fix(site-replication): do not inherit a bucket-level reset id when taking over an operator target

When site replication wires a bucket for a peer, `reconcile_site_replication_bucket_targets`
takes over an existing operator target that already points at that peer and
rewrites it under the site ARN. It also copied the target's `reset_id` and
`reset_before_date`. Those name a bucket-level `replication-reset` keyed by
the operator ARN, which the site resync status map never sees, so
`start_site_bucket_resync` found a foreign reset id with no matching status
and reported the bucket as `target belongs to a different active resync
operation` on every site resync, with no cancel path to clear it
(rustfs/backlog#2479, rep107-src in the SITE-105 run).

Carry the resync identity over only when the ARN is unchanged, i.e. when an
SR target is re-reconciled under its own ARN. Operator tuning (bandwidth,
proxy, storage class, health-check interval) still carries over.

- Unit test covers the takeover (reset id dropped) and the same-ARN
  re-reconcile (reset id kept).
- e2e `test_site_replication_resync_after_bucket_level_reset_to_same_peer`
  runs a bucket-level reset against the future peer, joins the sites, and
  requires the site resync to start without a conflict and complete; the
  repl-nightly selection digest is refreshed for the new case.

.agents/references/adversarial-validation.md

@@ -1,13 +1,33 @@
 # Adversarial Review Shape
 
-Use when root `AGENTS.md` triggers adversarial validation or for a substantial PR review. Paths below are repository-relative. The root finding standard and completion rule apply; selecting a lens does not require finding a defect.
+Use when root `AGENTS.md` triggers adversarial validation or for a substantial PR
+review. Paths below are repository-relative. The root finding standard and
+completion rule apply; selecting a lens does not require finding a defect.
 
 Risk and review shape:
 
-- **Exempt:** documentation, comments, formatting, or typos with no runtime, build, test, or agent-execution effect.
-- **Mechanical:** changes shown to preserve behavior, such as a symbol rename with unchanged callers or a file move with equivalent wiring. Run correctness and simplicity lenses. Classify tests, tooling, CI, and agent instructions by the behavior and authority they change, not their file type; deleting regression protection or changing failure propagation, publishing, or destructive actions can be high risk.
-- **Standard:** localized behavior changes. Run one integrated final-diff pass covering correctness, simplicity, and test coverage; add only domain lenses matched by the diff.
-- **High risk / substantial PR review:** high risk includes locking, erasure/quorum/heal, replication, multipart, RPC, lifecycle/tiering, persistence/fsync, IAM/KMS/auth, cryptography, on-disk/on-wire formats, and S3-visible semantics. Cover the applicable lenses from two perspectives: first trace the intended contract and implementation, then independently challenge its assumptions, failure paths, and evidence. Use separate reviewers when delegation is authorized and useful, or fresh sequential passes otherwise. Choose staffing and split lenses to fit the risk; a fixed reviewer count or duplicated review is not the goal.
-- **Outbound client defaults:** what `TargetClient`, `PutObjectOptions`, or the remote SDK configuration sends to every replication or migration target is high risk for every target class even when the change fixes one. Follow the SOP in `docs/postmortems/2026-09-03-replication-checksum-default-regression.md`: run the outbound target matrix, document each new env knob in the same PR, and list verified and unverified target classes in the PR Impact section.
+- **Exempt:** documentation, comments, formatting, or typos with no runtime,
+  build, test, or agent-execution effect.
+- **Mechanical:** renames, moves, test/tooling-only changes, and agent-rule
+  changes. Run correctness and simplicity lenses.
+- **Standard:** localized behavior changes. Run one integrated final-diff pass
+  covering correctness, simplicity, and test coverage; add only domain lenses
+  matched by the diff.
+- **High risk / substantial PR review:** high risk includes locking,
+  erasure/quorum/heal, replication, multipart, RPC, lifecycle/tiering,
+  persistence/fsync, IAM/KMS/auth, cryptography, on-disk/on-wire formats, and
+  S3-visible semantics. Cover all applicable lenses using exactly two
+  independent reviewers when delegation is explicitly authorized. Split the
+  lenses between them. Otherwise perform two fresh sequential passes.
+- **Outbound client defaults:** what `TargetClient`, `PutObjectOptions`, or
+  the remote SDK configuration sends to every replication or migration target
+  is high risk for every target class even when the change fixes one. Follow
+  the SOP in `docs/postmortems/2026-09-03-replication-checksum-default-regression.md`:
+  run the outbound target matrix, document each new env knob in the same PR,
+  and list verified and unverified target classes in the PR Impact section.
 
-Available domain lenses are security, concurrency/durability, compatibility, and performance; select only those matched by the change.
+Available domain lenses are security, concurrency/durability, compatibility,
+and performance. Select `.agents/skills/adversarial-validation/SKILL.md` for an
+explicit adversarial request, a high-risk change, or a substantial PR review;
+then read only its matching role references. A routine standard pass does not
+load the playbook unless the reviewer needs a RustFS-specific probe.

.agents/references/implementation.md

@@ -1,79 +1,65 @@
 # Implementation Rules
 
-These implementation, style, and quality rules apply to all contributions, regardless of author or editor. Paths below are repository-relative. Read only the relevant sections during read-only review; select verification from the root `AGENTS.md`.
-
-## Shared Style Contract
-
-- Use the toolchain declared in `rust-toolchain.toml`, respect the minimum supported Rust version in `Cargo.toml`, and let `rustfmt.toml` and the configured Rust/Clippy lints define mechanical style. Do not override repository settings with personal formatter or lint preferences.
-- Follow the owning module's organization, imports, and domain terminology where repository rules leave a choice. Existing violations do not justify new ones; avoid unrelated cleanup in a focused change.
-- Rules using "must" or "do not" are requirements. Rules using "prefer" are defaults; depart when correctness, ownership, performance, or readability benefits justify it. Explain consequential tradeoffs, not every idiomatic choice. Where several approaches meet the contract equally well, the implementer chooses.
-- Follow the declared toolchain locally and the affected CI lane's toolchain for reproduction. The repository currently tracks `stable`; for a formatter/lint mismatch, compare `rustc -Vv`, `cargo fmt --version`, and `cargo clippy --version` with the failing run before changing code. Toolchain upgrades must keep local and CI settings aligned and pass their affected gates; do not silently raise `rust-version` or change lint policy to make a check pass.
+Applies when changing code or running artifact-heavy work. Paths below
+are repository-relative. Read only the relevant sections during read-only review.
 
 ## Worktree and Disk Hygiene
 
-- For a new task, start from the latest `origin/main` unless a different base is requested, and confirm the requested change is not already present. When continuing existing work or a PR, preserve its branch, base, and task-owned changes; do not restart it from `main`.
-- An existing clean, isolated task worktree is sufficient. Create another worktree only when the current checkout is shared, dirty with unrelated work, or belongs to another task.
+- Start implementation from the latest `origin/main` and confirm the requested
+  change is not already present.
+- An existing clean, isolated task worktree is sufficient. Create another
+  worktree only when the current checkout is shared, dirty with unrelated work,
+  or belongs to another task.
 - Never commit from a shared checkout.
-- Use a task-specific branch named `<type>/<topic>`, such as `fix/...`, `feat/...`, `test/...`, or `docs/...`, unless the user specifies a name.
-- Do not include agent, tool, contributor, account, or organization names in branch names.
-- Push to the user-requested remote or the repository's configured push remote. Do not hard-code or infer a remote from an account name.
-- Check free space before artifact-heavy builds, tests, coverage, or downloads. Re-check before a broad gate when space is tight.
-- Before handoff, remove the Cargo target directories and temporary worktrees the task created unless they stay intentionally or hold unmerged work. Identify build output by Cargo's markers (`.rustc_info.json`, `CACHEDIR.TAG`), not by directory name: `target` is also a source directory here.
-- Remove only task-owned temporary/build artifacts. Never delete another task's worktree or uncommitted data.
-- At handoff, mention disk or cleanup details only when they affected execution or artifacts/worktrees remain intentionally.
-- For Docker verification, ensure the tested image contains the intended binary. `buildx build` without `--load` leaves the image in the build cache; use the Makefile's loaded image and rebuild without cache only when stale artifacts are evidenced.
+- Use a task-specific branch named `<type>/<topic>`, such as `fix/...`,
+  `feat/...`, `test/...`, or `docs/...`, unless the user specifies a name.
+- Do not include agent, tool, contributor, account, or organization names in
+  branch names.
+- Push to the user-requested remote or the repository's configured push remote.
+  Do not hard-code or infer a remote from an account name.
+- Check free space before artifact-heavy builds, tests, coverage, or downloads.
+  Re-check before a broad gate when space is tight.
+- Remove only task-owned temporary/build artifacts. Never delete another task's
+  worktree or uncommitted data.
+- At handoff, mention disk or cleanup details only when they affected execution
+  or artifacts/worktrees remain intentionally.
 
 ## Change Style
 
-- Preserve unrelated control flow. Restructure touched code only when needed for the requested behavior or an explicitly requested refactor; style preferences alone do not justify changing execution order or cleanup behavior.
-- Prefer a direct local edit over new files, wrappers, managers, or speculative abstractions.
-- Add a helper only when it removes current duplication, names a real domain boundary, or isolates a non-trivial invariant. Keep helpers near the code they support when the module's organization permits it.
-- Remove an in-scope path superseded by the change. If compatibility requires it, adapt at the boundary to one canonical core and use the repository's `RUSTFS_COMPAT_TODO` policy.
-- Comments explain non-obvious invariants or reasons. Do not narrate code or record change history.
+- Preserve existing control flow unless changing it is required for correctness.
+- Prefer a direct local edit over new files, wrappers, managers, or speculative
+  abstractions.
+- Add a helper only when it removes current duplication, names a real domain
+  boundary, or isolates a non-trivial invariant.
+- Remove an in-scope path superseded by the change. If compatibility requires it,
+  adapt at the boundary to one canonical core and use the repository's
+  `RUSTFS_COMPAT_TODO` policy.
+- Comments explain non-obvious invariants or reasons. Do not narrate code or
+  record change history.
 - Mention unrelated problems when useful; do not fix them in a narrow task.
 
-## Rust Style
-
-These repository-owned rules incorporate selected ideas from the [OpenCode style guide](https://github.com/anomalyco/opencode/blob/dev/AGENTS.md#style-guide), adapted to RustFS. That link is background, not an additional rule source. Apply these defaults to new or changed code; correctness and domain invariants take priority.
-
-- Default to immutable `let` bindings; use `mut` for actual state changes. Prefer `if` or `match` expressions when branches compute a value instead of initializing a placeholder and reassigning it.
-- Use type inference for obvious local values. Add annotations when inference needs help or the numeric, collection, or error type matters to understanding the code. Keep explicit types in function signatures and public contracts.
-- Keep the main path readable with guard clauses, `let ... else`, and `?` when immediate propagation is correct. Preserve explicit handling for recovery, cleanup, aggregation, and quorum decisions; `if`/`else` expressions and exhaustive `match` remain idiomatic.
-- Prefer readable iterator chains for straightforward mapping and filtering. Keep loops when they make state changes, early exits, or async operations clearer. Do not add intermediate collections or clones just to use iterators.
-- Inline trivial single-use expressions only when a binding adds no meaning. Keep names that explain domain concepts, aid debugging, or make ownership and guard lifetimes clear. Do not change lock release or drop timing for style.
-- Keep pure parsing, validation, and option-building helpers synchronous unless an async interface contract requires otherwise. This does not make blocking I/O or CPU-heavy work safe to run on async executor threads; offload it when needed to keep those threads responsive.
-
 ## Reuse and Boundary Rules
 
-- Before adding helpers, constants, fixtures, or wrappers, search the touched code and domain owner; check `crates/utils`, `crates/common`, and direct dependencies when they could own the behavior. Stop once the relevant reuse boundary is clear.
-- Reuse requires matching semantics: normalization, error types, deadlines, durability, and compatibility must fit the call site. A narrowly named local helper is better than forced reuse with different semantics.
-- Validate untrusted input at the boundary that owns it, then pass validated types inward without repeating checks whose guarantees still hold. Deserializing into a Rust type alone does not establish domain validity. Values newly read from disk, RPC, persistence, or another version must be validated at that consuming boundary.
-- For destructive actions such as delete or overwrite and for quorum decisions, check the relevant identity, generation, and authority under the operation's existing synchronization or precondition contract. A separate unguarded recheck does not prevent a check/use race.
-- Every new control-flow branch needs a concrete triggering input/state. For decoded or peer data, corruption and mixed-version input are valid triggers.
-- Required values must return a typed error when absent or corrupt; do not use a default that converts corruption into a plausible result.
-- Attach error context once where it is actionable. Do not erase typed errors below aggregation or quorum layers.
-
-## Rust Boundaries
-
-- Production `unwrap`/`expect` must follow a type guarantee or checked invariant; explain only non-obvious guarantees. Stricter scoped prohibitions, including `crates/AGENTS.md`, still apply. Invalid client, disk, or peer data must return errors rather than trigger panics.
-- Public APIs do not return `Result<_, String>`. Library APIs use domain errors unless intentional erasure is part of the boundary contract; expose a stored inner error through `Error::source()`.
-- Numeric conversions must not silently truncate. Use fallible conversions for untrusted values; validate finiteness, sign, and range before float-to-integer conversion. Clamp/saturate only when required by the domain.
-- Do not add crate-root `#![allow(dead_code)]`.
+- Before adding helpers, constants, fixtures, or wrappers, search the touched
+  crate, the domain-owning crate, `crates/utils`, `crates/common`, and relevant
+  direct dependencies.
+- Reuse requires matching semantics: normalization, error types, deadlines,
+  durability, and compatibility must fit the call site. A narrowly named local
+  helper is better than forced reuse with different semantics.
+- Validate untrusted input at its trust boundary, then trust the validated type.
+  Values crossing disk, RPC, persistence, or version boundaries remain
+  untrusted at every consumer.
+- Re-check boundary values immediately before destructive actions such as
+  delete, overwrite, or quorum decisions.
+- Every new branch needs a concrete triggering input/state. For decoded or peer
+  data, corruption and mixed-version input are valid triggers.
+- Required values must return a typed error when absent or corrupt; do not use a
+  default that converts corruption into a plausible result.
+- Attach error context once where it is actionable. Do not erase typed errors
+  below aggregation or quorum layers.
 
 ## Naming
 
-Use Rust API naming: `SCREAMING_SNAKE_CASE` constants/statics, `snake_case` functions/variables/modules, and `PascalCase` types/traits. Name domain concepts and include units where a value would otherwise be ambiguous; do not optimize for short names. Do not rename public, serialized, or persisted fields merely to match a local style preference, or rename unrelated existing violations.
-
-## API and Operational Contracts
-
-- For new or changed public APIs, document the caller-visible behavior and relevant `# Errors`, `# Panics`, and `# Safety` conditions. Include a useful example or link to one when usage is non-obvious; avoid boilerplate sections that say nothing. Follow the [Rust API documentation guidelines](https://rust-lang.github.io/api-guidelines/documentation.html) within the scope of the change.
-- For async or storage APIs, state cancellation, retry/idempotency, partial-completion, ownership, and durability guarantees when callers rely on them. Make failure cleanup and commit points explicit in code and tests; do not imply atomicity that the implementation does not provide.
-- For protocol, persisted-format, configuration, dependency, or operational changes, check affected consumers and supported versions. Update relevant docs/examples and describe compatibility, upgrade/rollback limits, and new configuration defaults when they change. New dependencies must solve a current need and fit the workspace's license, toolchain, and feature policy.
-- For hot-path or resource-management changes, check allocation/copying, blocking, unbounded work, and lock duration where affected. Support performance claims with an appropriate measurement or clearly label them as expectations; a benchmark is not required for unrelated changes.
-
-## Behavioral Tests
-
-- For behavior changes, add or update the narrowest test that calls the real implementation and asserts an observable result. Existing tests can provide coverage when they directly exercise the changed behavior; do not duplicate production logic as the test oracle.
-- Cover the changed contract's relevant failure and boundary cases, not only success. A bug regression should fail without the fix; do not broaden assertions or rely only on a successful call when the result or side effect is what matters.
-- Follow `docs/testing/README.md` for test layers, runners, isolation, synchronization, and flaky tests. Use controlled clocks or explicit synchronization for time/concurrency tests instead of fixed sleeps, and keep waits bounded.
-- Report the checks actually run and their outcomes, including skipped or blocked checks and the behavior they leave unverified. Do not describe focused local checks as full CI coverage.
+Use Rust API naming: `SCREAMING_SNAKE_CASE` constants/statics, `snake_case`
+functions/variables, and `PascalCase` types. Do not rename unrelated existing
+violations.

.agents/references/pull-requests.md

@@ -1,31 +1,51 @@
 # Git and Pull Request Rules
 
-Applies to commits, pushes, PRs, and issue/discussion actions. Paths below are repository-relative. User authorization and root `AGENTS.md` still govern scope.
+Applies to commits, pushes, PRs, and issue/discussion actions. Paths below are
+repository-relative. User authorization and root `AGENTS.md` still govern scope.
 
 ## Final PR Preflight
 
 Before creating or updating a PR, reuse completed review and verification:
 
-- Verify the actual base (normally `origin/main`) and the complete task diff, including file names and whitespace. Exclude secrets, logs, generated artifacts, and unrelated edits. Retain an existing PR's base unless requested.
-- Confirm the final diff passed the root verification tier; fix task-owned failures and run missing scoped checks. Report unresolved required checks or authority without expanding the task. Do not start another general review.
-- Keep the English Conventional Commit title at most 72 characters. Use the template headings, actual checks, material risks, and rollback notes.
-- Immediately before writing to GitHub, confirm the head and task diff are unchanged. Rerun only checks invalidated by edits or relevant state changes.
+- Verify the actual base (normally `origin/main`) and the complete task diff,
+  including file names and whitespace. Exclude secrets, logs, generated
+  artifacts, and unrelated edits. Retain an existing PR's base unless requested.
+- Confirm the final diff passed the root verification tier; fix task-owned
+  failures and run missing scoped checks. Report unresolved required checks or
+  authority without expanding the task. Do not start another general review.
+- Keep the English Conventional Commit title at most 72 characters. Use the
+  template headings, actual checks, material risks, and rollback notes.
+- Immediately before writing to GitHub, confirm the head and task diff are
+  unchanged. Rerun only checks invalidated by edits or relevant state changes.
 
 ## Pull Request Lifecycle
 
-- Creating or updating a PR includes one immediate snapshot of checks, mergeability, reviews, and unresolved threads.
-- Unless the user explicitly requests monitoring, a release workflow requires it, or an automation already owns it, hand off after the PR is open with the current state and next event to watch. Do not delay ordinary handoff with fixed quiet-period sleeps.
-- For requested monitoring, use event-driven or bounded waits. Report only state changes, actionable failures, or a meaningful prolonged delay.
-- Investigate failures/comments before changing code. Monitoring alone authorizes observation and diagnosis; fixes, pushes, replies, and thread resolution require their own existing task authority. When authorized, fix task-attributable issues, rerun affected verification, and resume the requested monitor. Otherwise report the concrete failure and next action without expanding scope.
-- Merge only with existing user authorization and satisfied applicable reviewer, check, and branch-protection requirements. Reviewer approval does not grant merge authority; user authorization does not bypass repository protections.
-- After an observed merge, verify the commit reached the base, then clean the task worktree/branch when safe. Preserve unmerged work for closed PRs unless deletion was explicitly authorized.
+- Creating or updating a PR includes one immediate snapshot of checks,
+  mergeability, reviews, and unresolved threads.
+- Unless the user explicitly requests monitoring, a release workflow requires
+  it, or an automation already owns it, hand off after the PR is open with the
+  current state and next event to watch. Do not delay ordinary handoff with
+  fixed quiet-period sleeps.
+- For requested monitoring, use event-driven or bounded waits. Report only state
+  changes, actionable failures, or a meaningful prolonged delay.
+- Investigate failures/comments before changing code. Fix task-attributable
+  issues, rerun affected verification, push, reply or resolve the thread, then
+  resume the requested monitor.
+- Never merge without required reviewer approval or explicit authority.
+- After an observed merge, verify the commit reached the base, then clean the
+  task worktree/branch when safe. Preserve unmerged work for closed PRs unless
+  deletion was explicitly authorized.
 
 ## Git and PR Baseline
 
 - Follow Conventional Commits; keep the subject at most 72 characters.
 - Source comments, commits, PR titles, and PR bodies are in English.
-- Keep every heading from `.github/pull_request_template.md`; use `N/A` where needed and include commands actually run.
+- Keep every heading from `.github/pull_request_template.md`; use `N/A` where
+  needed and include commands actually run.
 - Use `--body-file` for multiline `gh pr create`/`gh pr edit` content.
-- PR/issue/discussion content must not contain the literal sequence `\n` or hard-wrapped prose paragraphs.
-- Do not include local absolute paths or tool-specific labels/prefixes in GitHub content.
-- Resolve review threads after the underlying issue is fixed. If declining a suggestion, reply with a short evidence-based reason.
+- PR/issue/discussion content must not contain the literal sequence `\n` or
+  hard-wrapped prose paragraphs.
+- Do not include local absolute paths or tool-specific labels/prefixes in GitHub
+  content.
+- Resolve review threads after the underlying issue is fixed. If declining a
+  suggestion, reply with a short evidence-based reason.

.agents/skills/adversarial-validation/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: adversarial-validation
+description: Review RustFS diffs or designs for explicit adversarial requests, high-risk changes under the repository review policy, or substantial PR reviews. Skip ordinary questions, diagnosis, planning, status, routine low-risk implementation, and prose with no execution effect.
+---
+
+# RustFS Adversarial Validation
+
+Use the [repository risk tiers and review shape](../../references/adversarial-validation.md). This skill
+routes a review to RustFS-specific probes without loading unrelated domains.
+
+## Select Lenses
+
+Read only the references required by the diff:
+
+| Lens | When to read |
+|---|---|
+| [Correctness](references/correctness.md) | Every non-exempt adversarial review |
+| [Simplicity](references/simplicity.md) | Mechanical/standard changes and production growth |
+| [Test coverage](references/test-coverage.md) | Behavior or test changes |
+| [Security](references/security.md) | Authn/authz, IAM, RPC trust, paths, secrets, parsing, browser, encryption |
+| [Concurrency/durability](references/concurrency-durability.md) | Async shared state, locks, storage commit, cancellation, persisted queues |
+| [Compatibility](references/compatibility.md) | S3 surface, MinIO interop, metadata, wire/disk formats, mixed versions |
+| [Performance](references/performance.md) | Request/object hot paths, allocation, blocking work, fsync, fan-out |
+
+Do not read all references as a precaution. A path name alone is insufficient;
+the changed behavior must touch the lens's domain.
+
+For a dedicated security audit or advisory analysis, use
+`security-advisory-lessons` instead of loading it automatically during every
+adversarial review.
+
+## Review Protocol
+
+1. Freeze the exact final diff/head (or the design under review) and list the
+   selected lenses.
+2. Run the review shape required by the repository risk tier.
+3. For each selected lens, either report a concrete finding or a null verdict
+   naming the attacks performed.
+4. Apply root `AGENTS.md`'s finding standard. Test each candidate against callers,
+   existing coverage, and invariants before accepting it; an adversarial role
+   does not have to produce a defect.
+5. Fix or rebut supported findings with code-path, test, or invariant evidence.
+6. After a non-trivial edit, rerun only lenses affected by that edit against the
+   new exact diff.
+
+Do not turn a null verdict into a long checklist. Record concise evidence that
+the relevant failure classes were attacked, then stop under the root completion
+rule. Keep the required per-lens verdicts for high-risk PRs.

.agents/skills/adversarial-validation/references/compatibility.md

@@ -0,0 +1,38 @@
+# Compatibility Lens
+
+- Internal metadata uses `metadata_compat` helpers for dual RustFS/MinIO keys,
+  including mixed casing and removal of both twins.
+- Binary UUID metadata treats absent, empty, and nil as no value. Unversioned
+  remote tiers receive no `versionId`; versioned purge requests retain the real
+  version ID.
+- `xl.meta` changes preserve supported header/meta versions, recompute
+  signatures, decode legacy fixtures, and remain readable by old RustFS/MinIO.
+- Foreign/corrupt metadata validates parallel array lengths and missing fields;
+  it returns a decode error rather than indexing, panicking, or fabricating data.
+- Do not “correct” byte-for-byte MinIO ports without legacy fixture evidence.
+  Bitrot framing, shard math, distribution, and inline prefixes are contracts.
+- Client-visible metadata/events strip both internal prefixes
+  case-insensitively.
+- Proto fields are appended, never reused/renumbered; FlatBuffers tables extend
+  compatibly and absent new fields fail closed where authorization/quorum is
+  involved.
+- Replay real client request shapes and exact pagination boundaries for S3
+  handler changes.
+- Bucket metadata/IAM/config parsing remains compatible with pinned real MinIO
+  fixtures and encrypted migration data.
+- Compatibility shims use `RUSTFS_COMPAT_TODO(<task-id>)`, have a removal
+  condition, and default toward reading old data safely.
+
+## Outbound targets
+
+- A change to what the replication or migration client sends by default
+  (checksum policy, payload framing, headers, version-id addressing) is judged
+  against every target class, not the one it fixes. Name each target-side rule
+  the current default satisfies — checksum required with Object Lock
+  parameters, `aws-chunked` decoding, version-id adoption, ETag equals content
+  MD5 — and show which cell of
+  `crates/e2e_test/src/replication_target_matrix_test.rs` covers each.
+- A test that asserts the fix ("no trailer header") is not evidence; the
+  matrix cell that asserts the target accepted and stored the object is.
+- Every new environment escape hatch appears in
+  `docs/operations/replication-outbound-transport.md` in the same diff.

.agents/skills/adversarial-validation/references/concurrency-durability.md

@@ -0,0 +1,23 @@
+# Concurrency and Durability Lens
+
+- For every changed lock, enumerate overlapping lock sets and construct the
+  ABBA interleaving. Multiple-lock order must be documented and consistent.
+- Mark guard lifetimes and every `.await`, disk, and RPC call inside them.
+  Estimate contention and timeout behavior under concurrent requests.
+- Object commits remain fenced if the distributed lock is lost after shard
+  writes and before metadata rename.
+- For write/rename changes, trace `write tmp -> sync tmp -> rename -> sync parent
+  -> sync required ancestors`; simulate a crash after each step and honor the
+  configured durability gate.
+- Multi-disk fan-out counts every result. Quorum-minus-one cannot become success;
+  heal remains best-effort per target where that is the established contract.
+- At every new cancellable await between mutation and cleanup/commit, drop the
+  future and inspect leftover files, counters, permits, and replay state.
+- Multipart operations on the same upload ID are serialized where required;
+  abort/complete/list races cannot delete parts before durable commit.
+- Post-commit cleanup is best-effort, retry-safe, and cannot fail an already
+  committed write or delete the last surviving copy.
+- Persisted read-modify-write uses serialization/CAS. Queue replay is crash-safe
+  and duplicate delivery has an idempotency contract.
+- Streaming reconstruction failures after partial output surface as errors, not
+  successful EOF.

.agents/skills/adversarial-validation/references/correctness.md

@@ -0,0 +1,29 @@
+# Correctness Lens
+
+Attack the changed behavior, not every subsystem in the repository.
+
+- Trace new error paths to the caller. Inject the ignored/wildcard variants and
+  verify they cannot become success, not-found, or a plausible default.
+- Exercise zero/empty/missing, maximum, and exact-boundary inputs for every
+  changed count, size, index, page limit, or optional value.
+- For aggregation/quorum changes, test exactly quorum and quorum-minus-one with
+  mixed disk errors and nil/placeholder entries.
+- For listing/pagination, test `n == max`, `n == max + 1`, delimiter folding,
+  continuation markers, and object/prefix name collisions.
+- For EC/read/streaming changes, inject failure after partial output and verify
+  the client receives an error rather than a clean truncated body. Assert exact
+  bytes and length.
+- For multipart/object commits, fail before/after rename and cleanup; committed
+  data must remain readable and pre-commit cleanup must not destroy parts.
+- For version/index ordering, test `len - 1`, `len`, equal timestamps, missing
+  versions, and deterministic tie-breaking.
+- For directory-object behavior, trace `__XLDIR__` at the store layer; branches
+  below the layer that sees trailing slashes are dead.
+- For binary UUID metadata, absent, empty, and nil all mean no value. Never send
+  nil/empty `versionId` to an unversioned tier.
+- For agent rules/skill routers, test a trigger matrix covering ordinary
+  inquiry, low-risk implementation, explicit review, high-risk code, PR
+  creation, release, and post-PR monitoring. Each case must select only the
+  intended workflow and retain required safety/authorization boundaries.
+
+Null verdicts name only the probes relevant to the diff.

.agents/skills/adversarial-validation/references/performance.md

@@ -0,0 +1,20 @@
+# Performance Lens
+
+- For added clones/allocations on request/object/block paths, quantify copied
+  data and frequency. Recommend borrowing, move, `Bytes`/`Arc`, `Cow`, or
+  capacity reservation only for a concrete repeated cost.
+- Route every new sync/flush through the durability-mode and bucket override
+  gates; mode `none` must not pay the new fsync.
+- Keep blocking filesystem/CPU work off async runtime threads, but do not split
+  one small operation into many `spawn_blocking` round trips.
+- Measure lock hold time across I/O and compare acquisition order for ABBA.
+- Keep cleanup, extra stat/rename, and diagnostics out of the PUT commit critical
+  section when they need not be there.
+- Detect per-item serial I/O/RPC in batch APIs and accidental quadratic scans;
+  use a gate or bounded concurrency when the concrete fan-out warrants it.
+- Count buffer growth and byte copies in EC/bitrot paths; preserve pool gauge
+  balance and avoid repeated metadata decode/fetch per object.
+- Repetitive success logs stay at `trace`; metrics/instrumentation on hot paths
+  require an existing gate.
+- Claims of no impact on PUT/GET/commit/erasure paths need relevant benchmark or
+  A/B evidence, especially for 4 KiB objects.

.agents/skills/adversarial-validation/references/security.md

@@ -0,0 +1,31 @@
+# Security Lens
+
+Use `security-advisory-lessons` only for a dedicated advisory/security audit.
+For an ordinary matched diff, attack these boundaries:
+
+- Admin routes: route registration, whitelist, handler authn, and the exact
+  `AdminAction` must agree. Read-only diagnostics still require admin authz.
+- IAM/service accounts: treat parent, claims, keys, groups, status, and policy
+  names as attacker-controlled; prove ownership/root authority before writes.
+- Protocol frontends: every changed/sibling command authorizes the matching S3
+  action before reaching storage.
+- Secrets/signatures: use constant-time comparison, normalize public failures,
+  keep RPC/root/STS keys independent, and fail closed when secrets are absent.
+- RPC: bind signatures to the exact method/path and timestamp; reject replay,
+  stale, malformed, truncated, and invalid-enum payloads without panic.
+- Paths/object/archive entries: reject traversal, absolute/platform escapes,
+  and normalization differences between authz and storage.
+- Copy/multipart/presigned POST: enforce source, destination, version-aware
+  actions, copy-source conditions, and every signed policy condition.
+- Logging/errors: never expose credentials, tokens, expected signatures, raw
+  secret-bearing input, or merged configs—including via `Debug` and parse errors.
+- Untrusted serde: reject unknown fields where compatible and validate
+  security-critical defaults/ranges before numeric conversion.
+- SSE/browser/CORS/trusted proxy: inspect stored ciphertext and wrapper order;
+  isolate user content; never reflect credentialed arbitrary origins or trust
+  forwarded identity from direct clients.
+- Object Lock: unreadable/fabricated/unparsable metadata fails closed across
+  foreground, lifecycle, scanner, and force-delete paths.
+
+Security findings distinguish unauthenticated compromise from a
+low-privileged authenticated bypass.

.agents/skills/adversarial-validation/references/simplicity.md

@@ -0,0 +1,22 @@
+# Simplicity Lens
+
+- Compare the production diff with the smallest equivalent local edit. Fewer
+  lines alone are not evidence; the replacement must preserve correctness,
+  compatibility, readability, and real boundaries.
+- Search the touched crate, domain owner, `crates/utils`, `crates/common`, and
+  relevant dependencies for each new helper, constant, wrapper, or fixture.
+- Reject forced reuse when normalization, error, deadline, or durability
+  semantics differ.
+- Require a concrete trigger for every new defensive branch. Keep boundary
+  checks for disk/RPC/version data and checks immediately before destructive
+  actions.
+- Flag one-caller helpers only when they merely forward or split a short linear
+  flow without adding domain naming, invariant isolation, or useful context.
+- Ensure a replacement removes the superseded in-scope path or keeps one
+  canonical core behind a documented compatibility adapter.
+- Remove narration/change-history comments; preserve concise safety, lock,
+  durability, and compatibility invariants.
+- Treat tests, fixtures, generated code, and documentation separately from
+  production growth. Do not optimize away meaningful regression coverage.
+
+A finding must include a concrete smaller design, not a style preference.

.agents/skills/adversarial-validation/references/test-coverage.md

@@ -0,0 +1,25 @@
+# Test-Coverage Lens
+
+- For every behavior claim, name the focused test/check that fails if the
+  changed hunk is reverted. If none is practical, require the reason and
+  residual risk.
+- Confirm tests exercise the real production path and distinguish the intended
+  behavior from the named regression. A success, `is_err()`, or no-panic check
+  can be sufficient when that is the actual contract; require exact values,
+  bytes, state, or error variants when those distinctions matter to the change.
+- For new flags/modes, verify each branch and ask which test fails if the branch
+  is inverted.
+- For new error propagation, inject the failure and assert the caller observes
+  it; mentally replacing `?`/`return Err` with success must break a test.
+- Streaming GET tests assert the complete body and length under degraded reads.
+- Disk/wire-format tests use pinned foreign/legacy fixtures; same-code
+  round-trips are insufficient for compatibility.
+- Concurrency tests use readiness polling, isolate global state, and avoid fixed
+  sleeps or unrealistically short timeouts. Use nextest groups when process-level
+  serialization is required.
+- Internal metadata tests assert both RustFS and MinIO keys, not only read-back
+  through a helper that prefers one key.
+- Boundary companions are distinct coverage: `n == max` vs `max + 1`, and
+  absent vs empty vs nil UUID.
+- A focused test proves only the targets/features it builds. Add compilation or
+  Clippy only for uncovered changed targets.

.agents/skills/arch-checks/SKILL.md

@@ -1,5 +1,9 @@
+---
+name: arch-checks
+description: Diagnose failures from check_layer_dependencies.sh, check_architecture_migration_rules.sh, check_unsafe_code_allowances.sh, check_logging_guardrails.sh, check_doc_paths.sh, or check_no_planning_docs.sh. Use when one of these guards fails, not for every architecture question or documentation edit.
+---
 
-# Architecture Guard Troubleshooting
+# Architecture Guard Checks
 
 Read only the section for the failing guard. Use `.config/make/` and the current
 workflow to verify its wiring; not every guard is part of every gate. Fix the
@@ -34,16 +38,6 @@ source lines. If it fails after a doc edit, you reworded or removed a
 guarded line — restore the wording or update the script deliberately in the
 same PR, with rationale.
 
-## OIDC architecture boundaries
-
-`check_architecture_migration_rules.sh` also runs `scripts/check_oidc_architecture_boundaries.sh`. Its rule identifier and `file:line` point to the source boundary that changed. Keep OIDC provider configuration, discovery, transport, state, and runtime under `crates/iam/src/oidc/`; keep verified identity mapping under `crates/iam/src/federation/mapper.rs`; construct the runtime in IAM startup and `rustfs/src/startup_auth.rs`; publish the federation service and OIDC query together through `AppContext`. The Keycloak workflow must include the OIDC module path for pull requests and pushes.
-
-OIDC production modules must not reference RustFS `Credentials` or `FederatedSessionTransaction`. Federation orchestration creates the transaction, and the Admin session binding issues credentials.
-
-The Admin OIDC handler delegates persisted configuration reads, updates, and provider validation to `admin/service/oidc_config.rs`. Site replication uses `OidcConfigQuery::site_replication_snapshot()` and receives only the fields required for its response, including a hashed client secret. The Keycloak workflow also tracks the Admin configuration service path for both events.
-
-Run `bash scripts/check_oidc_architecture_boundaries.sh --self-test` after editing a rule. Its negative and accepted examples under `scripts/fixtures/architecture_migration_rules/oidc/` must produce the exact expected rule identifiers. Then run the full architecture guard.
-
 ## `check_unsafe_code_allowances.sh`
 
 Every `#[allow(unsafe_code)]` needs a `SAFETY:` comment within a few lines.
@@ -57,7 +51,7 @@ consider adding it to the script's `checked_files` list.
 
 ## `check_doc_paths.sh`
 
-Instruction docs (`AGENTS.md`, `ARCHITECTURE.md`) and every
+Instruction docs (`AGENTS.md`, `CLAUDE.md`, `ARCHITECTURE.md`) and every
 Markdown file under `docs/` (architecture, operations, testing, index) must not
 reference repo file paths that no longer exist. If your refactor moved code,
 update the docs that point at it — the error message lists `doc -> stale-path`

.agents/skills/code-change-verification/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: code-change-verification
+description: Review a commit, PR, or merged patch when the user requests ordinary code-change verification. Do not combine with adversarial-validation; use that skill instead for explicitly adversarial, substantial, or high-risk RustFS reviews.
+---
+
+# Code Change Verification
+
+Use this skill for an ordinary requested review. If the root policy or user calls
+for adversarial validation, use `adversarial-validation` instead of running both.
+
+## Core Workflow
+
+### 1) Scope and assumptions
+- Derive the change source, target branch, and relevant runtime/version from the
+  supplied diff and metadata. Ask only when missing context could change the verdict.
+- Focus only on requested scope; avoid reviewing unrelated files.
+
+### 2) Risk map
+- Prioritize in this order:
+  - Data correctness and user-visible behavior
+  - API/contract compatibility
+  - Security and authz/authn boundaries
+  - Concurrency and lifecycle correctness
+  - Performance and resource usage
+- Give higher priority to stateful paths, migration logic, defaults, and error handling.
+
+### 3) Evidence-based inspection
+- Read each modified hunk with neighboring context.
+- Trace call paths and call-site expectations.
+- Check for:
+  - invariant breaks and missing guards
+  - unchecked assumptions and null/empty/error-path handling
+  - stale tests, fixtures, and configs
+  - hidden coupling to shared helpers/constants/features
+- Apply root `AGENTS.md`'s finding standard: try to disprove a candidate before
+  reporting it. Mention an unresolved question only when it could materially
+  change the verdict; do not fill the report with speculative possibilities.
+
+#### Rust-specific checks
+
+For changed Rust behavior, use the matching sections of [rust-code-quality](../rust-code-quality/SKILL.md). Reuse checks already performed by the selected review workflow. Comment-only or formatting-only Rust diffs do not require the full Rust checklist. Carry its P0–P3 ratings over unchanged and use this skill's output format.
+
+### 4) Findings-first output
+- Order supported findings by P0–P3 severity; preserve the Rust ratings above.
+  Include `path:line`, the failure and impact, a focused fix, and its validation.
+- If no supported issues remain, state `No findings` with the reviewed scope and
+  any material verification limitation. Do not append optional improvements to
+  make a clean review look productive.
+
+Close after the required review. Recommend additional verification only for an
+identified unresolved risk or required gate; reuse evidence for unchanged code.

.agents/skills/code-change-verification/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Change Verification"
+  short_description: "Prioritize risks and verify code changes before merge."
+  default_prompt: "Use $code-change-verification for an ordinary requested diff review with prioritized findings."

.agents/skills/issue-triage/SKILL.md

@@ -1,13 +1,112 @@
 ---
 name: issue-triage
-description: Verify issue completion against current implementation and merged work. Use for issue triage; comment, close, or change labels only when authorized.
+description: Assess whether a GitHub issue is fixed, needs implementation, or can be closed by checking related work and current code. Use for issue completion/triage requests. Status questions are read-only; comment, close, or change labels only when the conversation authorizes that action.
 ---
+
 # Issue Triage
 
-- Resolve the issue repository separately from the implementation repository: `rustfs/backlog` tracks work in `rustfs/rustfs`. Pass `--repo` explicitly to GitHub queries.
-- Read the issue body, relevant comments, linked PRs, checklist, and sub-issues with `gh issue view`. Search explicit links, the full issue URL, qualified references, and subject keywords; an empty search result does not prove implementation is absent.
-- Fetch the implementation base and inspect its current code. For each merged candidate, verify `git merge-base --is-ancestor <merge-commit> <remote>/<base>`; a title, commit message, or merged state alone is insufficient. A local checkout may be stale or on another branch.
-- Verify every checklist/sub-issue before declaring completion. For batches, paginate the entire requested issue scope, exclude PR entries, and filter by author only when requested.
-- Recommend closing only when all requested behavior is present or evidence shows the issue is superseded. Otherwise name what remains. A status request is read-only; reuse existing authority for comments/closing/labels, and follow [Git and PR rules](../../references/pull-requests.md) before posting. Use Chinese for `rustfs/backlog`, existing repository labels only, and a closing comment naming the verified behavior and PRs.
+Use this skill when the user provides a GitHub issue URL and asks "can this be closed?", "is this already implemented?", "check completion status", or similar triage questions.
 
-Report the issue, current state, implementation evidence, remaining work, verdict, and action actually taken. Use a table for batches. Write multiline comments via `--body-file`; when closing, post the prepared comment before closing without an inline multiline body.
+## Workflow
+
+### 1. Fetch issue context
+
+```bash
+gh issue view <N> --repo <owner/repo> --json title,body,state,comments,labels,updatedAt
+```
+
+Read the issue body to understand what was requested. Extract:
+- The specific feature/fix/behavior described.
+- Any linked PRs or commits mentioned in the body or comments.
+- Any checklist items or sub-issues.
+
+Resolve the issue repository and implementation repository separately (for example, `rustfs/backlog` tracks work in `rustfs/rustfs`). Pass the implementation repository explicitly to PR queries; the current checkout may belong to another repository.
+
+### 2. Search for related work
+
+Search git history for commits referencing the issue:
+```bash
+git log --oneline --all --grep="<N>" | head -30
+```
+
+Search for related PRs:
+```bash
+gh pr list --repo <implementation-repo> --search "<issue-url>" --state all --json number,title,state,mergedAt
+```
+
+Also search qualified issue references and subject keywords; for same-repository
+issues, include `#<N>`. Follow explicit links even without a text match. A search
+page with no match does not prove the work is absent.
+
+If the issue mentions specific PRs, check their status:
+```bash
+gh pr view <PR_N> --repo <implementation-repo> --json state,mergedAt,title,mergeCommit,baseRefName
+```
+
+### 3. Verify implementation
+
+Fetch the implementation repository's current base branch. For each merged candidate, verify its merge commit is present and inspect the current code for the claimed behavior; a commit message match alone is not proof:
+```bash
+git fetch <implementation-remote> <base-branch>
+git merge-base --is-ancestor <merge-commit> <implementation-remote>/<base-branch>
+```
+
+If the issue describes a specific defect, inspect the fetched base's code rather than assuming the current checkout contains it:
+```bash
+git show <implementation-remote>/<base-branch>:crates/<relevant>/src/<file>.rs
+```
+
+For issues with checklists, verify each item individually. If sub-items are tracked as separate issues, check those too:
+```bash
+gh issue view <SUB_N> --repo <owner/repo> --json state
+```
+
+### 4. Determine verdict
+
+- **All items fixed and merged**: Recommend closing; name the verified PRs and behavior.
+- **Some items fixed, some remaining**: Keep open; report each remaining item.
+- **Not yet implemented**: Keep open; report what remains.
+- **Superseded or no longer relevant**: Recommend closing with evidence.
+
+### 5. Take action
+
+For a status-only request, return the assessment without GitHub writes. If commenting, closing, or label edits are authorized, perform only those actions; do not ask again for authority already given. Prepare the final assessment before asking for any missing authority. Write `rustfs/backlog` issue content in Chinese.
+
+Close with comment:
+```bash
+gh issue close <N> --repo <owner/repo> --comment "<body>"
+```
+
+Comment without closing:
+```bash
+gh issue comment <N> --repo <owner/repo> --body-file /tmp/triage.md
+```
+
+Update labels only when label changes are authorized, using existing repository labels; never add tool-specific labels:
+```bash
+gh issue edit <N> --repo <owner/repo> --add-label "<existing-label>"
+```
+
+Always use `--body-file` for multiline content, never inline `--body`.
+
+### 6. Handle multi-issue batches
+
+When the user asks to check multiple issues (e.g., "check all issues by user X" or "scan backlog for closable issues"):
+1. List the full requested scope with pagination (for example `gh api --paginate 'repos/<repo>/issues?state=open&per_page=100'`, excluding entries with `pull_request`). Add an author filter only when the user requested one; the default page/limit is not evidence that all issues were checked.
+2. For each issue, run steps 1-5 above.
+3. Report a summary table of all triaged issues with verdicts.
+
+## Report
+
+Identify the issue and current state, verified implementation/PR evidence,
+remaining items, verdict, and action actually taken. Use a table for batches;
+a single issue does not require a heading for each field. Follow step 4's
+verdicts without repeating the assessment in another template.
+
+## Notes
+
+- The user may ask in Chinese ("是否可以关闭", "检查完成情况"); respond in the same language.
+- When closing, always include a summary of what was fixed and which PRs resolved it — this creates a useful audit trail.
+- For issues in `rustfs/backlog`, use `--repo rustfs/backlog`.
+- For issues in `rustfs/rustfs`, use `--repo rustfs/rustfs`.
+- If the issue has sub-issues (GitHub sub-issues API), check each one's state before declaring the parent complete.

.agents/skills/plugin-contract-guard/SKILL.md

@@ -16,28 +16,68 @@ The "plugin system" spans four surfaces that must stay consistent:
 
 ## Hard invariants (verify before merging)
 
-1. **Secrets have one source of truth.** Secret config keys are declared only in the plugin manifest (`TargetPluginManifest.secret_fields`, `crates/targets/src/manifest.rs`) and flow to admin via `AdminTargetSpec.secret_fields`. Never add a hand-maintained per-service secret table in a handler; if redaction misses a field, fix the manifest.
+1. **Secrets have one source of truth.** Secret config keys are declared only
+   in the plugin manifest (`TargetPluginManifest.secret_fields`,
+   `crates/targets/src/manifest.rs`) and flow to admin via
+   `AdminTargetSpec.secret_fields`. Never add a hand-maintained per-service
+   secret table in a handler; if redaction misses a field, fix the manifest.
 
-2. **Redaction must round-trip.** Instance GET responses replace secret values with `***redacted***` (`REDACTED_SECRET_VALUE` in `plugins_instances.rs`). Instance PUT restores the stored secret when it receives that placeholder back (`restore_redacted_secret_values`). Any new read or write path for target config must keep both halves: redact on the way out, restore the placeholder on the way in. The placeholder literal must never be persisted.
+2. **Redaction must round-trip.** Instance GET responses replace secret values
+   with `***redacted***` (`REDACTED_SECRET_VALUE` in `plugins_instances.rs`).
+   Instance PUT restores the stored secret when it receives that placeholder
+   back (`restore_redacted_secret_values`). Any new read or write path for
+   target config must keep both halves: redact on the way out, restore the
+   placeholder on the way in. The placeholder literal must never be persisted.
 
-3. **Fixtures never reach production responses.** `example_external_webhook_plugin()` (`crates/targets/src/catalog/mod.rs`) is a test/demo fixture for control-plane planning tests. Production catalog/extension handlers must not include it; regression tests (`plugin_catalog_never_exposes_example_or_external_fixtures`, `extension_catalog_never_exposes_example_or_external_fixtures`) enforce it.
+3. **Fixtures never reach production responses.**
+   `example_external_webhook_plugin()` (`crates/targets/src/catalog/mod.rs`)
+   is a test/demo fixture for control-plane planning tests. Production
+   catalog/extension handlers must not include it; regression tests
+   (`plugin_catalog_never_exposes_example_or_external_fixtures`,
+   `extension_catalog_never_exposes_example_or_external_fixtures`) enforce it.
 
-4. **External plugin flow is planning-only and deny-by-default.** `plan_external_target_plugin_action` returns decisions, it executes nothing. `TargetPluginExternalFlowGate::default()` is fully closed and `TargetPluginInstallPolicy::default().allowed_download_hosts` is empty — keep it that way; tests opt in via explicit policies. Install validation requires https, an allowlisted host, a full 64-hex-char sha256 digest, signature and provenance URIs, and an artifact matching the host `target_triple`.
+4. **External plugin flow is planning-only and deny-by-default.**
+   `plan_external_target_plugin_action` returns decisions, it executes
+   nothing. `TargetPluginExternalFlowGate::default()` is fully closed and
+   `TargetPluginInstallPolicy::default().allowed_download_hosts` is empty —
+   keep it that way; tests opt in via explicit policies. Install validation
+   requires https, an allowlisted host, a full 64-hex-char sha256 digest,
+   signature and provenance URIs, and an artifact matching the host
+   `target_triple`.
 
-5. **Custom target types must not collide.** Unknown target types get an interned unique `custom:<type>` plugin id (`custom_plugin_id` in `manifest.rs`). Custom plugins with secrets must register via `TargetPluginDescriptor::with_manifest` and declare `secret_fields`; `::new` derives a manifest with no secrets.
+5. **Custom target types must not collide.** Unknown target types get an
+   interned unique `custom:<type>` plugin id (`custom_plugin_id` in
+   `manifest.rs`). Custom plugins with secrets must register via
+   `TargetPluginDescriptor::with_manifest` and declare `secret_fields`;
+   `::new` derives a manifest with no secrets.
 
 ## Changing the admin JSON contract
 
-- Shapes are locked twice in `plugin_contract.rs` tests: insta snapshots (`rustfs/src/admin/snapshots/`) plus literal `json!` assertions. Update both deliberately; a shape change is a console-facing API change.
-- Field naming is `snake_case`, except discovery blocks (`runtimeCapabilities`, `clusterSnapshot`, `extensionsCatalog`) which are camelCase **by cross-endpoint convention** (same shape in `system.rs`, `console.rs`, `pools.rs`). Do not "fix" that inconsistency locally.
-- Contract types deliberately duplicate `rustfs_targets` types (anti-corruption layer). Add a `From` impl; do not serialize internal types directly.
+- Shapes are locked twice in `plugin_contract.rs` tests: insta snapshots
+  (`rustfs/src/admin/snapshots/`) plus literal `json!` assertions. Update
+  both deliberately; a shape change is a console-facing API change.
+- Field naming is `snake_case`, except discovery blocks
+  (`runtimeCapabilities`, `clusterSnapshot`, `extensionsCatalog`) which are
+  camelCase **by cross-endpoint convention** (same shape in `system.rs`,
+  `console.rs`, `pools.rs`). Do not "fix" that inconsistency locally.
+- Contract types deliberately duplicate `rustfs_targets` types
+  (anti-corruption layer). Add a `From` impl; do not serialize internal
+  types directly.
 
 ## Handler conventions
 
-- Every new admin plugin/extension route needs authorization at the top of `call` and an `include_str!` guard test asserting it (repo-wide pattern — see `plugin_instance_handlers_require_admin_authorization_contract`). The source guard checks wiring, not runtime authorization; use focused behavior evidence for changed allow/deny semantics.
-- Reads use `GetBucketTargetAction` (instances) or `ServerInfoAdminAction` (catalogs); writes use `SetBucketTargetAction`.
-- Refresh persisted module switches once per request (`refresh_persisted_module_switches`), then evaluate the sync `module_disabled_block_reason` per domain — do not re-read the store per domain or per instance.
+- Every new admin plugin/extension route needs authorization at the top of
+  `call` and an `include_str!` guard test asserting it (repo-wide pattern —
+  see `plugin_instance_handlers_require_admin_authorization_contract`).
+- Reads use `GetBucketTargetAction` (instances) or `ServerInfoAdminAction`
+  (catalogs); writes use `SetBucketTargetAction`.
+- Refresh persisted module switches once per request
+  (`refresh_persisted_module_switches`), then evaluate the sync
+  `module_disabled_block_reason` per domain — do not re-read the store per
+  domain or per instance.
 
 ## Generic bounds
 
-Event-payload generics use the `PluginEvent` blanket trait (`crates/targets/src/plugin.rs`). Do not respell `Send + Sync + 'static + Clone + Serialize + DeserializeOwned`.
+Event-payload generics use the `PluginEvent` blanket trait
+(`crates/targets/src/plugin.rs`). Do not respell
+`Send + Sync + 'static + Clone + Serialize + DeserializeOwned`.

.agents/skills/pr-review/SKILL.md

@@ -1,20 +1,93 @@
 ---
 name: pr-review
-description: Review a GitHub PR using its exact base/head and repository risk policy. Use for requested PR reviews; publish or fix only within conversation authorization.
+description: Review a GitHub PR from a URL or number using its actual base/head and risk-appropriate code review. Use when the user asks for a PR review, not a status lookup or PR wording edit. Publish a review only when authorized; delegation and monitoring follow the requested scope and root AGENTS.md.
 ---
+
 # PR Review
 
-1. Resolve the PR repository and remote; the current checkout may belong elsewhere. Read the PR purpose and linked issues, then fetch the actual base and PR head:
+Use this skill for PR context and review delivery. An ordinary review request is read-only unless the conversation also authorizes posting or fixes. Reuse that authorization without asking again; prepare the review before requesting any missing publication approval.
 
-   ```bash
-   gh pr view <N> --repo <owner/repo> --json title,author,state,body,baseRefName,headRefName,baseRefOid,headRefOid
-   git fetch <repo-remote> <baseRefName> refs/pull/<N>/head
-   git diff <baseRefOid>...<headRefOid>
-   ```
+## Prerequisites
 
-   Record both SHAs; refresh if either moved during fetching. Follow relevant [implementation boundaries](../../references/implementation.md).
-2. Apply the [risk policy](../../references/adversarial-validation.md), including its two perspectives for high-risk work. Ordinary reviews use the root finding standard directly. File count does not determine risk or authorize delegation; keep any delegated review within the authorized scope.
-3. Check `gh pr checks <N> --repo <owner/repo>`. Investigate failures when relevant to a finding or a requested CI/readiness diagnosis. Distinguish pending, unavailable, pre-existing, flaky, and PR-caused states using evidence; a code review does not authorize unrelated repairs.
-4. Report the reviewed SHAs, risk tier, supported findings or `No findings`, material verification limits, check state, and verdict. Set severity from evidenced impact, triggering conditions, reach, and urgency: P0 is a critical issue requiring immediate action with broad or unavoidable impact; P1 is a high-impact defect requiring prompt correction; P2 is an ordinary concrete correctness, compatibility, performance, or maintainability defect; P3 is an optional improvement only when requested. A remote trigger, crash, or deadlock does not by itself establish P0. P0/P1 findings block approval; evaluate other findings and verification gaps against the actual acceptance requirements rather than approving automatically below that threshold.
-5. When posting is authorized, follow [Git and PR rules](../../references/pull-requests.md), recheck the remote base and head, and review any changed diff or integration assumptions before submitting. Reuse unaffected evidence. Use `gh pr review` with `--approve`, `--request-changes`, or `--comment` and `--body-file`; use [the API example](references/posting.md) for authorized inline comments. Reuse existing authorization.
-6. Follow the repository PR lifecycle and explicit monitoring scope. Fetch new heads before comparing to the reviewed SHA; never rely on an unfetched `origin/pull/<N>/head`. Push fixes or resolve threads only when authorized; check `maintainerCanModify` before a fork push.
+- Follow root `AGENTS.md`; classify risk with the [review policy](../../references/adversarial-validation.md) and consult relevant [change-style and boundary rules](../../references/implementation.md).
+- Select `code-change-verification` for ordinary review or `adversarial-validation` for explicitly adversarial, substantial, or high-risk review; do not run both on the same diff.
+
+## Workflow
+
+### 1. Gather PR context
+
+```bash
+gh pr view <N> --repo <owner/repo> --json title,author,state,body,additions,deletions,changedFiles,commits,baseRefName,headRefName,baseRefOid,headRefOid
+gh pr diff <N> --repo <owner/repo> --name-only
+```
+
+Read the PR body and linked issues to understand the change's purpose. If the PR references an issue, fetch that too:
+```bash
+gh issue view <ISSUE> --repo <issue-owner/repo> --json title,body,state
+```
+
+### 2. Fetch the diff and classify the change
+
+```bash
+git fetch <repo-remote> <baseRefName> refs/pull/<N>/head
+git diff <baseRefOid>...<headRefOid> --stat
+```
+
+Resolve `<repo-remote>` to the PR repository; do not assume the current checkout's `origin` or `main` matches. Record the exact base/head used. If either moved during fetching, refresh the snapshot before reviewing. Classify using the repository review policy; instruction changes that affect agent execution are mechanical, not exempt.
+
+### 3. Review the changed behavior
+
+Group files by functional area to trace callers and invariants. Use the root risk tier's review shape and only matching lenses. File count does not authorize delegation. When delegation is explicitly authorized, high-risk/substantial reviews use exactly two independent reviewers with the applicable lenses split between them; otherwise use two fresh sequential passes. Reviewers do not spawn further agents.
+
+Findings need a concrete failure scenario with `file:line`; a null verdict briefly names the relevant probes. Reuse existing evidence and choose local checks from the final diff under the root verification policy.
+
+### 4. Check CI status
+
+```bash
+gh pr checks <N> --repo <owner/repo>
+```
+
+Investigate a failed check when it bears on a finding or the user requested CI diagnosis/merge readiness:
+```bash
+gh run view --repo <owner/repo> --log-failed --job=<JOB_ID>
+```
+
+Use current evidence to distinguish pre-existing, flaky, and PR-caused failures. Do not classify them by guesswork or turn a code-only review into unrelated CI repair.
+
+### 5. Synthesize findings
+
+Report the PR, reviewed base/head, and risk tier, then summarize the assessment.
+Use the selected review's P0–P3 ratings and root finding standard: supported
+findings with `file:line`, failure scenario, and fix, or `No findings`.
+State the observed check status, including pending or unavailable checks, and
+the verdict (`APPROVE`, `REQUEST_CHANGES`, or `COMMENT`). Do not infer a pass
+from missing checks or add style nits to populate a clean review.
+
+### 6. Post the review
+
+Only when posting is authorized, write the review body to a temp file and post via CLI. Refresh the PR head first; if it changed, review the delta and update the verdict before posting:
+```bash
+# Request changes
+gh pr review <N> --repo <owner/repo> --request-changes --body-file /tmp/pr_review.md
+
+# Approve
+gh pr review <N> --repo <owner/repo> --approve --body-file /tmp/pr_review.md
+
+# Comment only (no verdict)
+gh pr review <N> --repo <owner/repo> --comment --body-file /tmp/pr_review.md
+```
+
+For authorized inline comments, use [the submission example](references/posting.md).
+
+Always use `--body-file` or `--input`, never inline multiline `--body`.
+
+### 7. Handle follow-up
+
+Follow the [PR lifecycle](../../references/pull-requests.md) and any explicit monitoring request. For follow-up, fetch the new head and compare the recorded reviewed SHA with the new SHA; revisit affected callers and findings. Never use an unfetched `origin/pull/<N>/head` ref as evidence. Update the posted review or resolve addressed threads only within existing authorization.
+
+## Notes
+
+- The user may ask for review in Chinese; respond in the same language but keep the review body in English per AGENTS.md rules.
+- When the user asks for "多角色对抗 review", run the full adversarial validation protocol — this skill's step 3 covers that.
+- If the PR is from a fork, check `maintainerCanModify` before attempting to push fixes.
+- For very large PRs, batch the review by functional area while keeping the same bounded review shape.

.agents/skills/pr-review/references/posting.md

@@ -4,20 +4,19 @@ Read only when an inline review is authorized. Recheck the PR head before postin
 
 For inline comments on specific lines, use the GitHub API:
 ```bash
-REVIEW_PAYLOAD=$(mktemp "${TMPDIR:-/tmp}/pr-review.XXXXXX")
-cat > "$REVIEW_PAYLOAD" <<'EOF'
+cat > /tmp/pr_review.json <<'EOF'
 {
   "commit_id": "<reviewed-head-sha>",
   "body": "review body",
   "event": "REQUEST_CHANGES",
   "comments": [
     {
-      "path": "crates/<crate>/src/<file>.rs",
+      "path": "crates/foo/src/bar.rs",
       "line": 42,
       "body": "finding description"
     }
   ]
 }
 EOF
-gh api --method POST /repos/{owner}/{repo}/pulls/<N>/reviews --input "$REVIEW_PAYLOAD" && rm -f "$REVIEW_PAYLOAD"
+gh api --method POST /repos/{owner}/{repo}/pulls/<N>/reviews --input /tmp/pr_review.json
 ```

.agents/skills/rust-code-quality/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: rust-code-quality
+description: Run a focused Rust quality review when the user requests one or a selected review workflow needs Rust-specific checks for changed behavior. Do not auto-load for every implementation edit, comment-only or formatting-only Rust diff, or repeat an already completed review.
+---
+
+# Rust Code Quality Gate
+
+Use this skill for a dedicated Rust review to cover rules that `cargo clippy`
+does not catch.
+
+Search matches and checklist items are candidates, not findings. Apply the root
+finding standard; distinguish a demonstrated bug, an explicit rule violation,
+and an optional preference. P2/P3 suggestions do not need to be invented or
+included in an otherwise clean correctness review.
+
+## Quick Start
+
+1. Identify changed `.rs` files.
+2. Run the matching candidate searches on changed files.
+3. Apply the manual checklist sections whose behavior the diff touches.
+4. Report or rebut every finding with evidence; P0/P1 findings block approval.
+   Fix them when implementation is authorized; a read-only review reports them.
+
+## Automated Checks
+
+Use these searches to find candidates in changed `.rs` files. Inspect syntax,
+`#[cfg(test)]` scope, and the changed hunk before reporting a finding; text
+filters do not reliably distinguish production code from tests.
+
+```bash
+# 1. unwrap/expect candidates
+rg -n '\.unwrap\(\)|\.expect\(' <changed-files>
+
+# 2. Silent type truncation via `as` cast
+rg -n ' as (u8|u16|u32|u64|usize|i8|i16|i32|i64|isize)\b' <changed-files>
+
+# 3. String as error type
+rg -n 'Result<.*String>' <changed-files>
+
+# 4. Box<dyn Error> in public APIs
+rg -n 'Box<dyn.*Error' <changed-files>
+
+# 5. println/eprintln in production
+rg -n 'println!|eprintln!' <changed-files>
+
+# 6. Ordering::Relaxed usage (verify each is intentional)
+rg -n 'Ordering::Relaxed' <changed-files>
+
+# 7. Default substituted for a possibly-required value (judge each: is the value optional by domain?)
+rg -n 'unwrap_or_default\(\)|unwrap_or\(' <changed-files>
+```
+
+## Manual Review Checklist
+
+For the Rust diff under review, verify:
+
+### Error Handling
+- [ ] Every production `unwrap()` or `expect()` is infallible by type or a checked invariant; explain only non-obvious invariants, using an existing type, a useful `expect` message, or a concise comment
+- [ ] No `Result<_, String>` in public API signatures
+- [ ] Public library APIs use domain errors unless deliberate error erasure at a boundary is part of the contract
+- [ ] `Error::source()` is overridden when inner error is stored
+- [ ] Error messages are actionable without exposing secret input
+
+### Type Safety
+- [ ] No silent `as` truncation (negative→unsigned, large→small)
+- [ ] Fallible numeric conversions use `TryFrom`/`try_into()` and return a typed error; clamp or saturate only when the domain explicitly requires it
+- [ ] Floating-point to integer conversion validates finiteness, sign, and range before conversion
+
+### Concurrency
+- [ ] Lock acquisition order is documented when multiple locks are used, and matches every other call site taking any overlapping subset (ABBA check)
+- [ ] No `tokio::sync` lock guard (read or write) held across `.await` without bounded hold time — long-lived read guards wedge writers (#4195)
+- [ ] Atomic read-modify-write uses the direct `fetch_*` operation when possible; use `compare_exchange` only for conditional updates
+- [ ] `std::sync::Mutex` in async context is held only briefly, never across `.await`
+
+### Memory and Performance
+- [ ] On an identified hot path, report cloning or allocation only with a concrete per-request/per-object cost or benchmark signal
+- [ ] Prefer borrowing, moving, `Bytes`/`Arc`, or capacity reservation only when it reduces that cost without obscuring ownership or APIs
+
+### Recursion Safety
+- [ ] Recursion over untrusted, persisted, or otherwise unbounded input has a depth limit or uses iterative traversal
+- [ ] Tree/cache traversals handle corrupted/cyclic input safely
+
+### Testing
+- [ ] Tests have an observable failure criterion; delegated assertions, `#[should_panic]`, snapshot/property checks, and meaningful `Result` failures do not need a redundant `assert!`
+- [ ] Use `expect` only when its message improves failure diagnosis; do not add boilerplate to self-evident test setup
+- [ ] Test volume and line count are never treated as production-code growth
+
+### Serde
+- [ ] Structs from untrusted input reject unknown fields where the compatibility contract permits; otherwise validate security-critical fields explicitly and test the supported input shape
+- [ ] `#[serde(default)]` not used on security-critical fields without validation
+
+### Code Hygiene
+- [ ] No `#![allow(dead_code)]` at crate root
+- [ ] No camelCase statics or Hungarian notation
+- [ ] New string literals don't duplicate existing constants
+
+### Reuse and Necessity
+- [ ] No new helper duplicates `crates/utils`, `crates/common`, the touched crate, the likely domain-owning crate, a relevant direct dependency, or plain std/tokio behavior; reused helpers match the call site's semantics
+- [ ] No branch without a nameable concrete trigger; no re-validation of what a validated upstream layer on the same path already guarantees (Cross-Cutting Domain Invariant patterns and pre-destructive-action re-checks are load-bearing — keep them)
+- [ ] Error context attached once where actionable, not re-wrapped at every hop; no typed→generic error conversion below aggregation/quorum layers
+- [ ] Comments avoid narration and change history while completely stating non-obvious lock, `SAFETY`, durability, compatibility, and unwrap invariants
+- [ ] No near-duplicate test pinning the same code path and poison-value class as an existing test (boundary companions — n==max vs max+1, absent/empty/nil UUID — are never near-duplicates)
+
+## Severity Classification
+
+- **P0 (Block merge)**: demonstrated data loss, security breach, remote crash, or deadlock
+- **P1 (Must fix)**: concrete correctness, compatibility, or material hot-path regression
+- **P2 (Should fix)**: avoidable duplication or maintainability issue with a concrete simpler replacement
+- **P3 (Nice to fix)**: local style or clarity issue with no behavioral risk
+
+## Output Template
+
+Use the calling review's output format. For a standalone review, report supported
+findings with severity, location, impact, fix, and validation, or `No findings`.
+Include only material unverified checks. Candidate counts are not a quality
+metric and do not need a separate scan report.

.agents/skills/rustfs-logging-governance/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: rustfs-logging-governance
+description: Add or review RustFS `tracing` events with the repository field shape, level policy, privacy boundaries, and guardrails. Use when a change adds or edits a tracing macro/instrumentation site or the logging guardrail script.
+---
+
+# RustFS Logging Governance
+
+Apply this skill only to changed logging sites; do not turn a local log edit into
+a broad logging cleanup.
+
+## Workflow
+
+1. Read the changed function/module context and classify the site as lifecycle,
+   request/hot path, fallback, external fetch, or summary.
+2. Match neighboring structured events and reuse existing `EVENT_*`,
+   `LOG_COMPONENT_*`, and `LOG_SUBSYSTEM_*` constants.
+3. Put stable fields first (`event`, `component`, `subsystem`, `state`/`result`,
+   then context) and a short label last.
+4. Select the level by operational meaning:
+   - `error`: behavior/security-affecting failure;
+   - `warn`: degraded/fallback/operator-actionable state;
+   - `info`: low-frequency lifecycle/mode change;
+   - `debug`: targeted diagnostics;
+   - `trace`: repetitive request/object/shard success paths.
+5. Never log secrets, tokens, auth headers, credential payloads, raw
+   attacker-controlled bodies, or merged config dumps. Error strings and
+   `Debug` output are log surfaces too.
+6. Prefer one aggregate summary over inventories or startup banners.
+7. Run `./scripts/check_logging_guardrails.sh` and the checks selected by root
+   `AGENTS.md`.
+
+Read [logging-governance.md](references/logging-governance.md) only for a broad
+logging audit, event-model migration, or guardrail expansion. Ordinary single-
+site edits do not require the full workspace scope map.

.agents/skills/rustfs-logging-governance/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "RustFS Logging Governance"
+  short_description: "Standardize RustFS logs with structured events and guardrails."
+  default_prompt: "Use $rustfs-logging-governance to standardize or review RustFS logging, reduce noise, and update guardrails."

.agents/skills/rustfs-logging-governance/references/logging-governance.md

@@ -1,6 +1,5 @@
 # Logging Audit and Migration Reference
 
-Use the [root logging rules](../../AGENTS.md#logging) for individual events.
 Read this reference only for a broad logging audit, an event-model migration,
 or a change to `scripts/check_logging_guardrails.sh`. Use `Cargo.toml` for the
 current workspace/crate list instead of maintaining one here.

.agents/skills/rustfs-release-publish/SKILL.md

@@ -1,38 +1,156 @@
 ---
 name: rustfs-release-publish
-description: Publish a RustFS version through frozen Linux candidate acceptance, desktop completion, manifest approval, byte-preserving publication and post-release follow-up. Use only for an explicit release request.
+description: "Run the end-to-end RustFS console gate, version bump, preview validation, human confirmation, and final-tag publication pipeline. Use only when the user explicitly asks to release or publish a RustFS version (发版/发布)."
 ---
-# RustFS Release
+# RustFS Release Publish (preview-validated pipeline)
 
-Require the exact final SemVer target before version edits or publication. If unspecified, inspect releases/tags and ask with concrete candidates; do not guess the channel or bump. Reuse the user's confirmed target and authorized delivery scope. Independent read-only preflight may continue.
+This skill orchestrates a full release. It wraps `rustfs-release-version-bump` (invoked here with the authorized commit/push/PR scope) with a mandatory preview-tag validation loop before the final tag is published.
 
-## Invariants
+The binary reports its build tag (`build::TAG` via shadow_rs; `SHORT_VERSION` in
+`rustfs/src/config/cli.rs`), and `build.yml` derives asset names and preview
+classification from that tag. Cargo.toml supplies only the no-tag fallback.
+Preview and final tags must therefore share the validated source commit;
+their tag-dependent version and asset names differ. The channel and cleanup
+constraints are defined once under Preview tag naming and Hard rules below.
 
-- Cargo and every candidate executable contain the final product version. `<target>-preview.<run_number>` is an immutable candidate identifier, not a public tag or displayed binary version.
-- Freeze the exact source, reviewed workflow recipe, toolchain, Console, CLI, dependency lock, previous stable version and validation plan. Newer unrelated main or Console releases do not change those inputs.
-- Retain `release/<target>` history when a release branch is used; backport only reviewed fixes. Pin `CANDIDATE_SHA` to its exact CI-validated commit. Never force-push a release branch or move a public tag.
-- Build Linux first. Complete field acceptance before macOS/Windows and packaging. Full certification and final acceptance are required before publication; a partial Linux PASS grants no release authority.
-- Promote the accepted bytes. Final publication never recompiles binaries or rebuilds packages/images. Infrastructure retries reuse successful artifacts; changed source or inputs require a new candidate and affected acceptance.
-- Phase failures block dependents. No latest/default-channel update before versioned delivery. Use the [pipeline runbook](../../../docs/operations/release-pipeline.md) for executable entry points, locks and recovery.
+Pipeline shape:
 
-## Read by phase
+```
+check console main against its latest Release
+  -> if ahead: publish console -> wait for Release asset + latest API
+  -> bump RustFS version files to <target> (final version, ONE commit) -> merge
+  -> tag <preview-tag> at that commit -> CI green
+  -> verify preview Release assets -> run binary locally + console checks
+  -> validate with latest rc client
+  -> report preview acceptance results -> STOP for explicit human confirmation
+  -> tag <target> at the SAME commit (zero delta) -> re-verify CI/release
+  -> CI deletes the <target>-preview.N Releases (tags kept)
+```
 
-| Phase | Procedure |
-|---|---|
-| 0 | Clean tree, fetch main/tags, verify access, then complete the mandatory [Console gate](references/console-gate.md). |
-| 1–2 | [Prepare the exact source and run branch CI](references/release-candidate.md). Version edits use `rustfs-release-version-bump`. |
-| 3 | [Build and verify the Linux candidate](references/preview-release.md). |
-| 4–5 | [Run artifact, field, Console and rc acceptance](references/preview-acceptance.md), then complete desktop/package/image/chart validation. |
-| Confirmation | Report the complete manifest and obtain the confirmation below. |
-| 6 | [Publish the accepted manifest](references/final-release.md). |
-| 7 | [Reconcile advisories, milestones, installation references, website and release branch](references/post-release-updates.md). |
+On validation failure: fix lands on main via normal PR (version files are already at `<target>`, no new bump PR), then tag `<preview-tag N+1>` at the new main commit and restart from Phase 2.
 
-## Human confirmation
+## Required inputs
 
-After all acceptance passes, report the target, source SHA, source CI run, Linux and completion run URLs, final manifest SHA-256, accepted Console/CLI identities, compatibility/performance results and backlog report. Explicitly ask whether to publish this exact manifest and end the turn without dispatching publication.
+- Final target version, for example `1.0.0-beta.10`.
+- Preview iteration `N` (default: next unused preview tag for that target; check with `git tag -l '<target>-preview.*'` after `git fetch --tags`).
 
-Only a new affirmative reply to that exact report authorizes Phase 6. An earlier general release request, silence or automatic continuation does not count. Reuse confirmation for retries of that same manifest; do not ask again merely because a destination failed. A changed source, input, manifest or acceptance result invalidates it and requires renewed acceptance/confirmation.
+If the target version is missing or ambiguous, collect the current release/tag baseline and ask before version edits or publication. Continue independent read-only preflight while the answer is pending (see the semver gate below).
 
-## Recovery and reporting
+## Semver gate — resolve the target before version edits or publication
 
-Resume failed infrastructure jobs without rebuilding successful units. Fix product defects on main, backport when needed, and start a new candidate. After a final tag exists, retry the same bytes or use a new patch version; never move the tag. Do not conflate implemented, CI-passed, field-accepted, approved, published and post-release-complete states. Report incomplete work and deviations with evidence; a tag or green build alone is not a completed release.
+Versions follow [SemVer 2.0.0](https://semver.org/). Precedence reminder:
+
+```
+1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0 < 1.0.1 < 1.1.0 < 2.0.0
+```
+
+Numeric prerelease identifiers compare numerically (`beta.9 < beta.10`), not lexically — see [semver.org spec item 11](https://semver.org/#spec-item-11). Preview tags are internal validation tags layered on top of the target's prerelease channel — they are never themselves a deliverable version and never appear in version files.
+
+Rules:
+
+- A request like "发个版" / "release the next version" without an exact version string is ALWAYS ambiguous. Derive the current latest tag (`git tag --sort=-v:refname | head`), then ask the user to choose with concrete candidates, e.g. from `1.0.0-beta.10`: next prerelease `1.0.0-beta.11`, promote to `1.0.0-rc.1`, promote to stable `1.0.0`. Never guess between these — they have very different meanings (channel promotion vs. iteration) and different CI classification consequences.
+- After a stable `X.Y.Z` exists, the next version must state which component bumps: patch `X.Y.(Z+1)` for fixes only, minor `X.(Y+1).0` for backward-compatible features, major `(X+1).0.0` for breaking changes. If the user names a bump type but not a number, compute it from the latest stable tag and echo the exact resulting version back for confirmation.
+- Echo the final confirmed version string verbatim in your first status report; every later phase must use exactly that string. If at any point the user's wording and the confirmed version diverge, stop and re-confirm.
+
+## Preview tag naming
+
+- Use `<target>-preview.N` for every target, e.g. `1.0.0-beta.10-preview.3` or `1.1.0-preview.1`.
+- The canonical suffix is exactly `-preview.<digits>`. `build.yml` recognizes it before alpha/beta/rc classification and routes it to the preview-only path; any other tag containing `-preview` fails closed instead of being treated as a release.
+- A preview Release MUST be published with `isPrerelease=true` and `isLatest=false`. Any `*-latest` preview asset or preview-triggered `latest.json`, R2, Docker, or Helm publication is a pipeline failure.
+- Preview Releases are cleaned up by the `cleanup-preview-releases` job after `publish-release` succeeds for the deliverable tag. It deletes every Release whose tag is exactly `<target>-preview.<digits>` and never passes `--cleanup-tag`, so the tags survive.
+
+## Hard rules
+
+- Version files (Cargo.toml, Cargo.lock, README, flake.nix, Chart.yaml, rustfs.spec) are bumped ONCE, directly to `<target>`. Never write a `-preview.N` suffix into any version file. If `rustfs-release-version-bump` is ever asked for a `-preview` version, that is a pipeline bug — stop.
+- Preview Release assets are versioned and intentionally visible on the Releases page for the duration of validation. Do not label them Latest or use them to update any latest distribution channel.
+- Never delete a preview Release by hand before Phase 6 finishes — Phase 4 downloads its assets and the final Release notes are generated while it still exists. Cleanup is CI's job; only step in manually (`gh release delete "<preview-tag>" --yes`, never `--cleanup-tag`) if `cleanup-preview-releases` failed.
+- Tags have no `v` prefix. Always annotated: `git tag -a <tag> -m "Release <tag>"`.
+- The final tag MUST point at exactly `PREVIEW_HASH` — the commit the validated preview tag points at. Never tag current `main` HEAD (commits merged after validation are unvalidated), and never create an extra version-bump commit between preview and final.
+- When a previous deliverable exists, GitHub Release notes for the preview and final tags MUST use it as their shared comparison baseline: the most recently published non-preview Release before the target. Internal `-preview.N` Releases are explicitly excluded from that selection, even when they point at the same commit as the final tag — cleanup runs after the notes are generated, so the preview Release is still present and would otherwise be picked as the baseline. If no previous deliverable exists, omit `previous_tag_name` and record that GitHub's default baseline fallback was used.
+- Generated Release notes carry a workflow-management marker so retries can repair them. Before manually curating a generated body, remove that marker; unmarked non-placeholder notes are preserved by later workflow runs.
+- Phases run in order; a failure in any phase blocks everything after it. After the fix lands on main, restart from Phase 2 with the next preview iteration against the new `origin/main` hash — do not resume mid-pipeline against a stale hash.
+- Completing preview acceptance does not authorize the final tag. After Phases 3–5 pass, report the acceptance evidence and stop until the user explicitly confirms continuation. The original release request, an earlier confirmation, silence, or an automated follow-up does not satisfy this gate.
+- Confirmation is scoped to the reported `<target>`, `<preview-tag>`, and `PREVIEW_HASH`. A failed or repeated acceptance cycle, including any new preview iteration, invalidates prior confirmation and requires a new one.
+- If the release is abandoned after Phase 1 merged, main's version files claim a version that was never tagged. Either revert the bump PR or leave it to be overwritten by the next release — but tell the user explicitly and record the decision.
+- User-facing status updates in Chinese; commits, PR titles/bodies, and tag messages in English. No hard-wrapping in commit messages, PR bodies, or documentation prose — one logical line per sentence/paragraph, let soft wrap handle display.
+
+## Phase 0 — Preflight
+
+- `git status --short` clean; `git fetch origin main --tags`.
+- `gh auth status` works; confirm you can view `gh release list -L 3`.
+- Confirm the exact final target version with the user if not explicit.
+
+### Console release gate
+
+Read and complete [the Console gate](references/console-gate.md) before Phase 1. Verify the latest published Console asset and exact commit; if Console main is ahead, complete its release and asset verification first. A successful build alone does not satisfy this gate.
+
+## Phase 1 — Version bump to the final target (once)
+
+- If main's version files already read `<target>` (e.g. this is a restart after a failed preview), verify with `rg -n "<target>" Cargo.toml rustfs.spec helm/rustfs/Chart.yaml` and skip to Phase 2.
+- Otherwise invoke the `rustfs-release-version-bump` skill with the final `<target>` (NOT a preview version), full GitHub flow (commit/push/PR).
+- Get the PR merged into main. Record the resulting main commit:
+
+```bash
+git fetch origin main
+PREVIEW_HASH=$(git rev-parse origin/main)   # must contain the bump PR
+```
+
+`PREVIEW_HASH` is the single source of truth for the rest of the pipeline — report it to the user and reuse it verbatim in Phases 2 and 6. Both the preview tag and the final tag will point at it.
+
+## Phase 2 — Publish the preview tag
+
+```bash
+git tag -a "<preview-tag>" -m "Release <preview-tag>" "$PREVIEW_HASH"
+git push origin "<preview-tag>"
+```
+
+Pushing the tag triggers `.github/workflows/build.yml` ("Build and Release"); `docker.yml` chains off it via `workflow_run`.
+
+The preview run builds versioned artifacts and publishes them in a GitHub prerelease. Its latest-channel, R2, Docker, and Helm jobs must be skipped. Those publication paths run only after the final tag is pushed.
+
+On a restart (N+1), refresh `PREVIEW_HASH=$(git rev-parse origin/main)` first — it must contain the fix — and re-report it.
+
+## Phase 3 — CI and preview Release verification
+
+- Find and watch the tag build: `gh run list --workflow build.yml --branch "<preview-tag>" --limit 1` then `gh run watch <run-id>`. Every build matrix target must succeed (linux x86_64/aarch64 × musl/gnu, macos-aarch64, windows-x86_64).
+- Confirm the Release publication jobs (`create-release`, `upload-release-assets`, and `publish-release`) succeed while `update-latest-version` is skipped.
+- Verify `gh release view "<preview-tag>" --json isPrerelease,assets,url`: `isPrerelease` must be `true`, and the Release must contain all 6 versioned platform zips, checksums, SBOM, and provenance with no `-latest` assets. Confirm `gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` does not return `<preview-tag>`.
+- Record `PREVIOUS_DELIVERABLE`, selected from published Releases by `publishedAt` after excluding the current tag and every `-preview.N` tag. Verify `gh release view "<preview-tag>" --json body --jq .body` contains `## What's Changed` and, when `PREVIOUS_DELIVERABLE` exists, `**Full Changelog**: https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<preview-tag>`. For a repository with no previous deliverable, verify a Full Changelog link exists and record the GitHub baseline fallback.
+- Confirm preview-triggered Docker and Helm jobs are skipped. Preview validation covers the built RustFS binaries, embedded console, and rc compatibility; Docker image construction and Helm publication are deferred to the final tag because the Dockerfiles consume GitHub Release assets.
+
+## Phases 4–5 — Local artifact, Console, and rc acceptance
+
+Read and complete [preview acceptance](references/preview-acceptance.md): verify the downloaded binary's tag/SHA and readiness, exercise Console CRUD with byte-identical download, and pass the full latest-rc command matrix. Any failure blocks final publication. Retain the results for the confirmation gate below.
+
+### Manual confirmation gate
+
+After every Phase 3–5 check passes, report the target, preview tag, `PREVIEW_HASH`, preview Release URL, console result, and rc matrix, then explicitly ask the user whether to publish the final tag. End the turn without creating or pushing `<target>`.
+
+Continue to Phase 6 only after a new user reply explicitly confirms the reported target, preview tag, and commit. A clear affirmative reply to that exact report, such as `确认继续`, is sufficient; if the reply is ambiguous or any reported value changed, ask again.
+
+## Phase 6 — Publish the final tag on the validated commit
+
+No second version bump, no release branch. The final tag goes on the exact commit the preview validated:
+
+```bash
+git fetch origin --tags
+git rev-parse "<preview-tag>^{commit}"          # must equal PREVIEW_HASH — abort if not
+git tag -a "<target>" -m "Release <target>" "$PREVIEW_HASH"
+git push origin "<target>"
+```
+
+- CI rebuilds from the same source; the only changed input is the tag name, so the binary now self-reports `<target>`.
+- Verify the final tag's complete publication path: all matrix and release jobs green; `gh release view "<target>"` shows the full versioned and `-latest` asset set plus checksums, SBOM, and provenance; Docker and Helm workflows succeed; `latest.json` points to `<target>`. A stable target must have `isPrerelease=false` and `isLatest=true`. An alpha/beta/rc target must have `isPrerelease=true`; GitHub does not permit prereleases to be Latest, but the project `latest.json` still advances to the final non-preview target.
+- Verify the final Release body contains `## What's Changed` and a Full Changelog link. When `PREVIOUS_DELIVERABLE` exists, the link MUST be `https://github.com/rustfs/rustfs/compare/<PREVIOUS_DELIVERABLE>...<target>` and the baseline MUST equal the preview Release baseline; for example, both `1.0.0-beta.12-preview.1` and `1.0.0-beta.12` compare from `1.0.0-beta.11`.
+- Verify the preview cleanup: `cleanup-preview-releases` must succeed, `gh release view "<preview-tag>"` must then report `release not found` for every preview iteration of this target, and `git rev-parse "<preview-tag>^{commit}"` must still resolve to `PREVIEW_HASH` (the tag is kept). If the job failed, delete the leftover Releases manually with `gh release delete "<preview-tag>" --yes` and report it.
+- Optionally spot-check `./rustfs --version` from a final-tag artifact — it must report `<target>`.
+
+## Output contract
+
+Always report:
+
+- Console gate result: previous/latest Console tags, whether merged changes required a release, `CONSOLE_HASH`, and Console run/Release URLs when a release was published.
+- Target version, preview tag(s) used, `PREVIEW_HASH` (which both tags point at).
+- Manual confirmation gate status (`WAITING_FOR_CONFIRMATION` or `CONFIRMED`) and its exact target, preview tag, and `PREVIEW_HASH`.
+- Per-phase result (PASS/FAIL/BLOCKED) with key evidence: preview and final Release URLs, preview `isPrerelease`/`isLatest` state, final latest-channel state, console check results, the rc command matrix, and the preview-Release cleanup result (deleted Releases plus surviving tags).
+- Any deviation from this pipeline and why the user approved it.

.agents/skills/rustfs-release-publish/references/console-gate.md

@@ -4,7 +4,7 @@ Read during Phase 0, before changing RustFS version files or tags. Follow the pa
 
 ### Console release gate
 
-Complete this gate before changing any RustFS version file or creating any RustFS tag. Candidate creation resolves `repos/rustfs/console/releases/latest` once and freezes the exact asset for every build, so a successful Console build alone is insufficient. After freezing, later Console releases do not silently change or invalidate the accepted inputs.
+Complete this gate before changing any RustFS version file or creating any RustFS tag. RustFS `build.yml` downloads the asset returned by `repos/rustfs/console/releases/latest`, so a successful Console build alone is insufficient.
 
 1. Read the latest published Console tag and compare it with Console `main`:
 
@@ -37,7 +37,7 @@ git -C "$CONSOLE_SCRATCH/console" tag -a "<console-tag>" -m "Release <console-ta
 git -C "$CONSOLE_SCRATCH/console" push origin "<console-tag>"
 ```
 
-Console tags include the `v` prefix. Pushing the tag triggers the Console repository's [release workflow](https://github.com/rustfs/console/blob/main/.github/workflows/release.yml) (`🚀 Release`). Remove the task-owned `CONSOLE_SCRATCH` after the gate completes.
+Console tags include the `v` prefix. Pushing the tag triggers `.github/workflows/release.yml` (`🚀 Release`). Remove `CONSOLE_SCRATCH` after the gate completes.
 
 3. Find the exact tag run and wait for completion:
 
@@ -55,4 +55,4 @@ test "$(gh api "repos/${CONSOLE_REPO}/releases/tags/<console-tag>" \
   --jq '[.assets[] | select(.name == "rustfs-console-<console-tag>.zip" and .state == "uploaded" and .size > 0 and (.digest | startswith("sha256:")))] | length')" -eq 1
 ```
 
-Treat a missing/mismatched asset, digest, latest tag, or failed/cancelled workflow as BLOCKED. Do not start Phase 1 until the Console gate passes. Record `CONSOLE_TAG`, `CONSOLE_HASH`, the asset URL/SHA256, Console run URL, and Release URL for comparison with the inputs actually consumed by the RustFS builds and the final report.
+Treat a missing/mismatched asset, digest, latest tag, or failed/cancelled workflow as BLOCKED. Do not start Phase 1 until the Console gate passes. Record `CONSOLE_TAG`, `CONSOLE_HASH`, Console run URL, and Release URL for the final report.

.agents/skills/rustfs-release-publish/references/final-release.md

@@ -1,13 +0,0 @@
-# Final release publication
-
-Read only after fresh confirmation of the complete candidate report. The [parent confirmation gate](../SKILL.md#human-confirmation) applies.
-
-Dispatch `release-publish.yml` on main with the successful completion run ID and approved `release-manifest.json` SHA-256. Do not create the tag manually. The workflow revalidates source, bytes and trusted certification, then creates the annotated final tag at `CANDIDATE_SHA`. A recipe change fails closed and requires a new candidate; unrelated main changes do not require a rebuild.
-
-Require both versioned publication and channel publication jobs to succeed. Verify the final tag's commit and manifest identity; all six platform ZIPs and compatibility aliases; DEB/RPM, checksums, SBOM, provenance and evidence bundle; both multi-architecture image variants in Docker Hub, GHCR and Quay; and the accepted Helm chart in the chart repository. Download a host-compatible final artifact and confirm its digest is exactly the accepted candidate digest and its version/source output agrees.
-
-For stable releases verify GitHub Latest, R2 download aliases and `latest.json` unless a newer stable release already owns those channels. Prereleases must remain GitHub prereleases and leave stable pointers unchanged. Verify generated release notes compare against the frozen previous stable release, excluding internal previews.
-
-On infrastructure failure retry the same workflow/seal; matching destinations are reused. Never clobber an asset, force a tag, rebuild the image or silently accept a changed digest. A source fix after the final tag requires a new patch version. Cross-registry writes are not atomic: report the unfinished destination rather than claiming publication complete.
-
-New candidates create no preview Releases to clean up. For a legacy preview release, preserve its tag and remove its Release only after final delivery and notes are verified. Do not pass `--cleanup-tag`. Complete the [post-release follow-up](post-release-updates.md) separately.

.agents/skills/rustfs-release-publish/references/post-release-updates.md

@@ -1,57 +0,0 @@
-# Post-release Security Advisory, Milestone, Installation, and Website Updates
-
-Read only after the final non-preview tag has passed Phase 6. Tag creation or a green binary build alone is insufficient: the release assets, source archive, container images, Helm package, and applicable latest channels must be available. Preview tags never enter this phase.
-
-## Security Advisories
-
-Reconcile advisories after every completed final release, including Console-only releases. Read-only preparation may start earlier; do not claim an unpublished artifact is an available fix.
-
-1. Fetch every page of the repository's live Security Advisories, including triage, draft, published, and closed states. A permission error or partial response blocks reconciliation; it does not mean there are no advisories. Keep unpublished advisory details in private task artifacts, never in a public PR, release note, or issue.
-2. For each potentially relevant advisory, map its fix to the exact published tag and verify the regression evidence. Main-branch reachability, a merged private fix, or a green build alone does not prove the shipped version is fixed. Check cherry-picked equivalents and reverted fixes explicitly. For embedded Console or dependency fixes, verify the shipped component version.
-3. Determine the first available fixed release and affected version ranges from evidence. Preserve an earlier correct patched version; do not relabel all fixes as the current release. An unchanged server baseline such as a Console-only release requires checking the earlier server release as well. Leave unresolved reports and fixes absent from the tag pending; do not close them merely because a release shipped.
-4. Prepare any necessary corrections to package identity, affected ranges, patched versions, fix/release links, and advisory text. Preserve unrelated fields, credit, CVE identifiers, and disclosure coordination. Apply updates only within existing user authorization; read back the result to verify it. Publishing a draft, requesting a CVE, or closing a report is a separate action: require explicit authorization for the concrete advisories and respect any embargo. Release-tag approval alone does not authorize those actions. Prepare the exact proposed changes before asking for missing authorization.
-5. Record each relevant advisory's URL, current state, fix evidence, first fixed version, action taken or proposed, and remaining blocker in private task artifacts. Report advisory follow-up separately from artifact publication. A successful release with unresolved advisory work is not complete follow-up; retain that work for the release monitor or a concrete user decision.
-
-## Version milestones
-
-1. Query all pages of both open and closed milestones in the RustFS release repository, matching titles exactly to version strings without a `v` prefix. A failed or incomplete query is not evidence that a milestone is absent; resolve the lookup before making changes.
-2. Close the milestone matching the published `<target>` if it is open; an already closed milestone needs no change. If it is missing, report the gap and continue checking the next version. Do not create a substitute for the released milestone or close/reassign its issues or PRs.
-3. Use an explicitly planned next version when provided; otherwise, for a stable `X.Y.Z`, use `X.Y.(Z+1)`. For example, after `1.0.1` is published, close milestone `1.0.1` and ensure milestone `1.0.2` exists. For an alpha/beta/rc target with a trailing numeric counter, increment that counter within the same channel unless a different next version was specified. If the next version cannot be determined, ask for that version and report this follow-up as blocked. Creating a planning milestone does not confirm the target of a future release or bypass the semver gate.
-4. Reuse an existing next-version milestone, whether open or closed; do not reopen it or create a duplicate. Only when the complete query confirms it is absent, create an open milestone with the exact next-version title. Do not invent a due date or description. After an uncertain creation result, query again before retrying.
-5. Read back both milestones and report their titles, URLs, and actual states, including whether the next milestone was reused or created. A failed close, create, or verification leaves milestone maintenance incomplete; retry only the unfinished operation after refreshing live state. Continue independent installation and website work without moving or republishing the release tag.
-
-## Installation references
-
-1. Re-read the published deliverable state before edits or a retry. If a newer release has superseded this target, do not downgrade installation references or the website announcement. Report the superseding release and leave those defaults intact.
-2. Invoke `rustfs-release-version-bump` with stage `post-release`, the exact target, and the authorized delivery scope. Prepare the follow-up on current main; do not edit or move either validated release tag. Cargo versions may already be preparing the next target and must remain untouched.
-3. Verify the exact Docker image manifest, Release download links, RPM source archive, and Helm repository entry before publishing the installation PR. The chart is packaged and tested before sealing; publication uploads those same bytes only after versioned Docker images are available.
-4. Report the installation PR and its merge state separately from the completed release. Reuse existing merge authorization and repository checks; do not infer new merge authority from this reference.
-
-## rustfs.com top banner
-
-Use the existing announcement configuration from [website PR #112](https://github.com/rustfs/rustfs.com/pull/112). Do not add a second banner or redesign the header.
-
-1. In an isolated checkout of `rustfs/rustfs.com`, read its current `AGENTS.md`, PR template if present, `data/announcement.ts`, and the consuming header component. Search for an existing announcement PR for this target before creating another.
-2. Update `homeAnnouncement` in `data/announcement.ts` after the release and installation availability checks pass. Keep `enabled: true`, `badge: 'New'`, and the existing component. For a stable release, use:
-
-   ```ts
-   export const homeAnnouncement = {
-     enabled: true,
-     badge: 'New',
-     message: 'RustFS <target> is now available! Please',
-     linkText: 'upgrade and try',
-     href: '/download',
-   } as const
-   ```
-
-   Replace `<target>` with the exact published version. Reserve GA wording for the actual first stable release. For a final alpha/beta/rc tag, explicitly call it a prerelease; use its GitHub Release URL if `/download` does not expose that target. Never announce a `-preview.N` build here.
-3. Use the site's current package manager and required checks. For this config-only change, type-check and lint the changed file, build the site, and inspect the generated homepage for the version, visible link text, and destination. Confirm `/download` actually offers the announced version before using that link.
-4. Commit, push, and create or update the website PR when included in the authorized release scope. Include the published RustFS Release URL and checks run. Keep merge and production-deployment authority separate; reuse permission already given, but this reference grants none by itself.
-5. After an authorized merge/deployment, verify the live `https://rustfs.com/` banner and its destination. If only the PR is ready, report that state and URL; do not report the banner as deployed. A website failure does not invalidate or move the published release tag: retry this phase after resolving the failure.
-
-## Reconcile main and remove the completed release branch
-
-1. Compare the exact published tag with current main. Audit every release-side commit since their merge base, including inherited backports. An ahead count is a history difference, not proof of missing changes. Use ancestry and patch equivalence, then inspect current code and regression evidence for squashed, adapted, superseded, or reverted changes. Record each commit as present, superseded, release-only, or missing; a positive `git cherry` result alone does not prove a missing fix.
-2. Bring missing shared changes to main through a reviewed PR and the required checks before closing the follow-up. Preserve main's later changes; decide version bumps and pinned Console configuration separately. If a history merge is needed, use a merge commit and verify the release commit is an ancestor of main; squash does not establish that ancestry. Do not merge main into the published release branch or move its tags. Report unresolved changes instead of claiming reconciliation is complete.
-3. After publication and authorized follow-ups are complete, delete the remote `release/<target>` branch. Immediately before deletion, verify its HEAD still equals the published tag's commit and no open PR targets or originates from it. Preserve a branch with newer work or open PRs and report the blocker. Use a deletion with an expected-old-SHA check to avoid removing a concurrently advanced branch.
-4. Verify the remote branch is absent and the final tag and any legacy preview tags still resolve to their recorded commits. Remove a local release branch only if it is task-owned, unchecked out, and has no unpreserved work. Record cleanup separately from artifact publication; an explicitly authorized deletion before reconciliation does not make unresolved main changes complete.

.agents/skills/rustfs-release-publish/references/preview-acceptance.md

@@ -1,68 +1,52 @@
-# Candidate Artifact Acceptance
+# Preview Artifact Acceptance
 
-Read after Phase 3 succeeds. Complete every check below before the parent skill's manual confirmation gate. These checks cover the downloaded artifact, embedded Console, and the rc release frozen in the candidate inputs.
+Read after Phase 3 succeeds. Complete every check below before the parent skill's manual confirmation gate. These checks cover the downloaded artifact, embedded Console, and latest rc client.
 
 ## Phase 4 — Run the artifact locally, verify the console
 
-Use a unique task-owned scratch directory. Select the versioned archive matching the acceptance host, and verify it against the sealed manifest before extraction. Before desktop completion, use the Linux acceptance environment rather than rebuilding for the local desktop. Do not substitute a different build when a matching artifact is unavailable; report that acceptance gap. The shell example below assumes the verified executable is at `RUSTFS_BINARY` (`rustfs.exe` on Windows), `SCRATCH` is the task directory, and `S3_PORT` and `CONSOLE_PORT` are distinct available ports. Use equivalent native commands when the shell differs.
-
-Bind both listeners to loopback. Choose task-only credentials, set loopback proxy exclusions for the server/client processes, and record the server PID. A port probe does not reserve a port; retry startup with fresh ports on a bind conflict rather than connecting to an existing service.
+Work inside the session scratchpad directory; never leave stray data dirs.
 
 ```bash
-"$RUSTFS_BINARY" --version
-mkdir -p "$SCRATCH/data"
-S3_ENDPOINT="http://127.0.0.1:${S3_PORT}"
-CONSOLE_ENDPOINT="http://127.0.0.1:${CONSOLE_PORT}"
-RUSTFS_ACCESS_KEY="$PREVIEW_ACCESS_KEY" RUSTFS_SECRET_KEY="$PREVIEW_SECRET_KEY" \
-  "$RUSTFS_BINARY" server \
-  --address "127.0.0.1:${S3_PORT}" \
-  --console-enable \
-  --console-address "127.0.0.1:${CONSOLE_PORT}" \
-  "$SCRATCH/data" >"$SCRATCH/server.log" 2>&1 &
-PREVIEW_SERVER_PID=$!
+gh release download "<preview-tag>" -p "rustfs-macos-aarch64-v<preview-tag>.zip" -D "$SCRATCH"
+cd "$SCRATCH" && unzip -o rustfs-*.zip
+./rustfs --version        # must report the PREVIEW TAG (build::TAG), not the Cargo.toml version, plus expected short SHA
+mkdir -p data
+RUSTFS_ACCESS_KEY=rustfsadmin RUSTFS_SECRET_KEY=rustfsadmin ./rustfs ./data
 ```
 
+Defaults: S3 endpoint `:9000`, embedded console `:9001`.
+
 Checks (all must pass):
 
-- `"$RUSTFS_BINARY" --version` reports the exact final `<target>` and full `CANDIDATE_SHA`. A preview suffix, another version or another source is a failure.
-- Wait with a bounded readiness deadline while checking the recorded server process remains alive; `curl --noproxy '*' -fsS "$S3_ENDPOINT/health/ready"` must return ready from this process's listener.
+- `./rustfs --version` reports the preview tag name and the short SHA of `PREVIEW_HASH`. Reporting `<target>` without the `-preview.N` suffix means the build did not embed the tag — treat as FAIL and investigate before proceeding.
+- `curl -fsS http://localhost:9000/health/ready` returns ready.
 - Startup log shows the embedded console being served (this was the regression that `fix(release): require embedded console assets` guards).
-- Open `CONSOLE_ENDPOINT` in the browser and log in with the task credentials. The dashboard must render without JS console errors; create a bucket, upload a file, download it back (byte-identical), and delete the object and bucket. Keep the server running for Phase 5.
+- Open `http://localhost:9001` in the browser: login with `rustfsadmin`/`rustfsadmin`; dashboard renders without JS console errors; create a bucket, upload a file, download it back (byte-identical), delete the object and bucket. Keep the server running for Phase 5.
 
-## Phase 5 — Validate with the pinned rc client
+## Phase 5 — Validate with the latest rc client
 
 `rc` is the RustFS CLI client from <https://github.com/rustfs/cli>.
 
-- Read the CLI release and asset digests from `inputs.json`; verify the local client's version or download a host-compatible asset from that exact release into the task directory. If the host is a desktop, resolve its asset within the same pinned CLI release and record the digest; do not independently follow `latest`. Set `RC_BIN` to that executable and record its version/digest. Avoid changing the user's installed client for this check.
-- Inspect the client's current help for an isolated configuration option and use it when supported. Otherwise choose a unique `PREVIEW_ALIAS` and confirm it is absent before creating it; never overwrite an existing alias. Use task-owned bucket/user names and input/output files. The names below are safe only inside the newly started isolated server.
-- Point the client at `S3_ENDPOINT` with loopback proxy exclusions and run the command matrix, recording PASS/FAIL per command:
+- Ensure the latest release is installed: compare `rc --version` against `gh api repos/rustfs/cli/releases/latest --jq .tag_name`; update via `brew upgrade rustfs/tap/rc` (or download the release binary).
+- Point it at the preview server and run the command matrix, recording PASS/FAIL per command:
 
 ```bash
-"$RC_BIN" alias set "$PREVIEW_ALIAS" "$S3_ENDPOINT" "$PREVIEW_ACCESS_KEY" "$PREVIEW_SECRET_KEY"
-"$RC_BIN" ls "$PREVIEW_ALIAS/"
-"$RC_BIN" mb "$PREVIEW_ALIAS/rel-check"
-"$RC_BIN" cp <local-file> "$PREVIEW_ALIAS/rel-check/"
-"$RC_BIN" stat "$PREVIEW_ALIAS/rel-check/<file>"
-"$RC_BIN" cat "$PREVIEW_ALIAS/rel-check/<file>"          # matches source
-"$RC_BIN" cp "$PREVIEW_ALIAS/rel-check/<file>" "$SCRATCH/out"
-cmp <local-file> "$SCRATCH/out"
-"$RC_BIN" cp -r <local-dir>/ "$PREVIEW_ALIAS/rel-check/dir/"
-"$RC_BIN" find "$PREVIEW_ALIAS/rel-check" --name "*"
-"$RC_BIN" share download "$PREVIEW_ALIAS/rel-check/<file>" --expire 1h
-# Fetch the presigned URL with curl --noproxy '*' and compare its body.
-"$RC_BIN" rm "$PREVIEW_ALIAS/rel-check/<file>"
-"$RC_BIN" rm -r --force "$PREVIEW_ALIAS/rel-check/dir"
-"$RC_BIN" rb "$PREVIEW_ALIAS/rel-check"
-"$RC_BIN" admin user list "$PREVIEW_ALIAS/"
-"$RC_BIN" admin user add "$PREVIEW_ALIAS/" relcheckuser relchecksecret12
-"$RC_BIN" admin user remove "$PREVIEW_ALIAS/" relcheckuser
-"$RC_BIN" alias remove "$PREVIEW_ALIAS"
+rc alias set preview http://localhost:9000 rustfsadmin rustfsadmin
+rc ls preview/
+rc mb preview/rel-check
+rc cp <local-file> preview/rel-check/
+rc stat preview/rel-check/<file>
+rc cat preview/rel-check/<file>          # matches source
+rc cp preview/rel-check/<file> ./out && cmp <local-file> ./out
+rc cp -r <local-dir>/ preview/rel-check/dir/
+rc find preview/rel-check --name "*"
+rc share download preview/rel-check/<file> --expire 1h   # presigned URL fetchable via curl
+rc rm preview/rel-check/<file> && rc rm -r --force preview/rel-check/dir
+rc rb preview/rel-check
+rc admin user list preview/
+rc admin user add preview/ relcheckuser relchecksecret12
+rc admin user remove preview/ relcheckuser
+rc alias remove preview
 ```
 
-- Any FAIL blocks acceptance. On success or failure, stop only the recorded task process and remove only task-created aliases/data after retaining the needed failure evidence. Do not erase an existing client configuration or unrelated server data.
-
-## Field acceptance and desktop completion
-
-Before accepting the Linux manifest, record Scanner/Heal, multi-pool, memory, major features, high-concurrency 503, performance and previous-version integrity/upgrade results in backlog. Preserve the release-specific agreed limits and baseline; a PASS label without artifact identities or test results does not satisfy acceptance.
-
-Dispatch `release-complete.yml` only after that report passes, using the exact Linux manifest digest and backlog URL. Require native macOS/Windows checks, package extraction, image startup/scans, chart tests and complete certification to pass. Complete any desktop Console/client checks applicable to the release against these same archives. Record the completion run and final manifest SHA-256 before entering the parent confirmation gate. Partial Linux acceptance does not authorize final publication.
+- Any FAIL blocks the release. Afterwards stop the server and delete the scratch data directory.

.agents/skills/rustfs-release-publish/references/preview-release.md

@@ -1,9 +0,0 @@
-# Linux candidate verification
-
-Read for Phase 3 after the source passed exact-SHA CI. The [parent invariants](../SKILL.md) apply; commands and recovery live in the [pipeline runbook](../../../../docs/operations/release-pipeline.md).
-
-Dispatch `release-candidate.yml` on main with the confirmed final version and `CANDIDATE_SHA`. Record the run ID, frozen `inputs.json`, every Linux archive digest and `linux-manifest.json` SHA-256. Require the four Linux builds, native startup/S3 checks, previous-release upgrade matrix and Linux seal to succeed. Missing, skipped, cancelled or failed required work is incomplete acceptance.
-
-Verify the frozen Console identity equals the one accepted in Phase 0. Every matrix job consumes that same digest and exact toolchain. The binary must report the final product version and source commit; its candidate ID is separate. No public tag, Release, registry tag, R2 release path, Helm repository or latest pointer should change during this stage.
-
-A green Linux run is ready for field acceptance, not publication. The partial certification must have `publish_allowed: false`. Retain the exact Linux manifest for the next stage; a new source/build-input candidate must not inherit the old approval. A newer unrelated main commit does not invalidate this evidence.

.agents/skills/rustfs-release-publish/references/release-candidate.md

@@ -1,28 +0,0 @@
-# Release Candidate Preparation
-
-Read for Phases 1–2. The [parent release invariants](../SKILL.md) and Console gate apply.
-
-## Candidate Resume Preflight
-
-- `git status --short` clean; `git fetch origin main --tags`.
-- `gh auth status` works; confirm you can view `gh release list -L 3`.
-- Confirm the exact final target version with the user if not explicit.
-- Check whether `release/<target>` already exists before creating it; a resumed release reuses the existing branch and its history. For an in-flight release that already has a preview tag but no branch, anchor the new branch to that tag's commit only after verifying its target versions and prior acceptance evidence.
-
-## Phase 1 — Source version bump to the final target (once)
-
-- If `release/<target>` exists, verify its Cargo.toml and workspace members in Cargo.lock read `<target>` and skip the source bump, even if main has advanced. If the branch versions differ, stop and resolve the mismatch without downgrading main.
-- If no branch exists but an unfinished preview tag does, verify its commit has `<target>` in both version files and skip the bump; Phase 2 anchors the branch to that commit. Stop if those files disagree. Otherwise, if main already has `<target>` in both files, skip the bump. Installation references intentionally retain the previous published deliverable during preview; if they were advanced to an unavailable target, restore that baseline before choosing the next candidate.
-- Only when neither the release branch, an unfinished preview tag, nor current main already has `<target>`: if main is at a later version, select and verify a historical commit containing `<target>` rather than downgrading main; block if none exists. Otherwise invoke the `rustfs-release-version-bump` skill with stage `prepare`, the final `<target>` (NOT a preview version), and full GitHub flow (commit/push/PR).
-- If a bump PR was needed, get it merged into main and record its merge commit. For a new release branch when main already has `<target>`, identify the main commit that introduced those versions. Phase 2 chooses a release candidate containing that commit; an existing release branch keeps its own history and a newer main HEAD is not required.
-
-Do not wait for the moving latest main HEAD to become green. The release-branch CI in Phase 2 validates the chosen commit before a candidate build is dispatched.
-
-## Phase 2 — Pin and validate the release source
-
-- Use `release/<target>`. On the first attempt, create it from a selected main commit containing the version bump and intended changes; it need not be the latest main HEAD. On a restart, retain the existing branch and backport only reviewed fixes from main. Verify the branch's Cargo versions still equal `<target>`. A legacy preview can anchor source selection, but its tag and old artifacts do not constitute a candidate in the new protocol; freeze and verify a new candidate after the release recipe is aligned.
-- The current `ci.yml` runs automatically on main pushes, not release-branch pushes. Dispatch it explicitly with `gh workflow run ci.yml --ref "release/<target>"`. Locate that dispatch run, verify its `head_sha` equals the release branch's remote HEAD, and require the full expected CI job set to pass, including `Quick Checks`, `Test and Lint`, and `End-to-End Tests (full merge gate)`. Treat a missing or skipped required lane as incomplete. A successful PR check or CI run for a different SHA does not qualify. If the branch advances or a run is cancelled, validate the new SHA again. Do not dispatch a candidate with failing or incomplete CI.
-- Prefer protecting `release/*` against force pushes and deletion and requiring reviewed backport PRs. Check live rulesets rather than assuming the main ruleset covers release branches; report a missing release-branch rule as a gap.
-- Set `CANDIDATE_SHA` to the CI-validated release-branch commit. Record the branch, exact commit and CI run URL. The new candidate protocol starts from a commit whose release recipe matches the reviewed main dispatcher; backport the recipe before freezing an older release branch if needed.
-- Dispatch the Linux candidate as described in [candidate verification](preview-release.md). Do not create a preview or final tag here. The final executable already contains `<target>`; publication later promotes those same bytes.
-- After a source or build-input change, run the affected source checks and create a new candidate. Reuse the frozen candidate after an infrastructure failure. Do not restart acceptance for unrelated main advances.

.agents/skills/rustfs-release-version-bump/SKILL.md

@@ -1,24 +1,118 @@
 ---
 name: rustfs-release-version-bump
-description: Prepare an exact RustFS Cargo version or align installation references after publication. Use for requested version bumps or the release workflow.
+description: "Prepare the version-file and release-asset bump for an exact RustFS alpha/beta/stable target, with verification and optional commit/push/PR delivery. Use for an explicit version bump or when invoked by the release-publish workflow."
 ---
-# Release Version Files
+# RustFS Release Version Bump
 
-Require an exact target; ask if missing or ambiguous. Reject targets containing `-preview`: those identify candidates, not product versions or new public tags. Infer `post-release` only from an explicit request or parent workflow; otherwise use `prepare`. Delivery defaults to local edit/verify; commit, push, PR, and merge follow existing authorization and [Git rules](../../references/pull-requests.md).
+Use this skill to prepare and verify release version files. Commit, push, and PR steps apply only when included in the user's delivery scope; publishing release tags belongs to `rustfs-release-publish`.
 
-| Stage | Files and constraints |
-|---|---|
-| `prepare` | Only `Cargo.toml` and `Cargo.lock`: workspace package, internal dependency, and workspace member versions become `<target>`. External dependencies stay unchanged. |
-| `post-release` | Only `README.md`, `README_ZH.md`, `flake.nix`, `helm/rustfs/Chart.yaml`, and `rustfs.spec`. Cargo may already target the next release; leave it untouched. |
+Validated baseline: release pattern used in PR `#2957`.
 
-Before installation edits, verify the exact non-preview Release, downloadable assets/source archive, pullable `rustfs/rustfs:<target>` image manifest, and published Helm chart. Block on missing artifacts. Do not downgrade defaults if a newer deliverable superseded the target. Candidate preparation retains the previous published installation references; follow-up commits never replace validated tags or sealed artifacts.
+## Required inputs
 
-Packaging policy:
+- Exact target version, for example `1.0.0-beta.4`.
+- Delivery scope: local (`edit/verify`), git (`commit/push`), or GitHub
+  (`commit/push/PR`). Derive it from the conversation; when unspecified, prepare
+  and verify locally without blocking on a delivery question.
 
-- Docker image tags have no `v` prefix. Derive chart/app versions with `scripts/helm_chart_version.sh <target>`; both equal the final product SemVer, including prerelease suffixes. Helm CI uses the frozen candidate version before sealing, so no early installation chart bump is required. Previously published chart versions remain unchanged.
-- RPM `Version` is numeric; `Release` is the prerelease suffix or `1` for stable. Expanded `Source0` and the unpack directory must resolve to the exact target including its suffix. Add the changelog entry using current git identity, date, and target; never copy an example identity/date.
-- Changing these mappings requires explicit confirmation.
+If target version is missing or ambiguous, stop and ask before editing.
 
-Verification follows root tiers: `prepare` validates Cargo metadata with the updated lockfile and checks every workspace/internal version with no unrelated lockfile updates. `post-release` renders Helm with the verified image, runs `scripts/test_helm_chart_version.sh` for chart version edits, and checks README, Nix, and RPM references. Run `git diff --check`; report unresolved required checks as `BLOCKED` without unrelated fixes.
+Reject any target version containing `-preview`: preview identifiers are tag-only (see `rustfs-release-publish`) and must never be written into version files. If asked for one, stop and point to the release pipeline instead of editing.
 
-For authorized commits, keep stages separate: `chore(release): prepare <target>` or `chore(release): align installation references for <target>`. Report target/stage, changed files, verification, material uncertainty, and actual commit/push/PR state.
+## Read before editing
+
+- `AGENTS.md` (root and nearest path-specific files).
+- `.github/pull_request_template.md` only when preparing a PR.
+- Current branch status and diff against `origin/main`.
+
+## Default release file scope
+
+Treat the following file list as the default checklist for each release bump:
+
+- `Cargo.toml`
+- `Cargo.lock`
+- `README.md`
+- `README_ZH.md`
+- `flake.nix`
+- `helm/rustfs/Chart.yaml`
+- `rustfs.spec`
+
+Only drop a file when the current repository release process clearly no longer requires it.
+
+## Hard release policy
+
+- Docker doc tags use `<version>` (for example `rustfs/rustfs:1.0.0-beta.4`), not `v<version>`.
+- Helm chart version mapping follows `beta.N -> 0.N.0`.
+- `rustfs.spec` `Release` uses prerelease suffix only (for example `beta.4`).
+- Do not change these rules without explicit confirmation.
+
+## Step-by-step workflow
+
+1. Confirm intent and isolate scope
+- Use the exact target and delivery scope already supplied; ask only for a missing or ambiguous target or a material release-policy choice.
+- Inspect current branch and ensure only release-related files are touched for this task.
+
+2. Update workspace versions
+- Bump `[workspace.package].version` in `Cargo.toml`.
+- Bump internal workspace crate dependency versions in `Cargo.toml`.
+- Update `Cargo.lock` so workspace package versions match target version.
+- Re-scan for partial leftovers.
+
+3. Update release assets
+- `README.md` and `README_ZH.md`: update versioned Docker examples to target version.
+- `flake.nix`: update package version to target version.
+- `helm/rustfs/Chart.yaml`:
+- `appVersion` = target version.
+- `version` follows chart mapping rule, for example:
+- `1.0.0-beta.3` -> `0.3.0`
+- `1.0.0-beta.4` -> `0.4.0`
+- `rustfs.spec`:
+- Set `Release` to prerelease suffix (example `beta.4`).
+- Add/update top changelog entry with exact format:
+- `* Thu May 20 2026 houseme <housemecn@gmail.com>`
+- `- Update RPM package to RustFS 1.0.0-beta.4`
+- Changelog identity and time must come from current environment:
+- `git config --get user.name`
+- `git config --get user.email`
+- `date '+%a %b %d %Y'`
+- Changelog version text must match target release version exactly.
+
+4. Verify before shipping
+- Run:
+- `make pre-commit`
+- If `make pre-commit` fails, fix task-attributable failures and rerun affected checks. Report unresolved required checks as `BLOCKED`; do not silently widen scope to fix unrelated issues.
+
+5. Commit strategy (only when committing is authorized)
+- Preferred split when both parts changed:
+- `chore(release): prepare <version>` for `Cargo.toml` and `Cargo.lock`.
+- `chore(release): align release assets for <version>` for docs and packaging files.
+- If user asks for one commit, use one commit.
+- Stage only intended release files; do not include unrelated working tree changes.
+
+6. Push and PR (only for the authorized delivery scope)
+- Push branch:
+- Use the user-requested or configured push remote: `git push -u <push-remote> <branch>` (first push), or `git push` when tracking is already configured.
+- Create PR with template headings unchanged:
+- `gh pr create --base main --head <branch> --title ... --body-file ...`
+- PR title/body must be English.
+- Use `N/A` for non-applicable template sections.
+- Include verification commands and any `BLOCKED` reason clearly.
+
+## Recommended check commands
+
+- `git status --short --branch`
+- `git diff --name-only origin/main...HEAD`
+- `git diff --stat origin/main...HEAD`
+- `rg -n "<old_version>|<new_version>" Cargo.toml Cargo.lock README.md README_ZH.md flake.nix helm/rustfs/Chart.yaml rustfs.spec`
+- `make pre-commit`
+
+## Output contract
+
+When using this skill, always report:
+
+- Target version.
+- Files changed.
+- Any assumptions or uncertainties requiring confirmation.
+- Verification result (`PASSED` or `BLOCKED`) with key evidence.
+- Commit message(s) used.
+- Push status and PR URL when GitHub flow is requested.

.agents/skills/rustfs-release-version-bump/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "RustFS Release Bump"
+  short_description: "Prepare RustFS release branches like PR #2957."
+  default_prompt: "Use $rustfs-release-version-bump to prepare and verify an exact RustFS release-version bump."

.agents/skills/security-advisory-lessons/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: security-advisory-lessons
+description: Perform a dedicated RustFS security/advisory review for authn/authz, IAM, RPC trust, paths, secrets, browser isolation, encryption, Object Lock, or other security boundaries. Use only when the user requests a security/advisory review or an adversarial review explicitly escalates to the full advisory map; do not auto-load solely because code touches a sensitive path.
+---
+
+# RustFS Security Advisory Lessons
+
+Use this skill as the deep security lens. For a normal adversarial review with a
+matched security surface, the concise security reference under
+`adversarial-validation` is sufficient.
+
+## Workflow
+
+1. Freeze the exact diff/head and identify the changed trust boundaries.
+2. Inspect the headings in [advisory-patterns.md](references/advisory-patterns.md),
+   then read the matching sections. Read the full map only for a broad security
+   audit. Useful headings are
+   auth/admin, IAM/STS/OIDC, policy/plugins, S3/copy/multipart, protocols, paths,
+   secrets/logging/RPC, browser/CORS/proxy, SSE, Object Lock, and serde.
+3. Trace unauthenticated, low-privilege, wrong-action/owner/bucket, malformed,
+   and default-config cases. Security decisions must fail closed.
+4. Require a focused negative regression test for the bypass/exploit form, not
+   only the intended success path. State residual risk when a test is impractical.
+5. Report proven vulnerabilities separately from defense-in-depth hardening.
+
+When advisory currentness matters, fetch the live inventory instead of treating
+the reference as a status mirror:
+
+```bash
+gh api repos/rustfs/rustfs/security-advisories --paginate \
+  --jq '.[] | {ghsa_id,state,severity,summary,updated_at}'
+```
+
+Fetch an individual advisory only when the live summary indicates a new or
+changed lesson.
+
+## Finding Standard
+
+Each finding includes severity, `file:line`, attacker prerequisites, concrete
+input/path, impact, smallest safe fix, and a regression check. Do not exaggerate
+unauthenticated impact when the actual issue requires authenticated low privilege.

.agents/skills/security-advisory-lessons/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Security Advisory Lessons"
+  short_description: "Apply advisory lessons in reviews."
+  default_prompt: "Use $security-advisory-lessons for a dedicated RustFS security review grounded in past advisories."

.agents/skills/security-advisory-lessons/references/advisory-patterns.md

@@ -0,0 +1,149 @@
+# RustFS Advisory Pattern Map
+
+This file is a lesson map, not an advisory inventory mirror. It keeps durable security patterns distilled from RustFS GitHub Security Advisories.
+
+When current advisory state, severity, URLs, or full text matters, fetch it live:
+
+```bash
+gh api repos/rustfs/rustfs/security-advisories --paginate \
+  --jq '.[] | {ghsa_id,state,severity,summary,updated_at}'
+gh api repos/rustfs/rustfs/security-advisories/<GHSA_ID>
+```
+
+Update this file only when an advisory adds or changes a reusable lesson, affected surface, validation pattern, or regression-test expectation. Do not update it for state-only, URL-only, count-only, or timestamp-only changes.
+
+## Pattern Index
+
+### Admin authorization and route exposure
+
+- `GHSA-pfcq-4gjr-6gjm`: notification target endpoints accepted authenticated users but skipped admin authorization. Lesson: distinguish authn from authz; admin target CRUD must call the operation-specific admin authorization path.
+- `GHSA-mm2q-qcmx-gw4w`: `ListServiceAccount` used `UpdateServiceAccountAdminAction`, while update lacked target ownership checks. Lesson: exact action constants and ownership checks are both required; information disclosure can chain into secret rotation and takeover.
+- `GHSA-vcwh-pff9-64cc`: `ImportIam` checked `ExportIAMAction` for an import/write operation. Lesson: every admin handler must authorize the action it actually performs.
+- `GHSA-jqmc-mg33-v45g` and `GHSA-8784-9m7f-c6p6`: `/profile/cpu` and `/profile/memory` were whitelisted from auth and allowed expensive diagnostics plus path disclosure. Lesson: profiling/debug endpoints need admin auth, opt-in, rate limits, and non-sensitive responses.
+- `GHSA-f5cv-v44x-2xgf`: `/rustfs/admin/v3/metrics` accepted any authenticated IAM user and skipped admin authorization. Lesson: read-only metrics and diagnostic admin endpoints still require an operation-specific admin action check.
+- `GHSA-796f-j7xp-hwf4`: `/rustfs/admin/v3/list-remote-targets` checked only that credentials existed and leaked replication target credentials. Lesson: replication target reads are privileged admin operations, and stored remote credentials require strict authz plus response redaction review.
+- `GHSA-xp32-gxq2-3v52`: console license metadata endpoint was public and exposed subject and expiration fields. Lesson: management metadata endpoints should require admin auth or return only coarse public status.
+
+### IAM import, service accounts, and privilege boundaries
+
+- `GHSA-566f-q62r-wcr8`: `ImportIam` accepted attacker-controlled service account `parent`, `claims`, `accessKey`, and `secretKey`, enabling persistent backdoor accounts under root. Lesson: imported IAM payloads are untrusted data and must be validated against privilege boundaries.
+- `GHSA-3495-h8r9-gfqg`: `ExportIAM` wrote regular-user and service-account secret keys into exported ZIP data. Lesson: IAM export is a credential-disclosure boundary; redact, seal, or strictly justify every exported secret before treating export permission as safe.
+- `GHSA-5354-r3w2-34m8`: `AddServiceAccount` checked `CreateServiceAccountAdminAction` but trusted caller-supplied `target_user`, allowing service accounts under the root parent. Lesson: service-account create paths must validate parent ownership or root/admin authority, not only the create action.
+- `GHSA-xgr5-qc6w-vcg9`: `deny_only=true` skipped allow checks and let restricted service accounts mint unrestricted children. Lesson: deny-only logic must never become implicit allow for privilege creation.
+- `GHSA-mm2q-qcmx-gw4w`: leaked service account access keys plus update-without-ownership formed an escalation chain. Lesson: service-account identifiers are security-sensitive because update APIs consume them.
+
+### STS, OIDC, and federation flows
+
+- `GHSA-5qfg-mf7r-jp3w` and `GHSA-3473-5353-xhwh`: `AssumeRoleWithWebIdentity` was reachable through unauthenticated `POST /` routing and could issue temporary credentials from crafted web identity input. Lesson: every STS route needs explicit SigV4 or trusted identity-provider validation before role assumption, and unauthenticated exemptions must be narrowed to the exact action with uniform failure responses.
+- `GHSA-jxrr-r6pv-h958`: unsigned JWT issuer data was decoded before verification to select an OIDC provider, and distinguishable failures could expose provider configuration. Lesson: web-identity routing may be unauthenticated, but pre-verification claims are untrusted routing hints; bound and rate-limit the request, normalize public errors, and verify signature, issuer, audience, and expiration before issuing credentials.
+- `GHSA-ccrv-v8v9-ch9q`, `GHSA-48rf-7j3q-3hfv`, and `GHSA-xvfh-7c9g-hpw2`: service-account-controlled material could self-sign JWT session tokens with forged policy claims, and missing `exp` was accepted for service-account tokens. Lesson: session tokens must be signed by a trusted issuer/key path, enforce required claims and expiration, and reject self-signed or principal-controlled tokens.
+- `GHSA-9pjf-w3c2-m32r`, `GHSA-4x2q-cpx9-9h26`, and `GHSA-xvpm-p3f7-34c3`: public OIDC authorize/callback flows trusted request `Host` or forwarded scheme when building credential-bearing redirects. Lesson: OIDC redirects must use configured allowlisted origins and trusted-proxy handling; never derive the post-login credential destination from direct client headers.
+- `GHSA-m479-9x88-94w6`, `GHSA-frwq-mfqx-83p8`, `GHSA-q9q8-rf9r-fg9f`, and `GHSA-j5c2-hhf7-6gf5`: OIDC validation accepted attacker-controlled discovery URLs because hostname checks rejected only literal forbidden IPs, allowing DNS rebinding SSRF. Lesson: outbound federation URL validation must resolve and classify hostnames at the connection boundary and reject loopback, private, link-local, and rebound addresses.
+
+### IAM policy conditions and external policy plugins
+
+- `GHSA-6r96-hmgc-726c`: request headers collided with lowercase server-derived condition keys such as `userid`, `groups`, `versionid`, and JWT/LDAP claims. Lesson: never let caller-controlled headers append to or replace server-derived policy context; reserve trusted condition keys and keep intentional request-header keys separate.
+- `GHSA-v9cp-qfw9-9pfp`: quantified negated string conditions applied negation after aggregation, transposing `ForAllValues` and `ForAnyValue` semantics. Lesson: push negation into the per-value predicate for quantified operators and test partially overlapping multi-value sets.
+- `GHSA-5w8r-p896-6vq2`: OPA policy mode skipped `ExistingObjectTag/*` loading, so tagged objects looked untagged to external policies. Lesson: external authorization plugins need the same object-tag and request context as built-in policy evaluation before they decide.
+
+### S3 object actions, copy, multipart, and upload policy validation
+
+- `GHSA-g8w9-qw9q-fghr`: a valid presigned `PutObject` accepted extra `x-amz-tagging`, website redirect, and storage-class headers omitted from `SignedHeaders`. Lesson: a presigned URL is a bounded capability; reject `x-amz-*` headers that are not cryptographically bound by the signature so unsigned metadata cannot change authorization, lifecycle, redirect, cost, or durability semantics.
+- `GHSA-3ppv-fx5m-m749`: explicit `versionId` reads and copy sources authorized `s3:GetObject` instead of `s3:GetObjectVersion`. Lesson: version-specific object access must select version-specific actions for direct reads, `CopyObject`, and `UploadPartCopy`, with tests proving the backend is not reached on denial.
+- `GHSA-x298-9x87-fvjq`: anonymous `ListObjectVersions` fell back to `ListBucket` and returned before public-access-block gates. Lesson: compatibility fallbacks must converge on the same post-authorization checks as direct grants, especially `RestrictPublicBuckets` and anonymous data-plane denies.
+- `GHSA-mx42-j6wv-px98`: `UploadPartCopy` missed source authorization and allowed cross-bucket object exfiltration. Lesson: multipart copy must enforce the same source and destination contract as `CopyObject`.
+- `GHSA-wfxj-ph3v-7mjf`: `UploadPartCopy` checked source and destination independently but missed destination copy-source policy constraints. Lesson: source read and destination write checks are not sufficient when policy constrains allowed copy sources.
+- `GHSA-w5fh-f8xh-5x3p`: presigned POST accepted uploads without enforcing signed policy conditions. Lesson: parse and enforce all POST policy constraints server-side, including size, key prefix, and content type.
+
+### Protocol frontends and IAM parity
+
+- `GHSA-3g29-xff2-92vp`: FTP `RETR` and `SIZE`/`MDTM` read paths authenticated the user but skipped IAM before calling storage. Lesson: non-HTTP protocol frontends must enforce the same per-operation authorization as the S3 API before backend access.
+- `GHSA-g3vq-vv42-f647`: FTPS `MKD` called `create_bucket` without checking `s3:CreateBucket`. Lesson: protocol command handlers need action-specific checks even when sibling handlers already authorize correctly.
+- `GHSA-3p3x-734c-h5vx`: FTPS and WebDAV compared secret keys with early-return string equality, while FTPS also returned distinguishable invalid-user and invalid-password failures. Lesson: password-style protocol auth needs constant-time secret comparison, indistinguishable failures where practical, and rate limiting.
+
+### Filesystem paths and object key traversal
+
+- `GHSA-pq29-69jg-9mxc`: RPC `read_file_stream` joined untrusted paths under a volume directory without canonical boundary checks. Lesson: `PathBuf::join` plus length checks are not path security.
+- `GHSA-8r6f-hmq2-28rg`: object keys containing traversal sequences bypassed bucket/object authorization when mapped to filesystem paths. Lesson: reject traversal at object-key parsing and verify final storage paths remain under the expected bucket/key root.
+- `GHSA-f4vq-9ffr-m8m3`: Snowball auto-extract accepted archive entries such as `../victim-bucket/object`, authorized the raw attacker-bucket path, then storage path cleaning crossed bucket boundaries. Lesson: archive entries become object keys and need traversal rejection plus consistent authz/storage normalization before writes.
+
+### Secrets, defaults, and cryptographic misuse
+
+- `GHSA-j59h-h7q5-q348`, `GHSA-3wm5-wpm5-hmfm`, `GHSA-6wc8-xm48-qhmx`, `GHSA-9gf3-jx4p-4xxf`, `GHSA-63xc-c3w3-m2cf`, and `GHSA-ch63-6q4v-hwp5`: RustFS shipped known default root credentials that could authenticate to S3, admin APIs, IAM, KMS, console, and token-signing surfaces. Lesson: root credentials must be operator-provided or generated per install; known defaults and warnings are not acceptable for network-reachable deployments.
+- `GHSA-h956-rh7x-ppgj`: gRPC used the hard-coded token `rustfs rpc` on both client and server. Lesson: source-visible shared tokens are authentication bypasses.
+- `GHSA-r5qv-rc46-hv8q`: internode RPC HMAC secret fell back to the public default `rustfsadmin`. Lesson: RPC/internode auth must fail closed instead of silently using public defaults.
+- `GHSA-75fx-qg6f-8rm7` and `GHSA-68cw-96m3-h2cf`: internode RPC secrets were derivable from known root credentials, making raw storage RPC signatures forgeable when explicit RPC secrets were unset. Lesson: RPC auth keys must be independent random secrets, never derived from S3 root credentials, and raw storage RPC should not share the public S3 listener without an internode-only boundary.
+- `GHSA-m77q-r63m-pj89`: STS JWTs used the root secret key as the shared token signing key, allowing token forgery when the root secret was known. Lesson: STS signing keys need key separation, rotation, and key IDs; do not reuse root credentials for JWT/HMAC signing.
+- `GHSA-923g-jp7v-f97f`: license verification embedded a production RSA private key and used private-key decryption as authenticity. Lesson: ship verifying/public keys only and use real signature verification.
+
+### Sensitive logging and debug output
+
+- `GHSA-r54g-49rx-98cr`: STS credentials were logged at info level. Lesson: generated credentials must never be logged in plaintext.
+- `GHSA-8cm2-h255-v749`: debug logs leaked session tokens, secret keys, JWT claims, and raw STS response bodies. Lesson: redaction must cover custom `Debug` implementations and dependency response-body logging.
+- `GHSA-333v-68xh-8mmq`: invalid RPC signature logging included the shared HMAC secret and expected signature. Lesson: error paths often leak secrets; never log raw secrets or derived authenticators.
+
+### RPC input validation and panic safety
+
+- `GHSA-gw2x-q739-qhcr`: malformed gRPC `GetMetrics` payloads reached `unwrap()` on deserialization and caused remote DoS. Lesson: every network/RPC deserialization failure returns an error, not a panic.
+- `GHSA-h956-rh7x-ppgj` and `GHSA-r5qv-rc46-hv8q`: weak RPC auth increased reachability of otherwise internal handlers. Lesson: panic bugs become more severe when internode auth is weak or defaulted.
+- `GHSA-c667-rgrv-99vj`: NodeService authentication signed the service prefix instead of the concrete generated method path, so valid metadata for one RPC could be replayed to another method during the timestamp window. Lesson: RPC HMAC payloads must bind exact gRPC method path, HTTP method surrogate, timestamp, and secret.
+
+### Browser, CORS, and console isolation
+
+- `GHSA-v9fg-3cr2-277j`: object preview rendered attacker-controlled HTML in a same-origin iframe, exposing console credentials stored in `localStorage`. Lesson: user content must be origin-isolated from the console and protected with `nosniff`, CSP, and strict content-type handling.
+- `GHSA-7gcx-wg4x-q9x6`: an incomplete preview fix reintroduced extension-based PDF detection and bypassed the sandboxed fallback for attacker-controlled content. Lesson: browser-surface fixes need regression tests for alternate viewers and file-type branches, and preview trust must come from validated content type plus sandboxing rather than object names.
+- `GHSA-x5xv-223c-8vm7`: default CORS reflected arbitrary origins with credentials. Lesson: never combine reflected origins with `Access-Control-Allow-Credentials: true`; default should be fail-closed.
+
+### Trusted proxy and source IP conditions
+
+- `GHSA-fc6g-2gcp-2qrq`: `aws:SourceIp` trusted client-supplied `X-Forwarded-For` or `X-Real-IP`. Lesson: forwarded IP headers are valid only behind configured trusted proxies; direct clients use socket peer IP.
+
+### SSE and on-disk storage invariants
+
+- `GHSA-xrrf-67jm-3c2r`: SSE metadata reported encryption while reader composition bypassed `EncryptReader` and stored plaintext. Lesson: test actual bytes on disk and wrapper order, not only API metadata.
+
+### Object Lock and retention invariants
+
+- `GHSA-j548-9grx-fh4f`: Object Lock enforcement treated unreadable, fabricated, or unparsable bucket metadata as absent configuration and allowed retained objects to be deleted or expired. Lesson: retention must fail closed unless Object Lock absence is authoritative, and every delete, lifecycle, scanner, force-delete, and default-retention path needs the same state distinction.
+
+### Serde deserialization and input validation
+
+- Reject unknown fields in untrusted S3 API XML/JSON, lifecycle, policy, and replication input where compatibility permits. Check the current type and supported payload fixtures; do not infer the repository's current coverage from an older audit. Where extra fields are part of the compatibility contract, validate security-critical values explicitly.
+- `#[serde(default)]` on security-critical fields silently accepts missing values as zero/empty. Lesson: when a field has security implications (retention days, permissions, limits), validate the deserialized value explicitly rather than relying on defaults.
+- Integer fields deserialized from user input and cast with `as` (e.g., `i32 as u32`) can wrap negative values to large positives. Lesson: validate ranges before casting; use `try_into()` with a typed error, or clamp only when the domain explicitly requires saturation.
+- XML config typos (e.g., `"NoncurentDays"` instead of `"NoncurrentDays"`) are silently accepted when `deny_unknown_fields` is absent. Lesson: strict deserialization prevents silent misconfiguration that could cause data loss or unexpected retention behavior.
+
+## Useful Search Seeds
+
+Use these targeted searches when a diff touches security-sensitive code:
+
+```bash
+rg -n "validate_admin_request|check_permissions|AdminAction::|deny_only|is_allowed" rustfs crates
+rg -n "authorize_operation|FtpsDriver|SftpDriver|RETR|MKD|SIZE|MDTM|CreateBucket|GetObject|HeadObject" crates/protocols rustfs
+rg -n "UploadPartCopy|upload_part_copy|CompleteMultipart|PostObject|presign|SignedHeaders|content-length-range|starts-with" rustfs crates
+rg -n "ListBucketVersions|GetObjectVersion|versionId|VersionId|ExistingObjectTag|ForAllValues|ForAnyValue|POLICY_PLUGIN|opa" rustfs crates
+rg -n "normalize_extract_entry_key|Snowball|auto-extract|PathBuf::join|canonicalize|\\.\\.|x-forwarded-for|x-real-ip|SourceIp" rustfs crates
+rg -n "DEFAULT_SECRET|DEFAULT_ACCESS|TEST_PRIVATE_KEY|rustfs rpc|RUSTFS_RPC_SECRET" rustfs crates
+rg -n "TONIC_RPC_PREFIX|verify_rpc_signature|check_auth|NodeServiceServer|x-rustfs-signature" rustfs crates
+rg -n "debug!|trace!|info!|error!|\\?resp|\\?merged_config|session_token|secret_key" rustfs crates
+rg -n "HashReader|EncryptReader|SSE|server-side encryption|Access-Control-Allow-Credentials|Origin" rustfs crates
+rg -n "ObjectLock|object_lock|retention|COMPLIANCE|GOVERNANCE|delete_prefix|lifecycle|scanner" rustfs crates
+rg -n "deny_unknown_fields|serde.default|as u32|as usize|as i32" rustfs crates
+```
+
+## Minimum Regression Test Expectations
+
+- Authz fixes: include unauthenticated, valid low-privilege, wrong-action, correct-action, owner, non-owner, and root/admin cases as applicable.
+- Protocol frontend authz fixes: include denied `RETR`, `SIZE`/`MDTM`, `MKD`, bucket probe, and sibling allowed-operation cases, and assert denied paths do not reach the storage backend.
+- IAM fixes: include import/update/list service-account cases with attacker-controlled parent, claims, access key, secret key, and policy.
+- Copy/upload fixes: include cross-bucket, cross-user, source-denied, destination-denied, copy-source-condition, and multipart completion cases.
+- Presigned upload fixes: include a valid presign with extra unsigned tagging, redirect, and storage-class headers; require rejection before storage access, and verify explicitly signed equivalents still work.
+- Version-action fixes: include historical UUID, explicit current version, `null`, range, partNumber, presigned, STS/session, service-account, anonymous bucket-policy, copy source, and multipart-copy source cases.
+- Policy-condition fixes: include reserved-key header collisions, missing keys, partially overlapping multi-value sets, plugin mode, and built-in policy mode.
+- Path fixes: include encoded traversal, absolute path, nested traversal, archive entries with `..`, valid object keys that resemble traversal text but should be rejected, and canonical bucket/prefix boundary checks.
+- Logging fixes: assert redacted output for structs and response bodies that may contain credentials.
+- IAM export fixes: assert exported archives omit plaintext user and service-account secrets unless the format deliberately encrypts or seals them.
+- RPC auth fixes: include captured metadata replay across two concrete methods, stale timestamps, wrong path, wrong method surrogate, wrong secret, and valid same-method calls.
+- Browser/CORS fixes: assert no credentials on reflected/default origins, correct behavior for explicit allowlists, and no same-origin script execution for previewed object content.
+- SSE fixes: inspect stored bytes and verify API metadata, read-back behavior, and on-disk ciphertext together.
+- Object Lock fixes: include unreadable metadata, fabricated metadata defaults, unparsable config, confirmed absent config, COMPLIANCE/GOVERNANCE retention, lifecycle expiry, scanner sweeps, and force-delete paths.

.agents/skills/test-coverage-improver/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: test-coverage-improver
+description: Analyze a supplied coverage report or perform an explicitly requested RustFS coverage assessment, rank uncovered risks, and propose focused tests. Do not trigger for ordinary implementation verification, a single regression test, documentation wording, or release preparation without a coverage request.
+---
+
+# Test Coverage Improver
+
+Use this skill when you need a prioritized, risk-aware plan to improve tests from coverage results.
+
+## Usage assumptions
+- Focus scope is either changed lines/files, a module, or the whole repository.
+- Reuse a supplied coverage artifact when its revision, scope, and format match.
+- If required context is missing, call out assumptions explicitly before proposing work.
+
+## Workflow
+
+1. Define scope and baseline
+   - Derive the revision and scope from the request, diff, or supplied report.
+   - Default to the affected files/module; whole-workspace coverage requires that
+     scope in the request. Ask only if a wrong scope would change the result.
+
+2. Obtain coverage evidence
+   - First inspect a matching existing artifact; do not regenerate it merely
+     because this skill was selected.
+   - If measurement is needed, read the Coverage section of
+     [the testing guide](../../../docs/testing/README.md#coverage), check disk
+     space/tool availability, and select package/test-scoped `cargo llvm-cov`
+     using the repository's nextest configuration. `make coverage` measures the
+     whole workspace (excluding E2E) and is only for that requested scope.
+   - Collect only metrics the report supports. Missing branch/changed-line
+     coverage is unknown, not zero.
+   - If measurement cannot run, continue with code-based test proposals and
+     mark measured coverage unverified; do not invent a coverage percentage.
+
+3. Rank highest-risk gaps
+   - Prioritize changed code, branch coverage gaps, and low-confidence boundaries.
+   - Apply the risk rubric in [coverage-prioritization.md](references/coverage-prioritization.md).
+   - Report up to 5–8 evidenced gaps; do not pad a small scope.
+   - For each gap, capture: file, lines, uncovered branches, and estimated risk score.
+
+4. Propose high-impact tests
+   - For each gap, name the behavior and regression, distinguishing assertions,
+     relevant normal/edge/failure cases, necessary setup, and estimated effort.
+   - Include only scenarios and setup that apply; reuse shared fixture details.
+
+5. Close with validation plan
+   - State which gaps remain after proposals.
+   - Give a scoped verification command and behavior-based acceptance criterion;
+     use a coverage threshold only when the task or repository requires one.
+   - List assumptions or blockers (environment, fixtures, flaky dependencies).
+
+## Report
+
+Summarize the supported metrics, then combine each ranked gap with its proposed
+test and validation. Include source lines only when supplied or inspected;
+mark missing metrics or locations as unknown. Do not duplicate gaps and tests
+in separate templates or fill empty categories for an otherwise small report.

.agents/skills/test-coverage-improver/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Test Coverage Improver"
+  short_description: "Find top uncovered risk areas and propose high-impact tests."
+  default_prompt: "Use $test-coverage-improver to analyze coverage for the requested scope, reuse matching reports, and propose tests for evidenced risks."

.agents/skills/test-coverage-improver/references/coverage-prioritization.md

@@ -0,0 +1,25 @@
+# Coverage Gap Prioritization Guide
+
+Use this rubric for each uncovered area.
+
+Score = (Criticality × 2) + CoverageDebt + (Volatility × 0.5)
+
+- Criticality:
+  - 5: authz/authn, data-loss, payment/consistency path
+  - 4: state mutation, cache invalidation, scheduling
+  - 3: error handling + fallbacks in user-visible flows
+  - 2: parsing/format conversion paths
+  - 1: logging-only or low-impact utilities
+
+- CoverageDebt:
+  - 0: 0–5 uncovered lines
+  - 1: 6–20 uncovered lines
+  - 2: 21–40 uncovered lines
+  - 3: 41+ uncovered lines
+
+- Volatility:
+  - 1: stable legacy code with few recent edits
+  - 2: changed in last 2 releases
+  - 3: touched in last 30 days or currently in active PR
+
+Sort by score descending, then by business impact.

.codex/config.toml

@@ -0,0 +1,5 @@
+# Bound individual tool outputs retained in context; retrieve relevant ranges
+# from task-owned log files when more evidence is needed.
+# https://learn.chatgpt.com/docs/config-file/config-reference
+
+tool_output_token_limit = 4000

.config/ci-plan.json

@@ -1,16 +0,0 @@
-{
-  "schema_version": 1,
-  "rollout": "enforced",
-  "core_packages": ["rustfs", "rustfs-ecstore", "rustfs-filemeta", "rustfs-iam", "rustfs-policy"],
-  "connect_packages": [
-    "rustfs-credentials", "rustfs-config", "rustfs-common", "rustfs-crypto",
-    "rustfs-iam", "rustfs-policy", "rustfs-kms", "rustfs-license", "rustfs-security-governance",
-    "rustfs-utils", "rustfs-tls-runtime", "rustfs-trusted-proxies", "rustfs-filemeta",
-    "rustfs-lock", "rustfs-obs", "rustfs-signer", "rustfs-io-metrics", "rustfs-s3-ops"
-  ],
-  "full_paths": [
-    "Cargo.toml", "Cargo.lock", "*/Cargo.toml", "rust-toolchain*", "rustfmt.toml",
-    "clippy.toml", ".cargo/*", ".config/*", ".github/*", "Makefile",
-    "scripts/*", "build.rs", "*.proto"
-  ]
-}

.config/e2e-distributed-selection.txt

@@ -1,2 +1,2 @@
-sha256-linux=348fa5eed9ae58962c06b33283ff4f15122cff97bce9b4eb1e3ffcb227264b0b
-sha256-darwin=348fa5eed9ae58962c06b33283ff4f15122cff97bce9b4eb1e3ffcb227264b0b
+sha256-linux=775825dcb2b4997c4fa24bd9ba9c0546316c503f4d5e369c39abff0678c95e8e
+sha256-darwin=775825dcb2b4997c4fa24bd9ba9c0546316c503f4d5e369c39abff0678c95e8e

.config/e2e-full-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=0374e6b9b061dd5d622686301386232a4aa1cb22eedc18af70d2a7411bc66f8d
-sha256-linux=f2cee240f7a744ae991971820f48a6c9c28d19f525e8b2345fcb76eeaaf1e382
+sha256-darwin=65024bb9e11c9bc1b4733d5634e955e6b00683b409cc54896624c14d9657a3c9
+sha256-linux=63540e78a72132cb0fcc3865db6ebabe6f4f3d64b9360f7214872b4664d7b790

.config/e2e-nightly-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=e84e04208f19dc0596b10d4d1b799ce43d6cc431415902f9c5458aa8232bc2d8
-sha256-linux=1f9c7add72c44d1c12ef4ac050bb7917431be657c0c90b29f70c3df56f8bbae3
+sha256-darwin=83a7dcaffd5a789517ae9f02a224f66a9713937885cff96fca2ad7e216f197ae
+sha256-linux=626c10f8c964507ff987b6c86069e9019dc6d2ae7fb02db9be5df5aa8cc5145b

.config/e2e-protocols-selection.txt

@@ -1,2 +1,2 @@
-sha256-darwin=a2cb67d91eb0d093928371d6e84a84b2dd41b2ba975a28094e81879bd65838ad
-sha256-linux=82db0561cf9b111f11782d647d0859c9d2a44c5c68481b5e39c48505828bd392
+sha256-darwin=55534a97fbd376f64c8f6c341d319017d11ff77cad6da8629a1a7f6a874e0315
+sha256-linux=c06fb8c19aed6f388b9dc61cb8251b7a44f8561a9bf764ad2b9e635598f8dc17

.config/e2e-repl-nightly-selection.txt

@@ -1 +1 @@
-sha256=4eac269f9a59b2f9be4e7a87ea6aa38454f5ebe10ede35c9b8d4218137d2cd35
+sha256=fa9281eb620cec40bfc68e62eab2773cd313f8ce1497d808ff813cfe5aa243ec

.config/e2e-smoke-selection.txt

@@ -1 +1 @@
-sha256=21e9a1561ac20382503c38353bbb9b830658534a4f277c254a42d0afc6ebed8b
+sha256=6d18f9cce820c51d5589de944e8cc185f73eeca0ea9a9916651943e3759169d0

.config/ecstore-required-tests.json

@@ -29,7 +29,7 @@
     {
       "invariant": "list-uncommitted-version",
       "suite": "rustfs-filemeta",
-      "name": "metacache::tests::resolve_merge_keeps_the_newest_version_at_listing_quorum"
+      "name": "metacache::tests::resolve_with_write_quorum_slack_keeps_partial_latest_hidden_during_merge"
     },
     {
       "invariant": "minio-object-fixture",
@@ -55,276 +55,6 @@
       "invariant": "odm-source-contract-gcs",
       "suite": "rustfs",
       "name": "on_demand_migration::gcs::tests::gcs_native_backend_satisfies_the_shared_backend_contract"
-    },
-    {
-      "invariant": "rollback-inspection",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_preserves_overwrite_data_dirs_and_staging"
-    },
-    {
-      "invariant": "rollback-closed-inspection-channel",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_closed_heal_receiver_preserves_recovery_material"
-    },
-    {
-      "invariant": "rollback-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_cancelled_task_is_not_success"
-    },
-    {
-      "invariant": "rollback-completion-equivalence",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_incomplete_matches_early_ack_and_full_wait_after_reopen"
-    },
-    {
-      "invariant": "rollback-physical-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_rollback_children_keep_namespace_ownership_after_coordinator_panic"
-    },
-    {
-      "invariant": "late-ack-retains-commit",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::rename_data_early_ack_post_mutation_tail_error_never_rolls_back_commit"
-    },
-    {
-      "invariant": "tail-drained-cas",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::tail_drained_put_waits_for_tail_and_allows_immediate_cas"
-    },
-    {
-      "invariant": "seeded-put-tail-pressure",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::seeded_put_completion_pressure_drains_every_real_tail"
-    },
-    {
-      "invariant": "borrowed-lock-tail",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::no_lock_put_waits_for_rename_tail_under_outer_guard"
-    },
-    {
-      "invariant": "cancelled-writer-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::tail_drained_put_owned_commit_survives_waiter_cancellation"
-    },
-    {
-      "invariant": "get-body-reconstruction",
-      "suite": "rustfs-ecstore",
-      "name": "ecstore_validation_blackbox::blackbox_get_restores_body_after_one_shard_file_is_removed"
-    },
-    {
-      "invariant": "range-reconstruction",
-      "suite": "rustfs-ecstore",
-      "name": "ecstore_validation_blackbox::blackbox_range_read_restores_exact_slice_with_one_offline_disk"
-    },
-    {
-      "invariant": "multipart-abort-linearization",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::abort_and_complete_linearize_for_plain_sse_and_legacy_layouts"
-    },
-    {
-      "invariant": "multipart-write-quorum",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::abort_enforces_delete_write_quorum_boundary"
-    },
-    {
-      "invariant": "multipart-physical-owner",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::complete_multipart_timeout_keeps_namespace_owner_until_physical_publication"
-    },
-    {
-      "invariant": "restore-abort-cleanup",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::transition_commit_failure_tests::multipart_restore_aborts_every_post_create_failure"
-    },
-    {
-      "invariant": "legacy-metadata",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::test_issue_2288_legacy_xlmeta_compatibility"
-    },
-    {
-      "invariant": "legacy-nil-version",
-      "suite": "rustfs-filemeta",
-      "name": "filemeta::test::test_into_fileinfo_reads_legacy_nil_uuid_inline_key"
-    },
-    {
-      "invariant": "commit-phase-schedule",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::commit_fault_schedule_keeps_multiple_disk_phases_independent"
-    },
-    {
-      "invariant": "commit-phase-ownership",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::io_primitives::tests::commit_fault_schedule_rejects_duplicate_checkpoint_without_disarming_owner"
-    },
-    {
-      "invariant": "metadata-observation-all-four-slot-states-and-arrival-orders-preserve-reduction",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_all_four_slot_states_and_arrival_orders_preserve_reduction"
-    },
-    {
-      "invariant": "metadata-observation-mixed-current-identity-arrivals-preserve-selection",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_mixed_current_identity_arrivals_preserve_selection"
-    },
-    {
-      "invariant": "metadata-observation-pending-newer-version-and-same-time-different-directory-force-full-wait",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_pending_newer_version_and_same_time_different_directory_force_full_wait"
-    },
-    {
-      "invariant": "metadata-observation-duplicate-shard-cannot-supply-a-read-reserve",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_duplicate_shard_cannot_supply_a_read_reserve"
-    },
-    {
-      "invariant": "metadata-observation-null-versions-markers-and-invalid-success-keep-their-meaning",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::core::metadata_quorum::tests::metadata_observation_null_versions_markers_and_invalid_success_keep_their_meaning"
-    },
-    {
-      "invariant": "metadata-cache-real-get-and-range-preserve-body-across-read-modes",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::read::metadata_cache_tests::metadata_cache_real_get_and_range_preserve_body_across_read_modes"
-    },
-    {
-      "invariant": "late-metadata-refresh-rejects-changed-generation-and-mapped-shards",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::read::metadata_cache_tests::late_metadata_refresh_rejects_changed_generation_and_mapped_shards"
-    },
-    {
-      "invariant": "late-full-get-rejects-changed-object-generation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::prepared_get_object_metadata_tests::non_inline_two_phase_get_rejects_generation_change_before_late_refresh"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-static-namespace",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_static_namespace"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-cross-subdirectory-limit",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_cross_subdirectory_limit"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-max-and-max-plus-one",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_max_and_max_plus_one"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-fixed-seed-marker-and-prefix",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_fixed_seed_marker_and_prefix"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-offline-corrupt-and-minority-stale",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_offline_corrupt_and_minority_stale"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-versions-delete-markers-and-free-versions",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_versions_delete_markers_and_free_versions"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-orphan-cleanup-requires-authoritative-evidence",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_orphan_listing_preserves_inputs"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-consumer-drop-joins-real-disk-producer",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_consumer_drop_joins_real_disk_producer"
-    },
-    {
-      "invariant": "list-objects-shared-corpus-cancelled-quorum-walk-releases-senders-and-disk-lock",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::differential_tests::list_objects_shared_corpus_cancelled_quorum_walk_releases_senders_and_disk_lock"
-    },
-    {
-      "invariant": "borrowed-context-boundary",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::borrowed_write_context_rejects_wrong_namespace_and_cache_flag"
-    },
-    {
-      "invariant": "borrowed-put-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::put_object_tmp_cleanup_tests::borrowed_tail_drained_put_keeps_owner_after_caller_cancel"
-    },
-    {
-      "invariant": "borrowed-mpu-cancellation",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::multipart::tests::borrowed_complete_keeps_namespace_owner_after_caller_cancel"
-    },
-    {
-      "invariant": "pool-cas-owner",
-      "suite": "rustfs-ecstore",
-      "name": "core::pools::pools_tests::pool_meta_cas_context_retains_actual_owner_for_exact_target"
-    },
-    {
-      "invariant": "pool-cas-released-owner",
-      "suite": "rustfs-ecstore",
-      "name": "core::pools::pools_tests::pool_meta_cas_rejects_released_owner"
-    },
-    {
-      "invariant": "copy-tail-drained",
-      "suite": "rustfs-ecstore",
-      "name": "store::object::tests::borrowed_copy_tail_drained_waits_for_rename_tail"
-    },
-    {
-      "invariant": "catalog-borrowed-publication",
-      "suite": "rustfs",
-      "name": "admin::handlers::table_catalog::tests::commit_backend_borrowed_put_preserves_owner_authorization_and_precondition"
-    },
-    {
-      "invariant": "directory-marker-quorum",
-      "suite": "rustfs-filemeta",
-      "name": "metacache::tests::resolve_directory_marker_and_prefix_preserve_quorum_in_both_orders"
-    },
-    {
-      "invariant": "logical-prefix-limit",
-      "suite": "rustfs-ecstore",
-      "name": "store::list_objects::test::list_path_gather_results_counts_common_prefixes_before_page_limit"
-    },
-    {
-      "invariant": "quota-same-name-owner-and-disk-authority",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_reuses_same_name_owner_and_rereads_disk_authority"
-    },
-    {
-      "invariant": "quota-snapshot-scope-and-owner",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_rejects_wrong_scope_incarnation_and_transaction_guard"
-    },
-    {
-      "invariant": "quota-snapshot-lifecycle-and-incarnation",
-      "suite": "rustfs-ecstore",
-      "name": "bucket::metadata_sys::tests::quota_snapshot_rejects_lifecycle_loss_during_read_and_changed_disk_incarnation"
-    },
-    {
-      "invariant": "marker-purge-receipt-reopen",
-      "suite": "rustfs-ecstore",
-      "name": "set_disk::ops::object::marker_purge_receipt_tests::quorum_marker_purge_receipt_survives_reopen_with_stale_member"
-    },
-    {
-      "invariant": "external-minio-shards",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_minio_shards_decode_and_reconstruct_plaintext"
-    },
-    {
-      "invariant": "external-legacy-shards",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_legacy_shards_decode_and_reconstruct_plaintext"
-    },
-    {
-      "invariant": "external-shard-bitrot",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_erasure_shards_reject_bitrot_corruption"
-    },
-    {
-      "invariant": "external-shard-quorum-codec",
-      "suite": "rustfs-ecstore::pinned_erasure_fixtures_test",
-      "name": "pinned_erasure_shards_reject_insufficient_quorum_and_wrong_codec"
     }
   ],
   "fixtures": [
@@ -352,36 +82,6 @@
       "path": "crates/ecstore/tests/fixtures/minio/bucket_metadata_full.xlmeta.hex",
       "sha256": "3b6de589519c08a1614c8bd409bb8199c17d42043861b07bce513075e6fbfc12",
       "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/minio/README.md"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/issue_2288_legacy_xlmeta.hex",
-      "sha256": "b3e8d32f9950a38b5dc71f679519cc830a2b2a807e8b0b39f78840b238d8eacf",
-      "source": "Legacy xl.meta captured for rustfs/backlog#2288; filemeta::test::test_issue_2288_legacy_xlmeta_compatibility"
-    },
-    {
-      "path": "crates/filemeta/tests/fixtures/issue_2265_legacy_meta_v2_object.hex",
-      "sha256": "89dd7ec92d16e54b5d31e0c49c9edffff8a7aa58890aaeff59bc2ff84da0a62f",
-      "source": "Legacy metadata v2 object captured for rustfs/backlog#2265; crates/filemeta/src/test_data.rs"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/list_namespace_keys.json",
-      "sha256": "5afddb60565deba0938e617470255563f0e15a15fab699645c59bb7ccc84898e",
-      "source": "Shared static LIST namespace corpus; ECStore differential tests and ODM list_through_static_namespace_boundary_matrix"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/minio/manifest.json",
-      "sha256": "c398f8dcb76903f6cf8eee07931c76592895ced201ff9d59ed4ff9b0ead2b13c",
-      "source": "MinIO RELEASE.2025-07-23T15-54-02Z; crates/ecstore/tests/fixtures/erasure-shards/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/legacy/manifest.json",
-      "sha256": "dce397d5b2f42748eb5091b4355bb9d133a50cbba003626fafac28095dbe540b",
-      "source": "RustFS 1.0.0-alpha.37; crates/ecstore/tests/fixtures/erasure-shards/README.md"
-    },
-    {
-      "path": "crates/ecstore/tests/fixtures/erasure-shards/plaintext.bin",
-      "sha256": "b5a83332327961a31b65a8731c64559fd04ff8ac9f6124022201dbbdba5ffa01",
-      "source": "Independent fixed SHA256 counter-stream oracle; crates/ecstore/tests/fixtures/erasure-shards/README.md"
     }
   ]
 }

.config/functional-script-revision.txt

@@ -1 +1 @@
-27e9584a2d776db9416d0edfd040d524d48b5d4d
+8bb710ef325d4b3f891e70deb671348a1f1d850a

.config/make/lint-fmt.mak

@@ -70,11 +70,6 @@ s3s-footprint-check: ## Check the s3s dependency footprint ratchet stays frozen
 	@echo "📦 Checking s3s footprint ratchet..."
 	./scripts/check_s3s_footprint.sh
 
-.PHONY: test-count-ratchet-check
-test-count-ratchet-check: ## Check no workspace crate fell below its test floor or rose above its #[ignore] ceiling in the committed baseline
-	@echo "🧪 Checking per-crate test-count ratchet..."
-	./scripts/check_test_count_ratchet.sh
-
 .PHONY: fips-wording-check
 fips-wording-check: ## Check docs and crates/kms do not over-claim crypto capabilities
 	@echo "📣 Checking cryptographic capability wording guard..."
@@ -95,7 +90,6 @@ test-wiring-check: ## Check tests stay registered and selected by their intended
 	@echo "🧪 Checking test wiring..."
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/ci_gate.py --check-workflow
-	$(RUSTFS_PYTHON_BIN) ./scripts/validation_registry.py check
 
 .PHONY: log-analyzer-rules-check
 log-analyzer-rules-check: core-deps ## Check log-analyzer rule anchors still exist verbatim in source

.config/make/pre-commit.mak

@@ -20,11 +20,11 @@ planning-docs-check: ## Check that no planning-type documents are committed
 	./scripts/check_no_planning_docs.sh
 
 .PHONY: pre-commit
-pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check test-count-ratchet-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
+pre-commit: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check quick-check ## Run fast pre-commit checks without clippy/full tests
 	@echo "✅ All pre-commit checks passed!"
 
 .PHONY: pre-pr
-pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check test-count-ratchet-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check offline-enrollment-e2e-check clippy-check test ## Run full pre-PR checks with clippy and tests
+pre-pr: fmt-check unsafe-code-check architecture-migration-check logging-guardrails-check error-other-ratchet-check tokio-io-uring-check extension-schema-check body-cache-whitelist-check s3s-footprint-check fips-wording-check embedded-secrets-check test-wiring-check doc-paths-check planning-docs-check log-analyzer-rules-check offline-enrollment-e2e-check clippy-check test ## Run full pre-PR checks with clippy and tests
 	@echo "✅ All pre-PR checks passed!"
 
 .PHONY: dev-check

.config/make/tests.mak

@@ -22,24 +22,13 @@ TEST_THREADS ?= 1
 # differ from CI and .config/nextest.toml test-groups will NOT apply.
 
 .PHONY: script-tests
-.PHONY: release-package-tests
-release-package-tests: ## Run release package integration on Linux with fpm, dpkg and rpm installed
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_packages.py
-
-.PHONY: release-image-tests
-release-image-tests: ## Run OCI integration with Docker, Go and skopeo; set RELEASE_IMAGE_VARIANT and RELEASE_IMAGE_OUTPUT
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_images.py
-
 script-tests: ## Run shell script tests
 	@echo "Running script tests..."
-	trap 'status=$$?; printf "ERROR: script-tests failed (exit %s): %s\n" "$$status" "$$BASH_COMMAND" >&2; exit "$$status"' ERR
 	./scripts/test_build_rustfs_options.sh
 	./scripts/test_docker_runtime_timezone.sh
 	./scripts/test_entrypoint_credentials.sh
-	./scripts/test_entrypoint_directories.sh
 	./scripts/test_internode_grpc_ab_bench.sh
 	./scripts/test_object_batch_bench_enhanced.sh
-	./scripts/test_package_service_scripts.sh
 	./scripts/test_hotpath_warp_ab_gate.sh
 	./scripts/test_hotpath_warp_abba.sh
 	./scripts/test_scanner_validation_harness.sh
@@ -58,40 +47,18 @@ script-tests: ## Run shell script tests
 	./scripts/test_manual_transition_runbooks.sh
 	./scripts/test_fuzz_runner.sh
 	./scripts/test_python_bin.sh
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_check_doc_paths.py
 	./scripts/check_embedded_secrets.sh --self-test
-	./scripts/check_s3s_footprint.sh --self-test
-	./scripts/test_check_test_count_ratchet.sh
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_test_wiring.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/codemods/s3_error_to_s3_types.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_e2e_binary.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_download_release_asset.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_inspect_btf_prototypes.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_build_workflow.py
-	$(RUSTFS_PYTHON_BIN) -m unittest discover -s scripts/release -p "test_*.py"
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_release_glibc.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_upgrade_workflow.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_migration_gate_evidence.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/ci_gate.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/check_connect_release_boundary.py --self-test
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_ci_test_artifact.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_ci_test_shards.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_ci_merge_queue.py
-	$(RUSTFS_PYTHON_BIN) -m unittest discover -s scripts/ci -p 'test_*.py'
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_security_coverage.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_scheduled_validation_freshness.py --self-test
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_security_workflow.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_nightly_candidate.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_functional_chain.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_functional_chain_health.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_repro_rejoin_readiness_docker.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_validation_registry.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_inspect_validation_runner.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_retain_validation_evidence.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/test_ci_timing_report.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/test_junit_diff.py
 	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_report_compat.py
-	$(RUSTFS_PYTHON_BIN) ./scripts/s3-tests/test_runner_tools.py
 	bash -n ./scripts/validate_object_data_cache_cold_stampede.sh
 	$(RUSTFS_PYTHON_BIN) ./scripts/check_object_data_cache_follower_samples.py --self-test
 	./scripts/validate_object_data_cache_cold_stampede.sh --self-test

.config/nextest.toml

@@ -57,11 +57,6 @@ command = ['sh', '-c', 'echo RUST_MIN_STACK=4194304 >> "$NEXTEST_ENV"']
 [scripts.setup.ecstore-large-stack]
 command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 
-# The receipt corruption oracle does not simulate a crash. Prefer tmpfs only
-# when its full fixture fits; retain the ordinary temporary directory otherwise.
-[scripts.setup.ecstore-receipt-tmpdir]
-command = ['sh', 'scripts/ci/receipt-fixture-tmpdir.sh']
-
 # The serial ILM selection builds the same deep storage futures in both the
 # lifecycle transition module and scanner integration binary. Different tests
 # in each have overflowed first across otherwise unrelated CI runs.
@@ -69,106 +64,18 @@ command = ['sh', 'scripts/ci/receipt-fixture-tmpdir.sh']
 command = ['sh', '-c', 'echo RUST_MIN_STACK=33554432 >> "$NEXTEST_ENV"']
 
 # --- default profile (local): serialize the flaky groups, never retry --------
-# These real-disk progress oracles exercise fsync, quorum IO, and crash/replay
-# boundaries. Reserve the run's capacity so unrelated fixtures cannot starve
-# their existing deadlines and typed-failure assertions (rustfs/backlog#2706).
-# Keep each test's internal concurrency and zero-retry policy unchanged.
-[[profile.default.overrides]]
-filter = """
-package(rustfs-ecstore) & (
-    test(/^set_disk::ops::multipart::tests::complete_multipart_(quorum_success_releases_logical_guards_before_physical_tail|waits_for_tail_before_releasing_guards_and_marking_capacity)$/)
-    | test(=store::heal::tests::full_format_heal_lost_after_last_save_does_not_publish_or_renew_and_latches)
-    | test(/^store::init::tests::(decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page|dispatch_manifest_shutdown_(drains_admitted_delete_batch_without_tail_admission|stops_aborting_validation_tail_reads|stops_authorized_tail_reads_before_receipt_or_cas))$/)
-    | (binary(metadata_read_lock_reuse_test) & test(=replica_multipart_completes_while_metadata_writer_waits_for_its_snapshot))
-)
-"""
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^connect::diagnostics::schedule::tests::/)'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^set_disk::tests::streaming_get_blocks_concurrent_/) | test(=store::object::tests::retired_marker_converges_after_bucket_recreation_on_sixteen_disks))'
-threads-required = "num-test-threads"
-
-# These real-disk lock probes must finish durable IO within production's 5s
-# acquisition budget. Reserve capacity from sibling test processes while
-# preserving the probes' internal concurrency, deadlines, and assertions.
-[[profile.default.overrides]]
-filter = '(package(rustfs-ecstore) & (test(/^core::pools_test::decommission_lock_order_tests::(active_decommission_migration_does_not_invert_capacity_and_delete_object(_tag)?_locks|decommission_moves_a_transitioned_version_expired_by_a_delete_all_rule_without_stalling)$/) | test(=services::integrity::tests::audit_migration_and_ack_recovery_preserve_source_and_reject_conflicts))) | (package(rustfs-heal) & test(=heal::mrf_queue::partial_write::tests::durable_retry_submission_error_keeps_checkpoint_and_uses_backoff))'
-threads-required = "num-test-threads"
-
-# These eight-disk decommission fixtures exercise concurrent retries,
-# free-version cleanup, and real capacity probes under production lock deadlines.
-# Reserve the run's capacity so unrelated IO cannot exhaust those budgets.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^store::init::tests::decommission_entry_(retries_source_changed_without_canceling_other_bucket|skips_cleanup_only_marker_when_free_version_is_present)$/) | test(=core::pools::tests::decommission_capacity_mutation_limits_prewrite_sampling_to_target))'
-threads-required = "num-test-threads"
-
-# This registration/backup lock probe uses an isolated eight-disk store.
-# Reserve capacity so sibling disk-heavy tests cannot consume its 2s
-# registration budget; retain the queued backup and deadlock assertions.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(=admin::handlers::table_catalog::tests::cold_object_registration_completes_while_other_bucket_backup_waits)'
-threads-required = "num-test-threads"
-
-[[profile.default.overrides]]
-filter = 'package(rustfs-heal) & (binary(mrf_partial_write_test) | (binary(mrf_pipeline_test) & test(/^journal_replay_survives_/)) | test(=admin_selector_survives_sigkill_with_original_scope_and_receipts))'
-threads-required = "num-test-threads"
-
-# Native scanner backlog fixtures include 24-set and pool-expansion cases.
-# Reserve capacity across test processes while preserving each scenario's fixed
-# budget, assertions, and internal concurrency.
-[[profile.default.overrides]]
-filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
-threads-required = "num-test-threads"
-
 [[profile.default.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
 
-# These cross-crate real-storage fixtures need the same bounded stack as ECStore tests.
-# The admin target-repair fixtures compose the full bucket delete and recreate
-# path on a real store; measured with RUST_MIN_STACK on 2026-10-15 they need
-# 2016-2040 KiB of the 2 MiB libtest default and overflowed on Linux CI.
-[[profile.default.scripts]]
-filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair_tests::[a-z_]+|admin::handlers::plugin_attempt::v2_tests::delegation_v2_persists_and_vends_with_real_parent_intersection|admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
-setup = 'ecstore-base-stack'
-
 [[profile.default.scripts]]
 filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
-# These handler/store fixtures and the relocated-pool GET compose deep storage
-# futures in libtest threads; on Linux they overflow the default 2 MiB stack.
-[[profile.default.scripts]]
-filter = 'package(rustfs) & (test(/^admin::handlers::table_catalog::tests::/) | test(/^table_catalog::store::tests::/) | test(=app::object::get::tests::execute_get_object_resumes_from_relocated_pool_without_splicing_body))'
-setup = 'ecstore-base-stack'
-
 [[profile.default.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
 
-# This conditional GET fixture composes real-store futures that overflowed
-# the default Linux test-thread stack.
-[[profile.default.scripts]]
-filter = 'package(rustfs) & test(=app::object::get::tests::conditional_get_304_uses_metadata_without_decoding_damaged_data)'
-setup = 'ecstore-large-stack'
-
-# These heal fixtures compose deep real-store recovery futures that can
-# overflow the default Linux test-thread stack.
-[[profile.default.scripts]]
-filter = 'package(rustfs-heal) & (test(=replacement_pool_metadata_follows_real_two_set_placement) | (binary(heal_integration_test) & test(=bucket_removal_recovers_delete_proofs_before_removing_empty_volumes)))'
-setup = 'ecstore-large-stack'
-
-# These real-disk scanner fixtures assert quiet-workload publication and
-# durable MRF admission. Reserve the pool while their bounded CAS/fsync
-# handoffs run so unrelated disk fanouts cannot consume that fixture budget.
-[[profile.default.overrides]]
-filter = 'package(rustfs-scanner) & (test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(=scanner_io::tests::multi_pool_scanner_cycle_publishes_combined_usage) | test(=scanner_io::tests::pending_put_commit_keeps_scanner_walk_live_without_authoritative_usage) | test(=scanner_folder::tests::mrf_ownership::checkpoint_fixture_metadata_heal_reaches_budgeted_tail))'
-threads-required = "num-test-threads"
-
 [[profile.default.overrides]]
 filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes) | test(/^store::bucket::tests::bucket_delete_(mark_delete|purge_removes|default_s3_delete)/))'
 test-group = 'ecstore-serial-flaky'
@@ -194,16 +101,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::heal::heal_result_report_tests::/)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the replacement bucket metadata heal test. It builds a real-disk
-# hermetic erasure set, writes bucket metadata, then asserts byte-identical
-# xl.meta readback after a rejected delayed repair. Under parallel load,
-# concurrent ecstore tests mutate the process-wide disk registry and alter
-# the serialized timestamp/disk-identity fields, flipping the assertion.
-# Preventive serialization only, no retries.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(replacement_bucket_metadata_respects_pool_ownership_and_required_records)'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the metadata-cache generation-retirement pair. Both carry
 # #[serial(metadata_cache_invalidation_probe)] — a no-op across nextest's
 # process boundary — and assert get_object_metadata_cache generation
@@ -229,40 +126,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnostic_capability_e2e))'
 test-group = 'embedded-test-ports'
 
-# Registration, inventory delivery, and real drive/object probes include
-# filesystem or HTTP IO in short deadlines. Reserve capacity so sibling test
-# processes cannot exhaust those budgets. Keep deadlines and assertions intact.
-# The short HTTP fixtures are tracked in rustfs/backlog#2714.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_client) & test(=configured_proxy_and_direct_endpoint_failures_are_distinct)) | (binary(connect_perf_object) & test(/^(real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put|cleanup_uses_a_budget_independent_of_the_measurement_window|cleanup_accepts_missing_object_and_still_deletes_the_bucket|cleanup_diagnostics_identify_each_disconnected_transport_stage|cleanup_diagnostics_identify_each_failed_http_stage_without_private_context|cleanup_diagnostics_identify_timeouts_without_resetting_the_shared_deadline|oversized_response_is_rejected_without_buffering_it)$/)))'
-threads-required = "num-test-threads"
-
-# This cancellation probe hashes the serving executable before acquiring its
-# collector lease. Keep competing test processes out of its 30s startup budget.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(=connect::diagnostics::trace_runtime::tests::local_runtime_profile_cancellation_waits_for_lease_release)'
-threads-required = "num-test-threads"
-
-# These real IAM/state fixtures keep production lock-acquisition limits while
-# peers complete durable IO. Reserve capacity from unrelated test processes;
-# the shared fixture's durable_iam_state_ prefix keeps the whole family together.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::site_replication::tests::durable_iam_state_/)'
-threads-required = "num-test-threads"
-
-# Real target-repair and rebalance-stop fixtures commit durable metadata while
-# peers wait on production locks or bounded cancellation checks. Reserve IO
-# capacity for each fixture; its internal races and deadlines remain intact.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::(replication::target_repair_tests::|rebalance::rebalance_handler_tests::real_admin_stop_)/)'
-threads-required = "num-test-threads"
-
-# Reserve capacity for these short heartbeat TLS/fsync probes (rustfs#8129).
-# Their existing deadlines, assertions, and retry policy remain in force.
-[[profile.default.overrides]]
-filter = 'package(rustfs) & binary(connect_heartbeat) & test(/^(restart_replays_pending_request_then_advances_sequence|restart_replays_exact_legacy_capabilities_with_and_without_jobs)$/)'
-threads-required = "num-test-threads"
-
 # Serialize the durable manual-transition checkpoint test across nextest's
 # process boundary; it mutates bucket lifecycle metadata and is not quarantined.
 [[profile.default.overrides]]
@@ -289,18 +152,9 @@ test-group = 'ecstore-serial-flaky'
 # deterministic commit barriers. Keep the whole init decommission family in one
 # nextest group; serial_test alone cannot isolate separate test processes.
 [[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_.*|suspended_.*decommission.*)$/)'
+filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_|suspended_.*decommission)$/)'
 test-group = 'ecstore-serial-flaky'
 
-# The tier overwrite cleanup-owner matrix restarts a real 4-disk store and
-# drives free-version recovery through lifecycle expiry workers. Reserve the
-# full test budget so competing real-store fixtures cannot starve the walk's
-# filesystem progress deadlines. Keep the production deadlines and no retries.
-[[profile.default.overrides]]
-filter = 'package(rustfs-ecstore) & test(tier_overwrite_put_and_self_copy_recover_persisted_cleanup_owners)'
-test-group = 'ecstore-serial-flaky'
-threads-required = "num-test-threads"
-
 # Serialize the bucket-incarnation / lifecycle-fence tests. They drive
 # init_bucket_metadata_sys and bucket_metadata_sys_of, i.e. process-global
 # OnceLock state that serial_test's #[serial] cannot protect across nextest's
@@ -343,25 +197,12 @@ test-group = 'e2e-cluster-nightly'
 filter = 'package(e2e_test) & (test(/^kms::kms_vault_test::/) | test(/^kms::kms_rekey_sweep_test::/) | test(/^kms::configured_roundtrip_test::test_configured_vault_kms_admin_and_versioned_cleanup$/))'
 test-group = 'e2e-vault'
 
-# These server-heavy smoke cases perform 1k+ sequential S3 writes or run the
-# scanner and a remote tier server together. Reserve the full test budget so
-# unrelated E2E processes cannot starve their storage and polling deadlines.
-[[profile.default.overrides]]
-filter = 'package(e2e_test) & (test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/) | test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry))'
-threads-required = "num-test-threads"
-
 # This four-disk, 65-member rollback probe already drives up to 32 concurrent
 # durable deletions. Reserve this nextest run's capacity for its progress oracle.
 [[profile.default.overrides]]
 filter = 'package(rustfs-ecstore) & test(=store::init::tests::dispatch_manifest_rollback_bounded_concurrency_reaches_tail_behind_slow_member)'
 threads-required = "num-test-threads"
 
-# These short-deadline real-disk progress probes need the test run's capacity
-# for scanner and object-lock handoffs; keep their assertions and deadlines.
-[[profile.default.overrides]]
-filter = '(package(rustfs-scanner) & (test(=scanner::tests::cycle_persist_failure::later_cycle_post_commit_failure_reloads_durable_state) | test(=scanner::tests::running_main_loop_catches_up_pause_cleared_after_startup_observe))) | (package(rustfs-ecstore) & test(=store::init::tests::restored_transitioned_delete_causally_enqueues_free_version))'
-threads-required = "num-test-threads"
-
 # ---------------------------------------------------------------------------
 # ci profile — the strict CI gate (ci.yml `cargo nextest run --profile ci`)
 # ---------------------------------------------------------------------------
@@ -377,114 +218,18 @@ fail-fast = false
 # marker is the observable signal the flake policy is built around.
 path = "junit.xml"
 
-# Match the local durable-progress reservations. All members, deadlines,
-# assertions, and internal concurrency remain enabled without retries.
-[[profile.ci.overrides]]
-filter = """
-package(rustfs-ecstore) & (
-    test(/^set_disk::ops::multipart::tests::complete_multipart_(quorum_success_releases_logical_guards_before_physical_tail|waits_for_tail_before_releasing_guards_and_marking_capacity)$/)
-    | test(=store::heal::tests::full_format_heal_lost_after_last_save_does_not_publish_or_renew_and_latches)
-    | test(/^store::init::tests::(decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page|dispatch_manifest_shutdown_(drains_admitted_delete_batch_without_tail_admission|stops_aborting_validation_tail_reads|stops_authorized_tail_reads_before_receipt_or_cas))$/)
-    | (binary(metadata_read_lock_reuse_test) & test(=replica_multipart_completes_while_metadata_writer_waits_for_its_snapshot))
-)
-"""
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^connect::diagnostics::schedule::tests::/)'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^set_disk::tests::streaming_get_blocks_concurrent_/) | test(=store::object::tests::retired_marker_converges_after_bucket_recreation_on_sixteen_disks))'
-threads-required = "num-test-threads"
-
-# These real-disk lock probes must finish durable IO within production's 5s
-# acquisition budget. Reserve capacity from sibling test processes while
-# preserving the probes' internal concurrency, deadlines, and assertions.
-[[profile.ci.overrides]]
-filter = '(package(rustfs-ecstore) & (test(/^core::pools_test::decommission_lock_order_tests::(active_decommission_migration_does_not_invert_capacity_and_delete_object(_tag)?_locks|decommission_moves_a_transitioned_version_expired_by_a_delete_all_rule_without_stalling)$/) | test(=services::integrity::tests::audit_migration_and_ack_recovery_preserve_source_and_reject_conflicts))) | (package(rustfs-heal) & test(=heal::mrf_queue::partial_write::tests::durable_retry_submission_error_keeps_checkpoint_and_uses_backoff))'
-threads-required = "num-test-threads"
-
-# These eight-disk decommission fixtures exercise concurrent retries,
-# free-version cleanup, and real capacity probes under production lock deadlines.
-# Reserve the run's capacity so unrelated IO cannot exhaust those budgets.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & (test(/^store::init::tests::decommission_entry_(retries_source_changed_without_canceling_other_bucket|skips_cleanup_only_marker_when_free_version_is_present)$/) | test(=core::pools::tests::decommission_capacity_mutation_limits_prewrite_sampling_to_target))'
-threads-required = "num-test-threads"
-
-# This registration/backup lock probe uses an isolated eight-disk store.
-# Reserve capacity so sibling disk-heavy tests cannot consume its 2s
-# registration budget; retain the queued backup and deadlock assertions.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(=admin::handlers::table_catalog::tests::cold_object_registration_completes_while_other_bucket_backup_waits)'
-threads-required = "num-test-threads"
-
-[[profile.ci.overrides]]
-filter = 'package(rustfs-heal) & (binary(mrf_partial_write_test) | (binary(mrf_pipeline_test) & test(/^journal_replay_survives_/)) | test(=admin_selector_survives_sigkill_with_original_scope_and_receipts))'
-threads-required = "num-test-threads"
-
-# Native scanner backlog fixtures include 24-set and pool-expansion cases.
-# Reserve capacity across test processes while preserving each scenario's fixed
-# budget, assertions, and internal concurrency.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-scanner) & (test(/^scanner::backlog::tests::native_/) | test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(/^scanner_io::tests::service_cohort::/))'
-threads-required = "num-test-threads"
-
-# Keep short-deadline real-disk progress probes from competing with unrelated
-# tests for scanner and object-lock capacity. Assertions and deadlines stay on.
-[[profile.ci.overrides]]
-filter = '(package(rustfs-scanner) & (test(=scanner::tests::cycle_persist_failure::later_cycle_post_commit_failure_reloads_durable_state) | test(=scanner::tests::running_main_loop_catches_up_pause_cleared_after_startup_observe))) | (package(rustfs-ecstore) & test(=store::init::tests::restored_transitioned_delete_causally_enqueues_free_version))'
-threads-required = "num-test-threads"
-
-# Emit this expensive fixture's stage timings in CI and use tmpfs when safe.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(=store::init::tests::decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page)'
-success-output = 'immediate'
-
-[[profile.ci.scripts]]
-filter = 'package(rustfs-ecstore) & test(=store::init::tests::decommission_durable_ilm_receipt_pagination_fails_closed_on_second_page)'
-setup = 'ecstore-receipt-tmpdir'
-
 [[profile.ci.scripts]]
 filter = 'package(rustfs-ecstore) & test(/^(bucket::lifecycle::bucket_lifecycle_ops::tests::manual_transition_worker_result_recovery_marks_unknown_for_corrupt_marker|services::rebalance::entry::tests::real_rebalance_run_fence_loss_blocks_multipart_publication|store::init::tests::(batch_transitioned_delete_uses_free_version_per_item|decommission_entry_(allows_free_version_consumed_before_source_lock|rejects_subquorum_free_version_conflict_and_retains_source|skips_cleanup_only_marker_when_free_version_is_present)|dispatched_tier_delete_recovery_(checks_later_pool_then_commits_after_source_removal|finds_directory_source_on_encoded_set|retains_journal_on_source_metadata_error)|force_tier_remove_blocks_on_physical_free_version_hidden_by_other_pool|legacy_unknown_transition_delete_falls_back_for_single_batch_and_blocks_prefix|multi_pool_(recursive_prefix_rejects_legacy_or_hidden_merge_loser_before_delete|same_remote_tuple_(batch|single)_delete_waits_for_all_sources|same_tuple_recursive_prefix_uses_one_journal_owner|transitioned_delete_persists_one_free_version_per_remote_tuple)|recursive_prefix_partial_(pool|set)_failure_keeps_prepared_cleanup_owners|restored_transitioned_delete_uses_free_version_as_cleanup_owner|stable_transitioned_recursive_prefix_delete_uses_journal_owners|suspended_null_transition_delete_uses_free_version_as_sole_owner|tier_mutation_peer_handler_applies_prepare_commit_and_abort_idempotently|transition_response_loss_persists_unknown_outcome_for_provider_recovery|transition_transaction_recovery_(drops_record_after_confirmed_local_commit|keeps_cleanup_pending_local_commit)|transitioned_delete_(free_version_replays_after_store_restart|local_quorum_failure_rolls_back_without_cleanup_owner|uses_free_version_as_cleanup_owner)|versioned_delete_marker_keeps_transitioned_source_and_remote_object|versioned_explicit_transition_delete_preserves_other_version_then_allows_bucket_delete))$/)'
 setup = 'ecstore-large-stack'
 
-# These cross-crate real-storage fixtures need the same bounded stack as ECStore tests.
-[[profile.ci.scripts]]
-filter = '(package(rustfs) & test(/^(admin::handlers::replication::target_repair_tests::[a-z_]+|admin::handlers::plugin_attempt::v2_tests::delegation_v2_persists_and_vends_with_real_parent_intersection|admin::handlers::site_replication::tests::durable_iam_state_apply_iam_item_rejects_a_stale_recreate_after_a_replicated_delete|admin::service::federated_identity::tests::(binding_keeps_explicit_iam_mapping_strict|markerless_legacy_oidc_session_crosses_auth_and_iam_deletion_boundaries)|storage::scanner_dirty_journal::tests::(clear_callback_keeps_unknown_coverage_until_all_pending_work_is_confirmed|owned_journals_keep_peer_records_after_interleaved_writes_and_clear))$/)) | (package(rustfs-heal) & ((binary(heal_b5_versioned_regression_test) & test(/^serial_tests::(test_heal_unversioned_bucket_e2e|test_historical_null_recursive_heal_restores_physical_versions|test_recursive_deep_heal_reports_stale_delete_marker_repair)$/)) | (binary(usage_observation_read_repair_test) & test(=usage_observation_read_repair_survives_snapshot_cleanup)))) | (package(rustfs-test-utils) & test(=data_usage_snapshot_tests::data_usage_snapshot_recovery_wires_primary_backup_and_negative_cache))'
-setup = 'ecstore-base-stack'
-
 [[profile.ci.scripts]]
 filter = 'package(rustfs-ecstore) | package(rustfs-s3select-api) | package(rustfs-scanner) | (package(rustfs) & test(/^(app::multipart_usecase::tests::concurrent_completions_share_durable_bucket_quota_reservations|app::object::delete::tests::compressed_delete_requests_update_observed_usage_without_releasing_quota_floor|app::object::internal_put::tests::internal_multipart_roundtrip_completes_and_abort_leaves_nothing|app::object::restore::tests::execute_restore_object_maps_failures_to_typed_s3_errors|storage::access::tests::(delete_object_access_captures_authorized_bucket_incarnation|copy_operations_reject_recreated_source_bucket_after_authorization|request_slot_keeps_bucket_policy_bound_to_its_store))$/))'
 setup = 'ecstore-base-stack'
 
-[[profile.ci.scripts]]
-filter = 'package(rustfs) & (test(/^admin::handlers::table_catalog::tests::/) | test(/^table_catalog::store::tests::/) | test(=app::object::get::tests::execute_get_object_resumes_from_relocated_pool_without_splicing_body))'
-setup = 'ecstore-base-stack'
-
 [[profile.ci.scripts]]
 filter = 'binary(lifecycle_integration_test) | (package(rustfs) & test(/^app::lifecycle_transition_api_test::/))'
 setup = 'lifecycle-large-stack'
 
-# This conditional GET fixture composes real-store futures that overflowed
-# the default Linux test-thread stack.
-[[profile.ci.scripts]]
-filter = 'package(rustfs) & test(=app::object::get::tests::conditional_get_304_uses_metadata_without_decoding_damaged_data)'
-setup = 'ecstore-large-stack'
-
-# These heal fixtures compose deep real-store recovery futures that can
-# overflow the default Linux test-thread stack.
-[[profile.ci.scripts]]
-filter = 'package(rustfs-heal) & (test(=replacement_pool_metadata_follows_real_two_set_placement) | (binary(heal_integration_test) & test(=bucket_removal_recovers_delete_proofs_before_removing_empty_volumes)))'
-setup = 'ecstore-large-stack'
-
-# These real-disk scanner fixtures assert quiet-workload publication and
-# durable MRF admission. Reserve the pool while their bounded CAS/fsync
-# handoffs run so unrelated disk fanouts cannot consume that fixture budget.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-scanner) & (test(=scanner_folder::tests::mrf_ownership::mrf_ownership_manager_completion_preserves_scanner_pending) | test(=scanner_io::tests::multi_pool_scanner_cycle_publishes_combined_usage) | test(=scanner_io::tests::pending_put_commit_keeps_scanner_walk_live_without_authoritative_usage) | test(=scanner_folder::tests::mrf_ownership::checkpoint_fixture_metadata_heal_reaches_budgeted_tail))'
-threads-required = "num-test-threads"
-
 # ===========================================================================
 # QUARANTINE — flaky tests granted retries = 2 under the ci profile ONLY.
 #
@@ -510,6 +255,13 @@ retries = 2
 filter = 'package(rustfs-ecstore) & (test(concurrent_resend_same_part_commits_one_generation) | test(concurrent_config_writes_from_separate_nodes_do_not_lose_writes))'
 test-group = 'ecstore-serial-flaky'
 
+# QUARANTINE: OPEN rustfs#4690 — walk_dir stall-budget accounting test depends
+# on producer/consumer timing windows that stretch past the budget on loaded
+# CI runners (regression test for rustfs#4644; failed on a zero-Rust-diff PR).
+[[profile.ci.overrides]]
+filter = 'package(rustfs-ecstore) & test(walk_dir_does_not_charge_consumer_backpressure_to_the_stall_budget)'
+retries = 2
+
 # Serialize the relocated-pool GET resume regression under the ci profile too
 # (see the matching default-profile override near the top). No longer a
 # quarantine: the fixture race (rustfs#6701/rustfs#6703) was fixed by #6707,
@@ -541,11 +293,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs-ecstore) & test(/^set_disk::ops::heal::heal_result_report_tests::/)'
 test-group = 'ecstore-serial-flaky'
 
-# Serialize the replacement bucket metadata heal test under the ci profile too.
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(replacement_bucket_metadata_respects_pool_ownership_and_required_records)'
-test-group = 'ecstore-serial-flaky'
-
 # Serialize the metadata-cache generation-retirement pair under the ci
 # profile too (see the matching default-profile override near the top). Not a
 # quarantine: no retries.
@@ -559,33 +306,6 @@ test-group = 'ecstore-serial-flaky'
 filter = 'package(rustfs) & (binary(/^embedded.*_test$/) | binary(admin_diagnostic_capability_e2e))'
 test-group = 'embedded-test-ports'
 
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & (binary(/^connect_registration$/) | binary(connect_inventory) | binary(connect_perf_drive) | (binary(connect_perf_client) & test(=configured_proxy_and_direct_endpoint_failures_are_distinct)) | (binary(connect_perf_object) & test(/^(real_rustfs_endpoint_and_production_cli_support_bounded_get_and_put|cleanup_uses_a_budget_independent_of_the_measurement_window|cleanup_accepts_missing_object_and_still_deletes_the_bucket|cleanup_diagnostics_identify_each_disconnected_transport_stage|cleanup_diagnostics_identify_each_failed_http_stage_without_private_context|cleanup_diagnostics_identify_timeouts_without_resetting_the_shared_deadline|oversized_response_is_rejected_without_buffering_it)$/)))'
-threads-required = "num-test-threads"
-
-# Preserve the cancellation probe's startup budget and assertions in CI too.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(=connect::diagnostics::trace_runtime::tests::local_runtime_profile_cancellation_waits_for_lease_release)'
-threads-required = "num-test-threads"
-
-# Keep the same IAM/state fixture capacity reservation in CI without changing the
-# production lock deadline, internal concurrency, assertions, or retry policy.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::site_replication::tests::durable_iam_state_/)'
-threads-required = "num-test-threads"
-
-# Match the real admin fixture capacity reservation without retries or changes
-# to production lock deadlines, cancellation barriers, or assertions.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & test(/^admin::handlers::(replication::target_repair_tests::|rebalance::rebalance_handler_tests::real_admin_stop_)/)'
-threads-required = "num-test-threads"
-
-# Reserve capacity for these short heartbeat TLS/fsync probes (rustfs#8129).
-# Their existing deadlines, assertions, and retry policy remain in force.
-[[profile.ci.overrides]]
-filter = 'package(rustfs) & binary(connect_heartbeat) & test(/^(restart_replays_pending_request_then_advances_sequence|restart_replays_exact_legacy_capabilities_with_and_without_jobs)$/)'
-threads-required = "num-test-threads"
-
 # Serialize the durable manual-transition checkpoint test under the ci profile
 # too. No retries: failures stay visible.
 [[profile.ci.overrides]]
@@ -603,14 +323,9 @@ filter = 'package(rustfs-ecstore) & (test(decommission_migrates_and_verifies_reg
 test-group = 'ecstore-serial-flaky'
 
 [[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_.*|suspended_.*decommission.*)$/)'
+filter = 'package(rustfs-ecstore) & test(/^store::init::tests::(decommission_|suspended_.*decommission)$/)'
 test-group = 'ecstore-serial-flaky'
 
-[[profile.ci.overrides]]
-filter = 'package(rustfs-ecstore) & test(tier_overwrite_put_and_self_copy_recover_persisted_cleanup_owners)'
-test-group = 'ecstore-serial-flaky'
-threads-required = "num-test-threads"
-
 # Serialize the bucket-incarnation / lifecycle-fence tests under the ci profile
 # too (see the matching default-profile override near the top). No retries.
 [[profile.ci.overrides]]
@@ -710,24 +425,13 @@ test-group = 'ecstore-serial-flaky'
 # the PR-lane e2e coverage for scanner usage snapshots consumed by quota and
 # admin surfaces. It uses the same single-node, random-port, isolated-temp-dir
 # fixture as the existing smoke modules.
-#
-# Dual-stack differential (rustfs/backlog#2740): `dual_stack_differential::`
-# starts two single-node servers from the same binary, one per
-# RUSTFS_S3_STACK value, on random ports with isolated temp dirs, and runs one
-# SDK script covering every operation of `impl S3 for FS` against both. Its
-# comparator unit tests need no server. It meets the admission criteria
-# unchanged; the module clause admits a new differential test without another
-# filter edit.
 [profile.e2e-smoke]
 default-filter = """
     package(e2e_test) & (
-        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|compression|multipart_storage_class|multipart_upload_id|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat|data_usage)_test::|^fake_s3_target::/)
+        test(/^(delete_marker_migration_semantics|version_id_regression|list_objects_v2_pagination|list_object_versions_regression|list_objects_duplicates|list_buckets_double_slash|list_buckets_auth|list_buckets_iam_filter|leading_slash_key|special_chars|create_bucket_region|delete_objects_versioning|head_object_consistency|head_object_range|copy_object_metadata|copy_object_tagging|copy_source_invalid_date|content_encoding|compression|multipart_storage_class|storage_class_capability|ssec_copy|anonymous_access|bucket_policy_check|presigned_negative|negative_sigv4|admin_auth|notification_webhook|tls_hot_reload|console_smoke|admin_iam_crud|admin_pools|sts_query_compat|data_usage)_test::|^fake_s3_target::/)
         | test(/^replication_extension_test::(test_replication_check_succeeds_with_remote_target|test_replication_check_rejects_target_without_object_lock|test_set_remote_target_rejects_unversioned_source_bucket|test_replication_check_rejects_unversioned_source_bucket|test_replication_check_rejects_missing_replication_config|test_replication_check_rejects_invalid_bucket|test_set_remote_target_rejects_same_bucket_on_same_deployment|test_set_remote_target_rejects_unversioned_target_bucket|test_set_remote_target_update_requires_arn|test_set_remote_target_update_rejects_missing_target|test_set_remote_target_rejects_invalid_target_url|test_set_remote_target_rejects_self_signed_https_target_without_skip_tls_verify|test_set_remote_target_rejects_private_ca_https_target_without_ca_cert_pem|test_list_remote_targets_rejects_empty_bucket|test_list_remote_targets_rejects_invalid_bucket|test_remove_remote_target_rejects_missing_target|test_remove_remote_target_rejects_missing_arn|test_remove_remote_target_rejects_invalid_bucket|test_remove_remote_target_rejects_target_used_by_replication|test_delete_bucket_replication_removes_remote_target)$/)
         | test(/^reliant::lifecycle::/)
-        | test(/^conditional_delete_objects_test::/)
         | test(/^reliant::tiering::/)
-        | test(/^dual_stack_differential::/)
-        | test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
         | test(/^on_demand_migration::(get_basic_test::(get_miss_pulls_inline_and_serves_locally_afterwards|head_miss_answers_from_the_source_without_persisting)|interaction_test::test_odm_admin_config_is_redacted_and_status_counts_match_the_source)$/)
     )
 """
@@ -736,16 +440,13 @@ fail-fast = false
 [profile.e2e-smoke.junit]
 path = "junit.xml"
 
-# Bound the whole pagination fixture, including startup, seeding, and cleanup;
-# its LIST deadline begins only after the seed objects have been written.
+# The pagination boundary cases can stall when a server/listing regression
+# prevents the continuation request from completing. Keep the timeout scoped
+# to those known failure modes so legitimate lifecycle/tiering waits retain
+# their test-level timing budget.
 [[profile.e2e-smoke.overrides]]
 filter = 'package(e2e_test) & test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/)'
 slow-timeout = { period = "60s", terminate-after = 2, grace-period = "10s" }
-threads-required = "num-test-threads"
-
-[[profile.e2e-smoke.overrides]]
-filter = 'package(e2e_test) & test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry)'
-threads-required = "num-test-threads"
 
 # ---------------------------------------------------------------------------
 # e2e-repl-nightly profile — scheduled full replication e2e lane (repl-1)
@@ -838,17 +539,10 @@ path = "junit.xml"
 filter = 'package(e2e_test)'
 test-group = 'e2e-cluster-nightly'
 
-# The EC8+4 multi-set heal proof deliberately uploads a larger workload so the
-# background root-heal pass can be interrupted after targeting the replacement
-# drive's erasure slots. Keep the extended budget scoped to this proof case.
-[[profile.e2e-nightly.overrides]]
-filter = 'package(e2e_test) & test(=heal_erasure_disk_rebuild_test::tests::test_cluster_root_heal_recovers_ec84_shards_across_multi_set_after_background_target_restart)'
-slow-timeout = { period = "120s", terminate-after = 12, grace-period = "10s" }
-
 # ---------------------------------------------------------------------------
 # e2e-distributed profile — 4-node 4-disk Actions suite
 # ---------------------------------------------------------------------------
-# Nightly and manual-dispatch lane owned by
+# Storage-sensitive PR / nightly / dispatch lane owned by
 # .github/workflows/e2e-distributed.yml.
 # Each case starts four rustfs processes (and for site replication, two
 # clusters). Upgrade cases also require RUSTFS_UPGRADE_SOURCE_BINARY.
@@ -944,8 +638,8 @@ path = "junit.xml"
 # Each e2e test spawns its own single-node rustfs server on a random port with
 # an isolated temp dir (crates/e2e_test/src/common.rs), so the set is
 # parallel-safe — the same property e2e-smoke relies on. The exceptions are the
-# 4-disk reliability / degraded-read fault-injection tests, multi-node heal
-# clusters, and the fixed-port Vault tests, all serialized below.
+# 4-disk reliability / degraded-read fault-injection tests and the fixed-port
+# Vault tests, both serialized below.
 [profile.e2e-full]
 default-filter = """
     package(e2e_test)
@@ -955,7 +649,6 @@ default-filter = """
     & !test(/^replication_extension_test::/)
     & !test(/^replication_target_matrix_test::/)
     & !test(/^on_demand_migration::(concurrency_test|fault_test|interop_test|real_source_test)::/)
-    & !test(/^upgrade_compatibility_test::upgrade_write_readiness_tests::/)
 """
 fail-fast = false
 
@@ -975,44 +668,6 @@ test-group = 'e2e-reliability'
 filter = 'package(e2e_test) & test(/^inline_fast_path_cluster_test::/)'
 test-group = 'e2e-inline-boundaries'
 
-# Heal interruption cases start whole multi-node clusters. Bound their overlap
-# just as the nightly lane does, without changing membership or retry policy.
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & test(/^heal_erasure_disk_rebuild_test::/)'
-test-group = 'e2e-cluster-nightly'
-
-# The multi-pool crash fixture seeds three nodes and 36 drives. Reserve this
-# nextest run's workers so other multi-node tests do not starve its deadline.
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & test(=heal_erasure_disk_rebuild_test::tests::test_cluster_root_heal_recovers_ec84_shards_across_multi_pool_after_background_target_crash)'
-threads-required = "num-test-threads"
-
 [[profile.e2e-full.overrides]]
 filter = 'package(e2e_test) & (test(/^kms::kms_vault_test::/) | test(/^kms::kms_rekey_sweep_test::/) | test(/^kms::configured_roundtrip_test::test_configured_vault_kms_admin_and_versioned_cleanup$/))'
 test-group = 'e2e-vault'
-
-# Keep the storage-heavy smoke cases isolated in the full suite too. They
-# start multiple server fixtures and issue many sequential S3 operations.
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & (test(/^list_objects_v2_pagination_test::tests::(test_list_objects_v2_delimiter_small_page_traverses_all|test_list_objects_v2_max_keys_above_limit_returns_token|test_list_objects_v2_maxkeys_above_limit_with_delimiter)$/) | test(=reliant::tiering::test_hermetic_transition_restore_failure_expiry_and_retry))'
-threads-required = "num-test-threads"
-
-# The mc fixture uploads hundreds of objects concurrently before measuring listing.
-# Reserve the runner so other server fixtures do not starve its disk operations.
-[[profile.e2e-full.overrides]]
-filter = 'package(e2e_test) & test(=mc_mirror_small_bucket_test::test_mc_mirror_small_bucket_completes_without_list_timeout)'
-threads-required = "num-test-threads"
-
-# Fixed, small contract for every executable server change. These existing
-# scenarios exercise write/read, anonymous denial and retained bytes on restart.
-[profile.core-contract]
-default-filter = '''
-    package(e2e_test) & test(/^(anonymous_access_test::test_anonymous_access_denied_when_restrict_public_buckets_enabled|head_object_consistency_test::head_object_consistency_after_write_and_multipart_and_presigned_head|storage_class_capability_test::tests::historical_label_only_metadata_is_standard_without_hiding_a_real_transition_tier)$/)
-'''
-retries = 0
-fail-fast = false
-test-threads = 1
-slow-timeout = { period = "60s", terminate-after = 3 }
-
-[profile.core-contract.junit]
-path = "junit.xml"

.config/release-validation-plan.json

@@ -1,135 +0,0 @@
-{
-  "schema_version": 1,
-  "plan_id": "rustfs-release-validation",
-  "description": "Certification for immutable candidates. All shipped platforms require native identity and startup; stable and prerelease require the pinned upgrade matrix. Linux-only acceptance never authorizes publication.",
-  "release_types": [
-    "preview",
-    "prerelease",
-    "stable"
-  ],
-  "targets": [
-    {
-      "os": "linux",
-      "arch": "x86_64",
-      "abi": "musl"
-    },
-    {
-      "os": "linux",
-      "arch": "aarch64",
-      "abi": "musl"
-    },
-    {
-      "os": "linux",
-      "arch": "x86_64",
-      "abi": "gnu"
-    },
-    {
-      "os": "linux",
-      "arch": "aarch64",
-      "abi": "gnu"
-    },
-    {
-      "os": "macos",
-      "arch": "aarch64",
-      "abi": "none"
-    },
-    {
-      "os": "windows",
-      "arch": "x86_64",
-      "abi": "msvc"
-    }
-  ],
-  "targets_basis": "Platform matrix of .github/workflows/build.yml (prepare-platform-matrix). gnu and macOS targets build with the pyroscope feature; musl and Windows targets build with no extra features.",
-  "features": [
-    "pyroscope"
-  ],
-  "trusted_workflows": [
-    {
-      "repository": "rustfs/rustfs",
-      "workflow_id": "release-candidate.yml"
-    },
-    {
-      "repository": "rustfs/rustfs",
-      "workflow_id": "release-complete.yml"
-    }
-  ],
-  "trusted_workflows_basis": "Receipts are produced by the reviewed main workflows and fetched by exact run ID with GitHub artifact digest verification. Candidate inputs freeze the harness commit separately from product source.",
-  "lanes": [
-    {
-      "lane": "identity",
-      "harness_repository": "rustfs/rustfs",
-      "harness_sha": "candidate.workflow_sha",
-      "harness_basis": "The exact workflow commit is frozen in candidate inputs; no mutable branch is accepted as a harness identity.",
-      "timeout_seconds": 1800,
-      "environment_capabilities": [
-        "process-exec"
-      ],
-      "cases": [
-        "artifact-identity",
-        "startup"
-      ],
-      "applies_to": {
-        "release_types": [
-          "preview",
-          "prerelease",
-          "stable"
-        ],
-        "platforms": "all"
-      },
-      "applies_basis": "Artifact identity and startup checks are mandatory for every release type, preview included, on every shipped target (rustfs/backlog#2662 frozen design item 5)."
-    },
-    {
-      "lane": "upgrade",
-      "harness_repository": "rustfs/rustfs",
-      "harness_sha": "candidate.workflow_sha",
-      "harness_basis": "The exact workflow commit is frozen in candidate inputs; no mutable branch is accepted as a harness identity.",
-      "timeout_seconds": 5400,
-      "environment_capabilities": [
-        "process-exec",
-        "previous-release-artifact"
-      ],
-      "cases": [
-        "direct-upgrade",
-        "mixed-version-upgrade",
-        "bucket-config-upgrade",
-        "bucket-config-rollback",
-        "multipart-layout-upgrade",
-        "multipart-layout-baseline"
-      ],
-      "cases_basis": "Case IDs of the pinned previous-release matrix in .github/workflows/e2e-upgrade.yml (source.version/asset/sha256 and the case list mapped there).",
-      "applies_to": {
-        "release_types": [
-          "prerelease",
-          "stable"
-        ],
-        "platforms": [
-          {
-            "os": "linux",
-            "arch": "x86_64",
-            "abi": "gnu"
-          }
-        ]
-      },
-      "applies_basis": "preview releases use the pre-declared smaller set (identity lane only). The upgrade lane is only exercised on linux-x86_64-gnu, the platform of the pinned source assets."
-    }
-  ],
-  "upgrade_sources": {
-    "basis": "Exactly the two previous-release sources pinned in .github/workflows/e2e-upgrade.yml are exercised today (source.version / source.asset / source.sha256). No other N-1/N-2 compatibility is claimed, and these digests are not inferred from tags.",
-    "sources": [
-      {
-        "version": "1.0.1",
-        "role": "N-1",
-        "artifact_name": "rustfs-linux-x86_64-gnu-v1.0.1.zip",
-        "artifact_sha256": "9742e183cb0dfb0d48fa909797af572fe47b7f827569036baa4156e0d3958ee5"
-      },
-      {
-        "version": "1.0.0-rc.5",
-        "role": "N-2",
-        "artifact_name": "rustfs-linux-x86_64-gnu-v1.0.0-rc.5.zip",
-        "artifact_sha256": "3ee8df71e8edcfada533be452c4135868f697bc515460ae97b027313eade7a3d"
-      }
-    ],
-    "rollback_supported": false,
-    "rollback_basis": "Only the bucket-config-rollback case (rollback_to_previous_release_reads_current_bucket_metadata) is exercised. Full data-plane rollback is not certified and is never a default claim."
-  }
-}

.config/s3s-edge-allowlist.txt

@@ -1,37 +0,0 @@
-# Files that may still reference s3s (`s3s::` or `s3s_sigv4`) when Phase 1 of
-# the gateway migration ends (rustfs/backlog#2734 task T0.6, rustfs/backlog#2741).
-# Consumed only by `scripts/check_s3s_footprint.sh --mode allowlist`.
-#
-# One entry per line: a repository-relative file path or a git `:(glob)`
-# pathspec. `**` matches across directories, `*` stays within one path
-# component, and a directory entry matches everything under it. Blank lines
-# and lines starting with `#` are ignored; an entry may not contain whitespace,
-# so a note belongs on its own comment line.
-#
-# Every Rust file listed by `git grep -l '\bs3s\(::\|_sigv4\)' -- '*.rs'` that
-# no entry matches fails the allowlist mode. Task T1.9 switches CI to that
-# mode; until then `--dry-run` prints the files still outside this list, which
-# is the Phase 1 tracking list.
-#
-# Never add crates/** other than crates/e2e_test: the engine crates leave s3s
-# entirely, and the script rejects such an entry. Only the s3s-facing edge of
-# the rustfs binary and the e2e oracle keep it.
-
-# rustfs binary: the s3s-facing edge that survives Phase 1
-rustfs/src/storage/ecfs.rs
-rustfs/src/storage/s3_compat/**
-rustfs/src/storage/access.rs
-rustfs/src/auth.rs
-rustfs/src/error.rs
-rustfs/src/storage_api.rs
-rustfs/src/app/storage_api.rs
-rustfs/src/admin/router.rs
-rustfs/src/app/metadata_route.rs
-rustfs/src/server/http.rs
-rustfs/src/server/layer.rs
-rustfs/src/server/hybrid.rs
-rustfs/src/protocols/client.rs
-
-# e2e oracle: the test target that verifies S3 behaviour against s3s
-crates/e2e_test/src/fake_s3_target/**
-crates/e2e_test/src/**

.config/s3s-footprint-baseline.txt

@@ -1,17 +0,0 @@
-# Exact baseline for the direct s3s footprint, consumed only by
-# scripts/check_s3s_footprint.sh (rustfs/backlog#1677; rustfs/backlog#2734 T0.4).
-#
-# Each value is the exact measurement of the tree, not a ceiling. CI fails when a
-# measured counter differs from its line here in either direction:
-#   - a larger measurement means new code widened the s3s surface: route it
-#     through the gateway abstractions instead; never raise a value here;
-#   - a smaller measurement means the PR shrank the surface: lower the matching
-#     value to the measured number in the same PR.
-#
-# files           Rust files referencing s3s paths, repo-wide minus crates/e2e_test
-# s3_error_lines  lines holding s3_error!, same scope, minus those the script
-#                 header's rule clears (rustfs_s3_types's macro); fails closed
-# ecstore_files   Rust files referencing s3s paths under crates/ecstore/src
-files=65
-s3_error_lines=219
-ecstore_files=0

.config/security-smoke-floor.txt

@@ -9,4 +9,4 @@
 # if the selected count drops below this number, so a rename or removal that
 # thins the security smoke gate must update this file in the same PR.
 # Adding tests does not require a bump, but bumping keeps the guard tight.
-28
+26

.config/test-count-baseline.txt

@@ -1,66 +0,0 @@
-# Per-crate test-count baseline consumed by scripts/check_test_count_ratchet.sh
-# (rustfs/backlog#2734 section 1 rule 3; T0.3 in rustfs/backlog#2738).
-#
-# One row per workspace member: <package>, tests, ignored, tab-separated.
-# tests counts #[test], #[tokio::test], #[tokio::test(...)] and #[test_case(...)]
-# attribute lines under the package directory; ignored counts #[ignore] and
-# #[ignore = "..."]. The tests column is a floor and the ignored column is a
-# ceiling: CI fails when a crate's tests fall below its row or its ignored count
-# rises above it. Extra tests and fewer ignores pass; --update tightens the rows.
-# Lowering a tests row or raising an ignored row is a reviewed statement that
-# tests were intentionally removed or ignored; justify it in the PR description.
-# Regenerate with:
-#   scripts/check_test_count_ratchet.sh --update
-e2e_test	1026	20
-rustfs	6440	64
-rustfs-audit	70	0
-rustfs-checksums	28	1
-rustfs-common	36	0
-rustfs-concurrency	87	0
-rustfs-config	43	0
-rustfs-connect-symbol-catalog	6	0
-rustfs-credentials	24	0
-rustfs-crypto	67	0
-rustfs-data-usage	58	0
-rustfs-ecstore	7858	2
-rustfs-extension-schema	23	0
-rustfs-filemeta	361	0
-rustfs-heal	1128	3
-rustfs-heal-contracts	8	0
-rustfs-iam	415	0
-rustfs-io-core	52	0
-rustfs-io-metrics	157	0
-rustfs-keystone	31	0
-rustfs-kms	716	25
-rustfs-license	2	0
-rustfs-lifecycle	156	0
-rustfs-lock	182	0
-rustfs-log-analyzer	91	0
-rustfs-madmin	210	0
-rustfs-notify	140	0
-rustfs-object-capacity	92	0
-rustfs-object-data-cache	141	0
-rustfs-obs	387	0
-rustfs-policy	758	0
-rustfs-protocols	770	1
-rustfs-protos	75	0
-rustfs-replication	209	0
-rustfs-rio	225	1
-rustfs-rio-v2	34	6
-rustfs-s3-client	71	0
-rustfs-s3-ops	8	0
-rustfs-s3-types	105	0
-rustfs-s3select-api	232	0
-rustfs-s3select-query	235	2
-rustfs-scanner	1392	20
-rustfs-scanner-metrics	90	0
-rustfs-security-governance	20	0
-rustfs-signer	34	0
-rustfs-storage-api	34	0
-rustfs-targets	612	26
-rustfs-test-utils	1	0
-rustfs-tls-runtime	44	0
-rustfs-trusted-proxies	72	0
-rustfs-utils	253	1
-rustfs-zip	30	0
-zstd	11	0

.docker/README.md

@@ -22,9 +22,9 @@ The following files in the project root are essential for Docker operations:
 | File | Description | Usage |
 | :--- | :--- | :--- |
 | **`docker-buildx.sh`** | **Multi-Arch Build Script**<br>Automates building and pushing Docker images for `amd64` and `arm64`. Supports release and dev channels. | `./docker-buildx.sh --push` |
-| **`Dockerfile`** | **Production Image (Alpine)**<br>Lightweight image using musl libc. Downloads verified RustFS and `rc` binaries from GitHub Releases and bundles `/etc/rustfs/bootstrap`. | `docker build -t rustfs:latest .` |
-| **`Dockerfile.glibc`** | **Production Image (Ubuntu)**<br>Standard image using glibc. Includes the bundled bootstrap configuration. | `docker build -f Dockerfile.glibc .` |
-| **`Dockerfile.source`** | **Development Image**<br>Builds RustFS from source code and bundles `rc` and the default bootstrap configuration. | `docker build -f Dockerfile.source .` |
+| **`Dockerfile`** | **Production Image (Alpine)**<br>Lightweight image using musl libc. Downloads pre-built binaries from GitHub Releases. | `docker build -t rustfs:latest .` |
+| **`Dockerfile.glibc`** | **Production Image (Ubuntu)**<br>Standard image using glibc. Useful if you need specific dynamic libraries. | `docker build -f Dockerfile.glibc .` |
+| **`Dockerfile.source`** | **Development Image**<br>Builds RustFS from source code. Includes build tools. Ideal for local development and CI. | `docker build -f Dockerfile.source .` |
 
 ### Docker Compose Configurations
 
@@ -110,36 +110,6 @@ docker compose up -d
 
 ---
 
-## Docker Compose environment values
-
-Use map syntax when quoting environment values in YAML:
-
-```yaml
-services:
-  rustfs:
-    image: rustfs/rustfs:latest
-    ports:
-      - "9000:9000"
-      - "9001:9001"
-    volumes:
-      - ./data:/data
-      - ./logs:/var/log/rustfs
-    environment:
-      RUSTFS_ADDRESS: ":9000"
-      RUSTFS_CONSOLE_ADDRESS: ":9001"
-      RUSTFS_CONSOLE_ENABLE: "true"
-      RUSTFS_OBS_LOGGER_LEVEL: error
-      RUSTFS_OBS_LOG_DIRECTORY: "/var/log/rustfs/"
-      RUSTFS_ACCESS_KEY: "${RUSTFS_ACCESS_KEY:?Set RUSTFS_ACCESS_KEY}"
-      RUSTFS_SECRET_KEY: "${RUSTFS_SECRET_KEY:?Set RUSTFS_SECRET_KEY}"
-```
-
-Create the host directories and grant the container user write access before starting this example; official images run as UID/GID `10001:10001`. Set both credential variables to your own values, then run `docker compose config` to inspect the resolved configuration locally before `docker compose up -d`. The resolved output includes credentials, so do not share it publicly.
-
-With list syntax, use `- RUSTFS_OBS_LOG_DIRECTORY=/var/log/rustfs/` or quote the whole item as `- "RUSTFS_OBS_LOG_DIRECTORY=/var/log/rustfs/"`. Writing `- RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"` passes the inner quotes literally, making this a relative path beginning with `"`, which can fail with `mkdir: cannot create directory '"': Permission denied`. This also applies to addresses and credentials: fix every affected list item, rather than only the log directory. The entrypoint preserves configured values, including literal quotes in valid paths and secrets.
-
----
-
 ## 🔧 Common Operations
 
 ### Cleaning Up

.docker/observability/grafana/dashboards/rustfs.json

@@ -1748,7 +1748,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id=\"$storage_cluster\", job=~\"$job\", bucket=~\"$bucket\"})",
+          "expr": "max by (job, bucket) (rustfs_cluster_usage_buckets_objects_count{job=~\"$job\", bucket=~\"$bucket\"})",
           "legendFormat": "{{bucket}}",
           "range": true,
           "refId": "A"
@@ -1848,7 +1848,7 @@
             "uid": "${datasource}"
           },
           "editorMode": "code",
-          "expr": "max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id=\"$storage_cluster\", job=~\"$job\", bucket=~\"$bucket\"})",
+          "expr": "max by (job, bucket) (rustfs_cluster_usage_buckets_total_bytes{job=~\"$job\", bucket=~\"$bucket\"})",
           "legendFormat": "{{bucket}}",
           "range": true,
           "refId": "A"

.docker/observability/otel-collector-config.yaml

@@ -28,15 +28,6 @@ processors:
     check_interval: 1s
     limit_mib: 1024
     spike_limit_mib: 256
-  transform/metrics:
-    error_mode: ignore
-    metric_statements:
-      # RustFS process metrics already expose process_pid as a metric label.
-      # Remove only the duplicate datapoint label and keep the shared resource
-      # process.pid available to sibling metrics and lock histograms.
-      - context: datapoint
-        statements:
-          - delete_key(attributes, "process_pid") where IsMatch(metric.name, "^rustfs_system_process_")
   transform/logs:
     error_mode: ignore
     log_statements:
@@ -121,7 +112,7 @@ service:
       exporters: [ otlp/tempo, otlp/jaeger ]
     metrics:
       receivers: [ otlp ]
-      processors: [ transform/metrics, memory_limiter, batch ]
+      processors: [ batch ]
       exporters: [ prometheus ]
     logs:
       receivers: [ otlp ]

.docker/observability/prometheus.yml

@@ -61,7 +61,6 @@ scrape_configs:
 otlp:
   promote_resource_attributes:
     - service.instance.id
-    - process.pid
     - service.name
     - service.namespace
     - cloud.availability_zone

.docker/observability/tests/bucket-usage.test.yml

@@ -1,48 +0,0 @@
-evaluation_interval: 1m
-tests:
-- name: bucket usage keeps clusters separate and deduplicates reporting nodes
-  interval: 1m
-  input_series:
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a1"}
-    values: '4096 1024'
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a2"}
-    values: '4096 1024'
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="b",job="rustfs",bucket="shared",service_instance_id="b1"}
-    values: '65536 65536'
-  - series: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job="rustfs",bucket="empty",service_instance_id="a1"}
-    values: '0 0'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a1"}
-    values: '3 1'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job="rustfs",bucket="shared",service_instance_id="a2"}
-    values: '3 1'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="b",job="rustfs",bucket="shared",service_instance_id="b1"}
-    values: '70 70'
-  - series: rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job="rustfs",bucket="empty",service_instance_id="a1"}
-    values: '0 0'
-  promql_expr_test:
-  - expr: max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",job=~"rustfs",bucket=~".*"})
-    eval_time: 1m
-    exp_samples:
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="shared"}'
-      value: 1024
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="empty"}'
-      value: 0
-  - expr: max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_objects_count{rustfs_cluster_id="a",job=~"rustfs",bucket=~".*"})
-    eval_time: 1m
-    exp_samples:
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="shared"}'
-      value: 1
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="empty"}'
-      value: 0
-  - expr: max by (rustfs_cluster_id, job, bucket) (rustfs_cluster_usage_buckets_total_bytes)
-    eval_time: 1m
-    exp_samples:
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="shared"}'
-      value: 1024
-    - labels: '{rustfs_cluster_id="a",job="rustfs",bucket="empty"}'
-      value: 0
-    - labels: '{rustfs_cluster_id="b",job="rustfs",bucket="shared"}'
-      value: 65536
-  - expr: rustfs_cluster_usage_buckets_total_bytes{rustfs_cluster_id="a",bucket="unknown"}
-    eval_time: 1m
-    exp_samples: []

.docker/rejoin-readiness.Dockerfile

@@ -1,40 +0,0 @@
-# syntax=docker/dockerfile:1.6
-# Copyright 2026 RustFS Team
-# Licensed under the Apache License, Version 2.0.
-
-# A compatible native runtime with Python 3.11+, getent and stat is required by
-# the isolated fixture's staging/provenance checks. This is a test image.
-ARG RUNTIME_BASE=python:3.13-slim-trixie
-FROM ${RUNTIME_BASE}
-
-ARG SOURCE_REVISION
-ARG BINARY_SHA256
-ARG BUILD_PROFILE=dev
-COPY rustfs /usr/bin/rustfs
-RUN python3 - "$SOURCE_REVISION" "$BINARY_SHA256" "$BUILD_PROFILE" <<'PY'
-import hashlib
-import os
-import re
-import shutil
-import sys
-
-source, digest, profile = sys.argv[1:]
-if not re.fullmatch(r"[0-9a-f]{40}", source):
-    raise SystemExit("invalid source revision")
-if not re.fullmatch(r"[0-9a-f]{64}", digest):
-    raise SystemExit("invalid binary digest")
-if profile not in ("dev", "release"):
-    raise SystemExit("invalid build profile")
-with open("/usr/bin/rustfs", "rb") as binary:
-    if hashlib.file_digest(binary, "sha256").hexdigest() != digest:
-        raise SystemExit("binary digest mismatch")
-for tool in ("getent", "stat"):
-    if shutil.which(tool) is None:
-        raise SystemExit(f"missing runtime tool: {tool}")
-os.chmod("/usr/bin/rustfs", 0o755)
-PY
-LABEL io.rustfs.repro.source_revision="${SOURCE_REVISION}" \
-      io.rustfs.repro.binary_sha256="${BINARY_SHA256}" \
-      io.rustfs.repro.build_profile="${BUILD_PROFILE}"
-USER 10001:10001
-ENTRYPOINT ["/usr/bin/rustfs"]

.gemini/settings.json

@@ -1,5 +0,0 @@
-{
-  "context": {
-    "fileName": "AGENTS.md"
-  }
-}

.github/AGENTS.md

@@ -4,15 +4,29 @@ Applies to `.github/`.
 
 ## Pull Requests
 
-PR conventions (English title/body, template usage, `--body-file` with the heredoc pattern, review-thread etiquette) live in [Git and PR rules](../.agents/references/pull-requests.md); do not duplicate them here.
+PR conventions (English title/body, template usage, `--body-file` with the
+heredoc pattern, review-thread etiquette) live in the root `AGENTS.md` under
+"Git and PR Baseline" — that section is the single normative home; do not
+duplicate its rules here.
 
 ## Workflow Changes
 
-- Changes to workflow YAML or `.github/actionlint.yaml` must pass `actionlint` (run from the repo root) with zero findings before commit/PR. Install via `brew install actionlint`, or the download script in the actionlint repo (rhysd/actionlint); `make pre-pr` does not cover workflow files, so this is the required check for them.
-- Custom self-hosted runner labels (`sm-standard-*`, `dind-*`) are declared in `.github/actionlint.yaml`. When introducing a new `runs-on:` label, declare it there in the same change. Never use the config or `-ignore` to silence real findings — fix the workflow (root `AGENTS.md`: make checks pass by fixing the cause, not by weakening the gate).
-- If `shellcheck` is installed, actionlint also lints `run:` scripts; treat those findings as part of the gate.
-- Runner placement and billing rules live in `.github/workflows/README.md`. A new job defaults to `ubuntu-latest` (free for this public repository); a self-hosted `runs-on` needs one of the reasons listed there, stated in a comment next to it, and a `rust-cache` key is never shared between the hosted and self-hosted images.
+- Any change touching `.github/workflows/` must pass `actionlint` (run from
+  the repo root) with zero findings before commit/PR. Install via
+  `brew install actionlint`, or the download script in the actionlint repo
+  (rhysd/actionlint); `make pre-pr` does not cover workflow files, so this is
+  the required check for them.
+- Custom self-hosted runner labels (`sm-standard-*`, `dind-*`) are declared
+  in `.github/actionlint.yaml`. When introducing a new `runs-on:` label,
+  declare it there in the same change. Never use the config or `-ignore` to
+  silence real findings — fix the workflow (root `AGENTS.md`: make checks
+  pass by fixing the cause, not by weakening the gate).
+- If `shellcheck` is installed, actionlint also lints `run:` scripts; treat
+  those findings as part of the gate.
 
 ## CI Alignment
 
-When changing CI-sensitive behavior, keep local validation aligned with `.github/workflows/ci.yml`. Read the workflow file directly for the current gate steps — do not rely on (or add) a copied command list here; copies go stale. `make pre-pr` covers the shared local gates, not the full CI feature, platform, or end-to-end matrix. Select checks using the root verification tiers.
+When changing CI-sensitive behavior, keep local validation aligned with
+`.github/workflows/ci.yml`. Read the workflow file directly for the current
+gate steps — do not rely on (or add) a copied command list here; copies go
+stale. `make pre-pr` is the local equivalent of the main gate.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,110 +0,0 @@
-name: Bug report
-description: Create a report to help us improve
-body:
-  - type: markdown
-    attributes:
-      value: |
-        ### Storage support requirements
-        **Supported:** local disks, SAN (Fibre Channel) attached volumes, or JBOD-mounted disks. We recommend formatting them with the **XFS** file system.
-
-        **Not supported:** NFS, SMB/Samba/CIFS, and other remote or shared filesystems as RustFS data directories. This also applies to the underlying host storage for Docker volumes and Kubernetes PersistentVolumes.
-
-        Reports that only reproduce on unsupported storage will be closed without investigation. Please reproduce the issue on supported storage before submitting a bug report.
-
-        See [Disk Planning and File System Selection](https://docs.rustfs.com/en/installation/linux/prerequisites-and-service) for details.
-  - type: checkboxes
-    id: storage-support
-    attributes:
-      label: Supported storage confirmation
-      options:
-        - label: I have reproduced this issue with all RustFS data directories on supported storage (local disks, SAN/Fibre Channel, or JBOD; XFS recommended), without NFS, SMB/Samba/CIFS, or other remote or shared filesystem mounts, including storage backing Docker volumes and Kubernetes PersistentVolumes.
-          required: true
-  - type: textarea
-    id: bug-description
-    attributes:
-      label: Describe the bug
-      description: A clear and concise description of what happened.
-    validations:
-      required: true
-  - type: textarea
-    id: reproduction-steps
-    attributes:
-      label: Steps to reproduce
-      description: Include the commands, configuration, or actions needed to reproduce the problem.
-      placeholder: |
-        1. Start RustFS with ...
-        2. Run ...
-        3. Observe ...
-    validations:
-      required: true
-  - type: textarea
-    id: expected-behavior
-    attributes:
-      label: Expected behavior
-      description: A clear and concise description of what you expected to happen.
-    validations:
-      required: true
-  - type: input
-    id: rustfs-version
-    attributes:
-      label: RustFS version
-      description: Provide the release version, container image tag, or commit hash.
-    validations:
-      required: true
-  - type: dropdown
-    id: deployment-method
-    attributes:
-      label: Deployment method
-      description: How are you running RustFS? Add any relevant details in Additional context.
-      options:
-        - Binary
-        - Docker / Docker Compose
-        - Kubernetes / Helm
-        - Built from source
-        - Other
-  - type: textarea
-    id: storage-mounts
-    attributes:
-      label: Data directory filesystems and mounts
-      description: |
-        Identify the filesystem type and mount source for every RustFS data directory.
-        On Linux, include output from `findmnt -T /path/to/data -o TARGET,SOURCE,FSTYPE,OPTIONS` for each data path; on other systems, provide equivalent mount information.
-        For Docker, identify the backing host path and filesystem, not just the container path or volume name.
-        For Kubernetes, identify the PV, StorageClass/CSI driver, and actual backing filesystem; a PVC name alone is not sufficient.
-        Remove credentials and other sensitive information before submitting.
-      placeholder: |
-        RustFS data paths:
-        Filesystem types and mount sources:
-        Mount command output:
-        Docker host paths or Kubernetes volume backing storage (if applicable):
-    validations:
-      required: true
-  - type: input
-    id: operating-system
-    attributes:
-      label: Server operating system and architecture
-      description: Include the operating system version and CPU architecture where RustFS is running.
-      placeholder: "For example: Ubuntu 24.04, x86_64"
-    validations:
-      required: true
-  - type: textarea
-    id: client-environment
-    attributes:
-      label: Client environment
-      description: Include the S3 client or SDK and version. For console issues, include the browser, operating system, and desktop or mobile device details.
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant logs
-      description: Paste relevant log output. Remove credentials and other sensitive information before submitting.
-      render: shell
-  - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: If applicable, drag and drop screenshots here to help explain the problem.
-  - type: textarea
-    id: additional-context
-    attributes:
-      label: Additional context
-      description: Add any other context, such as deployment topology or relevant configuration. Remove credentials and other sensitive information before submitting.

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +0,0 @@
-blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,38 +0,0 @@
-name: Feature request
-description: Suggest an idea for this project
-body:
-  - type: checkboxes
-    id: request-scope
-    attributes:
-      label: Request scope
-      description: |
-        RustFS data directories backed by NFS, SMB/Samba/CIFS, or other remote or shared filesystems are unsupported, including those behind Docker volumes or Kubernetes PersistentVolumes.
-        Troubleshooting requests for these deployments will be closed without investigation. Use this form for new or improved functionality.
-      options:
-        - label: This is a feature request and does not ask for troubleshooting an unsupported remote or shared filesystem deployment.
-          required: true
-  - type: textarea
-    id: problem-description
-    attributes:
-      label: Problem or use case
-      description: Describe the problem or use case that motivates this feature request.
-      placeholder: "For example: I am trying to ... but ..."
-    validations:
-      required: true
-  - type: textarea
-    id: proposed-solution
-    attributes:
-      label: Proposed solution
-      description: A clear and concise description of what you would like to happen.
-    validations:
-      required: true
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives considered
-      description: Describe any alternative solutions or features you have considered.
-  - type: textarea
-    id: additional-context
-    attributes:
-      label: Additional context
-      description: Add any other context or drag and drop screenshots about the feature request here.

.github/actions/quick-checks/action.yml

@@ -13,41 +13,30 @@
 # limitations under the License.
 
 name: Quick Checks
-description: Run the shared RustFS quality checks.
+description: Run the shared compile-free RustFS quality checks.
 
 runs:
   using: composite
   steps:
     - name: Install quality tools
-      uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2
+      uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
       with:
         tool: |
           ripgrep@15.2.0
           shellcheck@0.11.0
-          cargo-nextest@0.9.138
 
     - name: Install actionlint
       shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-        ASSET_DOWNLOADER: ${{ github.action_path }}/../setup/download_release_asset.py
       run: |
         actionlint_dir="$(mktemp -d "${RUNNER_TEMP}/actionlint.XXXXXX")"
-        python3 "$ASSET_DOWNLOADER" --repository rhysd/actionlint --tag v1.7.12 --asset actionlint_1.7.12_linux_amd64.tar.gz --output "$actionlint_dir/actionlint.tar.gz" --sha256 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        curl --fail --location --silent --show-error \
+          --output "$actionlint_dir/actionlint.tar.gz" \
+          https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
         echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  $actionlint_dir/actionlint.tar.gz" | sha256sum --check --status
         tar -xzf "$actionlint_dir/actionlint.tar.gz" -C "$actionlint_dir" actionlint
         rm "$actionlint_dir/actionlint.tar.gz"
         echo "$actionlint_dir" >> "$GITHUB_PATH"
 
-    - name: Install Python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-      with:
-        python-version: "3.12"
-
-    - name: Install workflow parser
-      shell: bash
-      run: python3 -m pip install --disable-pip-version-check PyYAML==6.0.3
-
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       with:
@@ -97,10 +86,6 @@ runs:
       shell: bash
       run: ./scripts/check_s3s_footprint.sh
 
-    - name: Check per-crate test-count ratchet
-      shell: bash
-      run: ./scripts/check_test_count_ratchet.sh
-
     - name: Check cryptographic capability wording
       shell: bash
       run: ./scripts/check_fips_wording.sh
@@ -113,16 +98,14 @@ runs:
       shell: bash
       run: make script-tests
 
-    - name: Check object generation protocol model
-      shell: bash
-      run: python3 ./scripts/test_object_generation_protocol_model.py
-
     - name: Check test wiring
       shell: bash
       run: |
+        python3 ./scripts/check_test_wiring.py --self-test
+        python3 ./scripts/check_scheduled_validation_freshness.py --self-test
+        python3 ./scripts/test_security_workflow.py
+        python3 ./scripts/test_nightly_candidate.py
         python3 ./scripts/check_test_wiring.py
-        python3 ./scripts/ci_gate.py --check-workflow
-        python3 ./scripts/validation_registry.py check
 
     - name: Check no planning docs committed
       shell: bash

.github/actions/runner-pilot/action.yml

@@ -1,107 +0,0 @@
-name: Runner capability and build pilot
-description: Inspect an existing runner and measure isolated fixed-source cold/warm builds
-inputs:
-  workload:
-    description: probe, server or workspace-tests
-    required: true
-  source-sha:
-    description: Exact merged main commit for builds
-    default: ""
-  toolchain:
-    description: Exact Rust version for builds
-    default: ""
-  scratch-root:
-    description: Existing absolute scratch root
-    default: ""
-  build-jobs:
-    description: Cargo concurrency
-    default: "2"
-  local-ssd:
-    description: Require operator storage attestation
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Validate pilot input and inspect existing capabilities
-      shell: bash
-      env:
-        PILOT_WORKLOAD: ${{ inputs.workload }}
-        PILOT_SHA: ${{ inputs.source-sha }}
-        PILOT_TOOLCHAIN: ${{ inputs.toolchain }}
-        PILOT_SCRATCH: ${{ inputs.scratch-root }}
-        PILOT_JOBS: ${{ inputs.build-jobs }}
-        PILOT_SSD: ${{ inputs.local-ssd }}
-      run: |
-        [[ "$PILOT_WORKLOAD" =~ ^(probe|server|workspace-tests)$ ]]
-        [[ "$PILOT_JOBS" =~ ^([1-9]|1[0-6])$ ]]
-        if [[ "$PILOT_WORKLOAD" != probe ]]; then
-          [[ "$PILOT_SHA" =~ ^[a-f0-9]{40}$ ]]
-          [[ "$PILOT_TOOLCHAIN" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
-        fi
-        scratch="${PILOT_SCRATCH:-$RUNNER_TEMP}"
-        [[ "$scratch" == /* && -d "$scratch" ]]
-        minimum_disk=1
-        minimum_memory=0
-        if [[ "$PILOT_WORKLOAD" == server ]]; then minimum_disk=24; minimum_memory=8; fi
-        if [[ "$PILOT_WORKLOAD" == workspace-tests ]]; then minimum_disk=90; minimum_memory=16; fi
-        extra=()
-        if [[ "$PILOT_SSD" == true ]]; then extra+=(--local-ssd-attestation /etc/rustfs-runner/storage.json); fi
-        python3 scripts/ci/runner_pilot.py --root "$scratch" \
-          --output "$RUNNER_TEMP/runner-pilot-evidence" \
-          --min-free-gib "$minimum_disk" --min-memory-gib "$minimum_memory" --architecture x86_64 "${extra[@]}"
-    - name: Checkout the trusted baseline history
-      if: inputs.workload != 'probe'
-      uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-      with:
-        ref: main
-        path: .runner-pilot-source
-        fetch-depth: 0
-        persist-credentials: false
-    - name: Bind the build to a merged main commit
-      if: inputs.workload != 'probe'
-      shell: bash
-      env:
-        PILOT_SHA: ${{ inputs.source-sha }}
-      run: |
-        git -C .runner-pilot-source merge-base --is-ancestor "$PILOT_SHA" HEAD
-        git -C .runner-pilot-source checkout --detach "$PILOT_SHA"
-    - name: Install build dependencies
-      if: inputs.workload != 'probe'
-      shell: bash
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y build-essential pkg-config libssl-dev cmake clang time
-    - name: Install the fixed protobuf compiler
-      if: inputs.workload != 'probe'
-      uses: rustfs/setup-protoc@a3705324d8f9bf5b6c3573fb6cf8ae421db55dd6 # v3.0.1
-      with:
-        version: "35.1"
-        repo-token: ${{ github.token }}
-    - name: Install the fixed flatbuffer compiler
-      if: inputs.workload != 'probe'
-      uses: Nugine/setup-flatc@698800de72a96bfb22cf60431dc21a2ff9a7e07b # v1
-      with:
-        version: "25.12.19"
-    - name: Install the requested exact Rust toolchain
-      if: inputs.workload != 'probe'
-      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-      with:
-        toolchain: ${{ inputs.toolchain }}
-    - name: Measure cold and warm builds without shared target caches
-      if: inputs.workload != 'probe'
-      shell: bash
-      env:
-        PILOT_WORKLOAD: ${{ inputs.workload }}
-        PILOT_SHA: ${{ inputs.source-sha }}
-        PILOT_TOOLCHAIN: ${{ inputs.toolchain }}
-        PILOT_SCRATCH: ${{ inputs.scratch-root }}
-        PILOT_JOBS: ${{ inputs.build-jobs }}
-        PILOT_SSD: ${{ inputs.local-ssd }}
-      run: |
-        extra=()
-        if [[ "$PILOT_SSD" == true ]]; then extra+=(--local-ssd-attestation /etc/rustfs-runner/storage.json); fi
-        python3 scripts/ci/runner_pilot.py --root "${PILOT_SCRATCH:-$RUNNER_TEMP}" \
-          --output "$RUNNER_TEMP/runner-pilot-evidence" \
-          --source .runner-pilot-source --source-sha "$PILOT_SHA" \
-          --toolchain "$PILOT_TOOLCHAIN" --benchmark "$PILOT_WORKLOAD" \
-          --jobs "$PILOT_JOBS" --timeout-seconds 3600 "${extra[@]}"

.github/actions/schedule-failure-issue/README.md

@@ -5,38 +5,20 @@ This is the single alerting mechanism for all timed pipelines
 (rustfs/backlog#1149 ci-8, arbitration G3): scheduled workflows must consume
 this action instead of inventing their own notification paths.
 
-Issues are filed in **rustfs/backlog** (override with `target-repository`),
-not the repository the workflow runs in, so scheduled-failure noise stays
-out of the code repository's issue tracker.
-
 ## Behavior
 
 - Issue title: `[scheduled-failure] <workflow name>` — the workflow name is
   the dedupe key.
-- If an **open** issue with that exact title exists in the target
-  repository, the failure is appended as a comment; otherwise a new issue is
-  created (labeled `infrastructure` by default; the label must exist in the
-  target repository). Closing the issue resets the cycle: the next failure
-  opens a fresh one.
-- The issue body / comment includes the source repository, run URL, run
-  attempt, event, ref and the names of the failed (or timed-out/cancelled)
-  jobs of the current run attempt.
+- If an **open** issue with that exact title exists, the failure is appended
+  as a comment; otherwise a new issue is created (labeled `infrastructure` by
+  default). Closing the issue resets the cycle: the next failure opens a
+  fresh one.
+- The issue body / comment includes the run URL, run attempt, event, ref and
+  the names of the failed (or timed-out/cancelled) jobs of the current run
+  attempt.
 - Requires `gh` and `jq` on the runner (both preinstalled on GitHub-hosted
   runners such as `ubuntu-latest`).
 
-## Tokens
-
-Two tokens are involved:
-
-- `github-token` authenticates issue create/comment/search against the
-  target repository. The workflow-scoped `secrets.GITHUB_TOKEN` is scoped to
-  the code repository and **cannot** open issues in rustfs/backlog, so this
-  must be a PAT or GitHub App token with `issues: write` on the target
-  repository, stored as the `BACKLOG_ISSUE_TOKEN` repository secret.
-- `source-token` (defaults to `${{ github.token }}`) reads the failed-job
-  list from the reported run, which lives in the repository running the
-  workflow.
-
 ## Usage
 
 Add a final job to the workflow. `always()` is required — without it the job
@@ -59,7 +41,7 @@ this job only; no other job may gain permissions.
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
 
 Notes:
@@ -74,6 +56,7 @@ Notes:
 - `.github/workflows/e2e-s3tests.yml` (weekly full s3-tests sweep)
 - `.github/workflows/mint.yml` (weekly multi-SDK mint run)
 - `.github/workflows/fuzz.yml` (nightly fuzz corpus jobs)
+- `.github/workflows/performance-ab.yml` (nightly warp A/B gate)
 - **Pending:** the ci-7 e2e nightly-full workflow does not exist yet
   (backlog#1149 ci-7). When it lands, wire it up with the snippet above.
 

.github/actions/schedule-failure-issue/action.yml

@@ -16,31 +16,18 @@ name: "Schedule Failure Issue"
 description: >-
   Open (or update) a tracking issue when a scheduled workflow run fails or
   does not complete normally.
-  Issues are filed in the target repository (default rustfs/backlog), not
-  the repository the workflow runs in.
   Dedupes by workflow name: if an open issue titled
-  "[scheduled-failure] <workflow name>" already exists there, the result is
+  "[scheduled-failure] <workflow name>" already exists, the result is
   appended as a comment; otherwise a new issue is created. This is the
   single alerting mechanism for all scheduled pipelines (backlog#1149 ci-8).
 
 inputs:
   github-token:
     description: >-
-      Token with issues:write on the target repository. The workflow-scoped
-      secrets.GITHUB_TOKEN is scoped to the code repository and cannot open
-      issues in rustfs/backlog, so pass a PAT / GitHub App token stored as a
-      repository secret (BACKLOG_ISSUE_TOKEN).
+      Token with issues:write on the repository. Pass secrets.GITHUB_TOKEN
+      from a job that declares `permissions: issues: write` (scope the
+      permission to the alert job only, never workflow-wide).
     required: true
-  target-repository:
-    description: "Repository the failure-tracking issue is filed in."
-    required: false
-    default: rustfs/backlog
-  source-token:
-    description: >-
-      Token used to read the failed-job list from the reported run. Defaults
-      to the workflow's own token, which can read runs of its own repository.
-    required: false
-    default: ${{ github.token }}
   workflow-name:
     description: "Workflow name used for the issue title (the dedupe key)."
     required: false
@@ -48,8 +35,8 @@ inputs:
   label:
     description: >-
       Label applied when a new issue is created. Must already exist in the
-      target repository; if applying it fails, the issue is created without a
-      label. Set to an empty string to skip labeling.
+      repository; if applying it fails, the issue is created without a label.
+      Set to an empty string to skip labeling.
     required: false
     default: "infrastructure"
   source-run-id:
@@ -84,8 +71,6 @@ runs:
       shell: bash
       env:
         GH_TOKEN: ${{ inputs.github-token }}
-        SOURCE_TOKEN: ${{ inputs.source-token }}
-        TARGET_REPOSITORY: ${{ inputs.target-repository }}
         WORKFLOW_NAME: ${{ inputs.workflow-name }}
         ISSUE_LABEL: ${{ inputs.label }}
         SOURCE_RUN_ID: ${{ inputs.source-run-id }}
@@ -101,10 +86,8 @@ runs:
         run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${SOURCE_RUN_ID}"
 
         # Inspect the reported run attempt. It can be the current in-workflow
-        # failure or a completed run observed by the external watchdog. The
-        # run lives in the repository running the workflow, so authenticate
-        # with the source token, not the target-repository token.
-        failed_jobs="$(GH_TOKEN="${SOURCE_TOKEN}" gh api \
+        # failure or a completed run observed by the external watchdog.
+        failed_jobs="$(gh api \
           "repos/${GITHUB_REPOSITORY}/actions/runs/${SOURCE_RUN_ID}/attempts/${SOURCE_RUN_ATTEMPT}/jobs" \
           --paginate \
           --jq '.jobs[]
@@ -126,7 +109,6 @@ runs:
         body="$(cat <<EOF
         Run of **${WORKFLOW_NAME}** did not complete successfully.
 
-        - Repository: ${GITHUB_REPOSITORY}
         - Run: ${run_url} (attempt ${SOURCE_RUN_ATTEMPT})
         - Event: \`${SOURCE_EVENT}\`
         - Ref: \`${SOURCE_REF_NAME}\` @ \`${SOURCE_SHA}\`
@@ -138,26 +120,26 @@ runs:
         EOF
         )"
 
-        # Dedupe by exact title among OPEN issues in the target repository (a
-        # closed issue means the earlier breakage was resolved; a new failure
-        # gets a fresh issue). GitHub search strips the [] characters, so
-        # search loosely and match the exact title with jq.
-        existing="$(gh issue list --repo "${TARGET_REPOSITORY}" --state open --limit 100 \
+        # Dedupe by exact title among OPEN issues (a closed issue means the
+        # earlier breakage was resolved; a new failure gets a fresh issue).
+        # GitHub search strips the [] characters, so search loosely and match
+        # the exact title with jq.
+        existing="$(gh issue list --repo "${GITHUB_REPOSITORY}" --state open --limit 100 \
           --search "\"scheduled-failure\" in:title" --json number,title \
           | jq -r --arg title "${title}" 'map(select(.title == $title)) | (.[0].number // empty)')"
 
         if [ -n "${existing}" ]; then
-          echo "Appending comment to existing open issue rustfs/backlog#${existing}"
-          gh issue comment "${existing}" --repo "${TARGET_REPOSITORY}" --body "${body}"
+          echo "Appending comment to existing open issue #${existing}"
+          gh issue comment "${existing}" --repo "${GITHUB_REPOSITORY}" --body "${body}"
           exit 0
         fi
 
-        echo "Creating new issue in ${TARGET_REPOSITORY}: ${title}"
+        echo "Creating new issue: ${title}"
         if [ -n "${ISSUE_LABEL}" ]; then
-          if gh issue create --repo "${TARGET_REPOSITORY}" \
+          if gh issue create --repo "${GITHUB_REPOSITORY}" \
                --title "${title}" --body "${body}" --label "${ISSUE_LABEL}"; then
             exit 0
           fi
           echo "::warning::issue creation with label '${ISSUE_LABEL}' failed (missing label?); retrying without a label"
         fi
-        gh issue create --repo "${TARGET_REPOSITORY}" --title "${title}" --body "${body}"
+        gh issue create --repo "${GITHUB_REPOSITORY}" --title "${title}" --body "${body}"

.github/actions/setup-docker-compose/action.yml

@@ -1,39 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Set up Docker Compose
-description: Install the verified Compose CLI used by native Linux x86_64 Connect acceptance
-
-runs:
-  using: composite
-  steps:
-    - name: Install verified Docker Compose CLI plugin
-      shell: bash
-      run: |
-        set -euo pipefail
-        [[ $(uname -s) == Linux && $(uname -m) == x86_64 ]]
-        plugin_dir="${DOCKER_CONFIG:-$HOME/.docker}/cli-plugins"
-        mkdir -p "$plugin_dir"
-        compose_download=$(mktemp "${RUNNER_TEMP:?}/connect-compose.XXXXXX")
-        compose_staged=$(mktemp "$plugin_dir/.docker-compose.XXXXXX")
-        trap 'rm -f "$compose_download" "$compose_staged"' EXIT
-        curl --fail --location --retry 3 \
-          https://github.com/docker/compose/releases/download/v2.40.3/docker-compose-linux-x86_64 \
-          --output "$compose_download"
-        printf '%s  %s\n' \
-          dba9d98e1ba5bfe11d88c99b9bd32fc4a0624a30fafe68eea34d61a3e42fd372 \
-          "$compose_download" | sha256sum --check --strict
-        install -m 0755 "$compose_download" "$compose_staged"
-        mv -f "$compose_staged" "$plugin_dir/docker-compose"
-        [[ $(docker compose version --short) == 2.40.3 ]]

.github/actions/setup/action.yml

@@ -36,16 +36,6 @@ inputs:
     description: "Install cross-compilation tools"
     required: false
     default: "false"
-  zig-version:
-    description: >-
-      Zig version for cargo-zigbuild builds. Pinned so the `<target>.<glibc>`
-      baseline semantics cannot drift with an untested zig release.
-    required: false
-    default: "0.17.0"
-  cargo-zigbuild-version:
-    description: "cargo-zigbuild version installed for cross builds."
-    required: false
-    default: "0.23.4"
   target:
     description: "Target architecture to add"
     required: false
@@ -66,7 +56,10 @@ inputs:
 runs:
   using: "composite"
   steps:
-    # Use the pinned code generators rather than Ubuntu's older packages.
+    # protobuf-compiler is deliberately absent: the setup-protoc step below
+    # installs 35.1 into the tool cache and prepends it to PATH, so the apt
+    # build (older, and never version-matched) was shadowed on every run and
+    # simply never used.
     - name: Install system dependencies (Ubuntu)
       if: runner.os == 'Linux'
       shell: bash
@@ -76,9 +69,7 @@ runs:
           build-essential \
           pkg-config \
           libssl-dev \
-          ripgrep \
-          python3 \
-          gh
+          ripgrep
 
     # musl-gcc is needed by the native musl release leg, and zip/unzip by the
     # release packaging steps. No CI test lane touches any of them.
@@ -87,32 +78,13 @@ runs:
       shell: bash
       run: sudo apt-get install -y musl-tools zip unzip
 
-    - name: Install pinned code generators through GitHub API (Linux x64)
-      if: runner.os == 'Linux' && runner.arch == 'X64'
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-        ASSET_DOWNLOADER: ${{ github.action_path }}/download_release_asset.py
-      run: |
-        python3 "$ASSET_DOWNLOADER" --repository protocolbuffers/protobuf --tag v35.1 --asset protoc-35.1-linux-x86_64.zip --output "$RUNNER_TEMP/protoc.zip"
-        python3 "$ASSET_DOWNLOADER" --repository google/flatbuffers --tag v25.12.19 --asset 'Linux.flatc.binary.g++-13.zip' --output "$RUNNER_TEMP/flatc.zip"
-        python3 -m zipfile -e "$RUNNER_TEMP/protoc.zip" "$RUNNER_TEMP/protoc"
-        python3 -m zipfile -e "$RUNNER_TEMP/flatc.zip" "$RUNNER_TEMP/flatc"
-        chmod +x "$RUNNER_TEMP/protoc/bin/protoc" "$RUNNER_TEMP/flatc/flatc"
-        "$RUNNER_TEMP/protoc/bin/protoc" --version
-        "$RUNNER_TEMP/flatc/flatc" --version
-        echo "$RUNNER_TEMP/protoc/bin" >> "$GITHUB_PATH"
-        echo "$RUNNER_TEMP/flatc" >> "$GITHUB_PATH"
-
     - name: Install protoc
-      if: runner.os != 'Linux' || runner.arch != 'X64'
       uses: rustfs/setup-protoc@a3705324d8f9bf5b6c3573fb6cf8ae421db55dd6 # v3.0.1
       with:
         version: "35.1"
         repo-token: ${{ github.token }}
 
     - name: Install flatc
-      if: runner.os != 'Linux' || runner.arch != 'X64'
       uses: Nugine/setup-flatc@698800de72a96bfb22cf60431dc21a2ff9a7e07b # v1
       with:
         version: "25.12.19"
@@ -127,23 +99,17 @@ runs:
     - name: Install Zig
       if: inputs.install-cross-tools == 'true'
       uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
-      with:
-        version: ${{ inputs.zig-version }}
 
     - name: Install cargo-zigbuild
       if: inputs.install-cross-tools == 'true'
       uses: taiki-e/install-action@a21ae4029b089b9ddc45704028756f51ab8abe48 # cargo-zigbuild
-      with:
-        tool: cargo-zigbuild@${{ inputs.cargo-zigbuild-version }}
 
     - name: Install cargo-nextest
       if: inputs.install-test-tools == 'true'
       uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest
-      with:
-        tool: cargo-nextest@0.9.138
 
     - name: Setup Rust cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       with:
         # false is rust-cache's own default. With true, cleanup.ts returns
         # *before* pruning ~/.cargo/registry/src, and config.ts archives the
@@ -158,5 +124,5 @@ runs:
         # normalises, so cargo fingerprints stay valid.
         cache-all-crates: false
         cache-on-failure: true
-        shared-key: ${{ inputs.cache-shared-key }}${{ inputs.install-cross-tools == 'true' && format('-zig-{0}-zigbuild-{1}', inputs.zig-version, inputs.cargo-zigbuild-version) || '' }}
+        shared-key: ${{ inputs.cache-shared-key }}
         save-if: ${{ inputs.cache-save-if }}

.github/actions/setup/download_release_asset.py

@@ -1,84 +0,0 @@
-#!/usr/bin/env python3
-"""Download a named GitHub release asset through its API and verify its digest."""
-
-import argparse
-import hashlib
-import json
-from pathlib import Path
-import re
-import subprocess
-import sys
-import tempfile
-from urllib.parse import quote
-
-
-def download(repository, tag, name, output, expected_sha256=None):
-    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*", repository):
-        raise ValueError("invalid release repository")
-    if not tag or not name or "/" in name or "\\" in name:
-        raise ValueError("invalid release tag or asset name")
-    if expected_sha256 is not None and not re.fullmatch(r"[0-9a-f]{64}", expected_sha256):
-        raise ValueError("invalid pinned asset digest")
-    result = subprocess.run(
-        ["gh", "api", "--hostname", "github.com", f"repos/{repository}/releases/tags/{quote(tag, safe='')}"],
-        check=True, capture_output=True, text=True, timeout=60,
-    )
-    release = json.loads(result.stdout)
-    if not isinstance(release, dict) or release.get("tag_name") != tag:
-        raise ValueError("release metadata does not match the requested tag")
-    assets = release.get("assets")
-    if not isinstance(assets, list) or any(not isinstance(asset, dict) for asset in assets):
-        raise ValueError("invalid release asset inventory")
-    matches = [asset for asset in assets if asset.get("name") == name]
-    if len(matches) != 1:
-        raise ValueError("release must contain exactly one named asset")
-    asset = matches[0]
-    asset_id, size, digest = asset.get("id"), asset.get("size"), asset.get("digest")
-    if type(asset_id) is not int or asset_id <= 0 or type(size) is not int or not 0 < size <= 512 * 1024 * 1024:
-        raise ValueError("invalid release asset identity or size")
-    if not isinstance(digest, str) or not re.fullmatch(r"sha256:[0-9a-f]{64}", digest):
-        raise ValueError("release asset has no valid SHA-256 digest")
-    sha256 = digest.removeprefix("sha256:")
-    if expected_sha256 is not None and expected_sha256 != sha256:
-        raise ValueError("release digest differs from the pinned digest")
-    output = Path(output)
-    output.parent.mkdir(parents=True, exist_ok=True)
-    temporary = None
-    try:
-        with tempfile.NamedTemporaryFile(dir=output.parent, prefix=".release-asset-", delete=False) as stream:
-            temporary = Path(stream.name)
-            # gh authenticates to the API; its HTTP client strips credentials on
-            # cross-host redirects. No browser URL or token is supplied in argv.
-            subprocess.run(
-                ["gh", "api", "--hostname", "github.com", "--header", "Accept: application/octet-stream", f"repos/{repository}/releases/assets/{asset_id}"],
-                check=True, stdout=stream, timeout=300,
-            )
-        with temporary.open("rb") as stream:
-            actual = hashlib.file_digest(stream, "sha256").hexdigest()
-        if temporary.stat().st_size != size or actual != sha256:
-            raise ValueError("downloaded release asset failed size or SHA-256 verification")
-        temporary.replace(output)
-        print(f"Verified release asset: {repository} {tag} {name} sha256={actual}")
-    finally:
-        if temporary is not None:
-            temporary.unlink(missing_ok=True)
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--repository", required=True)
-    parser.add_argument("--tag", required=True)
-    parser.add_argument("--asset", required=True)
-    parser.add_argument("--output", required=True, type=Path)
-    parser.add_argument("--sha256")
-    args = parser.parse_args()
-    try:
-        download(args.repository, args.tag, args.asset, args.output, args.sha256)
-    except (ValueError, KeyError, TypeError, json.JSONDecodeError, subprocess.SubprocessError, OSError) as error:
-        print(f"Release asset download failed: {error}", file=sys.stderr)
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

.github/actions/test-runtime/action.yml

@@ -1,16 +0,0 @@
-name: Verification runtime
-description: Install the runtime for prebuilt test archives without a target cache
-runs:
-  using: composite
-  steps:
-    - name: Install runtime tools
-      shell: bash
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y libssl-dev ripgrep
-    - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-    - name: Install cargo-nextest
-      uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest
-      with:
-        tool: cargo-nextest@0.9.138

.github/dependabot.yml

@@ -32,8 +32,6 @@ updates:
       - "overtrue"
       - "majinghe"
     ignore:
-      - dependency-name: "pulsar"
-        versions: [ "6.9.x" ]
       - dependency-name: "object_store"
         versions: [ "0.13.x" ]
       - dependency-name: "libunftp"

.github/pull_request_template.md

@@ -24,7 +24,8 @@ List relevant checks not run and the remaining risk. Use the validation tier in
 
 ## Impact
 <!--
-Describe user-facing, compatibility, API, deployment, configuration, or documentation impact. Use N/A when there is no expected impact.
+Describe user-facing, compatibility, API, deployment, configuration, or
+documentation impact. Use N/A when there is no expected impact.
 -->
 
 ## Additional Notes

.github/workflows/README.md

@@ -1,85 +0,0 @@
-# Workflow runners: what is billed and where a job belongs
-
-**Use this when:** adding a job, changing a `runs-on`, moving a lane between runner pools, or deciding whether a new check is worth its runner cost.
-**Source of truth:** `runs-on` in each workflow file for current placement; `.github/actionlint.yaml` for the declared self-hosted labels; the organisation's Settings → Billing → Usage page for what is actually charged; `docs/testing/ci-gates.md` for which checks block a merge (that does not change when a runner changes).
-
-## Billing facts
-
-This repository is public. For a public repository, GitHub's standard hosted runners (`ubuntu-latest`, `windows-latest`, `macos-latest`) cost nothing and have no minute cap, whatever plan the organisation is on. GitHub bills only two things: larger hosted runners, including the `macos-latest-xlarge` release lane used here, and standard runners in private repositories.
-
-Every other label in this repository is capacity RustFS pays for. ARC pods and lab machines accrue cost while the machine exists. A Ubicloud label is metered for the minutes a job holds its VM:
-
-| Label | Paid by | What it is | Use it for |
-|---|---|---|---|
-| `ubuntu-latest` | nobody | GitHub-hosted, Ubuntu 24.04, 4 vCPU, 16 GB RAM, about 14 GB of free disk. Ships a C toolchain, `docker`, `gh`, `curl`, `wget`, `jq`, Python. Can `mount` tmpfs and loop devices; io_uring works | the default for every job |
-| `windows-latest`, `macos-latest` | nobody | GitHub-hosted standard runners | Windows and macOS targets |
-| `macos-latest-xlarge` | RustFS | GitHub-hosted larger Apple Silicon runner | macOS release builds, deferred until Linux acceptance for candidates |
-| `sm-standard-2` | RustFS | ARC pod, Ubuntu 24.04, minimal image: no `gh`, no C toolchain; Docker only on the `dind-` label | only a job that a hosted runner cannot run (see the placement rule) |
-| `sm-standard-4` | RustFS | ARC pod, Ubuntu 24.04, 14 CPUs and 28 GB (the label is not the core count), large disk | workspace-scale Cargo builds |
-| `ubicloud-standard-16-arm` | RustFS | Ubicloud VM, alias of `ubicloud-standard-16-arm-ubuntu-2404`: Ubuntu 24.04 arm64, 16 vCPU, 48 GB, 300 GB disk. Reached through the `build.yml` matrix, so `actionlint.yaml` does not list it | native aarch64 release builds (`linux-aarch64-musl`, `linux-aarch64-gnu`) |
-| `dind-sm-standard-2` | RustFS | ARC pod with Docker-in-Docker | Docker workloads with a measured resource or environment requirement beyond the hosted runner |
-| `smoke-testing`, `pf-testing` | RustFS | long-lived lab machines | the packaged functional chain and performance suites |
-
-The self-hosted pods and the hosted image are both Ubuntu 24.04, so a binary built on one runs on the other; `ci.yml` builds the debug binary on `sm-standard-4` and runs it on both pools.
-
-## Placement rule
-
-A job runs on `ubuntu-latest` unless it has one of these reasons, and the reason goes in a comment next to its `runs-on`:
-
-1. **Disk.** It restores or produces the workspace `target/`: `cargo build` or `cargo test` with `--all-targets`, `cargo nextest run --all`, or any reader of the `ci-dev` / `ci-feat-*` caches. The workspace test build leaves about 64 GB in `target/`; a hosted runner has about 14 GB.
-2. **Critical-path CPU.** It is a build that several downstream lanes wait on and would blow its timeout at 4 vCPU (`build-rustfs-debug-binary` gates the e2e and s3-tests lanes).
-3. **Hardware or environment.** Native aarch64 or access to the lab machines. Docker alone is not a reason: hosted Ubuntu ships Docker and supports the QEMU and Buildx setup actions.
-4. **Cache ownership.** It reads a `rust-cache` key that a self-hosted job writes (see the cache rule below).
-
-Jobs that do only the following have no reason to be self-hosted: shell or Python scripts, `cargo fmt`, `cargo deny`, typos, actionlint, API calls (`gh`, dependency review, issue and stale bots, CLA checks), downloading an artifact and running a prebuilt binary, or a `cargo build -p rustfs` with its own cache key. `e2e-distributed.yml` and `e2e-upgrade.yml` build the server and the `e2e_test` harness on `ubuntu-latest` inside their budgets, so "it compiles something" alone is not a reason.
-
-The functional chain's `prepare` and `complete-chain` jobs, the performance runner availability check, and runner hygiene use `ubuntu-latest`: they inspect APIs or artifacts, not the lab hosts. The actual functional and performance suites remain on their lab runners. Functional-chain health collection uses `ubuntu-latest` so a lab outage cannot also stop its independent monitor. Docker image packaging also uses `ubuntu-latest` for both musl and glibc variants; it wraps verified candidate binaries rather than compiling the workspace, and still sets up QEMU and Buildx explicitly.
-
-Moving these jobs off AKS reduces capacity demand, not necessarily the Azure bill immediately. VM costs fall only when nodes scale down or smaller capacity replaces them.
-
-A hosted runner is also the only choice for a few things the pods cannot do: `mount -o loop` and `mount -t tmpfs` fail inside the ARC pods, and a container runtime cannot guarantee that `io_uring_setup` is allowed. `uring-integration` and `e2e-distributed` are on `ubuntu-latest` for that reason, not for cost.
-
-## Cache rule
-
-`Swatinem/rust-cache` builds its key from the OS, architecture, toolchain and lockfile. It does not include the runner label or image, so a cache written on an `sm-standard-4` pod and one written on `ubuntu-latest` would overwrite each other under the same `shared-key`.
-
-- Every `shared-key` has exactly one writer. `cache-warm.yml` owns `ci-dev`, `ci-feat-rio`, `ci-feat-proto` and `ci-uring`; every other `./.github/actions/setup` call states `cache-save-if` explicitly, and `scripts/security/check_cache_save_if.sh` fails the build when one does not.
-- All readers of a key run on the same image as its writer. Keys that live on hosted runners say so in their name (`ci-uring` is warmed on `ubuntu-latest`; `ci-e2e-distributed-hosted`, `e2e-upgrade-server-hosted`, `e2e-upgrade-tests-hosted`).
-- Moving a job between pools therefore means renaming its key. The new key is empty until a run from `main` (a scheduled run, or a manual dispatch of that workflow from `main`) saves it; until then that lane does a cold build. The `build.yml` aarch64 release legs append `-ubicloud-arm` for this reason. `cache-warm.yml` does not write those keys.
-- `CARGO_BUILD_JOBS` and every other `CARGO*`, `CC*`, `CFLAGS*`, `CXX*`, `CMAKE*` and `RUST*` variable is hashed into the key. `ci.yml` sets `CARGO_BUILD_JOBS` at step level for that reason; promoting it to job level rotates the key for every lane that shares it.
-
-## Where self-hosted minutes leak
-
-These are the patterns that have cost real money here without validating anything more:
-
-- An `if: always()` summary or alert job on a self-hosted label inside a `workflow_run`-triggered workflow. The upstream workflow completes many times a day, the real jobs skip, and the summary still starts a pod each time. Gate it on the upstream job having run, and keep it on `ubuntu-latest`.
-- Per-push workflows on `main`. A merge triggers the applicable `ci.yml` matrix and cache warming; `build.yml` development builds are scheduled or manual; with tens of merges a day that is as much self-hosted time as all pull requests together. Anything that does not verify the merged tree itself belongs on a schedule or behind a `paths` filter.
-- `apt-get install` of tools the hosted image already ships. It is only needed on the minimal pod images.
-- A throttled `CARGO_BUILD_JOBS` on a 14-CPU pod. The limit exists for link-storm reasons documented in `ci.yml`; measure before raising it, and measure before lowering it further.
-- Tiny jobs on ARC pods. Each one pays roughly a minute of pod start-up before its first step; a compile-free job that takes ten seconds costs more to schedule than to run.
-
-## Measuring a run
-
-To see which pool each job of a run used and for how long:
-
-```bash
-gh api "repos/rustfs/rustfs/actions/runs/<run_id>/jobs?per_page=100" \
-  --jq '.jobs[] | "\(.conclusion)\t\(.labels | join(","))\t\(.started_at)\t\(.completed_at)\t\(.name)"'
-```
-
-Rows using `macos-latest-xlarge` or a label starting with `sm-`, `dind-`, `ubicloud-`, `smoke-` or `pf-` use paid capacity. At the October 2026 review, a full pull-request run of `ci.yml` spent about 150 self-hosted minutes, a third of it in jobs that never compiled; treat that as the scale of what a placement mistake costs, not as a current figure.
-
-## Checklist for a new or moved job
-
-- `runs-on` is a literal label. A new self-hosted label is declared in `.github/actionlint.yaml` in the same change (`.github/AGENTS.md`).
-- The job declares `timeout-minutes` (`scripts/security/check_job_timeouts.sh`).
-- `actionlint` reports nothing.
-- A self-hosted `runs-on` carries a comment naming its reason from the placement rule.
-- Every `./.github/actions/setup` call states `cache-save-if`, and a key read from one pool is not written from the other.
-- Moving a job does not change its check name, so the `main` ruleset and `docs/testing/ci-gates.md` stay as they are; renaming it does, and then that document's change checklist applies.
-
-## Release stages
-
-The [candidate release pipeline](../../docs/operations/release-pipeline.md) builds Linux first and defers paid desktop capacity until acceptance. Daily development builds also select Linux; use manual platform selection for desktop development artifacts. All six platforms remain required before publication. The pipeline records and promotes the exact tested bytes. Builder workflows have no public-release credentials. Keep periodic development builds, PR verification and field-test chains separate when their contracts differ; do not re-enable disabled workflows as part of a source-file migration.
-
-Larger runners remain billed for public repositories; see [GitHub runner billing](https://docs.github.com/en/actions/concepts/runners/larger-runners#billing). Actual spending comes from organization billing, not runner labels or an estimated build duration.

.github/workflows/architecture-migration-rules.yml

@@ -0,0 +1,61 @@
+# Copyright 2024 RustFS Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Architecture Migration Rules
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened, closed ]
+    branches: [ main ]
+    paths:
+      - "ARCHITECTURE.md"
+      - "docs/architecture/**"
+      - "scripts/check_architecture_migration_rules.sh"
+      - ".github/workflows/architecture-migration-rules.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cancel-closed-pr-runs:
+    name: Cancel Closed PR Runs
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Explain cancellation run
+        run: echo "PR closed; this run only cancels older runs in the same concurrency group."
+
+  architecture-migration-rules:
+    name: Architecture Migration Rules
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install ripgrep
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
+        with:
+          tool: ripgrep@15.2.0
+
+      - name: Check architecture migration rules
+        run: ./scripts/check_architecture_migration_rules.sh

.github/workflows/audit.yml

@@ -23,19 +23,10 @@ on:
       - 'deny.toml'
       - '.github/actions/**'
       - '.github/workflows/**'
-      - 'scripts/release/**'
-      - 'scripts/security/generate_release_supply_chain_assets.py'
-      - '.config/release-validation-plan.json'
-      - '.github/scheduled-validations.json'
-      - 'scripts/test_helm_release_workflow.py'
-      - 'scripts/test_release_packages.py'
-      - 'scripts/test_release_images.py'
-      - 'Dockerfile*'
-      - 'entrypoint.sh'
-      - 'bootstrap/**'
-      - 'scripts/test_package_service_scripts.sh'
+      - 'scripts/release/create_or_update_release.sh'
+      - 'scripts/release/package_versions.sh'
       - 'scripts/test_package_versions.sh'
-      - 'scripts/test_docker_workflow.py'
+      - 'scripts/security/check_performance_ab_workflow.sh'
       - 'scripts/security/check_preview_release_workflow.sh'
       - 'scripts/security/check_tier_artifact_workflow.sh'
       - 'scripts/security/check_workflow_pins.sh'
@@ -48,19 +39,10 @@ on:
       - 'deny.toml'
       - '.github/actions/**'
       - '.github/workflows/**'
-      - 'scripts/release/**'
-      - 'scripts/security/generate_release_supply_chain_assets.py'
-      - '.config/release-validation-plan.json'
-      - '.github/scheduled-validations.json'
-      - 'scripts/test_helm_release_workflow.py'
-      - 'scripts/test_release_packages.py'
-      - 'scripts/test_release_images.py'
-      - 'Dockerfile*'
-      - 'entrypoint.sh'
-      - 'bootstrap/**'
-      - 'scripts/test_package_service_scripts.sh'
+      - 'scripts/release/create_or_update_release.sh'
+      - 'scripts/release/package_versions.sh'
       - 'scripts/test_package_versions.sh'
-      - 'scripts/test_docker_workflow.py'
+      - 'scripts/security/check_performance_ab_workflow.sh'
       - 'scripts/security/check_preview_release_workflow.sh'
       - 'scripts/security/check_tier_artifact_workflow.sh'
       - 'scripts/security/check_workflow_pins.sh'
@@ -100,12 +82,12 @@ jobs:
   # database lookup with a second ignore list to maintain.
   cargo-deny:
     name: Cargo Deny
-    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -124,7 +106,7 @@ jobs:
       # default is now "false", but state it explicitly — see
       # scripts/security/check_cache_save_if.sh.
       - name: Setup Rust cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           # Same reasoning as the setup composite: true archives every
           # dependency's unpacked source tree.
@@ -134,7 +116,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2
+        uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2
         with:
           tool: cargo-deny
 
@@ -143,41 +125,15 @@ jobs:
 
   workflow-pin-report:
     name: Workflow Pin Report
-    if: github.repository == 'rustfs/rustfs' && (github.event_name != 'pull_request' || github.event.action != 'closed')
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: read
-    outputs:
-      release_changed: ${{ steps.scope.outputs.release_changed }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
-          fetch-depth: 0
           persist-credentials: false
 
-      - name: Scope native packaging checks to release changes
-        id: scope
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
-        run: |
-          python3 - <<'PY'
-          import os, re, subprocess
-          event, base = os.environ['GITHUB_EVENT_NAME'], os.environ.get('BASE_SHA', '')
-          changed = event == 'workflow_dispatch'
-          if event in ('push', 'pull_request'):
-              if not re.fullmatch(r'[0-9a-f]{40}', base) or base == '0' * 40:
-                  changed = True
-              else:
-                  paths = subprocess.check_output(['git', 'diff', '--name-only', base, os.environ['GITHUB_SHA']], text=True).splitlines()
-                  pattern = r'^(scripts/release/|scripts/test_release_|Dockerfile|entrypoint.sh$|bootstrap/|\.dockerignore$|\.config/release-validation-plan.json$|\.github/workflows/(audit|build|docker|package|helm-package|release-[^.]+)\.yml$)'
-                  changed = any(re.match(pattern, path) for path in paths)
-          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
-              output.write(f'release_changed={str(changed).lower()}\n')
-          PY
-
       - name: Report unpinned GitHub Actions
         run: ./scripts/security/check_workflow_pins.sh --enforce
 
@@ -190,35 +146,11 @@ jobs:
       - name: Check checkouts clear their credentials
         run: ./scripts/security/check_persist_credentials.sh
 
-      - name: Check release candidate and promotion contracts
-        run: python3 -m unittest discover -s scripts/release -p 'test_*.py'
+      - name: Check preview release workflow policy
+        run: ./scripts/security/check_preview_release_workflow.sh
 
-      - name: Prepare artifact transport rehearsal
-        run: |
-          mkdir -p "$RUNNER_TEMP/release-transport"
-          printf '{"purpose":"transport contract, not release evidence"}\n' > "$RUNNER_TEMP/release-transport/transport.json"
-
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: release-transport-contract-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/release-transport/transport.json
-          if-no-files-found: error
-          retention-days: 1
-
-      - name: Verify actual GitHub artifact metadata and downloaded bytes
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 - <<'PY'
-          import os, sys
-          from pathlib import Path
-          sys.path.insert(0, 'scripts/release')
-          import candidate as c
-          run = c.github(f"repos/{c.REPOSITORY}/actions/runs/{os.environ['GITHUB_RUN_ID']}")
-          destination = Path(os.environ['RUNNER_TEMP']) / 'release-transport-downloaded'
-          c.download_artifact(run, f"release-transport-contract-{os.environ['GITHUB_RUN_ATTEMPT']}", destination)
-          c.require(c.read_json(destination / 'transport.json') == {'purpose': 'transport contract, not release evidence'}, 'artifact round trip changed')
-          PY
+      - name: Check performance A/B workflow trust boundary
+        run: ./scripts/security/check_performance_ab_workflow.sh
 
       - name: Check tier evidence workflow isolation
         run: ./scripts/security/check_tier_artifact_workflow.sh
@@ -226,83 +158,6 @@ jobs:
       - name: Check package version contract
         run: ./scripts/test_package_versions.sh
 
-      - name: Check package service lifecycle contract
-        run: ./scripts/test_package_service_scripts.sh
-
-  release-package-contract:
-    name: Release package contract
-    needs: workflow-pin-report
-    if: needs.workflow-pin-report.outputs.release_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Install real package managers
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y ruby ruby-dev build-essential rpm fakeroot cpio
-          sudo gem install fpm --version 1.17.0 --no-document
-      - name: Exercise accepted and substituted payloads through both recipes
-        run: python3 scripts/test_release_packages.py
-
-  release-image-contract:
-    name: Release image contract (${{ matrix.variant }})
-    needs: workflow-pin-report
-    if: needs.workflow-pin-report.outputs.release_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    strategy:
-      fail-fast: false
-      matrix:
-        variant: [musl, gnu]
-    env:
-      RELEASE_IMAGE_VARIANT: ${{ matrix.variant }}
-      NO_PROXY: 127.0.0.1,localhost,::1
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Install OCI tools
-        run: |
-          echo "RELEASE_IMAGE_OUTPUT=$RUNNER_TEMP/image-contract" >> "$GITHUB_ENV"
-          echo 'no_proxy=127.0.0.1,localhost,::1' >> "$GITHUB_ENV"
-          sudo apt-get update
-          sudo apt-get install -y skopeo
-          go version
-      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - name: Exercise real OCI packaging, startup, registry retry and conflicts
-        run: python3 scripts/test_release_images.py
-      - name: Exercise amd64 OCI archive scanning
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
-        env:
-          TRIVY_PLATFORM: linux/amd64
-        with:
-          input: ${{ runner.temp }}/image-contract-scan/image-${{ matrix.variant }}-amd64.tar
-          format: sarif
-          output: ${{ runner.temp }}/image-contract/scan-${{ matrix.variant }}-amd64.sarif
-          exit-code: "0"
-      - name: Exercise arm64 OCI archive scanning
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
-        env:
-          TRIVY_PLATFORM: linux/arm64
-        with:
-          input: ${{ runner.temp }}/image-contract-scan/image-${{ matrix.variant }}-arm64.tar
-          format: sarif
-          output: ${{ runner.temp }}/image-contract/scan-${{ matrix.variant }}-arm64.sarif
-          exit-code: "0"
-      - name: Verify scan receipts before recording the archive
-        run: |
-          python3 - <<'PY'
-          import os, sys
-          from pathlib import Path
-          sys.path.insert(0, 'scripts/release')
-          import deliver, test_candidate
-          deliver.image_record(test_candidate.inputs(), os.environ['RELEASE_IMAGE_VARIANT'], Path(os.environ['RELEASE_IMAGE_OUTPUT']))
-          PY
-
   dependency-review:
     name: Dependency Review
     runs-on: ubuntu-latest
@@ -313,7 +168,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -339,17 +194,17 @@ jobs:
     # workflow produces, and until now it was only visible to whoever happened to
     # open the Actions tab. Same ci-8 mechanism coverage.yml and
     # e2e-replication-nightly.yml already use.
-    if: github.repository == 'rustfs/rustfs' && (always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure'))
+    if: always() && github.event_name == 'schedule' && contains(needs.*.result, 'failure')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
       - name: Open or update failure-tracking issue
         uses: ./.github/actions/schedule-failure-issue
         with:
-          github-token: ${{ secrets.BACKLOG_ISSUE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/btf-prototype-reference.yml

@@ -1,75 +0,0 @@
-name: BTF prototype reference
-
-on:
-  pull_request:
-    paths:
-      - "scripts/inspect_btf_prototypes.py"
-      - "scripts/test_inspect_btf_prototypes.py"
-      - "scripts/fixtures/btf_prototypes.c"
-      - ".github/workflows/btf-prototype-reference.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: btf-prototype-reference-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  reference:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-      - name: Check prototype and CLI contracts
-        run: python3 -B scripts/test_inspect_btf_prototypes.py
-      - name: Install only missing native reference tools
-        run: |
-          select_bpftool() {
-            local candidate
-            local candidates=()
-            if command -v bpftool >/dev/null; then
-              candidates+=("$(command -v bpftool)")
-            fi
-            for candidate in /usr/lib/linux-tools-*/bpftool /usr/lib/linux-tools/*/bpftool; do
-              if [[ -x "$candidate" ]]; then
-                candidates+=("$candidate")
-              fi
-            done
-            while IFS= read -r candidate; do
-              if [[ -x "$candidate" ]] && file -Lb "$candidate" | grep -q 'ELF' \
-                && "$candidate" version >/dev/null 2>&1; then
-                printf '%s\n' "$candidate"
-                return 0
-              fi
-            done < <(printf '%s\n' "${candidates[@]}" | sort -Vr)
-            return 1
-          }
-          packages=()
-          command -v clang >/dev/null || packages+=(clang)
-          command -v llvm-objcopy >/dev/null || packages+=(llvm)
-          command -v gcc >/dev/null || packages+=(gcc)
-          select_bpftool >/dev/null || packages+=(linux-tools-generic)
-          if (( ${#packages[@]} )); then
-            sudo apt-get update
-            sudo apt-get install --no-install-recommends -y "${packages[@]}"
-          fi
-          # File parsing needs a working binary, not a host-kernel wrapper.
-          selected_bpftool="$(select_bpftool)"
-          "$selected_bpftool" version
-          printf 'BPFTOOL=%s\n' "$selected_bpftool" >> "$GITHUB_ENV"
-      - name: Compare declarations and layouts with independent references
-        run: |
-          clang -target bpf -O2 -g -c scripts/fixtures/btf_prototypes.c -o "$RUNNER_TEMP/prototypes.o"
-          llvm-objcopy --dump-section ".BTF=$RUNNER_TEMP/prototypes.btf" "$RUNNER_TEMP/prototypes.o"
-          gcc -std=c11 -Wall -Wextra -Werror -DRUSTFS_BTF_LAYOUT_REFERENCE \
-            scripts/fixtures/btf_prototypes.c -o "$RUNNER_TEMP/layout-reference"
-          "$RUNNER_TEMP/layout-reference" > "$RUNNER_TEMP/layout-reference.json"
-          python3 -B scripts/test_inspect_btf_prototypes.py --native-reference "$RUNNER_TEMP/prototypes.btf" \
-            --layout-reference "$RUNNER_TEMP/layout-reference.json"

.github/workflows/cache-warm.yml

@@ -15,16 +15,16 @@
 # Sole writer of the Rust dependency caches that ci.yml restores.
 #
 # Why this is a separate workflow rather than steps inside ci.yml: ci.yml's
-# concurrency group originally cancelled in-progress main runs, while merges
-# landed faster than its 70-minute pipeline. Over 15 consecutive main pushes:
+# concurrency group cancels in-progress runs on main pushes, and merges land far
+# faster than its 70-minute pipeline. Measured over 15 consecutive main pushes:
 # 12 cancelled, 2 failed, 0 succeeded. A cancelled run never reaches
 # Swatinem/rust-cache's post step (cache-on-failure does not cover cancellation),
 # so the writer lanes were saving nothing and every PR paid a cold restore —
 # 11.8-20.9 minutes of "Setup Rust environment" against 0.7-3.4 warm.
 #
-# Keep cache writing separate from validation: only these jobs publish the
-# complete feature closure for each key. Main validation now also finishes its
-# running baseline, while superseded PR attempts can still be cancelled.
+# Splitting cache writing out of the test pipeline lets ci.yml keep cancelling
+# superseded runs (which is correct — nobody needs test results for a commit
+# that is already three merges behind) while the caches still get written.
 #
 # The group below deliberately does NOT cancel in progress; see the comment on
 # it for how that bounds concurrency and why it is scoped by event.
@@ -42,23 +42,26 @@
 name: Cache Warm
 
 on:
-  schedule:
-    # Every six hours; the 22:41 UTC run lands before ci.yml's nightly 00:11
-    # UTC matrix. A reader restores the newest entry under its key and
-    # rebuilds whatever its own diff changed, so a cache up to six hours old
-    # costs a PR the handful of crates merged since. Warming after every merge
-    # (fourteen completed runs a day, about two sm-standard-4 hours each)
-    # spent far more than that to avoid it.
-    - cron: "41 4,10,16,22 * * *"
   push:
     branches: [ main ]
-    # A toolchain or lockfile change invalidates most of every key; those
-    # re-warm at once instead of waiting for the next slot.
-    paths:
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - ".github/actions/setup/**"
-      - ".github/workflows/cache-warm.yml"
+    # Mirrors ci.yml's push paths-ignore: if a commit cannot change what ci.yml
+    # compiles, it cannot change what ci.yml needs restored either.
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+      - "deploy/**"
+      - "scripts/dev_*.sh"
+      - "scripts/probe.sh"
+      - "LICENSE*"
+      - ".gitignore"
+      - ".dockerignore"
+      - "README*"
+      - "**/*.png"
+      - "**/*.jpg"
+      - "**/*.svg"
+      - ".github/workflows/build.yml"
+      - ".github/workflows/docker.yml"
+      - ".github/workflows/audit.yml"
   workflow_dispatch:
     inputs:
       emit_timings:
@@ -72,7 +75,7 @@ on:
 permissions:
   contents: read
 
-# Scoped by event. Scheduled, push and dispatch runs do not compete: GitHub keeps
+# Scoped by event. A push run and a dispatch run do not compete: GitHub keeps
 # one running plus one pending per group, so with a single shared group a
 # manually dispatched run was displaced as pending by the next merge and
 # cancelled — observed three times in a row, which made the --timings gate in
@@ -96,7 +99,7 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
-  # Readers: workspace-lint-and-build, workspace-tests (workspace and ILM), build-rustfs-debug-binary,
+  # Readers: test-and-lint, test-ilm-integration-serial, build-rustfs-debug-binary,
   # e2e-tests, e2e-full.
   warm-ci-dev:
     name: Warm ci-dev
@@ -106,7 +109,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -138,7 +141,7 @@ jobs:
 
       - name: Upload cargo timings report
         if: inputs.emit_timings
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: cargo-timings-ci-dev
           path: target/cargo-timings/
@@ -146,7 +149,7 @@ jobs:
           if-no-files-found: error
 
       # --all-targets covers the test binaries nextest builds, including
-      # e2e_test, which the workspace run excludes. The second build adds
+      # e2e_test, which test-and-lint's own run excludes. The second build adds
       # the e2e-test-hooks feature resolution that build-rustfs-debug-binary uses
       # and that no lint lane enables.
       - name: Build ci-dev superset
@@ -159,17 +162,6 @@ jobs:
           cargo build --workspace --all-targets
           cargo build -p rustfs --bins --features e2e-test-hooks
 
-      # ci.yml runs Clippy on every pull request. Clippy's check-mode artifacts
-      # are separate from the build above, so warm them with the exact
-      # invocation ci.yml uses; a pull request then re-checks only what its diff
-      # touches. A lint failure on main must not stop the warm-up: the cache is
-      # still saved (cache-on-failure), and the failure belongs to ci.yml.
-      - name: Warm Clippy check artifacts
-        run: |
-          if ! cargo clippy --all-targets -- -D warnings; then
-            echo "::warning::cargo clippy reports findings on this commit; check artifacts are still cached"
-          fi
-
       # Runs before rust-cache's post step, so these are the sizes it is about
       # to archive. Reported so the cache-all-crates decision stays evidence-led:
       # registry/src is what that flag prunes, registry/cache is what the pruned
@@ -193,10 +185,9 @@ jobs:
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
 
-  # Readers: test-and-lint-rio-v2 (nightly schedule, merge group, dispatch),
-  # build-rustfs-debug-binary-rio-v2 (nightly schedule / manual dispatch only —
-  # dormant rio-v2 variant, see rustfs/backlog#1835 and
-  # docs/architecture/minio-file-format-compat.md).
+  # Readers: test-and-lint-rio-v2 (per-PR), build-rustfs-debug-binary-rio-v2
+  # (weekly schedule / manual dispatch only — dormant rio-v2 variant, see
+  # rustfs/backlog#1835 and docs/architecture/minio-file-format-compat.md).
   # The second build below stays despite the reduced cadence: it warms the
   # rio-v2,e2e-test-hooks feature resolution the scheduled build restores,
   # which keeps that lane inside its 30-minute timeout.
@@ -208,7 +199,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -239,7 +230,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -269,7 +260,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 

.github/workflows/ci-resource-accounting.yml

@@ -1,60 +0,0 @@
-name: CI Resource Accounting
-
-on:
-  workflow_dispatch:
-    inputs:
-      since:
-        description: "Inclusive run creation timestamp, for example 2026-10-01T00:00:00Z"
-        required: true
-        type: string
-      until:
-        description: "Inclusive end timestamp; keep the window below 1000 runs"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-  actions: read
-  pull-requests: read
-
-concurrency:
-  group: ci-resource-accounting
-  cancel-in-progress: false
-
-jobs:
-  collect:
-    if: github.repository == 'rustfs/rustfs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - name: Collect all workflow attempts in the window
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ACCOUNTING_SINCE: ${{ inputs.since }}
-          ACCOUNTING_UNTIL: ${{ inputs.until }}
-          ACCOUNTING_REPOSITORY: ${{ github.repository }}
-        run: |
-          python3 scripts/ci/actions_cost_report.py \
-            --repository "$ACCOUNTING_REPOSITORY" \
-            --since "$ACCOUNTING_SINCE" --until "$ACCOUNTING_UNTIL" \
-            --output "$RUNNER_TEMP/ci-accounting.json" \
-            --summary "$RUNNER_TEMP/ci-accounting.md"
-      - name: Show available accounting summary
-        if: always()
-        run: |
-          if [[ -f "$RUNNER_TEMP/ci-accounting.md" ]]; then
-            cat "$RUNNER_TEMP/ci-accounting.md" >> "$GITHUB_STEP_SUMMARY"
-          fi
-      - name: Retain recomputable accounting evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: ci-accounting-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            ${{ runner.temp }}/ci-accounting.json
-            ${{ runner.temp }}/ci-accounting.md
-          if-no-files-found: error
-          retention-days: 30

.github/workflows/ci-runner-pilot.yml

@@ -1,92 +0,0 @@
-name: CI Runner Pilot
-
-on:
-  workflow_dispatch:
-    inputs:
-      pool:
-        description: "Existing runner pool; no infrastructure is created"
-        required: true
-        type: choice
-        options: [hosted, arc]
-        default: hosted
-      workload:
-        description: "Probe only, or perform cold/warm fixed-source builds"
-        required: true
-        type: choice
-        options: [probe, server, workspace-tests]
-        default: probe
-      source_sha:
-        description: "Exact 40-character merged main SHA; required for builds"
-        type: string
-      toolchain:
-        description: "Exact Rust version such as 1.92.0; required for builds"
-        type: string
-      scratch_root:
-        description: "Existing absolute scratch directory; empty uses runner.temp"
-        type: string
-      build_jobs:
-        description: "Fixed Cargo concurrency for both comparisons (1-16)"
-        type: string
-        default: "2"
-      local_ssd:
-        description: "Require operator /etc/rustfs-runner/storage.json attestation"
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-runner-pilot
-  cancel-in-progress: false
-
-jobs:
-  hosted:
-    if: github.repository == 'rustfs/rustfs' && github.ref == 'refs/heads/main' && inputs.pool == 'hosted'
-    runs-on: ubuntu-latest
-    timeout-minutes: 150
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/runner-pilot
-        with:
-          workload: ${{ inputs.workload }}
-          source-sha: ${{ inputs.source_sha }}
-          toolchain: ${{ inputs.toolchain }}
-          scratch-root: ${{ inputs.scratch_root }}
-          build-jobs: ${{ inputs.build_jobs }}
-          local-ssd: ${{ inputs.local_ssd }}
-      - name: Retain hosted pilot evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: runner-pilot-hosted-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/runner-pilot-evidence
-          if-no-files-found: error
-          retention-days: 30
-  arc:
-    if: github.repository == 'rustfs/rustfs' && github.ref == 'refs/heads/main' && inputs.pool == 'arc'
-    # Disk and hardware: measure the existing workspace build pool's storage.
-    runs-on: sm-standard-4
-    timeout-minutes: 150
-    steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/runner-pilot
-        with:
-          workload: ${{ inputs.workload }}
-          source-sha: ${{ inputs.source_sha }}
-          toolchain: ${{ inputs.toolchain }}
-          scratch-root: ${{ inputs.scratch_root }}
-          build-jobs: ${{ inputs.build_jobs }}
-          local-ssd: ${{ inputs.local_ssd }}
-      - name: Retain ARC pilot evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: runner-pilot-arc-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/runner-pilot-evidence
-          if-no-files-found: error
-          retention-days: 30

.github/workflows/cla.yml

@@ -66,7 +66,7 @@ jobs:
     steps:
       - name: Report CLA result for merge queue
         if: github.event_name == 'merge_group'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             await github.rest.checks.create({
@@ -95,7 +95,7 @@ jobs:
 
       - name: Run CLA Bot
         if: github.event_name != 'merge_group'
-        uses: overtrue/cla-bot@4bd1387c19691168c42fcf5edfa17b15819b2ab3 # v0.1.1
+        uses: overtrue/cla-bot@5e5929846a60cfb42b16d0d38e135ef67d94fc88 # v0.0.9
         with:
           github-token: ${{ github.token }}
           registry-token: ${{ steps.registry-token.outputs.token }}

.github/workflows/connect-diagnostic-schedule-acceptance.yml

@@ -1,206 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Connect diagnostic scheduler receipt acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect scheduler acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  diagnostic-schedule:
-    name: Verify production scheduler receipts over mTLS
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ && "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" --arg repository "$GITHUB_REPOSITORY" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == $repository
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-
-          gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract the verified official binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and (stat.S_IFMT(mode) in (0, stat.S_IFREG))
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({item.filename for item in entries}) == len(entries)
-              assert all(regular(item) and pathlib.PurePosixPath(item.filename).name == item.filename for item in entries)
-              assert sum(item.file_size for item in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  assert {item.filename for item in entries} == {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'} and len(entries) == 3
-                  assert all(regular(item) and 0 < item.file_size <= 1073741824 for item in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      import shutil
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-          file binary/rustfs | grep -Eq 'ELF 64-bit LSB.*x86-64'
-
-      - name: Run the real scheduler and receipt delivery scenario
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          [[ $(git -C connect-harness diff --name-only) == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          (cd connect-harness && ./tests/connectivity/diagnostic-schedule-evidence.test.sh)
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_DIAGNOSTIC_SCHEDULE_EVIDENCE="$GITHUB_WORKSPACE/diagnostic-schedule-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=diagnostic-schedule
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" '
-            .provenance.connectSha == $connect and .provenance.sourceSha == $source
-            and .provenance.binarySha256 == $binary
-          ' diagnostic-schedule-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" '
-            .provenance += {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest}
-          ' diagnostic-schedule-evidence.json > diagnostic-schedule-evidence.bound.json
-          mv diagnostic-schedule-evidence.bound.json diagnostic-schedule-evidence.json
-          node connect-harness/tests/connectivity/verify-diagnostic-schedule-evidence.mjs diagnostic-schedule-evidence.json --bound
-
-      - name: Upload verified receipt evidence
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: connect-diagnostic-schedule-evidence-${{ github.run_id }}
-          path: diagnostic-schedule-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-health-service-acceptance.yml

@@ -1,244 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Connect bounded health service acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect health service acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  health-service:
-    name: Verify bounded health service over mTLS
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_REPOSITORY" == rustfs/rustfs ]]
-          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-          run=$(gh api "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == "rustfs/rustfs"
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-          jq -r '.expires_at' <<<"$artifact" > artifact-expires-at
-          gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          [[ $(stat --format=%s official-artifact.zip) == $(jq -r '.size_in_bytes' <<<"$artifact") ]]
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract only the verified official service binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import shutil
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and stat.S_IFMT(mode) in (0, stat.S_IFREG)
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({entry.filename for entry in entries}) == len(entries)
-              assert all(regular(entry) and pathlib.PurePosixPath(entry.filename).name == entry.filename for entry in entries)
-              assert sum(entry.file_size for entry in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  assert {entry.filename for entry in entries} == {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'} and len(entries) == 3
-                  assert all(regular(entry) and 0 < entry.file_size <= 1073741824 for entry in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      header = source.read(20)
-                      assert header[:7] == b'\x7fELF\x02\x01\x01' and header[18:20] == b'\x3e\x00', 'Expected a little-endian ELF64 x86-64 binary'
-                      destination.write(header)
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-
-      - name: Run the real health service job
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          changed=$(git -C connect-harness diff --name-only)
-          [[ -z "$changed" || "$changed" == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          (cd connect-harness && ./tests/connectivity/health-service-evidence.test.sh)
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_HEALTH_SERVICE_EVIDENCE="$GITHUB_WORKSPACE/health-service-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=health-service
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" '
-            .provenance.connectSha == $connect and .provenance.sourceSha == $source
-            and .provenance.binarySha256 == $binary
-          ' health-service-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" \
-            --arg expiry "$(cat artifact-expires-at)" '
-            .provenance += {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest,artifactExpiresAt:$expiry}
-          ' health-service-evidence.json > health-service-evidence.bound.json
-          mv health-service-evidence.bound.json health-service-evidence.json
-          node connect-harness/tests/connectivity/health-service-evidence.mjs health-service-evidence.json --bound
-
-      - name: Upload only verified sanitized evidence
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: connect-health-service-evidence-${{ github.run_id }}
-          path: health-service-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-performance-drive-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect performance.drive service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  performance-drive:
-    name: Verify native Linux x86_64 performance.drive service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PERFORMANCE_DRIVE_EVIDENCE="$GITHUB_WORKSPACE/performance-drive-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=performance-drive
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('performance-drive-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            performance-drive-service-job-evidence.json >performance-drive-service-job-evidence.bound.json
-          mv performance-drive-service-job-evidence.bound.json performance-drive-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('performance-drive-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-performance-drive-evidence-${{ github.run_id }}
-          path: |
-            performance-drive-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-performance-network-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect performance.network service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  performance-network:
-    name: Verify native Linux x86_64 performance.network service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PERFORMANCE_NETWORK_EVIDENCE="$GITHUB_WORKSPACE/performance-network-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=performance-network
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('performance-network-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            performance-network-service-job-evidence.json >performance-network-service-job-evidence.bound.json
-          mv performance-network-service-job-evidence.bound.json performance-network-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('performance-network-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-performance-network-evidence-${{ github.run_id }}
-          path: |
-            performance-network-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-profile-cpu-acceptance.yml

@@ -1,221 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect profile.cpu service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      catalog_sha256:
-        description: Independently reviewed release CPU catalog SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  profile-cpu:
-    name: Verify native Linux x86_64 profile.cpu service job
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          github_api() {
-            curl --fail --silent --show-error \
-              --header "Authorization: Bearer $GH_TOKEN" \
-              --header 'Accept: application/vnd.github+json' \
-              "https://api.github.com/$1"
-          }
-
-          run=$(github_api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(github_api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(github_api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary and reviewed catalog
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CATALOG_SHA256: ${{ inputs.catalog_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ "$CATALOG_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs rustfs.cpu-symbol-catalog.json rustfs.cpu-symbol-catalog.sha256 -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-          # The packaged digest is corroboration, never the independent trust input.
-          [[ $(cat binary/rustfs.cpu-symbol-catalog.sha256) == "$CATALOG_SHA256" ]]
-          printf '%s  %s\n' "$CATALOG_SHA256" binary/rustfs.cpu-symbol-catalog.json | sha256sum --check --strict
-          chmod 0444 binary/rustfs.cpu-symbol-catalog.json
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          CATALOG_SHA256: ${{ inputs.catalog_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_CPU_CATALOG="$GITHUB_WORKSPACE/binary/rustfs.cpu-symbol-catalog.json" \
-            CONNECT_E2E_CPU_CATALOG_SHA256="$CATALOG_SHA256" \
-            CONNECT_E2E_PROFILE_EVIDENCE="$GITHUB_WORKSPACE/profile-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=profile
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('profile-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            profile-service-job-evidence.json >profile-service-job-evidence.bound.json
-          mv profile-service-job-evidence.bound.json profile-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('profile-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-profile-cpu-evidence-${{ github.run_id }}
-          path: |
-            profile-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-profile-memory-acceptance.yml

@@ -1,243 +0,0 @@
-# Copyright 2026 RustFS Team
-# SPDX-License-Identifier: Apache-2.0
-
-name: Connect service memory profile acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect memory acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  profile-memory:
-    name: Verify signed service memory profile over mTLS
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_REPOSITORY" == rustfs/rustfs ]]
-          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-          run=$(gh api "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == "rustfs/rustfs"
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-          jq -r '.expires_at' <<<"$artifact" > artifact-expires-at
-          gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          [[ $(stat --format=%s official-artifact.zip) == $(jq -r '.size_in_bytes' <<<"$artifact") ]]
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract only the verified official service binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import shutil
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and stat.S_IFMT(mode) in (0, stat.S_IFREG)
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({entry.filename for entry in entries}) == len(entries)
-              assert all(regular(entry) and pathlib.PurePosixPath(entry.filename).name == entry.filename for entry in entries)
-              assert sum(entry.file_size for entry in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  expected = {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'}
-                  assert {entry.filename for entry in entries} == expected and len(entries) == len(expected)
-                  assert all(regular(entry) and 0 < entry.file_size <= 1073741824 for entry in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-          file binary/rustfs | grep -Eq 'ELF 64-bit LSB.*x86-64'
-
-      - name: Run the real service job under S3 workload
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          changed=$(git -C connect-harness diff --name-only)
-          [[ -z "$changed" || "$changed" == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          (cd connect-harness && ./tests/connectivity/profile-memory-evidence.test.sh)
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PROFILE_MEMORY_EVIDENCE="$GITHUB_WORKSPACE/profile-memory-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=profile-memory
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" '
-            .provenance.connectSha == $connect and .provenance.sourceSha == $source
-            and .provenance.binarySha256 == $binary
-          ' profile-memory-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" \
-            --arg expiry "$(cat artifact-expires-at)" '
-            .provenance += {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest,artifactExpiresAt:$expiry}
-          ' profile-memory-evidence.json > profile-memory-evidence.bound.json
-          mv profile-memory-evidence.bound.json profile-memory-evidence.json
-          node connect-harness/tests/connectivity/profile-memory-evidence.mjs profile-memory-evidence.json --bound
-
-      - name: Upload only verified sanitized evidence
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
-        with:
-          name: connect-profile-memory-evidence-${{ github.run_id }}
-          path: profile-memory-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-profile-threads-acceptance.yml

@@ -1,249 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect profile.threads service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      thread_scope:
-        description: Thread profile scope
-        required: true
-        type: choice
-        default: native
-        options:
-          - native
-          - runtime
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  profile-threads:
-    name: Verify Linux x86_64 profile.threads service job
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          THREAD_SCOPE: ${{ inputs.thread_scope }}
-        run: |
-          set -euo pipefail
-          case "$THREAD_SCOPE" in
-            native) export CONNECT_E2E_THREAD_SCOPE=NATIVE_THREADS ;;
-            runtime) export CONNECT_E2E_THREAD_SCOPE=TOKIO_RUNTIME ;;
-            *) exit 1 ;;
-          esac
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_PROFILE_THREADS_EVIDENCE="$GITHUB_WORKSPACE/profile-threads-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=profile-threads
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('profile-threads-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          THREAD_SCOPE: ${{ inputs.thread_scope }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            --arg requestedThreadScope "$THREAD_SCOPE" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha, requestedThreadScope: $requestedThreadScope}' \
-            profile-threads-service-job-evidence.json >profile-threads-service-job-evidence.bound.json
-          mv profile-threads-service-job-evidence.bound.json profile-threads-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('profile-threads-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-profile-threads-evidence-${{ github.run_id }}
-          path: |
-            profile-threads-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-api-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.api service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-api:
-    name: Verify native Linux x86_64 top.api service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_API_EVIDENCE="$GITHUB_WORKSPACE/top-api-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-api
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('top-api-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            top-api-service-job-evidence.json >top-api-service-job-evidence.bound.json
-          mv top-api-service-job-evidence.bound.json top-api-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('top-api-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-api-evidence-${{ github.run_id }}
-          path: |
-            top-api-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-disk-acceptance.yml

@@ -1,259 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.disk service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Successful main-branch Build and Release run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact RustFS source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Independently verified rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact Connect top.disk service-job acceptance harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-disk:
-    name: Verify native top.disk service job over mTLS
-    runs-on: dind-sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Ensure GitHub CLI
-        shell: bash
-        run: |
-          if command -v gh >/dev/null 2>&1; then
-            gh --version
-            exit 0
-          fi
-
-          gh_version="2.101.0"
-          case "$(uname -m)" in
-            x86_64) gh_arch="amd64" ;;
-            aarch64|arm64) gh_arch="arm64" ;;
-            *)
-              echo "Unsupported Linux architecture for GitHub CLI: $(uname -m)" >&2
-              exit 1
-              ;;
-          esac
-
-          gh_install_root="${RUNNER_TEMP:-$PWD}/gh-cli"
-          rm -rf "$gh_install_root"
-          mkdir -p "$gh_install_root/bin"
-          archive="$gh_install_root/gh.tar.gz"
-          curl --fail --location --retry 3 \
-            "https://github.com/cli/cli/releases/download/v${gh_version}/gh_${gh_version}_linux_${gh_arch}.tar.gz" \
-            --output "$archive"
-          tar -xzf "$archive" -C "$gh_install_root"
-          install -m 0755 \
-            "$gh_install_root/gh_${gh_version}_linux_${gh_arch}/bin/gh" \
-            "$gh_install_root/bin/gh"
-          echo "$gh_install_root/bin" >> "$GITHUB_PATH"
-          export PATH="$gh_install_root/bin:$PATH"
-          gh --version
-
-      - name: Verify official source and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_REPOSITORY" == rustfs/rustfs ]]
-          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ && "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ && "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$BINARY_SHA256" =~ ^[0-9a-f]{64}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-          run=$(gh api "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}")
-          jq -e --arg source "$SOURCE_SHA" '
-            .head_sha == $source and .head_branch == "main"
-            and .head_repository.full_name == "rustfs/rustfs"
-            and .name == "Build and Release" and .path == ".github/workflows/build.yml"
-            and .status == "completed" and .conclusion == "success"
-          ' <<<"$run" >/dev/null
-          jobs=$(gh api --paginate --slurp "repos/rustfs/rustfs/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e '
-            [.[].jobs[] | select(.name | test("^Build RustFS \\(linux-x86_64-gnu\\)$"))] as $matches
-            | ($matches | length) == 1 and $matches[0].conclusion == "success"
-          ' <<<"$jobs" >/dev/null
-          artifact=$(gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}")
-          jq -e --argjson run "$BUILD_RUN_ID" --arg source "$SOURCE_SHA" --arg digest "$ARTIFACT_DIGEST" '
-            .workflow_run.id == $run and .workflow_run.head_sha == $source
-            and .name == ("rustfs-linux-x86_64-gnu-dev-" + $source[0:7])
-            and .digest == $digest and .expired == false
-            and (.expires_at | fromdateiso8601) > now
-            and .size_in_bytes > 0 and .size_in_bytes <= 2147483648
-          ' <<<"$artifact" >/dev/null
-          jq -r '.expires_at' <<<"$artifact" > artifact-expires-at
-          gh api "repos/rustfs/rustfs/actions/artifacts/${ARTIFACT_ID}/zip" > official-artifact.zip
-          [[ $(stat --format=%s official-artifact.zip) == $(jq -r '.size_in_bytes' <<<"$artifact") ]]
-          printf '%s  official-artifact.zip\n' "${ARTIFACT_DIGEST#sha256:}" | sha256sum --check --strict
-
-      - name: Extract only the verified official service binary
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          import io
-          import os
-          import pathlib
-          import shutil
-          import stat
-          import zipfile
-
-          def regular(entry):
-              mode = entry.external_attr >> 16
-              return not entry.is_dir() and stat.S_IFMT(mode) in (0, stat.S_IFREG)
-
-          package = f"rustfs-linux-x86_64-gnu-dev-{os.environ['SOURCE_SHA'][:7]}.zip"
-          with zipfile.ZipFile('official-artifact.zip') as outer:
-              entries = outer.infolist()
-              assert 1 <= len(entries) <= 16
-              assert len({entry.filename for entry in entries}) == len(entries)
-              assert all(regular(entry) and pathlib.PurePosixPath(entry.filename).name == entry.filename for entry in entries)
-              assert sum(entry.file_size for entry in entries) <= 2147483648
-              assert outer.testzip() is None
-              with zipfile.ZipFile(io.BytesIO(outer.read(package))) as inner:
-                  entries = inner.infolist()
-                  expected = {'rustfs', 'rustfs.cpu-symbol-catalog.json', 'rustfs.cpu-symbol-catalog.sha256'}
-                  assert {entry.filename for entry in entries} == expected and len(entries) == len(expected)
-                  assert all(regular(entry) and 0 < entry.file_size <= 1073741824 for entry in entries)
-                  assert inner.testzip() is None
-                  pathlib.Path('binary').mkdir()
-                  with inner.open('rustfs') as source, open('binary/rustfs', 'xb') as destination:
-                      header = source.read(20)
-                      assert header[:7] == b'\x7fELF\x02\x01\x01' and header[18:20] == b'\x3e\x00', 'Expected a little-endian ELF64 x86-64 binary'
-                      destination.write(header)
-                      shutil.copyfileobj(source, destination)
-          PY
-          chmod 0755 binary/rustfs
-          printf '%s  binary/rustfs\n' "$BINARY_SHA256" | sha256sum --check --strict
-
-      - name: Run the real top.disk service job
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          CONNECT_E2E_PRODUCER_SOURCE: ${{ inputs.source_sha }}
-          CONNECT_E2E_PRODUCER_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_E2E_PRODUCER_ARTIFACT_ID: ${{ inputs.artifact_id }}
-        run: |
-          set -euo pipefail
-          git -C connect-harness diff --exit-code
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          changed=$(git -C connect-harness diff --name-only)
-          [[ -z "$changed" || "$changed" == tests/e2e/connected/rustfs-ref ]]
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_DISK_EVIDENCE="$GITHUB_WORKSPACE/top-disk-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-disk
-
-      - name: Bind and validate sanitized evidence
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq -e --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" --arg artifact "$ARTIFACT_ID" '
-            .status == "PASS" and .officialArtifactId == $artifact and .producerSource == $source and .producerSha256 == $binary
-            and .result.provenance.sourceCommit == $source
-            and .result.provenance.executableSha256 == $binary
-          ' top-disk-service-job-evidence.json >/dev/null
-          jq --arg run "$GITHUB_RUN_ID" --arg build "$BUILD_RUN_ID" \
-            --arg artifact "$ARTIFACT_ID" --arg digest "$ARTIFACT_DIGEST" \
-            --arg connect "$CONNECT_SHA" --arg source "$SOURCE_SHA" --arg binary "$BINARY_SHA256" \
-            --arg expiry "$(cat artifact-expires-at)" '
-            . + {workflowRunId:$run,buildRunId:$build,artifactId:$artifact,artifactDigest:$digest,artifactExpiresAt:$expiry,connectSha:$connect,sourceSha:$source,binarySha256:$binary}
-          ' top-disk-service-job-evidence.json > top-disk-service-job-evidence.bound.json
-          mv top-disk-service-job-evidence.bound.json top-disk-service-job-evidence.json
-
-      - name: Upload only verified sanitized evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-disk-service-job-evidence-${{ github.run_id }}
-          path: top-disk-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error

.github/workflows/connect-top-locks-acceptance.yml

@@ -1,200 +0,0 @@
-# Copyright 2024 RustFS Team
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Connect top.locks service-job acceptance
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_run_id:
-        description: Main-branch Build and Release workflow run ID
-        required: true
-        type: string
-      artifact_id:
-        description: Linux x86_64 GNU artifact ID from that run
-        required: true
-        type: string
-      source_sha:
-        description: Exact 40-character source commit
-        required: true
-        type: string
-      artifact_digest:
-        description: GitHub artifact digest including sha256 prefix
-        required: true
-        type: string
-      binary_sha256:
-        description: Expected rustfs binary SHA-256
-        required: true
-        type: string
-      connect_sha:
-        description: Exact 40-character RustFS Connect harness commit
-        required: true
-        type: string
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  top-locks:
-    name: Verify native Linux x86_64 top.locks service job
-    runs-on: sm-standard-2
-    timeout-minutes: 45
-    steps:
-      - name: Checkout acceptance harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          persist-credentials: false
-
-      - name: Checkout exact RustFS source
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          path: rustfs-source
-          persist-credentials: false
-          ref: ${{ inputs.source_sha }}
-
-      - name: Checkout exact Connect harness
-        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
-        with:
-          repository: rustfs/connect
-          path: connect-harness
-          persist-credentials: false
-          ref: ${{ inputs.connect_sha }}
-          token: ${{ secrets.PF_TESTING_GH_TOKEN }}
-
-      - name: Set up Docker Compose
-        uses: ./.github/actions/setup-docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.14"
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 25.8.1
-          cache: npm
-          cache-dependency-path: connect-harness/web/package-lock.json
-
-      - name: Verify source run and artifact identity
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-        run: |
-          set -euo pipefail
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]]
-          [[ "$ARTIFACT_ID" =~ ^[0-9]+$ ]]
-          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          [[ "$CONNECT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ $(git -C rustfs-source rev-parse HEAD) == "$SOURCE_SHA" ]]
-          [[ $(git -C connect-harness rev-parse HEAD) == "$CONNECT_SHA" ]]
-          [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
-          [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
-
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
-          [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.head_branch' <<<"$run") == main ]]
-          [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
-          [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
-
-          expected_job='Build RustFS (linux-x86_64-gnu)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
-          jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
-            | (($matches | length) == 1 and $matches[0].conclusion == "success")
-          ' <<<"$jobs" >/dev/null
-
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
-          [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
-          [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
-          [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]
-          [[ $(jq -r '.digest' <<<"$artifact") == "$ARTIFACT_DIGEST" ]]
-          [[ $(jq -r '.expired' <<<"$artifact") == false ]]
-
-      - name: Download exact build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ inputs.artifact_id }}
-          path: artifact
-          run-id: ${{ inputs.build_run_id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract exact RustFS binary
-        shell: bash
-        env:
-          BINARY_SHA256: ${{ inputs.binary_sha256 }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          short_sha=${SOURCE_SHA:0:7}
-          package=$(find artifact -type f -name "rustfs-linux-x86_64-gnu-dev-${short_sha}.zip" -print -quit)
-          [[ -n "$package" ]]
-          mkdir -p binary
-          unzip -qq "$package" rustfs -d binary
-          chmod +x binary/rustfs
-          printf '%s  %s\n' "$BINARY_SHA256" binary/rustfs | sha256sum --check --strict
-
-      - name: Run signed service job acceptance
-        shell: bash
-        env:
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          printf '%s\n' "$SOURCE_SHA" >connect-harness/tests/e2e/connected/rustfs-ref
-          npm --prefix connect-harness/web ci
-          connect-harness/web/node_modules/.bin/playwright install --with-deps chromium
-          make -C connect-harness e2e-connected-dispatch-check
-          TMPDIR="$GITHUB_WORKSPACE" RUSTFS_BINARY="$GITHUB_WORKSPACE/binary/rustfs" \
-            RUSTFS_WORKTREE="$GITHUB_WORKSPACE/rustfs-source" \
-            CONNECT_E2E_TOP_LOCKS_EVIDENCE="$GITHUB_WORKSPACE/top-locks-service-job-evidence.json" \
-            make -C connect-harness e2e-connected E2E_SCENARIO=top-locks
-
-      - name: Bind workflow and artifact provenance
-        if: ${{ always() && hashFiles('top-locks-service-job-evidence.json') != '' }}
-        shell: bash
-        env:
-          BUILD_RUN_ID: ${{ inputs.build_run_id }}
-          ARTIFACT_ID: ${{ inputs.artifact_id }}
-          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
-          CONNECT_SHA: ${{ inputs.connect_sha }}
-          SOURCE_SHA: ${{ inputs.source_sha }}
-        run: |
-          set -euo pipefail
-          jq \
-            --arg workflowRunId "$GITHUB_RUN_ID" \
-            --arg buildRunId "$BUILD_RUN_ID" \
-            --arg artifactId "$ARTIFACT_ID" \
-            --arg artifactDigest "$ARTIFACT_DIGEST" \
-            --arg connectSha "$CONNECT_SHA" \
-            --arg sourceSha "$SOURCE_SHA" \
-            '. + {workflowRunId: $workflowRunId, buildRunId: $buildRunId, artifactId: $artifactId, artifactDigest: $artifactDigest, connectSha: $connectSha, sourceSha: $sourceSha}' \
-            top-locks-service-job-evidence.json >top-locks-service-job-evidence.bound.json
-          mv top-locks-service-job-evidence.bound.json top-locks-service-job-evidence.json
-
-      - name: Upload acceptance evidence
-        if: ${{ always() && hashFiles('top-locks-service-job-evidence.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: connect-top-locks-evidence-${{ github.run_id }}
-          path: |
-            top-locks-service-job-evidence.json
-          retention-days: 14
-          if-no-files-found: error