-/// throughput uploads single-file.
-pub const ENV_PUT_LARGE_FOREGROUND_ADMISSION_LIMIT: &str = "RUSTFS_PUT_LARGE_FOREGROUND_ADMISSION_LIMIT";
-pub const DEFAULT_PUT_LARGE_FOREGROUND_ADMISSION_LIMIT: usize = 0;
-
-/// Minimum direct PutObject size that enters automatic foreground write admission.
-///
-/// Requests with an unknown size are treated as large because the write pressure
-/// cannot be bounded from headers.
-pub const ENV_PUT_LARGE_FOREGROUND_ADMISSION_MIN_SIZE_BYTES: &str = "RUSTFS_PUT_LARGE_FOREGROUND_ADMISSION_MIN_SIZE_BYTES";
-pub const DEFAULT_PUT_LARGE_FOREGROUND_ADMISSION_MIN_SIZE_BYTES: usize = 32 * 1024 * 1024;
-
-/// Minimum UploadPart size that enters automatic foreground write admission.
-///
-/// Multipart pressure is often many moderate-sized parts rather than one very
-/// large request. The default gates every multipart part through the same permit
-/// pool as large/unknown-size PutObject while keeping small direct PUTs on the
-/// legacy path.
-pub const ENV_PUT_MULTIPART_FOREGROUND_ADMISSION_MIN_SIZE_BYTES: &str =
-    "RUSTFS_PUT_MULTIPART_FOREGROUND_ADMISSION_MIN_SIZE_BYTES";
-pub const DEFAULT_PUT_MULTIPART_FOREGROUND_ADMISSION_MIN_SIZE_BYTES: usize = 0;
-
-/// Time in milliseconds an automatic foreground write waits for a permit.
-///
-/// A short wait smooths transient bursts while still returning S3
-/// `SlowDown`/503 before body ingest when the node is already saturated.
-pub const ENV_PUT_LARGE_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS: &str = "RUSTFS_PUT_LARGE_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS";
-pub const DEFAULT_PUT_LARGE_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS: u64 = 250;
-
-const _: () = assert!(DEFAULT_PUT_LARGE_FOREGROUND_ADMISSION_ENABLE);
-
 /// Environment variable for minimum GetObject timeout in seconds.
 ///
 /// When dynamic timeout calculation is enabled, this is the minimum timeout
@@ -841,10 +777,4 @@ mod remote_version_state_tests {
         assert_eq!(super::ENV_POOL_META_V3_WRITE, "RUSTFS_POOL_META_V3_WRITE");
         assert_eq!(super::ENV_POOL_META_V3_FLEET_CONFIRMED, "RUSTFS_POOL_META_V3_FLEET_CONFIRMED");
     }
-
-    #[test]
-    fn snowball_limit_environment_names_are_stable() {
-        assert_eq!(super::ENV_SNOWBALL_MAX_ENTRY_BYTES, "RUSTFS_SNOWBALL_MAX_ENTRY_BYTES");
-        assert_eq!(super::ENV_SNOWBALL_MAX_UNPACKED_BYTES, "RUSTFS_SNOWBALL_MAX_UNPACKED_BYTES");
-    }
 }

crates/config/src/constants/scanner.rs

@@ -198,11 +198,11 @@ pub const ENV_SCANNER_IDLE_MODE: &str = "RUSTFS_SCANNER_IDLE_MODE";
 /// Environment variable that controls scanner cache save timeout in seconds.
 /// The scanner enforces a minimum value of `1`.
 /// - Unit: seconds (u64).
-/// - Example: `export RUSTFS_SCANNER_CACHE_SAVE_TIMEOUT_SECS=14`
+/// - Example: `export RUSTFS_SCANNER_CACHE_SAVE_TIMEOUT_SECS=30`
 pub const ENV_SCANNER_CACHE_SAVE_TIMEOUT_SECS: &str = "RUSTFS_SCANNER_CACHE_SAVE_TIMEOUT_SECS";
 
 /// Default scanner cache save timeout in seconds.
-pub const DEFAULT_SCANNER_CACHE_SAVE_TIMEOUT_SECS: u64 = 14;
+pub const DEFAULT_SCANNER_CACHE_SAVE_TIMEOUT_SECS: u64 = 30;
 
 /// Environment variable that caps concurrent scanner set tasks.
 /// A value of `0` keeps the existing topology-based concurrency.

crates/e2e_test/Cargo.toml

@@ -100,8 +100,7 @@ aws-sdk-s3 = { workspace = true, default-features = false, features = ["sigv4a",
 aws-sdk-sts = { workspace = true, default-features = false, features = ["default-https-client", "rt-tokio"] }
 aws-config = { workspace = true }
 aws-smithy-http-client = { workspace = true, default-features = false, features = ["rustls-aws-lc"] }
-aws-smithy-types.workspace = true
+async-compression = { workspace = true, features = ["tokio", "bzip2", "xz"] }
-async-compression = { workspace = true, features = ["tokio", "bzip2", "lz4", "xz"] }
 async-trait = { workspace = true }
 flate2.workspace = true
 http.workspace = true
@@ -115,7 +114,6 @@ rustfs-signer.workspace = true
 # server's implementation: a shared helper could agree with a bug on both sides.
 data-encoding = { workspace = true }
 hmac = { workspace = true }
-minlz.workspace = true
 sha1 = { workspace = true }
 serde_urlencoded = { workspace = true }
 tracing = { workspace = true }

crates/e2e_test/README.md

@@ -1,7 +1,7 @@
 # e2e_test
 
 End-to-end test suite for RustFS. Each test spawns a **real `rustfs` binary**
-(built and identified before the test invocation) and drives it over the network with the
+(built on demand from the workspace) and drives it over the network with the
 AWS SDK (`aws-sdk-s3`), raw HTTP (`reqwest` / `awscurl`), or a protocol client
 (FTPS / WebDAV / SFTP). This is the black-box integration layer: exhaustive
 end-to-end behavior lives here, unit behavior stays in the source crates
@@ -25,34 +25,38 @@ Registered in [`src/lib.rs`](src/lib.rs). Grouped by concern:
 | **policy** | [`src/policy/`](src/policy), `existing_object_tag_policy_test`, `bucket_policy_check_test`, `anonymous_access_test`, `security_boundary_test`, `multipart_auth_test` | IAM / bucket-policy / STS session policy, policy variables, anonymous access, DoS/SSRF boundaries. Own guide: [`src/policy/README.md`](src/policy/README.md) |
 | **protocols** | [`src/protocols/`](src/protocols) | FTPS, WebDAV, SFTP compliance. Fixed ports, own guide: [`src/protocols/README.md`](src/protocols/README.md) |
 | **reliant** | [`src/reliant/`](src/reliant) | Tests that reuse an **externally started** server (SQL/select, conditional writes, lifecycle, deleted-object reads, node-interact). Run via [`scripts/run_e2e_tests.sh`](../../scripts/run_e2e_tests.sh); see [`src/reliant/README.md`](src/reliant/README.md) |
-| **cluster** | `cluster_concurrency_test`, `stale_multipart_cleanup_cluster_test`, `namespace_lock_quorum_test`, `admin_timeout_regression_test`, `object_lambda_test`, `replication_extension_test`, `tier_stats_cluster_test` | Multi-node scenarios via `RustFSTestClusterEnvironment` |
+| **cluster** | `cluster_concurrency_test`, `stale_multipart_cleanup_cluster_test`, `namespace_lock_quorum_test`, `admin_timeout_regression_test`, `object_lambda_test`, `replication_extension_test` | Multi-node scenarios via `RustFSTestClusterEnvironment` |
 | **chaos / reliability** | [`src/chaos.rs`](src/chaos.rs), `reliability_disk_fault_test`, `heal_erasure_disk_rebuild_test`, `server_startup_failfast_test` | Disk offline/replace/corrupt, EC rebuild, heal, fail-fast startup |
 | **upgrade compatibility** | `upgrade_compatibility_test` | Pinned previous-release writes followed by current-build reads on the same data directory |
 
 ## How to run
 
-All commands assume repo root and Python 3.9 or newer on Linux or macOS. Build the server once through the provenance entry point, then run the test command through the same script:
+All commands assume repo root. `cargo test` triggers an on-demand build of the
+`rustfs` binary from [`src/common.rs`](src/common.rs) (`rustfs_binary_path`) on
+first use — the first invocation is slow, later ones reuse the binary.
 
 ```bash
-python3 scripts/e2e_binary.py build --features e2e-test-hooks
+# Whole crate (default = ignored tests skipped)
-
+cargo nextest run -p e2e_test
-# Whole crate (ignored tests remain skipped)
-python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run -p e2e_test
 
 # One module
-python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run -p e2e_test -E 'test(list_objects_v2_pagination_test)'
+cargo nextest run -p e2e_test -E 'test(list_objects_v2_pagination_test)'
+
+# PR smoke subset (see "CI smoke subset" below)
+cargo nextest run --profile e2e-smoke -p e2e_test
+
+# ILM serial lane — ignored lifecycle tests, single-threaded (mirrors CI)
+cargo nextest run -j1 --run-ignored ignored-only -p rustfs-scanner -p rustfs \
+  -E 'binary(lifecycle_integration_test) or (package(rustfs) and test(lifecycle_transition_api_test))'
 
-# PR smoke subset
-python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke -p e2e_test
 ```
 
-`build` records the source contents, HEAD, resolved Cargo features, profile, toolchain, and binary SHA-256 beside the executable in `rustfs.e2e.json`. `run` validates that identity before and after the command, preserves command failures, and removes its temporary run receipt on completion. The Rust harness checks that receipt before starting each server; it never compiles a server inside a test process. Source or binary changes during a run invalidate the result, even when the test command succeeds. Use an isolated worktree and keep it unchanged until the command finishes.
+The protocols suite has its own contract (fixed bind ports 9022–9301,
-
+single-worker execution, feature-gated scheduling) documented in
-The additional `--features` arguments must match between `build` and `run`; Cargo defaults remain enabled. The wrapper supplies `RUSTFS_BUILD_FEATURES` from Cargo's resolved feature list, including features enabled by `full`. Protocol helpers require a subset of that list. `CARGO_TARGET_DIR` and `--profile release` are supported. An in-workspace target directory must be Git-ignored; tracked files are always included in the source identity. `build --bins` preserves CI lanes that compile all RustFS binary targets. For a downloaded artifact, copy both the executable and its sidecar, then use `run`; do not generate a new identity for an arbitrary prebuilt binary. `CARGO_BIN_EXE_rustfs` cannot override the verified executable.
+[`src/protocols/README.md`](src/protocols/README.md). `RUSTFS_BUILD_FEATURES`
-
+selects which features the spawned binary is built with; leave it unset to run
-Each build/run holds an exclusive `rustfs.e2e.lock` marker beside the binary; concurrent wrappers fail immediately. Use a private target directory and do not run ordinary Cargo builds against it while tests are active: Cargo does not honor this marker. Interrupted runs fail and terminate their command group. After an uncatchable kill, inspect the PID recorded in a leftover marker and remove it only after confirming its owner has stopped. Embedded file symlinks are hashed through their target; embedded directory symlinks are rejected because their contents cannot be enumerated safely by this entry point.
+every protocol entry. Use the exact profile command under
-
+[Troubleshooting](#troubleshooting) for CI-equivalent execution.
-The protocols suite has its own fixed-port and single-worker contract in [`src/protocols/README.md`](src/protocols/README.md). Use its command under [Troubleshooting](#troubleshooting).
 
 ### `#[ignore]` semantics
 
@@ -118,7 +122,7 @@ via `create_s3_client(idx)` / `create_all_clients()`. See
 | `wait_for_server_ready` | Poll readiness before issuing requests |
 | `create_s3_client` / `create_test_bucket` / `delete_test_bucket` | aws-sdk-s3 client + bucket lifecycle |
 | `find_available_port` | Random free port (isolation primitive) |
-| `rustfs_binary_path` / `_with_features` | Verify this run's binary receipt and required feature subset |
+| `rustfs_binary_path` / `_with_features` | Locate/build the binary; honors `RUSTFS_BUILD_FEATURES` |
 | `requested_rustfs_build_features` / `rustfs_build_feature_enabled` | Feature-gate a test to what the binary was built with |
 | `execute_awscurl` / `awscurl_post` / `_get` / `_put` / `_delete` / `awscurl_post_sts_form_urlencoded` | Admin/STS API calls via `awscurl`; missing binaries are test failures |
 | `replication_fast_env` | Env vars that shrink replication timers (from repl-4); pass to `start_rustfs_server_with_env` |
@@ -165,7 +169,7 @@ the same profile for membership and execution with one nightly worker.
 | `s3s-e2e` black-box | `e2e-tests` + `e2e-tests-rio-v2` jobs | **Active** (external conformance tool) |
 | ILM / lifecycle (ignored) | `test-ilm-integration-serial` lane, `-j1` | **Active** (backlog#1148 ilm-1) |
 | KMS suite | `e2e-full` job, merge queue + main | **Active** |
-| Direct and mixed-version rolling upgrades from pinned previous release | `e2e-upgrade.yml`, storage-sensitive PRs + release tags + weekly | **Active** |
+| Direct upgrade from pinned previous release | `e2e-upgrade.yml`, storage-sensitive PRs + release tags + weekly | **Active** |
 | Cluster faults (`e2e-nightly` profile) | consolidated nightly workflow | **Active** (backlog#1149 ci-7) |
 | Protocols (FTPS/WebDAV/SFTP) | consolidated nightly workflow, serial | **Active** (backlog#1149 ci-7) |
 | Replication (fast subset) | `e2e-smoke` profile, `e2e-tests` job, every PR | **Active** (backlog#1147 repl-1) |
@@ -181,26 +185,32 @@ the wiring source of truth. Committed test-ID digests under
 **Reproduce a CI failure locally** — run the exact profile/lane:
 
 ```bash
-# Smoke, full, and cluster lanes share a server with fault-test hooks.
+# Smoke (e2e-tests job) — includes the 20 fast replication tests
-python3 scripts/e2e_binary.py build --features e2e-test-hooks
+cargo nextest run --profile e2e-smoke -p e2e_test
-python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-smoke -p e2e_test
+# Full single-node merge/main lane
-python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-full -p e2e_test
+cargo nextest run --profile e2e-full -p e2e_test
-python3 scripts/e2e_binary.py run --features e2e-test-hooks -- cargo nextest run --profile e2e-nightly -p e2e_test
+# Cluster fault nightly lane
-
+cargo nextest run --profile e2e-nightly -p e2e_test
-# Replication nightly uses the default server; awscurl is required for STS.
+# Replication nightly lane; awscurl is required for STS paths
-python3 scripts/e2e_binary.py build
+cargo nextest run --profile e2e-repl-nightly -p e2e_test
-python3 scripts/e2e_binary.py run -- cargo nextest run --profile e2e-repl-nightly -p e2e_test
+# Fixed-port protocol nightly lane
-
+RUSTFS_BUILD_FEATURES=ftps,webdav,sftp \
-# Protocol nightly owns fixed ports.
+  cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
-python3 scripts/e2e_binary.py build --features ftps,webdav,sftp
+# ILM serial lane
-python3 scripts/e2e_binary.py run --features ftps,webdav,sftp -- cargo nextest run -j 1 --profile e2e-protocols -p e2e_test --no-capture
-
-# The ILM serial lane does not use this server harness.
 cargo nextest run -j1 --run-ignored ignored-only -p rustfs-scanner -p rustfs \
   -E 'binary(lifecycle_integration_test) or (package(rustfs) and test(lifecycle_transition_api_test))'
+# s3s-e2e black box
+./scripts/e2e-run.sh ./target/debug/rustfs /tmp/rustfs-e2e-data
 ```
 
-**Stale or unverified binary.** Re-run the matching `build` command after changing source or features, then invoke tests through `run`. A missing receipt, copied old executable, or mismatched build identity is a prerequisite failure. Bare Cargo invocations that start a server deliberately fail; unit tests that do not start a server can still run directly.
+**Stale binary.** Tests build the `rustfs` binary once and reuse it. To avoid
+rebuilding while iterating on tests, `common.rs` reuses an existing binary when
+running *inside* the e2e test process even if sources changed
+(`can_reuse_inside_e2e`, [`src/common.rs`](src/common.rs) line 98). Downside: if
+you changed **server** code, force a rebuild with
+`cargo build -p rustfs` (or `touch` a source file outside the reuse window)
+before re-running, or CI's freshly built artifact will diverge from your local
+one.
 
 **Port already in use / orphan processes.** A hard-killed run can leak a
 `rustfs` child holding its port. Find and kill it:
@@ -223,8 +233,8 @@ spawn error. Install the pinned CI version before running their profiles.
   [`src/policy/README.md`](src/policy/README.md),
   [`src/protocols/README.md`](src/protocols/README.md),
   [`src/reliant/README.md`](src/reliant/README.md)
-- Per-module counts: `cargo nextest list -p e2e_test --profile <profile>`
+- Authoritative per-module counts:
-  (one-liner in [`docs/testing/README.md`](../../docs/testing/README.md))
+  [`docs/testing/e2e-suite-inventory.md`](../../docs/testing/e2e-suite-inventory.md)
 - Test pyramid & flake policy: [`docs/testing/README.md`](../../docs/testing/README.md)
 
 ## CI smoke subset (`--profile e2e-smoke`)
@@ -261,12 +271,12 @@ Note on `#[serial]`: nextest runs each test in its own process, so
 parallel-safe by construction (random port + isolated temp dir), which the
 current subset is.
 
-### Test inventory
+### Authoritative test inventory
 
-Per-module counts are not committed; list them with
+`docs/testing/e2e-suite-inventory.md` records the per-module test counts as
-`cargo nextest list -p e2e_test --profile <profile>` (the result is
+listed by `cargo nextest list -p e2e_test`. Regenerate it when adding or
-platform-dependent because some modules are linux-only; the `jq` one-liner is
+moving e2e tests so acceptance numbers in the test-strategy issues
-in `docs/testing/README.md`). When a profile membership change is
+(backlog#1147–#1155) stay auditable. When a profile membership change is
 intentional, review its JSON listing before updating the matching
 `.config/e2e-*-selection.txt` test-ID digest. Update only the platform that
 produced the listing:

crates/e2e_test/src/admin_auth_test.rs

@@ -31,9 +31,14 @@
 
 #[cfg(test)]
 mod tests {
-    use crate::common::{RustFSTestEnvironment, init_logging, rustfs_binary_path};
+    use crate::common::{RustFSTestEnvironment, init_logging, local_http_client, rustfs_binary_path};
-    use aws_sdk_s3::Client;
+    use aws_sdk_s3::config::{Credentials, Region};
     use aws_sdk_s3::error::ProvideErrorMetadata;
+    use aws_sdk_s3::{Client, Config};
+    use http::header::HOST;
+    use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+    use rustfs_signer::sign_v4;
+    use s3s::Body;
     use std::error::Error;
     use std::io::Read;
     use std::process::{Command, Stdio};
@@ -82,10 +87,10 @@ mod tests {
     }
 
     /// Send a SigV4-signed request to `path` (optionally with a JSON `body`) and
-    /// return `(status, body)`.
+    /// return `(status, body)`. Uses the `UNSIGNED_PAYLOAD` content hash so a
-    ///
+    /// request body can be attached without the caller pre-hashing it — the
-    /// Thin wrapper over [`crate::common::admin_request`], kept local so the
+    /// server verifies the signature against the same sentinel, exactly as the
-    /// call sites below keep their `Option<&str>` body shape.
+    /// AWS SDKs / MinIO client do for streaming/unsigned payloads.
     async fn signed_request(
         base_url: &str,
         method: http::Method,
@@ -94,13 +99,47 @@ mod tests {
         access_key: &str,
         secret_key: &str,
     ) -> Result<(reqwest::StatusCode, String), Box<dyn Error + Send + Sync>> {
-        crate::common::admin_request(base_url, method, path, body.map(str::to_string), access_key, secret_key).await
+        let url = format!("{base_url}{path}");
+        let uri = url.parse::<http::Uri>()?;
+        let authority = uri.authority().ok_or("missing authority")?.to_string();
+        let body_bytes = body.map(|b| b.as_bytes().to_vec()).unwrap_or_default();
+
+        // The signature is computed over `UNSIGNED_PAYLOAD`, so the body bytes do
+        // not participate in the SigV4 hash — sign over an empty body and attach
+        // the real payload to the wire request below.
+        let request = http::Request::builder()
+            .method(method.clone())
+            .uri(uri)
+            .header(HOST, authority)
+            .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+        let signed = sign_v4(request.body(Body::empty())?, 0, access_key, secret_key, "", "us-east-1");
+
+        let client = local_http_client();
+        let mut rb = client.request(method, url.as_str());
+        for (name, value) in signed.headers() {
+            rb = rb.header(name, value);
+        }
+        if !body_bytes.is_empty() {
+            rb = rb.body(body_bytes);
+        }
+        let resp = rb.send().await?;
+        let status = resp.status();
+        let text = resp.text().await?;
+        Ok((status, text))
     }
 
     /// Build an S3 client bound to explicit credentials (used to exercise the S3
     /// data plane with rotated / stale root credentials).
     fn s3_client_with(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str) -> Client {
-        env.create_s3_client_with_credentials(access_key, secret_key)
+        let credentials = Credentials::new(access_key, secret_key, None, None, "sec4-admin-auth");
+        let config = Config::builder()
+            .credentials_provider(credentials)
+            .region(Region::new("us-east-1"))
+            .endpoint_url(&env.url)
+            .force_path_style(true)
+            .behavior_version_latest()
+            .build();
+        Client::from_conf(config)
     }
 
     /// Create a non-admin IAM user via the admin `add-user` API using the root
@@ -112,7 +151,12 @@ mod tests {
         access_key: &str,
         secret_key: &str,
     ) -> Result<(), Box<dyn Error + Send + Sync>> {
-        crate::common::admin_create_user(env, access_key, secret_key).await
+        let path = format!("/rustfs/admin/v3/add-user?accessKey={access_key}");
+        let body = serde_json::json!({ "secretKey": secret_key, "status": "enabled" }).to_string();
+        let (status, resp) =
+            signed_request(&env.url, http::Method::PUT, &path, Some(&body), &env.access_key, &env.secret_key).await?;
+        assert!(status.is_success(), "add-user should succeed (status={status}, body={resp})");
+        Ok(())
     }
 
     /// A fully authenticated but non-admin credential must be rejected with

crates/e2e_test/src/admin_mfa_test.rs

@@ -59,8 +59,8 @@ mod tests {
 
     /// One signed admin request, returning the status and the raw body.
     ///
-    /// Thin wrapper over [`crate::common::admin_request`], kept local so the
+    /// Signs with `UNSIGNED_PAYLOAD` so the body does not participate in the
-    /// call sites below keep their `Option<&str>` body shape.
+    /// hash, matching how the other admin e2e tests drive these routes.
     async fn signed_request(
         base_url: &str,
         method: http::Method,
@@ -69,7 +69,30 @@ mod tests {
         access_key: &str,
         secret_key: &str,
     ) -> Result<(reqwest::StatusCode, String), Box<dyn Error + Send + Sync>> {
-        crate::common::admin_request(base_url, method, path, body.map(str::to_string), access_key, secret_key).await
+        let url = format!("{base_url}{path}");
+        let uri = url.parse::<http::Uri>()?;
+        let authority = uri.authority().ok_or("missing authority")?.to_string();
+        let body_bytes = body.map(|b| b.as_bytes().to_vec()).unwrap_or_default();
+
+        let request = http::Request::builder()
+            .method(method.clone())
+            .uri(uri)
+            .header(HOST, authority)
+            .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+        let signed = sign_v4(request.body(Body::empty())?, 0, access_key, secret_key, "", "us-east-1");
+
+        let client = local_http_client();
+        let mut builder = client.request(method, url.as_str());
+        for (name, value) in signed.headers() {
+            builder = builder.header(name, value);
+        }
+        if !body_bytes.is_empty() {
+            builder = builder.body(body_bytes);
+        }
+        let response = builder.send().await?;
+        let status = response.status();
+        let text = response.text().await?;
+        Ok((status, text))
     }
 
     /// A SigV4-signed `AssumeRole` form POST, optionally carrying a second factor.

crates/e2e_test/src/bucket_policy_check_test.rs

@@ -15,23 +15,39 @@
 //! Regression test for Issue #1423
 //! Verifies that Bucket Policies are honored for Authenticated Users.
 
-use crate::common::{AdminTransport, RustFSTestEnvironment, admin_create_user_via, init_logging};
+use crate::common::{RustFSTestEnvironment, init_logging};
-use aws_sdk_s3::Client;
+use aws_sdk_s3::config::{Credentials, Region};
 use aws_sdk_s3::error::ProvideErrorMetadata;
+use aws_sdk_s3::{Client, Config};
 use tracing::info;
 
-/// This suite deliberately drives the admin API through the external `awscurl`
-/// binary, so user creation pins `AdminTransport::Awscurl`.
 async fn create_user(
     env: &RustFSTestEnvironment,
     username: &str,
     password: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_create_user_via(AdminTransport::Awscurl, &env.url, &env.access_key, &env.secret_key, username, password).await
+    let create_user_body = serde_json::json!({
+        "secretKey": password,
+        "status": "enabled"
+    })
+    .to_string();
+
+    let create_user_url = format!("{}/rustfs/admin/v3/add-user?accessKey={}", env.url, username);
+    crate::common::awscurl_put(&create_user_url, &create_user_body, &env.access_key, &env.secret_key).await?;
+    Ok(())
 }
 
 fn create_user_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str) -> Client {
-    env.create_s3_client_with_credentials(access_key, secret_key)
+    let credentials = Credentials::new(access_key, secret_key, None, None, "test-user");
+    let config = Config::builder()
+        .credentials_provider(credentials)
+        .region(Region::new("us-east-1"))
+        .endpoint_url(&env.url)
+        .force_path_style(true)
+        .behavior_version_latest()
+        .build();
+
+    Client::from_conf(config)
 }
 
 #[tokio::test]

crates/e2e_test/src/checksum_upload_test.rs

@@ -22,10 +22,7 @@ mod tests {
     use aws_sdk_s3::config::{Credentials, Region, RequestChecksumCalculation};
     use aws_sdk_s3::error::ProvideErrorMetadata;
     use aws_sdk_s3::primitives::ByteStream;
-    use aws_sdk_s3::types::{
+    use aws_sdk_s3::types::{ChecksumAlgorithm, ChecksumMode, CompletedMultipartUpload, CompletedPart};
-        ChecksumAlgorithm, ChecksumMode, ChecksumType as SdkChecksumType, CompletedMultipartUpload, CompletedPart,
-        ServerSideEncryption,
-    };
     use aws_smithy_http_client::Builder as SmithyHttpClientBuilder;
     use md5::{Digest as Md5Digest, Md5};
     use rustfs_rio::{Checksum, ChecksumType as RioChecksumType};
@@ -263,117 +260,6 @@ mod tests {
         info!("PASSED: HeadObject returns stored SHA256 digest");
     }
 
-    #[tokio::test]
-    async fn test_head_object_returns_sse_s3_checksum() {
-        init_logging();
-
-        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
-        env.start_rustfs_server_with_env(
-            vec![],
-            &[
-                ("RUSTFS_SSE_S3_MASTER_KEY", "MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI="),
-                ("RUSTFS_CONSOLE_ENABLE", "false"),
-            ],
-        )
-        .await
-        .expect("Failed to start RustFS");
-
-        let client = create_s3_client(&env);
-        let bucket = "test-sse-s3-checksum-head";
-        create_bucket(&client, bucket).await.expect("Failed to create bucket");
-
-        let put = client
-            .put_object()
-            .bucket(bucket)
-            .key("encrypted.txt")
-            .body(ByteStream::from_static(b"encrypted checksum"))
-            .server_side_encryption(ServerSideEncryption::Aes256)
-            .checksum_algorithm(ChecksumAlgorithm::Crc32)
-            .send()
-            .await
-            .expect("SSE-S3 PutObject with CRC32 failed");
-        let expected = put.checksum_crc32().expect("PutObject must return CRC32");
-
-        let head = client
-            .head_object()
-            .bucket(bucket)
-            .key("encrypted.txt")
-            .checksum_mode(ChecksumMode::Enabled)
-            .send()
-            .await
-            .expect("SSE-S3 HeadObject failed");
-
-        assert_eq!(head.checksum_crc32(), Some(expected));
-
-        client
-            .copy_object()
-            .bucket(bucket)
-            .key("encrypted-copy.txt")
-            .copy_source(format!("{bucket}/encrypted.txt"))
-            .server_side_encryption(ServerSideEncryption::Aes256)
-            .send()
-            .await
-            .expect("SSE-S3 CopyObject failed");
-        let copy_head = client
-            .head_object()
-            .bucket(bucket)
-            .key("encrypted-copy.txt")
-            .checksum_mode(ChecksumMode::Enabled)
-            .send()
-            .await
-            .expect("SSE-S3 copied HeadObject failed");
-
-        assert_eq!(copy_head.checksum_crc32(), Some(expected));
-
-        let multipart_key = "encrypted-multipart.txt";
-        let create = client
-            .create_multipart_upload()
-            .bucket(bucket)
-            .key(multipart_key)
-            .server_side_encryption(ServerSideEncryption::Aes256)
-            .checksum_algorithm(ChecksumAlgorithm::Crc32)
-            .send()
-            .await
-            .expect("SSE-S3 CreateMultipartUpload with CRC32 failed");
-        let upload_id = create.upload_id().expect("CreateMultipartUpload must return an upload ID");
-        let part = client
-            .upload_part()
-            .bucket(bucket)
-            .key(multipart_key)
-            .upload_id(upload_id)
-            .part_number(1)
-            .body(ByteStream::from_static(b"encrypted multipart checksum"))
-            .checksum_algorithm(ChecksumAlgorithm::Crc32)
-            .send()
-            .await
-            .expect("SSE-S3 UploadPart with CRC32 failed");
-        let completed_part = CompletedPart::builder()
-            .part_number(1)
-            .e_tag(part.e_tag().expect("UploadPart must return an ETag"))
-            .checksum_crc32(part.checksum_crc32().expect("UploadPart must return CRC32"))
-            .build();
-        let complete = client
-            .complete_multipart_upload()
-            .bucket(bucket)
-            .key(multipart_key)
-            .upload_id(upload_id)
-            .multipart_upload(CompletedMultipartUpload::builder().parts(completed_part).build())
-            .send()
-            .await
-            .expect("SSE-S3 CompleteMultipartUpload with CRC32 failed");
-        let expected_multipart = complete.checksum_crc32().expect("CompleteMultipartUpload must return CRC32");
-        let multipart_head = client
-            .head_object()
-            .bucket(bucket)
-            .key(multipart_key)
-            .checksum_mode(ChecksumMode::Enabled)
-            .send()
-            .await
-            .expect("SSE-S3 multipart HeadObject failed");
-
-        assert_eq!(multipart_head.checksum_crc32(), Some(expected_multipart));
-    }
-
     /// Multipart upload with checksum: CreateMultipartUpload, UploadPart(s) with checksum_sha256, CompleteMultipartUpload; then GetObject verifies content.
     /// Uses part size >= 5MB (server minimum) for two parts.
     #[tokio::test]
@@ -599,222 +485,6 @@ mod tests {
             Some(full_checksum.as_str()),
             "Multipart object should report the same full-object CRC64NVME as direct upload"
         );
-        assert_eq!(
-            multipart_head.checksum_type(),
-            Some(&SdkChecksumType::FullObject),
-            "Multipart object with a full-object checksum must report FULL_OBJECT"
-        );
-    }
-
-    /// Create a CRC32 FULL_OBJECT multipart upload and upload every part, returning
-    /// the upload id and the `CompletedPart` list ready for CompleteMultipartUpload.
-    async fn start_full_object_crc32_upload(
-        client: &Client,
-        bucket: &str,
-        key: &str,
-        parts: &[&Vec<u8>],
-    ) -> (String, Vec<CompletedPart>) {
-        let create_result = client
-            .create_multipart_upload()
-            .bucket(bucket)
-            .key(key)
-            .checksum_algorithm(ChecksumAlgorithm::Crc32)
-            .checksum_type(SdkChecksumType::FullObject)
-            .send()
-            .await
-            .expect("Failed to create multipart upload");
-        let upload_id = create_result.upload_id().expect("No upload_id").to_string();
-
-        let mut completed_parts = Vec::new();
-        for (index, part) in parts.iter().enumerate() {
-            let part_number = index as i32 + 1;
-            let uploaded = client
-                .upload_part()
-                .bucket(bucket)
-                .key(key)
-                .upload_id(&upload_id)
-                .part_number(part_number)
-                .body(ByteStream::from((*part).clone()))
-                .checksum_algorithm(ChecksumAlgorithm::Crc32)
-                .send()
-                .await
-                .unwrap_or_else(|e| panic!("Failed to upload part {part_number}: {e:?}"));
-            completed_parts.push(
-                CompletedPart::builder()
-                    .part_number(part_number)
-                    .e_tag(uploaded.e_tag().expect("No etag for part"))
-                    .checksum_crc32(uploaded.checksum_crc32().expect("No CRC32 for part"))
-                    .build(),
-            );
-        }
-
-        (upload_id, completed_parts)
-    }
-
-    /// A multipart upload completed with a **full-object** checksum must report
-    /// `x-amz-checksum-type: FULL_OBJECT` on both GET and HEAD, the way AWS does.
-    ///
-    /// `complete_multipart_upload` used to persist the object-level checksum
-    /// record with the pre-merge checksum type, so the MULTIPART /
-    /// INCLUDES_MULTIPART flags never reached disk. `rustfs_rio::read_checksums`
-    /// only emits the FULL_OBJECT entry inside its MULTIPART branch, so these
-    /// objects came back from GET and HEAD with no checksum-type header at all.
-    /// Found while root-causing rustfs#6825.
-    #[tokio::test]
-    async fn test_full_object_multipart_reports_full_object_checksum_type() {
-        init_logging();
-        info!("TEST: full-object multipart upload round-trips x-amz-checksum-type: FULL_OBJECT");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
-        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
-
-        let client = create_s3_client(&env);
-        let bucket = "test-full-object-checksum-type";
-        create_bucket(&client, bucket).await.expect("Failed to create bucket");
-
-        const PART_SIZE: usize = 5 * 1024 * 1024;
-        let part1: Vec<u8> = (0..PART_SIZE).map(|i| (i % 241) as u8).collect();
-        let part2: Vec<u8> = (0..PART_SIZE).map(|i| ((i + 29) % 241) as u8).collect();
-        let content: Vec<u8> = part1.iter().chain(part2.iter()).copied().collect();
-
-        // CRC32 with an explicit FULL_OBJECT type: the object checksum is the
-        // CRC32 of the whole object, not the composite hash of the part digests.
-        let full_object_crc32 = Checksum::new_from_data(RioChecksumType::CRC32, &content)
-            .expect("crc32 checksum")
-            .encoded;
-
-        let key = "full-object-multipart.bin";
-        let (upload_id, completed_parts) = start_full_object_crc32_upload(&client, bucket, key, &[&part1, &part2]).await;
-
-        client
-            .complete_multipart_upload()
-            .bucket(bucket)
-            .key(key)
-            .upload_id(&upload_id)
-            .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed_parts)).build())
-            // Restate the full-object intent and value on CompleteMultipartUpload,
-            // exactly as an AWS SDK client does: `x-amz-checksum-type: FULL_OBJECT`
-            // plus `x-amz-checksum-crc32`, with no `x-amz-checksum-algorithm`
-            // header (CompleteMultipartUpload has no such member).
-            .checksum_type(SdkChecksumType::FullObject)
-            .checksum_crc32(full_object_crc32.clone())
-            .send()
-            .await
-            .expect("Failed to complete multipart upload");
-
-        let head = client
-            .head_object()
-            .bucket(bucket)
-            .key(key)
-            .checksum_mode(ChecksumMode::Enabled)
-            .send()
-            .await
-            .expect("Failed to head object");
-        assert_eq!(
-            head.checksum_type(),
-            Some(&SdkChecksumType::FullObject),
-            "HeadObject must report x-amz-checksum-type: FULL_OBJECT"
-        );
-        assert_eq!(
-            head.checksum_crc32(),
-            Some(full_object_crc32.as_str()),
-            "HeadObject must report the full-object CRC32, with no -<parts> suffix"
-        );
-
-        let get = client
-            .get_object()
-            .bucket(bucket)
-            .key(key)
-            .checksum_mode(ChecksumMode::Enabled)
-            .send()
-            .await
-            .expect("Failed to get object");
-        assert_eq!(
-            get.checksum_type(),
-            Some(&SdkChecksumType::FullObject),
-            "GetObject must report x-amz-checksum-type: FULL_OBJECT"
-        );
-        assert_eq!(
-            get.checksum_crc32(),
-            Some(full_object_crc32.as_str()),
-            "GetObject must report the full-object CRC32, with no -<parts> suffix"
-        );
-
-        let body = get.body.collect().await.expect("Failed to read body").into_bytes();
-        assert_eq!(body.as_ref(), content.as_slice(), "GetObject body must match the uploaded content");
-
-        info!("PASSED: full-object multipart reports FULL_OBJECT on GET and HEAD");
-    }
-
-    /// Declaring a checksum type on CompleteMultipartUpload that contradicts the
-    /// one recorded at CreateMultipartUpload must be rejected, and rejected as a
-    /// client error (4xx), not a server error.
-    #[tokio::test]
-    async fn test_complete_multipart_rejects_contradicting_checksum_type() {
-        init_logging();
-        info!("TEST: CompleteMultipartUpload rejects a checksum type that contradicts the upload");
-
-        let mut env = RustFSTestEnvironment::new().await.expect("Failed to create test environment");
-        env.start_rustfs_server(vec![]).await.expect("Failed to start RustFS");
-
-        let client = create_s3_client(&env);
-        let bucket = "test-checksum-type-mismatch";
-        create_bucket(&client, bucket).await.expect("Failed to create bucket");
-
-        const PART_SIZE: usize = 5 * 1024 * 1024;
-        let part1: Vec<u8> = (0..PART_SIZE).map(|i| (i % 239) as u8).collect();
-        let part2: Vec<u8> = (0..PART_SIZE).map(|i| ((i + 31) % 239) as u8).collect();
-        let content: Vec<u8> = part1.iter().chain(part2.iter()).copied().collect();
-        let full_object_crc32 = Checksum::new_from_data(RioChecksumType::CRC32, &content)
-            .expect("crc32 checksum")
-            .encoded;
-
-        let key = "checksum-type-mismatch.bin";
-        let (upload_id, completed_parts) = start_full_object_crc32_upload(&client, bucket, key, &[&part1, &part2]).await;
-
-        let err = client
-            .complete_multipart_upload()
-            .bucket(bucket)
-            .key(key)
-            .upload_id(&upload_id)
-            .multipart_upload(CompletedMultipartUpload::builder().set_parts(Some(completed_parts)).build())
-            // The upload was created as FULL_OBJECT; claiming COMPOSITE here
-            // contradicts it.
-            .checksum_type(SdkChecksumType::Composite)
-            .checksum_crc32(full_object_crc32.clone())
-            .send()
-            .await
-            .expect_err("COMPOSITE on a FULL_OBJECT upload must be rejected");
-
-        let service_err = err.into_service_error();
-        let code = service_err.meta().code().unwrap_or("<no code>").to_string();
-        let message = service_err.meta().message().unwrap_or_default().to_string();
-
-        // Before the fix the storage layer refused the combination with a generic
-        // error and the caller got `500 InternalError` -- "please try again" for a
-        // request that can only ever fail.
-        assert_eq!(
-            code, "InvalidRequest",
-            "a contradicting checksum type is a client error, got {code}: {message}"
-        );
-        assert!(
-            message.contains("FULL_OBJECT") && message.contains("COMPOSITE"),
-            "the message must name the recorded and requested types, got {message}"
-        );
-
-        // The upload is untouched by the rejected completion, so a well-formed
-        // retry on the same upload id still succeeds.
-        let listed = client
-            .list_parts()
-            .bucket(bucket)
-            .key(key)
-            .upload_id(&upload_id)
-            .send()
-            .await
-            .expect("upload must survive the rejected completion");
-        assert_eq!(listed.parts().len(), 2, "both parts must still be listed after the rejection");
-
-        info!("PASSED: contradicting checksum type rejected as InvalidRequest");
     }
 
     /// Integration test for the AWS 2026-04 additional checksum algorithms

crates/e2e_test/src/cluster_multidrive_pool_test.rs

@@ -27,10 +27,8 @@
 //! Readiness is established by the harness's `start()` handshake (TCP reachability
 //! plus an S3 `ListBuckets` poll) — there are no fixed sleeps.
 //!
-//! The volume-proxy smoke below also proves that the socket-level fault proxy
+//! Out of scope for this block (tracked separately): network fault injection
-//! can be installed before startup without changing the client-facing node URL.
+//! (toxiproxy / socket proxy) and 5GiB large-object budgets.
-//! A full lock-plane partition matrix and 5GiB large-object budget remain
-//! tracked separately.
 
 use crate::common::{ClusterTopology, RustFSTestClusterEnvironment};
 
@@ -78,28 +76,6 @@ async fn cluster_multidrive_single_pool_smoke() -> TestResult {
     Ok(())
 }
 
-/// 4 nodes x 4 drives, single pool: exercise the maximum local erasure layout
-/// supported by the cluster harness. This remains in the nightly lane because
-/// it starts four real server processes and sixteen data directories.
-#[tokio::test]
-async fn cluster_four_node_four_drive_single_pool_smoke() -> TestResult {
-    crate::common::init_logging();
-
-    let mut cluster = RustFSTestClusterEnvironment::with_topology(ClusterTopology::single_pool_multidrive(4, 4)).await?;
-
-    let volumes = cluster.rustfs_volumes_arg();
-    assert_eq!(volumes.split(' ').count(), 16, "expected 16 explicit endpoints, got: {volumes}");
-    assert!(!volumes.contains('{'), "single-pool layout must not use ellipses: {volumes}");
-    assert!(cluster.nodes.iter().all(|node| node.data_dirs.len() == 4));
-
-    cluster.start().await?;
-    cluster.create_test_bucket(BUCKET).await?;
-
-    let payload = vec![0x3Cu8; 1024 * 1024];
-    put_get_roundtrip(&cluster, "multidrive-4/object", &payload).await?;
-    Ok(())
-}
-
 /// Two single-node pools, 2 drives each: the multi-pool layout boots and
 /// round-trips. Every pool is a distinct erasure pool (`pool_idx` 0 and 1).
 #[tokio::test]
@@ -127,27 +103,3 @@ async fn cluster_two_pool_smoke() -> TestResult {
     put_get_roundtrip(&cluster, "twopool/object", &payload).await?;
     Ok(())
 }
-
-/// A real cluster smoke for the volume FaultProxy wiring. The proxy target is
-/// not listening yet when it is created; cluster startup must still converge
-/// once the target node starts, and peer disk/RPC traffic must traverse it.
-#[tokio::test]
-async fn cluster_volume_fault_proxy_pass_smoke() -> TestResult {
-    crate::common::init_logging();
-
-    let mut cluster = RustFSTestClusterEnvironment::with_topology(ClusterTopology::single_pool_multidrive(2, 2)).await?;
-    let proxy = cluster.start_volume_proxy_for_node(0).await?;
-    let proxied = proxy.local_addr().to_string();
-    assert!(cluster.rustfs_volumes_arg().contains(&proxied));
-
-    let result: TestResult = async {
-        cluster.start().await?;
-        cluster.create_test_bucket(BUCKET).await?;
-        let payload = vec![0x6Du8; 256 * 1024];
-        put_get_roundtrip(&cluster, "volume-proxy/object", &payload).await
-    }
-    .await;
-
-    proxy.shutdown().await;
-    result
-}

crates/e2e_test/src/common.rs

@@ -31,9 +31,9 @@ use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::sign_v4;
 use s3s::Body;
 use serde_json;
+use std::ffi::OsStr;
 use std::fs as stdfs;
 use std::io::ErrorKind;
-use std::net::SocketAddr;
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Once;
@@ -43,6 +43,7 @@ use tokio::net::TcpStream;
 use tokio::time::sleep;
 use tracing::{error, info, warn};
 use uuid::Uuid;
+use walkdir::WalkDir;
 
 // Common constants for all E2E tests
 pub const DEFAULT_ACCESS_KEY: &str = "rustfsadmin";
@@ -216,37 +217,7 @@ pub(crate) async fn signed_s3_request(
     access_key: &str,
     secret_key: &str,
 ) -> Result<reqwest::Response, Box<dyn std::error::Error + Send + Sync>> {
-    signed_s3_request_with_headers(method, url, body, content_type, access_key, secret_key, &http::HeaderMap::new()).await
+    signed_s3_request_with_session_token(method, url, body, content_type, access_key, secret_key, None).await
-}
-
-pub(crate) async fn signed_s3_request_with_headers(
-    method: http::Method,
-    url: &str,
-    body: Option<String>,
-    content_type: Option<&str>,
-    access_key: &str,
-    secret_key: &str,
-    extra_headers: &http::HeaderMap,
-) -> Result<reqwest::Response, Box<dyn std::error::Error + Send + Sync>> {
-    signed_s3_request_with_session_token(
-        method,
-        url,
-        body,
-        content_type,
-        SigningCredentials {
-            access_key,
-            secret_key,
-            session_token: None,
-        },
-        extra_headers,
-    )
-    .await
-}
-
-struct SigningCredentials<'a> {
-    access_key: &'a str,
-    secret_key: &'a str,
-    session_token: Option<&'a str>,
 }
 
 async fn signed_s3_request_with_session_token(
@@ -254,8 +225,9 @@ async fn signed_s3_request_with_session_token(
     url: &str,
     body: Option<String>,
     content_type: Option<&str>,
-    credentials: SigningCredentials<'_>,
+    access_key: &str,
-    extra_headers: &http::HeaderMap,
+    secret_key: &str,
+    session_token: Option<&str>,
 ) -> Result<reqwest::Response, Box<dyn std::error::Error + Send + Sync>> {
     let uri = url.parse::<http::Uri>()?;
     let authority = uri.authority().ok_or("S3 URL missing authority")?.to_string();
@@ -267,17 +239,14 @@ async fn signed_s3_request_with_session_token(
     if let Some(content_type) = content_type {
         request = request.header(CONTENT_TYPE, content_type);
     }
-    for (name, value) in extra_headers {
-        request = request.header(name, value);
-    }
 
     let content_length = i64::try_from(body.as_ref().map_or(0, String::len)).map_err(|_| "S3 request body is too large")?;
     let signed = sign_v4(
         request.body(Body::empty())?,
         content_length,
-        credentials.access_key,
+        access_key,
-        credentials.secret_key,
+        secret_key,
-        credentials.session_token.unwrap_or_default(),
+        session_token.unwrap_or_default(),
         "us-east-1",
     );
 
@@ -314,19 +283,8 @@ pub(crate) async fn admin_request_with_session_token(
 ) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
     let url = format!("{base_url}{path_and_query}");
     let content_type = body.as_ref().map(|_| "application/json");
-    let response = signed_s3_request_with_session_token(
+    let response =
-        method,
+        signed_s3_request_with_session_token(method, &url, body, content_type, access_key, secret_key, session_token).await?;
-        &url,
-        body,
-        content_type,
-        SigningCredentials {
-            access_key,
-            secret_key,
-            session_token,
-        },
-        &http::HeaderMap::new(),
-    )
-    .await?;
     let status = response.status();
     let body = response.text().await?;
     Ok((status, body))
@@ -363,75 +321,59 @@ fn resolve_rustfs_binary_path(workspace: &Path, configured_target_dir: Option<&P
     path
 }
 
-/// Resolve the server verified by `scripts/e2e_binary.py run` for this test invocation.
+/// Resolve the RustFS binary relative to the workspace, optionally requesting build features.
-/// Requested features are a required subset of the server's resolved Cargo features.
 pub fn rustfs_binary_path_with_features(requested_features: Option<&str>) -> PathBuf {
+    if let Some(path) = std::env::var_os("CARGO_BIN_EXE_rustfs") {
+        return PathBuf::from(path);
+    }
+    let requested_features = requested_features.and_then(normalize_rustfs_build_features);
+
     let workspace = workspace_root();
     let configured_target_dir = std::env::var_os("CARGO_TARGET_DIR").map(PathBuf::from);
-    let binary_path = std::env::var_os("CARGO_BIN_EXE_rustfs")
+    let binary_path = resolve_rustfs_binary_path(&workspace, configured_target_dir.as_deref());
-        .map(PathBuf::from)
+
-        .unwrap_or_else(|| resolve_rustfs_binary_path(&workspace, configured_target_dir.as_deref()));
+    let features_match = binary_features_match(&binary_path, requested_features.as_deref());
-    let receipt_path = std::env::var_os("RUSTFS_E2E_BINARY_RECEIPT").map(PathBuf::from);
+    let source_is_newer = workspace_sources_newer_than_binary(&binary_path);
-    receipt_path
+    let can_reuse_inside_e2e = running_inside_e2e_test_binary() && requested_features.is_none() && features_match;
-        .ok_or_else(|| std::io::Error::new(ErrorKind::NotFound, "missing E2E run receipt"))
+    if binary_path.is_file() && features_match && (!source_is_newer || can_reuse_inside_e2e) {
-        .and_then(|receipt| verify_e2e_binary_receipt(&receipt, &workspace, &binary_path, requested_features))
+        if source_is_newer {
-        .unwrap_or_else(|error| {
+            warn!(
-            panic!(
+                "RustFS binary at {:?} appears older than workspace sources; reusing it inside cargo test to avoid nested builds",
-                "E2E server prerequisite failed: {error}. Build with `python3 scripts/e2e_binary.py build --features <features>` and run tests with `python3 scripts/e2e_binary.py run --features <features> -- cargo nextest run ...`"
+                binary_path
-            )
+            );
-        })
+        }
+        info!("Using existing RustFS binary at {:?}", binary_path);
+        return binary_path;
+    }
+
+    info!("Building RustFS binary to ensure it's up to date...");
+    build_rustfs_binary(requested_features.as_deref(), &binary_path);
+
+    info!("Using RustFS binary at {:?}", binary_path);
+    binary_path
 }
 
-#[derive(serde::Deserialize)]
+fn workspace_sources_newer_than_binary(binary_path: &PathBuf) -> bool {
-#[serde(deny_unknown_fields)]
+    let Ok(binary_meta) = std::fs::metadata(binary_path) else {
-struct E2eBinaryReceipt {
+        return true;
-    schema: u32,
+    };
-    workspace: PathBuf,
+    let Ok(binary_modified) = binary_meta.modified() else {
-    binary: PathBuf,
+        return true;
-    size: u64,
+    };
-    modified_ns: u128,
+
-    features: Vec<String>,
+    let workspace = workspace_root();
+    let watch_roots = [
+        workspace.join("Cargo.toml"),
+        workspace.join("Cargo.lock"),
+        workspace.join("rustfs"),
+        workspace.join("crates"),
+    ];
+
+    watch_roots.iter().any(|path| path_is_newer_than(binary_modified, path))
 }
 
-fn verify_e2e_binary_receipt(
+fn running_inside_e2e_test_binary() -> bool {
-    receipt_path: &Path,
+    std::env::var("CARGO_PKG_NAME").is_ok_and(|value| value == "e2e_test")
-    workspace: &Path,
-    binary_path: &Path,
-    requested_features: Option<&str>,
-) -> std::io::Result<PathBuf> {
-    let receipt: E2eBinaryReceipt = serde_json::from_slice(&stdfs::read(receipt_path)?)?;
-    let binary = binary_path.canonicalize()?;
-    let metadata = binary.metadata()?;
-    let modified_ns = metadata
-        .modified()?
-        .duration_since(std::time::UNIX_EPOCH)
-        .map_err(std::io::Error::other)?
-        .as_nanos();
-    // The runner hashes source and binary before/after the entire suite. Each
-    // nextest process checks only this invocation's path, features, and file stat.
-    if receipt.schema != 1
-        || receipt.workspace != workspace.canonicalize()?
-        || receipt.binary != binary
-        || !metadata.is_file()
-        || receipt.size != metadata.len()
-        || receipt.modified_ns != modified_ns
-    {
-        return Err(std::io::Error::new(
-            ErrorKind::InvalidData,
-            "E2E server differs from this run's verified binary",
-        ));
-    }
-    if let Some(requested) = requested_features.and_then(normalize_rustfs_build_features)
-        && requested
-            .split(',')
-            .any(|feature| !receipt.features.iter().any(|actual| actual == feature))
-    {
-        return Err(std::io::Error::new(
-            ErrorKind::InvalidInput,
-            "E2E server is missing a requested build feature",
-        ));
-    }
-    Ok(binary)
 }
 
 pub fn requested_rustfs_build_features() -> Option<String> {
@@ -461,6 +403,96 @@ pub fn rustfs_build_feature_enabled(requested_features: Option<&str>, required_f
         .any(|feature| feature.eq_ignore_ascii_case(RUSTFS_FULL_FEATURE) || feature.eq_ignore_ascii_case(required_feature))
 }
 
+fn rustfs_binary_features_stamp_path(binary_path: &Path) -> PathBuf {
+    binary_path.with_extension("features")
+}
+
+fn binary_features_match(binary_path: &Path, requested_features: Option<&str>) -> bool {
+    let stamp_path = rustfs_binary_features_stamp_path(binary_path);
+    let recorded = stdfs::read_to_string(stamp_path)
+        .ok()
+        .and_then(|value| normalize_rustfs_build_features(&value));
+    let requested = requested_features.and_then(normalize_rustfs_build_features);
+
+    match requested.as_deref() {
+        Some(features) => recorded.as_deref() == Some(features),
+        None => recorded.is_none(),
+    }
+}
+
+fn path_is_newer_than(binary_modified: std::time::SystemTime, path: &Path) -> bool {
+    if path.is_file() {
+        return std::fs::metadata(path)
+            .and_then(|meta| meta.modified())
+            .map(|modified| modified > binary_modified)
+            .unwrap_or(false);
+    }
+
+    if !path.is_dir() {
+        return false;
+    }
+
+    WalkDir::new(path)
+        .into_iter()
+        .filter_entry(|entry| {
+            let name = entry.file_name();
+            name != OsStr::new("target") && name != OsStr::new(".git")
+        })
+        .filter_map(Result::ok)
+        .filter(|entry| entry.file_type().is_file())
+        .any(|entry| {
+            std::fs::metadata(entry.path())
+                .and_then(|meta| meta.modified())
+                .map(|modified| modified > binary_modified)
+                .unwrap_or(false)
+        })
+}
+
+/// Build the RustFS binary using cargo
+fn build_rustfs_binary(requested_features: Option<&str>, binary_path: &Path) {
+    let workspace = workspace_root();
+    info!("Building RustFS binary from workspace: {:?}", workspace);
+
+    let _profile = if cfg!(debug_assertions) {
+        info!("Building in debug mode");
+        "dev"
+    } else {
+        info!("Building in release mode");
+        "release"
+    };
+
+    let mut cmd = Command::new("cargo");
+    cmd.current_dir(&workspace).args(["build", "--bin", "rustfs"]);
+
+    if let Some(features) = requested_features {
+        cmd.arg("--features").arg(features);
+        info!("Building with features: {}", features);
+    }
+
+    if !cfg!(debug_assertions) {
+        cmd.arg("--release");
+    }
+
+    info!(
+        "Executing: cargo build --bin rustfs {}",
+        if cfg!(debug_assertions) { "" } else { "--release" }
+    );
+
+    let output = cmd.output().expect("Failed to execute cargo build command");
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        panic!("Failed to build RustFS binary. Error: {stderr}");
+    }
+
+    let stamp_path = rustfs_binary_features_stamp_path(binary_path);
+    if let Err(err) = stdfs::write(&stamp_path, requested_features.unwrap_or_default()) {
+        warn!("Failed to write RustFS feature stamp {:?}: {}", stamp_path, err);
+    }
+
+    info!("✅ RustFS binary built successfully");
+}
+
 fn awscurl_binary_path() -> PathBuf {
     std::env::var_os("AWSCURL_PATH")
         .map(PathBuf::from)
@@ -1139,9 +1171,6 @@ pub struct RustFSTestClusterEnvironment {
     pub node_extra_env: Vec<Vec<(String, String)>>,
     pub node_capture_log_paths: Vec<Option<String>>,
     pub topology: ClusterTopology,
-    /// Optional socket proxies used for the corresponding node's volume
-    /// endpoints. Proxies must be installed before [`Self::start`].
-    volume_proxy_addresses: Vec<Option<SocketAddr>>,
 }
 
 impl RustFSTestClusterEnvironment {
@@ -1233,7 +1262,6 @@ impl RustFSTestClusterEnvironment {
             extra_env.push(("RUSTFS_UNSAFE_BYPASS_DISK_CHECK".to_string(), "true".to_string()));
         }
 
-        let node_count = topology.node_count;
         Ok(Self {
             nodes,
             temp_dir,
@@ -1243,7 +1271,6 @@ impl RustFSTestClusterEnvironment {
             node_extra_env: vec![Vec::new(); topology.node_count],
             node_capture_log_paths: vec![None; topology.node_count],
             topology,
-            volume_proxy_addresses: vec![None; node_count],
         })
     }
 
@@ -1311,34 +1338,6 @@ impl RustFSTestClusterEnvironment {
         self.build_volumes_arg()
     }
 
-    /// Start a socket proxy for one node's volume endpoints and route all
-    /// subsequent `RUSTFS_VOLUMES` references for that node through it.
-    ///
-    /// Call this before [`Self::start`], then use the returned proxy's
-    /// [`crate::fault_proxy::FaultProxy::set_mode`] to inject latency,
-    /// blackhole, or one-way partition faults. The node's own listen address
-    /// remains direct, so S3 clients can still reach it while peer disk/RPC
-    /// traffic is steered through the proxy.
-    pub async fn start_volume_proxy_for_node(
-        &mut self,
-        node_idx: usize,
-    ) -> Result<crate::fault_proxy::FaultProxy, Box<dyn std::error::Error + Send + Sync>> {
-        self.ensure_node_index(node_idx)?;
-        if self.volume_proxy_addresses[node_idx].is_some() {
-            return Err(format!("a volume proxy is already configured for node {node_idx}").into());
-        }
-        let target = self.nodes[node_idx].address.parse::<SocketAddr>()?;
-        let proxy = crate::fault_proxy::FaultProxy::start(target).await?;
-        self.volume_proxy_addresses[node_idx] = Some(proxy.local_addr());
-        Ok(proxy)
-    }
-
-    fn volume_address(&self, node_idx: usize) -> String {
-        self.volume_proxy_addresses[node_idx]
-            .map(|address| address.to_string())
-            .unwrap_or_else(|| self.nodes[node_idx].address.clone())
-    }
-
     fn build_volumes_arg(&self) -> String {
         let pools = self.topology.normalized_pools();
 
@@ -1347,11 +1346,7 @@ impl RustFSTestClusterEnvironment {
             return self
                 .nodes
                 .iter()
-                .enumerate()
+                .flat_map(|n| n.data_dirs.iter().map(move |dir| format!("http://{}{}", n.address, dir)))
-                .flat_map(|(node_idx, n)| {
-                    let address = self.volume_address(node_idx);
-                    n.data_dirs.iter().map(move |dir| format!("http://{}{}", address, dir))
-                })
                 .collect::<Vec<_>>()
                 .join(" ");
         }
@@ -1362,19 +1357,13 @@ impl RustFSTestClusterEnvironment {
         pools
             .iter()
             .map(|nodes| {
-                let node_idx = nodes[0];
+                let node = &self.nodes[nodes[0]];
-                let node = &self.nodes[node_idx];
                 let base = node
                     .data_dirs
                     .first()
                     .and_then(|d| d.rsplit_once('/').map(|(parent, _)| parent))
                     .unwrap_or(&node.data_dir);
-                format!(
+                format!("http://{}{}/drive{{0...{}}}", node.address, base, self.topology.drives_per_node - 1)
-                    "http://{}{}/drive{{0...{}}}",
-                    self.volume_address(node_idx),
-                    base,
-                    self.topology.drives_per_node - 1
-                )
             })
             .collect::<Vec<_>>()
             .join(" ")
@@ -1393,18 +1382,31 @@ impl RustFSTestClusterEnvironment {
     ///   times out, or cluster service readiness times out.
     pub async fn start(&mut self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         let binary_path = rustfs_binary_path();
-        self.start_with_binary(&binary_path).await
-    }
-
-    /// Start every cluster node with a specific RustFS binary.
-    ///
-    /// Upgrade compatibility tests use this to initialize a cluster with a
-    /// pinned previous release before replacing nodes with the workspace build.
-    pub async fn start_with_binary(&mut self, binary_path: &Path) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         let volumes_arg = self.build_volumes_arg();
 
-        for node_idx in 0..self.nodes.len() {
+        for (i, node) in self.nodes.iter_mut().enumerate() {
-            self.spawn_node(node_idx, binary_path, &volumes_arg)?;
+            info!("Starting cluster node {} on {}", i, node.address);
+
+            let mut command = Command::new(&binary_path);
+            command
+                .env("RUSTFS_VOLUMES", &volumes_arg)
+                .env("RUSTFS_ADDRESS", &node.address)
+                .env("RUSTFS_ACCESS_KEY", &self.access_key)
+                .env("RUSTFS_SECRET_KEY", &self.secret_key)
+                .env("RUSTFS_CONSOLE_ENABLE", "false")
+                .env("RUST_LOG", "rustfs=info,rustfs_notify=debug");
+
+            for (key, value) in &self.extra_env {
+                command.env(key, value);
+            }
+            for (key, value) in &self.node_extra_env[i] {
+                command.env(key, value);
+            }
+            capture_command_logs(&mut command, self.node_capture_log_paths[i].as_deref())?;
+
+            let process = command.current_dir(&node.data_dir).spawn()?;
+
+            node.process = Some(process);
         }
 
         for (i, node) in self.nodes.iter().enumerate() {
@@ -1420,46 +1422,20 @@ impl RustFSTestClusterEnvironment {
 
     /// Start one node process using the cluster's existing volume layout.
     pub async fn start_node(&mut self, node_idx: usize) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        let binary_path = rustfs_binary_path();
-        self.start_node_from_binary(node_idx, &binary_path).await
-    }
-
-    /// Start one stopped cluster node with a specific RustFS binary while
-    /// preserving the cluster's volume layout and that node's data directory.
-    pub async fn start_node_from_binary(
-        &mut self,
-        node_idx: usize,
-        binary_path: &Path,
-    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        let volumes_arg = self.build_volumes_arg();
-        self.spawn_node(node_idx, binary_path, &volumes_arg)?;
-
-        self.wait_for_node_ready(&self.nodes[node_idx].address, node_idx).await?;
-        self.wait_for_node_service_ready(node_idx).await?;
-        Ok(())
-    }
-
-    fn spawn_node(
-        &mut self,
-        node_idx: usize,
-        binary_path: &Path,
-        volumes_arg: &str,
-    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         self.ensure_node_index(node_idx)?;
         if self.nodes[node_idx].process.is_some() {
             return Err(format!("cluster node {node_idx} is already running").into());
         }
-        if !binary_path.is_file() {
-            return Err(format!("RustFS binary does not exist: {}", binary_path.display()).into());
-        }
 
+        let binary_path = rustfs_binary_path();
+        let volumes_arg = self.build_volumes_arg();
         let log_path = self.node_capture_log_paths[node_idx].clone();
         let node = &mut self.nodes[node_idx];
-        info!("Starting cluster node {} on {} with {}", node_idx, node.address, binary_path.display());
+        info!("Starting cluster node {} on {}", node_idx, node.address);
 
-        let mut command = Command::new(binary_path);
+        let mut command = Command::new(&binary_path);
         command
-            .env("RUSTFS_VOLUMES", volumes_arg)
+            .env("RUSTFS_VOLUMES", &volumes_arg)
             .env("RUSTFS_ADDRESS", &node.address)
             .env("RUSTFS_ACCESS_KEY", &self.access_key)
             .env("RUSTFS_SECRET_KEY", &self.secret_key)
@@ -1476,6 +1452,9 @@ impl RustFSTestClusterEnvironment {
 
         let process = command.current_dir(&node.data_dir).spawn()?;
         node.process = Some(process);
+
+        self.wait_for_node_ready(&self.nodes[node_idx].address, node_idx).await?;
+        self.wait_for_node_service_ready(node_idx).await?;
         Ok(())
     }
 
@@ -1623,51 +1602,6 @@ impl RustFSTestClusterEnvironment {
         process.wait()?;
         Ok(())
     }
-
-    /// Gracefully stop one cluster node and wait for its process to exit.
-    ///
-    /// This is intentionally separate from [`Self::stop_node`]: the latter is
-    /// a hard kill used by crash-recovery tests, while this path lets RustFS
-    /// complete its normal shutdown hooks before a test restarts the node.
-    pub async fn stop_node_gracefully(&mut self, node_idx: usize) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-        self.ensure_node_index(node_idx)?;
-
-        #[cfg(unix)]
-        {
-            let Some(process) = self.nodes[node_idx].process.as_ref() else {
-                return Ok(());
-            };
-            let pid = process.id().to_string();
-            let signal_status = Command::new("kill").args(["-TERM", &pid]).status()?;
-            if !signal_status.success() {
-                return Err(format!("failed to send SIGTERM to cluster node {node_idx} (pid {pid})").into());
-            }
-
-            let mut process = self.nodes[node_idx]
-                .process
-                .take()
-                .ok_or_else(|| format!("cluster node {node_idx} process disappeared while stopping"))?;
-            let deadline = std::time::Instant::now() + Duration::from_secs(45);
-            loop {
-                if let Some(status) = process.try_wait()? {
-                    info!("Cluster node {} stopped gracefully with {}", node_idx, status);
-                    return Ok(());
-                }
-                if std::time::Instant::now() >= deadline {
-                    let _ = process.kill();
-                    let _ = process.wait();
-                    return Err(format!("cluster node {node_idx} did not stop gracefully within 45 seconds").into());
-                }
-                sleep(Duration::from_millis(100)).await;
-            }
-        }
-
-        #[cfg(not(unix))]
-        {
-            let _ = node_idx;
-            Err("graceful cluster-node stop is only supported on Unix E2E hosts".into())
-        }
-    }
 }
 
 impl Drop for RustFSTestClusterEnvironment {
@@ -1810,128 +1744,30 @@ pub(crate) async fn admin_create_user(
     username: &str,
     secret_key: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_create_user_via(AdminTransport::Signed, &env.url, &env.access_key, &env.secret_key, username, secret_key).await
+    let url = format!("{}/rustfs/admin/v3/add-user?accessKey={}", env.url, username);
-}
+    let body = serde_json::json!({
+        "secretKey": secret_key,
+        "status": "enabled"
+    });
+    let response = signed_request(
+        http::Method::PUT,
+        &url,
+        &env.access_key,
+        &env.secret_key,
+        Some(body.to_string().into_bytes()),
+        Some("application/json"),
+    )
+    .await?;
 
-/// Transport used by the shared admin-API helpers: in-process SigV4 signing
+    if response.status() != reqwest::StatusCode::OK {
-/// via [`signed_request`], or the external `awscurl` binary (an independent
+        let status = response.status();
-/// SigV4 implementation exercised by the awscurl-gated suites).
+        let body = response.text().await.unwrap_or_default();
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+        return Err(format!("create user failed: {status} {body}").into());
-pub(crate) enum AdminTransport {
-    Signed,
-    Awscurl,
-}
-
-/// Execute an admin-API request against `base_url` with admin credentials over
-/// the chosen transport, failing on any non-success response.
-pub(crate) async fn admin_execute_at(
-    transport: AdminTransport,
-    method: http::Method,
-    base_url: &str,
-    admin_access_key: &str,
-    admin_secret_key: &str,
-    path_and_query: &str,
-    body: Option<&str>,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let url = format!("{base_url}{path_and_query}");
-    match transport {
-        AdminTransport::Signed => {
-            let content_type = match body {
-                Some(body) if !body.is_empty() => Some("application/json"),
-                _ => None,
-            };
-            let response = signed_request(
-                method.clone(),
-                &url,
-                admin_access_key,
-                admin_secret_key,
-                body.map(|body| body.as_bytes().to_vec()),
-                content_type,
-            )
-            .await?;
-            if !response.status().is_success() {
-                let status = response.status();
-                let text = response.text().await.unwrap_or_default();
-                return Err(format!("{method} {path_and_query} failed: {status} {text}").into());
-            }
-        }
-        AdminTransport::Awscurl => {
-            execute_awscurl(&url, method.as_str(), body, admin_access_key, admin_secret_key).await?;
-        }
     }
+
     Ok(())
 }
 
-/// Create a new IAM user via the admin API over the chosen transport.
-pub(crate) async fn admin_create_user_via(
-    transport: AdminTransport,
-    base_url: &str,
-    admin_access_key: &str,
-    admin_secret_key: &str,
-    username: &str,
-    secret_key: &str,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let path = format!("/rustfs/admin/v3/add-user?accessKey={username}");
-    let body = serde_json::json!({"secretKey": secret_key, "status": "enabled"}).to_string();
-    admin_execute_at(
-        transport,
-        http::Method::PUT,
-        base_url,
-        admin_access_key,
-        admin_secret_key,
-        &path,
-        Some(&body),
-    )
-    .await
-}
-
-/// Install a canned policy via the admin API over the chosen transport.
-pub(crate) async fn admin_add_canned_policy_via(
-    transport: AdminTransport,
-    base_url: &str,
-    admin_access_key: &str,
-    admin_secret_key: &str,
-    policy_name: &str,
-    policy_json: &str,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let path = format!("/rustfs/admin/v3/add-canned-policy?name={policy_name}");
-    admin_execute_at(
-        transport,
-        http::Method::PUT,
-        base_url,
-        admin_access_key,
-        admin_secret_key,
-        &path,
-        Some(policy_json),
-    )
-    .await
-}
-
-/// Attach a canned policy to a user via the admin API over the chosen transport.
-pub(crate) async fn admin_attach_user_policy_via(
-    transport: AdminTransport,
-    base_url: &str,
-    admin_access_key: &str,
-    admin_secret_key: &str,
-    policy_name: &str,
-    username: &str,
-) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let path = format!("/rustfs/admin/v3/set-user-or-group-policy?policyName={policy_name}&userOrGroup={username}&isGroup=false");
-    // `Some("")` preserves the historical wire shape on both transports: awscurl
-    // keeps sending `-d ''` and the signed path attaches an empty body with no
-    // content type.
-    admin_execute_at(
-        transport,
-        http::Method::PUT,
-        base_url,
-        admin_access_key,
-        admin_secret_key,
-        &path,
-        Some(""),
-    )
-    .await
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1997,66 +1833,16 @@ mod tests {
     }
 
     #[test]
-    fn explicit_binary_without_run_receipt_is_rejected() {
+    fn binary_feature_stamp_matching_uses_normalized_features() {
-        const CHILD_ENV: &str = "RUSTFS_E2E_RECEIPT_TEST_CHILD";
+        let binary_path = std::env::temp_dir().join(format!("rustfs-feature-stamp-test-{}", Uuid::new_v4()));
-        if std::env::var_os(CHILD_ENV).is_some() {
+        let stamp_path = rustfs_binary_features_stamp_path(&binary_path);
-            rustfs_binary_path_with_features(None);
-            return;
-        }
-        let executable = std::env::current_exe().expect("locate isolated test process");
-        let output = Command::new(&executable)
-            .args([
-                "--exact",
-                "common::tests::explicit_binary_without_run_receipt_is_rejected",
-                "--nocapture",
-            ])
-            .env(CHILD_ENV, "1")
-            .env("CARGO_BIN_EXE_rustfs", &executable)
-            .env_remove("RUSTFS_E2E_BINARY_RECEIPT")
-            .output()
-            .expect("run the missing-receipt scenario with isolated environment variables");
-        assert!(!output.status.success(), "an explicit binary must not bypass run verification");
-        assert!(String::from_utf8_lossy(&output.stderr).contains("missing E2E run receipt"));
-    }
 
-    #[test]
+        stdfs::write(&stamp_path, " SFTP, ftps ").expect("write feature stamp");
-    fn e2e_run_receipt_rejects_replaced_binary_and_missing_features() {
+        assert!(binary_features_match(&binary_path, Some("sftp,ftps")));
-        let directory = std::env::temp_dir().join(format!("rustfs-e2e-receipt-test-{}", Uuid::new_v4()));
+        assert!(binary_features_match(&binary_path, Some(" SFTP, FTPS ")));
-        stdfs::create_dir(&directory).expect("create receipt fixture");
+        assert!(!binary_features_match(&binary_path, Some("sftp")));
-        let binary = directory.join("rustfs");
+
-        let receipt = directory.join("receipt.json");
+        stdfs::remove_file(stamp_path).ok();
-        stdfs::write(&binary, "server").expect("write fixture binary");
-        let metadata = binary.metadata().expect("stat fixture binary");
-        let record = serde_json::json!({
-            "schema": 1,
-            "workspace": directory.canonicalize().expect("canonical workspace"),
-            "binary": binary.canonicalize().expect("canonical binary"),
-            "size": metadata.len(),
-            "modified_ns": metadata.modified().expect("modified time").duration_since(std::time::UNIX_EPOCH).expect("positive timestamp").as_nanos(),
-            "features": ["default", "full", "ftps", "webdav", "sftp"]
-        });
-        stdfs::write(&receipt, serde_json::to_vec(&record).expect("serialize receipt")).expect("write receipt");
-        verify_e2e_binary_receipt(&receipt, &directory, &binary, Some("sftp,webdav")).expect("resolved feature subset");
-        verify_e2e_binary_receipt(&receipt, &directory, &binary, Some("full")).expect("full was actually requested");
-        assert_eq!(
-            verify_e2e_binary_receipt(&receipt, &directory, &binary, Some("rio-v2"))
-                .expect_err("full does not enable rio-v2")
-                .kind(),
-            ErrorKind::InvalidInput
-        );
-        let other = directory.join("old-server");
-        stdfs::write(&other, "server").expect("write alternate binary");
-        assert!(verify_e2e_binary_receipt(&receipt, &directory, &other, None).is_err());
-        stdfs::write(&binary, "different server").expect("replace fixture binary");
-        assert!(verify_e2e_binary_receipt(&receipt, &directory, &binary, None).is_err());
-        stdfs::remove_file(&receipt).expect("remove expired receipt");
-        assert_eq!(
-            verify_e2e_binary_receipt(&receipt, &directory, &binary, None)
-                .expect_err("expired receipt")
-                .kind(),
-            ErrorKind::NotFound
-        );
-        stdfs::remove_dir_all(directory).expect("remove receipt fixture");
     }
 
     /// Build a cluster environment struct in-memory (no ports, no processes) so
@@ -2073,7 +1859,7 @@ mod tests {
         }
         let multidrive = topology.drives_per_node > 1;
 
-        let nodes: Vec<ClusterNode> = (0..topology.node_count)
+        let nodes = (0..topology.node_count)
             .map(|i| {
                 let address = format!("127.0.0.1:{}", 9000 + i);
                 let data_dirs: Vec<String> = if multidrive {
@@ -2094,7 +1880,6 @@ mod tests {
             })
             .collect();
 
-        let node_count = nodes.len();
         RustFSTestClusterEnvironment {
             nodes,
             temp_dir,
@@ -2104,7 +1889,6 @@ mod tests {
             node_extra_env: vec![Vec::new(); topology.node_count],
             node_capture_log_paths: vec![None; topology.node_count],
             topology,
-            volume_proxy_addresses: vec![None; node_count],
         }
     }
 
@@ -2189,25 +1973,6 @@ mod tests {
         assert!(ClusterTopology::single_pool_multidrive(1, 1).validate().is_ok());
     }
 
-    #[tokio::test]
-    async fn volume_proxy_rewrites_cluster_volume_endpoint() {
-        let mut env = RustFSTestClusterEnvironment::new(1)
-            .await
-            .expect("cluster environment should allocate a node");
-        let direct = env.nodes[0].address.clone();
-        let proxy = env
-            .start_volume_proxy_for_node(0)
-            .await
-            .expect("volume proxy should bind before the target server starts");
-        let proxied = proxy.local_addr().to_string();
-        let volumes = env.rustfs_volumes_arg();
-
-        assert!(volumes.contains(&proxied), "volumes must use the proxy address: {volumes}");
-        assert!(!volumes.contains(&direct), "volumes must not retain the direct address: {volumes}");
-
-        proxy.shutdown().await;
-    }
-
     #[test]
     fn cluster_node_env_supports_per_node_overrides() {
         let mut env = fake_cluster(ClusterTopology::single_pool(4));

crates/e2e_test/src/degraded_listing_availability_test.rs

@@ -1,174 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Regression: an object legally committed at degraded write quorum must stay
-//! listable while a *different* drive is offline.
-//!
-//! On a 4-drive EC 2+2 set, a PUT made while one drive is down persists
-//! `xl.meta` on 3 of 4 drives (write quorum). If a different drive later goes
-//! offline before heal converges, a strict latest-listing quorum of 3 can only
-//! ever observe 2 copies, so ListObjectsV2 silently dropped the object even
-//! though GetObject (read quorum 2) still succeeded. Exposed by the flaky
-//! "Mixed-version rolling upgrade from rc.2" CI lane (run 33478999853); the
-//! product fix relaxes the listing's required object quorum by the number of
-//! set drives the listing could not consult (see
-//! `latest_listing_required_object_quorum` in
-//! `crates/ecstore/src/store/list_objects.rs`).
-
-#[cfg(test)]
-mod tests {
-    use crate::common::{RustFSTestClusterEnvironment, init_logging};
-    use aws_sdk_s3::Client;
-    use bytes::Bytes;
-    use std::collections::HashSet;
-    use std::error::Error;
-    use std::time::{Duration, Instant};
-    use tracing::info;
-
-    type TestResult = Result<(), Box<dyn Error + Send + Sync>>;
-
-    const BUCKET: &str = "degraded-listing-availability";
-    const OBJECT_COUNT: usize = 8;
-    /// Well under the observed heal-convergence gap (~50s in the CI incident),
-    /// so a listing that only completes after heal restores the missing copy
-    /// still fails this deadline on a regressed build.
-    const LISTING_DEADLINE: Duration = Duration::from_secs(25);
-    const GET_RETRY_DEADLINE: Duration = Duration::from_secs(15);
-    const PUT_RETRY_DEADLINE: Duration = Duration::from_secs(15);
-
-    fn object_key(idx: usize) -> String {
-        format!("degraded-object-{idx:02}")
-    }
-
-    async fn list_all_keys(client: &Client) -> Result<HashSet<String>, Box<dyn Error + Send + Sync>> {
-        let mut keys = HashSet::new();
-        let mut continuation_token: Option<String> = None;
-        loop {
-            let response = client
-                .list_objects_v2()
-                .bucket(BUCKET)
-                .set_continuation_token(continuation_token.clone())
-                .send()
-                .await?;
-            keys.extend(
-                response
-                    .contents()
-                    .iter()
-                    .filter_map(|object| object.key().map(str::to_owned)),
-            );
-            match response.next_continuation_token() {
-                Some(token) => continuation_token = Some(token.to_owned()),
-                None => break,
-            }
-        }
-        Ok(keys)
-    }
-
-    /// 4-node single-drive cluster (EC 2+2, write quorum 3):
-    /// 1. Stop node 1 and PUT objects — each commits on nodes {0, 2, 3} only.
-    /// 2. Stop node 3 (a holder drive), then bring node 1 back before heal can
-    ///    recreate the missing copies there.
-    /// 3. Every object still satisfies read quorum (nodes 0 and 2), so GET
-    ///    must succeed AND ListObjectsV2 must report every key well before
-    ///    heal converges.
-    #[tokio::test]
-    async fn degraded_write_remains_listable_while_a_different_drive_is_offline() -> TestResult {
-        init_logging();
-
-        let mut cluster = RustFSTestClusterEnvironment::new(4).await?;
-        // Listing availability must not depend on heal convergence: disable
-        // the background healers so the degraded objects keep their metadata
-        // on exactly 3 of 4 drives for the whole test.
-        cluster.set_env("RUSTFS_HEAL_ENABLED", "false");
-        cluster.set_env("RUSTFS_SCANNER_ENABLED", "false");
-        cluster.start().await?;
-        cluster.create_test_bucket(BUCKET).await?;
-        let client = cluster.create_s3_client(0)?;
-
-        info!("stopping node 1 so the uploads commit at degraded write quorum (3 of 4)");
-        cluster.stop_node(1)?;
-        // The first writes after a node drops can see transient 503s while the
-        // survivors notice the dead peer; retry briefly (overwrites of the same
-        // unversioned key are idempotent).
-        for idx in 0..OBJECT_COUNT {
-            let key = object_key(idx);
-            let body = format!("degraded listing payload {idx}");
-            let deadline = Instant::now() + PUT_RETRY_DEADLINE;
-            loop {
-                let request = client
-                    .put_object()
-                    .bucket(BUCKET)
-                    .key(&key)
-                    .body(Bytes::from(body.clone()).into());
-                match request.send().await {
-                    Ok(_) => break,
-                    Err(error) if Instant::now() < deadline => {
-                        info!("retrying degraded PUT for {key}: {error}");
-                        tokio::time::sleep(Duration::from_millis(500)).await;
-                    }
-                    Err(error) => return Err(format!("degraded PUT for {key} failed: {error}").into()),
-                }
-            }
-        }
-
-        info!("stopping node 3 (holds a copy) and restoring node 1 (holds none)");
-        cluster.stop_node(3)?;
-        cluster.start_node(1).await?;
-
-        // The first requests after a node drops can see transient 503s while
-        // the survivors notice the dead peer; retry briefly before asserting.
-        for idx in 0..OBJECT_COUNT {
-            let key = object_key(idx);
-            let deadline = Instant::now() + GET_RETRY_DEADLINE;
-            let body = loop {
-                match client.get_object().bucket(BUCKET).key(&key).send().await {
-                    Ok(response) => break response.body.collect().await?.into_bytes(),
-                    Err(error) if Instant::now() < deadline => {
-                        info!("retrying degraded GET for {key}: {error}");
-                        tokio::time::sleep(Duration::from_millis(500)).await;
-                    }
-                    Err(error) => return Err(format!("degraded object {key} failed read quorum GET: {error}").into()),
-                }
-            };
-            assert!(!body.is_empty(), "degraded object {key} should read back at read quorum");
-        }
-
-        let expected: HashSet<String> = (0..OBJECT_COUNT).map(object_key).collect();
-        let deadline = Instant::now() + LISTING_DEADLINE;
-        let listed = loop {
-            let listed = match list_all_keys(&client).await {
-                Ok(keys) => keys,
-                Err(error) if Instant::now() < deadline => {
-                    info!("retrying degraded listing: {error}");
-                    tokio::time::sleep(Duration::from_millis(500)).await;
-                    continue;
-                }
-                Err(error) => return Err(error),
-            };
-            if expected.is_subset(&listed) {
-                break listed;
-            }
-            assert!(
-                Instant::now() < deadline,
-                "objects readable at read quorum stayed missing from ListObjectsV2 for {LISTING_DEADLINE:?}: \
-                 missing={:?} listed={listed:?}",
-                expected.difference(&listed).collect::<Vec<_>>(),
-            );
-            tokio::time::sleep(Duration::from_millis(500)).await;
-        };
-        info!(listed = listed.len(), "degraded objects are listable while node 3 is offline");
-
-        Ok(())
-    }
-}

crates/e2e_test/src/existing_object_tag_policy_test.rs

@@ -16,29 +16,37 @@
 //! session policy** (`Policy` parameter) via `awscurl --service sts` with explicit
 //! `Content-Type: application/x-www-form-urlencoded` on `POST /`.
 
-use crate::common::{
+use crate::common::{RustFSTestEnvironment, awscurl_delete, awscurl_post_sts_form_urlencoded, awscurl_put, init_logging};
-    AdminTransport, RustFSTestEnvironment, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via,
+use aws_sdk_s3::config::{Credentials, Region};
-    awscurl_delete, awscurl_post_sts_form_urlencoded, build_test_s3_config, init_logging,
-};
-use aws_sdk_s3::Client;
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{Delete, ObjectIdentifier, Tag, Tagging};
+use aws_sdk_s3::{Client, Config};
 use tracing::info;
 use uuid::Uuid;
 
 fn user_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str) -> Client {
-    env.create_s3_client_with_credentials(access_key, secret_key)
+    let credentials = Credentials::new(access_key, secret_key, None, None, "e2e-existing-tag");
+    let config = Config::builder()
+        .credentials_provider(credentials)
+        .region(Region::new("us-east-1"))
+        .endpoint_url(&env.url)
+        .force_path_style(true)
+        .behavior_version_latest()
+        .build();
+    Client::from_conf(config)
 }
 
 fn sts_session_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str, session_token: &str) -> Client {
-    Client::from_conf(build_test_s3_config(
+    let credentials = Credentials::new(access_key, secret_key, Some(session_token.into()), None, "e2e-sts-session");
-        &env.url,
+    let config = Config::builder()
-        access_key,
+        .credentials_provider(credentials)
-        secret_key,
+        .region(Region::new("us-east-1"))
-        Some(session_token),
+        .endpoint_url(&env.url)
-        "e2e-sts-session",
+        .force_path_style(true)
-    ))
+        .behavior_version_latest()
+        .build();
+    Client::from_conf(config)
 }
 
 fn extract_xml_tag(xml: &str, tag: &str) -> Option<String> {
@@ -69,16 +77,15 @@ async fn assume_role_with_session_policy(
     parse_assume_role_credentials(&xml)
 }
 
-// This suite deliberately drives the admin API through the external `awscurl`
-// binary (an independent SigV4 implementation), so the wrappers below pin
-// `AdminTransport::Awscurl`.
-
 async fn admin_create_user(
     env: &RustFSTestEnvironment,
     username: &str,
     password: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_create_user_via(AdminTransport::Awscurl, &env.url, &env.access_key, &env.secret_key, username, password).await
+    let body = serde_json::json!({ "secretKey": password, "status": "enabled" }).to_string();
+    let url = format!("{}/rustfs/admin/v3/add-user?accessKey={}", env.url, username);
+    awscurl_put(&url, &body, &env.access_key, &env.secret_key).await?;
+    Ok(())
 }
 
 async fn admin_add_canned_policy(
@@ -86,15 +93,9 @@ async fn admin_add_canned_policy(
     policy_name: &str,
     policy_json: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_add_canned_policy_via(
+    let url = format!("{}/rustfs/admin/v3/add-canned-policy?name={}", env.url, policy_name);
-        AdminTransport::Awscurl,
+    awscurl_put(&url, policy_json, &env.access_key, &env.secret_key).await?;
-        &env.url,
+    Ok(())
-        &env.access_key,
-        &env.secret_key,
-        policy_name,
-        policy_json,
-    )
-    .await
 }
 
 async fn admin_attach_policy_to_user(
@@ -102,7 +103,12 @@ async fn admin_attach_policy_to_user(
     policy_name: &str,
     username: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_attach_user_policy_via(AdminTransport::Awscurl, &env.url, &env.access_key, &env.secret_key, policy_name, username).await
+    let url = format!(
+        "{}/rustfs/admin/v3/set-user-or-group-policy?policyName={}&userOrGroup={}&isGroup=false",
+        env.url, policy_name, username
+    );
+    awscurl_put(&url, "", &env.access_key, &env.secret_key).await?;
+    Ok(())
 }
 
 async fn admin_remove_user(env: &RustFSTestEnvironment, username: &str) {

crates/e2e_test/src/fake_s3_target/README.md

@@ -1,17 +1,11 @@
 # Programmable fake S3 target
 
-This module is the shared failure-injection boundary for replication end-to-end tests and the programmable external source for on-demand-migration (ODM) tests. It runs an in-process, path-style S3 endpoint backed by `s3s`; no production crate depends on it.
+This module is the shared failure-injection boundary for replication end-to-end tests. It runs an in-process, path-style S3 endpoint backed by `s3s`; no production crate depends on it.
 
 `FakeS3Target::start()` creates the listener. Add target buckets with `create_bucket`, point a RustFS remote target at `address()`, use `FAKE_ACCESS_KEY` / `FAKE_SECRET_KEY`, then enqueue per-operation faults with `inject`. Faults for one operation are consumed in FIFO order and do not consume faults queued for another operation. A fault is consumed only after `s3s` verifies the full request signature, so anonymous, other-access-key, and bad-signature traffic cannot disturb a script.
 
-Supported data operations are HeadBucket, GetBucketVersioning, ListObjectsV2, PUT/GET/HEAD/DELETE Object, Get/Put/Delete ObjectTagging (tags live per version; Put replaces the whole set, Delete clears it), and create/upload/complete/abort multipart upload. `create_bucket` models general-purpose buckets in S3's shared global namespace; account-regional namespace buckets and their `-an` names are intentionally out of scope. Buckets created with `create_bucket` are versioned: PUT creates a version, DELETE without `versionId` creates a delete marker, and DELETE with `versionId` removes exactly that version. Internal source version IDs must be UUIDs and are stored canonically. Source mtime is honored only for source-replication PUT/DELETE requests; absent or invalid values use receipt time, matching RustFS, while multipart completion always uses receipt time. Replicated versions are ordered newest-first by source mtime so late older versions and delete markers do not become current. Equal mtimes prefer objects over delete markers, then canonical UUID order; RustFS's internal FileMeta signature tie-break is intentionally out of scope because it is not part of the target S3 protocol. Multipart part numbers follow S3's `1..=10000` range, and every completed part except the final part must be at least 5 MiB.
+Supported data operations are HeadBucket, GetBucketVersioning, PUT/GET/HEAD/DELETE Object, Get/Put/Delete ObjectTagging (tags live per version; Put replaces the whole set, Delete clears it), and create/upload/complete/abort multipart upload. `create_bucket` models general-purpose buckets in S3's shared global namespace; account-regional namespace buckets and their `-an` names are intentionally out of scope. Buckets are versioned: PUT creates a version, DELETE without `versionId` creates a delete marker, and DELETE with `versionId` removes exactly that version. Internal source version IDs must be UUIDs and are stored canonically. Source mtime is honored only for source-replication PUT/DELETE requests; absent or invalid values use receipt time, matching RustFS, while multipart completion always uses receipt time. Replicated versions are ordered newest-first by source mtime so late older versions and delete markers do not become current. Equal mtimes prefer objects over delete markers, then canonical UUID order; RustFS's internal FileMeta signature tie-break is intentionally out of scope because it is not part of the target S3 protocol. Multipart part numbers follow S3's `1..=10000` range, and every completed part except the final part must be at least 5 MiB.
 
-`create_bucket_with_object_lock(name)` creates a versioned bucket whose GetObjectLockConfiguration reports `Enabled`; every other bucket answers `ObjectLockConfigurationNotFoundError`, the code RustFS's replication-check classifies as "not enabled". Three switches model remote-target behaviors the fleet has shown, so the outbound target matrix (`crates/e2e_test/src/replication_target_matrix_test.rs`) can replicate every object shape against each: `assign_own_version_ids(true)` ignores the source version id and mints its own (AWS S3 / Wasabi); `reject_aws_chunked_uploads(true)` refuses any PutObject or UploadPart announcing `aws-chunked` framing (`Content-Encoding: aws-chunked`, an `x-amz-trailer`, or a `STREAMING-*` payload hash) with `InvalidRequest` before the body is read (SeaweedFS 3.97, rustfs#6853); `require_checksum_for_object_lock(true)` rejects a PutObject carrying any `x-amz-object-lock-*` header unless it also carries `Content-MD5`, an `x-amz-checksum-*` header, or `x-amz-sdk-checksum-algorithm` (AWS S3 / MinIO, rustfs#7082). Independently of that switch, a `Content-MD5` header is always verified against the body and a mismatch answers `BadDigest`.
+Fault actions cover HTTP 401/403/503 responses, pre-dispatch delay, connection abort when a logical request-body threshold is reached, streaming slow drain, and a deliberately wrong response ETag (including multipart-complete XML). `requests()` returns the ordered, credential-free request journal for assertions. Each record also journals a `ProxyHeaderSnapshot` — the read-proxy anti-loop marker (`x-{rustfs,minio}-source-proxy-request`), the replication-check exemption header, and the client SSE-C header family (algorithm and key-MD5 values; for the key itself only its presence) — so proxy tests can pin the exact wire contract.
 
-`create_bucket_with_mode(name, BucketMode::Unversioned)` models a plain migration source: PUT overwrites in place, DELETE removes the key without a delete marker, GetBucketVersioning reports no status, and no `x-amz-version-id` is returned by PUT, GET, HEAD, tagging, or multipart completion. The only `versionId` such a bucket accepts is `null`; any other value is rejected with `InvalidArgument`. The mode is fixed at creation.
+The listener is loopback-only. It admits at most 64 active connections and two concurrently buffered request bodies; authenticated multipart-complete XML collection and assembly take both body permits. Keep-alive is disabled, request-header reads are bounded to 30 seconds, a parsed request is bounded to 65 seconds, and the complete connection lifetime is bounded to 100 seconds. It retains at most 256 buckets, 4,096 journal entries, 4,096 scripted faults, 4,096 object versions, 256 multipart uploads, and 10,000 multipart parts. Retained identifiers are capped at 1 KiB, user metadata at 2 KiB, and content type at 1 KiB. A PUT or uploaded part is capped at 64 MiB; a completed multipart object and all stored object/part data are capped at 128 MiB. Body drain, body-permit waits, delay, and slow-drain execution are bounded to 30 seconds; each slow-drain slice delay must be below that bound.
-
-ListObjectsV2 lists current versions only (a key whose newest version is a delete marker is hidden) in byte order and supports `prefix`, `delimiter`, `max-keys` (clamped to 1000), `start-after`, and `continuation-token`; common prefixes count toward `max-keys`, `IsTruncated` / `NextContinuationToken` / `KeyCount` follow S3, and continuation tokens are opaque. `encoding-type` and `fetch-owner` are accepted but ignored, and ListObjects (v1) is not implemented. GET and HEAD honor `Range` in the `bytes=first-last`, `bytes=first-`, and `bytes=-suffix` forms with a 206 status, exact `Content-Range`, and `Accept-Ranges: bytes`; unsatisfiable ranges answer 416 `InvalidRange` with `Content-Range: bytes */<length>`. PUT and CreateMultipartUpload accept `Content-Type`, `Content-Encoding`, `Content-Disposition`, `Content-Language`, `Cache-Control`, `Expires`, and `x-amz-meta-*` (names stored lowercased), and HEAD/GET replay them verbatim together with `Last-Modified` and the ETag (hex MD5 for single PUTs, `<md5-of-part-md5s>-<parts>` for multipart objects). `put_seed_object` stores an object directly, bypassing the wire, the fault script, and the journal, so a source can be seeded without polluting the assertions a scenario later makes.
-
-Fault actions cover HTTP 401/403/503 responses (`Status`), any 4xx/5xx status paired with the matching S3 error code (`ResponseStatus`), pre-dispatch delay, holding a fully computed successful response before its first byte (`Stall`), connection abort when a logical request-body threshold is reached, GetObject bodies cut off after N bytes while `Content-Length` announces the full size (`TruncateBodyAt`), GetObject bodies delivered in fixed slices with a pause between them (`SlowSendBody`, a mid-body stall rather than a first-byte one), streaming slow drain, and a deliberately wrong response ETag (including multipart-complete XML). `requests()` returns the ordered, credential-free request journal for assertions and `count_requests(operation, key)` counts entries for one exact key. Each record journals the `Range` and `User-Agent` request headers, the ListObjectsV2 `prefix` and `continuation-token` query values, a `TransportSnapshot` — whether the body was announced as `aws-chunked`, the verbatim `Content-MD5`, the sorted `x-amz-checksum-*` / `x-amz-sdk-checksum-algorithm` header names, and whether any `x-amz-object-lock-*` header was present — and a `ProxyHeaderSnapshot` — the read-proxy anti-loop marker (`x-{rustfs,minio}-source-proxy-request`), the replication-check exemption header, and the client SSE-C header family (algorithm and key-MD5 values; for the key itself only its presence) — so proxy tests can pin the exact wire contract.
-
-The listener is loopback-only. It admits at most 64 active connections and two concurrently buffered request bodies; authenticated multipart-complete XML collection and assembly take both body permits. Keep-alive is disabled, request-header reads are bounded to 30 seconds, a parsed request is bounded to 65 seconds, and the complete connection lifetime is bounded to 100 seconds. It retains at most 256 buckets, 4,096 journal entries, 4,096 scripted faults, 4,096 object versions, 256 multipart uploads, and 10,000 multipart parts. Retained identifiers are capped at 1 KiB, user metadata at 2 KiB, and content type and each standard object header at 1 KiB. By default a PUT or uploaded part is capped at 64 MiB and a completed multipart object and all stored object/part data are capped at 128 MiB; `FakeS3Target::start_with_options(FakeS3TargetOptions { max_object_bytes })` raises the object cap up to 256 MiB, and the total budget then becomes twice the object cap (never below 128 MiB). Body drain, body-permit waits, delay, stall, and slow-drain execution are bounded to 30 seconds; each slow-drain slice delay must be below that bound.

crates/e2e_test/src/group_delete_test.rs

@@ -15,11 +15,20 @@
 //! E2E tests for group management (fixes #2028).
 
 use crate::common::{RustFSTestEnvironment, admin_ok, admin_request, init_logging};
-use aws_sdk_s3::Client;
+use aws_sdk_s3::config::{Credentials, Region};
+use aws_sdk_s3::{Client, Config};
 use tracing::info;
 
 fn create_user_s3_client(env: &RustFSTestEnvironment, access_key: &str, secret_key: &str) -> Client {
-    env.create_s3_client_with_credentials(access_key, secret_key)
+    let credentials = Credentials::new(access_key, secret_key, None, None, "e2e-group-test");
+    let config = Config::builder()
+        .credentials_provider(credentials)
+        .region(Region::new("us-east-1"))
+        .endpoint_url(&env.url)
+        .force_path_style(true)
+        .behavior_version_latest()
+        .build();
+    Client::from_conf(config)
 }
 
 #[tokio::test(flavor = "multi_thread")]

crates/e2e_test/src/inline_fast_path_cluster_test.rs

@@ -15,13 +15,13 @@
 //! Four-node EC regression gate for inline storage and the inline GET reader.
 //!
 //! The storage decision is based on shard bytes (256 KiB / 32 KiB objects for
-//! the default EC 2+2 geometry), and the GET fast path follows the persisted
+//! the default EC 2+2 geometry), while the GET fast path has its own object-size
-//! inline marker. A local OTLP/HTTP collector observes the existing reader-path
+//! limits (128 KiB / 16 KiB). A local OTLP/HTTP collector observes the existing
-//! counter without adding a scrape endpoint or production logging.
+//! reader-path counter without adding a scrape endpoint or production logging.
 //! One S3 GET can select readers on multiple EC nodes, so the counter tracks
 //! distributed reader selection rather than HTTP request count.
 
-use crate::common::{RustFSTestClusterEnvironment, RustFSTestEnvironment, init_logging};
+use crate::common::{RustFSTestClusterEnvironment, RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::Client;
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{
@@ -30,7 +30,7 @@ use aws_sdk_s3::types::{
 };
 use bytes::Bytes;
 use flate2::read::GzDecoder;
-use http::header::CONTENT_ENCODING;
+use http::header::{CONTENT_ENCODING, HOST};
 use http::{Method, Request, Response, StatusCode};
 use http_body_util::{BodyExt, Full};
 use hyper::body::Incoming;
@@ -42,6 +42,9 @@ use opentelemetry_proto::tonic::metrics::v1::{
     Metric, NumberDataPoint, ResourceMetrics, ScopeMetrics, Sum, metric, number_data_point,
 };
 use prost::Message;
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
+use s3s::Body;
 use std::collections::BTreeMap;
 use std::convert::Infallible;
 use std::error::Error;
@@ -89,7 +92,6 @@ const MPU_PART_1_SIZE: usize = 5 * 1024 * 1024;
 const MPU_PART_2_SIZE: usize = 16 * KIB;
 const TIER_BUCKET: &str = "inline-fallback-cold-tier";
 const TIER_PREFIX: &str = "tiered";
-const ALLOW_LOOPBACK_TIER_ENDPOINT_ENV: &str = "RUSTFS_TIER_RUSTFS_ALLOW_LOOPBACK_ENDPOINT";
 const MSGPACK_FALLBACK_CONTROL_SERIES: [(&str, &str); 4] = [
     (FALLBACK_REQUEST_DIRECTION, "ReadMultipleReq"),
     (FALLBACK_RESPONSE_DIRECTION, "ReadMultipleResp"),
@@ -792,12 +794,12 @@ fn metric_attribute(key: &str, value: &str) -> KeyValue {
 }
 
 fn boundary_cases(state: VersionState) -> Vec<BoundaryCase> {
-    let storage_limit = match state {
+    let (fast_limit, storage_limit) = match state {
-        VersionState::Enabled => 32 * KIB,
+        VersionState::Enabled => (16 * KIB, 32 * KIB),
-        VersionState::Unversioned => 256 * KIB,
+        VersionState::Unversioned => (128 * KIB, 256 * KIB),
         // A suspended bucket stores its null version using the unversioned
         // shard threshold, while ObjectInfo keeps version-aware GET semantics.
-        VersionState::Suspended => 256 * KIB,
+        VersionState::Suspended => (16 * KIB, 256 * KIB),
     };
     let mut sizes = vec![0, 16 * KIB - 1, 16 * KIB, 16 * KIB + 1, 32 * KIB - 1, 32 * KIB, 32 * KIB + 1];
     if !matches!(state, VersionState::Enabled) {
@@ -818,7 +820,7 @@ fn boundary_cases(state: VersionState) -> Vec<BoundaryCase> {
             stored_inline: size <= storage_limit,
             expected_reader_path: if size == 0 {
                 EMPTY
-            } else if size <= storage_limit {
+            } else if size <= fast_limit {
                 INLINE_DIRECT
             } else {
                 LEGACY_DUPLEX
@@ -1260,8 +1262,6 @@ async fn put_two_part_multipart(client: &Client, bucket: &str, key: &str) -> Tes
     Ok((body, part2, complete.e_tag().map(str::to_owned)))
 }
 
-/// Thin wrapper over [`crate::common::admin_request`], kept local so the call
-/// sites below keep their `Option<&str>` body shape.
 async fn signed_admin_request(
     base_url: &str,
     method: Method,
@@ -1270,7 +1270,30 @@ async fn signed_admin_request(
     access_key: &str,
     secret_key: &str,
 ) -> TestResult<(reqwest::StatusCode, String)> {
-    crate::common::admin_request(base_url, method, path, body.map(str::to_string), access_key, secret_key).await
+    let url = format!("{base_url}{path}");
+    let uri = url.parse::<http::Uri>()?;
+    let authority = uri.authority().ok_or("request URL missing authority")?.to_string();
+    let body_bytes = body.map(|value| value.as_bytes().to_vec()).unwrap_or_default();
+
+    let request = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    let signed = sign_v4(request.body(Body::empty())?, 0, access_key, secret_key, "", "us-east-1");
+
+    let client = local_http_client();
+    let mut request_builder = client.request(method, url.as_str());
+    for (name, value) in signed.headers() {
+        request_builder = request_builder.header(name, value);
+    }
+    if !body_bytes.is_empty() {
+        request_builder = request_builder.body(body_bytes);
+    }
+    let response = request_builder.send().await?;
+    let status = response.status();
+    let text = response.text().await?;
+    Ok((status, text))
 }
 
 fn unique_tier_name() -> String {
@@ -2101,7 +2124,6 @@ async fn four_node_add_tier_converges() -> TestResult {
     cold.create_s3_client().create_bucket().bucket(TIER_BUCKET).send().await?;
 
     let mut hot = RustFSTestClusterEnvironment::new(4).await?;
-    hot.set_env(ALLOW_LOOPBACK_TIER_ENDPOINT_ENV, "true");
     hot.start().await?;
 
     let tier_name = unique_tier_name();
@@ -2120,7 +2142,6 @@ async fn four_node_add_tier_converges_after_offline_node_restart_without_second_
     cold.create_s3_client().create_bucket().bucket(TIER_BUCKET).send().await?;
 
     let mut hot = RustFSTestClusterEnvironment::new(4).await?;
-    hot.set_env(ALLOW_LOOPBACK_TIER_ENDPOINT_ENV, "true");
     hot.start().await?;
 
     let tier_name = unique_tier_name();
@@ -2217,7 +2238,6 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
     cold_client.create_bucket().bucket(TIER_BUCKET).send().await?;
 
     let mut hot = RustFSTestClusterEnvironment::new(4).await?;
-    hot.set_env(ALLOW_LOOPBACK_TIER_ENDPOINT_ENV, "true");
     hot.set_env("RUSTFS_SCANNER_ENABLED", "false");
     hot.set_env("RUSTFS_SCANNER_CYCLE", "3600");
     hot.set_env("RUSTFS_MAX_TRANSITION_WORKERS", "1");
@@ -2360,7 +2380,6 @@ async fn four_node_manual_transition_rollout_non_empty_restart_readback() -> Tes
     cold_client.create_bucket().bucket(TIER_BUCKET).send().await?;
 
     let mut hot = RustFSTestClusterEnvironment::new(4).await?;
-    hot.set_env(ALLOW_LOOPBACK_TIER_ENDPOINT_ENV, "true");
     hot.set_env("RUSTFS_SCANNER_ENABLED", "false");
     hot.set_env("RUSTFS_SCANNER_CYCLE", "3600");
     hot.set_env("RUSTFS_MAX_TRANSITION_WORKERS", "2");
@@ -2465,7 +2484,6 @@ async fn four_node_mixed_msgpack_compat_mode_preserves_fallback_controls_during_
 
     let collector = OtlpMetricCollector::start().await?;
     let mut hot = RustFSTestClusterEnvironment::new(4).await?;
-    hot.set_env(ALLOW_LOOPBACK_TIER_ENDPOINT_ENV, "true");
     configure_mixed_msgpack_cluster(&mut hot, &collector)?;
     hot.set_env("RUSTFS_SCANNER_CYCLE", "1");
     hot.set_env("RUSTFS_ILM_PROCESS_TIME", "1");
@@ -2577,7 +2595,6 @@ async fn four_node_transitioned_inline_fallback() -> TestResult {
 
     let collector = OtlpMetricCollector::start().await?;
     let mut hot = RustFSTestClusterEnvironment::new(4).await?;
-    hot.set_env(ALLOW_LOOPBACK_TIER_ENDPOINT_ENV, "true");
     configure_reader_metric_cluster(&mut hot, &collector);
     hot.set_env("RUSTFS_SCANNER_CYCLE", "1");
     hot.set_env("RUSTFS_ILM_PROCESS_TIME", "1");

crates/e2e_test/src/kms/configured_roundtrip_test.rs

@@ -17,7 +17,6 @@
 
 use super::common::{
     LocalKMSTestEnvironment, VAULT_KEY_NAME, VaultTestEnvironment, configure_kms, get_kms_status, kms_admin_request, start_kms,
-    test_sse_kms_encryption,
 };
 use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::types::{BucketVersioningStatus, ServerSideEncryption, VersioningConfiguration};
@@ -432,38 +431,6 @@ async fn test_configured_local_kms_admin_and_versioned_cleanup() -> TestResult {
     Ok(())
 }
 
-#[tokio::test]
-async fn test_admin_configured_local_kms_is_restored_after_restart() -> TestResult {
-    let mut env = LocalKMSTestEnvironment::new().await?;
-    env.base_env.start_rustfs_server(Vec::new()).await?;
-
-    let default_key_id = env.configure_local_kms().await?;
-    start_kms(&env.base_env.url, &env.base_env.access_key, &env.base_env.secret_key).await?;
-
-    env.base_env.restart_server_preserving_data(Vec::new(), &[]).await?;
-    assert_configured_status(
-        &env.base_env.url,
-        &env.base_env.access_key,
-        &env.base_env.secret_key,
-        "local",
-        &default_key_id,
-    )
-    .await?;
-
-    let bucket = format!("kms-restart-{}", Uuid::new_v4());
-    env.base_env.create_test_bucket(&bucket).await?;
-    let client = env.base_env.create_s3_client();
-    test_sse_kms_encryption(&client, &bucket).await?;
-    client
-        .delete_object()
-        .bucket(&bucket)
-        .key("test-sse-kms-object")
-        .send()
-        .await?;
-    env.base_env.delete_test_bucket(&bucket).await?;
-    Ok(())
-}
-
 #[tokio::test]
 async fn test_configured_vault_kms_admin_and_versioned_cleanup() -> TestResult {
     let mut env = VaultTestEnvironment::new().await?;

crates/e2e_test/src/kms/kms_anonymous_enforcement_test.rs

@@ -1,220 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Anonymous access to SSE-KMS objects under per-key authorization.
-//!
-//! Locks both halves of the anonymous contract decided in backlog#2028 (D4):
-//!
-//! - **Enforcement on**: anonymous requests hold no `kms` grants, so a public
-//!   bucket policy does not let them read SSE-KMS objects or write through an
-//!   SSE-KMS default-encryption rule. Both fail with `AccessDenied`.
-//! - **Enforcement off** (the default): bucket policy alone governs anonymous
-//!   access, matching the pre-enforcement behavior — public SSE-KMS objects are
-//!   decrypted and served, and anonymous writes are encrypted under the default
-//!   key.
-//!
-//! The denial today is emergent — an empty-account principal falling through to
-//! the IAM default deny — so without this file a refactor of principal
-//! construction or policy evaluation could silently flip it. Each test carries a
-//! plaintext-object positive control: a denial proves nothing while the bucket
-//! policy has not propagated.
-
-use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
-use crate::common::{init_logging, local_http_client};
-use aws_sdk_s3::primitives::ByteStream;
-use aws_sdk_s3::types::{
-    ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
-};
-use std::time::Duration;
-
-type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
-
-const DEFAULT_KEY: &str = "kms-anon-default-key";
-const BUCKET: &str = "kms-anon-enforcement";
-const PLAIN_OBJECT: &str = "plain.txt";
-const ENCRYPTED_OBJECT: &str = "encrypted.txt";
-const PAYLOAD: &[u8] = b"kms anonymous enforcement payload";
-
-/// How long a bucket policy change may take to reach the request path.
-const POLICY_PROPAGATION: Duration = Duration::from_secs(20);
-
-/// Start a local-KMS server and build the public-bucket fixture.
-///
-/// The bucket holds a plaintext object (the positive control), an SSE-KMS
-/// object, an SSE-KMS default-encryption rule, and a bucket policy opening
-/// `GetObject`/`PutObject` to everyone. The enforcement switch defaults to off,
-/// so the enforcing case has to set it explicitly.
-async fn start_public_sse_kms_bucket(env: &mut LocalKMSTestEnvironment, enforce: bool) -> TestResult {
-    create_key_with_specific_id(&env.kms_keys_dir, DEFAULT_KEY).await?;
-
-    let key_dir = env.kms_keys_dir.clone();
-    let args = vec![
-        "--kms-enable",
-        "--kms-backend",
-        "local",
-        "--kms-key-dir",
-        key_dir.as_str(),
-        "--kms-default-key-id",
-        DEFAULT_KEY,
-    ];
-    let mut envs = vec![("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")];
-    if enforce {
-        envs.push(("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "true"));
-    }
-    env.base_env.start_rustfs_server_with_env(args, &envs).await?;
-    env.base_env.create_test_bucket(BUCKET).await?;
-
-    let owner = env.base_env.create_s3_client();
-
-    owner
-        .put_object()
-        .bucket(BUCKET)
-        .key(PLAIN_OBJECT)
-        .body(ByteStream::from_static(PAYLOAD))
-        .send()
-        .await?;
-    owner
-        .put_object()
-        .bucket(BUCKET)
-        .key(ENCRYPTED_OBJECT)
-        .body(ByteStream::from_static(PAYLOAD))
-        .server_side_encryption(ServerSideEncryption::AwsKms)
-        .ssekms_key_id(DEFAULT_KEY)
-        .send()
-        .await?;
-
-    let encryption_config = ServerSideEncryptionConfiguration::builder()
-        .rules(
-            ServerSideEncryptionRule::builder()
-                .apply_server_side_encryption_by_default(
-                    ServerSideEncryptionByDefault::builder()
-                        .sse_algorithm(ServerSideEncryption::AwsKms)
-                        .kms_master_key_id(DEFAULT_KEY)
-                        .build()?,
-                )
-                .build(),
-        )
-        .build()?;
-    owner
-        .put_bucket_encryption()
-        .bucket(BUCKET)
-        .server_side_encryption_configuration(encryption_config)
-        .send()
-        .await?;
-
-    let policy = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [{
-            "Sid": "PublicReadWrite",
-            "Effect": "Allow",
-            "Principal": "*",
-            "Action": ["s3:GetObject", "s3:PutObject"],
-            "Resource": [format!("arn:aws:s3:::{BUCKET}/*")]
-        }]
-    })
-    .to_string();
-    owner.put_bucket_policy().bucket(BUCKET).policy(&policy).send().await?;
-    let _ = owner.delete_public_access_block().bucket(BUCKET).send().await;
-
-    Ok(())
-}
-
-fn object_url(env: &LocalKMSTestEnvironment, key: &str) -> String {
-    format!("{}/{BUCKET}/{key}", env.base_env.url)
-}
-
-async fn anonymous_get(env: &LocalKMSTestEnvironment, key: &str) -> Result<reqwest::Response, reqwest::Error> {
-    local_http_client().get(object_url(env, key)).send().await
-}
-
-async fn anonymous_put(env: &LocalKMSTestEnvironment, key: &str) -> Result<reqwest::Response, reqwest::Error> {
-    local_http_client().put(object_url(env, key)).body(PAYLOAD).send().await
-}
-
-/// Retry the plaintext read until the public bucket policy is live.
-async fn wait_for_public_read(env: &LocalKMSTestEnvironment) -> TestResult {
-    let deadline = tokio::time::Instant::now() + POLICY_PROPAGATION;
-    loop {
-        let status = anonymous_get(env, PLAIN_OBJECT).await?.status();
-        if status.as_u16() == 200 {
-            return Ok(());
-        }
-        if tokio::time::Instant::now() >= deadline {
-            return Err(format!("positive control never became readable: anonymous GET {PLAIN_OBJECT} -> {status}").into());
-        }
-        tokio::time::sleep(Duration::from_millis(500)).await;
-    }
-}
-
-async fn assert_anonymous_denied(response: reqwest::Response, what: &str) -> TestResult {
-    let status = response.status().as_u16();
-    let body = response.text().await?;
-    assert_eq!(status, 403, "{what} must be denied, got {status}: {body}");
-    assert!(body.contains("AccessDenied"), "{what} must carry AccessDenied: {body}");
-    Ok(())
-}
-
-/// Enforcement on: a public bucket policy does not exempt anonymous requests
-/// from per-key authorization, on either the read or the default-encryption
-/// write path.
-#[tokio::test(flavor = "multi_thread")]
-async fn anonymous_sse_kms_denied_under_enforcement() -> TestResult {
-    init_logging();
-
-    let mut env = LocalKMSTestEnvironment::new().await?;
-    start_public_sse_kms_bucket(&mut env, true).await?;
-    wait_for_public_read(&env).await?;
-
-    let read = anonymous_get(&env, ENCRYPTED_OBJECT).await?;
-    assert_anonymous_denied(read, "anonymous GET of an SSE-KMS object").await?;
-
-    let write = anonymous_put(&env, "anon-write.txt").await?;
-    assert_anonymous_denied(write, "anonymous PUT through an SSE-KMS default-encryption rule").await?;
-
-    Ok(())
-}
-
-/// Enforcement off (the default): bucket policy alone governs anonymous access,
-/// and the default-encryption rule still encrypts anonymous writes.
-#[tokio::test(flavor = "multi_thread")]
-async fn anonymous_sse_kms_governed_by_bucket_policy_without_enforcement() -> TestResult {
-    init_logging();
-
-    let mut env = LocalKMSTestEnvironment::new().await?;
-    start_public_sse_kms_bucket(&mut env, false).await?;
-    wait_for_public_read(&env).await?;
-
-    let read = anonymous_get(&env, ENCRYPTED_OBJECT).await?;
-    assert_eq!(read.status().as_u16(), 200, "anonymous GET of a public SSE-KMS object must succeed");
-    assert_eq!(read.bytes().await?.as_ref(), PAYLOAD, "the object must be served decrypted");
-
-    let write = anonymous_put(&env, "anon-write.txt").await?;
-    assert_eq!(write.status().as_u16(), 200, "anonymous PUT to a public bucket must succeed");
-
-    let stored = env
-        .base_env
-        .create_s3_client()
-        .head_object()
-        .bucket(BUCKET)
-        .key("anon-write.txt")
-        .send()
-        .await?;
-    assert_eq!(
-        stored.server_side_encryption(),
-        Some(&ServerSideEncryption::AwsKms),
-        "the anonymous write must be encrypted by the bucket default rule"
-    );
-
-    Ok(())
-}

crates/e2e_test/src/kms/kms_ilm_sse_kms_test.rs

@@ -66,7 +66,6 @@ const SURVIVOR_KEY: &str = "keep/object.bin";
 const TIER_NAME: &str = "KMSCOLD";
 const TIER_BUCKET: &str = "kms-ilm-cold-tier";
 const TIER_PREFIX: &str = "tiered";
-const ALLOW_LOOPBACK_TIER_ENDPOINT_ENV: (&str, &str) = ("RUSTFS_TIER_RUSTFS_ALLOW_LOOPBACK_ENDPOINT", "true");
 const TRANSITION_BUCKET: &str = "kms-ilm-transition";
 const TRANSITION_KEY: &str = "tier/object.bin";
 
@@ -81,7 +80,7 @@ const ILM_DEADLINE: StdDuration = StdDuration::from_secs(90);
 /// `--kms-default-key-id`, insecure dev defaults). The lifecycle env matches
 /// `reliant/lifecycle.rs::fast_lifecycle_env` plus `RUSTFS_ILM_DEBUG_DAY_SECS=2`,
 /// so a `Days=1` rule is due about two seconds after the write.
-async fn start_enforcing_ilm_server(env: &mut LocalKMSTestEnvironment, extra_env: &[(&str, &str)]) -> TestResult {
+async fn start_enforcing_ilm_server(env: &mut LocalKMSTestEnvironment) -> TestResult {
     create_key_with_specific_id(&env.kms_keys_dir, SSE_KEY).await?;
 
     let key_dir = env.kms_keys_dir.clone();
@@ -95,14 +94,13 @@ async fn start_enforcing_ilm_server(env: &mut LocalKMSTestEnvironment, extra_env
         SSE_KEY,
     ];
 
-    let mut envs = vec![
+    let envs = [
         ("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true"),
         ("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "true"),
         ("RUSTFS_SCANNER_CYCLE", "1"),
         ("RUSTFS_ILM_PROCESS_TIME", "1"),
         ("RUSTFS_ILM_DEBUG_DAY_SECS", "2"),
     ];
-    envs.extend_from_slice(extra_env);
 
     env.base_env.start_rustfs_server_with_env(args, &envs).await?;
     Ok(())
@@ -429,7 +427,7 @@ async fn ilm_expiration_on_sse_kms_bucket_under_enforcement() -> TestResult {
     init_logging();
 
     let mut env = LocalKMSTestEnvironment::new().await?;
-    start_enforcing_ilm_server(&mut env, &[]).await?;
+    start_enforcing_ilm_server(&mut env).await?;
     env.base_env.create_test_bucket(EXPIRY_BUCKET).await?;
 
     let client = env.base_env.create_s3_client();
@@ -501,7 +499,7 @@ async fn ilm_transition_on_sse_kms_bucket_under_enforcement_reads_back() -> Test
 
     // Hot server: Local KMS + enforcement + accelerated lifecycle clock.
     let mut env = LocalKMSTestEnvironment::new().await?;
-    start_enforcing_ilm_server(&mut env, &[ALLOW_LOOPBACK_TIER_ENDPOINT_ENV]).await?;
+    start_enforcing_ilm_server(&mut env).await?;
     let hot_client = env.base_env.create_s3_client();
 
     add_rustfs_tier(&env.base_env, &cold.base_env).await?;

crates/e2e_test/src/kms/mod.rs

@@ -57,12 +57,6 @@ mod copy_object_version_restore_sse_test;
 #[cfg(test)]
 mod configured_roundtrip_test;
 
-#[cfg(test)]
-mod select_sse_response_test;
-
-#[cfg(test)]
-mod kms_anonymous_enforcement_test;
-
 #[cfg(test)]
 mod kms_authorization_negative_matrix_test;
 

crates/e2e_test/src/kms/multipart_encryption_test.rs

@@ -560,12 +560,18 @@ async fn test_multipart_encryption_type(
         .set_parts(Some(completed_parts))
         .build();
 
-    let complete_request = s3_client
+    let mut complete_request = s3_client
         .complete_multipart_upload()
         .bucket(bucket)
         .key(object_key)
         .upload_id(upload_id)
         .multipart_upload(completed_multipart_upload);
+    if matches!(encryption_type, EncryptionType::SSEC) {
+        complete_request = complete_request
+            .sse_customer_algorithm("AES256")
+            .sse_customer_key(sse_c_key.as_ref().unwrap())
+            .sse_customer_key_md5(sse_c_md5.as_ref().unwrap());
+    }
     let _complete_output = complete_request.send().await?;
 
     // Download and verify

crates/e2e_test/src/kms/select_sse_response_test.rs

@@ -1,241 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! SelectObjectContent SSE response-header compatibility (backlog#1625).
-
-use super::common::{LocalKMSTestEnvironment, sse_customer_key_md5_base64, start_kms};
-use crate::common::signed_s3_request_with_headers;
-use aws_sdk_s3::primitives::ByteStream;
-use aws_sdk_s3::types::ServerSideEncryption;
-use base64_simd::STANDARD as BASE64;
-use http::{HeaderMap, Method};
-use std::error::Error;
-use uuid::Uuid;
-
-type TestResult<T = ()> = Result<T, Box<dyn Error + Send + Sync>>;
-
-const CSV_BODY: &[u8] = b"name\nalice\n";
-const SELECT_BODY: &str = r#"<SelectObjectContentRequest xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-<Expression>SELECT * FROM S3Object</Expression>
-<ExpressionType>SQL</ExpressionType>
-<InputSerialization><CSV><FileHeaderInfo>USE</FileHeaderInfo></CSV></InputSerialization>
-<OutputSerialization><CSV/></OutputSerialization>
-</SelectObjectContentRequest>"#;
-const KMS_CONTEXT: &str = "eyJ0ZW5hbnQiOiJzMy1zZWxlY3QifQ==";
-const SSE_ALGORITHM: &str = "x-amz-server-side-encryption";
-const SSE_KMS_KEY_ID: &str = "x-amz-server-side-encryption-aws-kms-key-id";
-const SSE_KMS_CONTEXT: &str = "x-amz-server-side-encryption-context";
-const SSE_C_ALGORITHM: &str = "x-amz-server-side-encryption-customer-algorithm";
-const SSE_C_KEY: &str = "x-amz-server-side-encryption-customer-key";
-const SSE_C_KEY_MD5: &str = "x-amz-server-side-encryption-customer-key-md5";
-const LOG_FLUSH_SENTINEL: &str = "select-sse-log-flush-sentinel.csv";
-
-async fn raw_select(
-    env: &crate::common::RustFSTestEnvironment,
-    bucket: &str,
-    object: &str,
-    request_headers: &HeaderMap,
-) -> TestResult<reqwest::Response> {
-    let url = format!("{}/{bucket}/{object}?select&select-type=2", env.url);
-    signed_s3_request_with_headers(
-        Method::POST,
-        &url,
-        Some(SELECT_BODY.to_string()),
-        Some("application/xml"),
-        &env.access_key,
-        &env.secret_key,
-        request_headers,
-    )
-    .await
-}
-
-async fn assert_success_headers(response: reqwest::Response, expected: &[(&str, &str)], absent: &[&str]) -> TestResult {
-    if response.status() != reqwest::StatusCode::OK {
-        let status = response.status();
-        let url = response.url().clone();
-        let body = response.text().await?;
-        panic!("Select request to {url} failed with {status}: {body}");
-    }
-    for (name, value) in expected {
-        assert_eq!(response.headers().get(*name).and_then(|header| header.to_str().ok()), Some(*value));
-    }
-    for name in absent {
-        assert!(response.headers().get(*name).is_none(), "successful Select response must omit {name}");
-    }
-    let body = response.bytes().await?;
-    assert!(
-        body.windows(b"alice".len()).any(|window| window == b"alice"),
-        "successful Select response must contain a Records event with the selected row"
-    );
-    assert!(
-        body.windows(b"End".len()).any(|window| window == b"End"),
-        "successful Select response must contain the terminal End event"
-    );
-    Ok(())
-}
-
-async fn assert_pre_stream_failure(response: reqwest::Response) -> TestResult {
-    assert_eq!(response.status(), reqwest::StatusCode::BAD_REQUEST);
-    let body = response.text().await?;
-    assert!(body.contains("<Error>"), "pre-stream failure must return an S3 XML error: {body}");
-    assert!(
-        body.contains("<Code>InvalidRequest</Code>"),
-        "invalid SSE-C parameters must preserve the S3 error code: {body}"
-    );
-    Ok(())
-}
-
-fn put_object(
-    client: &aws_sdk_s3::Client,
-    bucket: &str,
-    object: &str,
-) -> aws_sdk_s3::operation::put_object::builders::PutObjectFluentBuilder {
-    client
-        .put_object()
-        .bucket(bucket)
-        .key(object)
-        .body(ByteStream::from_static(CSV_BODY))
-}
-
-#[tokio::test]
-async fn select_projects_encryption_headers_and_rejects_invalid_sse_c_before_streaming() -> TestResult {
-    let mut kms = LocalKMSTestEnvironment::new().await?;
-    let log_path = format!("{}/server.log", kms.base_env.temp_dir);
-    kms.base_env.capture_log_path = Some(log_path.clone());
-    kms.base_env
-        .start_rustfs_server_with_env(Vec::new(), &[("RUST_LOG", "s3s=debug,rustfs=info")])
-        .await?;
-    let key_id = kms.configure_local_kms().await?;
-    start_kms(&kms.base_env.url, &kms.base_env.access_key, &kms.base_env.secret_key).await?;
-
-    let client = kms.base_env.create_s3_client();
-    let bucket = format!("select-sse-{}", Uuid::new_v4().simple());
-    client.create_bucket().bucket(&bucket).send().await?;
-
-    put_object(&client, &bucket, "plain.csv").send().await?;
-    put_object(&client, &bucket, "sse-s3.csv")
-        .server_side_encryption(ServerSideEncryption::Aes256)
-        .send()
-        .await?;
-    put_object(&client, &bucket, "sse-kms.csv")
-        .server_side_encryption(ServerSideEncryption::AwsKms)
-        .ssekms_key_id(&key_id)
-        .ssekms_encryption_context(KMS_CONTEXT)
-        .send()
-        .await?;
-
-    let customer_key = "01234567890123456789012345678901";
-    let customer_key_b64 = BASE64.encode_to_string(customer_key);
-    let customer_key_md5 = sse_customer_key_md5_base64(customer_key);
-    put_object(&client, &bucket, "sse-c.csv")
-        .sse_customer_algorithm("AES256")
-        .sse_customer_key(&customer_key_b64)
-        .sse_customer_key_md5(&customer_key_md5)
-        .send()
-        .await?;
-
-    assert_success_headers(
-        raw_select(&kms.base_env, &bucket, "plain.csv", &HeaderMap::new()).await?,
-        &[],
-        &[
-            SSE_ALGORITHM,
-            SSE_KMS_KEY_ID,
-            SSE_KMS_CONTEXT,
-            SSE_C_ALGORITHM,
-            SSE_C_KEY,
-            SSE_C_KEY_MD5,
-        ],
-    )
-    .await?;
-    assert_success_headers(
-        raw_select(&kms.base_env, &bucket, "sse-s3.csv", &HeaderMap::new()).await?,
-        &[(SSE_ALGORITHM, "AES256")],
-        &[SSE_KMS_KEY_ID, SSE_KMS_CONTEXT, SSE_C_ALGORITHM, SSE_C_KEY, SSE_C_KEY_MD5],
-    )
-    .await?;
-    assert_success_headers(
-        raw_select(&kms.base_env, &bucket, "sse-kms.csv", &HeaderMap::new()).await?,
-        &[
-            (SSE_ALGORITHM, "aws:kms"),
-            (SSE_KMS_KEY_ID, &key_id),
-            (SSE_KMS_CONTEXT, KMS_CONTEXT),
-        ],
-        &[SSE_C_ALGORITHM, SSE_C_KEY, SSE_C_KEY_MD5],
-    )
-    .await?;
-
-    let mut sse_c_headers = HeaderMap::new();
-    sse_c_headers.insert(SSE_C_ALGORITHM, "AES256".parse()?);
-    sse_c_headers.insert(SSE_C_KEY, customer_key_b64.parse()?);
-    sse_c_headers.insert(SSE_C_KEY_MD5, customer_key_md5.parse()?);
-    assert_success_headers(
-        raw_select(&kms.base_env, &bucket, "sse-c.csv", &sse_c_headers).await?,
-        &[(SSE_C_ALGORITHM, "AES256"), (SSE_C_KEY_MD5, &customer_key_md5)],
-        &[SSE_ALGORITHM, SSE_KMS_KEY_ID, SSE_KMS_CONTEXT, SSE_C_KEY],
-    )
-    .await?;
-
-    assert_pre_stream_failure(raw_select(&kms.base_env, &bucket, "sse-c.csv", &HeaderMap::new()).await?).await?;
-
-    let mut missing_algorithm_headers = HeaderMap::new();
-    missing_algorithm_headers.insert(SSE_C_KEY, customer_key_b64.parse()?);
-    missing_algorithm_headers.insert(SSE_C_KEY_MD5, customer_key_md5.parse()?);
-    assert_pre_stream_failure(raw_select(&kms.base_env, &bucket, "sse-c.csv", &missing_algorithm_headers).await?).await?;
-
-    let mut wrong_algorithm_headers = sse_c_headers.clone();
-    wrong_algorithm_headers.insert(SSE_C_ALGORITHM, "AES128".parse()?);
-    assert_pre_stream_failure(raw_select(&kms.base_env, &bucket, "sse-c.csv", &wrong_algorithm_headers).await?).await?;
-
-    let wrong_md5 = sse_customer_key_md5_base64("99999999999999999999999999999999");
-    let mut wrong_md5_headers = sse_c_headers.clone();
-    wrong_md5_headers.insert(SSE_C_KEY_MD5, wrong_md5.parse()?);
-    assert_pre_stream_failure(raw_select(&kms.base_env, &bucket, "sse-c.csv", &wrong_md5_headers).await?).await?;
-
-    let wrong_key = "99999999999999999999999999999999";
-    let wrong_key_b64 = BASE64.encode_to_string(wrong_key);
-    let mut wrong_key_headers = HeaderMap::new();
-    wrong_key_headers.insert(SSE_C_ALGORITHM, "AES256".parse()?);
-    wrong_key_headers.insert(SSE_C_KEY, wrong_key_b64.parse()?);
-    wrong_key_headers.insert(SSE_C_KEY_MD5, wrong_md5.parse()?);
-    assert_pre_stream_failure(raw_select(&kms.base_env, &bucket, "sse-c.csv", &wrong_key_headers).await?).await?;
-
-    put_object(&client, &bucket, LOG_FLUSH_SENTINEL).send().await?;
-    assert_success_headers(
-        raw_select(&kms.base_env, &bucket, LOG_FLUSH_SENTINEL, &HeaderMap::new()).await?,
-        &[],
-        &[
-            SSE_ALGORITHM,
-            SSE_KMS_KEY_ID,
-            SSE_KMS_CONTEXT,
-            SSE_C_ALGORITHM,
-            SSE_C_KEY,
-            SSE_C_KEY_MD5,
-        ],
-    )
-    .await?;
-    let mut logs = String::new();
-    for _ in 0..100 {
-        logs = tokio::fs::read_to_string(&log_path).await?;
-        if logs.contains(LOG_FLUSH_SENTINEL) {
-            break;
-        }
-        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
-    }
-    assert!(logs.contains(LOG_FLUSH_SENTINEL), "timed out waiting for the log sink to flush");
-    for secret in [customer_key, customer_key_b64.as_str(), wrong_key, wrong_key_b64.as_str()] {
-        assert!(!logs.contains(secret), "Select request logging leaked SSE-C customer key material");
-    }
-
-    Ok(())
-}

crates/e2e_test/src/lib.rs

@@ -23,17 +23,10 @@ pub mod common;
 #[cfg(test)]
 pub mod chaos;
 
-// Programmable S3 target for replication failure-path tests (backlog#1147 repl-8)
+// Programmable S3 target for replication failure-path tests (backlog#1147 repl-8).
-// and on-demand-migration source scenarios (backlog#2151).
 #[cfg(test)]
 pub mod fake_s3_target;
 
-// On-demand migration (backlog#2147): shared two-server environment, admin
-// wrappers, and the harness self-test (backlog#2151). Behavior scenarios are
-// added by later ODM tasks.
-#[cfg(test)]
-pub mod on_demand_migration;
-
 // Socket-level network fault-injection proxy for black-box cluster tests
 // (backlog#1325 network fault-injection block): latency / blackhole / one-way
 // partition on the wire between nodes. Serves #1312/#1319 (lock-plane one-way
@@ -68,9 +61,6 @@ mod get_codec_streaming_compat_test;
 #[cfg(test)]
 mod version_id_regression_test;
 
-#[cfg(test)]
-mod select_request_root_alias_test;
-
 // Pinned previous-release -> current-build on-disk compatibility.
 #[cfg(test)]
 mod upgrade_compatibility_test;
@@ -80,12 +70,6 @@ mod upgrade_compatibility_test;
 #[cfg(test)]
 mod replication_lww_receiver_test;
 
-// Outbound target matrix: every object shape against every remote-target
-// failure mode the fake target models (SOP:
-// docs/postmortems/2026-09-03-replication-checksum-default-regression.md).
-#[cfg(test)]
-mod replication_target_matrix_test;
-
 // Data usage regression tests
 #[cfg(test)]
 mod data_usage_test;
@@ -180,10 +164,6 @@ mod delete_objects_versioning_test;
 #[cfg(test)]
 mod delete_object_no_content_length_test;
 
-// Regression test for signed empty PutObject requests without Content-Length.
-#[cfg(test)]
-mod put_object_no_content_length_test;
-
 // Delete-marker visibility baseline for data-movement migration proof.
 #[cfg(test)]
 mod delete_marker_migration_semantics_test;
@@ -218,10 +198,6 @@ mod cluster_multidrive_pool_test;
 #[cfg(test)]
 mod inline_fast_path_cluster_test;
 
-// backlog#2207: two-node gate for the cluster-authoritative tier stats contract.
-#[cfg(test)]
-mod tier_stats_cluster_test;
-
 // PutObject / MultipartUpload with checksum (Content-MD5, x-amz-checksum-*)
 #[cfg(test)]
 mod checksum_upload_test;
@@ -365,11 +341,6 @@ mod delete_regression_test;
 #[cfg(test)]
 mod listing_regression_test;
 
-// Cluster regression: objects committed at degraded write quorum must stay
-// listable while a different drive is offline (CI run 33478999853).
-#[cfg(test)]
-mod degraded_listing_availability_test;
-
 // P1 regression: bucket statistics accuracy (rustfs#5615, #5008, #5116, #5055, #3898, #1012)
 #[cfg(test)]
 mod bucket_stats_regression_test;

crates/e2e_test/src/multipart_auth_test.rs

@@ -15,7 +15,7 @@
 //! Regression coverage for anonymous access on multipart control APIs.
 
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
-use async_compression::tokio::write::{BzEncoder, Lz4Encoder, XzEncoder};
+use async_compression::tokio::write::{BzEncoder, XzEncoder};
 use aws_sdk_s3::error::{ProvideErrorMetadata, SdkError};
 use aws_sdk_s3::operation::head_object::HeadObjectOutput;
 use aws_sdk_s3::primitives::ByteStream;
@@ -23,10 +23,7 @@ use aws_sdk_s3::types::{
     ServerSideEncryption, ServerSideEncryptionByDefault, ServerSideEncryptionConfiguration, ServerSideEncryptionRule,
 };
 use chrono::{Duration as ChronoDuration, Utc};
-use flate2::{
+use flate2::{Compression, write::GzEncoder};
-    Compression,
-    write::{GzEncoder, ZlibEncoder},
-};
 use http::HeaderValue;
 use http::header::{CONTENT_TYPE, HOST};
 use md5::{Digest as Md5Digest, Md5};
@@ -190,12 +187,6 @@ fn gzip_bytes(data: &[u8]) -> Vec<u8> {
     encoder.finish().expect("gzip encoder should finish")
 }
 
-fn zlib_bytes(data: &[u8]) -> Vec<u8> {
-    let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
-    encoder.write_all(data).expect("zlib encoder should accept input");
-    encoder.finish().expect("zlib encoder should finish")
-}
-
 fn zstd_bytes(data: &[u8]) -> Vec<u8> {
     let mut encoder = zstd::Encoder::new(Vec::new(), 0).expect("zstd encoder should initialize");
     encoder.write_all(data).expect("zstd encoder should accept input");
@@ -218,45 +209,6 @@ async fn xz_bytes(data: &[u8]) -> Vec<u8> {
     encoder.into_inner().into_inner()
 }
 
-async fn lz4_bytes(data: &[u8]) -> Vec<u8> {
-    let cursor = Cursor::new(Vec::new());
-    let mut encoder = Lz4Encoder::new(cursor);
-    encoder.write_all(data).await.expect("LZ4 encoder should accept input");
-    encoder.shutdown().await.expect("LZ4 encoder should finish");
-    encoder.into_inner().into_inner()
-}
-
-/// Encode the S2 framed stream shape emitted by minio-go PutObjectsSnowball
-/// with `Compress: true`: 1 MiB independent blocks, better compression,
-/// masked CRC-32C, and the `S2sTwO` stream identifier.
-fn minio_go_snowball_s2_bytes(data: &[u8]) -> Vec<u8> {
-    const BLOCK_SIZE: usize = 1 << 20;
-    const CHECKSUM_SIZE: usize = 4;
-
-    let mut output = b"\xff\x06\x00\x00S2sTwO".to_vec();
-    let mut encoder = minlz::Encoder::new();
-    for block in data.chunks(BLOCK_SIZE) {
-        let compressed = encoder.encode_better(block);
-        let compressed_limit = block.len().saturating_sub(block.len() / 32).saturating_sub(5);
-        let (chunk_type, payload) = if compressed.len() <= compressed_limit {
-            (0x00, compressed.as_slice())
-        } else {
-            (0x01, block)
-        };
-        let chunk_len = payload.len() + CHECKSUM_SIZE;
-        assert!(chunk_len < 1 << 24, "S2 fixture chunk must fit the 24-bit frame length");
-        output.extend_from_slice(&[
-            chunk_type,
-            (chunk_len & 0xff) as u8,
-            ((chunk_len >> 8) & 0xff) as u8,
-            ((chunk_len >> 16) & 0xff) as u8,
-        ]);
-        output.extend_from_slice(&minlz::crc::crc(block).to_le_bytes());
-        output.extend_from_slice(payload);
-    }
-    output
-}
-
 fn assert_s3_error_code<T, E>(result: Result<T, SdkError<E>>, code: &str)
 where
     T: std::fmt::Debug,
@@ -3504,62 +3456,6 @@ async fn test_signed_put_object_extract_expands_tar_entries_with_prefix_headers(
     Ok(())
 }
 
-#[tokio::test]
-async fn test_signed_put_object_extract_ignore_dirs_skips_unauthorized_directory()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "signed-extract-ignore-dirs-auth";
-    let archive_key = "bundle.tar";
-    let allowed_member = "allowed/member.txt";
-    let denied_directory = "denied/";
-    let username = "snowball-ignore-dirs";
-    let secret_key = "snowball-ignore-dirs-secret";
-    let expected_body = b"allowed-body";
-
-    let admin_client = env.create_s3_client();
-    admin_client.create_bucket().bucket(bucket).send().await?;
-    create_restricted_user(&env, username, secret_key).await?;
-
-    let policy = serde_json::json!({
-        "Version": "2012-10-17",
-        "Statement": [{
-            "Effect": "Allow",
-            "Principal": { "AWS": [username] },
-            "Action": ["s3:PutObject"],
-            "Resource": [
-                format!("arn:aws:s3:::{bucket}/{archive_key}"),
-                format!("arn:aws:s3:::{bucket}/{allowed_member}")
-            ]
-        }]
-    })
-    .to_string();
-    admin_client.put_bucket_policy().bucket(bucket).policy(policy).send().await?;
-
-    let restricted_client = restricted_user_client(&env, username, secret_key);
-    let tar_bytes = make_tar(&[(allowed_member, expected_body)], &[denied_directory]).await;
-    restricted_client
-        .put_object()
-        .bucket(bucket)
-        .key(archive_key)
-        .body(ByteStream::from(tar_bytes))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-            req.headers_mut().insert("x-amz-meta-snowball-ignore-dirs", "true");
-        })
-        .send()
-        .await?;
-
-    let stored = admin_client.get_object().bucket(bucket).key(allowed_member).send().await?;
-    assert_eq!(stored.body.collect().await?.into_bytes().as_ref(), expected_body);
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn test_signed_put_object_extract_preserves_request_metadata_on_extracted_objects()
 -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
@@ -4289,60 +4185,6 @@ async fn test_signed_put_object_extract_returns_archive_etag() -> Result<(), Box
     Ok(())
 }
 
-#[tokio::test]
-async fn test_signed_put_object_extract_expands_s2_and_lz4_by_magic_with_raw_etags()
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-
-    let mut env = RustFSTestEnvironment::new().await?;
-    env.start_rustfs_server(vec![]).await?;
-
-    let bucket = "signed-extract-magic-codecs";
-    let client = env.create_s3_client();
-    client.create_bucket().bucket(bucket).send().await?;
-
-    let s2_tar = make_tar(&[("s2/object.txt", b"s2-body")], &[]).await;
-    let s2_archive = minio_go_snowball_s2_bytes(&s2_tar);
-    let expected_s2_etag = format!("\"{}\"", md5_hex(&s2_archive));
-    let s2_response = client
-        .put_object()
-        .bucket(bucket)
-        // minio-go intentionally uploads a compressed S2 stream with a .tar key.
-        .key("snowball-upload-0123456789abcdef.tar")
-        .body(ByteStream::from(s2_archive))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-        })
-        .send()
-        .await?;
-    assert_eq!(s2_response.e_tag(), Some(expected_s2_etag.as_str()));
-
-    let s2_object = client.get_object().bucket(bucket).key("s2/object.txt").send().await?;
-    assert_eq!(s2_object.body.collect().await?.into_bytes().as_ref(), b"s2-body");
-
-    let lz4_tar = make_tar(&[("lz4/object.txt", b"lz4-body")], &[]).await;
-    let lz4_archive = lz4_bytes(&lz4_tar).await;
-    let expected_lz4_etag = format!("\"{}\"", md5_hex(&lz4_archive));
-    let lz4_response = client
-        .put_object()
-        .bucket(bucket)
-        .key("also-looks-like-a-plain.tar")
-        .body(ByteStream::from(lz4_archive))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-        })
-        .send()
-        .await?;
-    assert_eq!(lz4_response.e_tag(), Some(expected_lz4_etag.as_str()));
-
-    let lz4_object = client.get_object().bucket(bucket).key("lz4/object.txt").send().await?;
-    assert_eq!(lz4_object.body.collect().await?.into_bytes().as_ref(), b"lz4-body");
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn test_signed_put_object_extract_preserves_entry_mtime() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     init_logging();
@@ -4467,15 +4309,9 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
     let context_archive_resources = [
         format!("arn:aws:s3:::{bucket}/tag-context.tar"),
         format!("arn:aws:s3:::{bucket}/lock-context.tar"),
-        format!("arn:aws:s3:::{bucket}/legal-hold-context.tar"),
-        format!("arn:aws:s3:::{bucket}/user-agent-bypass.tar"),
-        format!("arn:aws:s3:::{bucket}/sse-bypass.tar"),
     ];
     let tag_entry_resource = format!("arn:aws:s3:::{bucket}/tag-context-entry.txt");
     let lock_entry_resource = format!("arn:aws:s3:::{bucket}/lock-context-entry.txt");
-    let legal_hold_entry_resource = format!("arn:aws:s3:::{bucket}/legal-hold-context-entry.txt");
-    let user_agent_entry_resource = format!("arn:aws:s3:::{bucket}/user-agent-bypass-entry.txt");
-    let sse_entry_resource = format!("arn:aws:s3:::{bucket}/sse-bypass-entry.txt");
     let policy = serde_json::json!({
         "Version": "2012-10-17",
         "Statement": [
@@ -4535,7 +4371,7 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
                 "Sid": "PaxContextArchives",
                 "Effect": "Allow",
                 "Principal": { "AWS": [pax_context_user] },
-                "Action": ["s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectLegalHold", "s3:PutObjectTagging"],
+                "Action": ["s3:PutObject", "s3:PutObjectRetention", "s3:PutObjectTagging"],
                 "Resource": context_archive_resources
             },
             {
@@ -4575,49 +4411,6 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
                 "Principal": { "AWS": [pax_context_user] },
                 "Action": ["s3:PutObjectRetention"],
                 "Resource": [lock_entry_resource]
-            },
-            {
-                "Sid": "PaxLegalHoldContextPut",
-                "Effect": "Allow",
-                "Principal": { "AWS": [pax_context_user] },
-                "Action": ["s3:PutObject"],
-                "Resource": [legal_hold_entry_resource.clone()]
-            },
-            {
-                "Sid": "PaxLegalHoldContextAction",
-                "Effect": "Allow",
-                "Principal": { "AWS": [pax_context_user] },
-                "Action": ["s3:PutObjectLegalHold"],
-                "Resource": [legal_hold_entry_resource],
-                "Condition": {
-                    "StringEquals": {
-                        "s3:object-lock-legal-hold": "OFF"
-                    }
-                }
-            },
-            {
-                "Sid": "MemberUserAgentCondition",
-                "Effect": "Allow",
-                "Principal": { "AWS": [pax_context_user] },
-                "Action": ["s3:PutObject"],
-                "Resource": [user_agent_entry_resource],
-                "Condition": {
-                    "StringEquals": {
-                        "aws:UserAgent": "trusted"
-                    }
-                }
-            },
-            {
-                "Sid": "MemberSseCondition",
-                "Effect": "Allow",
-                "Principal": { "AWS": [pax_context_user] },
-                "Action": ["s3:PutObject"],
-                "Resource": [sse_entry_resource],
-                "Condition": {
-                    "StringEquals": {
-                        "s3:x-amz-server-side-encryption": "AES256"
-                    }
-                }
             }
         ]
     })
@@ -4630,13 +4423,8 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
     let cases = [
         (
             "legal-hold.tar",
-            put_only_client.clone(),
-            HashMap::from([("minio.metadata.x-amz-object-lock-legal-hold", "ON".to_string())]),
-        ),
-        (
-            "tagging.tar",
             put_only_client,
-            HashMap::from([("minio.metadata.x-amz-tagging", "classification=restricted".to_string())]),
+            HashMap::from([("minio.metadata.x-amz-object-lock-legal-hold", "ON".to_string())]),
         ),
         (
             "retention-condition.tar",
@@ -4724,57 +4512,6 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
     assert_eq!(stored.body.collect().await?.into_bytes().as_ref(), b"condition-body");
 
     let pax_context_client = restricted_user_client(&env, pax_context_user, pax_context_secret);
-    for (archive_key, entry_key, pax_key, injected_value, outer_user_agent) in [
-        (
-            "user-agent-bypass.tar",
-            "user-agent-bypass-entry.txt",
-            "minio.metadata.user-agent",
-            "trusted",
-            Some("untrusted"),
-        ),
-        (
-            "sse-bypass.tar",
-            "sse-bypass-entry.txt",
-            "minio.metadata.x-amz-server-side-encryption",
-            "AES256",
-            None,
-        ),
-    ] {
-        let pax = HashMap::from([(pax_key, injected_value.to_string())]);
-        let archive = make_tar_with_pax_entry(entry_key, b"must-not-write", None, &pax).await;
-        let err = pax_context_client
-            .put_object()
-            .bucket(bucket)
-            .key(archive_key)
-            .body(ByteStream::from(archive))
-            .customize()
-            .mutate_request(move |req| {
-                req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-                if let Some(user_agent) = outer_user_agent {
-                    req.headers_mut().insert("user-agent", user_agent);
-                }
-            })
-            .send()
-            .await
-            .expect_err("PAX metadata must not satisfy unrelated IAM request conditions");
-        assert_eq!(
-            err.as_service_error().and_then(|error| error.meta().code()),
-            Some("AccessDenied"),
-            "{archive_key}"
-        );
-        let err = admin_client
-            .head_object()
-            .bucket(bucket)
-            .key(entry_key)
-            .send()
-            .await
-            .expect_err("a denied PAX member must not be written");
-        assert!(matches!(
-            err.as_service_error().and_then(|error| error.meta().code()),
-            Some("NoSuchKey" | "NotFound")
-        ));
-    }
-
     let tag_pax = HashMap::from([("minio.metadata.x-amz-tagging", "classification=public".to_string())]);
     let archive = make_tar_with_pax_entry("tag-context-entry.txt", b"tag-context-body", None, &tag_pax).await;
     pax_context_client
@@ -4838,34 +4575,6 @@ async fn test_signed_put_object_extract_authorizes_each_pax_privilege_and_retent
         pax_retain_until
     );
 
-    let legal_hold_pax = HashMap::from([("minio.metadata.x-amz-object-lock-legal-hold", "ON".to_string())]);
-    let archive = make_tar_with_pax_entry("legal-hold-context-entry.txt", b"must-not-write", None, &legal_hold_pax).await;
-    let err = pax_context_client
-        .put_object()
-        .bucket(bucket)
-        .key("legal-hold-context.tar")
-        .object_lock_legal_hold_status(aws_sdk_s3::types::ObjectLockLegalHoldStatus::Off)
-        .body(ByteStream::from(archive))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-        })
-        .send()
-        .await
-        .expect_err("PAX legal hold must replace the outer value in the member IAM condition context");
-    assert_eq!(err.as_service_error().and_then(|error| error.meta().code()), Some("AccessDenied"));
-    let err = admin_client
-        .head_object()
-        .bucket(bucket)
-        .key("legal-hold-context-entry.txt")
-        .send()
-        .await
-        .expect_err("a denied PAX legal-hold member must not be written");
-    assert!(matches!(
-        err.as_service_error().and_then(|error| error.meta().code()),
-        Some("NoSuchKey" | "NotFound")
-    ));
-
     Ok(())
 }
 
@@ -5341,8 +5050,8 @@ async fn test_signed_put_object_extract_expands_tzst_archive() -> Result<(), Box
 }
 
 #[tokio::test]
-async fn test_signed_put_object_extract_uses_magic_without_requiring_or_trusting_extension()
+async fn test_signed_put_object_extract_rejects_missing_archive_extension() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
--> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+{
     init_logging();
 
     let mut env = RustFSTestEnvironment::new().await?;
@@ -5355,7 +5064,8 @@ async fn test_signed_put_object_extract_uses_magic_without_requiring_or_trusting
     admin_client.create_bucket().bucket(bucket).send().await?;
 
     let tar_bytes = make_tar(&[("plain.txt", b"plain-body")], &[]).await;
-    admin_client
+
+    let result = admin_client
         .put_object()
         .bucket(bucket)
         .key(archive_key)
@@ -5365,80 +5075,15 @@ async fn test_signed_put_object_extract_uses_magic_without_requiring_or_trusting
             req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
         })
         .send()
-        .await?;
+        .await;
 
-    let plain = admin_client.get_object().bucket(bucket).key("plain.txt").send().await?;
+    assert_s3_error_code(result, "InvalidArgument");
-    assert_eq!(plain.body.collect().await?.into_bytes().as_ref(), b"plain-body");
-
-    let raw_with_gzip_suffix = make_tar(&[("raw-with-wrong-suffix.txt", b"raw-body")], &[]).await;
-    admin_client
-        .put_object()
-        .bucket(bucket)
-        .key("raw-but-named.tar.gz")
-        .body(ByteStream::from(raw_with_gzip_suffix))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-        })
-        .send()
-        .await?;
-
-    let raw = admin_client
-        .get_object()
-        .bucket(bucket)
-        .key("raw-with-wrong-suffix.txt")
-        .send()
-        .await?;
-    assert_eq!(raw.body.collect().await?.into_bytes().as_ref(), b"raw-body");
-
-    let gzip_with_tar_suffix = gzip_bytes(&make_tar(&[("gzip-with-wrong-suffix.txt", b"gzip-body")], &[]).await);
-    admin_client
-        .put_object()
-        .bucket(bucket)
-        .key("gzip-but-named.tar")
-        .body(ByteStream::from(gzip_with_tar_suffix))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-        })
-        .send()
-        .await?;
-
-    let gzip = admin_client
-        .get_object()
-        .bucket(bucket)
-        .key("gzip-with-wrong-suffix.txt")
-        .send()
-        .await?;
-    assert_eq!(gzip.body.collect().await?.into_bytes().as_ref(), b"gzip-body");
-
-    let zlib_archive = zlib_bytes(&make_tar(&[("zlib-extension.txt", b"zlib-body")], &[]).await);
-    admin_client
-        .put_object()
-        .bucket(bucket)
-        .key("bundle.zlib")
-        .body(ByteStream::from(zlib_archive))
-        .customize()
-        .mutate_request(|req| {
-            req.headers_mut().insert("x-amz-meta-snowball-auto-extract", "true");
-        })
-        .send()
-        .await?;
-
-    let zlib = admin_client
-        .get_object()
-        .bucket(bucket)
-        .key("zlib-extension.txt")
-        .send()
-        .await?;
-    assert_eq!(zlib.body.collect().await?.into_bytes().as_ref(), b"zlib-body");
 
     Ok(())
 }
 
 #[tokio::test]
-async fn test_signed_put_object_extract_rejects_invalid_archive_payload() -> Result<(), Box<dyn std::error::Error + Send + Sync>>
+async fn test_signed_put_object_extract_rejects_invalid_tar_gz_payload() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-{
     init_logging();
 
     let mut env = RustFSTestEnvironment::new().await?;

crates/e2e_test/src/negative_sigv4_test.rs

@@ -36,10 +36,9 @@
 use crate::common::{RustFSTestEnvironment, init_logging, local_http_client};
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::ByteStream;
-use rustfs_signer::constants::{UNSIGNED_PAYLOAD, UNSIGNED_PAYLOAD_TRAILER};
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
 use rustfs_signer::request_signature_v4::{SIGN_V4_ALGORITHM, get_scope, get_signature, get_signing_key};
 use std::fmt::Write as _;
-use std::io::Cursor;
 use time::macros::format_description;
 use time::{Duration, OffsetDateTime};
 use tracing::info;
@@ -99,37 +98,15 @@ impl SigV4 {
     /// header AND folded into the canonical request — pass the hash of the
     /// body you *claim* to send, which may differ from what you actually send.
     fn sign(&self, method: &str, path: &str, canonical_query: &str, content_sha256: &str) -> SignedHeaders {
-        self.sign_with_extra_headers(method, path, canonical_query, content_sha256, &[])
-    }
-
-    /// Sign additional request headers while preserving SigV4's lowercase,
-    /// lexicographically sorted canonical-header representation.
-    fn sign_with_extra_headers(
-        &self,
-        method: &str,
-        path: &str,
-        canonical_query: &str,
-        content_sha256: &str,
-        extra_signed_headers: &[(&str, &str)],
-    ) -> SignedHeaders {
         let amz_date = amz_datetime(self.time);
-        let mut canonical_header_values = vec![
+        let signed_headers = "host;x-amz-content-sha256;x-amz-date";
-            ("host", self.host.as_str()),
-            ("x-amz-content-sha256", content_sha256),
-            ("x-amz-date", amz_date.as_str()),
-        ];
-        canonical_header_values.extend(extra_signed_headers.iter().copied());
-        canonical_header_values.sort_unstable_by(|left, right| left.0.cmp(right.0));
 
-        let signed_headers = canonical_header_values
+        let canonical_headers = format!(
-            .iter()
+            "host:{host}\nx-amz-content-sha256:{sha}\nx-amz-date:{date}\n",
-            .map(|(name, _)| *name)
+            host = self.host,
-            .collect::<Vec<_>>()
+            sha = content_sha256,
-            .join(";");
+            date = amz_date,
-        let mut canonical_headers = String::new();
+        );
-        for (name, value) in canonical_header_values {
-            let _ = writeln!(canonical_headers, "{name}:{value}");
-        }
         let canonical_request =
             format!("{method}\n{path}\n{canonical_query}\n{canonical_headers}\n{signed_headers}\n{content_sha256}");
 
@@ -202,34 +179,6 @@ async fn setup(env: &mut RustFSTestEnvironment) -> Result<(), Box<dyn std::error
     Ok(())
 }
 
-async fn build_single_member_archive(
-    member_key: &str,
-    member_body: &[u8],
-) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync>> {
-    let mut builder = tokio_tar::Builder::new(Cursor::new(Vec::new()));
-    let mut header = tokio_tar::Header::new_gnu();
-    header.set_size(member_body.len() as u64);
-    header.set_mode(0o644);
-    header.set_cksum();
-    builder.append_data(&mut header, member_key, Cursor::new(member_body)).await?;
-    Ok(builder.into_inner().await?.into_inner())
-}
-
-fn sha256_base64(data: &[u8]) -> String {
-    use sha2::{Digest, Sha256};
-
-    base64_simd::STANDARD.encode_to_string(Sha256::digest(data))
-}
-
-fn encode_unsigned_aws_chunked_with_sha256_trailer(decoded: &[u8]) -> Vec<u8> {
-    let checksum = sha256_base64(decoded);
-    let mut encoded = format!("{:x}\r\n", decoded.len()).into_bytes();
-    encoded.extend_from_slice(decoded);
-    encoded.extend_from_slice(b"\r\n0\r\n");
-    encoded.extend_from_slice(format!("x-amz-checksum-sha256:{checksum}\r\n\r\n").as_bytes());
-    encoded
-}
-
 /// Positive control: a correctly hand-signed request must succeed. Without
 /// this, every negative assertion below could pass for the wrong reason (a
 /// broken signer that never produces a valid signature).
@@ -300,128 +249,6 @@ async fn tampered_signature_returns_signature_does_not_match() -> Result<(), Box
     Ok(())
 }
 
-/// `STREAMING-UNSIGNED-PAYLOAD-TRAILER` disables per-chunk signatures, not the
-/// seed/header SigV4 signature. A forged request must be rejected before the
-/// Snowball handler can publish any archive member.
-#[tokio::test]
-async fn snowball_streaming_unsigned_trailer_rejects_forged_signature() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    setup(&mut env).await?;
-
-    let archive_key = "forged-streaming-snowball.tar";
-    let member_key = "must-not-be-published.txt";
-    let archive = build_single_member_archive(member_key, b"forged request payload").await?;
-    let decoded_content_length = archive.len().to_string();
-    let encoded_body = encode_unsigned_aws_chunked_with_sha256_trailer(&archive);
-    let path = format!("/{BUCKET}/{archive_key}");
-
-    let mut signer = SigV4::new(&env);
-    signer.secret_key = "wrong-secret-for-forged-streaming-request".to_string();
-    let extra_signed_headers = [
-        ("content-encoding", "aws-chunked"),
-        ("x-amz-decoded-content-length", decoded_content_length.as_str()),
-        ("x-amz-meta-snowball-auto-extract", "true"),
-        ("x-amz-trailer", "x-amz-checksum-sha256"),
-    ];
-    let headers = signer.sign_with_extra_headers("PUT", &path, "", UNSIGNED_PAYLOAD_TRAILER, &extra_signed_headers);
-
-    let response = local_http_client()
-        .put(format!("{}{}", env.url, path))
-        .header("authorization", &headers.authorization)
-        .header("content-encoding", "aws-chunked")
-        .header("x-amz-content-sha256", &headers.content_sha256)
-        .header("x-amz-date", &headers.amz_date)
-        .header("x-amz-decoded-content-length", &decoded_content_length)
-        .header("x-amz-meta-snowball-auto-extract", "true")
-        .header("x-amz-trailer", "x-amz-checksum-sha256")
-        .body(encoded_body)
-        .send()
-        .await?;
-    let status = response.status();
-    let body = response.text().await?;
-    assert_eq!(status.as_u16(), 403, "forged streaming signature must be 403, body:\n{body}");
-    assert_error_code(&body, "SignatureDoesNotMatch");
-
-    let absent = env
-        .create_s3_client()
-        .get_object()
-        .bucket(BUCKET)
-        .key(member_key)
-        .send()
-        .await
-        .expect_err("a forged streaming request must not publish a Snowball member");
-    assert_eq!(absent.raw_response().map(|response| response.status().as_u16()), Some(404));
-    assert_eq!(absent.as_service_error().and_then(ProvideErrorMetadata::code), Some("NoSuchKey"));
-
-    env.stop_server();
-    Ok(())
-}
-
-/// Snowball must consume the complete aws-chunked body before reading the
-/// trailing checksum exported by s3s into the PutObject response.
-#[tokio::test]
-async fn snowball_streaming_unsigned_trailer_returns_sha256_checksum() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    setup(&mut env).await?;
-
-    let archive_key = "valid-streaming-snowball.tar";
-    let member_key = "streaming-checksum-member.txt";
-    let member_body = b"valid streaming Snowball payload";
-    let archive = build_single_member_archive(member_key, member_body).await?;
-    let expected_checksum = sha256_base64(&archive);
-    let decoded_content_length = archive.len().to_string();
-    let encoded_body = encode_unsigned_aws_chunked_with_sha256_trailer(&archive);
-    let path = format!("/{BUCKET}/{archive_key}");
-
-    let signer = SigV4::new(&env);
-    let extra_signed_headers = [
-        ("content-encoding", "aws-chunked"),
-        ("x-amz-decoded-content-length", decoded_content_length.as_str()),
-        ("x-amz-meta-snowball-auto-extract", "true"),
-        ("x-amz-sdk-checksum-algorithm", "SHA256"),
-        ("x-amz-trailer", "x-amz-checksum-sha256"),
-    ];
-    let headers = signer.sign_with_extra_headers("PUT", &path, "", UNSIGNED_PAYLOAD_TRAILER, &extra_signed_headers);
-
-    let response = local_http_client()
-        .put(format!("{}{}", env.url, path))
-        .header("authorization", &headers.authorization)
-        .header("content-encoding", "aws-chunked")
-        .header("x-amz-content-sha256", &headers.content_sha256)
-        .header("x-amz-date", &headers.amz_date)
-        .header("x-amz-decoded-content-length", &decoded_content_length)
-        .header("x-amz-meta-snowball-auto-extract", "true")
-        .header("x-amz-sdk-checksum-algorithm", "SHA256")
-        .header("x-amz-trailer", "x-amz-checksum-sha256")
-        .body(encoded_body)
-        .send()
-        .await?;
-    let status = response.status();
-    let response_checksum = response
-        .headers()
-        .get("x-amz-checksum-sha256")
-        .and_then(|value| value.to_str().ok())
-        .map(str::to_owned);
-    let response_body = response.text().await?;
-    assert_eq!(status.as_u16(), 200, "valid streaming Snowball PUT failed, body:\n{response_body}");
-    assert_eq!(response_checksum.as_deref(), Some(expected_checksum.as_str()));
-
-    let member = env
-        .create_s3_client()
-        .get_object()
-        .bucket(BUCKET)
-        .key(member_key)
-        .send()
-        .await?;
-    let stored = member.body.collect().await?.into_bytes();
-    assert_eq!(stored.as_ref(), member_body);
-
-    env.stop_server();
-    Ok(())
-}
-
 /// (b) A valid AccessKeyId paired with the wrong secret key must be rejected
 /// with SignatureDoesNotMatch / 403.
 #[tokio::test]
@@ -549,68 +376,6 @@ async fn tampered_upload_part_payload_is_rejected() -> Result<(), Box<dyn std::e
     Ok(())
 }
 
-/// s3s v0.16 validates the aws-chunked decoded length while RustFS consumes the
-/// body stream. Mismatches are client body errors and must not leak as 500s.
-#[tokio::test]
-async fn aws_chunked_decoded_length_mismatch_returns_incomplete_body() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    init_logging();
-    let mut env = RustFSTestEnvironment::new().await?;
-    setup(&mut env).await?;
-
-    for (key, declared_len) in [
-        ("decoded-length-overrun.bin", 3_usize),
-        ("decoded-length-shortfall.bin", 9_usize),
-    ] {
-        let decoded = b"decoded";
-        assert_ne!(declared_len, decoded.len(), "test case must exercise a mismatch");
-        let encoded_body = encode_unsigned_aws_chunked_with_sha256_trailer(decoded);
-        let decoded_content_length = declared_len.to_string();
-        let path = format!("/{BUCKET}/{key}");
-        let signer = SigV4::new(&env);
-        let extra_signed_headers = [
-            ("content-encoding", "aws-chunked"),
-            ("x-amz-decoded-content-length", decoded_content_length.as_str()),
-            ("x-amz-trailer", "x-amz-checksum-sha256"),
-        ];
-        let headers = signer.sign_with_extra_headers("PUT", &path, "", UNSIGNED_PAYLOAD_TRAILER, &extra_signed_headers);
-
-        let response = local_http_client()
-            .put(format!("{}{}", env.url, path))
-            .header("authorization", &headers.authorization)
-            .header("content-encoding", "aws-chunked")
-            .header("x-amz-content-sha256", &headers.content_sha256)
-            .header("x-amz-date", &headers.amz_date)
-            .header("x-amz-decoded-content-length", &decoded_content_length)
-            .header("x-amz-trailer", "x-amz-checksum-sha256")
-            .body(encoded_body)
-            .timeout(std::time::Duration::from_secs(10))
-            .send()
-            .await?;
-        let status = response.status();
-        let body = response.text().await.unwrap_or_default();
-        assert_eq!(
-            status,
-            reqwest::StatusCode::BAD_REQUEST,
-            "decoded length mismatch must be a client error, body:\n{body}"
-        );
-        assert_error_code(&body, "IncompleteBody");
-
-        let absent = env
-            .create_s3_client()
-            .get_object()
-            .bucket(BUCKET)
-            .key(key)
-            .send()
-            .await
-            .expect_err("decoded length mismatch must not publish an object");
-        assert_eq!(absent.raw_response().map(|response| response.status().as_u16()), Some(404));
-        assert_eq!(absent.as_service_error().and_then(ProvideErrorMetadata::code), Some("NoSuchKey"));
-    }
-
-    env.stop_server();
-    Ok(())
-}
-
 /// (e) A request whose `x-amz-date` is skewed beyond the server's tolerance
 /// (s3s default 900s / 15 min) must be rejected with RequestTimeTooSkewed /
 /// 403. The signature is otherwise valid: the credential-scope date and

crates/e2e_test/src/notification_webhook_test.rs

@@ -38,10 +38,14 @@ use aws_sdk_s3::types::{
     NotificationConfiguration, NotificationConfigurationFilter, ObjectIdentifier, QueueConfiguration, S3KeyFilter,
     VersioningConfiguration,
 };
+use http::header::{CONTENT_TYPE, HOST};
 use local_ip_address::local_ip;
 use reqwest::StatusCode;
+use rustfs_signer::constants::UNSIGNED_PAYLOAD;
+use rustfs_signer::sign_v4;
 use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
 use rustfs_utils::http::headers::{AMZ_REQUEST_ID, REQUEST_ID_HEADER};
+use s3s::Body;
 use serde_json::Value;
 use std::error::Error;
 use std::io::Cursor;
@@ -411,16 +415,42 @@ async fn collect_until(
 // Admin target configuration (signed admin HTTP)
 // ---------------------------------------------------------------------------
 
-/// Thin wrapper over [`crate::common::signed_request`] with this suite's
-/// root credentials; a `Some` body is always JSON here.
 async fn signed_admin_request(
     env: &RustFSTestEnvironment,
     method: http::Method,
     url: &str,
     body: Option<Vec<u8>>,
 ) -> Result<reqwest::Response, BoxError> {
-    let content_type = body.is_some().then_some("application/json");
+    let uri = url.parse::<http::Uri>()?;
-    crate::common::signed_request(method, url, &env.access_key, &env.secret_key, body, content_type).await
+    let authority = uri.authority().ok_or("admin URL missing authority")?.to_string();
+    let mut builder = http::Request::builder()
+        .method(method.clone())
+        .uri(uri)
+        .header(HOST, authority)
+        .header("x-amz-content-sha256", UNSIGNED_PAYLOAD);
+    if body.is_some() {
+        builder = builder.header(CONTENT_TYPE, "application/json");
+    }
+
+    let content_len = body.as_ref().map(|b| b.len() as i64).unwrap_or_default();
+    let signed = sign_v4(
+        builder.body(Body::empty())?,
+        content_len,
+        &env.access_key,
+        &env.secret_key,
+        "",
+        "us-east-1",
+    );
+
+    let reqwest_method = reqwest::Method::from_bytes(method.as_str().as_bytes())?;
+    let mut request = crate::common::local_http_client().request(reqwest_method, url);
+    for (name, value) in signed.headers() {
+        request = request.header(name, value);
+    }
+    if let Some(body) = body {
+        request = request.body(body);
+    }
+    Ok(request.send().await?)
 }
 
 async fn enable_notify_module(env: &RustFSTestEnvironment) -> TestResult {

crates/e2e_test/src/on_demand_migration/backfill_test.rs

@@ -1,254 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! On-demand migration backfill job scenarios (ODM-12, rustfs/backlog#2159):
-//! a full backfill of a small-object source, cancellation, and resuming from
-//! the persisted continuation token after a server restart.
-
-use super::common::{BackfillOp, BackfillRequest, ODM_SERVER_ENV, OdmSourceSpec, OdmTestEnv, SeedObject};
-use crate::fake_s3_target::Operation;
-use bytes::Bytes;
-use std::time::Duration;
-
-type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
-
-const SOURCE_BUCKET: &str = "odm-backfill-source";
-const LOCAL_BUCKET: &str = "odm-backfill-local";
-const KEY_PREFIX: &str = "cold/";
-/// Keys per scenario. The fake source retains at most 4,096 object versions
-/// and 4,096 journal entries, and one pull is a HEAD plus a GET, so a
-/// scenario that asserts on the journal stays below ~2,000 keys. The job
-/// lists 1,000 keys per page, so this still spans several pages and exercises
-/// the continuation token, which is what the scenarios are about.
-const SEEDED_KEYS: usize = 1500;
-
-fn key(i: usize) -> String {
-    format!("{KEY_PREFIX}{i:05}")
-}
-
-/// Content that identifies the key so a mis-stored object is caught.
-fn body(i: usize) -> Bytes {
-    Bytes::from(format!("object-{i:05}-payload"))
-}
-
-fn seed(env: &OdmTestEnv, count: usize) {
-    let objects: Vec<SeedObject> = (0..count).map(|i| SeedObject::new(key(i), body(i))).collect();
-    let etags = env.seed_source(SOURCE_BUCKET, &objects);
-    assert_eq!(etags.len(), count);
-}
-
-async fn configure(env: &OdmTestEnv, spec: &OdmSourceSpec) -> TestResult {
-    let response = env.configure_source(LOCAL_BUCKET, spec).await?;
-    assert_eq!(response.status, 200, "configure: {}", response.body);
-    // The probe issued a one-key listing; count only the job's traffic.
-    env.source.take_requests();
-    Ok(())
-}
-
-fn source_lists(env: &OdmTestEnv) -> Vec<Option<String>> {
-    env.source
-        .requests()
-        .into_iter()
-        .filter(|record| record.operation == Operation::ListObjectsV2)
-        .map(|record| record.continuation_token)
-        .collect()
-}
-
-fn source_gets(env: &OdmTestEnv) -> usize {
-    env.source
-        .requests()
-        .into_iter()
-        .filter(|record| record.operation == Operation::GetObject)
-        .count()
-}
-
-fn counter(job: &serde_json::Value, name: &str) -> u64 {
-    job[name].as_u64().unwrap_or_else(|| panic!("{name} missing in {job}"))
-}
-
-#[tokio::test]
-async fn backfill_pulls_every_source_object_across_list_pages() -> TestResult {
-    const COUNT: usize = SEEDED_KEYS;
-    let env = OdmTestEnv::start().await?;
-    env.source.create_bucket(SOURCE_BUCKET);
-    env.rustfs.create_test_bucket(LOCAL_BUCKET).await?;
-    seed(&env, COUNT);
-    configure(&env, &env.fake_source_spec(SOURCE_BUCKET)).await?;
-
-    let started = env.start_backfill(LOCAL_BUCKET, BackfillRequest::default()).await?;
-    assert_eq!(started.status, 200, "start: {}", started.body);
-    let job = started.json()?["job"].clone();
-    assert_eq!(job["state"], "running");
-    assert_eq!(job["skip_existing"], "always");
-    assert_eq!(job["dry_run"], false);
-    let job_id = job["job_id"].as_str().expect("job id").to_string();
-
-    // A second start while the job holds its lease is a conflict.
-    let again = env
-        .backfill(LOCAL_BUCKET, BackfillOp::Start(BackfillRequest::default()))
-        .await?;
-    assert_eq!(again.status, 409, "second start: {}", again.body);
-    assert!(again.body.contains("OnDemandMigrationBackfillRunning"), "{}", again.body);
-
-    let done = env
-        .wait_for_backfill(LOCAL_BUCKET, Duration::from_secs(240), |job| job["state"] == "completed")
-        .await?;
-    assert_eq!(done["job_id"], job_id.as_str());
-    assert_eq!(counter(&done, "listed"), COUNT as u64);
-    assert_eq!(counter(&done, "enqueued"), COUNT as u64);
-    assert_eq!(counter(&done, "pulled"), COUNT as u64);
-    assert_eq!(counter(&done, "failed"), 0);
-    assert_eq!(counter(&done, "skipped_existing"), 0);
-    assert!(done["continuation_token"].is_null(), "a finished job carries no cursor");
-    assert_eq!(done["last_key"], key(COUNT - 1));
-    assert!(done["failed_keys"].as_array().is_some_and(Vec::is_empty));
-    let expected_bytes: u64 = (0..COUNT).map(|i| body(i).len() as u64).sum();
-    assert_eq!(counter(&done, "bytes"), expected_bytes);
-
-    assert_eq!(env.local_key_count(LOCAL_BUCKET, KEY_PREFIX).await?, COUNT);
-    for i in [0, 999, 1000, 1200, COUNT - 1] {
-        env.assert_local_present(LOCAL_BUCKET, &key(i), &body(i)).await;
-    }
-
-    let lists = source_lists(&env);
-    assert_eq!(lists.len(), COUNT.div_ceil(1000), "{COUNT} keys at 1000 per page: {lists:?}");
-    assert!(lists[0].is_none(), "the first page starts without a cursor");
-    assert!(lists[1..].iter().all(Option::is_some), "every later page carries the cursor");
-    assert_eq!(source_gets(&env), COUNT, "every object is fetched exactly once");
-
-    // The status endpoint summarises the same job.
-    let status = env.status(LOCAL_BUCKET).await?;
-    assert_eq!(status.status, 200);
-    let summary = status.json()?["backfill"].clone();
-    assert_eq!(summary["job_id"], job_id.as_str());
-    assert_eq!(summary["state"], "completed");
-    assert_eq!(counter(&summary, "pulled"), COUNT as u64);
-    Ok(())
-}
-
-#[tokio::test]
-async fn backfill_cancel_stops_enqueueing_and_persists_cancelled() -> TestResult {
-    const COUNT: usize = SEEDED_KEYS;
-    let env = OdmTestEnv::start().await?;
-    env.source.create_bucket(SOURCE_BUCKET);
-    env.rustfs.create_test_bucket(LOCAL_BUCKET).await?;
-    seed(&env, COUNT);
-    let mut spec = env.fake_source_spec(SOURCE_BUCKET);
-    spec.policy.max_concurrent_pulls = 1;
-    configure(&env, &spec).await?;
-
-    // Cancelling before any job exists is a 404, not a silent success.
-    let nothing = env.backfill(LOCAL_BUCKET, BackfillOp::Cancel).await?;
-    assert_eq!(nothing.status, 404, "cancel without a job: {}", nothing.body);
-    assert!(nothing.body.contains("NoSuchBackfillJob"), "{}", nothing.body);
-    let unread = env.backfill(LOCAL_BUCKET, BackfillOp::Status).await?;
-    assert_eq!(unread.status, 404, "status without a job: {}", unread.body);
-
-    let started = env.start_backfill(LOCAL_BUCKET, BackfillRequest::default()).await?;
-    assert_eq!(started.status, 200, "start: {}", started.body);
-    env.wait_for_backfill(LOCAL_BUCKET, Duration::from_secs(60), |job| {
-        job["state"] == "running" && counter(job, "enqueued") > 0
-    })
-    .await?;
-
-    let cancelled = env.backfill(LOCAL_BUCKET, BackfillOp::Cancel).await?;
-    assert_eq!(cancelled.status, 200, "cancel: {}", cancelled.body);
-    let job = cancelled.json()?["job"].clone();
-    assert_eq!(job["state"], "cancelled");
-    let enqueued_at_cancel = counter(&job, "enqueued");
-    assert!(enqueued_at_cancel < COUNT as u64, "the job was cancelled mid-way: {job}");
-
-    // Nothing is queued after the cancel: the checkpoint and the source
-    // traffic both stop moving once the few in-flight pulls drain.
-    tokio::time::sleep(Duration::from_secs(2)).await;
-    let persisted = env.backfill_job(LOCAL_BUCKET).await?.expect("checkpoint kept for inspection");
-    assert_eq!(persisted["state"], "cancelled");
-    assert_eq!(counter(&persisted, "enqueued"), enqueued_at_cancel);
-    let gets_after_drain = source_gets(&env);
-    tokio::time::sleep(Duration::from_secs(1)).await;
-    assert_eq!(source_gets(&env), gets_after_drain, "no source GET after the cancel drained");
-    assert!(env.local_key_count(LOCAL_BUCKET, KEY_PREFIX).await? < COUNT);
-
-    // Cancel is idempotent and the status endpoint reports the final state.
-    let again = env.backfill(LOCAL_BUCKET, BackfillOp::Cancel).await?;
-    assert_eq!(again.status, 200, "second cancel: {}", again.body);
-    assert_eq!(again.json()?["job"]["state"], "cancelled");
-    let status = env.status(LOCAL_BUCKET).await?;
-    assert_eq!(status.json()?["backfill"]["state"], "cancelled");
-
-    // A cancelled job releases the bucket: a new job can start.
-    let restarted = env.start_backfill(LOCAL_BUCKET, BackfillRequest::default()).await?;
-    assert_eq!(restarted.status, 200, "restart after cancel: {}", restarted.body);
-    assert_ne!(restarted.json()?["job"]["job_id"], job["job_id"]);
-    let _ = env.backfill(LOCAL_BUCKET, BackfillOp::Cancel).await?;
-    Ok(())
-}
-
-#[tokio::test]
-async fn backfill_resumes_from_continuation_token_after_restart() -> TestResult {
-    const COUNT: usize = SEEDED_KEYS;
-    let mut env = OdmTestEnv::start().await?;
-    env.source.create_bucket(SOURCE_BUCKET);
-    env.rustfs.create_test_bucket(LOCAL_BUCKET).await?;
-    seed(&env, COUNT);
-    let mut spec = env.fake_source_spec(SOURCE_BUCKET);
-    spec.policy.max_concurrent_pulls = 2;
-    configure(&env, &spec).await?;
-
-    let started = env.start_backfill(LOCAL_BUCKET, BackfillRequest::default()).await?;
-    assert_eq!(started.status, 200, "start: {}", started.body);
-    let job_id = started.json()?["job"]["job_id"].as_str().expect("job id").to_string();
-
-    // Wait for the first page to be committed (cursor persisted), then kill
-    // the server while the job is still running.
-    let mid = env
-        .wait_for_backfill(LOCAL_BUCKET, Duration::from_secs(120), |job| {
-            job["state"] == "running" && job["continuation_token"].is_string()
-        })
-        .await?;
-    assert!(counter(&mid, "listed") >= 1000 && counter(&mid, "listed") < COUNT as u64, "{mid}");
-    env.source.take_requests();
-    env.rustfs.restart_server_preserving_data(vec![], ODM_SERVER_ENV).await?;
-
-    let done = env
-        .wait_for_backfill(LOCAL_BUCKET, Duration::from_secs(300), |job| job["state"] == "completed")
-        .await?;
-    assert_eq!(done["job_id"], job_id.as_str(), "the same job continues after the restart");
-    assert_eq!(counter(&done, "failed"), 0);
-    assert!(
-        counter(&done, "listed") >= COUNT as u64,
-        "the resumed job listed the rest (the interrupted page is listed twice): {done}"
-    );
-    // Keys pulled before the crash are re-listed and skipped, never re-pulled;
-    // a pull whose report died with the old process is counted neither way,
-    // so only the lower bound and the queue accounting are exact.
-    assert!(counter(&done, "pulled") + counter(&done, "skipped_existing") >= COUNT as u64, "{done}");
-    assert!(counter(&done, "pulled") <= counter(&done, "enqueued"), "{done}");
-    assert_eq!(env.local_key_count(LOCAL_BUCKET, KEY_PREFIX).await?, COUNT);
-    for i in [0, 500, 999, 1000, COUNT - 1] {
-        env.assert_local_present(LOCAL_BUCKET, &key(i), &body(i)).await;
-    }
-
-    let lists = source_lists(&env);
-    assert!(!lists.is_empty(), "the resumed job listed the source");
-    assert!(
-        lists.iter().all(Option::is_some),
-        "after the restart every source listing carries a continuation-token: {lists:?}"
-    );
-    assert!(
-        lists.len() <= COUNT.div_ceil(1000),
-        "the listing did not start over from the first page: {lists:?}"
-    );
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/concurrency_test.rs

@@ -1,183 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Concurrency limits of on-demand migration (rustfs/backlog#2158):
-//! single-flight on one key, the `max_concurrent_pulls` ceiling, and a full
-//! background pull queue.
-//!
-//! The point of each case is what the source is spared, so the source
-//! journal (`count_requests`) carries the assertion in every one of them.
-
-use super::common::{BoxError, OdmTestEnv, RawResponse, SeedObject, start_configured_env};
-use crate::fake_s3_target::Operation;
-use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
-use bytes::Bytes;
-use std::time::Duration;
-
-type TestResult = Result<(), BoxError>;
-
-const SOURCE_BUCKET: &str = "odm-concurrency-source";
-/// Background pulls land after the response that queued them.
-const SETTLE: Duration = Duration::from_secs(120);
-
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-fn source_get_count(env: &OdmTestEnv, key: &str) -> usize {
-    env.source.count_requests(Operation::GetObject, key)
-}
-
-/// Case 9: 32 concurrent misses on one key coalesce into a single-flight
-/// pull. At most two source GETs are allowed: the leader plus one follower
-/// that gave up waiting and streamed through.
-#[tokio::test]
-async fn test_odm_concurrent_misses_on_one_key_coalesce() -> TestResult {
-    let bucket = "odm-concurrency-singleflight";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    env.client
-        .put_bucket_versioning()
-        .bucket(bucket)
-        .versioning_configuration(
-            VersioningConfiguration::builder()
-                .status(BucketVersioningStatus::Enabled)
-                .build(),
-        )
-        .send()
-        .await?;
-
-    let key = "singleflight/asset.bin";
-    let body = payload(512 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let responses: Vec<RawResponse> = futures::future::try_join_all((0..32).map(|_| env.raw_get(bucket, key))).await?;
-    for (index, response) in responses.iter().enumerate() {
-        assert_eq!(response.status, 200, "reader {index}: {}", String::from_utf8_lossy(&response.body));
-        assert_eq!(response.body, body, "reader {index} received different bytes");
-    }
-
-    let source_gets = source_get_count(&env, key);
-    assert!(
-        (1..=2).contains(&source_gets),
-        "32 concurrent misses must not become {source_gets} source GETs"
-    );
-
-    assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "the leader stores the object");
-    env.assert_local_present(bucket, key, &body).await;
-    let versions = env.client.list_object_versions().bucket(bucket).prefix(key).send().await?;
-    assert_eq!(
-        versions.versions().len(),
-        1,
-        "the coalesced pull commits exactly one version: {:?}",
-        versions.versions()
-    );
-    assert_eq!(
-        source_get_count(&env, key),
-        source_gets,
-        "nothing pulls the object again once it is local"
-    );
-    Ok(())
-}
-
-/// Case 10: 64 misses on distinct keys never exceed `max_concurrent_pulls`
-/// in flight, and all of them eventually land.
-#[tokio::test]
-async fn test_odm_concurrent_pulls_respect_the_configured_ceiling() -> TestResult {
-    let bucket = "odm-concurrency-ceiling";
-    const MAX_CONCURRENT_PULLS: u32 = 4;
-    const KEYS: usize = 64;
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |spec| {
-        spec.policy.max_concurrent_pulls = MAX_CONCURRENT_PULLS;
-    })
-    .await?;
-
-    let body = payload(256 * 1024);
-    let keys: Vec<String> = (0..KEYS).map(|index| format!("ceiling/object-{index:03}.bin")).collect();
-    let seeds: Vec<SeedObject> = keys.iter().map(|key| SeedObject::new(key.clone(), body.clone())).collect();
-    env.seed_source(SOURCE_BUCKET, &seeds);
-
-    let reads = futures::future::try_join_all(keys.iter().map(|key| env.raw_get(bucket, key)));
-    let (responses, peak_inflight) = env.peak_inflight_pulls(bucket, reads).await?;
-    let responses = responses?;
-    for (key, response) in keys.iter().zip(&responses) {
-        assert_eq!(response.status, 200, "{key}: {}", String::from_utf8_lossy(&response.body));
-        assert_eq!(response.body, body, "{key} received different bytes");
-    }
-    assert!(
-        peak_inflight <= u64::from(MAX_CONCURRENT_PULLS),
-        "in-flight pulls peaked at {peak_inflight}, above the configured {MAX_CONCURRENT_PULLS}"
-    );
-    assert!(
-        peak_inflight >= 1,
-        "the poll never observed a pull in flight, so the ceiling assertion proves nothing"
-    );
-
-    for key in &keys {
-        assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "{key} must be stored locally");
-        assert_eq!(source_get_count(&env, key), 1, "{key} is pulled exactly once");
-    }
-    assert_eq!(env.status_counter(bucket, "/inflight_pulls").await?, 0, "every pull slot is released");
-    Ok(())
-}
-
-/// Case 11: with a small background queue, a burst of Range reads overflows
-/// it. The overflow is counted and dropped, never turned into a client
-/// failure: every reader still gets its 206 from the source.
-#[tokio::test]
-async fn test_odm_range_burst_overflows_the_pull_queue_without_failing_clients() -> TestResult {
-    let bucket = "odm-concurrency-queue-full";
-    const REQUESTS: usize = 100;
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |spec| {
-        spec.policy.pull_queue_capacity = 8;
-        spec.policy.max_concurrent_pulls = 1;
-    })
-    .await?;
-
-    let body = payload(128 * 1024);
-    let keys: Vec<String> = (0..REQUESTS).map(|index| format!("queue/object-{index:03}.bin")).collect();
-    let seeds: Vec<SeedObject> = keys.iter().map(|key| SeedObject::new(key.clone(), body.clone())).collect();
-    env.seed_source(SOURCE_BUCKET, &seeds);
-
-    let responses: Vec<RawResponse> = futures::future::try_join_all(
-        keys.iter()
-            .map(|key| env.raw_object_request(http::Method::GET, bucket, key, &[("range", "bytes=0-1023")])),
-    )
-    .await?;
-    for (key, response) in keys.iter().zip(&responses) {
-        assert_eq!(response.status, 206, "{key}: {}", String::from_utf8_lossy(&response.body));
-        assert_eq!(response.body, body.slice(0..1024), "{key} served the wrong range");
-        assert_eq!(
-            response.header("content-range"),
-            Some(format!("bytes 0-1023/{}", body.len()).as_str()),
-            "{key}"
-        );
-    }
-
-    let queue_full = env
-        .wait_for_status_counter(bucket, "/counters/pull_failures_total/queue_full", 1, SETTLE)
-        .await?;
-    assert!(queue_full > 0, "a 100-deep burst must overflow an 8-slot queue");
-
-    let ranged_reads: usize = keys.iter().map(|key| source_get_count(&env, key)).sum();
-    assert!(
-        ranged_reads >= REQUESTS,
-        "every reader is served from the source: {ranged_reads} GETs for {REQUESTS} readers"
-    );
-    let dropped = keys.iter().filter(|key| source_get_count(&env, key) == 1).count();
-    assert!(
-        dropped > 0,
-        "the overflowed keys are the ones with no backfill GET, but every key got one"
-    );
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/fault_test.rs

@@ -1,551 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Source-failure scenarios for on-demand migration (rustfs/backlog#2158):
-//! access denied, the circuit breaker, first-byte and mid-body stream
-//! failures (a cut body and a stalled one), ETag integrity, the negative
-//! cache, and an unsupported (SSE-C) source object.
-//!
-//! Every case asserts what the source was asked for, not only what the
-//! client received: a fault that silently turned into a second source
-//! request would otherwise pass.
-
-use super::common::{BoxError, OdmTestEnv, SeedObject, start_configured_env};
-use crate::fake_s3_target::{FaultAction, Operation};
-use bytes::Bytes;
-use std::time::{Duration, Instant};
-
-type TestResult = Result<(), BoxError>;
-
-const SOURCE_BUCKET: &str = "odm-fault-source";
-/// Header the GET/HEAD paths add when the answer came from the source.
-const ODM_RESPONSE_HEADER: &str = "x-rustfs-on-demand-migration";
-/// Status of the `SourceUnavailable` error the `propagate` policy returns.
-const SOURCE_UNAVAILABLE_STATUS: u16 = 424;
-/// Background pulls and their counters land after the response.
-const SETTLE: Duration = Duration::from_secs(60);
-/// Consecutive counted source failures that open the breaker
-/// (`BREAKER_FAILURE_THRESHOLD` in ecstore).
-const BREAKER_FAILURE_THRESHOLD: usize = 5;
-
-/// Position-dependent payload so a misaligned or truncated copy is caught.
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-/// A source object with a well-formed but deliberately wrong single-part
-/// ETag: the fake source retains `x-rustfs-source-etag` verbatim, so HEAD
-/// and GET advertise an MD5 the body does not have.
-async fn seed_with_etag(env: &OdmTestEnv, key: &str, body: Bytes, etag: &str) -> TestResult {
-    let response = env
-        .source_client()
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key(key)
-        .body(aws_sdk_s3::primitives::ByteStream::from(body))
-        .customize()
-        .mutate_request({
-            let etag = etag.to_string();
-            move |request| {
-                request.headers_mut().insert("x-rustfs-source-etag", etag.clone());
-            }
-        })
-        .send()
-        .await?;
-    assert_eq!(
-        response.e_tag(),
-        Some(format!("\"{etag}\"").as_str()),
-        "the fake source stores the announced ETag"
-    );
-    Ok(())
-}
-
-/// A source object that reports SSE-C: the fake source echoes the customer
-/// algorithm it captured from the replication passthrough transport header.
-async fn seed_with_ssec(env: &OdmTestEnv, key: &str, body: Bytes) -> TestResult {
-    env.source_client()
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key(key)
-        .body(aws_sdk_s3::primitives::ByteStream::from(body))
-        .customize()
-        .mutate_request(|request| {
-            request.headers_mut().insert("x-rustfs-replication-ssec-algorithm", "AES256");
-        })
-        .send()
-        .await?;
-    Ok(())
-}
-
-/// Case 1: a 403 from the source is a configuration error, not a health
-/// signal. `propagate` answers 424 and records the class; `not_found` hides
-/// it as a 404. Neither counts toward the breaker.
-#[tokio::test]
-async fn test_odm_source_access_denied_propagates_without_opening_the_breaker() -> TestResult {
-    let propagating = "odm-fault-denied-propagate";
-    let hiding = "odm-fault-denied-notfound";
-    let env = start_configured_env(propagating, SOURCE_BUCKET, |_| {}).await?;
-    let mut hiding_spec = env.fake_source_spec(SOURCE_BUCKET);
-    hiding_spec.policy.source_error = "not_found".to_string();
-    env.configure_and_wait(hiding, &hiding_spec).await?;
-
-    let propagate_key = "denied/propagate.bin";
-    let hidden_key = "denied/hidden.bin";
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new(propagate_key, payload(4096)),
-            SeedObject::new(hidden_key, payload(4096)),
-        ],
-    );
-
-    env.source
-        .inject_for_key(Operation::HeadObject, propagate_key, FaultAction::ResponseStatus(403), 1);
-    let denied = env.raw_get(propagating, propagate_key).await?;
-    assert_eq!(denied.status, SOURCE_UNAVAILABLE_STATUS, "{}", String::from_utf8_lossy(&denied.body));
-    assert!(
-        String::from_utf8_lossy(&denied.body).contains("SourceUnavailable"),
-        "the propagated error names the ODM source code: {}",
-        String::from_utf8_lossy(&denied.body)
-    );
-    assert_eq!(env.source.count_requests(Operation::HeadObject, propagate_key), 1);
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, propagate_key),
-        0,
-        "a denied HEAD never reaches the body"
-    );
-
-    let status = env.status_json(propagating).await?;
-    assert_eq!(
-        status.pointer("/last_source_error/class").and_then(|v| v.as_str()),
-        Some("access_denied"),
-        "{status}"
-    );
-    assert_eq!(
-        status.pointer("/breaker/state").and_then(|v| v.as_str()),
-        Some("closed"),
-        "a configuration error must not open the breaker: {status}"
-    );
-    assert_eq!(
-        status
-            .pointer("/counters/requests_total/get/source_error")
-            .and_then(|v| v.as_u64()),
-        Some(1),
-        "{status}"
-    );
-
-    env.source
-        .inject_for_key(Operation::HeadObject, hidden_key, FaultAction::ResponseStatus(403), 1);
-    let hidden = env.raw_get(hiding, hidden_key).await?;
-    assert_eq!(hidden.status, 404, "{}", String::from_utf8_lossy(&hidden.body));
-    assert_eq!(env.source.count_requests(Operation::HeadObject, hidden_key), 1);
-    assert_eq!(env.source.count_requests(Operation::GetObject, hidden_key), 0);
-
-    env.assert_local_absent(propagating, propagate_key).await;
-    env.assert_local_absent(hiding, hidden_key).await;
-    Ok(())
-}
-
-/// Case 2: repeated transport failures open the breaker; while it is open
-/// the source is not touched at all, and the half-open probe after the open
-/// window closes it again. The open window is a compiled-in 30 s constant
-/// (`BREAKER_OPEN_DURATION`), so this case waits in real time.
-///
-/// The source client disables SDK retries, so one logical source call is
-/// exactly one wire request: the script is exactly as deep as the number of
-/// breaker failures it has to produce, and the scripted fault count and the
-/// observed source request count must agree.
-#[tokio::test]
-async fn test_odm_repeated_source_errors_open_the_breaker_and_recover() -> TestResult {
-    let bucket = "odm-fault-breaker";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    let key = "breaker/doc.bin";
-    let body = payload(8192);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    env.source
-        .inject_for_key(Operation::HeadObject, key, FaultAction::ResponseStatus(503), BREAKER_FAILURE_THRESHOLD);
-    for attempt in 1..=BREAKER_FAILURE_THRESHOLD {
-        let response = env.raw_get(bucket, key).await?;
-        assert_eq!(
-            response.status,
-            SOURCE_UNAVAILABLE_STATUS,
-            "attempt {attempt}: {}",
-            String::from_utf8_lossy(&response.body)
-        );
-    }
-    assert_eq!(
-        env.status_json(bucket)
-            .await?
-            .pointer("/breaker/state")
-            .and_then(|v| v.as_str()),
-        Some("open"),
-        "the threshold of consecutive source failures must open the breaker"
-    );
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        BREAKER_FAILURE_THRESHOLD,
-        "every counted failure is exactly one source request"
-    );
-
-    // With the script cleared, the only thing that can still fail a read is
-    // the open breaker itself.
-    env.source.clear_faults();
-    let source_requests = env.source.count_requests(Operation::HeadObject, key);
-    let rejected = env.raw_get(bucket, key).await?;
-    assert_eq!(rejected.status, SOURCE_UNAVAILABLE_STATUS, "{}", String::from_utf8_lossy(&rejected.body));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        source_requests,
-        "an open breaker never touches the source"
-    );
-    assert!(
-        env.status_counter(bucket, "/counters/requests_total/get/breaker_open")
-            .await?
-            >= 1,
-        "the rejected request is counted as breaker_open"
-    );
-
-    // Half-open admits exactly one probe once the open window elapses.
-    let deadline = Instant::now() + Duration::from_secs(120);
-    let recovered = loop {
-        let response = env.raw_get(bucket, key).await?;
-        if response.status == 200 {
-            break response;
-        }
-        assert_eq!(response.status, SOURCE_UNAVAILABLE_STATUS);
-        assert!(Instant::now() < deadline, "the breaker never left the open state");
-        tokio::time::sleep(Duration::from_secs(1)).await;
-    };
-    assert_eq!(recovered.body, body, "the recovered read serves the source bytes");
-    assert_eq!(recovered.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        source_requests + 1,
-        "only the half-open probe reached the source"
-    );
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 1);
-    assert_eq!(
-        env.status_json(bucket)
-            .await?
-            .pointer("/breaker/state")
-            .and_then(|v| v.as_str()),
-        Some("closed"),
-        "a successful probe closes the breaker"
-    );
-    Ok(())
-}
-
-/// Case 3: a source that holds the response past `first_byte_ms` is a
-/// timeout, and the client never sees a 200 head. One logical source call is
-/// one wire request, so a single scripted stall is enough to fail the read.
-#[tokio::test]
-async fn test_odm_source_stall_times_out_before_the_first_byte() -> TestResult {
-    let bucket = "odm-fault-stall";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |spec| {
-        spec.policy.source_timeout.first_byte_ms = 500;
-    })
-    .await?;
-    let key = "stall/doc.bin";
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, payload(4096))]);
-
-    env.source
-        .inject_for_key(Operation::HeadObject, key, FaultAction::Stall(Duration::from_secs(5)), 1);
-    let started = Instant::now();
-    let response = env.raw_get(bucket, key).await?;
-    let elapsed = started.elapsed();
-    assert_eq!(response.status, SOURCE_UNAVAILABLE_STATUS, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        1,
-        "the stalled HEAD is the only source request"
-    );
-    assert!(
-        elapsed < Duration::from_secs(5),
-        "the read timeout must cut the attempt short, took {elapsed:?}"
-    );
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        0,
-        "a timed-out HEAD never starts a body read"
-    );
-    assert_eq!(
-        env.status_json(bucket)
-            .await?
-            .pointer("/last_source_error/class")
-            .and_then(|v| v.as_str()),
-        Some("timeout"),
-    );
-    env.assert_local_absent(bucket, key).await;
-    Ok(())
-}
-
-/// Case 4: the source cuts the body of an inline pull. The client sees a
-/// short read, nothing is stored, and no multipart upload is left behind.
-#[tokio::test]
-async fn test_odm_inline_pull_aborts_when_the_source_body_is_cut() -> TestResult {
-    let bucket = "odm-fault-inline-cut";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    let key = "cut/inline.bin";
-    let body = payload(256 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    env.source
-        .inject_for_key(Operation::GetObject, key, FaultAction::TruncateBodyAt(1024), 1);
-    // The client sees a transport failure while reading the body: the
-    // announced Content-Length is never delivered.
-    env.raw_get(bucket, key)
-        .await
-        .expect_err("a cut source body must not read back as a complete object");
-
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "an aborted inline pull is not retried on the same request"
-    );
-    // Give a stray background pull time to appear before asserting absence.
-    tokio::time::sleep(Duration::from_secs(3)).await;
-    env.assert_local_absent(bucket, key).await;
-    let uploads = env.client.list_multipart_uploads().bucket(bucket).send().await?;
-    assert!(
-        uploads.uploads().is_empty(),
-        "an aborted pull leaves no multipart upload: {:?}",
-        uploads.uploads()
-    );
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "nothing re-reads the source afterwards"
-    );
-    Ok(())
-}
-
-/// Case 5: the source answers, sends part of the body and then goes quiet
-/// for longer than `source_timeout.idle_ms`. The inline tee must end both
-/// ends: the client gets a short read rather than a silently truncated 200,
-/// the pull is counted as a source timeout, and nothing (object or multipart
-/// upload) is left behind locally.
-#[tokio::test]
-async fn test_odm_inline_pull_aborts_when_the_source_body_stalls() -> TestResult {
-    let bucket = "odm-fault-inline-stall";
-    const IDLE_MS: u64 = 1_000;
-    let idle = Duration::from_millis(IDLE_MS);
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |spec| {
-        spec.policy.source_timeout.idle_ms = IDLE_MS;
-    })
-    .await?;
-    let key = "stall/inline.bin";
-    let body = payload(256 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    // The head and the first slice arrive at once; the source then pauses for
-    // four times the idle budget, which is what a stalled source looks like.
-    env.source.inject_for_key(
-        Operation::GetObject,
-        key,
-        FaultAction::SlowSendBody {
-            chunk_bytes: 32 * 1024,
-            delay: idle * 4,
-        },
-        1,
-    );
-    let started = Instant::now();
-    env.raw_get(bucket, key)
-        .await
-        .expect_err("a stalled source body must not read back as a complete object");
-    let elapsed = started.elapsed();
-    assert!(
-        elapsed < idle * 4,
-        "the idle budget, not the source's own pause, must end the read (took {elapsed:?})"
-    );
-
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "an aborted inline pull is not retried on the same request"
-    );
-    env.wait_for_status_counter(bucket, "/counters/pull_failures_total/source_timeout", 1, SETTLE)
-        .await?;
-    // The leader releases its slot just after it records the failure.
-    let deadline = Instant::now() + SETTLE;
-    loop {
-        let inflight = env
-            .status_json(bucket)
-            .await?
-            .pointer("/inflight_pulls")
-            .and_then(|value| value.as_u64());
-        if inflight == Some(0) {
-            break;
-        }
-        assert!(Instant::now() < deadline, "the aborted pull never released its slot: {inflight:?}");
-        tokio::time::sleep(Duration::from_millis(200)).await;
-    }
-    env.assert_local_absent(bucket, key).await;
-    let uploads = env.client.list_multipart_uploads().bucket(bucket).send().await?;
-    assert!(
-        uploads.uploads().is_empty(),
-        "a stalled pull leaves no multipart upload: {:?}",
-        uploads.uploads()
-    );
-    Ok(())
-}
-
-/// Case 6: the background pull of a large object hits a cut body, counts the
-/// failure, and the retry stores the object.
-#[tokio::test]
-async fn test_odm_background_pull_retries_a_truncated_source_body() -> TestResult {
-    let bucket = "odm-fault-background-cut";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |spec| spec.policy.inline_max_bytes = 4096).await?;
-    let key = "cut/background.bin";
-    let body = payload(512 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    // The faults are consumed in order by the two GETs the large-object path
-    // makes: the passthrough that answers the client (unaffected), then the
-    // background pull (cut).
-    env.source
-        .inject_for_key(Operation::GetObject, key, FaultAction::Delay(Duration::ZERO), 1);
-    env.source
-        .inject_for_key(Operation::GetObject, key, FaultAction::TruncateBodyAt(2048), 1);
-
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 200, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(response.body, body, "the passthrough is unaffected by the pull's fault");
-
-    // The cut body ends the pull attempt as a retryable source transport
-    // failure; the retry stores the object, so the pull as a whole succeeds
-    // and no failure is counted (only a pull that gives up is).
-    assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "the retry must store the object");
-    env.assert_local_present(bucket, key, &body).await;
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        3,
-        "one passthrough, one cut pull, one successful retry"
-    );
-    let status = env.status_json(bucket).await?;
-    assert_eq!(
-        status
-            .pointer("/counters/pulled_objects_total/background")
-            .and_then(|v| v.as_u64()),
-        Some(1),
-        "{status}"
-    );
-    assert_eq!(
-        status
-            .pointer("/counters/pull_failures_total")
-            .and_then(|failures| failures.as_object())
-            .map(|failures| failures.values().filter_map(serde_json::Value::as_u64).sum::<u64>()),
-        Some(0),
-        "a retried attempt is not a failed pull: {status}"
-    );
-    Ok(())
-}
-
-/// Case 7: the source advertises an ETag its bytes do not match. The client
-/// still gets every byte; the write-back is discarded as an integrity
-/// failure and nothing is stored.
-#[tokio::test]
-async fn test_odm_wrong_source_etag_discards_the_write_back() -> TestResult {
-    let bucket = "odm-fault-etag";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    let key = "etag/mismatch.bin";
-    let body = payload(64 * 1024);
-    seed_with_etag(&env, key, body.clone(), "0123456789abcdef0123456789abcdef").await?;
-
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 200, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(response.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(response.body, body, "the client receives the complete source bytes");
-
-    env.wait_for_status_counter(bucket, "/counters/pull_failures_total/etag_mismatch", 1, SETTLE)
-        .await?;
-    env.assert_local_absent(bucket, key).await;
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "a discarded write-back is not re-read"
-    );
-    Ok(())
-}
-
-/// Case 8: a source miss is remembered for `negative_cache_ttl_secs`, and
-/// re-checked once the entry expires.
-#[tokio::test]
-async fn test_odm_source_not_found_is_negative_cached_for_the_ttl() -> TestResult {
-    let bucket = "odm-fault-negative-cache";
-    let ttl = Duration::from_secs(3);
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |spec| {
-        spec.policy.negative_cache_ttl_secs = ttl.as_secs();
-    })
-    .await?;
-    let key = "negative/nowhere.bin";
-
-    for attempt in 1..=10 {
-        let response = env.raw_get(bucket, key).await?;
-        assert_eq!(response.status, 404, "attempt {attempt}: {}", String::from_utf8_lossy(&response.body));
-    }
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        1,
-        "nine of the ten misses stop at the negative cache"
-    );
-    assert!(
-        env.status_counter(bucket, "/counters/requests_total/get/negative_cached")
-            .await?
-            >= 9,
-        "the cached misses are counted"
-    );
-
-    tokio::time::sleep(ttl + Duration::from_secs(2)).await;
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 404);
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        2,
-        "an expired entry re-checks the source once"
-    );
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 0);
-    Ok(())
-}
-
-/// Case 9: an SSE-C source object cannot be migrated (the key belongs to the
-/// source's client), so the read fails as unsupported without a body read.
-#[tokio::test]
-async fn test_odm_ssec_source_object_is_unsupported() -> TestResult {
-    let bucket = "odm-fault-ssec";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    let key = "ssec/secret.bin";
-    seed_with_ssec(&env, key, payload(4096)).await?;
-
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, SOURCE_UNAVAILABLE_STATUS, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        0,
-        "an unsupported object is rejected on the HEAD"
-    );
-    assert_eq!(
-        env.status_json(bucket)
-            .await?
-            .pointer("/counters/requests_total/get/unsupported")
-            .and_then(|v| v.as_u64()),
-        Some(1),
-    );
-    env.assert_local_absent(bucket, key).await;
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/get_basic_test.rs

@@ -1,298 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Basic read-through scenarios (rustfs/backlog#2156): inline pull and
-//! local persistence, large-object passthrough with background backfill,
-//! Range passthrough, source 404, `versionId` reads, a disabled bucket, and
-//! the HEAD passthrough that stores nothing (rustfs/backlog#2155).
-//! Every source-side expectation is asserted on the fake source's journal.
-
-use super::common::{BoxError, OdmSourceSpec, OdmTestEnv, SeedObject};
-use crate::fake_s3_target::{BucketMode, Operation};
-use aws_sdk_s3::error::ProvideErrorMetadata;
-use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
-use bytes::Bytes;
-use std::time::Duration;
-
-type TestResult = Result<(), BoxError>;
-
-const SOURCE_BUCKET: &str = "odm-get-source";
-const ODM_RESPONSE_HEADER: &str = "x-rustfs-on-demand-migration";
-/// Background pulls run after the response; generous for a loaded CI host.
-const BACKFILL_WAIT: Duration = Duration::from_secs(60);
-
-/// Position-dependent payload so a misaligned or truncated copy is caught.
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-/// RustFS with `local_bucket` migrating from `SOURCE_BUCKET` on the fake
-/// source (unversioned, like a plain migration source); `adjust` tweaks the
-/// policy before it is installed. Returns once the runtime consults the
-/// source.
-async fn configured_env(local_bucket: &str, adjust: impl FnOnce(&mut OdmSourceSpec)) -> Result<OdmTestEnv, BoxError> {
-    let env = OdmTestEnv::start().await?;
-    env.source.create_bucket_with_mode(SOURCE_BUCKET, BucketMode::Unversioned);
-    env.rustfs.create_test_bucket(local_bucket).await?;
-    let mut spec = env.fake_source_spec(SOURCE_BUCKET);
-    adjust(&mut spec);
-    let response = env.configure_source(local_bucket, &spec).await?;
-    assert_eq!(response.status, 200, "configure on-demand migration: {}", response.body);
-    env.wait_until_source_consulted(local_bucket).await?;
-    Ok(env)
-}
-
-fn source_get_ranges(env: &OdmTestEnv, key: &str) -> Vec<Option<String>> {
-    env.source
-        .requests()
-        .into_iter()
-        .filter(|record| record.operation == Operation::GetObject && record.key.as_deref() == Some(key))
-        .map(|record| record.range)
-        .collect()
-}
-
-#[tokio::test]
-async fn get_miss_pulls_inline_and_serves_locally_afterwards() -> TestResult {
-    let bucket = "odm-get-inline";
-    let env = configured_env(bucket, |_| {}).await?;
-    let key = "inline/report.bin";
-    let body = payload(200 * 1024);
-    let etag = env
-        .seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())])
-        .remove(0);
-    let quoted_etag = format!("\"{etag}\"");
-
-    let first = env.raw_get(bucket, key).await?;
-    assert_eq!(first.status, 200, "{}", String::from_utf8_lossy(&first.body));
-    assert_eq!(first.header(ODM_RESPONSE_HEADER), Some("source"), "a source answer is marked");
-    assert_eq!(first.header("etag"), Some(quoted_etag.as_str()), "inline answers carry the source ETag");
-    assert_eq!(first.header("content-length"), Some(body.len().to_string().as_str()));
-    assert_eq!(first.header("accept-ranges"), Some("bytes"));
-    assert_eq!(first.body, body, "the client receives the source bytes");
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 1, "exactly one source GET");
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-
-    assert!(
-        env.wait_local_listed(bucket, key, BACKFILL_WAIT).await?,
-        "the inline pull must store the object locally"
-    );
-    let second = env.raw_get(bucket, key).await?;
-    assert_eq!(second.status, 200);
-    assert_eq!(second.header(ODM_RESPONSE_HEADER), None, "a local hit carries no source marker");
-    assert_eq!(second.body, body, "the local copy is the source bytes");
-    assert_eq!(second.header("etag"), Some(quoted_etag.as_str()), "preserve_etag keeps the source ETag");
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "the second GET is served locally"
-    );
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    Ok(())
-}
-
-#[tokio::test]
-async fn get_large_object_streams_through_and_backfills_in_background() -> TestResult {
-    let bucket = "odm-get-large";
-    let env = configured_env(bucket, |spec| spec.policy.inline_max_bytes = 4096).await?;
-    let key = "large/archive.bin";
-    let body = payload(512 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 200, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(response.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(response.header("content-length"), Some(body.len().to_string().as_str()));
-    assert_eq!(response.body, body, "the passthrough streams the whole object");
-
-    assert!(
-        env.wait_local_listed(bucket, key, BACKFILL_WAIT).await?,
-        "the background pull must store the object locally"
-    );
-    env.assert_local_present(bucket, key, &body).await;
-    assert_eq!(
-        source_get_ranges(&env, key),
-        vec![None, None],
-        "one passthrough GET plus one background pull, both unranged"
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn get_range_streams_206_and_backfills_the_whole_object() -> TestResult {
-    let bucket = "odm-get-range";
-    let env = configured_env(bucket, |_| {}).await?;
-    let key = "range/video.bin";
-    let body = payload(100_000);
-    let etag = env
-        .seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())])
-        .remove(0);
-
-    let response = env
-        .client
-        .get_object()
-        .bucket(bucket)
-        .key(key)
-        .range("bytes=10-19")
-        .send()
-        .await?;
-    assert_eq!(response.content_range(), Some("bytes 10-19/100000"), "the source's 206 is passed through");
-    assert_eq!(response.content_length(), Some(10));
-    assert_eq!(response.e_tag(), Some(format!("\"{etag}\"").as_str()));
-    assert_eq!(response.body.collect().await?.into_bytes(), body.slice(10..20));
-    assert_eq!(
-        source_get_ranges(&env, key),
-        vec![Some("bytes=10-19".to_string())],
-        "the Range is forwarded"
-    );
-
-    assert!(
-        env.wait_local_listed(bucket, key, BACKFILL_WAIT).await?,
-        "serve_and_backfill must pull the whole object"
-    );
-    env.assert_local_present(bucket, key, &body).await;
-    assert_eq!(
-        source_get_ranges(&env, key),
-        vec![Some("bytes=10-19".to_string()), None],
-        "the background pull fetches the whole object"
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn get_source_not_found_is_404_and_negative_cached() -> TestResult {
-    let bucket = "odm-get-missing";
-    let env = configured_env(bucket, |_| {}).await?;
-    let key = "missing/nowhere.bin";
-
-    for attempt in 1..=2 {
-        let err = env
-            .client
-            .get_object()
-            .bucket(bucket)
-            .key(key)
-            .send()
-            .await
-            .expect_err("a key missing on both sides is 404");
-        assert_eq!(err.code(), Some("NoSuchKey"), "attempt {attempt}: {err:?}");
-    }
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 0, "a source miss never pulls");
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        1,
-        "the second miss stops at the negative cache"
-    );
-    env.assert_local_absent(bucket, key).await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn get_with_version_id_does_not_consult_the_source() -> TestResult {
-    let bucket = "odm-get-versioned";
-    let env = configured_env(bucket, |_| {}).await?;
-    env.client
-        .put_bucket_versioning()
-        .bucket(bucket)
-        .versioning_configuration(
-            VersioningConfiguration::builder()
-                .status(BucketVersioningStatus::Enabled)
-                .build(),
-        )
-        .send()
-        .await?;
-    let key = "versioned/doc.bin";
-    let body = payload(1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let err = env
-        .client
-        .get_object()
-        .bucket(bucket)
-        .key(key)
-        .version_id("11111111-2222-4333-8444-555555555555")
-        .send()
-        .await
-        .expect_err("a version read cannot be answered by the source");
-    assert!(
-        matches!(err.code(), Some("NoSuchVersion") | Some("NoSuchKey")),
-        "unexpected error: {err:?}"
-    );
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 0);
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 0);
-    env.assert_local_absent(bucket, key).await;
-
-    // The same key without versionId is still migrated: the gate is per request.
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 200, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(response.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(response.body, body);
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 1);
-    Ok(())
-}
-
-#[tokio::test]
-async fn get_after_disable_does_not_consult_the_source() -> TestResult {
-    let bucket = "odm-get-disabled";
-    let env = configured_env(bucket, |_| {}).await?;
-    let key = "disabled/doc.bin";
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, payload(1024))]);
-
-    let response = env.disable(bucket).await?;
-    assert_eq!(response.status, 204, "{}", response.body);
-
-    let err = env
-        .client
-        .get_object()
-        .bucket(bucket)
-        .key(key)
-        .send()
-        .await
-        .expect_err("a disabled bucket answers locally");
-    assert_eq!(err.code(), Some("NoSuchKey"), "{err:?}");
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 0);
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 0);
-    env.assert_local_absent(bucket, key).await;
-    Ok(())
-}
-
-/// A HEAD miss is answered from the source but must not store anything: the
-/// key stays absent locally, so a second HEAD consults the source again. This
-/// is the smoke-lane guard for the HEAD passthrough (rustfs/backlog#2155).
-#[tokio::test]
-async fn head_miss_answers_from_the_source_without_persisting() -> TestResult {
-    let bucket = "odm-head-passthrough";
-    let env = configured_env(bucket, |_| {}).await?;
-    let key = "head/report.bin";
-    let body = payload(32 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let head = env.raw_object_request(http::Method::HEAD, bucket, key, &[]).await?;
-    assert_eq!(head.status, 200, "{}", String::from_utf8_lossy(&head.body));
-    assert_eq!(head.header(ODM_RESPONSE_HEADER), Some("source"), "a source answer is marked");
-    assert_eq!(head.header("content-length"), Some(body.len().to_string().as_str()));
-    assert!(head.body.is_empty(), "a HEAD answer carries no body");
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 0, "a HEAD must never pull the body");
-    env.assert_local_absent(bucket, key).await;
-
-    let again = env.raw_object_request(http::Method::HEAD, bucket, key, &[]).await?;
-    assert_eq!(again.status, 200, "{}", String::from_utf8_lossy(&again.body));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        2,
-        "nothing was written back, so the second HEAD consults the source again"
-    );
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 0);
-    env.assert_local_absent(bucket, key).await;
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/harness_self_test.rs

@@ -1,606 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Self-test of the ODM harness (rustfs/backlog#2151): the fake source's
-//! migration-facing surface (ListObjectsV2 paging, `Range`, unversioned
-//! buckets, metadata replay, fault actions) and the two-server environment.
-//! No ODM behavior is exercised here.
-
-use super::common::{OdmTestEnv, SeedObject, fake_source_client, start_source_rustfs};
-use crate::fake_s3_target::{BucketMode, FakeS3Target, FakeS3TargetOptions, FaultAction, Operation, SeedMetadata};
-use aws_sdk_s3::Client;
-use aws_sdk_s3::error::ProvideErrorMetadata;
-use aws_sdk_s3::primitives::{ByteStream, DateTime};
-use bytes::Bytes;
-use std::collections::BTreeSet;
-use std::time::{Duration, Instant};
-
-type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
-
-const SOURCE_BUCKET: &str = "odm-source";
-
-/// Position-dependent payload so a misaligned range read is caught.
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-async fn fake_source() -> Result<(FakeS3Target, Client), Box<dyn std::error::Error + Send + Sync>> {
-    let source = FakeS3Target::start().await?;
-    source.create_bucket(SOURCE_BUCKET);
-    let client = fake_source_client(&source);
-    Ok((source, client))
-}
-
-/// Full ListObjectsV2 traversal. Returns `(keys, common prefixes, pages)` and
-/// checks the page shape on the way: every page except the last is full and
-/// truncated, the last carries no continuation token.
-async fn list_all(
-    client: &Client,
-    prefix: Option<&str>,
-    delimiter: Option<&str>,
-    start_after: Option<&str>,
-    max_keys: i32,
-) -> Result<(Vec<String>, Vec<String>, usize), Box<dyn std::error::Error + Send + Sync>> {
-    let mut keys = Vec::new();
-    let mut prefixes = Vec::new();
-    let mut pages = 0usize;
-    let mut token: Option<String> = None;
-    loop {
-        let page = client
-            .list_objects_v2()
-            .bucket(SOURCE_BUCKET)
-            .set_prefix(prefix.map(str::to_string))
-            .set_delimiter(delimiter.map(str::to_string))
-            .set_start_after(start_after.map(str::to_string))
-            .max_keys(max_keys)
-            .set_continuation_token(token.clone())
-            .send()
-            .await?;
-        pages += 1;
-        let page_keys: Vec<String> = page
-            .contents()
-            .iter()
-            .filter_map(|object| object.key().map(str::to_string))
-            .collect();
-        let page_prefixes: Vec<String> = page
-            .common_prefixes()
-            .iter()
-            .filter_map(|common| common.prefix().map(str::to_string))
-            .collect();
-        let entries = page_keys.len() + page_prefixes.len();
-        assert_eq!(page.key_count(), Some(entries as i32), "KeyCount must count keys and prefixes");
-        assert_eq!(page.continuation_token(), token.as_deref(), "the request token must be echoed");
-        keys.extend(page_keys);
-        prefixes.extend(page_prefixes);
-        if page.is_truncated() == Some(true) {
-            assert_eq!(entries as i32, max_keys, "every truncated page must be full");
-            token = Some(
-                page.next_continuation_token()
-                    .expect("truncated page must carry a continuation token")
-                    .to_string(),
-            );
-        } else {
-            assert!(page.next_continuation_token().is_none(), "final page must not carry a token");
-            return Ok((keys, prefixes, pages));
-        }
-    }
-}
-
-#[tokio::test]
-async fn fake_source_list_objects_v2_paginates_with_delimiter() -> TestResult {
-    let (source, client) = fake_source().await?;
-    let mut expected_keys = BTreeSet::new();
-    for directory in 0..30 {
-        for file in 0..30 {
-            expected_keys.insert(format!("d{directory:02}/k{file:03}"));
-        }
-    }
-    for index in 0..100 {
-        expected_keys.insert(format!("top-{index:03}"));
-    }
-    assert_eq!(expected_keys.len(), 1000);
-    for key in &expected_keys {
-        source.put_seed_object(SOURCE_BUCKET, key.clone(), Bytes::from(key.clone()), &SeedMetadata::new());
-    }
-    // A key whose current version is a delete marker must stay hidden.
-    client
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key("hidden/marker")
-        .body(ByteStream::from_static(b"gone"))
-        .send()
-        .await?;
-    client
-        .delete_object()
-        .bucket(SOURCE_BUCKET)
-        .key("hidden/marker")
-        .send()
-        .await?;
-    let expected_sorted: Vec<String> = expected_keys.iter().cloned().collect();
-    let expected_prefixes: Vec<String> = (0..30).map(|directory| format!("d{directory:02}/")).collect();
-    let expected_top: Vec<String> = (0..100).map(|index| format!("top-{index:03}")).collect();
-
-    // Flat traversal in byte order, 1000 keys in pages of 7.
-    let (keys, prefixes, pages) = list_all(&client, None, None, None, 7).await?;
-    assert_eq!(keys, expected_sorted);
-    assert!(prefixes.is_empty());
-    assert_eq!(pages, 143);
-
-    // Delimiter folding: 30 common prefixes then 100 top-level keys, pages of 7.
-    let (keys, prefixes, pages) = list_all(&client, None, Some("/"), None, 7).await?;
-    assert_eq!(prefixes, expected_prefixes);
-    assert_eq!(keys, expected_top);
-    assert_eq!(pages, 19);
-
-    // Empty prefix equals no prefix.
-    let (keys, _, _) = list_all(&client, Some(""), None, None, 1000).await?;
-    assert_eq!(keys, expected_sorted);
-
-    // No match: empty, not truncated, no token.
-    let (keys, prefixes, pages) = list_all(&client, Some("zzz/"), Some("/"), None, 7).await?;
-    assert!(keys.is_empty() && prefixes.is_empty());
-    assert_eq!(pages, 1);
-    let (keys, _, _) = list_all(&client, Some("hidden/"), None, None, 7).await?;
-    assert!(keys.is_empty(), "a current delete marker must hide its key");
-
-    // Exact page boundary: 30 keys under one directory, max-keys=30 -> one
-    // untruncated page.
-    let (keys, prefixes, pages) = list_all(&client, Some("d05/"), Some("/"), None, 30).await?;
-    assert_eq!(keys.len(), 30);
-    assert!(prefixes.is_empty());
-    assert_eq!(pages, 1);
-
-    // start-after skips keys at or before the marker.
-    let (keys, _, _) = list_all(&client, None, None, Some("top-097"), 1000).await?;
-    assert_eq!(keys, ["top-098", "top-099"]);
-
-    // max-keys is clamped to 1000; exactly 1000 keys fit in one page.
-    let (keys, _, pages) = list_all(&client, None, None, None, 5000).await?;
-    assert_eq!(keys.len(), 1000);
-    assert_eq!(pages, 1);
-
-    let listings: Vec<_> = source
-        .requests()
-        .into_iter()
-        .filter(|record| record.operation == Operation::ListObjectsV2)
-        .collect();
-    assert!(listings.len() >= 143 + 19);
-    assert!(listings.iter().any(|record| record.prefix.as_deref() == Some("d05/")));
-    assert!(
-        listings.iter().any(|record| record.continuation_token.is_some()),
-        "resumed pages must journal their continuation token"
-    );
-    assert!(listings.iter().all(|record| record.user_agent.is_some()));
-    source.shutdown().await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn fake_source_range_get_variants_and_416() -> TestResult {
-    let (source, client) = fake_source().await?;
-    let body = payload(1000);
-    source.put_seed_object(SOURCE_BUCKET, "ranged", body.clone(), &SeedMetadata::new());
-
-    for (range, expected_range, expected_slice) in [
-        ("bytes=10-19", "bytes 10-19/1000", &body[10..20]),
-        ("bytes=990-", "bytes 990-999/1000", &body[990..]),
-        ("bytes=-5", "bytes 995-999/1000", &body[995..]),
-        ("bytes=0-5000", "bytes 0-999/1000", &body[..]),
-    ] {
-        let output = client
-            .get_object()
-            .bucket(SOURCE_BUCKET)
-            .key("ranged")
-            .range(range)
-            .send()
-            .await?;
-        assert_eq!(output.content_range(), Some(expected_range), "{range}");
-        assert_eq!(output.accept_ranges(), Some("bytes"), "{range}");
-        assert_eq!(output.content_length(), Some(expected_slice.len() as i64), "{range}");
-        let collected = output.body.collect().await?.into_bytes();
-        assert_eq!(collected.as_ref(), expected_slice, "{range}");
-    }
-    let head = client
-        .head_object()
-        .bucket(SOURCE_BUCKET)
-        .key("ranged")
-        .range("bytes=10-19")
-        .send()
-        .await?;
-    assert_eq!(head.content_range(), Some("bytes 10-19/1000"));
-    assert_eq!(head.content_length(), Some(10));
-
-    for range in ["bytes=1000-", "bytes=-0"] {
-        let error = client
-            .get_object()
-            .bucket(SOURCE_BUCKET)
-            .key("ranged")
-            .range(range)
-            .send()
-            .await
-            .expect_err("unsatisfiable range must fail");
-        let response = error.raw_response().expect("416 must retain the raw response");
-        assert_eq!(response.status().as_u16(), 416, "{range}");
-        assert_eq!(response.headers().get("content-range"), Some("bytes */1000"), "{range}");
-        assert_eq!(error.code(), Some("InvalidRange"), "{range}");
-    }
-
-    let ranged = source
-        .requests()
-        .into_iter()
-        .find(|record| record.operation == Operation::GetObject && record.range.as_deref() == Some("bytes=10-19"))
-        .expect("the Range header must be journaled verbatim");
-    assert_eq!(ranged.key.as_deref(), Some("ranged"));
-    assert!(source.count_requests(Operation::GetObject, "ranged") >= 6);
-    source.shutdown().await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn fake_source_unversioned_bucket_overwrites_and_deletes() -> TestResult {
-    let (source, client) = fake_source().await?;
-    source.create_bucket_with_mode("plain-source", BucketMode::Unversioned);
-    let versioning = client.get_bucket_versioning().bucket("plain-source").send().await?;
-    assert!(versioning.status().is_none(), "unversioned bucket must report no versioning status");
-
-    let first = client
-        .put_object()
-        .bucket("plain-source")
-        .key("doc")
-        .body(ByteStream::from_static(b"first"))
-        .send()
-        .await?;
-    assert!(first.version_id().is_none());
-    let second = client
-        .put_object()
-        .bucket("plain-source")
-        .key("doc")
-        .body(ByteStream::from_static(b"second"))
-        .send()
-        .await?;
-    assert!(second.version_id().is_none());
-    let get = client.get_object().bucket("plain-source").key("doc").send().await?;
-    assert!(get.version_id().is_none(), "GET must not return x-amz-version-id");
-    assert_eq!(get.body.collect().await?.into_bytes().as_ref(), b"second");
-    let head = client.head_object().bucket("plain-source").key("doc").send().await?;
-    assert!(head.version_id().is_none(), "HEAD must not return x-amz-version-id");
-    assert_eq!(source.stored_versions("plain-source", "doc").len(), 1, "overwrite must replace in place");
-
-    let deleted = client.delete_object().bucket("plain-source").key("doc").send().await?;
-    assert!(deleted.delete_marker().is_none() && deleted.version_id().is_none());
-    let missing = client
-        .get_object()
-        .bucket("plain-source")
-        .key("doc")
-        .send()
-        .await
-        .expect_err("deleted object must be gone");
-    assert_eq!(missing.raw_response().map(|response| response.status().as_u16()), Some(404));
-    assert_eq!(missing.code(), Some("NoSuchKey"));
-    let missing_head = client
-        .head_object()
-        .bucket("plain-source")
-        .key("doc")
-        .send()
-        .await
-        .expect_err("deleted object must fail HEAD");
-    assert_eq!(missing_head.raw_response().map(|response| response.status().as_u16()), Some(404));
-    assert!(source.stored_versions("plain-source", "doc").is_empty(), "DELETE must not leave a marker");
-
-    // The versioned bucket on the same target keeps its version ids.
-    let versioned = client
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key("doc")
-        .body(ByteStream::from_static(b"versioned"))
-        .send()
-        .await?;
-    assert!(versioned.version_id().is_some());
-    source.shutdown().await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn fake_source_replays_standard_and_user_metadata() -> TestResult {
-    let (source, client) = fake_source().await?;
-    let body = payload(4096);
-    let expected_etag = format!("\"{}\"", {
-        use md5::Digest as _;
-        hex_simd::encode_to_string(md5::Md5::digest(&body), hex_simd::AsciiCase::Lower)
-    });
-    // 2026-01-01T00:00:00Z rendered as an HTTP date by the SDK.
-    let expires = DateTime::from_secs(1_767_225_600);
-    client
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key("meta")
-        .body(ByteStream::from(body.clone()))
-        .content_type("application/x-odm")
-        .content_encoding("gzip")
-        .content_disposition("attachment; filename=\"meta.bin\"")
-        .content_language("en-US")
-        .cache_control("max-age=60")
-        .expires(expires)
-        .metadata("Foo-Bar", "mixed case name")
-        .metadata("UPPER", "upper name")
-        .metadata("already-lower", "lower name")
-        .send()
-        .await?;
-
-    let head = client.head_object().bucket(SOURCE_BUCKET).key("meta").send().await?;
-    let get = client.get_object().bucket(SOURCE_BUCKET).key("meta").send().await?;
-    for (label, content_type, content_encoding, content_disposition, content_language, cache_control, expires_string, e_tag) in [
-        (
-            "HEAD",
-            head.content_type(),
-            head.content_encoding(),
-            head.content_disposition(),
-            head.content_language(),
-            head.cache_control(),
-            head.expires_string(),
-            head.e_tag(),
-        ),
-        (
-            "GET",
-            get.content_type(),
-            get.content_encoding(),
-            get.content_disposition(),
-            get.content_language(),
-            get.cache_control(),
-            get.expires_string(),
-            get.e_tag(),
-        ),
-    ] {
-        assert_eq!(content_type, Some("application/x-odm"), "{label}");
-        assert_eq!(content_encoding, Some("gzip"), "{label}");
-        assert_eq!(content_disposition, Some("attachment; filename=\"meta.bin\""), "{label}");
-        assert_eq!(content_language, Some("en-US"), "{label}");
-        assert_eq!(cache_control, Some("max-age=60"), "{label}");
-        assert_eq!(expires_string, Some("Thu, 01 Jan 2026 00:00:00 GMT"), "{label}");
-        assert_eq!(e_tag, Some(expected_etag.as_str()), "{label}");
-    }
-    for metadata in [head.metadata(), get.metadata()] {
-        let metadata = metadata.expect("user metadata must be replayed");
-        assert_eq!(metadata.get("foo-bar").map(String::as_str), Some("mixed case name"));
-        assert_eq!(metadata.get("upper").map(String::as_str), Some("upper name"));
-        assert_eq!(metadata.get("already-lower").map(String::as_str), Some("lower name"));
-        assert!(!metadata.contains_key("Foo-Bar") && !metadata.contains_key("UPPER"));
-    }
-    assert!(head.last_modified().is_some());
-    assert_eq!(head.last_modified(), get.last_modified());
-    assert_eq!(head.content_length(), Some(4096));
-    assert_eq!(get.body.collect().await?.into_bytes(), body);
-
-    // Seeded objects replay the same way.
-    let seeded_etag = source.put_seed_object(
-        SOURCE_BUCKET,
-        "seeded",
-        Bytes::from_static(b"seeded"),
-        &SeedMetadata::new()
-            .content_type("text/plain")
-            .content_encoding("identity")
-            .cache_control("no-store")
-            .user_metadata("Origin", "seed"),
-    );
-    let seeded = client.head_object().bucket(SOURCE_BUCKET).key("seeded").send().await?;
-    assert_eq!(seeded.e_tag(), Some(format!("\"{seeded_etag}\"").as_str()));
-    assert_eq!(seeded.content_type(), Some("text/plain"));
-    assert_eq!(seeded.content_encoding(), Some("identity"));
-    assert_eq!(seeded.cache_control(), Some("no-store"));
-    assert_eq!(
-        seeded
-            .metadata()
-            .and_then(|metadata| metadata.get("origin"))
-            .map(String::as_str),
-        Some("seed")
-    );
-    source.shutdown().await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn fake_source_fault_actions_truncate_stall_and_status() -> TestResult {
-    let (source, client) = fake_source().await?;
-    let body = payload(4096);
-    source.put_seed_object(SOURCE_BUCKET, "faulty", body.clone(), &SeedMetadata::new());
-
-    // TruncateBodyAt: headers promise 4096 bytes, the body ends after 100.
-    source.inject_for_key(Operation::GetObject, "faulty", FaultAction::TruncateBodyAt(100), 1);
-    let truncated = client.get_object().bucket(SOURCE_BUCKET).key("faulty").send().await?;
-    assert_eq!(truncated.content_length(), Some(4096));
-    let short_read = truncated
-        .body
-        .collect()
-        .await
-        .expect_err("a truncated body must fail to collect");
-    let short_read = short_read.to_string();
-    assert!(!short_read.is_empty());
-
-    // ResponseStatus: arbitrary status with the matching S3 error code.
-    for (code, expected_code) in [
-        (429u16, "SlowDown"),
-        (404, "NoSuchKey"),
-        (500, "InternalError"),
-        (503, "ServiceUnavailable"),
-    ] {
-        source.inject(Operation::GetObject, FaultAction::ResponseStatus(code), 1);
-        let error = client
-            .get_object()
-            .bucket(SOURCE_BUCKET)
-            .key("faulty")
-            .send()
-            .await
-            .expect_err("scripted status must fail");
-        assert_eq!(error.raw_response().map(|response| response.status().as_u16()), Some(code));
-        assert_eq!(error.code(), Some(expected_code));
-    }
-
-    // Stall: the fully computed response is held before its first byte.
-    source.inject(Operation::HeadObject, FaultAction::Stall(Duration::from_millis(400)), 1);
-    let started = Instant::now();
-    let stalled = client.head_object().bucket(SOURCE_BUCKET).key("faulty").send().await?;
-    assert!(started.elapsed() >= Duration::from_millis(350), "stall must delay the first byte");
-    assert_eq!(stalled.content_length(), Some(4096));
-    let post_stall_started = Instant::now();
-    client.head_object().bucket(SOURCE_BUCKET).key("faulty").send().await?;
-    assert!(post_stall_started.elapsed() < Duration::from_millis(350), "stall is consumed once");
-
-    // The object is intact once the script is drained.
-    let intact = client.get_object().bucket(SOURCE_BUCKET).key("faulty").send().await?;
-    assert_eq!(intact.body.collect().await?.into_bytes(), body);
-
-    assert_eq!(source.count_requests(Operation::GetObject, "faulty"), 6);
-    assert_eq!(source.count_requests(Operation::HeadObject, "faulty"), 2);
-    assert_eq!(source.count_requests(Operation::GetObject, "other"), 0);
-    let records = source.requests();
-    assert!(
-        records.iter().all(|record| record
-            .user_agent
-            .as_deref()
-            .is_some_and(|agent| agent.contains("aws-sdk-rust"))),
-        "the SDK user agent must be journaled"
-    );
-    assert!(
-        records
-            .iter()
-            .any(|record| record.fault == Some(FaultAction::TruncateBodyAt(100)))
-    );
-    assert!(
-        records
-            .iter()
-            .any(|record| record.fault == Some(FaultAction::Stall(Duration::from_millis(400))))
-    );
-    source.shutdown().await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn fake_source_raised_object_cap_accepts_large_put() -> TestResult {
-    let source = FakeS3Target::start_with_options(FakeS3TargetOptions {
-        max_object_bytes: 96 * 1024 * 1024,
-    })
-    .await?;
-    source.create_bucket(SOURCE_BUCKET);
-    let client = fake_source_client(&source);
-    let len = 64 * 1024 * 1024 + 1;
-    client
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key("large")
-        .body(ByteStream::from(vec![7u8; len]))
-        .send()
-        .await?;
-    let head = client.head_object().bucket(SOURCE_BUCKET).key("large").send().await?;
-    assert_eq!(head.content_length(), Some(len as i64));
-    let tail = client
-        .get_object()
-        .bucket(SOURCE_BUCKET)
-        .key("large")
-        .range("bytes=-1")
-        .send()
-        .await?;
-    assert_eq!(tail.content_range(), Some(format!("bytes {}-{}/{len}", len - 1, len - 1).as_str()));
-    source.shutdown().await;
-    Ok(())
-}
-
-#[tokio::test]
-async fn odm_env_starts_rustfs_and_fake_source() -> TestResult {
-    let env = OdmTestEnv::start().await?;
-    env.source.create_bucket(SOURCE_BUCKET);
-    let local_bucket = "odm-local";
-    env.rustfs.create_test_bucket(local_bucket).await?;
-
-    let etags = env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new("seed/a", Bytes::from_static(b"alpha")),
-            SeedObject::new("seed/b", Bytes::from_static(b"beta"))
-                .with_metadata(SeedMetadata::new().content_type("text/plain").user_metadata("Kind", "seed")),
-        ],
-    );
-    assert_eq!(etags.len(), 2);
-    assert!(env.source.requests().is_empty(), "seeding must not touch the journal");
-    let source_client = env.source_client();
-    let seeded = source_client.head_object().bucket(SOURCE_BUCKET).key("seed/b").send().await?;
-    assert_eq!(seeded.content_type(), Some("text/plain"));
-    assert_eq!(seeded.e_tag(), Some(format!("\"{}\"", etags[1]).as_str()));
-    assert_eq!(env.source.count_requests(Operation::HeadObject, "seed/b"), 1);
-
-    env.assert_local_absent(local_bucket, "seed/a").await;
-    env.client
-        .put_object()
-        .bucket(local_bucket)
-        .key("seed/a")
-        .body(ByteStream::from_static(b"alpha"))
-        .send()
-        .await?;
-    env.assert_local_present(local_bucket, "seed/a", b"alpha").await;
-    env.assert_local_absent(local_bucket, "seed/b").await;
-
-    let spec = env.fake_source_spec(SOURCE_BUCKET).to_json();
-    assert_eq!(spec["version"], 1);
-    assert_eq!(spec["enabled"], true);
-    assert_eq!(spec["source"]["provider"], "s3");
-    assert_eq!(spec["source"]["endpoint"], env.source.endpoint());
-    assert_eq!(spec["source"]["bucket"], SOURCE_BUCKET);
-    assert_eq!(spec["source"]["credentials"]["secret_key"], "fake-secret");
-    assert_eq!(spec["policy"]["source_timeout"]["first_byte_ms"], 15_000);
-    assert!(spec["policy"]["bandwidth_limit_bytes_per_sec"].is_null());
-    let debug = format!("{:?}", env.fake_source_spec(SOURCE_BUCKET));
-    assert!(!debug.contains("fake-secret"), "Debug output must redact the secret");
-    Ok(())
-}
-
-#[tokio::test]
-async fn start_source_rustfs_round_trips_put_get() -> TestResult {
-    let env = OdmTestEnv::start().await?;
-    let source = start_source_rustfs().await?;
-    assert_ne!(source.url, env.rustfs.url, "the source must be a separate instance");
-
-    source.create_test_bucket(SOURCE_BUCKET).await?;
-    let source_client = source.create_s3_client();
-    let body = payload(70_000);
-    let put = source_client
-        .put_object()
-        .bucket(SOURCE_BUCKET)
-        .key("real/object")
-        .body(ByteStream::from(body.clone()))
-        .content_type("application/octet-stream")
-        .send()
-        .await?;
-    assert!(put.e_tag().is_some());
-    let get = source_client
-        .get_object()
-        .bucket(SOURCE_BUCKET)
-        .key("real/object")
-        .send()
-        .await?;
-    assert_eq!(get.content_type(), Some("application/octet-stream"));
-    assert_eq!(get.body.collect().await?.into_bytes(), body);
-
-    let visible_to_primary = env
-        .client
-        .list_buckets()
-        .send()
-        .await?
-        .buckets()
-        .iter()
-        .any(|bucket| bucket.name() == Some(SOURCE_BUCKET));
-    assert!(!visible_to_primary, "the two servers must not share state");
-    let spec = super::common::OdmSourceSpec::for_rustfs_source(&source, SOURCE_BUCKET).to_json();
-    assert_eq!(spec["source"]["provider"], "rustfs");
-    assert_eq!(spec["source"]["endpoint"], source.url);
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/interaction_test.rs

@@ -1,823 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! How on-demand migration composes with the rest of the bucket surface
-//! (rustfs/backlog#2158): default encryption, Object Lock, quota,
-//! notifications, replication, versioning and delete markers, the disable
-//! switch, and the admin view.
-//!
-//! A pulled object goes through the internal put path, so it must be
-//! indistinguishable from a client PUT. Each case pins both the resulting
-//! local object and what the source was asked for.
-
-use super::common::{
-    AdminResponse, BoxError, OdmEnvOptions, OdmSourceSpec, OdmTestEnv, SeedObject, start_configured_env,
-    start_configured_env_with,
-};
-use crate::common::{RustFSTestEnvironment, replication_fast_env, signed_request};
-use crate::fake_s3_target::{BucketMode, FAKE_ACCESS_KEY, FAKE_SECRET_KEY, FakeS3Target, Operation};
-use crate::object_lock::common::put_object_lock_configuration;
-use aws_sdk_s3::error::ProvideErrorMetadata;
-use aws_sdk_s3::types::{
-    BucketVersioningStatus, Event, FilterRule, FilterRuleName, NotificationConfiguration, NotificationConfigurationFilter,
-    ObjectLockRetentionMode, QueueConfiguration, S3KeyFilter, ServerSideEncryption, ServerSideEncryptionByDefault,
-    ServerSideEncryptionConfiguration, ServerSideEncryptionRule, VersioningConfiguration,
-};
-use bytes::Bytes;
-use local_ip_address::local_ip;
-use rustfs_utils::egress::ENV_OUTBOUND_ALLOW_ORIGINS;
-use serde_json::Value;
-use std::time::{Duration, Instant};
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpListener;
-use tokio::sync::mpsc;
-
-type TestResult = Result<(), BoxError>;
-
-const SOURCE_BUCKET: &str = "odm-interaction-source";
-const ODM_RESPONSE_HEADER: &str = "x-rustfs-on-demand-migration";
-/// `userIdentity.principalId` every write-back event carries.
-const ODM_PRINCIPAL_ID: &str = "rustfs-on-demand-migration";
-const SETTLE: Duration = Duration::from_secs(120);
-
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-async fn admin(
-    env: &RustFSTestEnvironment,
-    method: http::Method,
-    path: &str,
-    body: Option<Value>,
-) -> Result<AdminResponse, BoxError> {
-    let url = format!("{}{path}", env.url);
-    let body = body.map(|value| serde_json::to_vec(&value)).transpose()?;
-    let content_type = body.is_some().then_some("application/json");
-    let response = signed_request(method, &url, &env.access_key, &env.secret_key, body, content_type).await?;
-    Ok(AdminResponse {
-        status: response.status().as_u16(),
-        body: response.text().await?,
-    })
-}
-
-async fn enable_versioning(env: &OdmTestEnv, bucket: &str) -> TestResult {
-    env.client
-        .put_bucket_versioning()
-        .bucket(bucket)
-        .versioning_configuration(
-            VersioningConfiguration::builder()
-                .status(BucketVersioningStatus::Enabled)
-                .build(),
-        )
-        .send()
-        .await?;
-    Ok(())
-}
-
-/// Case 12: a bucket that encrypts by default stores the pulled object
-/// encrypted, and it reads back as plaintext afterwards without touching the
-/// source again.
-#[tokio::test]
-async fn test_odm_pulled_object_uses_bucket_default_encryption() -> TestResult {
-    let bucket = "odm-interaction-sse";
-    let env = start_configured_env_with(
-        OdmEnvOptions {
-            local_kms: true,
-            ..OdmEnvOptions::default()
-        },
-        bucket,
-        SOURCE_BUCKET,
-        |_| {},
-    )
-    .await?;
-    env.client
-        .put_bucket_encryption()
-        .bucket(bucket)
-        .server_side_encryption_configuration(
-            ServerSideEncryptionConfiguration::builder()
-                .rules(
-                    ServerSideEncryptionRule::builder()
-                        .apply_server_side_encryption_by_default(
-                            ServerSideEncryptionByDefault::builder()
-                                .sse_algorithm(ServerSideEncryption::Aes256)
-                                .build()?,
-                        )
-                        .build(),
-                )
-                .build()?,
-        )
-        .send()
-        .await?;
-
-    let key = "sse/report.bin";
-    let body = payload(128 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let first = env.raw_get(bucket, key).await?;
-    assert_eq!(first.status, 200, "{}", String::from_utf8_lossy(&first.body));
-    assert_eq!(first.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(first.body, body);
-    assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "the pull must store the object");
-
-    let second = env.raw_get(bucket, key).await?;
-    assert_eq!(second.status, 200, "{}", String::from_utf8_lossy(&second.body));
-    assert_eq!(second.header(ODM_RESPONSE_HEADER), None, "the second read is local");
-    assert_eq!(
-        second.header("x-amz-server-side-encryption"),
-        Some("AES256"),
-        "the write-back honours the bucket default encryption"
-    );
-    assert_eq!(second.body, body, "the encrypted copy reads back as the source bytes");
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "the encrypted local copy serves the second read"
-    );
-    Ok(())
-}
-
-/// Case 13: a pulled object inherits the bucket's default Object Lock
-/// retention, so it cannot be deleted while the retention holds.
-#[tokio::test]
-async fn test_odm_pulled_object_inherits_object_lock_retention() -> TestResult {
-    let bucket = "odm-interaction-object-lock";
-    let env = OdmTestEnv::start().await?;
-    env.source.create_bucket_with_mode(SOURCE_BUCKET, BucketMode::Unversioned);
-    env.client
-        .create_bucket()
-        .bucket(bucket)
-        .object_lock_enabled_for_bucket(true)
-        .send()
-        .await?;
-    put_object_lock_configuration(&env.client, bucket, ObjectLockRetentionMode::Compliance, Some(1), None).await?;
-    let spec = env.fake_source_spec(SOURCE_BUCKET);
-    env.configure_and_wait(bucket, &spec).await?;
-
-    let key = "locked/record.bin";
-    let body = payload(32 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let pulled = env.raw_get(bucket, key).await?;
-    assert_eq!(pulled.status, 200, "{}", String::from_utf8_lossy(&pulled.body));
-    assert_eq!(pulled.body, body);
-    assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "the pull must store the object");
-
-    let head = env.client.head_object().bucket(bucket).key(key).send().await?;
-    assert_eq!(
-        head.object_lock_mode().map(|mode| mode.as_str()),
-        Some("COMPLIANCE"),
-        "the default retention mode is applied to the pulled object"
-    );
-    assert!(head.object_lock_retain_until_date().is_some(), "a retain-until date is set");
-
-    let version_id = head.version_id().ok_or("an Object Lock bucket is versioned")?.to_string();
-    let error = env
-        .client
-        .delete_object()
-        .bucket(bucket)
-        .key(key)
-        .version_id(&version_id)
-        .send()
-        .await
-        .expect_err("a COMPLIANCE-retained version cannot be deleted");
-    assert_eq!(error.code(), Some("AccessDenied"), "{error:?}");
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "the rejected delete never consults the source"
-    );
-    Ok(())
-}
-
-/// Case 14: the write-back obeys the bucket quota. The client is still
-/// served from the source, but nothing is stored and the failure is counted.
-#[tokio::test]
-async fn test_odm_write_back_respects_the_bucket_quota() -> TestResult {
-    let bucket = "odm-interaction-quota";
-    let env = start_configured_env_with(
-        OdmEnvOptions {
-            env: vec![("RUSTFS_SCANNER_CYCLE", "1"), ("RUSTFS_SCANNER_START_DELAY_SECS", "0")],
-            ..OdmEnvOptions::default()
-        },
-        bucket,
-        SOURCE_BUCKET,
-        |_| {},
-    )
-    .await?;
-
-    // Fill the bucket past the quota it is about to get, so the write-back's
-    // admission check has to reject it.
-    let filler = payload(2 * 1024 * 1024);
-    env.client
-        .put_object()
-        .bucket(bucket)
-        .key("quota/filler.bin")
-        .body(aws_sdk_s3::primitives::ByteStream::from(filler.clone()))
-        .send()
-        .await?;
-    wait_for_bucket_usage(&env, bucket, filler.len() as u64).await?;
-    set_bucket_quota(&env, bucket, 1024 * 1024).await?;
-
-    let key = "quota/oversized.bin";
-    let body = payload(2 * 1024 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 200, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(response.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(response.body, body, "a full bucket still serves the client from the source");
-
-    env.wait_for_status_counter(bucket, "/counters/pull_failures_total/quota", 1, SETTLE)
-        .await?;
-    env.assert_local_absent(bucket, key).await;
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "the rejected write-back is not retried against the source"
-    );
-    Ok(())
-}
-
-/// The quota route answers 503 until the durable-quota capability is
-/// confirmed on the fresh single-node deployment, so the write is retried.
-async fn set_bucket_quota(env: &OdmTestEnv, bucket: &str, quota_bytes: u64) -> TestResult {
-    let deadline = Instant::now() + Duration::from_secs(60);
-    loop {
-        let response = admin(
-            &env.rustfs,
-            http::Method::PUT,
-            &format!("/rustfs/admin/v3/quota/{bucket}"),
-            Some(serde_json::json!({ "quota": quota_bytes, "quota_type": "HARD" })),
-        )
-        .await?;
-        if response.status < 300 {
-            return Ok(());
-        }
-        if response.status != 503 || Instant::now() >= deadline {
-            return Err(format!("set quota for {bucket}: {} {}", response.status, response.body).into());
-        }
-        tokio::time::sleep(Duration::from_millis(500)).await;
-    }
-}
-
-async fn wait_for_bucket_usage(env: &OdmTestEnv, bucket: &str, at_least: u64) -> TestResult {
-    let deadline = Instant::now() + Duration::from_secs(60);
-    loop {
-        let response = admin(&env.rustfs, http::Method::GET, &format!("/rustfs/admin/v3/quota-stats/{bucket}"), None).await?;
-        if response.status == 200 {
-            let usage = serde_json::from_str::<Value>(&response.body)?
-                .get("current_usage")
-                .and_then(Value::as_u64)
-                .unwrap_or(0);
-            if usage >= at_least {
-                return Ok(());
-            }
-        }
-        if Instant::now() >= deadline {
-            return Err(format!("bucket usage for {bucket} did not reach {at_least} bytes: {}", response.body).into());
-        }
-        tokio::time::sleep(Duration::from_millis(200)).await;
-    }
-}
-
-/// Case 15: a pull emits an ordinary creation event attributed to the
-/// migration principal, and `emit_events=false` silences it.
-#[tokio::test]
-async fn test_odm_pull_emits_object_created_events_unless_disabled() -> TestResult {
-    let emitting = "odm-interaction-events";
-    let silent = "odm-interaction-events-off";
-    // The collector binds first: the outbound guard rejects a webhook
-    // endpoint on a private address unless its origin is allowed at startup.
-    let (endpoint, mut events) = spawn_event_collector().await?;
-    let allowed_origin = reqwest::Url::parse(&endpoint)?.origin().ascii_serialization();
-    let env = start_configured_env_with(
-        OdmEnvOptions {
-            env: vec![(ENV_OUTBOUND_ALLOW_ORIGINS, allowed_origin.as_str())],
-            ..OdmEnvOptions::default()
-        },
-        emitting,
-        SOURCE_BUCKET,
-        |_| {},
-    )
-    .await?;
-    let mut silent_spec = env.fake_source_spec(SOURCE_BUCKET);
-    silent_spec.policy.emit_events = false;
-    env.configure_and_wait(silent, &silent_spec).await?;
-
-    let target = "odm-events";
-    let switches = admin(
-        &env.rustfs,
-        http::Method::PUT,
-        "/rustfs/admin/v3/module-switches",
-        Some(serde_json::json!({ "notify_enabled": true, "audit_enabled": false })),
-    )
-    .await?;
-    assert_eq!(switches.status, 200, "{}", switches.body);
-    let queue_dir = format!("{}/notify-queue-{target}", env.rustfs.temp_dir);
-    tokio::fs::create_dir_all(&queue_dir).await?;
-    let configured = admin(
-        &env.rustfs,
-        http::Method::PUT,
-        &format!("/rustfs/admin/v3/target/notify_webhook/{target}"),
-        Some(serde_json::json!({
-            "key_values": [
-                { "key": "endpoint", "value": endpoint },
-                { "key": "queue_dir", "value": queue_dir },
-            ]
-        })),
-    )
-    .await?;
-    assert_eq!(configured.status, 200, "{}", configured.body);
-    wait_for_target_online(&env.rustfs, target).await?;
-    for bucket in [emitting, silent] {
-        put_notification_config(&env, bucket, target).await?;
-    }
-
-    // Control: an ordinary client PUT must produce an event, so a missing
-    // one below is about the write-back and not about the pipeline.
-    let control_key = "events/control.bin";
-    env.client
-        .put_object()
-        .bucket(emitting)
-        .key(control_key)
-        .body(aws_sdk_s3::primitives::ByteStream::from(payload(1024)))
-        .send()
-        .await?;
-    let control = wait_for_event(&mut events, emitting, control_key, Duration::from_secs(60))
-        .await
-        .ok_or("the notification pipeline delivered no event for a plain PUT")?;
-    assert_eq!(
-        control.pointer("/eventName").and_then(Value::as_str),
-        Some("s3:ObjectCreated:Put"),
-        "{control}"
-    );
-
-    let emitting_key = "events/pulled.bin";
-    let silent_key = "events/quiet.bin";
-    let body = payload(16 * 1024);
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new(emitting_key, body.clone()),
-            SeedObject::new(silent_key, body.clone()),
-        ],
-    );
-
-    for (bucket, key) in [(emitting, emitting_key), (silent, silent_key)] {
-        let response = env.raw_get(bucket, key).await?;
-        assert_eq!(response.status, 200, "{bucket}: {}", String::from_utf8_lossy(&response.body));
-        assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "{bucket}/{key} must be stored");
-        assert_eq!(env.source.count_requests(Operation::GetObject, key), 1, "{bucket}/{key}");
-    }
-
-    let record = wait_for_event(&mut events, emitting, emitting_key, Duration::from_secs(60))
-        .await
-        .ok_or("no creation event for the pulled object")?;
-    assert_eq!(
-        record.pointer("/eventName").and_then(Value::as_str),
-        Some("s3:ObjectCreated:Put"),
-        "{record}"
-    );
-    assert_eq!(
-        record.pointer("/userIdentity/principalId").and_then(Value::as_str),
-        Some(ODM_PRINCIPAL_ID),
-        "{record}"
-    );
-
-    // The silent bucket's object landed before the event above was observed,
-    // so a missing event here is a decision, not a race.
-    assert!(
-        wait_for_event(&mut events, silent, silent_key, Duration::from_secs(5))
-            .await
-            .is_none(),
-        "emit_events=false must not publish a creation event"
-    );
-    Ok(())
-}
-
-async fn put_notification_config(env: &OdmTestEnv, bucket: &str, target: &str) -> TestResult {
-    let queue = QueueConfiguration::builder()
-        .id(format!("{bucket}-rule"))
-        .queue_arn(format!("arn:rustfs:sqs:us-east-1:{target}:webhook"))
-        .events(Event::from("s3:ObjectCreated:*"))
-        .filter(
-            NotificationConfigurationFilter::builder()
-                .key(
-                    S3KeyFilter::builder()
-                        .filter_rules(FilterRule::builder().name(FilterRuleName::Prefix).value("events/").build())
-                        .build(),
-                )
-                .build(),
-        )
-        .build()?;
-    env.client
-        .put_bucket_notification_configuration()
-        .bucket(bucket)
-        .notification_configuration(NotificationConfiguration::builder().queue_configurations(queue).build())
-        .send()
-        .await?;
-    Ok(())
-}
-
-async fn wait_for_target_online(env: &RustFSTestEnvironment, target: &str) -> TestResult {
-    let deadline = Instant::now() + Duration::from_secs(30);
-    loop {
-        let response = admin(env, http::Method::GET, "/rustfs/admin/v3/target/list", None).await?;
-        if response.status == 200 {
-            let body: Value = serde_json::from_str(&response.body)?;
-            let online = body["notification_endpoints"].as_array().is_some_and(|endpoints| {
-                endpoints.iter().any(|endpoint| {
-                    endpoint["account_id"].as_str() == Some(target) && endpoint["status"].as_str() == Some("online")
-                })
-            });
-            if online {
-                return Ok(());
-            }
-        }
-        if Instant::now() >= deadline {
-            return Err(format!("webhook target {target} did not come online: {}", response.body).into());
-        }
-        tokio::time::sleep(Duration::from_millis(200)).await;
-    }
-}
-
-/// Minimal HTTP receiver: answers everything 200 (so the target's
-/// reachability probe reports online) and forwards parsed POST bodies.
-async fn spawn_event_collector() -> Result<(String, mpsc::UnboundedReceiver<Value>), BoxError> {
-    let listener = TcpListener::bind("0.0.0.0:0").await?;
-    let port = listener.local_addr()?.port();
-    let endpoint = format!("http://{}/events", std::net::SocketAddr::new(local_ip()?, port));
-    let (tx, rx) = mpsc::unbounded_channel();
-    tokio::spawn(async move {
-        while let Ok((mut stream, _)) = listener.accept().await {
-            let tx = tx.clone();
-            tokio::spawn(async move {
-                let mut buffer = Vec::new();
-                let mut chunk = [0_u8; 4096];
-                let mut content_length = 0usize;
-                let mut header_end = None;
-                while header_end.is_none() {
-                    match stream.read(&mut chunk).await {
-                        Ok(0) | Err(_) => return,
-                        Ok(read) => buffer.extend_from_slice(&chunk[..read]),
-                    }
-                    header_end = buffer.windows(4).position(|window| window == b"\r\n\r\n");
-                }
-                let header_end = header_end.expect("loop exits only with a header end");
-                let headers = String::from_utf8_lossy(&buffer[..header_end]).to_string();
-                for line in headers.split("\r\n").skip(1) {
-                    if let Some((name, value)) = line.split_once(':')
-                        && name.trim().eq_ignore_ascii_case("content-length")
-                    {
-                        content_length = value.trim().parse().unwrap_or(0);
-                    }
-                }
-                let body_offset = header_end + 4;
-                while buffer.len() - body_offset < content_length {
-                    match stream.read(&mut chunk).await {
-                        Ok(0) | Err(_) => return,
-                        Ok(read) => buffer.extend_from_slice(&chunk[..read]),
-                    }
-                }
-                let _ = stream
-                    .write_all(b"HTTP/1.1 200 OK\r\ncontent-length: 0\r\nconnection: close\r\n\r\n")
-                    .await;
-                let _ = stream.shutdown().await;
-                if let Ok(value) = serde_json::from_slice::<Value>(&buffer[body_offset..body_offset + content_length]) {
-                    let _ = tx.send(value);
-                }
-            });
-        }
-    });
-    Ok((endpoint, rx))
-}
-
-/// The first delivered record for `bucket`/`key`, or `None` on timeout.
-async fn wait_for_event(
-    events: &mut mpsc::UnboundedReceiver<Value>,
-    bucket: &str,
-    key: &str,
-    timeout: Duration,
-) -> Option<Value> {
-    let deadline = Instant::now() + timeout;
-    loop {
-        let remaining = deadline.checked_duration_since(Instant::now())?;
-        let envelope = tokio::time::timeout(remaining, events.recv()).await.ok()??;
-        for record in envelope["Records"].as_array().into_iter().flatten() {
-            // S3 event notifications URL-encode the object key.
-            let record_key = record.pointer("/s3/object/key").and_then(Value::as_str).map(|raw| {
-                urlencoding::decode(raw)
-                    .map(|decoded| decoded.into_owned())
-                    .unwrap_or_else(|_| raw.to_string())
-            });
-            if record.pointer("/s3/bucket/name").and_then(Value::as_str) == Some(bucket) && record_key.as_deref() == Some(key) {
-                return Some(record.clone());
-            }
-        }
-    }
-}
-
-/// Case 16: a pulled object enters the replication pipeline like any other
-/// write, and a configuration whose source is one of the bucket's own
-/// replication targets is rejected.
-#[tokio::test]
-async fn test_odm_pulled_object_replicates_and_target_as_source_is_rejected() -> TestResult {
-    let bucket = "odm-interaction-replication";
-    let replica_bucket = "odm-replica";
-    let fast_env = replication_fast_env();
-    let env = start_configured_env_with(
-        OdmEnvOptions {
-            env: fast_env.clone(),
-            ..OdmEnvOptions::default()
-        },
-        bucket,
-        SOURCE_BUCKET,
-        |_| {},
-    )
-    .await?;
-    let replica = FakeS3Target::start().await?;
-    replica.create_bucket(replica_bucket);
-
-    enable_versioning(&env, bucket).await?;
-    let arn = set_remote_target(&env.rustfs, bucket, &replica.address(), replica_bucket).await?;
-    put_bucket_replication(&env.rustfs, bucket, &arn).await?;
-
-    let key = "replicated/asset.bin";
-    let body = payload(64 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, body.clone())]);
-
-    let response = env.raw_get(bucket, key).await?;
-    assert_eq!(response.status, 200, "{}", String::from_utf8_lossy(&response.body));
-    assert_eq!(response.body, body);
-    assert!(env.wait_local_listed(bucket, key, SETTLE).await?, "the pull must store the object");
-
-    let deadline = Instant::now() + SETTLE;
-    while !replica.has_object(replica_bucket, key) {
-        assert!(Instant::now() < deadline, "the pulled object was never replicated to the target");
-        tokio::time::sleep(Duration::from_millis(200)).await;
-    }
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, key),
-        1,
-        "replication reads the local copy, never the migration source"
-    );
-
-    let looping = OdmSourceSpec::for_fake_source(&replica, replica_bucket);
-    let rejected = env.configure_source(bucket, &looping).await?;
-    assert_eq!(
-        rejected.status, 400,
-        "a bucket may not migrate from its own replication target: {}",
-        rejected.body
-    );
-    Ok(())
-}
-
-async fn set_remote_target(
-    env: &RustFSTestEnvironment,
-    bucket: &str,
-    endpoint: &str,
-    target_bucket: &str,
-) -> Result<String, BoxError> {
-    let response = admin(
-        env,
-        http::Method::PUT,
-        &format!("/rustfs/admin/v3/set-remote-target?bucket={}", urlencoding::encode(bucket)),
-        Some(serde_json::json!({
-            "endpoint": endpoint,
-            "credentials": { "accessKey": FAKE_ACCESS_KEY, "secretKey": FAKE_SECRET_KEY },
-            "targetbucket": target_bucket,
-            "secure": false,
-            "skipTlsVerify": false,
-            "type": "replication"
-        })),
-    )
-    .await?;
-    if response.status != 200 {
-        return Err(format!("set remote target: {} {}", response.status, response.body).into());
-    }
-    Ok(serde_json::from_str(&response.body)?)
-}
-
-async fn put_bucket_replication(env: &RustFSTestEnvironment, bucket: &str, arn: &str) -> TestResult {
-    let body = format!(
-        r#"<ReplicationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Role></Role>
-  <Rule>
-    <ID>odm-rule</ID>
-    <Priority>1</Priority>
-    <Status>Enabled</Status>
-    <DeleteMarkerReplication><Status>Enabled</Status></DeleteMarkerReplication>
-    <ExistingObjectReplication><Status>Enabled</Status></ExistingObjectReplication>
-    <Destination><Bucket>{arn}</Bucket></Destination>
-  </Rule>
-</ReplicationConfiguration>"#
-    );
-    let url = format!("{}/{bucket}?replication", env.url);
-    let response = signed_request(
-        http::Method::PUT,
-        &url,
-        &env.access_key,
-        &env.secret_key,
-        Some(body.into_bytes()),
-        Some("application/xml"),
-    )
-    .await?;
-    if response.status() != 200 {
-        let status = response.status();
-        return Err(format!("put bucket replication: {status} {}", response.text().await.unwrap_or_default()).into());
-    }
-    Ok(())
-}
-
-/// Case 17: a local delete marker is the authoritative answer in a versioned
-/// bucket, while an unversioned delete leaves nothing behind and the key is
-/// migrated again.
-#[tokio::test]
-async fn test_odm_delete_marker_shadows_the_source_but_a_plain_delete_does_not() -> TestResult {
-    let versioned = "odm-interaction-delete-marker";
-    let unversioned = "odm-interaction-plain-delete";
-    let env = start_configured_env(versioned, SOURCE_BUCKET, |_| {}).await?;
-    let spec = env.fake_source_spec(SOURCE_BUCKET);
-    env.configure_and_wait(unversioned, &spec).await?;
-    enable_versioning(&env, versioned).await?;
-
-    let key = "deleted/doc.bin";
-    let source_body = payload(8 * 1024);
-    let local_body = payload(4 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(key, source_body.clone())]);
-
-    for bucket in [versioned, unversioned] {
-        env.client
-            .put_object()
-            .bucket(bucket)
-            .key(key)
-            .body(aws_sdk_s3::primitives::ByteStream::from(local_body.clone()))
-            .send()
-            .await?;
-        env.client.delete_object().bucket(bucket).key(key).send().await?;
-    }
-
-    let shadowed = env.raw_get(versioned, key).await?;
-    assert_eq!(shadowed.status, 404, "{}", String::from_utf8_lossy(&shadowed.body));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, key),
-        0,
-        "a local delete marker answers without the source"
-    );
-
-    let migrated = env.raw_get(unversioned, key).await?;
-    assert_eq!(migrated.status, 200, "{}", String::from_utf8_lossy(&migrated.body));
-    assert_eq!(migrated.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(migrated.body, source_body, "an unversioned delete leaves the source authoritative");
-    assert_eq!(env.source.count_requests(Operation::HeadObject, key), 1);
-    assert_eq!(env.source.count_requests(Operation::GetObject, key), 1);
-    Ok(())
-}
-
-/// Case 18: deleting the configuration stops all source traffic without
-/// touching what was already migrated, and reinstalling it resumes.
-#[tokio::test]
-async fn test_odm_disable_keeps_pulled_objects_and_stops_source_traffic() -> TestResult {
-    let bucket = "odm-interaction-disable";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    let pulled_key = "disable/pulled.bin";
-    let untouched_key = "disable/untouched.bin";
-    let body = payload(32 * 1024);
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new(pulled_key, body.clone()),
-            SeedObject::new(untouched_key, body.clone()),
-        ],
-    );
-
-    let pulled = env.raw_get(bucket, pulled_key).await?;
-    assert_eq!(pulled.status, 200, "{}", String::from_utf8_lossy(&pulled.body));
-    assert!(env.wait_local_listed(bucket, pulled_key, SETTLE).await?);
-
-    let disabled = env.disable(bucket).await?;
-    assert_eq!(disabled.status, 204, "{}", disabled.body);
-
-    let still_readable = env.raw_get(bucket, pulled_key).await?;
-    assert_eq!(still_readable.status, 200, "{}", String::from_utf8_lossy(&still_readable.body));
-    assert_eq!(still_readable.body, body, "a migrated object survives the disable");
-    assert_eq!(still_readable.header(ODM_RESPONSE_HEADER), None);
-    assert_eq!(env.source.count_requests(Operation::GetObject, pulled_key), 1);
-
-    let missing = env.raw_get(bucket, untouched_key).await?;
-    assert_eq!(missing.status, 404, "{}", String::from_utf8_lossy(&missing.body));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, untouched_key),
-        0,
-        "a disabled bucket never reaches the source"
-    );
-
-    let spec = env.fake_source_spec(SOURCE_BUCKET);
-    env.configure_and_wait(bucket, &spec).await?;
-    let resumed = env.raw_get(bucket, untouched_key).await?;
-    assert_eq!(resumed.status, 200, "{}", String::from_utf8_lossy(&resumed.body));
-    assert_eq!(resumed.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(resumed.body, body);
-    assert_eq!(env.source.count_requests(Operation::GetObject, untouched_key), 1);
-    Ok(())
-}
-
-/// Case 19: the admin surface an operator sees — the configuration read back
-/// without its secret, and a status document whose counters match the source
-/// journal exactly.
-#[tokio::test]
-async fn test_odm_admin_config_is_redacted_and_status_counts_match_the_source() -> TestResult {
-    let bucket = "odm-interaction-admin";
-    let env = start_configured_env(bucket, SOURCE_BUCKET, |_| {}).await?;
-    let hit_key = "admin/present.bin";
-    let miss_key = "admin/absent.bin";
-    let body = payload(16 * 1024);
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new(hit_key, body.clone())]);
-
-    let config = env.get_config(bucket).await?;
-    assert_eq!(config.status, 200, "{}", config.body);
-    let config = config.json()?;
-    assert_eq!(
-        config
-            .pointer("/config/source/credentials/secret_key")
-            .and_then(Value::as_str),
-        Some("REDACTED"),
-        "{config}"
-    );
-    assert_eq!(
-        config
-            .pointer("/config/source/credentials/access_key")
-            .and_then(Value::as_str),
-        Some(FAKE_ACCESS_KEY),
-        "the access key stays readable: {config}"
-    );
-    assert!(
-        !config.to_string().contains(FAKE_SECRET_KEY),
-        "the secret must not appear anywhere in the response"
-    );
-
-    let hit = env.raw_get(bucket, hit_key).await?;
-    assert_eq!(hit.status, 200, "{}", String::from_utf8_lossy(&hit.body));
-    for _ in 0..2 {
-        let miss = env.raw_get(bucket, miss_key).await?;
-        assert_eq!(miss.status, 404, "{}", String::from_utf8_lossy(&miss.body));
-    }
-    assert!(env.wait_local_listed(bucket, hit_key, SETTLE).await?);
-
-    let status = env.status_json(bucket).await?;
-    assert_eq!(status.pointer("/configured").and_then(Value::as_bool), Some(true), "{status}");
-    assert_eq!(status.pointer("/enabled").and_then(Value::as_bool), Some(true), "{status}");
-    assert_eq!(status.pointer("/module_enabled").and_then(Value::as_bool), Some(true), "{status}");
-    assert_eq!(status.pointer("/provider").and_then(Value::as_str), Some("s3"), "{status}");
-    assert_eq!(
-        status
-            .pointer("/counters/requests_total/get/source_hit")
-            .and_then(Value::as_u64),
-        Some(1),
-        "one source hit, matching the one source GET: {status}"
-    );
-    assert_eq!(
-        status
-            .pointer("/counters/requests_total/get/source_miss")
-            .and_then(Value::as_u64),
-        Some(1),
-        "only the first miss reached the source: {status}"
-    );
-    assert_eq!(
-        status
-            .pointer("/counters/requests_total/get/negative_cached")
-            .and_then(Value::as_u64),
-        Some(1),
-        "the second miss stopped at the negative cache: {status}"
-    );
-    assert_eq!(
-        status
-            .pointer("/counters/pulled_objects_total/inline")
-            .and_then(Value::as_u64),
-        Some(1),
-        "{status}"
-    );
-    assert_eq!(
-        status.pointer("/counters/pulled_bytes_total").and_then(Value::as_u64),
-        Some(body.len() as u64),
-        "{status}"
-    );
-    assert_eq!(env.source.count_requests(Operation::GetObject, hit_key), 1);
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, miss_key),
-        1,
-        "the status counters and the source journal agree"
-    );
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/interop_test.rs

@@ -1,243 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Provider interoperability cases (ODM-20, rustfs/backlog#2167).
-//!
-//! One body per case, run against whichever source the environment names:
-//! the in-process fake source locally, a MinIO container or a real cloud
-//! provider under `.github/workflows/on-demand-migration-interop.yml`. The
-//! source is resolved by [`OdmInteropEnv`], so a provider difference in
-//! path-style addressing, region handling, ETag shape or list pagination
-//! shows up as one of these assertions failing rather than as a second,
-//! drifting copy of the suite.
-//!
-//! Consequently these cases assert only on what every S3 implementation has
-//! to agree on — what the client receives and what RustFS stored — never on
-//! the fake source's request journal, which a real provider does not have.
-//! The journal-backed expectations stay in `get_basic_test.rs` and
-//! `interaction_test.rs`.
-//!
-//! The first three cases are the minimum a cloud provider is asked for (GET
-//! miss, HEAD miss, merged list pagination); the backfill case runs against
-//! the MinIO container, whose object count the lane raises well past the fake
-//! source's caps.
-
-use super::common::{BackfillRequest, BoxError, OdmInteropEnv, SeedObject, interop_backfill_objects};
-use bytes::Bytes;
-use std::time::Duration;
-
-type TestResult = Result<(), BoxError>;
-
-const ODM_RESPONSE_HEADER: &str = "x-rustfs-on-demand-migration";
-/// Background pulls land after the response that triggered them; generous for
-/// a loaded runner talking to a container.
-const SETTLE: Duration = Duration::from_secs(90);
-
-/// Position-dependent payload so a misaligned or truncated copy is caught.
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-/// A GET miss is answered from the source with the source's own ETag, and the
-/// object it stored serves every later read locally.
-#[tokio::test]
-async fn interop_get_miss_pulls_from_the_source_and_serves_locally() -> TestResult {
-    let case =
-        OdmInteropEnv::start("interop_get_miss_pulls_from_the_source_and_serves_locally", "odm-interop-get", |_| {}).await?;
-    let key = "interop/report.bin";
-    let body = payload(200 * 1024);
-    let etag = case.seed(&[SeedObject::new(key, body.clone())]).await?.remove(0);
-    let quoted_etag = format!("\"{etag}\"");
-
-    let first = case.env.raw_get(&case.bucket, key).await?;
-    assert_eq!(first.status, 200, "{}", String::from_utf8_lossy(&first.body));
-    assert_eq!(first.header(ODM_RESPONSE_HEADER), Some("source"), "a source answer is marked");
-    assert_eq!(first.header("content-length"), Some(body.len().to_string().as_str()));
-    assert_eq!(
-        first.header("etag"),
-        Some(quoted_etag.as_str()),
-        "the source ETag is passed through unchanged"
-    );
-    assert_eq!(first.body, body, "the client receives the source bytes");
-
-    assert!(
-        case.env.wait_local_listed(&case.bucket, key, SETTLE).await?,
-        "the inline pull must store the object locally"
-    );
-    let second = case.env.raw_get(&case.bucket, key).await?;
-    assert_eq!(second.status, 200, "{}", String::from_utf8_lossy(&second.body));
-    assert_eq!(second.header(ODM_RESPONSE_HEADER), None, "a local hit carries no source marker");
-    assert_eq!(second.body, body, "the local copy is the source bytes");
-    assert_eq!(
-        second.header("etag"),
-        Some(quoted_etag.as_str()),
-        "preserve_etag keeps the source ETag on the stored object"
-    );
-    case.finish().await
-}
-
-/// A HEAD miss is proxied with the source's size and ETag and stores nothing.
-#[tokio::test]
-async fn interop_head_miss_answers_from_the_source_without_persisting() -> TestResult {
-    let case =
-        OdmInteropEnv::start("interop_head_miss_answers_from_the_source_without_persisting", "odm-interop-head", |_| {}).await?;
-    let key = "interop/head-only.bin";
-    let body = payload(9_000);
-    let etag = case.seed(&[SeedObject::new(key, body.clone())]).await?.remove(0);
-
-    let head = case
-        .env
-        .raw_object_request(http::Method::HEAD, &case.bucket, key, &[])
-        .await?;
-    assert_eq!(head.status, 200, "HEAD must be answered from the source");
-    assert_eq!(head.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(head.header("content-length"), Some(body.len().to_string().as_str()));
-    assert_eq!(head.header("etag"), Some(format!("\"{etag}\"").as_str()));
-    assert!(head.body.is_empty(), "a HEAD carries no body");
-    case.env.assert_local_absent(&case.bucket, key).await;
-
-    // A key the source does not hold is a plain 404, not a source error.
-    let missing = case
-        .env
-        .raw_object_request(http::Method::HEAD, &case.bucket, "interop/absent.bin", &[])
-        .await?;
-    assert_eq!(missing.status, 404, "a source miss is a 404");
-    case.finish().await
-}
-
-/// The merged `ListObjectsV2` pages the source namespace in byte order, keeps
-/// every page within `max_keys`, and lets a local object win a shared key.
-#[tokio::test]
-async fn interop_list_through_pages_the_source_namespace() -> TestResult {
-    const SOURCE_KEYS: usize = 120;
-    const PAGE_SIZE: i32 = 50;
-    const SOURCE_BODY_LEN: usize = 3;
-    const LOCAL_BODY_LEN: usize = 11;
-
-    let case = OdmInteropEnv::start("interop_list_through_pages_the_source_namespace", "odm-interop-list", |spec| {
-        spec.policy.list_through = true
-    })
-    .await?;
-    let keys: Vec<String> = (0..SOURCE_KEYS).map(|index| format!("page/obj-{index:05}")).collect();
-    let seeds: Vec<SeedObject> = keys
-        .iter()
-        .map(|key| SeedObject::new(key.clone(), payload(SOURCE_BODY_LEN)))
-        .collect();
-    case.seed(&seeds).await?;
-
-    // Five keys the local bucket also holds, with a body length that tells the
-    // two sides apart in the listing.
-    let shared: Vec<String> = keys.iter().step_by(25).cloned().collect();
-    for key in &shared {
-        case.env
-            .client
-            .put_object()
-            .bucket(&case.bucket)
-            .key(key)
-            .body(aws_sdk_s3::primitives::ByteStream::from(payload(LOCAL_BODY_LEN)))
-            .send()
-            .await?;
-    }
-
-    let mut listed: Vec<(String, i64)> = Vec::new();
-    let mut token: Option<String> = None;
-    let mut completed = false;
-    for _ in 0..SOURCE_KEYS {
-        let page = case
-            .env
-            .client
-            .list_objects_v2()
-            .bucket(&case.bucket)
-            .prefix("page/")
-            .max_keys(PAGE_SIZE)
-            .set_continuation_token(token.take())
-            .send()
-            .await?;
-        assert!(page.contents().len() <= PAGE_SIZE as usize, "a merged page must not exceed max_keys");
-        for object in page.contents() {
-            listed.push((object.key().unwrap_or_default().to_string(), object.size().unwrap_or_default()));
-        }
-        if !page.is_truncated().unwrap_or(false) {
-            completed = true;
-            break;
-        }
-        token = Some(
-            page.next_continuation_token()
-                .ok_or("truncated merged page without a continuation token")?
-                .to_string(),
-        );
-    }
-    assert!(completed, "the merged listing did not terminate");
-
-    let listed_keys: Vec<String> = listed.iter().map(|(key, _)| key.clone()).collect();
-    assert_eq!(listed_keys, keys, "the merged listing is the source namespace in byte order");
-    for (key, size) in &listed {
-        let expected = if shared.contains(key) {
-            LOCAL_BODY_LEN
-        } else {
-            SOURCE_BODY_LEN
-        };
-        assert_eq!(*size, expected as i64, "{key} must be reported by the side that wins it");
-    }
-    case.finish().await
-}
-
-/// A backfill pulls every object under the run's source prefix. The count
-/// comes from the environment: the fake source caps out around 4,096 stored
-/// versions, while the MinIO lane runs the full production-shaped batch.
-#[tokio::test]
-async fn interop_backfill_pulls_every_source_object() -> TestResult {
-    const KEY_PREFIX: &str = "cold/";
-    let count = interop_backfill_objects()?;
-    assert!(count > 0, "the backfill case needs at least one source object");
-    let case = OdmInteropEnv::start("interop_backfill_pulls_every_source_object", "odm-interop-backfill", |_| {}).await?;
-
-    let objects: Vec<SeedObject> = (0..count)
-        .map(|index| SeedObject::new(format!("{KEY_PREFIX}{index:06}"), Bytes::from(format!("object-{index:06}"))))
-        .collect();
-    case.seed(&objects).await?;
-
-    let started = case.env.start_backfill(&case.bucket, BackfillRequest::default()).await?;
-    assert_eq!(started.status, 200, "start backfill: {}", started.body);
-
-    // One pull is a HEAD plus a GET plus a local write; the ceiling scales
-    // with the object count so raising it in the workflow does not need a
-    // second knob here.
-    let timeout = Duration::from_secs(180 + count as u64 / 5);
-    let done = case
-        .env
-        .wait_for_backfill(&case.bucket, timeout, |job| job["state"] == "completed")
-        .await?;
-    for (name, expected) in [
-        ("listed", count as u64),
-        ("enqueued", count as u64),
-        ("pulled", count as u64),
-        ("failed", 0),
-    ] {
-        assert_eq!(
-            done[name].as_u64().unwrap_or_else(|| panic!("{name} missing in {done}")),
-            expected,
-            "backfill {name}"
-        );
-    }
-    assert_eq!(
-        case.env.local_key_count(&case.bucket, KEY_PREFIX).await?,
-        count,
-        "every source object must be stored locally"
-    );
-    case.env
-        .assert_local_present(&case.bucket, &objects[count - 1].key, &objects[count - 1].body)
-        .await;
-    case.finish().await
-}

crates/e2e_test/src/on_demand_migration/list_through_test.rs

@@ -1,365 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Optional merged `ListObjectsV2` (`policy.list_through`, ODM-17,
-//! rustfs/backlog#2164): full pagination over a source and a local namespace,
-//! common-prefix union under a delimiter, the continuation-token contract, and
-//! the two `source_error` behaviours when the source listing fails.
-
-use super::common::{BoxError, OdmSourceSpec, OdmTestEnv, SeedObject, start_configured_env};
-use crate::fake_s3_target::{FaultAction, Operation};
-use aws_sdk_s3::types::{BucketVersioningStatus, VersioningConfiguration};
-use bytes::Bytes;
-
-type TestResult = Result<(), BoxError>;
-
-const SOURCE_BUCKET: &str = "odm-list-source";
-const LIST_HEADER: &str = "x-rustfs-on-demand-migration-list";
-
-/// Byte lengths that tell a local object from a source one in a listing.
-const SOURCE_BODY_LEN: usize = 3;
-const LOCAL_BODY_LEN: usize = 11;
-
-fn body(len: usize) -> Bytes {
-    vec![b'x'; len].into()
-}
-
-/// RustFS migrating `bucket` from `SOURCE_BUCKET` with `list_through` on.
-async fn list_through_env(bucket: &str, adjust: impl FnOnce(&mut OdmSourceSpec)) -> Result<OdmTestEnv, BoxError> {
-    start_configured_env(bucket, SOURCE_BUCKET, |spec| {
-        spec.policy.list_through = true;
-        adjust(spec);
-    })
-    .await
-}
-
-/// Every key the bucket lists, walked through the merged continuation token.
-/// Also returns the size each page reported per key and the page sizes, so a
-/// caller can assert who won a shared key and that no page exceeded `max_keys`.
-async fn walk_listing(
-    env: &OdmTestEnv,
-    bucket: &str,
-    delimiter: Option<&str>,
-    max_keys: i32,
-) -> Result<(Vec<(String, i64)>, Vec<String>, Vec<usize>), BoxError> {
-    let mut objects = Vec::new();
-    let mut prefixes = Vec::new();
-    let mut page_sizes = Vec::new();
-    let mut token: Option<String> = None;
-    for _ in 0..1000 {
-        let page = env
-            .client
-            .list_objects_v2()
-            .bucket(bucket)
-            .max_keys(max_keys)
-            .set_delimiter(delimiter.map(str::to_string))
-            .set_continuation_token(token.take())
-            .send()
-            .await?;
-        let listed = page.contents().len() + page.common_prefixes().len();
-        page_sizes.push(listed);
-        for object in page.contents() {
-            objects.push((object.key().unwrap_or_default().to_string(), object.size().unwrap_or_default()));
-        }
-        for prefix in page.common_prefixes() {
-            prefixes.push(prefix.prefix().unwrap_or_default().to_string());
-        }
-        if !page.is_truncated().unwrap_or(false) {
-            return Ok((objects, prefixes, page_sizes));
-        }
-        token = Some(
-            page.next_continuation_token()
-                .ok_or("truncated page without a continuation token")?
-                .to_string(),
-        );
-    }
-    Err("merged listing did not terminate".into())
-}
-
-#[tokio::test]
-async fn list_through_merges_the_whole_namespace_across_full_pagination() -> TestResult {
-    let bucket = "odm-list-merge";
-    let env = list_through_env(bucket, |_| {}).await?;
-
-    // 2000 source keys, 80 of them also local, plus 10 local-only keys that
-    // interleave between source keys ("obj-00010x" sorts after "obj-00010").
-    let source_keys: Vec<String> = (0..2000).map(|index| format!("obj-{index:05}")).collect();
-    let seeds: Vec<SeedObject> = source_keys
-        .iter()
-        .map(|key| SeedObject::new(key.clone(), body(SOURCE_BODY_LEN)))
-        .collect();
-    env.seed_source(SOURCE_BUCKET, &seeds);
-
-    let shared: Vec<String> = source_keys.iter().step_by(25).cloned().collect();
-    let local_only: Vec<String> = (0..10).map(|index| format!("obj-{:05}x", index * 7)).collect();
-    for key in shared.iter().chain(local_only.iter()) {
-        env.client
-            .put_object()
-            .bucket(bucket)
-            .key(key)
-            .body(body(LOCAL_BODY_LEN).into())
-            .send()
-            .await?;
-    }
-
-    let max_keys = 97;
-    let (objects, prefixes, page_sizes) = walk_listing(&env, bucket, None, max_keys).await?;
-    assert!(prefixes.is_empty(), "no delimiter means no common prefixes");
-
-    let mut expected: Vec<String> = source_keys.iter().chain(local_only.iter()).cloned().collect();
-    expected.sort();
-    expected.dedup();
-    let listed: Vec<String> = objects.iter().map(|(key, _)| key.clone()).collect();
-    assert_eq!(listed, expected, "the merged listing is the sorted, deduplicated union");
-    assert!(
-        page_sizes.iter().all(|size| *size <= max_keys as usize),
-        "no page may exceed max_keys: {page_sizes:?}"
-    );
-
-    let shared_sizes: Vec<i64> = objects
-        .iter()
-        .filter(|(key, _)| shared.contains(key))
-        .map(|(_, size)| *size)
-        .collect();
-    assert_eq!(shared_sizes.len(), shared.len(), "every shared key is listed exactly once");
-    assert!(
-        shared_sizes.iter().all(|size| *size == LOCAL_BODY_LEN as i64),
-        "the local object wins a key both sides hold"
-    );
-    let source_sizes: Vec<i64> = objects
-        .iter()
-        .filter(|(key, _)| !shared.contains(key) && !local_only.contains(key))
-        .map(|(_, size)| *size)
-        .collect();
-    assert!(
-        source_sizes.iter().all(|size| *size == SOURCE_BODY_LEN as i64),
-        "source-only keys report the source's own size"
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn list_through_unions_common_prefixes_under_a_delimiter() -> TestResult {
-    let bucket = "odm-list-delimiter";
-    let env = list_through_env(bucket, |_| {}).await?;
-
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new("p1/a", body(SOURCE_BODY_LEN)),
-            SeedObject::new("p1/b", body(SOURCE_BODY_LEN)),
-            SeedObject::new("p2/a", body(SOURCE_BODY_LEN)),
-            SeedObject::new("top-s", body(SOURCE_BODY_LEN)),
-        ],
-    );
-    for key in ["p1/c", "p3/a", "top-l"] {
-        env.client
-            .put_object()
-            .bucket(bucket)
-            .key(key)
-            .body(body(LOCAL_BODY_LEN).into())
-            .send()
-            .await?;
-    }
-
-    // A page size of two forces the prefix union to survive page boundaries.
-    let (objects, prefixes, page_sizes) = walk_listing(&env, bucket, Some("/"), 2).await?;
-    assert_eq!(prefixes, vec!["p1/", "p2/", "p3/"], "prefixes are unioned and deduplicated");
-    let listed: Vec<String> = objects.iter().map(|(key, _)| key.clone()).collect();
-    assert_eq!(listed, vec!["top-l", "top-s"]);
-    assert!(page_sizes.iter().all(|size| *size <= 2), "{page_sizes:?}");
-    Ok(())
-}
-
-#[tokio::test]
-async fn list_through_propagates_a_source_listing_failure() -> TestResult {
-    let bucket = "odm-list-propagate";
-    let env = list_through_env(bucket, |_| {}).await?;
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new("remote", body(SOURCE_BODY_LEN))]);
-    env.client
-        .put_object()
-        .bucket(bucket)
-        .key("local")
-        .body(body(LOCAL_BODY_LEN).into())
-        .send()
-        .await?;
-
-    env.source
-        .inject(Operation::ListObjectsV2, FaultAction::ResponseStatus(503), 1);
-    let failure = env
-        .client
-        .list_objects_v2()
-        .bucket(bucket)
-        .send()
-        .await
-        .expect_err("propagate must surface the source failure");
-    let failure = failure.into_service_error();
-    assert_eq!(failure.meta().code(), Some("SourceUnavailable"), "{failure:?}");
-
-    // The next listing sees a healthy source again and merges both sides.
-    let (objects, _, _) = walk_listing(&env, bucket, None, 100).await?;
-    let listed: Vec<String> = objects.iter().map(|(key, _)| key.clone()).collect();
-    assert_eq!(listed, vec!["local", "remote"]);
-    Ok(())
-}
-
-#[tokio::test]
-async fn list_through_degrades_to_local_only_under_the_not_found_policy() -> TestResult {
-    let bucket = "odm-list-degrade";
-    let env = list_through_env(bucket, |spec| spec.policy.source_error = "not_found".to_string()).await?;
-    env.seed_source(SOURCE_BUCKET, &[SeedObject::new("remote", body(SOURCE_BODY_LEN))]);
-    env.client
-        .put_object()
-        .bucket(bucket)
-        .key("local")
-        .body(body(LOCAL_BODY_LEN).into())
-        .send()
-        .await?;
-
-    env.source
-        .inject(Operation::ListObjectsV2, FaultAction::ResponseStatus(503), 1);
-    let degraded = env.raw_list_objects_v2(bucket, "max-keys=100").await?;
-    assert_eq!(degraded.status, 200, "{}", String::from_utf8_lossy(&degraded.body));
-    assert_eq!(
-        degraded.header(LIST_HEADER),
-        Some("local_only"),
-        "a degraded listing must say so in the response header"
-    );
-    let xml = String::from_utf8_lossy(&degraded.body).to_string();
-    assert!(xml.contains("<Key>local</Key>"), "{xml}");
-    assert!(!xml.contains("<Key>remote</Key>"), "a degraded listing shows local state only: {xml}");
-
-    let healthy = env.raw_list_objects_v2(bucket, "max-keys=100").await?;
-    assert_eq!(healthy.status, 200);
-    assert_eq!(healthy.header(LIST_HEADER), None, "a healthy merge carries no degradation marker");
-    assert!(String::from_utf8_lossy(&healthy.body).contains("<Key>remote</Key>"));
-    Ok(())
-}
-
-#[tokio::test]
-async fn list_through_rejects_a_tampered_continuation_token() -> TestResult {
-    let bucket = "odm-list-token";
-    let env = list_through_env(bucket, |_| {}).await?;
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new("a", body(SOURCE_BODY_LEN)),
-            SeedObject::new("b", body(SOURCE_BODY_LEN)),
-            SeedObject::new("c", body(SOURCE_BODY_LEN)),
-        ],
-    );
-
-    let page = env.client.list_objects_v2().bucket(bucket).max_keys(1).send().await?;
-    let token = page.next_continuation_token().ok_or("first page must be truncated")?;
-    let decoded = String::from_utf8(base64_simd::STANDARD.decode_to_vec(token.as_bytes())?)?;
-    assert!(decoded.contains("\"t\":\"odm-list\""), "the merged token is an envelope: {decoded}");
-
-    let tampered = base64_simd::STANDARD.encode_to_string(decoded.replace("\"v\":1", "\"v\":2").as_bytes());
-    let rejected = env
-        .raw_list_objects_v2(bucket, &format!("continuation-token={tampered}"))
-        .await?;
-    assert_eq!(
-        rejected.status,
-        400,
-        "a bumped token version is a client error: {}",
-        String::from_utf8_lossy(&rejected.body)
-    );
-    Ok(())
-}
-
-#[tokio::test]
-async fn a_merged_token_keeps_paginating_after_list_through_is_turned_off() -> TestResult {
-    let bucket = "odm-list-token-off";
-    let env = list_through_env(bucket, |_| {}).await?;
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new("s1", body(SOURCE_BODY_LEN)),
-            SeedObject::new("s2", body(SOURCE_BODY_LEN)),
-        ],
-    );
-    for key in ["l1", "l2"] {
-        env.client
-            .put_object()
-            .bucket(bucket)
-            .key(key)
-            .body(body(LOCAL_BODY_LEN).into())
-            .send()
-            .await?;
-    }
-
-    let page = env.client.list_objects_v2().bucket(bucket).max_keys(1).send().await?;
-    assert_eq!(page.contents()[0].key(), Some("l1"));
-    let token = page
-        .next_continuation_token()
-        .ok_or("first page must be truncated")?
-        .to_string();
-
-    let mut spec = env.fake_source_spec(SOURCE_BUCKET);
-    spec.policy.list_through = false;
-    env.configure_and_wait(bucket, &spec).await?;
-
-    let resumed = env
-        .client
-        .list_objects_v2()
-        .bucket(bucket)
-        .max_keys(10)
-        .continuation_token(token)
-        .send()
-        .await?;
-    let listed: Vec<&str> = resumed.contents().iter().filter_map(|object| object.key()).collect();
-    assert_eq!(listed, vec!["l2"], "a merged token falls back to its local cursor");
-    Ok(())
-}
-
-#[tokio::test]
-async fn a_local_delete_marker_hides_the_source_key_from_a_merged_listing() -> TestResult {
-    let bucket = "odm-list-delete-marker";
-    let env = list_through_env(bucket, |_| {}).await?;
-    env.client
-        .put_bucket_versioning()
-        .bucket(bucket)
-        .versioning_configuration(
-            VersioningConfiguration::builder()
-                .status(BucketVersioningStatus::Enabled)
-                .build(),
-        )
-        .send()
-        .await?;
-    env.seed_source(
-        SOURCE_BUCKET,
-        &[
-            SeedObject::new("kept", body(SOURCE_BODY_LEN)),
-            SeedObject::new("shadowed", body(SOURCE_BODY_LEN)),
-        ],
-    );
-
-    env.client
-        .put_object()
-        .bucket(bucket)
-        .key("shadowed")
-        .body(body(LOCAL_BODY_LEN).into())
-        .send()
-        .await?;
-    env.client.delete_object().bucket(bucket).key("shadowed").send().await?;
-
-    let (objects, _, _) = walk_listing(&env, bucket, None, 100).await?;
-    let listed: Vec<String> = objects.iter().map(|(key, _)| key.clone()).collect();
-    assert_eq!(
-        listed,
-        vec!["kept"],
-        "a local delete marker shadows the source key the same way it does on GET"
-    );
-    Ok(())
-}

crates/e2e_test/src/on_demand_migration/mod.rs

@@ -1,40 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! On-demand migration (ODM) end-to-end suite (rustfs/backlog#2147).
-//!
-//! `common` is the shared environment: one RustFS under test, one programmable
-//! fake S3 source, admin-API wrappers, seeding and local-state assertions.
-//! `harness_self_test` proves the harness itself; `get_basic_test` covers the
-//! GET read-through (rustfs/backlog#2156) and `backfill_test` the background
-//! backfill job (ODM-12, rustfs/backlog#2159); `list_through_test` covers the
-//! optional merged `ListObjectsV2` (ODM-17, rustfs/backlog#2164). The fault, concurrency,
-//! interaction and real-source matrix is rustfs/backlog#2158; its lane split
-//! lives in `.config/nextest.toml` (fault / concurrency / real source run
-//! nightly, the rest in the merge lane). `interop_test` is the provider
-//! interoperability lane (ODM-20, rustfs/backlog#2167): the same case bodies
-//! against the fake source locally and against a real provider named by the
-//! environment in `.github/workflows/on-demand-migration-interop.yml`.
-
-pub mod common;
-
-mod backfill_test;
-mod concurrency_test;
-mod fault_test;
-mod get_basic_test;
-mod harness_self_test;
-mod interaction_test;
-mod interop_test;
-mod list_through_test;
-mod real_source_test;

crates/e2e_test/src/on_demand_migration/real_source_test.rs

@@ -1,266 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! On-demand migration against a real RustFS source (rustfs/backlog#2158).
-//!
-//! These cases start a second (and, for the loop guard, a third) RustFS
-//! process, so they carry the `_real_single_node` marker and run in the
-//! nightly lane. A real source keeps no request journal, so "the source was
-//! not consulted" is proven by removing the object from the source and
-//! showing the read still succeeds, or by pointing the *second* server at a
-//! fake source whose journal must stay empty.
-
-use super::common::{
-    AdminResponse, BoxError, ODM_ADMIN_ROUTE, OdmSourceSpec, OdmTestEnv, RawResponse, SeedObject, start_source_rustfs,
-    start_source_rustfs_with_odm,
-};
-use crate::common::{RustFSTestEnvironment, signed_request};
-use crate::fake_s3_target::{BucketMode, Operation};
-use aws_sdk_s3::Client;
-use bytes::Bytes;
-use std::time::{Duration, Instant};
-
-type TestResult = Result<(), BoxError>;
-
-const ODM_RESPONSE_HEADER: &str = "x-rustfs-on-demand-migration";
-/// Reinstalled configurations are applied asynchronously; every phase polls
-/// for the new behavior instead of sleeping.
-const APPLY_TIMEOUT: Duration = Duration::from_secs(30);
-const SETTLE: Duration = Duration::from_secs(60);
-
-fn payload(len: usize) -> Bytes {
-    (0..len).map(|index| (index % 251) as u8).collect::<Vec<u8>>().into()
-}
-
-/// `PUT /rustfs/admin/v3/on-demand-migration/{bucket}` against any server,
-/// not just the one under test.
-async fn configure_odm(env: &RustFSTestEnvironment, bucket: &str, spec: &OdmSourceSpec) -> Result<AdminResponse, BoxError> {
-    let url = format!("{}{ODM_ADMIN_ROUTE}/{bucket}", env.url);
-    let body = serde_json::to_vec(&spec.to_json())?;
-    let response = signed_request(
-        http::Method::PUT,
-        &url,
-        &env.access_key,
-        &env.secret_key,
-        Some(body),
-        Some("application/json"),
-    )
-    .await?;
-    Ok(AdminResponse {
-        status: response.status().as_u16(),
-        body: response.text().await?,
-    })
-}
-
-async fn put_object(client: &Client, bucket: &str, key: &str, body: Bytes) -> TestResult {
-    client
-        .put_object()
-        .bucket(bucket)
-        .key(key)
-        .body(aws_sdk_s3::primitives::ByteStream::from(body))
-        .send()
-        .await?;
-    Ok(())
-}
-
-/// Polls a read against the server under test until it answers `expected`.
-/// This is how a reinstalled configuration is waited for when the source
-/// keeps no journal to probe.
-async fn wait_for_get_status(env: &OdmTestEnv, bucket: &str, key: &str, expected: u16) -> Result<RawResponse, BoxError> {
-    let deadline = Instant::now() + APPLY_TIMEOUT;
-    loop {
-        let response = env.raw_get(bucket, key).await?;
-        if response.status == expected {
-            return Ok(response);
-        }
-        if Instant::now() >= deadline {
-            return Err(format!(
-                "GET {bucket}/{key} stayed at {} instead of {expected}: {}",
-                response.status,
-                String::from_utf8_lossy(&response.body)
-            )
-            .into());
-        }
-        tokio::time::sleep(Duration::from_millis(200)).await;
-    }
-}
-
-/// Case 20: a second RustFS as the migration source — the pull, a HEAD
-/// passthrough, a Range read, and both prefix knobs.
-#[tokio::test]
-async fn test_odm_rustfs_source_serves_pull_head_range_and_prefixes_real_single_node() -> TestResult {
-    let bucket = "odm-real-source";
-    let source_bucket = "odm-real-origin";
-    let source = start_source_rustfs().await?;
-    let source_client = source.create_s3_client();
-    source.create_test_bucket(source_bucket).await?;
-
-    let env = OdmTestEnv::start().await?;
-    env.rustfs.create_test_bucket(bucket).await?;
-    let spec = OdmSourceSpec::for_rustfs_source(&source, source_bucket);
-    let configured = configure_odm(&env.rustfs, bucket, &spec).await?;
-    assert_eq!(configured.status, 200, "{}", configured.body);
-
-    // Phase 1: a miss is pulled and stored; removing it from the source
-    // afterwards proves the second read never goes back to the source.
-    let pulled_key = "real/pulled.bin";
-    let pulled_body = payload(256 * 1024);
-    put_object(&source_client, source_bucket, pulled_key, pulled_body.clone()).await?;
-    let pulled = wait_for_get_status(&env, bucket, pulled_key, 200).await?;
-    assert_eq!(pulled.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(pulled.body, pulled_body, "the client receives the source bytes");
-    assert!(env.wait_local_listed(bucket, pulled_key, SETTLE).await?, "the pull must store the object");
-    source_client
-        .delete_object()
-        .bucket(source_bucket)
-        .key(pulled_key)
-        .send()
-        .await?;
-    let local = env.raw_get(bucket, pulled_key).await?;
-    assert_eq!(local.status, 200, "{}", String::from_utf8_lossy(&local.body));
-    assert_eq!(local.header(ODM_RESPONSE_HEADER), None, "a local hit is not marked");
-    assert_eq!(local.body, pulled_body, "the object is served from the local copy");
-
-    // Phase 2: HEAD proxies metadata without storing anything.
-    let head_key = "real/head-only.bin";
-    let head_body = payload(9_000);
-    put_object(&source_client, source_bucket, head_key, head_body.clone()).await?;
-    let head = env.raw_object_request(http::Method::HEAD, bucket, head_key, &[]).await?;
-    assert_eq!(head.status, 200, "HEAD must be answered from the source");
-    assert_eq!(head.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(head.header("content-length"), Some(head_body.len().to_string().as_str()));
-    env.assert_local_absent(bucket, head_key).await;
-
-    // Phase 3: a Range read is passed through as a 206.
-    let range_key = "real/range.bin";
-    let range_body = payload(100_000);
-    put_object(&source_client, source_bucket, range_key, range_body.clone()).await?;
-    let ranged = env
-        .raw_object_request(http::Method::GET, bucket, range_key, &[("range", "bytes=100-199")])
-        .await?;
-    assert_eq!(ranged.status, 206, "{}", String::from_utf8_lossy(&ranged.body));
-    assert_eq!(ranged.header("content-range"), Some("bytes 100-199/100000"));
-    assert_eq!(ranged.body, range_body.slice(100..200));
-
-    // Phase 4: `filter.prefix` decides which local keys may consult the
-    // source at all.
-    let allowed_key = "allowed/doc.bin";
-    let denied_key = "denied/doc.bin";
-    let filtered_body = payload(4_096);
-    put_object(&source_client, source_bucket, allowed_key, filtered_body.clone()).await?;
-    put_object(&source_client, source_bucket, denied_key, filtered_body.clone()).await?;
-    let mut filtered = OdmSourceSpec::for_rustfs_source(&source, source_bucket);
-    filtered.filter.prefix = Some("allowed/".to_string());
-    let response = configure_odm(&env.rustfs, bucket, &filtered).await?;
-    assert_eq!(response.status, 200, "{}", response.body);
-    let denied = wait_for_get_status(&env, bucket, denied_key, 404).await?;
-    assert_eq!(denied.header(ODM_RESPONSE_HEADER), None);
-    env.assert_local_absent(bucket, denied_key).await;
-    let allowed = wait_for_get_status(&env, bucket, allowed_key, 200).await?;
-    assert_eq!(allowed.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(allowed.body, filtered_body);
-
-    // Phase 5: `filter.source_prefix` rewrites the key on the way out, so a
-    // local key resolves to a different key in the source bucket.
-    let rewritten_key = "rewritten/doc.bin";
-    let rewritten_body = payload(2_048);
-    put_object(&source_client, source_bucket, &format!("archive/{rewritten_key}"), rewritten_body.clone()).await?;
-    let mut rewriting = OdmSourceSpec::for_rustfs_source(&source, source_bucket);
-    rewriting.filter.source_prefix = Some("archive/".to_string());
-    let response = configure_odm(&env.rustfs, bucket, &rewriting).await?;
-    assert_eq!(response.status, 200, "{}", response.body);
-    let rewritten = wait_for_get_status(&env, bucket, rewritten_key, 200).await?;
-    assert_eq!(rewritten.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(rewritten.body, rewritten_body, "the source prefix is prepended to the local key");
-    Ok(())
-}
-
-/// Case 21: two migrating servers pointed at each other must not build a
-/// request loop. The middle server also has a fake source of its own, whose
-/// journal is the evidence: a key it would happily fetch for a direct client
-/// is never fetched for a request that arrived with the anti-loop marker.
-#[tokio::test]
-async fn test_odm_chained_sources_stop_at_the_loop_guard_real_single_node() -> TestResult {
-    let bucket = "odm-loop-guard";
-    let fake_bucket = "odm-loop-fake";
-    let env = OdmTestEnv::start().await?;
-    env.source.create_bucket_with_mode(fake_bucket, BucketMode::Unversioned);
-    env.rustfs.create_test_bucket(bucket).await?;
-
-    let middle = start_source_rustfs_with_odm().await?;
-    let middle_client = middle.create_s3_client();
-    middle.create_test_bucket(bucket).await?;
-    let middle_spec = OdmSourceSpec::for_fake_source(&env.source, fake_bucket);
-    let configured = configure_odm(&middle, bucket, &middle_spec).await?;
-    assert_eq!(configured.status, 200, "{}", configured.body);
-
-    let chained = OdmSourceSpec::for_rustfs_source(&middle, bucket);
-    let configured = configure_odm(&env.rustfs, bucket, &chained).await?;
-    assert_eq!(configured.status, 200, "{}", configured.body);
-
-    // The first hop works: an object that only the middle server holds is
-    // migrated to the server under test.
-    let present_key = "loop/present.bin";
-    let present_body = payload(16 * 1024);
-    put_object(&middle_client, bucket, present_key, present_body.clone()).await?;
-    let served = wait_for_get_status(&env, bucket, present_key, 200).await?;
-    assert_eq!(served.header(ODM_RESPONSE_HEADER), Some("source"));
-    assert_eq!(served.body, present_body, "the first hop serves the middle server's object");
-
-    // The second hop does not: this key exists only on the middle server's
-    // own source, and the anti-loop marker stops the chain there.
-    let guarded_key = "loop/chain-guard.bin";
-    let guarded_body = payload(8 * 1024);
-    env.seed_source(fake_bucket, &[SeedObject::new(guarded_key, guarded_body.clone())]);
-    let guarded = env.raw_get(bucket, guarded_key).await?;
-    assert_eq!(guarded.status, 404, "{}", String::from_utf8_lossy(&guarded.body));
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, guarded_key),
-        0,
-        "a chained request must not reach a third source"
-    );
-    assert_eq!(env.source.count_requests(Operation::GetObject, guarded_key), 0);
-
-    // Proof that the guard, and not a broken configuration, is what stopped
-    // it: the same key served directly by the middle server does reach the
-    // fake source.
-    let direct = middle_client.get_object().bucket(bucket).key(guarded_key).send().await?;
-    assert_eq!(direct.body.collect().await?.into_bytes(), guarded_body);
-    assert_eq!(
-        env.source.count_requests(Operation::GetObject, guarded_key),
-        1,
-        "an unmarked request does consult the middle server's source"
-    );
-
-    // Now make the pair mutual and prove the read still terminates.
-    let mutual = OdmSourceSpec::for_rustfs_source(&env.rustfs, bucket);
-    let configured = configure_odm(&middle, bucket, &mutual).await?;
-    assert_eq!(configured.status, 200, "{}", configured.body);
-
-    let mutual_key = "loop/mutual.bin";
-    let started = Instant::now();
-    let response = wait_for_get_status(&env, bucket, mutual_key, 404).await?;
-    assert_eq!(response.header(ODM_RESPONSE_HEADER), None);
-    assert!(
-        started.elapsed() < Duration::from_secs(10),
-        "a mutual configuration must not loop, took {:?}",
-        started.elapsed()
-    );
-    assert_eq!(
-        env.source.count_requests(Operation::HeadObject, mutual_key),
-        0,
-        "the fake source is out of the chain once the pair is mutual"
-    );
-    Ok(())
-}

crates/e2e_test/src/policy/policy_variables_test.rs

@@ -15,24 +15,28 @@
 //! Tests for AWS IAM policy variables with single-value, multi-value, and nested scenarios
 
 use crate::common::{
-    AdminTransport, RustFSTestEnvironment, admin_add_canned_policy_via, admin_attach_user_policy_via, admin_create_user_via,
+    RustFSTestEnvironment, awscurl_delete, awscurl_put, build_test_s3_config, build_test_sts_client, init_logging,
-    awscurl_delete, awscurl_put, build_test_s3_config, build_test_sts_client, init_logging,
 };
 use aws_sdk_s3::Client;
 use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::primitives::ByteStream;
 use tracing::info;
 
-/// Helper function to create a regular user with given credentials.
+/// Helper function to create a regular user with given credentials
-///
-/// This suite deliberately drives the admin API through the external `awscurl`
-/// binary, so the shared helpers are pinned to `AdminTransport::Awscurl`.
 async fn create_user(
     env: &RustFSTestEnvironment,
     username: &str,
     password: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_create_user_via(AdminTransport::Awscurl, &env.url, &env.access_key, &env.secret_key, username, password).await
+    let create_user_body = serde_json::json!({
+        "secretKey": password,
+        "status": "enabled"
+    })
+    .to_string();
+
+    let create_user_url = format!("{}/rustfs/admin/v3/add-user?accessKey={}", env.url, username);
+    awscurl_put(&create_user_url, &create_user_body, &env.access_key, &env.secret_key).await?;
+    Ok(())
 }
 
 /// Helper function to create and attach a policy
@@ -42,17 +46,18 @@ async fn create_and_attach_policy(
     username: &str,
     policy_document: serde_json::Value,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    admin_add_canned_policy_via(
+    let policy_string = policy_document.to_string();
-        AdminTransport::Awscurl,
+
-        &env.url,
+    // Create policy
-        &env.access_key,
+    let add_policy_url = format!("{}/rustfs/admin/v3/add-canned-policy?name={}", env.url, policy_name);
-        &env.secret_key,
+    awscurl_put(&add_policy_url, &policy_string, &env.access_key, &env.secret_key).await?;
-        policy_name,
+
-        &policy_document.to_string(),
+    // Attach policy to user
-    )
+    let attach_policy_url = format!(
-    .await?;
+        "{}/rustfs/admin/v3/set-user-or-group-policy?policyName={}&userOrGroup={}&isGroup=false",
-    admin_attach_user_policy_via(AdminTransport::Awscurl, &env.url, &env.access_key, &env.secret_key, policy_name, username)
+        env.url, policy_name, username
-        .await?;
+    );
+    awscurl_put(&attach_policy_url, "", &env.access_key, &env.secret_key).await?;
     Ok(())
 }
 

crates/e2e_test/src/presigned_negative_test.rs

@@ -87,9 +87,7 @@ fn valid_config() -> PresigningConfig {
 }
 
 /// Flip bytes inside the `X-Amz-Signature=` query value without changing its
-/// length, producing a structurally valid but incorrect signature. Every hex
+/// length, producing a structurally valid but incorrect signature.
-/// digit is replaced by its complement (15 - v), which has no fixed point, so
-/// the tamper changes the value no matter which digits the signature contains.
 fn tamper_signature(uri: &str) -> String {
     let marker = "X-Amz-Signature=";
     let idx = uri.find(marker).expect("presigned uri must carry X-Amz-Signature") + marker.len();
@@ -98,9 +96,10 @@ fn tamper_signature(uri: &str) -> String {
     let (sig, tail) = rest.split_at(end);
     let tampered: String = sig
         .chars()
-        .map(|c| {
+        .map(|c| match c {
-            let v = c.to_digit(16).expect("X-Amz-Signature value must be hex");
+            '0' => 'f',
-            char::from_digit(15 - v, 16).expect("complement of a hex digit is a hex digit")
+            'a' => '0',
+            other => other,
         })
         .collect();
     assert_ne!(sig, tampered, "tamper must actually change the signature hex");

crates/e2e_test/src/protocols/README.md

@@ -17,13 +17,15 @@ Use the canonical CI-equivalent protocol command in the parent
 For targeted debugging of the core suite only:
 
 ```bash
-python3 scripts/e2e_binary.py build --features ftps,webdav,sftp
+RUSTFS_BUILD_FEATURES=ftps,webdav,sftp cargo test --package e2e_test test_protocol_core_suite -- --test-threads=1 --nocapture
-python3 scripts/e2e_binary.py run --features ftps,webdav,sftp -- cargo test --package e2e_test test_protocol_core_suite -- --test-threads=1 --nocapture
 ```
 
 This targeted command does not cover the full `e2e-protocols` profile.
 
-`e2e_binary.py` supplies `RUSTFS_BUILD_FEATURES` from the verified server's resolved Cargo features. The protocol runner schedules only entries present in that feature list; helpers check that their required features are available without rebuilding the server.
+`RUSTFS_BUILD_FEATURES` controls which features the test rustfs binary is
+built with. When this variable is set, the protocol test runner schedules
+only entries whose protocol is present in the requested feature list. Leave
+it unset to run every protocol entry.
 `--test-threads=1` is required because every entry spawns a rustfs server
 on fixed bind ports.