chore(release): prepare 1.0.0-beta.12 (#5461 )

* chore(release): prepare 1.0.0-beta.12 * chore(release): align release assets for 1.0.0-beta.12 * chore(deps): refresh release dependencies Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: houseme <housemecn@gmail.com> Co-authored-by: heihutu <heihutu@gmail.com>
fix(iam): add correctly named policy APIs (#5457 )
2026-07-30 01:58:59 +00:00 · 2026-07-30 01:31:28 +00:00 · 2026-07-30 00:55:23 +00:00 · 2026-07-30 00:53:16 +00:00 · 2026-07-30 00:52:37 +00:00 · 2026-07-30 00:10:38 +00:00
46 changed files with 2340 additions and 1729 deletions
@@ -10,10 +10,16 @@ never weaken a check to get green.

 ## `check_layer_dependencies.sh` — layer DAG in `rustfs/src`

-Enforces `interface (admin, storage/ecfs, storage/s3_api) → app → infra`; no
-upward imports. Known legacy violations live in
+Enforces `composition (server, startup/init) → interface (admin,
+storage/ecfs, storage/s3_api) → app → infra`; no upward imports. Server source
+files are composition roots, while imports of their exported HTTP contracts
+are classified as interface dependencies. Known legacy violations live in
 `scripts/layer-dependency-baseline.txt`.

+Dedicated `*_test.rs` and `tests/` modules are outside this production guard.
+Inline `#[cfg(test)]` imports remain checked under their source file's layer;
+move architecture-crossing test scaffolding into a dedicated test module.
+
 - **New violation**: restructure your change so the dependency points
  downward (move the shared type/function to the lower layer).
 - **You legitimately removed a baseline entry**: run
@@ -642,9 +642,9 @@ dependencies = [

 [[package]]
 name = "async-compression"
-version = "0.4.42"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
+checksum = "3976abdc8fe7d1133d43d304afd42abdf5bc3e1319d263d223bde07b5efc4be8"
 dependencies = [
 "compression-codecs",
 "compression-core",
@@ -870,7 +870,7 @@ dependencies = [
 "bytes",
 "fastrand",
 "hex",
- "http 1.4.2",
+ "http 1.5.0",
 "sha1 0.10.7",
 "time",
 "tokio",
@@ -934,7 +934,7 @@ dependencies = [
 "bytes-utils",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "percent-encoding",
@@ -970,7 +970,7 @@ dependencies = [
 "hex",
 "hmac 0.13.0",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "lru 0.16.4",
 "percent-encoding",
@@ -1001,7 +1001,7 @@ dependencies = [
 "bytes",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "regex-lite",
 "tracing",
 ]
@@ -1027,7 +1027,7 @@ dependencies = [
 "bytes",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "regex-lite",
 "tracing",
 ]
@@ -1054,7 +1054,7 @@ dependencies = [
 "aws-types",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "regex-lite",
 "tracing",
 ]
@@ -1076,7 +1076,7 @@ dependencies = [
 "hex",
 "hmac 0.13.0",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "p256 0.13.2",
 "percent-encoding",
 "sha2 0.11.0",
@@ -1108,7 +1108,7 @@ dependencies = [
 "bytes",
 "crc-fast",
 "hex",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "md-5 0.11.0",
@@ -1142,7 +1142,7 @@ dependencies = [
 "bytes-utils",
 "futures-core",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "percent-encoding",
@@ -1161,7 +1161,7 @@ dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "hyper",
 "hyper-rustls",
 "hyper-util",
@@ -1224,7 +1224,7 @@ dependencies = [
 "bytes",
 "fastrand",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "http-body-util",
@@ -1245,7 +1245,7 @@ dependencies = [
 "aws-smithy-types",
 "bytes",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "pin-project-lite",
 "tokio",
 "tracing",
@@ -1271,7 +1271,7 @@ checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
- "http 1.4.2",
+ "http 1.5.0",
 ]

 [[package]]
@@ -1285,7 +1285,7 @@ dependencies = [
 "bytes-utils",
 "futures-core",
 "http 0.2.12",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "http-body-util",
@@ -1337,7 +1337,7 @@ dependencies = [
 "bytes",
 "form_urlencoded",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -1368,7 +1368,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
 "bytes",
 "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "mime",
@@ -3229,7 +3229,7 @@ dependencies = [
 "futures-util",
 "headers",
 "htmlescape",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "libc",
@@ -3654,7 +3654,7 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"

 [[package]]
 name = "e2e_test"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "anyhow",
 "astral-tokio-tar",
@@ -3672,7 +3672,7 @@ dependencies = [
 "flate2",
 "futures",
 "hex",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body-util",
 "hyper",
 "hyper-util",
@@ -4384,7 +4384,7 @@ dependencies = [
 "google-cloud-gax",
 "hex",
 "hmac 0.13.0",
- "http 1.4.2",
+ "http 1.5.0",
 "jsonwebtoken 10.4.0",
 "reqwest",
 "rustc_version",
@@ -4409,7 +4409,7 @@ dependencies = [
 "futures",
 "google-cloud-rpc",
 "google-cloud-wkt",
- "http 1.4.2",
+ "http 1.5.0",
 "pin-project",
 "rand 0.10.2",
 "serde",
@@ -4431,7 +4431,7 @@ dependencies = [
 "google-cloud-rpc",
 "google-cloud-wkt",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -4544,7 +4544,7 @@ dependencies = [
 "google-cloud-type",
 "google-cloud-wkt",
 "hex",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "md5",
 "percent-encoding",
@@ -4624,7 +4624,7 @@ dependencies = [
 "fnv",
 "futures-core",
 "futures-sink",
- "http 1.4.2",
+ "http 1.5.0",
 "indexmap 2.14.0",
 "slab",
 "tokio",
@@ -4727,7 +4727,7 @@ dependencies = [
 "base64 0.22.1",
 "bytes",
 "headers-core",
- "http 1.4.2",
+ "http 1.5.0",
 "httpdate",
 "mime",
 "sha1 0.10.7",
@@ -4739,7 +4739,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
 ]

 [[package]]
@@ -4961,9 +4961,9 @@ dependencies = [

 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
 "bytes",
 "itoa",
@@ -4987,7 +4987,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
 "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 ]

 [[package]]
@@ -4998,7 +4998,7 @@ checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
 "bytes",
 "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "pin-project-lite",
 ]
@@ -5044,7 +5044,7 @@ dependencies = [
 "futures-channel",
 "futures-core",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "httparse",
 "httpdate",
@@ -5061,7 +5061,7 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.2",
+ "http 1.5.0",
 "hyper",
 "hyper-util",
 "log",
@@ -5095,7 +5095,7 @@ dependencies = [
 "bytes",
 "futures-channel",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "hyper",
 "ipnet",
@@ -6704,10 +6704,10 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",
 "chrono",
 "getrandom 0.2.17",
- "http 1.4.2",
+ "http 1.5.0",
 "rand 0.8.7",
 "serde",
 "serde_json",
@@ -6815,7 +6815,7 @@ dependencies = [
 "futures-channel",
 "futures-core",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "humantime",
 "itertools 0.14.0",
 "parking_lot",
@@ -6871,7 +6871,7 @@ dependencies = [
 "dyn-clone",
 "ed25519-dalek 2.2.0",
 "hmac 0.12.1",
- "http 1.4.2",
+ "http 1.5.0",
 "itertools 0.10.5",
 "log",
 "oauth2",
@@ -6932,7 +6932,7 @@ checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
 dependencies = [
 "async-trait",
 "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 "opentelemetry",
 "reqwest",
 ]
@@ -6944,7 +6944,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
 dependencies = [
 "flate2",
- "http 1.4.2",
+ "http 1.5.0",
 "opentelemetry",
 "opentelemetry-http",
 "opentelemetry-proto",
@@ -7820,7 +7820,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
 "heck",
- "itertools 0.14.0",
+ "itertools 0.10.5",
 "log",
 "multimap",
 "once_cell",
@@ -7840,7 +7840,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
 dependencies = [
 "heck",
- "itertools 0.14.0",
+ "itertools 0.10.5",
 "log",
 "multimap",
 "petgraph 0.8.3",
@@ -7861,7 +7861,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
 "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
 "proc-macro2",
 "quote",
 "syn 2.0.119",
@@ -7874,7 +7874,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
 "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
 "proc-macro2",
 "quote",
 "syn 2.0.119",
@@ -8329,9 +8329,9 @@ dependencies = [

 [[package]]
 name = "redis"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0b9503711b03773e43b31668c7b5bd279ee7cd9b7d18cff7c23a42cc1d08e5a"
+checksum = "3257df217f7eab0044627a268c9cc6cdb60c0c421c88f83ac41c4e31520b6b84"
 dependencies = [
 "arc-swap",
 "arcstr",
@@ -8481,7 +8481,7 @@ dependencies = [
 "futures-core",
 "futures-util",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -8627,7 +8627,7 @@ dependencies = [
 "async-tungstenite",
 "futures-io",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "rustls-native-certs",
 "rustls-pki-types",
 "rustls-webpki",
@@ -8657,7 +8657,7 @@ dependencies = [
 "flume",
 "futures-io",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "log",
 "mqttbytes-core-next",
 "rumqttc-core-next",
@@ -8845,7 +8845,7 @@ dependencies = [

 [[package]]
 name = "rustfs"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "aes-gcm",
 "anyhow",
@@ -8874,7 +8874,7 @@ dependencies = [
 "hex-simd",
 "hmac 0.13.0",
 "hotpath",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -8981,7 +8981,7 @@ dependencies = [

 [[package]]
 name = "rustfs-audit"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "chrono",
@@ -9003,12 +9003,12 @@ dependencies = [

 [[package]]
 name = "rustfs-checksums"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "base64-simd",
 "bytes",
 "crc-fast",
- "http 1.4.2",
+ "http 1.5.0",
 "md-5 0.11.0",
 "pretty_assertions",
 "sha1 0.11.0",
@@ -9018,7 +9018,7 @@ dependencies = [

 [[package]]
 name = "rustfs-common"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "chrono",
 "metrics",
@@ -9033,7 +9033,7 @@ dependencies = [

 [[package]]
 name = "rustfs-concurrency"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "insta",
 "rustfs-io-core",
@@ -9045,7 +9045,7 @@ dependencies = [

 [[package]]
 name = "rustfs-config"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "const-str",
 "serde",
@@ -9054,7 +9054,7 @@ dependencies = [

 [[package]]
 name = "rustfs-credentials"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "base64-simd",
 "hmac 0.13.0",
@@ -9067,7 +9067,7 @@ dependencies = [

 [[package]]
 name = "rustfs-crypto"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "aes-gcm",
 "argon2",
@@ -9087,7 +9087,7 @@ dependencies = [

 [[package]]
 name = "rustfs-data-usage"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "rmp-serde",
@@ -9097,8 +9097,9 @@ dependencies = [

 [[package]]
 name = "rustfs-ecstore"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
+ "aes-gcm",
 "arc-swap",
 "async-channel",
 "async-recursion",
@@ -9114,6 +9115,7 @@ dependencies = [
 "byteorder",
 "bytes",
 "bytesize",
+ "chacha20poly1305",
 "chrono",
 "criterion",
 "enumset",
@@ -9127,7 +9129,7 @@ dependencies = [
 "hex-simd",
 "hmac 0.13.0",
 "hotpath",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -9166,6 +9168,7 @@ dependencies = [
 "rustfs-erasure-codec",
 "rustfs-filemeta",
 "rustfs-io-metrics",
+ "rustfs-kms",
 "rustfs-lifecycle",
 "rustfs-lock",
 "rustfs-madmin",
@@ -9232,7 +9235,7 @@ dependencies = [

 [[package]]
 name = "rustfs-extension-schema"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "serde",
 "serde_json",
@@ -9241,7 +9244,7 @@ dependencies = [

 [[package]]
 name = "rustfs-filemeta"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "arc-swap",
 "byteorder",
@@ -9267,12 +9270,12 @@ dependencies = [

 [[package]]
 name = "rustfs-heal"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "base64 0.23.0",
 "futures",
- "http 1.4.2",
+ "http 1.5.0",
 "metrics",
 "rustfs-common",
 "rustfs-concurrency",
@@ -9297,13 +9300,13 @@ dependencies = [

 [[package]]
 name = "rustfs-iam"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "arc-swap",
 "async-trait",
 "base64-simd",
 "futures",
- "http 1.4.2",
+ "http 1.5.0",
 "jsonwebtoken 11.0.0",
 "moka",
 "openidconnect",
@@ -9334,7 +9337,7 @@ dependencies = [

 [[package]]
 name = "rustfs-io-core"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "bytes",
 "memmap2",
@@ -9346,7 +9349,7 @@ dependencies = [

 [[package]]
 name = "rustfs-io-metrics"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "criterion",
 "metrics",
@@ -9409,11 +9412,11 @@ dependencies = [

 [[package]]
 name = "rustfs-keystone"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "bytes",
 "futures",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -9435,7 +9438,7 @@ dependencies = [

 [[package]]
 name = "rustfs-kms"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "aes-gcm",
 "arc-swap",
@@ -9469,7 +9472,7 @@ dependencies = [

 [[package]]
 name = "rustfs-lifecycle"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "metrics",
@@ -9491,7 +9494,7 @@ dependencies = [

 [[package]]
 name = "rustfs-lock"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "crossbeam-queue",
@@ -9513,7 +9516,7 @@ dependencies = [

 [[package]]
 name = "rustfs-log-analyzer"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "chrono",
 "flate2",
@@ -9531,7 +9534,7 @@ dependencies = [

 [[package]]
 name = "rustfs-madmin"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "chrono",
 "humantime",
@@ -9545,7 +9548,7 @@ dependencies = [

 [[package]]
 name = "rustfs-notify"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -9579,7 +9582,7 @@ dependencies = [

 [[package]]
 name = "rustfs-object-capacity"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "criterion",
 "futures",
@@ -9597,7 +9600,7 @@ dependencies = [

 [[package]]
 name = "rustfs-object-data-cache"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "bytes",
 "criterion",
@@ -9613,7 +9616,7 @@ dependencies = [

 [[package]]
 name = "rustfs-obs"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "chrono",
 "crossbeam-channel",
@@ -9665,7 +9668,7 @@ dependencies = [

 [[package]]
 name = "rustfs-policy"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "base64-simd",
@@ -9694,7 +9697,7 @@ dependencies = [

 [[package]]
 name = "rustfs-protocols"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "astral-tokio-tar",
 "async-compression",
@@ -9707,7 +9710,7 @@ dependencies = [
 "futures-util",
 "hex",
 "hmac 0.13.0",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body-util",
 "hyper",
 "hyper-util",
@@ -9756,7 +9759,7 @@ dependencies = [

 [[package]]
 name = "rustfs-protos"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "flatbuffers",
 "prost 0.14.4",
@@ -9779,7 +9782,7 @@ dependencies = [

 [[package]]
 name = "rustfs-replication"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "byteorder",
 "bytes",
@@ -9796,7 +9799,7 @@ dependencies = [

 [[package]]
 name = "rustfs-rio"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "aes-gcm",
 "arc-swap",
@@ -9808,7 +9811,7 @@ dependencies = [
 "futures",
 "hex-simd",
 "hotpath",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body-util",
 "md-5 0.11.0",
 "pin-project-lite",
@@ -9834,7 +9837,7 @@ dependencies = [

 [[package]]
 name = "rustfs-rio-v2"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "aes-gcm",
 "bytes",
@@ -9856,14 +9859,14 @@ dependencies = [

 [[package]]
 name = "rustfs-s3-ops"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "rustfs-s3-types",
 ]

 [[package]]
 name = "rustfs-s3-types"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "serde",
 "serde_json",
@@ -9871,7 +9874,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3select-api"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "bytes",
@@ -9879,7 +9882,7 @@ dependencies = [
 "datafusion",
 "futures",
 "futures-core",
- "http 1.4.2",
+ "http 1.5.0",
 "metrics",
 "parking_lot",
 "rustfs-common",
@@ -9900,7 +9903,7 @@ dependencies = [

 [[package]]
 name = "rustfs-s3select-query"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-recursion",
 "async-trait",
@@ -9916,7 +9919,7 @@ dependencies = [

 [[package]]
 name = "rustfs-scanner"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "bytes",
@@ -9924,7 +9927,7 @@ dependencies = [
 "futures",
 "hex-simd",
 "hmac 0.13.0",
- "http 1.4.2",
+ "http 1.5.0",
 "metrics",
 "rand 0.10.2",
 "rmp-serde",
@@ -9954,18 +9957,18 @@ dependencies = [

 [[package]]
 name = "rustfs-security-governance"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "thiserror 2.0.19",
 ]

 [[package]]
 name = "rustfs-signer"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "base64-simd",
 "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 "hyper",
 "rustfs-utils",
 "s3s",
@@ -9978,7 +9981,7 @@ dependencies = [

 [[package]]
 name = "rustfs-storage-api"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "insta",
@@ -9992,7 +9995,7 @@ dependencies = [

 [[package]]
 name = "rustfs-targets"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "arc-swap",
 "async-nats",
@@ -10045,7 +10048,7 @@ dependencies = [

 [[package]]
 name = "rustfs-test-utils"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "rustfs-data-usage",
 "rustfs-ecstore",
@@ -10060,7 +10063,7 @@ dependencies = [

 [[package]]
 name = "rustfs-tls-runtime"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "arc-swap",
 "metrics",
@@ -10080,11 +10083,11 @@ dependencies = [

 [[package]]
 name = "rustfs-trusted-proxies"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "async-trait",
 "axum",
- "http 1.4.2",
+ "http 1.5.0",
 "ipnetwork",
 "metrics",
 "moka",
@@ -10116,7 +10119,7 @@ dependencies = [

 [[package]]
 name = "rustfs-utils"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "base64-simd",
 "blake2",
@@ -10130,7 +10133,7 @@ dependencies = [
 "hex-simd",
 "highway",
 "hmac 0.13.0",
- "http 1.4.2",
+ "http 1.5.0",
 "hyper",
 "local-ip-address",
 "lz4",
@@ -10157,7 +10160,7 @@ dependencies = [

 [[package]]
 name = "rustfs-zip"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 dependencies = [
 "astral-tokio-tar",
 "async-compression",
@@ -10187,7 +10190,7 @@ dependencies = [
 "anyhow",
 "async-trait",
 "bytes",
- "http 1.4.2",
+ "http 1.5.0",
 "reqwest",
 "rustify_derive",
 "serde",
@@ -10227,9 +10230,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -10367,7 +10370,7 @@ dependencies = [
 "futures",
 "hex-simd",
 "hmac 0.13.0",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "httparse",
@@ -11495,7 +11498,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -11731,13 +11734,13 @@ dependencies = [

 [[package]]
 name = "tokio-macros"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]

 [[package]]
@@ -11841,7 +11844,7 @@ dependencies = [
 "bytes",
 "futures-core",
 "futures-sink",
- "http 1.4.2",
+ "http 1.5.0",
 "httparse",
 "rand 0.8.7",
 "rustls-pki-types",
@@ -11893,7 +11896,7 @@ dependencies = [
 "bytes",
 "flate2",
 "h2",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "hyper",
@@ -11980,7 +11983,7 @@ dependencies = [
 "bitflags 2.13.1",
 "bytes",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "pin-project-lite",
 "tower",
@@ -12000,7 +12003,7 @@ dependencies = [
 "bytes",
 "futures-core",
 "futures-util",
- "http 1.4.2",
+ "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
 "percent-encoding",
@@ -12173,7 +12176,7 @@ checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
 dependencies = [
 "bytes",
 "data-encoding",
- "http 1.4.2",
+ "http 1.5.0",
 "httparse",
 "log",
 "rand 0.9.5",
@@ -12360,7 +12363,7 @@ checksum = "30ffcc0e81025065dda612ec1e26a3d81bb16ef3062354873d17a35965d68522"
 dependencies = [
 "async-trait",
 "derive_builder",
- "http 1.4.2",
+ "http 1.5.0",
 "reqwest",
 "rustify",
 "rustify_derive",
@@ -69,7 +69,7 @@ edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/rustfs/rustfs"
 rust-version = "1.97.1"
-version = "1.0.0-beta.11"
+version = "1.0.0-beta.12"
 homepage = "https://rustfs.com"
 description = "RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages worldwide. "
 keywords = ["RustFS", "Minio", "object-storage", "filesystem", "s3"]
@@ -86,58 +86,58 @@ redundant_clone = "warn"

 [workspace.dependencies]
 # RustFS Internal Crates
-rustfs = { path = "./rustfs", version = "1.0.0-beta.11" }
-rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.11" }
-rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.11" }
-rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.11" }
-rustfs-common = { path = "crates/common", version = "1.0.0-beta.11" }
-rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.11" }
-rustfs-config = { path = "./crates/config", version = "1.0.0-beta.11" }
-rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.11" }
-rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.11" }
-rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.11" }
-rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.11" }
-rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.11" }
-rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.11" }
-rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.11" }
-rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.11" }
-rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.11" }
-rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.11" }
-rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.11" }
-rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.11" }
-rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.11" }
-rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.11" }
-rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.11" }
-rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.11" }
-rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.11" }
-rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.11" }
-rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.11" }
-rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.11" }
-rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.11" }
-rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.11" }
-rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.11" }
-rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.11" }
-rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.11" }
-rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.11" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.11" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.11" }
-rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.11" }
-rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.11" }
-rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.11" }
-rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.11" }
-rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.11" }
-rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.11" }
-rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.11" }
-rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.11" }
-rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.11" }
-rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.11" }
-rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.11" }
+rustfs = { path = "./rustfs", version = "1.0.0-beta.12" }
+rustfs-heal = { path = "crates/heal", version = "1.0.0-beta.12" }
+rustfs-audit = { path = "crates/audit", version = "1.0.0-beta.12" }
+rustfs-checksums = { path = "crates/checksums", version = "1.0.0-beta.12" }
+rustfs-common = { path = "crates/common", version = "1.0.0-beta.12" }
+rustfs-data-usage = { path = "crates/data-usage", version = "1.0.0-beta.12" }
+rustfs-config = { path = "./crates/config", version = "1.0.0-beta.12" }
+rustfs-concurrency = { path = "./crates/concurrency", version = "1.0.0-beta.12" }
+rustfs-credentials = { path = "crates/credentials", version = "1.0.0-beta.12" }
+rustfs-crypto = { path = "crates/crypto", version = "1.0.0-beta.12" }
+rustfs-ecstore = { path = "crates/ecstore", version = "1.0.0-beta.12" }
+rustfs-filemeta = { path = "crates/filemeta", version = "1.0.0-beta.12" }
+rustfs-iam = { path = "crates/iam", version = "1.0.0-beta.12" }
+rustfs-keystone = { path = "crates/keystone", version = "1.0.0-beta.12" }
+rustfs-lifecycle = { path = "crates/lifecycle", version = "1.0.0-beta.12" }
+rustfs-kms = { path = "crates/kms", version = "1.0.0-beta.12" }
+rustfs-lock = { path = "crates/lock", version = "1.0.0-beta.12" }
+rustfs-madmin = { path = "crates/madmin", version = "1.0.0-beta.12" }
+rustfs-notify = { path = "crates/notify", version = "1.0.0-beta.12" }
+rustfs-io-metrics = { path = "crates/io-metrics", version = "1.0.0-beta.12" }
+rustfs-io-core = { path = "crates/io-core", version = "1.0.0-beta.12" }
+rustfs-object-capacity = { path = "crates/object-capacity", version = "1.0.0-beta.12" }
+rustfs-object-data-cache = { path = "crates/object-data-cache", version = "1.0.0-beta.12" }
+rustfs-log-analyzer = { path = "crates/log-analyzer", version = "1.0.0-beta.12" }
+rustfs-obs = { path = "crates/obs", version = "1.0.0-beta.12" }
+rustfs-policy = { path = "crates/policy", version = "1.0.0-beta.12" }
+rustfs-protos = { path = "crates/protos", version = "1.0.0-beta.12" }
+rustfs-protocols = { path = "crates/protocols", version = "1.0.0-beta.12" }
+rustfs-replication = { path = "crates/replication", version = "1.0.0-beta.12" }
+rustfs-rio = { path = "crates/rio", version = "1.0.0-beta.12" }
+rustfs-rio-v2 = { path = "crates/rio-v2", version = "1.0.0-beta.12" }
+rustfs-s3-types = { path = "crates/s3-types", version = "1.0.0-beta.12" }
+rustfs-s3-ops = { path = "crates/s3-ops", version = "1.0.0-beta.12" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "1.0.0-beta.12" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "1.0.0-beta.12" }
+rustfs-scanner = { path = "crates/scanner", version = "1.0.0-beta.12" }
+rustfs-security-governance = { path = "crates/security-governance", version = "1.0.0-beta.12" }
+rustfs-extension-schema = { path = "crates/extension-schema", version = "1.0.0-beta.12" }
+rustfs-signer = { path = "crates/signer", version = "1.0.0-beta.12" }
+rustfs-storage-api = { path = "crates/storage-api", version = "1.0.0-beta.12" }
+rustfs-trusted-proxies = { path = "crates/trusted-proxies", version = "1.0.0-beta.12" }
+rustfs-targets = { path = "crates/targets", version = "1.0.0-beta.12" }
+rustfs-test-utils = { path = "crates/test-utils", version = "1.0.0-beta.12" }
+rustfs-tls-runtime = { path = "crates/tls-runtime", version = "1.0.0-beta.12" }
+rustfs-utils = { path = "crates/utils", version = "1.0.0-beta.12" }
+rustfs-zip = { path = "./crates/zip", version = "1.0.0-beta.12" }

 # Async Runtime and Networking
 async-channel = "2.5.0"
 async_zip = { default-features = false, version = "0.0.18" }
 mysql_async = { default-features = false, version = "0.37" }
-async-compression = { version = "0.4.42" }
+async-compression = { version = "0.4.43" }
 async-recursion = "1.1.1"
 async-trait = "0.1.91"
 async-nats = { version = "0.50.0", default-features = false }
@@ -152,7 +152,7 @@ lapin = { default-features = false, version = "4.10.0" }
 hyper = { version = "1.11.0" }
 hyper-rustls = { default-features = false, version = "0.27.9" }
 hyper-util = { version = "0.1.20" }
-http = "1.4.2"
+http = "1.5.0"
 http-body = "1.1.0"
 http-body-util = "0.1.4"
 minlz = "1.2.3"
@@ -200,7 +200,7 @@ jsonwebtoken = { version = "11.0.0" }
 openidconnect = { default-features = false, version = "4.0" }
 pbkdf2 = "0.13.0"
 rsa = { version = "=0.10.0-rc.18" }
-rustls = { default-features = false, version = "0.23.42" }
+rustls = { default-features = false, version = "0.23.43" }
 rustls-native-certs = "0.8"
 rustls-pki-types = "1.15.1"
 sha1 = "0.11.0"
@@ -283,7 +283,7 @@ reed-solomon-erasure = { package = "rustfs-erasure-codec", version = "8.0.2" }
 reed-solomon-simd = "3.1.0"
 regex = { version = "1.13.1" }
 rumqttc = { package = "rumqttc-next", version = "0.33.3" }
-redis = { version = "1.4.1" }
+redis = { version = "1.5.0" }
 rustix = { version = "1.1.4" }
 rust-embed = { version = "8.12.0" }
 rustc-hash = { version = "2.1.3" }
@@ -116,7 +116,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # Using specific version
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.11
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 If you use [podman](https://github.com/containers/podman) instead of docker, you can install the RustFS with the below command
@@ -113,7 +113,7 @@ chown -R 10001:10001 data logs
 docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:latest

 # 使用指定版本运行
-docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.11
+docker run -d -p 9000:9000 -p 9001:9001 -v $(pwd)/data:/data -v $(pwd)/logs:/logs rustfs/rustfs:1.0.0-beta.12
 ```

 如果您通过绑定挂载启用 TLS 证书目录，也请用同样方式准备该目录：
@@ -57,6 +57,7 @@ rustfs-policy.workspace = true
 rustfs-protos.workspace = true
 rustfs-replication.workspace = true
 rustfs-lifecycle.workspace = true
+rustfs-kms.workspace = true
 rustfs-s3-types = { workspace = true }
 rustfs-data-usage.workspace = true
 rustfs-object-capacity.workspace = true
@@ -123,6 +124,8 @@ libc.workspace = true
 rustix = { workspace = true, features = ["process", "fs"] }
 rustfs-madmin.workspace = true
 reqwest = { workspace = true }
+aes-gcm = { workspace = true, features = ["rand_core"] }
+chacha20poly1305.workspace = true
 aws-sdk-s3 = { workspace = true, default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
 urlencoding = { workspace = true }
 smallvec = { workspace = true, features = ["serde"] }
@@ -391,12 +391,10 @@ pub mod notification {

 pub mod object {
    pub use crate::object_api::{
-        BLOCK_SIZE_V2, ERASURE_ALGORITHM, EncryptionResolutionError, EncryptionResolutionErrorKind, GetObjectBodyCacheHook,
-        GetObjectBodyCacheHookLookup, GetObjectBodySource, GetObjectReader, ObjectEncryptionResolver, ObjectInfo,
-        ObjectMutationHook, ObjectOptions, PutObjReader, RangedDecompressReader, ReadEncryptionMaterial, ReadEncryptionMode,
-        ReadEncryptionRequest, StreamConsumer, get_object_body_cache_plaintext_len, lookup_get_object_body_cache_hook,
-        register_get_object_body_cache_hook, register_object_mutation_hook, unregister_get_object_body_cache_hook,
-        unregister_object_mutation_hook,
+        BLOCK_SIZE_V2, ERASURE_ALGORITHM, GetObjectBodyCacheHook, GetObjectBodyCacheHookLookup, GetObjectBodySource,
+        GetObjectReader, ObjectInfo, ObjectMutationHook, ObjectOptions, PutObjReader, RangedDecompressReader, StreamConsumer,
+        get_object_body_cache_plaintext_len, lookup_get_object_body_cache_hook, register_get_object_body_cache_hook,
+        register_object_mutation_hook, unregister_get_object_body_cache_hook, unregister_object_mutation_hook,
    };
    pub use crate::store::PreparedGetObjectReader;
 }
@@ -46,6 +46,16 @@ lazy_static! {
        m.insert("x-amz-replication-status".to_string(), true);
        m
    };
+    static ref SSE_HEADERS: HashMap<String, bool> = {
+        let mut m = HashMap::new();
+        m.insert("x-amz-server-side-encryption".to_string(), true);
+        m.insert("x-amz-server-side-encryption-aws-kms-key-id".to_string(), true);
+        m.insert("x-amz-server-side-encryption-context".to_string(), true);
+        m.insert("x-amz-server-side-encryption-customer-algorithm".to_string(), true);
+        m.insert("x-amz-server-side-encryption-customer-key".to_string(), true);
+        m.insert("x-amz-server-side-encryption-customer-key-md5".to_string(), true);
+        m
+    };
 }

 pub fn is_standard_query_value(qs_key: &str) -> bool {
@@ -60,12 +70,16 @@ pub fn is_standard_header(header_key: &str) -> bool {
    *SUPPORTED_HEADERS.get(&header_key.to_lowercase()).unwrap_or(&false)
 }

+pub fn is_sse_header(header_key: &str) -> bool {
+    *SSE_HEADERS.get(&header_key.to_lowercase()).unwrap_or(&false)
+}
+
 pub fn is_amz_header(header_key: &str) -> bool {
    let key = header_key.to_lowercase();
    key.starts_with("x-amz-meta-")
        || key.starts_with("x-amz-grant-")
        || key == "x-amz-acl"
-        || rustfs_utils::http::is_sse_header(header_key)
+        || is_sse_header(header_key)
        || key.starts_with("x-amz-checksum-")
 }

@@ -1,80 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use async_trait::async_trait;
-use http::{HeaderMap, HeaderValue};
-use std::collections::HashMap;
-use std::error::Error;
-use std::fmt::{Display, Formatter};
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ReadEncryptionMode {
-    Direct { base_nonce: [u8; 12] },
-    Object,
-}
-
-pub struct ReadEncryptionMaterial {
-    pub key_bytes: [u8; 32],
-    pub mode: ReadEncryptionMode,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum EncryptionResolutionErrorKind {
-    InvalidRequest,
-    InvalidMetadata,
-    ServiceUnavailable,
-    DecryptionFailed,
-}
-
-#[derive(Debug)]
-pub struct EncryptionResolutionError {
-    kind: EncryptionResolutionErrorKind,
-    message: String,
-}
-
-impl EncryptionResolutionError {
-    pub fn new(kind: EncryptionResolutionErrorKind, message: impl Into<String>) -> Self {
-        Self {
-            kind,
-            message: message.into(),
-        }
-    }
-
-    pub fn kind(&self) -> EncryptionResolutionErrorKind {
-        self.kind
-    }
-}
-
-impl Display for EncryptionResolutionError {
-    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
-        formatter.write_str(&self.message)
-    }
-}
-
-impl Error for EncryptionResolutionError {}
-
-pub struct ReadEncryptionRequest<'a> {
-    pub bucket: &'a str,
-    pub object: &'a str,
-    pub metadata: &'a HashMap<String, String>,
-    pub headers: &'a HeaderMap<HeaderValue>,
-}
-
-#[async_trait]
-pub trait ObjectEncryptionResolver: Send + Sync {
-    async fn resolve_read_material(
-        &self,
-        request: ReadEncryptionRequest<'_>,
-    ) -> Result<Option<ReadEncryptionMaterial>, EncryptionResolutionError>;
-}
@@ -84,7 +84,6 @@ pub(crate) fn legacy_encrypted_range_seek_enabled() -> bool {
 }

 mod body_cache_hook;
-mod encryption;
 mod hook_slot;
 mod object_mutation_hook;
 mod readers;
@@ -99,10 +98,6 @@ pub use body_cache_hook::{
 pub(crate) use body_cache_hook::{
    get_object_body_cache_hook, get_object_body_cache_hook_suppressed, without_get_object_body_cache_hook,
 };
-pub use encryption::{
-    EncryptionResolutionError, EncryptionResolutionErrorKind, ObjectEncryptionResolver, ReadEncryptionMaterial,
-    ReadEncryptionMode, ReadEncryptionRequest,
-};
 pub(crate) use object_mutation_hook::notify_object_mutation;
 pub use object_mutation_hook::{ObjectMutationHook, register_object_mutation_hook, unregister_object_mutation_hook};
 pub use readers::*;
@@ -273,9 +273,29 @@ impl ObjectInfo {
    }

    pub fn is_encrypted(&self) -> bool {
-        self.user_defined
-            .keys()
-            .any(|key| rustfs_utils::http::is_object_encryption_marker(key))
+        // Corresponding to the logic in rustfs/src/sse.rs/encryption_material_to_metadata function
+        use rustfs_utils::http::{SSEC_ALGORITHM_HEADER, SSEC_KEY_HEADER, SSEC_KEY_MD5_HEADER};
+
+        self.user_defined.keys().any(|key| {
+            let lower = key.to_ascii_lowercase();
+            lower.starts_with("x-minio-encryption-")
+                || lower.starts_with("x-minio-internal-server-side-encryption-")
+                || matches!(
+                    lower.as_str(),
+                    "x-minio-internal-encrypted-multipart"
+                        | "x-rustfs-encryption-key"
+                        | "x-rustfs-encryption-algorithm"
+                        | "x-rustfs-encryption-iv"
+                        | "x-rustfs-encryption-key-id"
+                        | "x-rustfs-encryption-context"
+                        | "x-rustfs-encryption-tag"
+                        | "x-amz-server-side-encryption-aws-kms-key-id"
+                        | SSEC_ALGORITHM_HEADER
+                        | SSEC_KEY_HEADER
+                        | SSEC_KEY_MD5_HEADER
+                        | "x-amz-server-side-encryption"
+                )
+        })
    }

    /// Maximum inline size for non-versioned objects (128 KiB).
@@ -319,7 +339,26 @@ impl ObjectInfo {
    }

    pub fn encryption_original_size(&self) -> std::io::Result<Option<i64>> {
-        rustfs_utils::http::get_object_encryption_original_size(&self.user_defined)
+        let actual_size = rustfs_utils::http::get_str(&self.user_defined, rustfs_utils::http::SUFFIX_ACTUAL_SIZE);
+        if let Some(size_str) = self
+            .user_defined
+            .get("x-rustfs-encryption-original-size")
+            .map(String::as_str)
+            .or_else(|| {
+                self.user_defined
+                    .get("x-amz-server-side-encryption-customer-original-size")
+                    .map(String::as_str)
+            })
+            .or(actual_size.as_deref())
+            && !size_str.is_empty()
+        {
+            let size = size_str
+                .parse::<i64>()
+                .map_err(|e| std::io::Error::other(format!("Failed to parse encryption original size: {e}")))?;
+            return Ok(Some(size));
+        }
+
+        Ok(None)
    }

    pub fn decrypted_size(&self) -> std::io::Result<i64> {
@@ -349,6 +388,9 @@ impl ObjectInfo {
            return Ok(actual_size);
        }

+        // Check if object is encrypted
+        // Managed SSE stores original size in x-rustfs-encryption-original-size metadata
+        // SSE-C stores original size in x-amz-server-side-encryption-customer-original-size
        if let Some(size) = self.encryption_original_size()? {
            return Ok(size);
        }
@@ -839,19 +881,6 @@ mod tests {
        assert!(!object.is_inline_fast_path_eligible(), "transitioned objects must fall back");
    }

-    #[test]
-    fn minio_internal_encryption_metadata_is_not_treated_as_plaintext() {
-        let object = ObjectInfo {
-            user_defined: Arc::new(HashMap::from([(
-                "X-Minio-Internal-Server-Side-Encryption-Sealed-Key".to_string(),
-                "sealed".to_string(),
-            )])),
-            ..Default::default()
-        };
-
-        assert!(object.is_encrypted());
-    }
-
    #[test]
    fn versions_after_marker_handles_null_version_marker() {
        let first_version = Uuid::parse_str("11111111-2222-3333-4444-555555555555").unwrap();
@@ -46,7 +46,6 @@ use crate::bucket::metadata_sys::BucketMetadataSys;
 use crate::bucket::replication::{DynReplicationPool, ReplicationStats};
 use crate::disk::DiskStore;
 use crate::layout::endpoints::{EndpointServerPools, SetupType};
-use crate::object_api::ObjectEncryptionResolver;
 use crate::services::event_notification::EventNotifier;
 use crate::services::tier::tier::TierConfigMgr;
 use rustfs_lock::{GlobalLockManager, get_global_lock_manager};
@@ -160,8 +159,6 @@ pub struct InstanceContext {
    /// workers (scanner/heal/tier/lifecycle) without touching another instance.
    /// Replaces the process-global cancel-token static.
    background_cancel_token: OnceLock<CancellationToken>,
-    /// Resolves object-encryption material at the application boundary.
-    object_encryption_resolver: OnceLock<Arc<dyn ObjectEncryptionResolver>>,
    tier_delete_journal_recovery_stores: std::sync::Mutex<HashSet<Uuid>>,
    transition_transaction_recovery_stores: std::sync::Mutex<HashSet<Uuid>>,
    #[cfg(test)]
@@ -200,7 +197,6 @@ impl InstanceContext {
            local_disk_set_drives: Arc::new(RwLock::new(Vec::new())),
            bucket_metadata_sys: std::sync::Mutex::new(None),
            background_cancel_token: OnceLock::new(),
-            object_encryption_resolver: OnceLock::new(),
            tier_delete_journal_recovery_stores: std::sync::Mutex::new(HashSet::new()),
            transition_transaction_recovery_stores: std::sync::Mutex::new(HashSet::new()),
            #[cfg(test)]
@@ -213,19 +209,6 @@ impl InstanceContext {
        self.lock_manager.clone()
    }

-    /// Install the application-owned object-encryption resolver once.
-    pub fn set_object_encryption_resolver(
-        &self,
-        resolver: Arc<dyn ObjectEncryptionResolver>,
-    ) -> Result<(), Arc<dyn ObjectEncryptionResolver>> {
-        self.object_encryption_resolver.set(resolver)
-    }
-
-    /// Return the configured object-encryption resolver, if startup installed one.
-    pub fn object_encryption_resolver(&self) -> Option<&dyn ObjectEncryptionResolver> {
-        self.object_encryption_resolver.get().map(Arc::as_ref)
-    }
-
    /// Set this instance's S3 region.
    ///
    /// Write-once: panics on a second write, preserving the startup fail-fast
@@ -46,6 +46,7 @@ use crate::{
 use rustfs_concurrency::WorkloadAdmissionSnapshotProvider;
 use rustfs_config::server_config::{Config, get_global_server_config, set_global_server_config};
 use rustfs_io_metrics::internode_metrics::global_internode_metrics;
+use rustfs_kms::{ObjectEncryptionService, get_global_encryption_service};
 use rustfs_lock::client::LockClient;
 use s3s::dto::BucketLifecycleConfiguration;
 use s3s::region::Region;
@@ -104,6 +105,10 @@ pub(crate) fn record_erasure_write_quorum_failure(stage: &'static str, dominant_
    global_internode_metrics().record_erasure_write_quorum_failure(stage, dominant_error);
 }

+pub(crate) async fn object_encryption_service() -> Option<Arc<ObjectEncryptionService>> {
+    get_global_encryption_service().await
+}
+
 pub fn object_store_handle() -> Option<Arc<ECStore>> {
    resolve_object_store_handle()
 }
@@ -505,7 +505,9 @@ impl SetDisks {
    }

    fn file_info_has_encryption_metadata(meta: &FileInfo) -> bool {
-        meta.metadata.keys().any(|name| http::is_object_encryption_marker(name))
+        meta.metadata
+            .keys()
+            .any(|name| http::is_encryption_metadata_key(name) || http::is_sse_header(name))
    }

    fn starts_with_ignore_ascii_case(value: &str, prefix: &str) -> bool {
@@ -144,17 +144,15 @@ use rustfs_object_capacity::capacity_scope::{
    CapacityScope, CapacityScopeDisk, current_dirty_generation, record_capacity_scope, record_global_dirty_scope,
 };
 use rustfs_s3_types::EventName;
-#[cfg(test)]
-use rustfs_utils::http::SSEC_ALGORITHM_HEADER;
 use rustfs_utils::http::headers::AMZ_OBJECT_TAGGING;
 use rustfs_utils::http::headers::AMZ_STORAGE_CLASS;
 use rustfs_utils::http::headers::{
    CACHE_CONTROL, CONTENT_DISPOSITION, CONTENT_ENCODING, CONTENT_LANGUAGE, CONTENT_TYPE, EXPIRES, HeaderExt as _,
 };
 use rustfs_utils::http::{
-    SUFFIX_ACTUAL_OBJECT_SIZE_CAP, SUFFIX_ACTUAL_SIZE, SUFFIX_COMPRESSION, SUFFIX_COMPRESSION_SIZE, SUFFIX_REPLICATION_SSEC_CRC,
-    SUFFIX_RESTORE_OPERATION_ID, contains_key_str, get_header_map, get_str, insert_str, is_object_encryption_marker,
-    remove_header_map,
+    SSEC_ALGORITHM_HEADER, SSEC_KEY_HEADER, SSEC_KEY_MD5_HEADER, SUFFIX_ACTUAL_OBJECT_SIZE_CAP, SUFFIX_ACTUAL_SIZE,
+    SUFFIX_COMPRESSION, SUFFIX_COMPRESSION_SIZE, SUFFIX_REPLICATION_SSEC_CRC, SUFFIX_RESTORE_OPERATION_ID, contains_key_str,
+    get_header_map, get_str, insert_str, is_encryption_metadata_key, remove_header_map,
 };
 use rustfs_utils::{
    HashAlgorithm,
@@ -669,7 +667,10 @@ pub(crate) fn strip_internal_multipart_metadata(metadata: &mut HashMap<String, S
 }

 fn should_persist_encryption_original_size(metadata: &HashMap<String, String>) -> bool {
-    metadata.keys().any(|key| is_object_encryption_marker(key))
+    metadata.keys().any(|key| is_encryption_metadata_key(key))
+        || metadata.contains_key(SSEC_ALGORITHM_HEADER)
+        || metadata.contains_key(SSEC_KEY_HEADER)
+        || metadata.contains_key(SSEC_KEY_MD5_HEADER)
 }

 /// Per-set memoized capacity dirty scope.
@@ -5848,23 +5849,27 @@ mod tests {
            crate::disk::DataDirDeleteStatus::Deleted
        );
        release_slow_candidate.notify_one();
-        for _ in 0..10 {
-            tokio::task::yield_now().await;
-        }
-        assert_eq!(
-            disk2
-                .delete_data_dir(
-                    bucket,
-                    data_dir,
-                    DeleteOptions {
-                        recursive: true,
-                        ..Default::default()
-                    },
-                )
-                .await
-                .expect("a token acquired after the deadline must be released"),
-            crate::disk::DataDirDeleteStatus::Deleted
-        );
+        timeout(Duration::from_secs(1), async {
+            loop {
+                match disk2
+                    .delete_data_dir(
+                        bucket,
+                        data_dir,
+                        DeleteOptions {
+                            recursive: true,
+                            ..Default::default()
+                        },
+                    )
+                    .await
+                    .expect("a token acquired after the deadline must be released")
+                {
+                    crate::disk::DataDirDeleteStatus::Deleted => return,
+                    crate::disk::DataDirDeleteStatus::Deferred => tokio::time::sleep(Duration::from_millis(1)).await,
+                }
+            }
+        })
+        .await
+        .expect("late snapshot lease cleanup must finish within the bounded wait");
    }

    #[tokio::test(start_paused = true)]
@@ -42,7 +42,6 @@ use crate::object_api::{GetObjectBodySource, get_object_body_cache_hook_suppress
 use crate::services::tier::tier::{TierConfigMgr, TierOperationLease};
 use crate::store::ECStore;
 use futures::FutureExt as _;
-use http::HeaderValue;
 use std::future::Future;

 fn erasure_from_file_info(fi: &FileInfo, uses_legacy: bool) -> Result<coding::Erasure> {
@@ -50,17 +49,6 @@ fn erasure_from_file_info(fi: &FileInfo, uses_legacy: bool) -> Result<coding::Er
        .map_err(Error::from)
 }

-async fn get_object_reader_with_context(
-    ctx: &InstanceContext,
-    reader: Box<dyn AsyncRead + Unpin + Send + Sync>,
-    range: Option<HTTPRangeSpec>,
-    object_info: &ObjectInfo,
-    opts: &ObjectOptions,
-    headers: &HeaderMap<HeaderValue>,
-) -> Result<(GetObjectReader, usize, i64)> {
-    GetObjectReader::new_with_resolver(reader, range, object_info, opts, headers, ctx.object_encryption_resolver()).await
-}
-
 /// Length of the full plaintext body when — and only when — this read's output
 /// is exactly the object's complete plaintext, so the app-layer body cache may
 /// serve it in place of the erasure read.
@@ -725,8 +713,7 @@ impl crate::storage_api_contracts::object::ObjectIO for SetDisks {
                            size_bucket,
                        );
                        record_get_object_reader_path_observation(GET_OBJECT_PATH_CODEC_STREAMING, object_class, size_bucket);
-                        let (mut reader, _offset, _length) =
-                            get_object_reader_with_context(&self.ctx, stream, range, &object_info, opts, &h).await?;
+                        let (mut reader, _offset, _length) = GetObjectReader::new(stream, range, &object_info, opts, &h).await?;
                        // Carry the hook probe result so the app layer skips its
                        // now-redundant lookup on the streaming miss path (ODC-16).
                        reader.body_source = body_source;
@@ -758,8 +745,7 @@ impl crate::storage_api_contracts::object::ObjectIO for SetDisks {
        let (rd, wd) = tokio::io::duplex(duplex_buffer_size);
        debug!(bucket, object, duplex_buffer_size, "Created duplex pipe for object data transfer");

-        let (mut reader, offset, length) =
-            get_object_reader_with_context(&self.ctx, Box::new(rd), range, &object_info, opts, &h).await?;
+        let (mut reader, offset, length) = GetObjectReader::new(Box::new(rd), range, &object_info, opts, &h).await?;
        // Carry the hook probe result so the app layer skips its now-redundant
        // lookup on the streaming miss path (ODC-16).
        reader.body_source = body_source;
@@ -4550,61 +4536,6 @@ mod erasure_construction_tests {
    }
 }

-#[cfg(test)]
-mod object_encryption_resolver_wiring_tests {
-    use super::*;
-    use crate::object_api::{EncryptionResolutionError, ObjectEncryptionResolver, ReadEncryptionMaterial, ReadEncryptionRequest};
-    use std::io::Cursor;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-
-    struct CountingResolver {
-        calls: AtomicUsize,
-    }
-
-    #[async_trait::async_trait]
-    impl ObjectEncryptionResolver for CountingResolver {
-        async fn resolve_read_material(
-            &self,
-            _request: ReadEncryptionRequest<'_>,
-        ) -> std::result::Result<Option<ReadEncryptionMaterial>, EncryptionResolutionError> {
-            self.calls.fetch_add(1, Ordering::Relaxed);
-            Ok(None)
-        }
-    }
-
-    #[tokio::test]
-    async fn get_object_reader_forwards_instance_resolver() {
-        let resolver = Arc::new(CountingResolver {
-            calls: AtomicUsize::new(0),
-        });
-        let ctx = InstanceContext::new();
-        assert!(
-            ctx.set_object_encryption_resolver(resolver.clone()).is_ok(),
-            "fresh context should accept resolver"
-        );
-        let object_info = ObjectInfo {
-            bucket: "bucket".to_string(),
-            name: "object".to_string(),
-            size: 1,
-            user_defined: Arc::new(HashMap::from([("x-amz-server-side-encryption".to_string(), "AES256".to_string())])),
-            ..Default::default()
-        };
-
-        let result = get_object_reader_with_context(
-            &ctx,
-            Box::new(Cursor::new(Vec::<u8>::new())),
-            None,
-            &object_info,
-            &ObjectOptions::default(),
-            &HeaderMap::new(),
-        )
-        .await;
-
-        assert!(result.is_err(), "resolver returning no material must fail closed");
-        assert_eq!(resolver.calls.load(Ordering::Relaxed), 1);
-    }
-}
-
 #[cfg(test)]
 pub(in crate::set_disk::ops) mod hermetic_set_disks_support {
    //! Shared hermetic `SetDisks` construction for the ops tests below: the
@@ -310,12 +310,13 @@ impl ECStore {
        meta.set_created(opts.created_at);

        if opts.lock_enabled {
-            meta.object_lock_config_xml = crate::bucket::utils::serialize::<ObjectLockConfiguration>(&enableObjcetLockConfig)?;
-            meta.versioning_config_xml = crate::bucket::utils::serialize::<VersioningConfiguration>(&enableVersioningConfig)?;
+            meta.object_lock_config_xml =
+                crate::bucket::utils::serialize::<ObjectLockConfiguration>(&ENABLED_OBJECT_LOCK_CONFIG)?;
+            meta.versioning_config_xml = crate::bucket::utils::serialize::<VersioningConfiguration>(&ENABLED_VERSIONING_CONFIG)?;
        }

        if opts.versioning_enabled {
-            meta.versioning_config_xml = crate::bucket::utils::serialize::<VersioningConfiguration>(&enableVersioningConfig)?;
+            meta.versioning_config_xml = crate::bucket::utils::serialize::<VersioningConfiguration>(&ENABLED_VERSIONING_CONFIG)?;
        }

        await_bucket_namespace_operation(
@@ -428,11 +428,11 @@ impl ECStore {
 }

 lazy_static! {
-    static ref enableObjcetLockConfig: ObjectLockConfiguration = ObjectLockConfiguration {
+    static ref ENABLED_OBJECT_LOCK_CONFIG: ObjectLockConfiguration = ObjectLockConfiguration {
        object_lock_enabled: Some(ObjectLockEnabled::from_static(ObjectLockEnabled::ENABLED)),
        ..Default::default()
    };
-    static ref enableVersioningConfig: VersioningConfiguration = VersioningConfiguration {
+    static ref ENABLED_VERSIONING_CONFIG: VersioningConfiguration = VersioningConfiguration {
        status: Some(BucketVersioningStatus::from_static(BucketVersioningStatus::ENABLED)),
        ..Default::default()
    };
@@ -2,7 +2,7 @@

 ## MinIO-generated encrypted fixtures

-`rustfs/src/storage/minio_generated_read_test.rs` validates the `bitrot -> GetObjectReader` path against raw MinIO backend data captured by
+`minio_generated_read_test.rs` validates the `bitrot -> GetObjectReader` path against raw MinIO backend data captured by
 `.\rustfs\scripts\minio_fixture_lab\lab.py`.

 It currently covers multipart fixtures for:
@@ -20,5 +20,5 @@ Example:
 ```powershell
 $env:RUSTFS_MINIO_FIXTURE_ROOT = '.\rustfs\tmp\minio-fixture-lab-local-key'
 $env:RUSTFS_MINIO_STATIC_KMS_KEY_B64 = '<base64-32-byte-local-minio-kms-key>'
-cargo +1.97.1 test -p rustfs --features rio-v2 storage::minio_generated_read_test --lib -- --ignored
+cargo +1.97.1 test -p rustfs-ecstore --features rio-v2 --test minio_generated_read_test -- --ignored
 ```
@@ -4,13 +4,14 @@ use std::fs;
 use std::io::Cursor;
 use std::path::{Path, PathBuf};

-use super::sse::SseObjectEncryptionResolver;
-use super::storage_api::ecstore_test_support::{
-    DiskAPI as _, DiskOption, Endpoint, Erasure, GetObjectReader, ObjectInfo, ObjectOptions, create_bitrot_reader, new_disk,
-};
+mod storage_api;
+
 use rustfs_filemeta::{FileInfo, FileInfoOpts, get_file_info};
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
+use storage_api::minio_generated_read::{
+    DiskAPI as _, DiskOption, Endpoint, Erasure, GetObjectReader, ObjectInfo, ObjectOptions, create_bitrot_reader, new_disk,
+};
 use temp_env::async_with_vars;
 use tokio::io::{AsyncReadExt, AsyncWrite};

@@ -48,7 +49,7 @@ impl AsyncWrite for VecAsyncWriter {
 fn fixture_root() -> PathBuf {
    std::env::var_os("RUSTFS_MINIO_FIXTURE_ROOT")
        .map(PathBuf::from)
-        .unwrap_or_else(|| PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../crates/rio-v2/tests/fixtures/minio-generated"))
+        .unwrap_or_else(|| PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../rio-v2/tests/fixtures/minio-generated"))
 }

 fn case_dir(case_id: &str) -> PathBuf {
@@ -136,14 +137,12 @@ async fn read_fixture_plaintext(encrypted: Vec<u8>, object_info: ObjectInfo, kms
            ("RUSTFS_SSE_S3_MASTER_KEY", None::<String>),
        ],
        async move {
-            let resolver = SseObjectEncryptionResolver;
-            let (mut reader, offset, length) = GetObjectReader::new_with_resolver(
+            let (mut reader, offset, length) = GetObjectReader::new(
                Box::new(Cursor::new(encrypted)),
                None,
                &object_info,
                &ObjectOptions::default(),
                &http::HeaderMap::new(),
-                Some(&resolver),
            )
            .await
            .map_err(|err| format!("construct GetObjectReader from MinIO raw fixture: {err:?}"))?;
@@ -220,12 +219,11 @@ async fn encrypted_fixture_bytes(case_dir: &Path, manifest: &ManifestRecord, fil
            readers.push(reader);
        }

-        let erasure = Erasure::try_new(
+        let erasure = Erasure::new(
            file_info.erasure.data_blocks,
            file_info.erasure.parity_blocks,
            file_info.erasure.block_size,
-        )
-        .expect("fixture erasure geometry");
+        );
        let mut writer = VecAsyncWriter::default();
        let (written, err) = erasure.decode(&mut writer, readers, 0, part.size, part.size).await;
        if let Some(err) = err {
@@ -556,7 +556,7 @@ where
        Ok(now)
    }

-    pub async fn list_polices(&self, bucket_name: &str) -> Result<HashMap<String, Policy>> {
+    pub async fn list_policies(&self, bucket_name: &str) -> Result<HashMap<String, Policy>> {
        let mut m = HashMap::new();

        self.api.load_policy_docs(&mut m).await?;
@@ -588,6 +588,15 @@ where
        Ok(filtered)
    }

+    /// Backward-compatible misspelling retained until the next breaking release.
+    #[deprecated(
+        since = "1.0.0",
+        note = "use list_policies instead; this alias will be removed in the next breaking release"
+    )]
+    pub async fn list_polices(&self, bucket_name: &str) -> Result<HashMap<String, Policy>> {
+        self.list_policies(bucket_name).await
+    }
+
    pub async fn merge_policies(&self, name: &str) -> (String, Policy) {
        let mut policies = Vec::new();
        let mut to_merge = Vec::new();
@@ -2184,7 +2193,7 @@ where
    }
 }

-pub fn get_default_policyes() -> HashMap<String, PolicyDoc> {
+pub fn get_default_policies() -> HashMap<String, PolicyDoc> {
    let default_policies = &DEFAULT_POLICIES;
    default_policies
        .iter()
@@ -2201,6 +2210,15 @@ pub fn get_default_policyes() -> HashMap<String, PolicyDoc> {
        .collect()
 }

+/// Backward-compatible misspelling retained until the next breaking release.
+#[deprecated(
+    since = "1.0.0",
+    note = "use get_default_policies instead; this alias will be removed in the next breaking release"
+)]
+pub fn get_default_policyes() -> HashMap<String, PolicyDoc> {
+    get_default_policies()
+}
+
 fn set_default_canned_policies(policies: &mut HashMap<String, PolicyDoc>) {
    let default_policies = &DEFAULT_POLICIES;
    for (k, v) in default_policies.iter() {
@@ -2900,7 +2918,7 @@ mod tests {

    #[test]
    fn test_get_default_policies() {
-        let policies = get_default_policyes();
+        let policies = get_default_policies();

        // Should contain some default policies
        assert!(!policies.is_empty());
@@ -2913,6 +2931,12 @@ mod tests {
        }
    }

+    #[test]
+    #[allow(deprecated)]
+    fn deprecated_get_default_policyes_matches_current_api() {
+        assert_eq!(get_default_policyes().len(), get_default_policies().len());
+    }
+
    #[test]
    fn test_get_token_signing_key() {
        // This function returns the global action credential's secret key
@@ -22,7 +22,7 @@ use crate::{
    cache::{Cache, CacheEntity},
    error::{is_err_no_such_policy, is_err_no_such_user},
    keyring,
-    manager::{extract_jwt_claims, extract_jwt_claims_allow_missing_exp, get_default_policyes},
+    manager::{extract_jwt_claims, extract_jwt_claims_allow_missing_exp, get_default_policies},
    root_credentials,
 };
 use futures::future::join_all;
@@ -1127,7 +1127,7 @@ impl Store for ObjectStore {
        let cache_snapshot = cache.snapshot();
        let listed_config_items = self.list_all_iamconfig_items().await?;

-        let mut policy_docs_cache = CacheEntity::new(get_default_policyes());
+        let mut policy_docs_cache = CacheEntity::new(get_default_policies());

        if let Some(policies_list) = listed_config_items.get(POLICIES_LIST_KEY) {
            // Load in fixed-size chunks so each policy is fetched exactly once.
@@ -18,7 +18,7 @@ use crate::error::is_err_no_such_temp_account;
 use crate::error::{Error, Result};
 use crate::federation::OIDC_VIRTUAL_PARENT_CLAIM;
 use crate::manager::extract_jwt_claims;
-use crate::manager::get_default_policyes;
+use crate::manager::get_default_policies;
 use crate::manager::{IamCache, IamSyncMetricsSnapshot};
 use crate::store::GroupInfo;
 use crate::store::MappedPolicy;
@@ -249,7 +249,7 @@ impl<T: Store> IamSys<T> {
    }

    pub async fn delete_policy(&self, name: &str, notify: bool) -> Result<()> {
-        for k in get_default_policyes().keys() {
+        for k in get_default_policies().keys() {
            if k == name {
                return Err(Error::other("system policy can not be deleted"));
            }
@@ -291,8 +291,17 @@ impl<T: Store> IamSys<T> {
        self.store.api.load_mapped_policies(user_type, is_group, m).await
    }

+    pub async fn list_policies(&self, bucket_name: &str) -> Result<HashMap<String, Policy>> {
+        self.store.list_policies(bucket_name).await
+    }
+
+    /// Backward-compatible misspelling retained until the next breaking release.
+    #[deprecated(
+        since = "1.0.0",
+        note = "use list_policies instead; this alias will be removed in the next breaking release"
+    )]
    pub async fn list_polices(&self, bucket_name: &str) -> Result<HashMap<String, Policy>> {
-        self.store.list_polices(bucket_name).await
+        self.list_policies(bucket_name).await
    }

    pub async fn list_policy_docs(&self, bucket_name: &str) -> Result<HashMap<String, PolicyDoc>> {
@@ -1683,11 +1692,17 @@ mod tests {
    use super::*;
    use crate::cache::{Cache, CacheEntity};
    use crate::error::Error;
-    use crate::manager::get_default_policyes;
+    use crate::manager::get_default_policies;
    use crate::store::{GroupInfo, MappedPolicy, Store, UserType};
    use rustfs_credentials::{Credentials, init_global_action_credentials};
    use rustfs_policy::auth::{UserIdentity, get_new_credentials_with_metadata};
    use rustfs_policy::policy::Args;
+
+    #[test]
+    #[allow(deprecated)]
+    fn deprecated_list_polices_api_is_available() {
+        let _ = IamSys::<StsTestMockStore>::list_polices;
+    }
    use rustfs_policy::policy::action::{Action, AdminAction, S3Action};
    use rustfs_policy::policy::policy_uses_existing_object_tag_conditions;
    use serde_json::Value;
@@ -1925,7 +1940,7 @@ mod tests {
        }

        async fn load_all(&self, cache: &Cache) -> Result<()> {
-            let mut policy_docs = get_default_policyes();
+            let mut policy_docs = get_default_policies();
            let custom_claim_policy =
                Policy::parse_config(CUSTOM_STS_CLAIM_POLICY_JSON.as_bytes()).expect("custom STS claim policy should parse");
            policy_docs.insert(CUSTOM_STS_CLAIM_POLICY.to_string(), PolicyDoc::new(custom_claim_policy));
@@ -25,25 +25,3 @@ For local KMS end-to-end tests, keep proxy bypass settings:
 NO_PROXY=127.0.0.1,localhost HTTP_PROXY= HTTPS_PROXY= http_proxy= https_proxy= \
 cargo test --package e2e_test test_local_kms_end_to_end -- --nocapture --test-threads=1
 ```
-
-## Local Key Export for SSE-S3 Migration Tests
-
-Use the read-only `local_kms_key_decrypt` example to export an AES-256 Local
-KMS key as the base64 value expected by `RUSTFS_SSE_S3_MASTER_KEY`:
-
-```bash
-export RUSTFS_KMS_LOCAL_MASTER_KEY='<local-kms-at-rest-master-key>'
-export RUSTFS_SSE_S3_MASTER_KEY="$(
-  cargo run -q -p rustfs-kms --example local_kms_key_decrypt -- \
-    /absolute/path/to/<key-id>.key
-)"
-```
-
-For a `plaintext-dev-only` Local KMS key file,
-`RUSTFS_KMS_LOCAL_MASTER_KEY` is not required.
-
-The example writes only the base64-encoded 32-byte key to stdout. Diagnostics
-go to stderr. Never paste its output into logs, shell history, issue comments,
-or committed configuration. The export path must remain read-only and must
-reuse `LocalKmsClient` decoding so current Argon2id and legacy key-file
-compatibility stay aligned with the backend.
@@ -1,112 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
-use rustfs_kms::{LocalConfig, backends::local::LocalKmsClient};
-use std::io::{self, Write};
-use std::path::{Path, PathBuf};
-use zeroize::Zeroizing;
-
-const LOCAL_KMS_MASTER_KEY_ENV: &str = "RUSTFS_KMS_LOCAL_MASTER_KEY";
-
-fn usage(program: &str) -> String {
-    format!(
-        "Usage: {program} <local-kms-key-file>\n\
-         Reads {LOCAL_KMS_MASTER_KEY_ENV} when the key file is encrypted.\n\
-         Writes only the base64-encoded 32-byte key to stdout."
-    )
-}
-
-fn resolve_key_file(path: &Path) -> Result<(PathBuf, String), String> {
-    let canonical = std::fs::canonicalize(path).map_err(|error| format!("cannot open Local KMS key file: {error}"))?;
-    if canonical.extension().and_then(|extension| extension.to_str()) != Some("key") {
-        return Err("Local KMS key file must have a .key extension".to_string());
-    }
-    let key_dir = canonical
-        .parent()
-        .ok_or_else(|| "Local KMS key file must have a parent directory".to_string())?
-        .to_path_buf();
-    let key_id = canonical
-        .file_stem()
-        .and_then(|stem| stem.to_str())
-        .filter(|stem| !stem.is_empty())
-        .ok_or_else(|| "Local KMS key file name must contain a valid UTF-8 key ID".to_string())?
-        .to_string();
-    Ok((key_dir, key_id))
-}
-
-async fn run() -> Result<(), String> {
-    let mut args = std::env::args();
-    let program = args.next().unwrap_or_else(|| "local_kms_key_decrypt".to_string());
-    let Some(key_file) = args.next() else {
-        return Err(usage(&program));
-    };
-    if args.next().is_some() {
-        return Err(usage(&program));
-    }
-
-    let (key_dir, key_id) = resolve_key_file(Path::new(&key_file))?;
-    let master_key = std::env::var(LOCAL_KMS_MASTER_KEY_ENV).ok().filter(|value| !value.is_empty());
-    let client = LocalKmsClient::new_for_key_export(LocalConfig {
-        key_dir,
-        master_key,
-        file_permissions: Some(0o600),
-    })
-    .await
-    .map_err(|error| error.to_string())?;
-    let key_material = client
-        .decrypt_key_material_for_export(&key_id)
-        .await
-        .map_err(|error| error.to_string())?;
-    let encoded = Zeroizing::new(BASE64_STANDARD.encode(key_material.as_ref()));
-
-    let mut stdout = io::stdout().lock();
-    writeln!(stdout, "{}", encoded.as_str()).map_err(|error| format!("failed to write decrypted key: {error}"))
-}
-
-#[tokio::main]
-async fn main() {
-    if let Err(error) = run().await {
-        let _ = writeln!(io::stderr().lock(), "local_kms_key_decrypt: {error}");
-        std::process::exit(1);
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn resolve_key_file_extracts_directory_and_key_id() {
-        let directory = tempfile::tempdir().expect("create temporary directory");
-        let key_file = directory.path().join("migration-key.key");
-        std::fs::write(&key_file, b"{}").expect("create key file");
-
-        let (key_dir, key_id) = resolve_key_file(&key_file).expect("resolve key file");
-
-        assert_eq!(key_dir, directory.path().canonicalize().expect("canonical directory"));
-        assert_eq!(key_id, "migration-key");
-    }
-
-    #[test]
-    fn resolve_key_file_rejects_non_key_extension() {
-        let directory = tempfile::tempdir().expect("create temporary directory");
-        let key_file = directory.path().join("migration-key.json");
-        std::fs::write(&key_file, b"{}").expect("create key file");
-
-        let error = resolve_key_file(&key_file).expect_err("non-key file must be rejected");
-
-        assert!(error.contains(".key"));
-    }
-}
@@ -36,7 +36,6 @@ use std::path::{Component, Path, PathBuf};
 use std::time::Duration;
 use tokio::fs;
 use tracing::{debug, warn};
-use zeroize::Zeroizing;

 /// Reject key identifiers that would not name a single file directly inside the key
 /// directory.
@@ -147,45 +146,6 @@ impl LocalKmsClient {
        Ok(client)
    }

-    /// Open a Local KMS key directory without creating or modifying any files.
-    ///
-    /// This constructor is restricted to explicit key-export tooling. Normal
-    /// backend operation must use [`Self::new`].
-    pub async fn new_for_key_export(config: LocalConfig) -> Result<Self> {
-        if !fs::try_exists(&config.key_dir).await? {
-            return Err(KmsError::configuration_error("Local KMS key directory does not exist"));
-        }
-
-        let (master_cipher, legacy_master_cipher) = if let Some(ref master_key) = config.master_key {
-            let legacy_key = Self::derive_legacy_master_key(master_key)?;
-            let legacy_master_cipher = Aes256Gcm::new(&legacy_key);
-            let salt_path = Self::master_key_salt_path(&config);
-            let master_cipher = if fs::try_exists(&salt_path).await? {
-                let salt = fs::read(&salt_path).await?;
-                let salt: [u8; LOCAL_KMS_MASTER_KEY_SALT_LEN] = salt.try_into().map_err(|_| {
-                    KmsError::configuration_error(format!(
-                        "Local KMS master key salt at {} must be exactly {} bytes",
-                        salt_path.display(),
-                        LOCAL_KMS_MASTER_KEY_SALT_LEN
-                    ))
-                })?;
-                Aes256Gcm::new(&Self::derive_master_key(master_key, &salt)?)
-            } else {
-                Aes256Gcm::new(&legacy_key)
-            };
-            (Some(master_cipher), Some(legacy_master_cipher))
-        } else {
-            (None, None)
-        };
-
-        Ok(Self {
-            config,
-            master_cipher,
-            legacy_master_cipher,
-            dek_crypto: AesDekCrypto::new(),
-        })
-    }
-
    /// Derive a 256-bit key from the master key string using a persistent Argon2id salt.
    fn derive_master_key(master_key: &str, salt: &[u8]) -> Result<Key<Aes256Gcm>> {
        let params = Params::new(
@@ -475,20 +435,6 @@ impl LocalKmsClient {
        Ok(key_material)
    }

-    /// Decrypt an AES-256 Local KMS key for explicit migration tooling.
-    ///
-    /// The returned buffer is zeroized on drop. Callers must treat the value as
-    /// plaintext key material and avoid logging or persisting it.
-    pub async fn decrypt_key_material_for_export(&self, key_id: &str) -> Result<Zeroizing<[u8; 32]>> {
-        let (stored_key, key_material) = self.decode_stored_key(key_id).await?;
-        if stored_key.algorithm != "AES_256" {
-            return Err(KmsError::unsupported_algorithm(stored_key.algorithm));
-        }
-        let actual = key_material.len();
-        let key_material = key_material.try_into().map_err(|_| KmsError::invalid_key_size(32, actual))?;
-        Ok(Zeroizing::new(key_material))
-    }
-
    async fn validate_existing_keys(&self) -> Result<()> {
        let mut entries = fs::read_dir(&self.config.key_dir).await?;
        while let Some(entry) = entries.next_entry().await? {
@@ -1262,52 +1208,6 @@ mod tests {
        assert!(matches!(wrong_master_error, KmsError::CryptographicError { .. }));
    }

-    #[tokio::test]
-    async fn key_export_uses_existing_local_decryption_path_without_writing_files() {
-        let (client, _temp_dir) = create_test_client().await;
-        let key_id = "export-key";
-        client
-            .create_key(key_id, "AES_256", None)
-            .await
-            .expect("create encrypted key");
-        let expected = client.get_key_material(key_id).await.expect("load expected key material");
-        let salt_path = LocalKmsClient::master_key_salt_path(&client.config);
-        let salt_before = fs::read(&salt_path).await.expect("read existing salt");
-
-        let export_client = LocalKmsClient::new_for_key_export(client.config.clone())
-            .await
-            .expect("open read-only export client");
-        let exported = export_client
-            .decrypt_key_material_for_export(key_id)
-            .await
-            .expect("decrypt key for export");
-
-        assert_eq!(exported.as_ref(), expected.as_slice());
-        assert_eq!(fs::read(&salt_path).await.expect("read unchanged salt"), salt_before);
-    }
-
-    #[tokio::test]
-    async fn key_export_accepts_plaintext_dev_only_key_without_master_key() {
-        let (client, _temp_dir) = create_dev_mode_client().await;
-        let key_id = "plaintext-export-key";
-        client
-            .create_key(key_id, "AES_256", None)
-            .await
-            .expect("create plaintext-dev-only key");
-        let expected = client.get_key_material(key_id).await.expect("load expected key material");
-
-        let export_client = LocalKmsClient::new_for_key_export(client.config.clone())
-            .await
-            .expect("open read-only export client");
-        let exported = export_client
-            .decrypt_key_material_for_export(key_id)
-            .await
-            .expect("export plaintext-dev-only key");
-
-        assert_eq!(exported.as_ref(), expected.as_slice());
-        assert!(!LocalKmsClient::master_key_salt_path(&client.config).exists());
-    }
-
    #[tokio::test]
    async fn test_plaintext_dev_only_storage_is_explicit_and_loadable() {
        let (client, _temp_dir) = create_dev_mode_client().await;
@@ -89,7 +89,7 @@ pub use error::{KmsError, KmsUnavailableError, Result};
 pub use manager::KmsManager;
 pub use service::{DataKey, ObjectEncryptionService};
 pub use service_manager::{
-    KmsServiceManager, KmsServiceStatus, KmsStartOutcome, get_global_encryption_service, get_global_kms_service_manager,
+    KmsServiceManager, KmsServiceStatus, get_global_encryption_service, get_global_kms_service_manager,
    init_global_kms_service_manager,
 };
 pub use types::*;
@@ -21,13 +21,12 @@ use crate::manager::KmsManager;
 use crate::service::ObjectEncryptionService;
 use arc_swap::ArcSwap;
 use sha2::{Digest, Sha256};
-use std::future::Future;
 use std::sync::{
    Arc, OnceLock,
    atomic::{AtomicU64, Ordering},
 };
 use subtle::ConstantTimeEq;
-use tokio::sync::Mutex;
+use tokio::sync::{Mutex, RwLock};
 use tracing::{debug, error, info, warn};

 const LOG_COMPONENT_KMS: &str = "kms";
@@ -94,13 +93,6 @@ pub enum KmsServiceStatus {
    Error(String),
 }

-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum KmsStartOutcome {
-    Started,
-    Restarted,
-    AlreadyRunning,
-}
-
 /// Service version information for zero-downtime reconfiguration
 #[derive(Clone)]
 struct ServiceVersion {
@@ -112,17 +104,16 @@ struct ServiceVersion {
    manager: Arc<KmsManager>,
 }

-#[derive(Clone)]
-struct RuntimeState {
-    config: Option<KmsConfig>,
-    status: KmsServiceStatus,
-    current_service: Option<ServiceVersion>,
-}
-
 /// Dynamic KMS service manager with versioned services for zero-downtime reconfiguration
 pub struct KmsServiceManager {
-    /// Atomically published configuration, status, and current service.
-    state: ArcSwap<RuntimeState>,
+    /// Current service version (if running)
+    /// Uses ArcSwap for atomic, lock-free service switching
+    /// This allows instant atomic updates without blocking readers
+    current_service: ArcSwap<Option<ServiceVersion>>,
+    /// Current configuration
+    config: Arc<RwLock<Option<KmsConfig>>>,
+    /// Current status
+    status: Arc<RwLock<KmsServiceStatus>>,
    /// Version counter (monotonically increasing)
    version_counter: Arc<AtomicU64>,
    /// Mutex to protect lifecycle operations (start, stop, reconfigure)
@@ -134,11 +125,9 @@ impl KmsServiceManager {
    /// Create a new KMS service manager (not configured)
    pub fn new() -> Self {
        Self {
-            state: ArcSwap::from_pointee(RuntimeState {
-                config: None,
-                status: KmsServiceStatus::NotConfigured,
-                current_service: None,
-            }),
+            current_service: ArcSwap::from_pointee(None),
+            config: Arc::new(RwLock::new(None)),
+            status: Arc::new(RwLock::new(KmsServiceStatus::NotConfigured)),
            version_counter: Arc::new(AtomicU64::new(0)),
            lifecycle_mutex: Arc::new(Mutex::new(())),
        }
@@ -146,67 +135,44 @@ impl KmsServiceManager {

    /// Get current service status
    pub async fn get_status(&self) -> KmsServiceStatus {
-        self.state.load().status.clone()
+        self.status.read().await.clone()
    }

    /// Get current configuration (if any)
    pub async fn get_config(&self) -> Option<KmsConfig> {
-        self.state.load().config.clone()
+        self.config.read().await.clone()
    }

    /// Get configuration for status and management responses without static key material.
    pub async fn get_redacted_config(&self) -> Option<KmsConfig> {
-        let mut config = self.state.load().config.clone()?;
-        Self::redact_config(&mut config);
-        Some(config)
-    }
-
-    /// Get status and redacted configuration from the same published snapshot.
-    pub async fn get_redacted_state(&self) -> (KmsServiceStatus, Option<KmsConfig>) {
-        let state = self.state.load();
-        let mut config = state.config.clone();
-        if let Some(config) = &mut config {
-            Self::redact_config(config);
-        }
-        (state.status.clone(), config)
-    }
-
-    fn redact_config(config: &mut KmsConfig) {
+        let mut config = self.config.read().await.clone()?;
        if let BackendConfig::Static(static_config) = &mut config.backend_config {
            use zeroize::Zeroize;
            static_config.secret_key.zeroize();
        }
+        Some(config)
    }

    /// Configure KMS with new configuration
    pub async fn configure(&self, new_config: KmsConfig) -> Result<()> {
-        self.configure_with_persistence(new_config, || async { Ok(()) }).await
-    }
-
-    /// Configure KMS and publish the in-memory state only after persistence succeeds.
-    ///
-    /// The persistence callback runs under the lifecycle lock and must not call
-    /// another lifecycle method on this manager.
-    pub async fn configure_with_persistence<Persist, PersistFuture>(&self, new_config: KmsConfig, persist: Persist) -> Result<()>
-    where
-        Persist: FnOnce() -> PersistFuture,
-        PersistFuture: Future<Output = Result<()>>,
-    {
-        new_config.validate()?;
        let _guard = self.lifecycle_mutex.lock().await;
-        let current = self.state.load_full();
-        validate_local_transition(current.config.as_ref(), &new_config)?;
-        if current.current_service.is_some() {
-            return Err(KmsError::configuration_error(
-                "Cannot configure KMS while it is running; use reconfigure instead",
-            ));
+        new_config.validate()?;
+        {
+            let config = self.config.read().await;
+            validate_local_transition(config.as_ref(), &new_config)?;
+        }
+
+        // Update configuration
+        {
+            let mut config = self.config.write().await;
+            *config = Some(new_config.clone());
+        }
+
+        // Update status
+        {
+            let mut status = self.status.write().await;
+            *status = KmsServiceStatus::Configured;
        }
-        persist().await?;
-        self.state.store(Arc::new(RuntimeState {
-            config: Some(new_config),
-            status: KmsServiceStatus::Configured,
-            current_service: None,
-        }));

        debug!(
            event = EVENT_KMS_SERVICE_STATE,
@@ -224,35 +190,19 @@ impl KmsServiceManager {
        self.start_internal().await
    }

-    /// Start or restart KMS with the running-state decision serialized with the lifecycle action.
-    pub async fn start_or_restart(&self, force: bool) -> Result<KmsStartOutcome> {
-        let _guard = self.lifecycle_mutex.lock().await;
-        let running = self.state.load().current_service.is_some();
-        if running && !force {
-            return Ok(KmsStartOutcome::AlreadyRunning);
-        }
-        self.start_internal().await?;
-        Ok(if running {
-            KmsStartOutcome::Restarted
-        } else {
-            KmsStartOutcome::Started
-        })
-    }
-
    /// Internal start implementation (called within lifecycle mutex)
    async fn start_internal(&self) -> Result<()> {
-        let state = self.state.load_full();
-        let config = match state.config.as_ref() {
-            Some(config) => config.clone(),
-            None => {
-                let err_msg = "Cannot start KMS: no configuration provided";
-                error!("{}", err_msg);
-                self.state.store(Arc::new(RuntimeState {
-                    config: None,
-                    status: KmsServiceStatus::Error(err_msg.to_string()),
-                    current_service: None,
-                }));
-                return Err(KmsError::configuration_error(err_msg));
+        let config = {
+            let config_guard = self.config.read().await;
+            match config_guard.as_ref() {
+                Some(config) => config.clone(),
+                None => {
+                    let err_msg = "Cannot start KMS: no configuration provided";
+                    error!("{}", err_msg);
+                    let mut status = self.status.write().await;
+                    *status = KmsServiceStatus::Error(err_msg.to_string());
+                    return Err(KmsError::configuration_error(err_msg));
+                }
            }
        };

@@ -265,9 +215,17 @@ impl KmsServiceManager {
            "KMS service starting"
        );

-        match self.create_healthy_service_version(&config).await {
+        match self.create_service_version(&config).await {
            Ok(service_version) => {
-                self.publish_running(config, service_version);
+                // Atomically update to new service version (lock-free, instant)
+                // ArcSwap::store() is a true atomic operation using CAS
+                self.current_service.store(Arc::new(Some(service_version)));
+
+                // Update status
+                {
+                    let mut status = self.status.write().await;
+                    *status = KmsServiceStatus::Running;
+                }

                debug!(
                    event = EVENT_KMS_SERVICE_STATE,
@@ -281,24 +239,13 @@ impl KmsServiceManager {
            Err(e) => {
                let err_msg = format!("Failed to create KMS backend: {e}");
                error!("{}", err_msg);
-                if state.current_service.is_none() {
-                    self.state.store(Arc::new(RuntimeState {
-                        config: state.config.clone(),
-                        status: KmsServiceStatus::Error(err_msg.clone()),
-                        current_service: None,
-                    }));
-                }
+                let mut status = self.status.write().await;
+                *status = KmsServiceStatus::Error(err_msg.clone());
                Err(KmsError::backend_error(&err_msg))
            }
        }
    }

-    /// Replace the running service without exposing a stopped interval.
-    pub async fn restart(&self) -> Result<()> {
-        let _guard = self.lifecycle_mutex.lock().await;
-        self.start_internal().await
-    }
-
    /// Stop KMS service
    ///
    /// Note: This stops accepting new operations, but existing operations using
@@ -320,16 +267,15 @@ impl KmsServiceManager {

        // Atomically clear current service version (lock-free, instant)
        // Note: Existing Arc references will keep the service alive until operations complete
-        let state = self.state.load_full();
-        self.state.store(Arc::new(RuntimeState {
-            config: state.config.clone(),
-            status: if state.config.is_some() {
-                KmsServiceStatus::Configured
-            } else {
-                KmsServiceStatus::NotConfigured
-            },
-            current_service: None,
-        }));
+        self.current_service.store(Arc::new(None));
+
+        // Update status (keep configuration)
+        {
+            let mut status = self.status.write().await;
+            if !matches!(*status, KmsServiceStatus::NotConfigured) {
+                *status = KmsServiceStatus::Configured;
+            }
+        }

        debug!(
            event = EVENT_KMS_SERVICE_STATE,
@@ -352,22 +298,6 @@ impl KmsServiceManager {
    /// This ensures zero downtime during reconfiguration, even for long-running
    /// operations like encrypting large files.
    pub async fn reconfigure(&self, new_config: KmsConfig) -> Result<()> {
-        self.reconfigure_with_persistence(new_config, || async { Ok(()) }).await
-    }
-
-    /// Reconfigure KMS after the candidate is healthy and persistence succeeds.
-    ///
-    /// The persistence callback runs under the lifecycle lock and must not call
-    /// another lifecycle method on this manager.
-    pub async fn reconfigure_with_persistence<Persist, PersistFuture>(
-        &self,
-        new_config: KmsConfig,
-        persist: Persist,
-    ) -> Result<()>
-    where
-        Persist: FnOnce() -> PersistFuture,
-        PersistFuture: Future<Output = Result<()>>,
-    {
        let _guard = self.lifecycle_mutex.lock().await;

        debug!(
@@ -378,18 +308,33 @@ impl KmsServiceManager {
            "KMS service reconfiguring"
        );
        new_config.validate()?;
-        validate_local_transition(self.state.load().config.as_ref(), &new_config)?;
+        {
+            let config = self.config.read().await;
+            validate_local_transition(config.as_ref(), &new_config)?;
+        }

        // Create new service version without stopping old one
        // This allows existing operations to continue while new operations use new service
-        match self.create_healthy_service_version(&new_config).await {
+        match self.create_service_version(&new_config).await {
            Ok(new_service_version) => {
                // Get old version for logging (lock-free read)
-                let old_version = self.state.load().current_service.as_ref().map(|sv| sv.version);
+                let old_version = self.current_service.load().as_ref().as_ref().map(|sv| sv.version);

-                persist().await?;
+                {
+                    let mut config = self.config.write().await;
+                    *config = Some(new_config);
+                }

-                self.publish_running(new_config, new_service_version.clone());
+                // Atomically switch to new service version (lock-free, instant CAS operation)
+                // This is a true atomic operation - no waiting for locks, instant switch
+                // Old service will be dropped when no more Arc references exist
+                self.current_service.store(Arc::new(Some(new_service_version.clone())));
+
+                // Update status
+                {
+                    let mut status = self.status.write().await;
+                    *status = KmsServiceStatus::Running;
+                }

                if let Some(old_ver) = old_version {
                    info!(
@@ -426,7 +371,7 @@ impl KmsServiceManager {
    /// Returns the manager from the current service version.
    /// Uses lock-free atomic load for optimal performance.
    pub async fn get_manager(&self) -> Option<Arc<KmsManager>> {
-        self.state.load().current_service.as_ref().map(|sv| sv.manager.clone())
+        self.current_service.load().as_ref().as_ref().map(|sv| sv.manager.clone())
    }

    /// Get encryption service (if running)
@@ -436,7 +381,7 @@ impl KmsServiceManager {
    /// This ensures new operations always use the latest service version,
    /// while existing operations continue using their Arc references.
    pub async fn get_encryption_service(&self) -> Option<Arc<ObjectEncryptionService>> {
-        self.state.load().current_service.as_ref().map(|sv| sv.service.clone())
+        self.current_service.load().as_ref().as_ref().map(|sv| sv.service.clone())
    }

    /// Get current service version number
@@ -444,16 +389,14 @@ impl KmsServiceManager {
    /// Useful for monitoring and debugging.
    /// Uses lock-free atomic load.
    pub async fn get_service_version(&self) -> Option<u64> {
-        self.state.load().current_service.as_ref().map(|sv| sv.version)
+        self.current_service.load().as_ref().as_ref().map(|sv| sv.version)
    }

    /// Health check for the KMS service
    pub async fn health_check(&self) -> Result<bool> {
-        let checked_state = self.state.load_full();
-        match checked_state.current_service.as_ref() {
-            Some(service_version) => {
-                let manager = service_version.manager.clone();
-                let checked_version = service_version.version;
+        let manager = self.get_manager().await;
+        match manager {
+            Some(manager) => {
                // Perform health check on the backend
                match manager.health_check().await {
                    Ok(healthy) => {
@@ -464,8 +407,9 @@ impl KmsServiceManager {
                    }
                    Err(e) => {
                        error!("KMS health check error: {}", e);
-                        let _guard = self.lifecycle_mutex.lock().await;
-                        self.mark_health_error_if_current(checked_version, &e);
+                        // Update status to error
+                        let mut status = self.status.write().await;
+                        *status = KmsServiceStatus::Error(format!("Health check failed: {e}"));
                        Err(e)
                    }
                }
@@ -524,33 +468,6 @@ impl KmsServiceManager {
            manager: kms_manager,
        })
    }
-
-    async fn create_healthy_service_version(&self, config: &KmsConfig) -> Result<ServiceVersion> {
-        let service_version = self.create_service_version(config).await?;
-        if !service_version.manager.health_check().await? {
-            return Err(KmsError::backend_error("KMS backend health check failed"));
-        }
-        Ok(service_version)
-    }
-
-    fn publish_running(&self, config: KmsConfig, service_version: ServiceVersion) {
-        self.state.store(Arc::new(RuntimeState {
-            config: Some(config),
-            status: KmsServiceStatus::Running,
-            current_service: Some(service_version),
-        }));
-    }
-
-    fn mark_health_error_if_current(&self, checked_version: u64, error: &KmsError) {
-        let current = self.state.load_full();
-        if current.current_service.as_ref().map(|version| version.version) == Some(checked_version) {
-            self.state.store(Arc::new(RuntimeState {
-                config: current.config.clone(),
-                status: KmsServiceStatus::Error(format!("Health check failed: {error}")),
-                current_service: current.current_service.clone(),
-            }));
-        }
-    }
 }

 impl Default for KmsServiceManager {
@@ -583,11 +500,6 @@ pub async fn get_global_encryption_service() -> Option<Arc<ObjectEncryptionServi
 #[cfg(test)]
 mod tests {
    use super::*;
-    use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
-
-    fn static_config(key_id: &str, fill: u8) -> KmsConfig {
-        KmsConfig::static_kms(key_id.to_string(), BASE64_STANDARD.encode([fill; 32]))
-    }

    #[tokio::test]
    async fn configure_rejects_insecure_development_defaults_before_state_update() {
@@ -605,6 +517,8 @@ mod tests {

    #[tokio::test]
    async fn redacted_config_omits_static_key_material() {
+        use base64::Engine as _;
+
        let manager = KmsServiceManager::new();
        let encoded_key = base64::engine::general_purpose::STANDARD.encode([0x5au8; 32]);
        manager
@@ -619,136 +533,6 @@ mod tests {
        assert!(static_config.secret_key.is_empty());
    }

-    #[tokio::test]
-    async fn configure_persistence_failure_leaves_state_unchanged() {
-        let manager = KmsServiceManager::new();
-
-        let result = manager
-            .configure_with_persistence(static_config("key-a", 0x11), || async { Err(KmsError::backend_error("persist failed")) })
-            .await;
-
-        assert!(result.is_err());
-        assert_eq!(manager.get_status().await, KmsServiceStatus::NotConfigured);
-        assert!(manager.get_config().await.is_none());
-        assert!(manager.get_encryption_service().await.is_none());
-    }
-
-    #[tokio::test]
-    async fn configure_rejects_running_service_without_changing_snapshot() {
-        let manager = KmsServiceManager::new();
-        manager.configure(static_config("key-a", 0x11)).await.expect("configure");
-        manager.start().await.expect("start");
-        let version = manager.get_service_version().await;
-
-        let result = manager.configure(static_config("key-b", 0x22)).await;
-
-        assert!(result.is_err());
-        assert_eq!(manager.get_status().await, KmsServiceStatus::Running);
-        assert_eq!(manager.get_service_version().await, version);
-        assert_eq!(
-            manager.get_config().await.and_then(|config| config.default_key_id),
-            Some("key-a".to_string())
-        );
-    }
-
-    #[tokio::test]
-    async fn reconfigure_persistence_failure_keeps_old_running_snapshot() {
-        let manager = KmsServiceManager::new();
-        manager.configure(static_config("key-a", 0x11)).await.expect("configure");
-        manager.start().await.expect("start");
-        let old_version = manager.get_service_version().await;
-        let old_service = manager.get_encryption_service().await.expect("old service");
-
-        let result = manager
-            .reconfigure_with_persistence(static_config("key-b", 0x22), || async {
-                Err(KmsError::backend_error("persist failed"))
-            })
-            .await;
-
-        assert!(result.is_err());
-        assert_eq!(manager.get_status().await, KmsServiceStatus::Running);
-        assert_eq!(manager.get_service_version().await, old_version);
-        assert_eq!(
-            manager.get_config().await.and_then(|config| config.default_key_id),
-            Some("key-a".to_string())
-        );
-        assert!(Arc::ptr_eq(
-            &old_service,
-            &manager.get_encryption_service().await.expect("old service remains")
-        ));
-    }
-
-    #[tokio::test]
-    async fn reconfigure_candidate_failure_keeps_old_running_snapshot() {
-        let manager = KmsServiceManager::new();
-        manager.configure(static_config("key-a", 0x11)).await.expect("configure");
-        manager.start().await.expect("start");
-        let old_version = manager.get_service_version().await;
-        let invalid_parent = tempfile::NamedTempFile::new().expect("temporary file");
-        let invalid_config = KmsConfig::local(invalid_parent.path().join("keys")).with_insecure_development_defaults();
-
-        let result = manager.reconfigure(invalid_config).await;
-
-        assert!(result.is_err());
-        assert_eq!(manager.get_status().await, KmsServiceStatus::Running);
-        assert_eq!(manager.get_service_version().await, old_version);
-        assert_eq!(
-            manager.get_config().await.and_then(|config| config.default_key_id),
-            Some("key-a".to_string())
-        );
-    }
-
-    #[tokio::test]
-    async fn restart_never_unpublishes_the_running_service() {
-        let manager = Arc::new(KmsServiceManager::new());
-        manager.configure(static_config("key-a", 0x11)).await.expect("configure");
-        manager.start().await.expect("start");
-        let old_version = manager.get_service_version().await.expect("old version");
-        let restarting = {
-            let manager = manager.clone();
-            tokio::spawn(async move { manager.restart().await })
-        };
-
-        while !restarting.is_finished() {
-            assert!(manager.get_encryption_service().await.is_some());
-            tokio::task::yield_now().await;
-        }
-        restarting.await.expect("restart task").expect("restart");
-
-        assert!(manager.get_encryption_service().await.is_some());
-        assert!(manager.get_service_version().await.expect("new version") > old_version);
-        assert_eq!(manager.get_status().await, KmsServiceStatus::Running);
-    }
-
-    #[tokio::test]
-    async fn start_or_restart_decides_under_the_lifecycle_lock() {
-        let manager = KmsServiceManager::new();
-        manager.configure(static_config("key-a", 0x11)).await.expect("configure");
-
-        assert_eq!(manager.start_or_restart(false).await.expect("initial start"), KmsStartOutcome::Started);
-        let first_version = manager.get_service_version().await.expect("first version");
-        assert_eq!(
-            manager.start_or_restart(false).await.expect("already running"),
-            KmsStartOutcome::AlreadyRunning
-        );
-        assert_eq!(manager.get_service_version().await, Some(first_version));
-        assert_eq!(manager.start_or_restart(true).await.expect("forced restart"), KmsStartOutcome::Restarted);
-        assert!(manager.get_service_version().await.expect("restarted version") > first_version);
-    }
-
-    #[tokio::test]
-    async fn stale_health_failure_cannot_poison_new_service_status() {
-        let manager = KmsServiceManager::new();
-        manager.configure(static_config("key-a", 0x11)).await.expect("configure");
-        manager.start().await.expect("start");
-        let old_version = manager.get_service_version().await.expect("old version");
-        manager.restart().await.expect("restart");
-
-        manager.mark_health_error_if_current(old_version, &KmsError::backend_error("stale failure"));
-
-        assert_eq!(manager.get_status().await, KmsServiceStatus::Running);
-    }
-
    #[tokio::test]
    async fn forbidden_local_master_key_change_preserves_running_config_and_service() {
        use crate::types::{CreateKeyRequest, KeyUsage};
@@ -137,7 +137,7 @@ tests read):
 ./capture_via_docker.sh

 RUSTFS_MINIO_STATIC_KMS_KEY_B64=IyqsU3kMFloCNup4BsZtf/rmfHVcTgznO2F25CkEH1g= \
-  cargo test -p rustfs --features rio-v2 storage::minio_generated_read_test --lib -- --ignored
+  cargo test -p rustfs-ecstore --features rio-v2 --test minio_generated_read_test -- --ignored
 ```

 This is exactly what the nightly `minio-interop` GitHub Actions workflow runs
@@ -25,11 +25,6 @@ const RUSTFS_PREFIX: &str = "x-rustfs-";
 const MINIO_PREFIX: &str = "x-minio-";
 const MINIO_ENCRYPTION_PREFIX: &str = "x-minio-encryption-";
 const RUSTFS_ENCRYPTION_PREFIX: &str = "x-rustfs-encryption-";
-const MINIO_INTERNAL_ENCRYPTION_PREFIX: &str = "x-minio-internal-server-side-encryption-";
-const MINIO_INTERNAL_ENCRYPTED_MULTIPART: &str = "x-minio-internal-encrypted-multipart";
-const RUSTFS_ENCRYPTION_ORIGINAL_SIZE: &str = "x-rustfs-encryption-original-size";
-const MINIO_ENCRYPTION_ORIGINAL_SIZE: &str = "x-minio-encryption-original-size";
-const SSEC_ORIGINAL_SIZE: &str = "x-amz-server-side-encryption-customer-original-size";

 // Suffix constants (part after x-rustfs- or x-minio-). Use with get_header/insert_header.
 pub const SUFFIX_FORCE_DELETE: &str = "force-delete";
@@ -45,49 +40,11 @@ pub const SUFFIX_SOURCE_REPLICATION_REQUEST: &str = "source-replication-request"
 pub const SUFFIX_SOURCE_REPLICATION_CHECK: &str = "source-replication-check";
 pub const SUFFIX_REPLICATION_SSEC_CRC: &str = "replication-ssec-crc";

-/// Returns true if the key is object-encryption metadata understood by RustFS or MinIO.
-/// Case-insensitive for metadata filtering.
+/// Returns true if the key is an internal encryption metadata key (x-rustfs-encryption-* or
+/// x-minio-encryption-*). Case-insensitive for metadata filtering.
 pub fn is_encryption_metadata_key(key: &str) -> bool {
    let lower = key.to_lowercase();
-    lower.starts_with(RUSTFS_ENCRYPTION_PREFIX)
-        || lower.starts_with(MINIO_ENCRYPTION_PREFIX)
-        || lower.starts_with(MINIO_INTERNAL_ENCRYPTION_PREFIX)
-        || lower == MINIO_INTERNAL_ENCRYPTED_MULTIPART
-}
-
-/// Returns true when a metadata key proves that object data is encrypted.
-///
-/// Original-size metadata alone is not proof: older plaintext objects can
-/// retain that compatibility field after metadata migration.
-pub fn is_object_encryption_marker(key: &str) -> bool {
-    (is_encryption_metadata_key(key)
-        && !key.eq_ignore_ascii_case(RUSTFS_ENCRYPTION_ORIGINAL_SIZE)
-        && !key.eq_ignore_ascii_case(MINIO_ENCRYPTION_ORIGINAL_SIZE))
-        || super::is_sse_header(key)
-}
-
-/// Reads the logical object size recorded by encryption metadata.
-pub fn get_object_encryption_original_size(metadata: &std::collections::HashMap<String, String>) -> std::io::Result<Option<i64>> {
-    let actual_size = super::get_str(metadata, super::SUFFIX_ACTUAL_SIZE);
-    let size = get_case_insensitive(metadata, RUSTFS_ENCRYPTION_ORIGINAL_SIZE)
-        .or_else(|| get_case_insensitive(metadata, SSEC_ORIGINAL_SIZE))
-        .or(actual_size.as_deref());
-
-    let Some(size) = size.filter(|size| !size.is_empty()) else {
-        return Ok(None);
-    };
-    size.parse::<i64>()
-        .map(Some)
-        .map_err(|error| std::io::Error::other(format!("Failed to parse encryption original size: {error}")))
-}
-
-fn get_case_insensitive<'a>(metadata: &'a std::collections::HashMap<String, String>, key: &str) -> Option<&'a str> {
-    metadata.get(key).map(String::as_str).or_else(|| {
-        metadata
-            .iter()
-            .find(|(candidate, _)| candidate.eq_ignore_ascii_case(key))
-            .map(|(_, value)| value.as_str())
-    })
+    lower.starts_with(RUSTFS_ENCRYPTION_PREFIX) || lower.starts_with(MINIO_ENCRYPTION_PREFIX)
 }

 fn rustfs_key(suffix: &str) -> String {
@@ -149,37 +106,10 @@ mod tests {
        assert!(is_encryption_metadata_key("x-rustfs-encryption-iv"));
        assert!(is_encryption_metadata_key("X-Rustfs-Encryption-Key"));
        assert!(is_encryption_metadata_key("x-minio-encryption-iv"));
-        assert!(is_encryption_metadata_key("X-Minio-Internal-Server-Side-Encryption-Sealed-Key"));
-        assert!(is_encryption_metadata_key("X-Minio-Internal-Encrypted-Multipart"));
        assert!(!is_encryption_metadata_key("x-amz-meta-custom"));
        assert!(!is_encryption_metadata_key("x-rustfs-internal-healing"));
    }

-    #[test]
-    fn object_encryption_marker_excludes_size_only_metadata() {
-        assert!(!is_object_encryption_marker(RUSTFS_ENCRYPTION_ORIGINAL_SIZE));
-        assert!(is_object_encryption_marker("X-Minio-Internal-Server-Side-Encryption-Sealed-Key"));
-        assert!(is_object_encryption_marker("x-amz-server-side-encryption"));
-    }
-
-    #[test]
-    fn object_encryption_original_size_is_case_insensitive() {
-        let metadata = std::collections::HashMap::from([(
-            "X-Amz-Server-Side-Encryption-Customer-Original-Size".to_string(),
-            "42".to_string(),
-        )]);
-        assert_eq!(get_object_encryption_original_size(&metadata).expect("valid size"), Some(42));
-    }
-
-    #[test]
-    fn object_encryption_original_size_prefers_rustfs_metadata() {
-        let metadata = std::collections::HashMap::from([
-            (SSEC_ORIGINAL_SIZE.to_string(), "21".to_string()),
-            (RUSTFS_ENCRYPTION_ORIGINAL_SIZE.to_string(), "42".to_string()),
-        ]);
-        assert_eq!(get_object_encryption_original_size(&metadata).expect("valid size"), Some(42));
-    }
-
    #[test]
    fn test_get_header() {
        let mut headers = HeaderMap::new();
@@ -358,7 +358,7 @@ Fixture-backed tests should run when the fixture path is present:

 ```bash
 cargo test -p rustfs-ecstore --test legacy_bitrot_read_test -- --nocapture
-cargo test -p rustfs --features rio-v2 storage::minio_generated_read_test --lib -- --ignored --nocapture
+cargo test -p rustfs-ecstore --features rio-v2 --test minio_generated_read_test -- --ignored --nocapture
 ```

 ## Multi-Expert Adversarial Review Summary
@@ -59,7 +59,7 @@
        {
          default = rustPlatform.buildRustPackage {
            pname = "rustfs";
-            version = "1.0.0-beta.11";
+            version = "1.0.0-beta.12";

            src = ./.;

@@ -2,8 +2,8 @@ apiVersion: v2
 name: rustfs
 description: RustFS helm chart to deploy RustFS on kubernetes cluster.
 type: application
-version: "0.11.0"
-appVersion: "1.0.0-beta.11"
+version: "0.12.0"
+appVersion: "1.0.0-beta.12"
 home: https://rustfs.com
 icon: https://media.sys.truenas.net/apps/rustfs/icons/icon.svg
 maintainers:
@@ -1,9 +1,9 @@
 %global _enable_debug_packages 0
 %global _empty_manifest_terminate_build 0
-%global prerelease beta.11
+%global prerelease beta.12
 Name:           rustfs
 Version:        1.0.0
-Release:        beta.11
+Release:        beta.12
 Summary:       High-performance distributed object storage for MinIO alternative

 License:        Apache-2.0
@@ -58,6 +58,9 @@ install %_builddir/%{name}-%{version}-%{prerelease}/target/%_arch/%_arch-unknown
 %_bindir/rustfs

 %changelog
+* Thu Jul 30 2026 overtrue <anzhengchao@gmail.com>
+- Update RPM package to RustFS 1.0.0-beta.12
+
 * Thu Jul 23 2026 overtrue <anzhengchao@gmail.com>
 - Update RPM package to RustFS 1.0.0-beta.11

@@ -393,27 +393,36 @@ impl Operation for ConfigureKmsHandler {
        // Convert request to KmsConfig
        let kms_config = configure_request.to_kms_config();

-        let persisted_config = kms_config.clone();
-        let (success, message, status) = match service_manager
-            .configure_with_persistence(kms_config, || async move {
-                save_kms_config(&persisted_config)
-                    .await
-                    .map_err(|error| rustfs_kms::KmsError::backend_error(format!("Failed to persist KMS configuration: {error}")))
-            })
-            .await
-        {
+        // Configure the service
+        let (success, message, status) = match service_manager.configure(kms_config.clone()).await {
            Ok(()) => {
-                let status = service_manager.get_status().await;
-                info!(
-                    component = LOG_COMPONENT_ADMIN,
-                    subsystem = LOG_SUBSYSTEM_KMS,
-                    event = "kms_service_state",
-                    operation = "configure",
-                    state = "configured",
-                    status = ?status,
-                    "admin kms dynamic state"
-                );
-                (true, "KMS configured successfully".to_string(), status)
+                // Persist the configuration to cluster storage
+                if let Err(e) = save_kms_config(&kms_config).await {
+                    let error_msg = format!("KMS configured in memory but failed to persist: {e}");
+                    error!(
+                        component = LOG_COMPONENT_ADMIN,
+                        subsystem = LOG_SUBSYSTEM_KMS,
+                        event = "kms_service_state",
+                        operation = "configure",
+                        state = "persist_failed",
+                        error = %e,
+                        "admin kms dynamic state"
+                    );
+                    let status = service_manager.get_status().await;
+                    (false, error_msg, status)
+                } else {
+                    let status = service_manager.get_status().await;
+                    info!(
+                        component = LOG_COMPONENT_ADMIN,
+                        subsystem = LOG_SUBSYSTEM_KMS,
+                        event = "kms_service_state",
+                        operation = "configure",
+                        state = "configured",
+                        status = ?status,
+                        "admin kms dynamic state"
+                    );
+                    (true, "KMS configured successfully".to_string(), status)
+                }
            }
            Err(e) => {
                let error_msg = format!("Failed to configure KMS: {e}");
@@ -520,61 +529,125 @@ impl Operation for StartKmsHandler {
        );

        let service_manager = kms_service_manager_from_context();
-        let force = start_request.force.unwrap_or(false);
-        let (success, message, status) = match service_manager.start_or_restart(force).await {
-            Ok(rustfs_kms::KmsStartOutcome::Started) => {
-                let status = service_manager.get_status().await;
-                info!(
-                    component = LOG_COMPONENT_ADMIN,
-                    subsystem = LOG_SUBSYSTEM_KMS,
-                    event = "kms_service_state",
-                    operation = "start",
-                    state = "running",
-                    status = ?status,
-                    "admin kms dynamic state"
-                );
-                (true, "KMS service started successfully".to_string(), status)
-            }
-            Ok(rustfs_kms::KmsStartOutcome::Restarted) => {
-                let status = service_manager.get_status().await;
-                info!(
-                    component = LOG_COMPONENT_ADMIN,
-                    subsystem = LOG_SUBSYSTEM_KMS,
-                    event = "kms_service_state",
-                    operation = "restart",
-                    state = "running",
-                    status = ?status,
-                    "admin kms dynamic state"
-                );
-                (true, "KMS service restarted successfully".to_string(), status)
-            }
-            Ok(rustfs_kms::KmsStartOutcome::AlreadyRunning) => {
-                let status = service_manager.get_status().await;
-                warn!(
-                    component = LOG_COMPONENT_ADMIN,
-                    subsystem = LOG_SUBSYSTEM_KMS,
-                    event = "kms_service_state",
-                    operation = "start",
-                    state = "already_running",
-                    "admin kms dynamic state"
-                );
-                (false, "KMS service is already running. Use force=true to restart.".to_string(), status)
-            }
-            Err(e) => {
-                let error_msg = format!("Failed to start or restart KMS service: {e}");
-                error!(
-                    component = LOG_COMPONENT_ADMIN,
-                    subsystem = LOG_SUBSYSTEM_KMS,
-                    event = "kms_service_state",
-                    operation = "start",
-                    state = "start_failed",
-                    error = %e,
-                    "admin kms dynamic state"
-                );
-                let status = service_manager.get_status().await;
-                (false, error_msg, status)
-            }
-        };
+
+        // Check if already running and force flag
+        let current_status = service_manager.get_status().await;
+        if matches!(current_status, KmsServiceStatus::Running) && !start_request.force.unwrap_or(false) {
+            warn!(
+                component = LOG_COMPONENT_ADMIN,
+                subsystem = LOG_SUBSYSTEM_KMS,
+                event = "kms_service_state",
+                operation = "start",
+                state = "already_running",
+                "admin kms dynamic state"
+            );
+            let response = StartKmsResponse {
+                success: false,
+                message: "KMS service is already running. Use force=true to restart.".to_string(),
+                status: current_status,
+            };
+            let json_response = match serde_json::to_string(&response) {
+                Ok(json) => json,
+                Err(e) => {
+                    error!(
+                        component = LOG_COMPONENT_ADMIN,
+                        subsystem = LOG_SUBSYSTEM_KMS,
+                        event = EVENT_ADMIN_KMS_DYNAMIC_STATE,
+                        operation = "start",
+                        result = "response_serialize_failed",
+                        error = %e,
+                        "admin kms dynamic state"
+                    );
+                    return Ok(S3Response::new((
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        Body::from("Serialization error".to_string()),
+                    )));
+                }
+            };
+            return Ok(S3Response::new((StatusCode::OK, Body::from(json_response))));
+        }
+
+        // Start the service (or restart if force=true)
+        let (success, message, status) =
+            if start_request.force.unwrap_or(false) && matches!(current_status, KmsServiceStatus::Running) {
+                // Force restart
+                match service_manager.stop().await {
+                    Ok(()) => match service_manager.start().await {
+                        Ok(()) => {
+                            let status = service_manager.get_status().await;
+                            info!(
+                                component = LOG_COMPONENT_ADMIN,
+                                subsystem = LOG_SUBSYSTEM_KMS,
+                                event = "kms_service_state",
+                                operation = "restart",
+                                state = "running",
+                                status = ?status,
+                                "admin kms dynamic state"
+                            );
+                            (true, "KMS service restarted successfully".to_string(), status)
+                        }
+                        Err(e) => {
+                            let error_msg = format!("Failed to restart KMS service: {e}");
+                            error!(
+                                component = LOG_COMPONENT_ADMIN,
+                                subsystem = LOG_SUBSYSTEM_KMS,
+                                event = "kms_service_state",
+                                operation = "restart",
+                                state = "start_failed",
+                                error = %e,
+                                "admin kms dynamic state"
+                            );
+                            let status = service_manager.get_status().await;
+                            (false, error_msg, status)
+                        }
+                    },
+                    Err(e) => {
+                        let error_msg = format!("Failed to stop KMS service for restart: {e}");
+                        error!(
+                            component = LOG_COMPONENT_ADMIN,
+                            subsystem = LOG_SUBSYSTEM_KMS,
+                            event = "kms_service_state",
+                            operation = "restart",
+                            state = "stop_failed",
+                            error = %e,
+                            "admin kms dynamic state"
+                        );
+                        let status = service_manager.get_status().await;
+                        (false, error_msg, status)
+                    }
+                }
+            } else {
+                // Normal start
+                match service_manager.start().await {
+                    Ok(()) => {
+                        let status = service_manager.get_status().await;
+                        info!(
+                            component = LOG_COMPONENT_ADMIN,
+                            subsystem = LOG_SUBSYSTEM_KMS,
+                            event = "kms_service_state",
+                            operation = "start",
+                            state = "running",
+                            status = ?status,
+                            "admin kms dynamic state"
+                        );
+                        (true, "KMS service started successfully".to_string(), status)
+                    }
+                    Err(e) => {
+                        let error_msg = format!("Failed to start KMS service: {e}");
+                        error!(
+                            component = LOG_COMPONENT_ADMIN,
+                            subsystem = LOG_SUBSYSTEM_KMS,
+                            event = "kms_service_state",
+                            operation = "start",
+                            state = "start_failed",
+                            error = %e,
+                            "admin kms dynamic state"
+                        );
+                        let status = service_manager.get_status().await;
+                        (false, error_msg, status)
+                    }
+                }
+            };

        let response = StartKmsResponse {
            success,
@@ -731,7 +804,8 @@ impl Operation for GetKmsStatusHandler {

        let service_manager = kms_service_manager_from_context();

-        let (status, config) = service_manager.get_redacted_state().await;
+        let status = service_manager.get_status().await;
+        let config = service_manager.get_redacted_config().await;

        // Get backend type and health status
        let backend_type = config.as_ref().map(|c| c.backend.clone());
@@ -864,27 +938,36 @@ impl Operation for ReconfigureKmsHandler {
        // Convert request to KmsConfig
        let kms_config = configure_request.to_kms_config();

-        let persisted_config = kms_config.clone();
-        let (success, message, status) = match service_manager
-            .reconfigure_with_persistence(kms_config, || async move {
-                save_kms_config(&persisted_config)
-                    .await
-                    .map_err(|error| rustfs_kms::KmsError::backend_error(format!("Failed to persist KMS configuration: {error}")))
-            })
-            .await
-        {
+        // Reconfigure the service (stops, reconfigures, and starts)
+        let (success, message, status) = match service_manager.reconfigure(kms_config.clone()).await {
            Ok(()) => {
-                let status = service_manager.get_status().await;
-                info!(
-                    component = LOG_COMPONENT_ADMIN,
-                    subsystem = LOG_SUBSYSTEM_KMS,
-                    event = "kms_service_state",
-                    operation = "reconfigure",
-                    state = "reconfigured",
-                    status = ?status,
-                    "admin kms dynamic state"
-                );
-                (true, "KMS reconfigured and restarted successfully".to_string(), status)
+                // Persist the configuration to cluster storage
+                if let Err(e) = save_kms_config(&kms_config).await {
+                    let error_msg = format!("KMS reconfigured in memory but failed to persist: {e}");
+                    error!(
+                        component = LOG_COMPONENT_ADMIN,
+                        subsystem = LOG_SUBSYSTEM_KMS,
+                        event = "kms_service_state",
+                        operation = "reconfigure",
+                        state = "persist_failed",
+                        error = %e,
+                        "admin kms dynamic state"
+                    );
+                    let status = service_manager.get_status().await;
+                    (false, error_msg, status)
+                } else {
+                    let status = service_manager.get_status().await;
+                    info!(
+                        component = LOG_COMPONENT_ADMIN,
+                        subsystem = LOG_SUBSYSTEM_KMS,
+                        event = "kms_service_state",
+                        operation = "reconfigure",
+                        state = "reconfigured",
+                        status = ?status,
+                        "admin kms dynamic state"
+                    );
+                    (true, "KMS reconfigured and restarted successfully".to_string(), status)
+                }
            }
            Err(e) => {
                let error_msg = format!("Failed to reconfigure KMS: {e}");
@@ -148,7 +148,7 @@ impl Operation for ListCannedPolicies {
            return Err(s3_error!(InternalError, "iam is not initialized"));
        };

-        let policies = iam_store.list_polices(&query.bucket).await.map_err(|e| {
+        let policies = iam_store.list_policies(&query.bucket).await.map_err(|e| {
            warn!(
                component = LOG_COMPONENT_ADMIN,
                subsystem = LOG_SUBSYSTEM_POLICY,
@@ -724,7 +724,7 @@ impl Operation for ExportIam {
            match file {
                ALL_POLICIES_FILE => {
                    let policies: HashMap<String, rustfs_policy::policy::Policy> = iam_store
-                        .list_polices("")
+                        .list_policies("")
                        .await
                        .map_err(|e| S3Error::with_message(S3ErrorCode::InternalError, e.to_string()))?;
                    let json_str = serde_json::to_vec(&policies)
@@ -18,12 +18,13 @@ use super::handles::{
    IamHandle, KmsHandle, default_action_credential_interface, default_boot_time_interface, default_bucket_metadata_interface,
    default_bucket_monitor_interface, default_buffer_config_interface, default_deployment_id_interface,
    default_endpoints_interface, default_expiry_state_interface, default_federated_identity_interface,
-    default_internode_metrics_interface, default_local_node_name_interface, default_lock_client_interface,
-    default_lock_clients_interface, default_notification_system_interface, default_notify_interface,
-    default_outbound_tls_runtime_interface, default_performance_metrics_interface, default_region_interface,
-    default_replication_pool_interface, default_replication_stats_interface, default_runtime_port_interface,
-    default_s3select_db_interface, default_scanner_metrics_interface, default_server_config_interface,
-    default_storage_class_interface, default_tier_config_interface, default_transition_state_interface,
+    default_internode_metrics_interface, default_kms_runtime_interface, default_local_node_name_interface,
+    default_lock_client_interface, default_lock_clients_interface, default_notification_system_interface,
+    default_notify_interface, default_outbound_tls_runtime_interface, default_performance_metrics_interface,
+    default_region_interface, default_replication_pool_interface, default_replication_stats_interface,
+    default_runtime_port_interface, default_s3select_db_interface, default_scanner_metrics_interface,
+    default_server_config_interface, default_storage_class_interface, default_tier_config_interface,
+    default_transition_state_interface,
 };
 use super::interfaces::{
    ActionCredentialInterface, BootTimeInterface, BucketMetadataInterface, BucketMonitorInterface, BufferConfigInterface,
@@ -79,7 +80,6 @@ pub struct AppContext {
 impl AppContext {
    pub fn new(object_store: Arc<ECStore>, iam: Arc<dyn IamInterface>, kms: Arc<dyn KmsInterface>) -> Self {
        let object_data_cache = ObjectDataCacheAdapter::from_env_or_disabled();
-        let kms_runtime = Arc::new(crate::app::context::handles::KmsRuntimeHandle::new(kms.handle()));
        // Let ecstore probe this cache inside get_object_reader, after
        // metadata resolution but before the erasure data read (backlog#802).
        crate::app::object_data_cache::register_object_data_cache_body_hook(Arc::clone(&object_data_cache));
@@ -94,7 +94,7 @@ impl AppContext {
            iam,
            federated_identity: default_federated_identity_interface(),
            kms,
-            kms_runtime,
+            kms_runtime: default_kms_runtime_interface(),
            outbound_tls_runtime: default_outbound_tls_runtime_interface(),
            notify: default_notify_interface(),
            notification_system: default_notification_system_interface(),
@@ -128,19 +128,12 @@ impl KmsInterface for KmsHandle {
 }

 /// Default KMS runtime interface adapter.
-pub struct KmsRuntimeHandle {
-    kms: Option<Arc<KmsServiceManager>>,
-}
-
-impl KmsRuntimeHandle {
-    pub fn new(kms: Arc<KmsServiceManager>) -> Self {
-        Self { kms: Some(kms) }
-    }
-}
+#[derive(Default)]
+pub struct KmsRuntimeHandle;

 impl KmsRuntimeInterface for KmsRuntimeHandle {
    fn service_manager(&self) -> Option<Arc<KmsServiceManager>> {
-        self.kms.clone()
+        runtime_sources::kms_service_manager()
    }
 }

@@ -492,9 +485,7 @@ pub fn default_notification_system_interface() -> Arc<dyn NotificationSystemInte
 }

 pub fn default_kms_runtime_interface() -> Arc<dyn KmsRuntimeInterface> {
-    Arc::new(KmsRuntimeHandle {
-        kms: runtime_sources::kms_service_manager(),
-    })
+    Arc::new(KmsRuntimeHandle)
 }

 pub fn default_outbound_tls_runtime_interface() -> Arc<dyn OutboundTlsRuntimeInterface> {
@@ -616,10 +607,10 @@ pub fn default_buffer_config_interface() -> Arc<dyn BufferConfigInterface> {
 #[cfg(test)]
 mod tests {
    use super::{
-        KmsRuntimeHandle, KmsServiceManager, ServerConfigHandle, default_federated_identity_interface,
-        federated_identity_interface, publish_default_federated_identity_service, runtime_sources,
+        ServerConfigHandle, default_federated_identity_interface, federated_identity_interface,
+        publish_default_federated_identity_service, runtime_sources,
    };
-    use crate::app::context::interfaces::{KmsRuntimeInterface, ServerConfigInterface};
+    use crate::app::context::interfaces::ServerConfigInterface;
    use rustfs_config::server_config::Config;
    use rustfs_iam::{
        federation::{FederatedIdentityRegistry, FederatedIdentityService, oidc::StandardOidcAdapter},
@@ -742,19 +733,4 @@ mod tests {
            "handle B must serve its own credentials"
        );
    }
-
-    #[test]
-    fn kms_runtime_handles_keep_injected_managers_isolated() {
-        let manager_a = Arc::new(KmsServiceManager::new());
-        let manager_b = Arc::new(KmsServiceManager::new());
-        let handle_a = KmsRuntimeHandle::new(manager_a.clone());
-        let handle_b = KmsRuntimeHandle::new(manager_b.clone());
-
-        assert!(Arc::ptr_eq(&handle_a.service_manager().expect("manager A"), &manager_a));
-        assert!(Arc::ptr_eq(&handle_b.service_manager().expect("manager B"), &manager_b));
-        assert!(!Arc::ptr_eq(
-            &handle_a.service_manager().expect("manager A"),
-            &handle_b.service_manager().expect("manager B")
-        ));
-    }
 }
@@ -36,8 +36,6 @@ mod ecfs_extend;
 mod ecfs_test;
 pub(crate) mod head_prefix;
 #[cfg(test)]
-mod minio_generated_read_test;
-#[cfg(test)]
 mod multi_factor_scheduler_integration_test;
 pub(crate) mod runtime_sources;
 #[cfg(test)]
@@ -70,10 +70,6 @@
 //! ```

 use super::StorageError;
-use super::storage_api::ecstore_object::{
-    EncryptionResolutionError, EncryptionResolutionErrorKind, ObjectEncryptionResolver, ReadEncryptionMaterial,
-    ReadEncryptionMode, ReadEncryptionRequest,
-};
 use crate::storage::storage_api::runtime_sources_consumer::runtime_sources;
 #[cfg(feature = "rio-v2")]
 use aes_gcm::aead::Payload;
@@ -159,7 +155,6 @@ use rustfs_utils::http::headers::{
 };
 use rustfs_utils::path::path_join_buf;
 use s3s::dto::{SSECustomerAlgorithm, SSECustomerKey, SSECustomerKeyMD5, SSEKMSKeyId};
-use std::borrow::Cow;

 // ============================================================================
 // High-Level SSE Configuration
@@ -657,23 +652,6 @@ pub(crate) fn validate_sse_headers_for_read(metadata: &HashMap<String, String>,
 }

 pub(crate) fn map_get_object_reader_error(err: StorageError) -> ApiError {
-    if let StorageError::Io(io_error) = &err
-        && let Some(resolution_error) = io_error
-            .get_ref()
-            .and_then(|source| source.downcast_ref::<EncryptionResolutionError>())
-    {
-        let code = match resolution_error.kind() {
-            EncryptionResolutionErrorKind::InvalidRequest => S3ErrorCode::InvalidRequest,
-            EncryptionResolutionErrorKind::ServiceUnavailable => S3ErrorCode::ServiceUnavailable,
-            _ => S3ErrorCode::InternalError,
-        };
-        return ApiError {
-            code,
-            message: resolution_error.to_string(),
-            source: Some(Box::new(err)),
-        };
-    }
-
    if let Some(message) = map_ssec_get_object_reader_error_message(&err) {
        return ApiError {
            code: S3ErrorCode::InvalidRequest,
@@ -796,117 +774,6 @@ pub enum EncryptionKeyKind {
    Object,
 }

-pub(crate) struct SseObjectEncryptionResolver;
-
-#[async_trait]
-impl ObjectEncryptionResolver for SseObjectEncryptionResolver {
-    async fn resolve_read_material(
-        &self,
-        request: ReadEncryptionRequest<'_>,
-    ) -> Result<Option<ReadEncryptionMaterial>, EncryptionResolutionError> {
-        let metadata = normalize_encryption_metadata_case(request.metadata)?;
-        let (customer_algorithm, customer_key, customer_key_md5) =
-            extract_ssec_params_from_headers(request.headers).map_err(map_encryption_resolution_error)?;
-        if let Some(stored_algorithm) = metadata.get("x-amz-server-side-encryption-customer-algorithm") {
-            let request_algorithm = customer_algorithm.as_ref().ok_or_else(|| {
-                map_encryption_resolution_error(ssec_invalid_request(
-                    "The object was stored using a form of Server Side Encryption. \
-                     The correct parameters must be provided to retrieve the object.",
-                ))
-            })?;
-            if stored_algorithm != request_algorithm.as_str() {
-                return Err(map_encryption_resolution_error(ssec_invalid_request(
-                    "The provided encryption parameters did not match the ones used originally to encrypt the object.",
-                )));
-            }
-        }
-        let material = sse_decryption(DecryptionRequest {
-            bucket: request.bucket,
-            key: request.object,
-            metadata: &metadata,
-            sse_customer_key: customer_key.as_ref(),
-            sse_customer_key_md5: customer_key_md5.as_ref(),
-        })
-        .await
-        .map_err(map_encryption_resolution_error)?;
-
-        Ok(material.map(|material| ReadEncryptionMaterial {
-            key_bytes: material.key_bytes,
-            mode: match material.key_kind {
-                EncryptionKeyKind::Direct => ReadEncryptionMode::Direct {
-                    base_nonce: material.base_nonce,
-                },
-                EncryptionKeyKind::Object => ReadEncryptionMode::Object,
-            },
-        }))
-    }
-}
-
-fn normalize_encryption_metadata_case(
-    metadata: &HashMap<String, String>,
-) -> Result<Cow<'_, HashMap<String, String>>, EncryptionResolutionError> {
-    const CANONICAL_KEYS: &[&str] = &[
-        "x-amz-server-side-encryption",
-        "x-amz-server-side-encryption-aws-kms-key-id",
-        "x-amz-server-side-encryption-customer-algorithm",
-        "x-amz-server-side-encryption-customer-key-md5",
-        SSEC_ORIGINAL_SIZE_HEADER,
-        INTERNAL_ENCRYPTION_KEY_ID_HEADER,
-        INTERNAL_ENCRYPTION_KEY_HEADER,
-        INTERNAL_ENCRYPTION_ALGORITHM_HEADER,
-        INTERNAL_ENCRYPTION_IV_HEADER,
-        "x-rustfs-encryption-context",
-        "x-rustfs-encryption-tag",
-        INTERNAL_ENCRYPTION_ORIGINAL_SIZE_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_MULTIPART_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_IV_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_ALGORITHM_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_SSEC_SEALED_KEY_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_S3_SEALED_KEY_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_KMS_SEALED_KEY_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_KMS_KEY_ID_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_KMS_CONTEXT_HEADER,
-    ];
-
-    let needs_normalization = metadata.keys().any(|key| {
-        CANONICAL_KEYS
-            .iter()
-            .any(|canonical| key != canonical && key.eq_ignore_ascii_case(canonical))
-    });
-    if !needs_normalization {
-        return Ok(Cow::Borrowed(metadata));
-    }
-
-    let mut normalized = metadata.clone();
-    for canonical in CANONICAL_KEYS {
-        let mut matching_values = metadata
-            .iter()
-            .filter_map(|(key, value)| key.eq_ignore_ascii_case(canonical).then_some(value));
-        let Some(value) = matching_values.next() else {
-            continue;
-        };
-        if matching_values.any(|candidate| candidate != value) {
-            return Err(EncryptionResolutionError::new(
-                EncryptionResolutionErrorKind::InvalidMetadata,
-                format!("conflicting object encryption metadata for {canonical}"),
-            ));
-        }
-        if !normalized.contains_key(*canonical) {
-            normalized.insert((*canonical).to_string(), value.clone());
-        }
-    }
-    Ok(Cow::Owned(normalized))
-}
-
-fn map_encryption_resolution_error(error: ApiError) -> EncryptionResolutionError {
-    let kind = match error.code {
-        S3ErrorCode::InvalidArgument | S3ErrorCode::InvalidRequest => EncryptionResolutionErrorKind::InvalidRequest,
-        S3ErrorCode::ServiceUnavailable => EncryptionResolutionErrorKind::ServiceUnavailable,
-        _ => EncryptionResolutionErrorKind::DecryptionFailed,
-    };
-    EncryptionResolutionError::new(kind, error.message)
-}
-
 #[derive(Debug, Clone)]
 pub struct ManagedSealedKey {
    #[cfg(feature = "rio-v2")]
@@ -2775,20 +2642,19 @@ fn ssec_invalid_request(message: &str) -> ApiError {
 mod tests {
    use super::{
        ApiError, DataKey, DecryptionRequest, EncryptionKeyKind, EncryptionMaterial, EncryptionRequest,
-        EncryptionResolutionErrorKind, INTERNAL_ENCRYPTION_ALGORITHM_HEADER, INTERNAL_ENCRYPTION_IV_HEADER,
-        INTERNAL_ENCRYPTION_KEY_HEADER, INTERNAL_ENCRYPTION_KEY_ID_HEADER, KmsSseDekProvider, KmsUnavailableError,
-        MINIO_INTERNAL_ENCRYPTION_ALGORITHM_HEADER, MINIO_INTERNAL_ENCRYPTION_IV_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_KMS_CONTEXT_HEADER, MINIO_INTERNAL_ENCRYPTION_KMS_KEY_ID_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_KMS_SEALED_KEY_HEADER, MINIO_INTERNAL_ENCRYPTION_MULTIPART_HEADER,
-        MINIO_INTERNAL_ENCRYPTION_S3_SEALED_KEY_HEADER, MINIO_INTERNAL_ENCRYPTION_SSEC_SEALED_KEY_HEADER,
-        ObjectEncryptionResolver, PrepareEncryptionRequest, ReadEncryptionMode, ReadEncryptionRequest, SSEC_ORIGINAL_SIZE_HEADER,
-        SSEType, SseDekProvider, SseObjectEncryptionResolver, SsecParams, StorageError, TestSseDekProvider,
-        apply_managed_decryption_material, apply_managed_encryption_material, encryption_material_to_metadata,
-        extract_server_side_encryption_from_headers, extract_ssec_params_from_headers, extract_ssekms_context_from_headers,
-        generate_ssec_nonce, is_managed_sse, kms_operation_error, map_get_object_reader_error, mark_encrypted_multipart_metadata,
-        md5_base64, normalize_managed_metadata, reset_sse_dek_provider, resolve_effective_kms_key_id, sse_decryption,
-        sse_encryption, sse_prepare_encryption, strip_managed_encryption_metadata, validate_sse_headers_for_read,
-        validate_sse_headers_for_write, validate_ssec_for_read, validate_ssec_params, verify_ssec_key_match,
+        INTERNAL_ENCRYPTION_ALGORITHM_HEADER, INTERNAL_ENCRYPTION_IV_HEADER, INTERNAL_ENCRYPTION_KEY_HEADER,
+        INTERNAL_ENCRYPTION_KEY_ID_HEADER, KmsSseDekProvider, KmsUnavailableError, MINIO_INTERNAL_ENCRYPTION_ALGORITHM_HEADER,
+        MINIO_INTERNAL_ENCRYPTION_IV_HEADER, MINIO_INTERNAL_ENCRYPTION_KMS_CONTEXT_HEADER,
+        MINIO_INTERNAL_ENCRYPTION_KMS_KEY_ID_HEADER, MINIO_INTERNAL_ENCRYPTION_KMS_SEALED_KEY_HEADER,
+        MINIO_INTERNAL_ENCRYPTION_MULTIPART_HEADER, MINIO_INTERNAL_ENCRYPTION_S3_SEALED_KEY_HEADER,
+        MINIO_INTERNAL_ENCRYPTION_SSEC_SEALED_KEY_HEADER, PrepareEncryptionRequest, SSEC_ORIGINAL_SIZE_HEADER, SSEType,
+        SseDekProvider, SsecParams, StorageError, TestSseDekProvider, apply_managed_decryption_material,
+        apply_managed_encryption_material, encryption_material_to_metadata, extract_server_side_encryption_from_headers,
+        extract_ssec_params_from_headers, extract_ssekms_context_from_headers, generate_ssec_nonce, is_managed_sse,
+        kms_operation_error, map_get_object_reader_error, mark_encrypted_multipart_metadata, md5_base64,
+        normalize_managed_metadata, reset_sse_dek_provider, resolve_effective_kms_key_id, sse_decryption, sse_encryption,
+        sse_prepare_encryption, strip_managed_encryption_metadata, validate_sse_headers_for_read, validate_sse_headers_for_write,
+        validate_ssec_for_read, validate_ssec_params, verify_ssec_key_match,
    };
    #[cfg(feature = "rio-v2")]
    use super::{
@@ -2843,154 +2709,11 @@ mod tests {
    use tokio::sync::Mutex;

    static SSE_TEST_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
-    static SSE_TEST_KMS_KEY_DIR: OnceLock<tempfile::TempDir> = OnceLock::new();

    async fn lock_sse_test_state() -> tokio::sync::MutexGuard<'static, ()> {
        SSE_TEST_LOCK.get_or_init(|| Mutex::new(())).lock().await
    }

-    async fn configure_test_global_local_kms() -> Arc<rustfs_kms::KmsServiceManager> {
-        let key_dir = SSE_TEST_KMS_KEY_DIR.get_or_init(|| tempfile::TempDir::new().expect("create KMS key directory"));
-        let manager = rustfs_kms::init_global_kms_service_manager();
-        manager
-            .reconfigure(rustfs_kms::KmsConfig::local(key_dir.path().to_path_buf()).with_insecure_development_defaults())
-            .await
-            .expect("configure test KMS service");
-        manager
-    }
-
-    #[tokio::test]
-    async fn object_encryption_resolver_returns_ssec_read_material() {
-        let key = [0x31; 32];
-        let key_b64 = BASE64_STANDARD.encode(key);
-        let key_md5 = md5_base64(key);
-        let nonce = [0x42; 12];
-        let metadata = HashMap::from([
-            ("X-Amz-Server-Side-Encryption-Customer-Algorithm".to_string(), "AES256".to_string()),
-            ("X-Amz-Server-Side-Encryption-Customer-Key-Md5".to_string(), key_md5.clone()),
-            ("X-Rustfs-Encryption-Iv".to_string(), BASE64_STANDARD.encode(nonce)),
-        ]);
-        let mut headers = HeaderMap::new();
-        headers.insert("x-amz-server-side-encryption-customer-algorithm", HeaderValue::from_static("AES256"));
-        headers.insert(
-            "x-amz-server-side-encryption-customer-key",
-            HeaderValue::from_str(&key_b64).expect("base64 key is a valid header"),
-        );
-        headers.insert(
-            "x-amz-server-side-encryption-customer-key-md5",
-            HeaderValue::from_str(&key_md5).expect("base64 MD5 is a valid header"),
-        );
-
-        let material = SseObjectEncryptionResolver
-            .resolve_read_material(ReadEncryptionRequest {
-                bucket: "bucket",
-                object: "object",
-                metadata: &metadata,
-                headers: &headers,
-            })
-            .await
-            .expect("SSE-C material should resolve")
-            .expect("SSE-C metadata should produce material");
-
-        assert_eq!(material.key_bytes, key);
-        assert_eq!(material.mode, ReadEncryptionMode::Direct { base_nonce: nonce });
-    }
-
-    #[tokio::test]
-    async fn object_encryption_resolver_rejects_missing_or_invalid_ssec_algorithm() {
-        let key = [0x31; 32];
-        let key_b64 = BASE64_STANDARD.encode(key);
-        let key_md5 = md5_base64(key);
-        let metadata = HashMap::from([
-            ("x-amz-server-side-encryption-customer-algorithm".to_string(), "AES256".to_string()),
-            ("x-amz-server-side-encryption-customer-key-md5".to_string(), key_md5.clone()),
-        ]);
-
-        for algorithm in [None, Some("AES128")] {
-            let mut headers = HeaderMap::new();
-            if let Some(algorithm) = algorithm {
-                headers.insert("x-amz-server-side-encryption-customer-algorithm", HeaderValue::from_static(algorithm));
-            }
-            headers.insert(
-                "x-amz-server-side-encryption-customer-key",
-                HeaderValue::from_str(&key_b64).expect("base64 key is a valid header"),
-            );
-            headers.insert(
-                "x-amz-server-side-encryption-customer-key-md5",
-                HeaderValue::from_str(&key_md5).expect("base64 MD5 is a valid header"),
-            );
-
-            let result = SseObjectEncryptionResolver
-                .resolve_read_material(ReadEncryptionRequest {
-                    bucket: "bucket",
-                    object: "object",
-                    metadata: &metadata,
-                    headers: &headers,
-                })
-                .await;
-            let error = match result {
-                Err(error) => error,
-                Ok(_) => panic!("missing or invalid SSE-C algorithm must fail closed"),
-            };
-
-            assert_eq!(error.kind(), EncryptionResolutionErrorKind::InvalidRequest);
-        }
-    }
-
-    #[tokio::test]
-    async fn object_encryption_resolver_classifies_missing_ssec_key_as_invalid_request() {
-        let metadata = HashMap::from([("x-amz-server-side-encryption-customer-algorithm".to_string(), "AES256".to_string())]);
-        let result = SseObjectEncryptionResolver
-            .resolve_read_material(ReadEncryptionRequest {
-                bucket: "bucket",
-                object: "object",
-                metadata: &metadata,
-                headers: &HeaderMap::new(),
-            })
-            .await;
-        let error = match result {
-            Err(error) => error,
-            Ok(_) => panic!("missing SSE-C key must fail closed"),
-        };
-
-        assert_eq!(error.kind(), EncryptionResolutionErrorKind::InvalidRequest);
-    }
-
-    #[tokio::test]
-    async fn object_encryption_resolver_rejects_conflicting_metadata_case_variants() {
-        let metadata = HashMap::from([
-            ("x-rustfs-encryption-key".to_string(), "first".to_string()),
-            ("X-Rustfs-Encryption-Key".to_string(), "second".to_string()),
-        ]);
-        let result = SseObjectEncryptionResolver
-            .resolve_read_material(ReadEncryptionRequest {
-                bucket: "bucket",
-                object: "object",
-                metadata: &metadata,
-                headers: &HeaderMap::new(),
-            })
-            .await;
-        let error = match result {
-            Err(error) => error,
-            Ok(_) => panic!("conflicting metadata aliases must fail closed"),
-        };
-
-        assert_eq!(error.kind(), EncryptionResolutionErrorKind::InvalidMetadata);
-    }
-
-    #[test]
-    fn normalize_encryption_metadata_case_accepts_lowercase_minio_internal_keys() {
-        let lowercase_key = MINIO_INTERNAL_ENCRYPTION_S3_SEALED_KEY_HEADER.to_ascii_lowercase();
-        let metadata = HashMap::from([(lowercase_key, "sealed-key".to_string())]);
-
-        let normalized = super::normalize_encryption_metadata_case(&metadata).expect("metadata aliases should normalize");
-
-        assert_eq!(
-            normalized.get(MINIO_INTERNAL_ENCRYPTION_S3_SEALED_KEY_HEADER),
-            Some(&"sealed-key".to_string())
-        );
-    }
-
    struct UnavailableSseDekProvider;

    #[async_trait::async_trait]
@@ -3710,11 +3433,18 @@ mod tests {
    #[cfg(feature = "rio-v2")]
    #[tokio::test]
    async fn test_sse_kms_roundtrip_persists_and_uses_minio_context() {
+        use rustfs_kms::config::KmsConfig;
        use rustfs_kms::types::{CreateKeyRequest, KeyUsage};
+        use tempfile::TempDir;
        let _guard = lock_sse_test_state().await;

        reset_sse_dek_provider();
-        let manager = configure_test_global_local_kms().await;
+        let manager = rustfs_kms::init_global_kms_service_manager();
+        let temp_dir = TempDir::new().expect("temp dir");
+        manager
+            .reconfigure(KmsConfig::local(temp_dir.path().to_path_buf()).with_insecure_development_defaults())
+            .await
+            .expect("kms reconfigure should succeed");
        manager
            .get_encryption_service()
            .await
@@ -4006,19 +3736,6 @@ mod tests {

                assert_eq!(decrypted.key_kind, EncryptionKeyKind::Object);
                assert_eq!(decrypted.key_bytes, material.key_bytes);
-
-                let resolved = SseObjectEncryptionResolver
-                    .resolve_read_material(ReadEncryptionRequest {
-                        bucket: "bucket",
-                        object: "object",
-                        metadata: &metadata,
-                        headers: &HeaderMap::new(),
-                    })
-                    .await
-                    .expect("managed resolver")
-                    .expect("managed material");
-                assert_eq!(resolved.mode, ReadEncryptionMode::Object);
-                assert_eq!(resolved.key_bytes, material.key_bytes);
            },
        )
        .await;
@@ -4079,29 +3796,6 @@ mod tests {

        assert_eq!(decrypted.key_kind, EncryptionKeyKind::Object);
        assert_eq!(decrypted.key_bytes, material.key_bytes);
-
-        let mut headers = HeaderMap::new();
-        headers.insert("x-amz-server-side-encryption-customer-algorithm", HeaderValue::from_static("AES256"));
-        headers.insert(
-            "x-amz-server-side-encryption-customer-key",
-            HeaderValue::from_str(&customer_key).expect("customer key header"),
-        );
-        headers.insert(
-            "x-amz-server-side-encryption-customer-key-md5",
-            HeaderValue::from_str(&customer_key_md5).expect("customer key MD5 header"),
-        );
-        let resolved = SseObjectEncryptionResolver
-            .resolve_read_material(ReadEncryptionRequest {
-                bucket: "bucket",
-                object: "object",
-                metadata: &metadata,
-                headers: &headers,
-            })
-            .await
-            .expect("SSE-C resolver")
-            .expect("SSE-C material");
-        assert_eq!(resolved.mode, ReadEncryptionMode::Object);
-        assert_eq!(resolved.key_bytes, material.key_bytes);
    }

    #[cfg(feature = "rio-v2")]
@@ -4576,9 +4270,17 @@ mod tests {

    #[tokio::test]
    async fn test_managed_decryption_selects_provider_from_persisted_dek() {
+        use rustfs_kms::config::KmsConfig;
+        use tempfile::TempDir;
+
        let _guard = lock_sse_test_state().await;
        reset_sse_dek_provider();
-        let manager = configure_test_global_local_kms().await;
+        let manager = rustfs_kms::init_global_kms_service_manager();
+        let key_dir = TempDir::new().expect("create KMS key directory");
+        manager
+            .reconfigure(KmsConfig::local(key_dir.path().to_path_buf()).with_insecure_development_defaults())
+            .await
+            .expect("start test KMS service");

        let local_master_key = [7u8; 32];
        let local_provider = TestSseDekProvider::new_with_key(local_master_key);
@@ -4646,6 +4348,9 @@ mod tests {
    /// the local-provider cache.
    #[tokio::test]
    async fn test_kms_envelope_never_routes_to_cached_local_provider() {
+        use rustfs_kms::config::KmsConfig;
+        use tempfile::TempDir;
+
        let _guard = lock_sse_test_state().await;
        reset_sse_dek_provider();

@@ -4657,7 +4362,12 @@ mod tests {
            .expect("write local provider into local cache") = Some(Arc::new(TestSseDekProvider::new_with_key(local_master_key)));

        // 2. Start a KMS service (dynamic enable).
-        let manager = configure_test_global_local_kms().await;
+        let manager = rustfs_kms::init_global_kms_service_manager();
+        let key_dir = TempDir::new().expect("create KMS key directory");
+        manager
+            .reconfigure(KmsConfig::local(key_dir.path().to_path_buf()).with_insecure_development_defaults())
+            .await
+            .expect("start test KMS service");

        // 3. Construct a KMS JSON envelope — the persisted format of a KMS-wrapped DEK.
        //    is_data_key_envelope() will return true for this payload.
@@ -4748,7 +4458,7 @@ mod tests {
        use rustfs_kms::config::KmsConfig;
        let _guard = lock_sse_test_state().await;

-        let manager = Arc::new(rustfs_kms::KmsServiceManager::new());
+        let manager = rustfs_kms::init_global_kms_service_manager();

        manager
            .reconfigure(KmsConfig::static_kms("first-key".to_string(), BASE64_STANDARD.encode([0x11; 32])))
@@ -4982,15 +4692,6 @@ mod tests {
        );
    }

-    #[test]
-    fn test_map_get_object_reader_error_preserves_typed_service_unavailable() {
-        let resolution_error =
-            super::EncryptionResolutionError::new(EncryptionResolutionErrorKind::ServiceUnavailable, "KMS unavailable");
-        let err = map_get_object_reader_error(StorageError::other(resolution_error));
-        assert_eq!(err.code, S3ErrorCode::ServiceUnavailable);
-        assert_eq!(err.message, "KMS unavailable");
-    }
-
    #[test]
    fn test_map_get_object_reader_error_leaves_non_ssec_errors_unchanged() {
        let err = map_get_object_reader_error(StorageError::other("plain io failure"));
@@ -509,21 +509,12 @@ pub(crate) mod ecstore_object {
    #[cfg(test)]
    pub(crate) use rustfs_ecstore::api::object::GetObjectBodySource;
    pub(crate) use rustfs_ecstore::api::object::{
-        EncryptionResolutionError, EncryptionResolutionErrorKind, GetObjectBodyCacheHook, GetObjectBodyCacheHookLookup,
-        ObjectEncryptionResolver, ObjectMutationHook, ReadEncryptionMaterial, ReadEncryptionMode, ReadEncryptionRequest,
-        get_object_body_cache_plaintext_len, lookup_get_object_body_cache_hook, register_get_object_body_cache_hook,
-        register_object_mutation_hook, unregister_get_object_body_cache_hook, unregister_object_mutation_hook,
+        GetObjectBodyCacheHook, GetObjectBodyCacheHookLookup, ObjectMutationHook, get_object_body_cache_plaintext_len,
+        lookup_get_object_body_cache_hook, register_get_object_body_cache_hook, register_object_mutation_hook,
+        unregister_get_object_body_cache_hook, unregister_object_mutation_hook,
    };
 }

-#[cfg(all(test, feature = "rio-v2"))]
-pub(crate) mod ecstore_test_support {
-    pub(crate) use rustfs_ecstore::api::bitrot::create_bitrot_reader;
-    pub(crate) use rustfs_ecstore::api::disk::{DiskAPI, DiskOption, endpoint::Endpoint, new_disk};
-    pub(crate) use rustfs_ecstore::api::erasure::Erasure;
-    pub(crate) use rustfs_ecstore::api::object::{GetObjectReader, ObjectInfo, ObjectOptions};
-}
-
 pub(crate) mod ecstore_set_disk {
    pub(crate) use rustfs_ecstore::api::set_disk::{DEFAULT_READ_BUFFER_SIZE, get_lock_acquire_timeout, is_valid_storage_class};
 }
@@ -954,21 +945,13 @@ pub(crate) async fn init_local_disks(endpoint_pools: EndpointServerPools) -> Res
 /// The process-level bootstrap instance context that single-instance startup
 /// threads through the storage foundation (Phase 5 follow-up, backlog#1052).
 pub(crate) fn bootstrap_instance_ctx() -> Arc<InstanceContext> {
-    let context = ecstore_runtime::bootstrap_ctx();
-    configure_object_encryption_resolver(&context);
-    context
+    ecstore_runtime::bootstrap_ctx()
 }

 /// Construct a fresh per-server instance context (backlog#1052 S5): a second
 /// embedded server owns its own erasure/region/endpoint/deployment id cells.
 pub(crate) fn new_instance_ctx() -> Arc<InstanceContext> {
-    let context = Arc::new(InstanceContext::new());
-    configure_object_encryption_resolver(&context);
-    context
-}
-
-fn configure_object_encryption_resolver(context: &InstanceContext) {
-    let _ = context.set_object_encryption_resolver(Arc::new(super::sse::SseObjectEncryptionResolver));
+    Arc::new(InstanceContext::new())
 }

 pub(crate) fn init_lock_clients(endpoint_pools: EndpointServerPools) {
@@ -1763,7 +1746,7 @@ pub(crate) async fn init_compression_total_memory_from_backend(store: Arc<ECStor
 mod tests {
    use super::{
        apply_active_resync_intents, bucket_targets_metadata_lock_shard, ecstore_bucket, lock_bucket_targets_metadata,
-        new_instance_ctx, scanner_maintenance_config_file,
+        scanner_maintenance_config_file,
    };
    use std::time::Duration;

@@ -1794,16 +1777,6 @@ mod tests {
        );
    }

-    #[test]
-    fn fresh_instance_context_installs_object_encryption_resolver() {
-        assert!(new_instance_ctx().object_encryption_resolver().is_some());
-    }
-
-    #[test]
-    fn bootstrap_instance_context_installs_object_encryption_resolver() {
-        assert!(super::bootstrap_instance_ctx().object_encryption_resolver().is_some());
-    }
-
    #[test]
    fn scanner_maintenance_config_only_includes_scanner_owned_work() {
        assert!(scanner_maintenance_config_file(ecstore_bucket::metadata::BUCKET_LIFECYCLE_CONFIG));
@@ -13,7 +13,14 @@ fi
 classify_source_layer() {
  local file="$1"

-  if [[ "$file" == rustfs/src/app/* ]]; then
+  if [[ "$file" == rustfs/src/server/* ]] ||
+    [[ "$file" == rustfs/src/startup_*.rs ]] ||
+    [[ "$file" == rustfs/src/init.rs ]] ||
+    [[ "$file" == rustfs/src/main.rs ]] ||
+    [[ "$file" == rustfs/src/lib.rs ]] ||
+    [[ "$file" == rustfs/src/embedded.rs ]]; then
+    printf 'composition'
+  elif [[ "$file" == rustfs/src/app/* ]]; then
    printf 'app'
  elif [[ "$file" == rustfs/src/admin/* ]] || [[ "$file" == rustfs/src/storage/ecfs.rs ]] || [[ "$file" == rustfs/src/storage/s3_api/* ]]; then
    printf 'interface'
@@ -30,6 +37,14 @@ classify_target_layer() {
  local storage_path

  case "$root" in
+    init | main | lib | embedded | startup_*)
+      printf 'composition'
+      ;;
+    server)
+      # Server files are composition roots when they import lower layers, but
+      # their exported HTTP contracts belong to the interface boundary.
+      printf 'interface'
+      ;;
    app)
      printf 'app'
      ;;
@@ -53,6 +68,9 @@ classify_target_layer() {

 layer_rank() {
  case "$1" in
+    composition)
+      printf '4'
+      ;;
    interface)
      printf '3'
      ;;
@@ -68,6 +86,50 @@ layer_rank() {
  esac
 }

+is_reverse_dependency() {
+  local source_rank target_rank
+
+  source_rank="$(layer_rank "$1")"
+  target_rank="$(layer_rank "$2")"
+  (( source_rank < target_rank ))
+}
+
+assert_dependency_direction() {
+  local expected="$1"
+  local source="$2"
+  local target="$3"
+  local actual='allowed'
+
+  if is_reverse_dependency "$source" "$target"; then
+    actual='reverse'
+  fi
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Layer dependency guard self-test failed: %s -> %s (expected %s, got %s)\n' \
+      "$source" "$target" "$expected" "$actual" >&2
+    exit 1
+  fi
+}
+
+run_layer_model_self_tests() {
+  local server_source app_source storage_source server_target admin_target app_target storage_target
+
+  server_source="$(classify_source_layer rustfs/src/server/http.rs)"
+  app_source="$(classify_source_layer rustfs/src/app/bucket_usecase.rs)"
+  storage_source="$(classify_source_layer rustfs/src/storage/rpc/node_service.rs)"
+  server_target="$(classify_target_layer server::http)"
+  admin_target="$(classify_target_layer admin::router)"
+  app_target="$(classify_target_layer app::bucket_usecase)"
+  storage_target="$(classify_target_layer storage::rpc)"
+
+  assert_dependency_direction 'allowed' "$server_source" "$admin_target"
+  assert_dependency_direction 'allowed' "$server_source" "$app_target"
+  assert_dependency_direction 'allowed' "$server_source" "$storage_target"
+  assert_dependency_direction 'reverse' "$app_source" "$server_target"
+  assert_dependency_direction 'reverse' "$storage_source" "$server_target"
+  assert_dependency_direction 'reverse' "$app_source" "$admin_target"
+  assert_dependency_direction 'reverse' "$storage_source" "$admin_target"
+}
+
 normalize_import_group_item() {
  local prefix="$1"
  local item="$2"
@@ -182,6 +244,11 @@ normalize_import_path() {

 emit_crate_use_statements() {
  (cd "$ROOT_DIR" && rg --files -g '*.rs' rustfs/src | while IFS= read -r file; do
+    # The guard is file-scoped: dedicated test modules are excluded, while
+    # inline #[cfg(test)] imports remain subject to the source file's layer.
+    if [[ "$file" == *_test.rs ]] || [[ "$file" == */tests/* ]]; then
+      continue
+    fi
    perl -0777 -ne '
      while (/\buse\s+crate::.*?;/sg) {
        my $statement = $&;
@@ -194,6 +261,26 @@ emit_crate_use_statements() {
  done)
 }

+write_baseline_file() {
+  local entries="$1"
+
+  cat >"$BASELINE_FILE" <<'EOF'
+# Layer dependency baseline for the rustfs binary crate.
+#
+# The guard models production imports as:
+#   composition -> interface -> app -> infra
+#
+# Canonical dependency entry:
+#   dep|source_file|source_layer->target_layer|crate::imported_symbol
+#
+# Canonical conceptual cycle entry:
+#   cycle|left_layer<->right_layer
+EOF
+  cat "$entries" >>"$BASELINE_FILE"
+}
+
+run_layer_model_self_tests
+
 normalize_baseline_file() {
  local input="$1"
  local output="$2"
@@ -265,10 +352,7 @@ while IFS= read -r line; do
      printf '%s->%s\n' "$source_layer" "$target_layer" >>"$EDGES_RAW"
    fi

-    source_rank="$(layer_rank "$source_layer")"
-    target_rank="$(layer_rank "$target_layer")"
-
-    if (( source_rank < target_rank )); then
+    if is_reverse_dependency "$source_layer" "$target_layer"; then
      printf 'dep|%s|%s->%s|crate::%s\n' "$file" "$source_layer" "$target_layer" "$import_path" >>"$VIOLATIONS_RAW"
    fi
  done < <(normalize_import_path "$text")
@@ -292,7 +376,7 @@ done <"${TMP_DIR}/edges_sorted.txt" | sort -u >"${TMP_DIR}/cycles_sorted.txt"
 cat "${TMP_DIR}/violations_sorted.txt" "${TMP_DIR}/cycles_sorted.txt" | sort -u >"$CURRENT_BASELINE"

 if [[ "$MODE" == "update" ]]; then
-  cp "$CURRENT_BASELINE" "$BASELINE_FILE"
+  write_baseline_file "$CURRENT_BASELINE"
  echo "Updated baseline: $BASELINE_FILE"
  exit 0
 fi
@@ -1,35 +1,44 @@
 # Layer dependency baseline for the rustfs binary crate.
 #
-# These are intra-crate module references within rustfs/ that cross the
-# conceptual layer boundaries (app, infra/server, interface/admin).
-# Since they live inside one Cargo crate, Rust doesn't enforce separation.
-# The list is maintained for architectural awareness during code review.
+# The guard models production imports as:
+#   composition -> interface -> app -> infra
 #
-# Format for dependency entries:
-#   status|source_file|direction|imported_symbol|reason
+# Canonical dependency entry:
+#   dep|source_file|source_layer->target_layer|crate::imported_symbol
 #
-# Format for conceptual cycles:
-#   status|cycle|direction_pair|reason
-#
-# Status:
-#   accepted - reviewed and intentionally allowed
-#   todo     - should be resolved in a future refactor
-
+# Canonical conceptual cycle entry:
+#   cycle|left_layer<->right_layer
 cycle|app<->infra
 cycle|app<->interface
+cycle|composition<->infra
+cycle|composition<->interface
 cycle|infra<->interface
+dep|rustfs/src/admin/handlers/scanner.rs|interface->composition|crate::startup_background::ENV_SCANNER_ENABLED
+dep|rustfs/src/admin/handlers/scanner.rs|interface->composition|crate::startup_background::scanner_enabled_from_env
+dep|rustfs/src/app/admin_usecase.rs|app->interface|crate::server::DependencyReadiness
+dep|rustfs/src/app/admin_usecase.rs|app->interface|crate::server::collect_dependency_readiness_report
 dep|rustfs/src/app/bucket_usecase.rs|app->interface|crate::admin::handlers::site_replication::site_replication_bucket_meta_hook
 dep|rustfs/src/app/bucket_usecase.rs|app->interface|crate::admin::handlers::site_replication::site_replication_delete_bucket_hook
 dep|rustfs/src/app/bucket_usecase.rs|app->interface|crate::admin::handlers::site_replication::site_replication_make_bucket_hook
-dep|rustfs/src/init.rs|infra->interface|crate::admin
+dep|rustfs/src/app/bucket_usecase.rs|app->interface|crate::server::RemoteAddr
+dep|rustfs/src/app/object_usecase.rs|app->interface|crate::server::convert_ecstore_object_info
+dep|rustfs/src/cluster_snapshot.rs|infra->interface|crate::server::DependencyReadiness
+dep|rustfs/src/cluster_snapshot.rs|infra->interface|crate::server::DependencyReadinessReport
+dep|rustfs/src/cluster_snapshot.rs|infra->interface|crate::server::ReadinessDegradedReason
+dep|rustfs/src/cluster_snapshot.rs|infra->interface|crate::server::snapshot_dependency_readiness_report
 dep|rustfs/src/runtime_sources.rs|infra->app|crate::app::context
-dep|rustfs/src/server/http.rs|infra->interface|crate::admin
-dep|rustfs/src/server/layer.rs|infra->interface|crate::admin::console::is_console_path
+dep|rustfs/src/storage/access.rs|infra->interface|crate::server::RemoteAddr
+dep|rustfs/src/storage/ecfs_extend.rs|infra->interface|crate::server::cors
 dep|rustfs/src/storage/ecfs_extend.rs|infra->interface|crate::storage::ecfs::ListObjectUnorderedQuery
-dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::ecfs::FS
-dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::ecfs::validate_object_lock_configuration_input
-dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::s3_api::common::rustfs_initiator
-dep|rustfs/src/storage/ecfs_test.rs|infra->interface|crate::storage::s3_api::common::rustfs_owner
+dep|rustfs/src/storage/helper.rs|infra->interface|crate::server::convert_ecstore_object_info
+dep|rustfs/src/storage/helper.rs|infra->interface|crate::server::is_audit_module_enabled
+dep|rustfs/src/storage/helper.rs|infra->interface|crate::server::is_notify_module_enabled
+dep|rustfs/src/storage/helper.rs|infra->interface|crate::server::refresh_audit_module_enabled
+dep|rustfs/src/storage/helper.rs|infra->interface|crate::server::refresh_notify_module_enabled
+dep|rustfs/src/storage/rpc/http_service.rs|infra->interface|crate::server::RPC_PREFIX
 dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::admin::service::config::reload_dynamic_config_runtime_state
 dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::admin::service::config::reload_runtime_config_snapshot
 dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::admin::service::site_replication::reload_site_replication_runtime_state
+dep|rustfs/src/storage/rpc/node_service.rs|infra->interface|crate::server::MODULE_SWITCHES_SIGNAL_SUBSYSTEM
+dep|rustfs/src/storage/rpc/node_service/heal.rs|infra->composition|crate::startup_background::heal_enabled_from_env
+dep|rustfs/src/storage/rpc/node_service/heal.rs|infra->composition|crate::startup_background::scanner_enabled_from_env
@@ -317,7 +317,7 @@ write_blackbox_matrix() {
 	    printf 'quick\theal degraded erasure disk rebuild\tblack-box\tcargo test --package e2e_test heal_erasure_disk_rebuild_test -- --nocapture\tnone\t%s\n' "$e2e_status"
 	    printf 'quick\tnamespace lock quorum under EC ops\tblack-box\tcargo test --package e2e_test namespace_lock_quorum_test -- --nocapture\tnone\t%s\n' "$e2e_status"
 	    printf 'full\tlegacy bitrot read fixture restore\tfixture\tcargo test -p rustfs-ecstore --test legacy_bitrot_read_test -- --nocapture\tRUSTFS_LEGACY_TEST_ROOT,RUSTFS_LEGACY_TEST_DISK\t%s\n' "$legacy_status"
-	    printf 'full\tMinIO generated encrypted read and negative restore fixture\tfixture\tcargo test -p rustfs --features rio-v2 storage::minio_generated_read_test --lib -- --ignored --nocapture\tRUSTFS_MINIO_FIXTURE_ROOT,RUSTFS_MINIO_STATIC_KMS_KEY_B64\t%s\n' "$minio_status"
+	    printf 'full\tMinIO generated encrypted read and negative restore fixture\tfixture\tcargo test -p rustfs-ecstore --features rio-v2 --test minio_generated_read_test -- --ignored --nocapture\tRUSTFS_MINIO_FIXTURE_ROOT,RUSTFS_MINIO_STATIC_KMS_KEY_B64\t%s\n' "$minio_status"
 	    printf 'full\tS3 multipart range versioning delete subset\tblack-box\tenv TESTEXPR=\"multipart or range or versioning or delete\" DEPLOY_MODE=build MAXFAIL=0 ./scripts/s3-tests/run.sh\tnone\t%s\n' "$s3_status"
 	    printf 'destructive\tdistributed cluster concurrency\tblack-box\tcargo test --package e2e_test cluster_concurrency_test -- --nocapture\tnone\t%s\n' "$destructive_status"
 	    printf 'destructive\tstale multipart cleanup cluster\tblack-box\tcargo test --package e2e_test stale_multipart_cleanup_cluster_test -- --nocapture\tnone\t%s\n' "$destructive_status"
@@ -377,7 +377,7 @@ run_fixture_steps() {

 	  if fixture_available; then
 	    run_step "ecstore-minio-generated-read-fixture" \
-	      cargo test -p rustfs --features rio-v2 storage::minio_generated_read_test --lib -- --ignored --nocapture
+	      cargo test -p rustfs-ecstore --features rio-v2 --test minio_generated_read_test -- --ignored --nocapture
 	  elif [[ "$REQUIRE_FIXTURES" == "true" ]]; then
 	    echo "ERROR: $(minio_fixture_missing_reason)" >&2
 	    exit 1
Author	SHA1	Message	Date
Zhengchao An	2e5cef513f	chore(release): prepare 1.0.0-beta.12 (#5461 ) * chore(release): prepare 1.0.0-beta.12 * chore(release): align release assets for 1.0.0-beta.12 * chore(deps): refresh release dependencies Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: houseme <housemecn@gmail.com> Co-authored-by: heihutu <heihutu@gmail.com>	2026-07-30 01:31:28 +00:00
Zhengchao An	2d4f77fd3b	fix(iam): add correctly named policy APIs (#5457 )	2026-07-30 00:55:23 +00:00
Zhengchao An	920705417c	refactor(ecstore): correct bucket config static names (#5458 ) refactor(ecstore): fix bucket config static names	2026-07-30 00:53:16 +00:00
Zhengchao An	b097c94c59	ci: model server as a composition root (#5459 ) * ci: model server as a composition root * test(ci): cover server to storage layer flow	2026-07-30 00:52:37 +00:00
Zhengchao An	3991a1d73c	test(ecstore): stabilize late snapshot lease cleanup (#5456 ) test(ecstore): wait for late snapshot lease cleanup	2026-07-30 00:10:38 +00:00