From 9435912a831011991738056483d9a7ada264cae8 Mon Sep 17 00:00:00 2001
From: cxymds <cxymds@gmail.com>
Date: Wed, 4 Nov 2026 08:57:42 +0800
Subject: [PATCH 1/3] fix(test): make local VM execution portable

---
 .../environment-compatibility-tests.yml       |  63 ++++++++
 README.md                                     |  24 +++
 rustfs-replication-test.sh                    |   5 +-
 rustfs-table-test.sh                          |  84 ++++++----
 rustfs-upgrade-test.sh                        |   7 +-
 rustfs_performance_test.sh                    |  14 +-
 scripts/check_execution_environment.py        | 153 ++++++++++++++++++
 scripts/lib/jq_nwise.jq                       |   5 +
 test_check_execution_environment.py           |  62 +++++++
 test_rustfs_performance_testing.py            |  14 ++
 test_rustfs_replication.py                    |  12 ++
 test_rustfs_table.py                          |  28 ++++
 12 files changed, 434 insertions(+), 37 deletions(-)
 create mode 100644 .github/workflows/environment-compatibility-tests.yml
 create mode 100644 scripts/check_execution_environment.py
 create mode 100644 scripts/lib/jq_nwise.jq
 create mode 100644 test_check_execution_environment.py
 create mode 100644 test_rustfs_table.py

diff --git a/.github/workflows/environment-compatibility-tests.yml b/.github/workflows/environment-compatibility-tests.yml
new file mode 100644
index 00000000..856f0a60
--- /dev/null
+++ b/.github/workflows/environment-compatibility-tests.yml
@@ -0,0 +1,63 @@
+name: Environment Compatibility Tests
+
+on:
+  pull_request:
+    paths:
+      - rustfs-table-test.sh
+      - rustfs-replication-test.sh
+      - rustfs-upgrade-test.sh
+      - rustfs_performance_test.sh
+      - scripts/check_execution_environment.py
+      - scripts/lib/**
+      - test_check_execution_environment.py
+      - test_rustfs_table.py
+      - test_rustfs_performance_testing.py
+      - test_rustfs_replication.py
+      - .github/workflows/environment-compatibility-tests.yml
+  push:
+    branches: [main]
+    paths:
+      - rustfs-table-test.sh
+      - rustfs-replication-test.sh
+      - rustfs-upgrade-test.sh
+      - rustfs_performance_test.sh
+      - scripts/check_execution_environment.py
+      - scripts/lib/**
+      - test_check_execution_environment.py
+      - test_rustfs_table.py
+      - test_rustfs_performance_testing.py
+      - test_rustfs_replication.py
+      - .github/workflows/environment-compatibility-tests.yml
+
+permissions:
+  contents: read
+
+jobs:
+  environment-compatibility:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          persist-credentials: false
+      - name: Validate shell syntax
+        run: >-
+          bash -n
+          rustfs-table-test.sh
+          rustfs-replication-test.sh
+          rustfs-upgrade-test.sh
+          rustfs_performance_test.sh
+      - name: Test portable execution helpers
+        run: >-
+          python3 -B -m unittest -v
+          test_check_execution_environment.py
+          test_rustfs_table.py
+          test_rustfs_performance_testing.py
+          test_rustfs_replication.py
+      - name: Test missing HOME
+        run: env -u HOME bash test_rustfs_pool_expand.sh
+      - name: Smoke-test environment preflight
+        run: >-
+          python3 scripts/check_execution_environment.py
+          --command bash
+          --minimum-bash-major 4
diff --git a/README.md b/README.md
index faf00feb..e0df9ccd 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,30 @@
 # auto-testing
 Auto testing scripts
 
+## Portable execution environments
+
+The suite defaults and CI topology remain unchanged. Local fleets can run the
+read-only compatibility preflight before any mutation:
+
+```bash
+python3 scripts/check_execution_environment.py \
+  --command aws --command curl --command jq --command openssl --command ssh \
+  --minimum-bash-major 4 \
+  --check-aws-list-objects \
+  --data-root /data/rustfs --drive-count 4 \
+  --minimum-free-gib 40 --require-distinct-devices \
+  --require-port 18080
+```
+
+The command prints JSON and exits `2` when a requirement is blocked. It does
+not create files, install packages, or change test behavior. A local VM that
+maps separate data disks to `/data/rustfs1` through `/data/rustfs4` can remove
+the root-filesystem disk-check bypass used by ad hoc single-disk deployments.
+
+The tier webhook receiver is configurable with `RUSTFS_RECEIVER_PORT`; choose a
+port that does not conflict with the local package server or another service.
+Scripts without an executable bit can be invoked with `bash <script>`.
+
 ## Release validation migration
 
 `validation-cases.json` snapshots all 158 canonical cases from
diff --git a/rustfs-replication-test.sh b/rustfs-replication-test.sh
index 2cbe31f4..5c9284cf 100755
--- a/rustfs-replication-test.sh
+++ b/rustfs-replication-test.sh
@@ -29,6 +29,9 @@
 #
 set -Eeuo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+JQ_LIB="${SCRIPT_DIR}/scripts/lib"
+
 # ==================== Configuration ====================
 
 if [ -n "${RUSTFS_NODES:-}" ]; then
@@ -678,7 +681,7 @@ rm_bucket_force() {
         --delete "${payload}" >/dev/null 2>&1 || true
     done < <(aws --endpoint-url "${url}" --region "${REGION}" s3api list-object-versions \
         --bucket "${b}" --output json 2>/dev/null \
-        | jq -c '[.Versions[]?, .DeleteMarkers[]?] | map({Key, VersionId}) | select(length > 0) | _nwise(1000) | {Objects: ., Quiet: true}')
+        | jq -c -L "${JQ_LIB}" 'include "jq_nwise"; [.Versions[]?, .DeleteMarkers[]?] | map({Key, VersionId}) | select(length > 0) | nwise(1000) | {Objects: ., Quiet: true}')
     aws --endpoint-url "${url}" --region "${REGION}" s3api delete-bucket --bucket "${b}" >/dev/null 2>&1 || true
     bucket_exists "${ep}" "${b}" || return 0
     sleep 2
diff --git a/rustfs-table-test.sh b/rustfs-table-test.sh
index 1e15747b..2caffbdc 100755
--- a/rustfs-table-test.sh
+++ b/rustfs-table-test.sh
@@ -31,7 +31,7 @@ COMPAT_PATH="${RUSTFS_TABLE_COMPAT_PATH:-/_iceberg}"
 TEST_BUCKET_PREFIX="${RUSTFS_TABLE_TEST_BUCKET:-tblsuite}"
 LOG_FILE="${RUSTFS_TABLE_LOG_FILE:-}"
 SMOKE_SCRIPT="${RUSTFS_TABLE_SMOKE_SCRIPT:-}"   # optional: path to product pyiceberg_smoke.py
-SUDO=(); [ "$(id -u)" -ne 0 ] && SUDO=(sudo -n)
+LOCAL_SUDO=(); [ "$(id -u)" -ne 0 ] && LOCAL_SUDO=(sudo -n)
 DRY_RUN=0
 SKIP_SMOKE=0
 PASS=0; FAIL=0; UNSUPPORTED=0
@@ -146,14 +146,26 @@ rest_body() { sed -n '2,$p' <<<"${REST_OUT}"; }
 
 # ==================== Environment (install + parallel start, shared-fleet style) ====================
 remote() { ssh -o BatchMode=yes -o ConnectTimeout=10 -p "${SSH_PORT}" "${SSH_USER}@${1}" "$2"; }
+remote_root() {
+  ssh -o BatchMode=yes -o ConnectTimeout=10 -p "${SSH_PORT}" "${SSH_USER}@${1}" \
+    "if [ \"\$(id -u)\" -eq 0 ]; then bash -s; else sudo -n bash -s; fi"
+}
 
 setup_environment() {
   local v
   for v in "${NODES[@]}"; do
-    remote "${v}" "curl -fsSL --retry 3 -o /tmp/rustfs-table.deb '${PACKAGE_URL}' && ${SUDO[*]} dpkg -i --force-confold /tmp/rustfs-table.deb >/dev/null 2>&1 && ${SUDO[*]} mkdir -p /data/rustfs{1..4}/mnmd && ${SUDO[*]} chown -R rustfs:rustfs /data/rustfs{1..4}/mnmd" || die "install failed on ${v}"
+    remote_root "${v}" <<EOF || die "install failed on ${v}"
+set -e
+curl -fsSL --retry 3 -o /tmp/rustfs-table.deb '${PACKAGE_URL}'
+dpkg -i --force-confold /tmp/rustfs-table.deb >/dev/null
+mkdir -p /data/rustfs{1..4}/mnmd
+chown -R rustfs:rustfs /data/rustfs{1..4}/mnmd
+EOF
   done
   write_node_config() {
-    remote "$1" "${SUDO[*]} tee /etc/default/rustfs >/dev/null <<'CFG'
+    remote_root "$1" <<EOF
+set -e
+cat > /etc/default/rustfs <<'CFG'
 RUSTFS_ACCESS_KEY=${ACCESS_KEY}
 RUSTFS_SECRET_KEY=${SECRET_KEY}
 RUSTFS_VOLUMES=\"http://rustfs-node{1...4}:9000/data/rustfs{1...4}/mnmd\"
@@ -162,7 +174,8 @@ RUSTFS_CONSOLE_ADDRESS=\":9001\"
 RUSTFS_CONSOLE_ENABLE=true
 RUSTFS_OBS_LOGGER_LEVEL=error
 RUSTFS_OBS_LOG_DIRECTORY=\"/var/log/rustfs/\"
-CFG"
+CFG
+EOF
   }
   local cfg_pids=()
   for v in "${NODES[@]}"; do write_node_config "${v}" & cfg_pids+=("$!"); done
@@ -170,7 +183,13 @@ CFG"
   # process substitution (bash >= 5.1) and would hang forever on tee
   wait "${cfg_pids[@]}"
   local start_pids=()
-  for v in "${NODES[@]}"; do remote "${v}" "${SUDO[*]} systemctl reset-failed rustfs 2>/dev/null; ${SUDO[*]} systemctl start rustfs" & start_pids+=("$!"); done
+  for v in "${NODES[@]}"; do
+    remote_root "${v}" <<'EOF' &
+systemctl reset-failed rustfs 2>/dev/null || true
+systemctl start rustfs
+EOF
+    start_pids+=("$!")
+  done
   wait "${start_pids[@]}"
   local deadline=$(( $(date +%s) + 180 )) i=0 ok
   while [ "$(date +%s)" -lt "${deadline}" ]; do
@@ -193,7 +212,14 @@ CFG"
 teardown_environment() {
   local v
   local clean_pids=()
-  for v in "${NODES[@]}"; do remote "${v}" "${SUDO[*]} systemctl stop rustfs 2>/dev/null; ${SUDO[*]} dpkg -P rustfs >/dev/null 2>&1; ${SUDO[*]} rm -rf /data/rustfs{1..4}/mnmd /etc/default/rustfs" & clean_pids+=("$!"); done
+  for v in "${NODES[@]}"; do
+    remote_root "${v}" <<'EOF' &
+systemctl stop rustfs 2>/dev/null || true
+dpkg -P rustfs >/dev/null 2>&1 || true
+rm -rf /data/rustfs{1..4}/mnmd /etc/default/rustfs
+EOF
+    clean_pids+=("$!")
+  done
   wait "${clean_pids[@]}"
   log "environment torn down"
 }
@@ -218,7 +244,7 @@ test_tbl101() {
   local venv="/tmp/tbl-venv-${RUN_ID}"
   if ! python3 -m venv "${venv}" >/tmp/tbl-venv-err.log 2>&1; then
     echo "tbl101: venv create failed, installing python3-venv: $(head -3 /tmp/tbl-venv-err.log)"
-    ${SUDO[*]} apt-get install -y python3-venv >/dev/null 2>&1 || true
+    "${LOCAL_SUDO[@]}" apt-get install -y python3-venv >/dev/null 2>&1 || true
     python3 -m venv "${venv}" >>/tmp/tbl-venv-err.log 2>&1 \
       || { echo "tbl101: venv create failed twice: $(tail -3 /tmp/tbl-venv-err.log)"; return 2; }
   fi
@@ -369,27 +395,29 @@ test_tbl107() {
 }
 
 # ==================== Main ====================
-TEST_TMP="$(mktemp -d /tmp/rustfs-table-test.XXXXXX)"
-trap 'cleanup_all; rm -rf "${TEST_TMP}"' EXIT
-if [ -n "${LOG_FILE}" ]; then
-  mkdir -p "$(dirname "${LOG_FILE}")"
-  exec > >(tee -a "${LOG_FILE}") 2>&1
-fi
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  TEST_TMP="$(mktemp -d /tmp/rustfs-table-test.XXXXXX)"
+  trap 'cleanup_all; rm -rf "${TEST_TMP}"' EXIT
+  if [ -n "${LOG_FILE}" ]; then
+    mkdir -p "$(dirname "${LOG_FILE}")"
+    exec > >(tee -a "${LOG_FILE}") 2>&1
+  fi
 
-log "S3 Tables (Iceberg REST Catalog) suite"
-log "endpoint=${API_ENDPOINT} rest=${REST_PATH} bucket-prefix=${TEST_BUCKET_PREFIX}"
-[ "${DRY_RUN}" -eq 0 ] && setup_environment
+  log "S3 Tables (Iceberg REST Catalog) suite"
+  log "endpoint=${API_ENDPOINT} rest=${REST_PATH} bucket-prefix=${TEST_BUCKET_PREFIX}"
+  [ "${DRY_RUN}" -eq 0 ] && setup_environment
 
-run_test TBL-101 "PyIcebergEndToEnd"            test_tbl101
-run_test TBL-102 "EnableAndGetTableBucket"      test_tbl102
-run_test TBL-103 "NamespaceAndTableCrud"        test_tbl103
-run_test TBL-104 "ReservedPrefixProtection"     test_tbl104
-run_test TBL-106 "CompatPrefixAndConfig"        test_tbl106
-run_test TBL-107 "TableBucketListIsolation"     test_tbl107
-run_test TBL-105 "CommitCasConflict"            test_tbl105
+  run_test TBL-101 "PyIcebergEndToEnd"            test_tbl101
+  run_test TBL-102 "EnableAndGetTableBucket"      test_tbl102
+  run_test TBL-103 "NamespaceAndTableCrud"        test_tbl103
+  run_test TBL-104 "ReservedPrefixProtection"     test_tbl104
+  run_test TBL-106 "CompatPrefixAndConfig"        test_tbl106
+  run_test TBL-107 "TableBucketListIsolation"     test_tbl107
+  run_test TBL-105 "CommitCasConflict"            test_tbl105
 
-cleanup_all
-log "table suite: ${PASS} passed, ${FAIL} failed, ${UNSUPPORTED} unsupported"
-[ "${FAIL}" -eq 0 ] || printf 'failed: %s\n' "${FAILED_TESTS[*]}"
-[ "${DRY_RUN}" -eq 0 ] || exit 0
-[ "${FAIL}" -eq 0 ]
+  cleanup_all
+  log "table suite: ${PASS} passed, ${FAIL} failed, ${UNSUPPORTED} unsupported"
+  [ "${FAIL}" -eq 0 ] || printf 'failed: %s\n' "${FAILED_TESTS[*]}"
+  [ "${DRY_RUN}" -eq 0 ] || exit 0
+  [ "${FAIL}" -eq 0 ]
+fi
diff --git a/rustfs-upgrade-test.sh b/rustfs-upgrade-test.sh
index 82540461..01f645ca 100644
--- a/rustfs-upgrade-test.sh
+++ b/rustfs-upgrade-test.sh
@@ -42,6 +42,9 @@
 #   RUSTFS_NODES / RUSTFS_SSH_USER          shared test VMs (default vm000..002 / azureuser)
 set -Eeuo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+JQ_LIB="${SCRIPT_DIR}/scripts/lib"
+
 TEST_TMP="$(mktemp -d "${TMPDIR:-/tmp}/rustfs-upgrade.XXXXXX")"
 trap 'rm -rf "${TEST_TMP}"' EXIT
 
@@ -862,8 +865,8 @@ seed_warp_bucket() {
       aws_run s3api delete-objects --bucket "${bucket}" --delete "${payload}"
       assert_aws_ok || die "seed: trim ${bucket} (delete batch failed)"
     done < <(printf '%s' "${keys_json}" \
-             | jq -c --argjson k "${keep}" \
-               '.[0:(length - $k)] | _nwise(1000) | {Objects: [.[] | {Key: .}], Quiet: true}')
+             | jq -c --argjson k "${keep}" -L "${JQ_LIB}" \
+               'include "jq_nwise"; .[0:(length - $k)] | nwise(1000) | {Objects: [.[] | {Key: .}], Quiet: true}')
     aws_run s3api list-objects-v2 --bucket "${bucket}" --query 'length(Contents)'
     assert_aws_ok || die "seed: post-trim list ${bucket}"
     remaining="$(printf '%s' "${AWS_OUT}" | tr -d '[:space:]')"
diff --git a/rustfs_performance_test.sh b/rustfs_performance_test.sh
index 933d77a8..106ce857 100755
--- a/rustfs_performance_test.sh
+++ b/rustfs_performance_test.sh
@@ -76,19 +76,21 @@ RUSTFS_CONSOLE_ENABLE=true
 RUSTFS_OBS_LOGGER_LEVEL=error
 RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"
 
-# Benchmark runner (step 5/6): prefer the default Obsidian location, fall back
-# to a rustfs-performance-testing.sh next to this script (e.g. in the repo or
-# on a jumpbox).
-_DEFAULT_BENCH="${HOME}/Documents/Obsidian Vault/rustfs-performance-testing.sh"
+# Benchmark runner (step 5/6): prefer the default Obsidian location when HOME
+# is available, then fall back to a runner next to this script.
 _SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-if [ -x "${_DEFAULT_BENCH}" ]; then
+_DEFAULT_BENCH=""
+if [ -n "${HOME:-}" ]; then
+  _DEFAULT_BENCH="${HOME}/Documents/Obsidian Vault/rustfs-performance-testing.sh"
+fi
+if [ -n "${_DEFAULT_BENCH}" ] && [ -x "${_DEFAULT_BENCH}" ]; then
   _BENCH_RESOLVED="${_DEFAULT_BENCH}"
 elif [ -x "${_SCRIPT_DIR}/rustfs-performance-testing.sh" ]; then
   _BENCH_RESOLVED="${_SCRIPT_DIR}/rustfs-performance-testing.sh"
 elif [ -x "${_SCRIPT_DIR}/rustfs_performance_testing.sh" ]; then
   _BENCH_RESOLVED="${_SCRIPT_DIR}/rustfs_performance_testing.sh"
 else
-  _BENCH_RESOLVED="${_DEFAULT_BENCH}"
+  _BENCH_RESOLVED="${_DEFAULT_BENCH:-${_SCRIPT_DIR}/rustfs_performance_testing.sh}"
 fi
 BENCH_SCRIPT="${RUSTFS_BENCH_SCRIPT:-${_BENCH_RESOLVED}}"
 RESULT_DIR="${RUSTFS_RESULT_DIR:-$(pwd)/warp-bench-results-$(date +%Y%m%d-%H%M%S)}"
diff --git a/scripts/check_execution_environment.py b/scripts/check_execution_environment.py
new file mode 100644
index 00000000..ebbe1cc8
--- /dev/null
+++ b/scripts/check_execution_environment.py
@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""Report whether a host can execute the live suites without changing them."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import shutil
+import socket
+import subprocess
+from pathlib import Path
+
+
+def result(name: str, status: str, detail: str) -> dict:
+    return {"name": name, "status": status, "detail": detail}
+
+
+def command_check(command: str) -> dict:
+    path = shutil.which(command)
+    if path:
+        return result(f"command:{command}", "pass", path)
+    return result(f"command:{command}", "blocked", "command not found")
+
+
+def bash_version_check(minimum_major: int) -> dict:
+    executable = shutil.which("bash")
+    if not executable:
+        return result("bash:version", "blocked", "bash command not found")
+    try:
+        completed = subprocess.run(
+            [executable, "--version"], capture_output=True, text=True,
+            timeout=10, check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        return result("bash:version", "blocked", str(exc))
+    match = re.search(r"version\s+(\d+)\.(\d+)\.(\d+)", completed.stdout)
+    if completed.returncode or not match:
+        return result("bash:version", "blocked", completed.stderr.strip() or "unknown bash version")
+    version = tuple(int(part) for part in match.groups())
+    if version[0] < minimum_major:
+        return result(
+            "bash:version", "blocked",
+            f"{version[0]}.{version[1]}.{version[2]} requires major >= {minimum_major}",
+        )
+    return result(
+        "bash:version", "pass",
+        f"{version[0]}.{version[1]}.{version[2]} major >= {minimum_major}",
+    )
+
+
+def aws_list_objects_check(command: str = "aws") -> dict:
+    executable = shutil.which(command)
+    if not executable:
+        return result("aws:list-objects-v2", "blocked", "aws command not found")
+    try:
+        completed = subprocess.run(
+            [executable, "s3api", "list-objects-v2", "help"],
+            capture_output=True, text=True, timeout=30, check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        return result("aws:list-objects-v2", "blocked", str(exc))
+    detail = (completed.stderr or completed.stdout).strip()
+    if completed.returncode == 0:
+        return result("aws:list-objects-v2", "pass", "CLI parser accepted the operation")
+    if "badly formed help string" in detail.lower():
+        return result(
+            "aws:list-objects-v2", "blocked",
+            "AWS CLI cannot render list-objects-v2 help; install a compatible AWS CLI v2",
+        )
+    return result(
+        "aws:list-objects-v2", "blocked",
+        detail[-1000:] or f"aws exited {completed.returncode}",
+    )
+
+
+def port_check(port: int, host: str = "0.0.0.0") -> dict:
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as listener:
+            listener.bind((host, port))
+    except OSError as exc:
+        return result(f"port:{port}", "blocked", str(exc))
+    return result(f"port:{port}", "pass", f"available on {host}")
+
+
+def drive_layout_check(
+    data_root: Path, count: int, minimum_free_gib: float, distinct_devices: bool,
+) -> list[dict]:
+    checks = []
+    devices: dict[int, Path] = {}
+    for index in range(1, count + 1):
+        drive = data_root.with_name(data_root.name + str(index))
+        name = f"drive:{drive}"
+        if not drive.is_dir() or drive.is_symlink():
+            checks.append(result(name, "blocked", "missing directory or symlink"))
+            continue
+        stat = drive.stat()
+        free_gib = shutil.disk_usage(drive).free / (1024 ** 3)
+        if free_gib < minimum_free_gib:
+            checks.append(result(
+                name, "blocked",
+                f"free={free_gib:.2f}GiB minimum={minimum_free_gib:.2f}GiB",
+            ))
+            continue
+        if distinct_devices and stat.st_dev in devices:
+            checks.append(result(
+                name, "blocked",
+                f"shares device with {devices[stat.st_dev]}",
+            ))
+            continue
+        devices[stat.st_dev] = drive
+        checks.append(result(
+            name, "pass",
+            f"device={stat.st_dev} free={free_gib:.2f}GiB",
+        ))
+    return checks
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--command", action="append", default=[])
+    parser.add_argument("--minimum-bash-major", type=int, default=0)
+    parser.add_argument("--check-aws-list-objects", action="store_true")
+    parser.add_argument("--data-root", type=Path, default=Path("/data/rustfs"))
+    parser.add_argument("--drive-count", type=int, default=0)
+    parser.add_argument("--minimum-free-gib", type=float, default=0)
+    parser.add_argument("--require-distinct-devices", action="store_true")
+    parser.add_argument("--require-port", action="append", type=int, default=[])
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    checks = [command_check(command) for command in args.command]
+    if args.minimum_bash_major:
+        checks.append(bash_version_check(args.minimum_bash_major))
+    if args.check_aws_list_objects:
+        checks.append(aws_list_objects_check())
+    checks.extend(port_check(port) for port in args.require_port)
+    if args.drive_count:
+        checks.extend(drive_layout_check(
+            args.data_root,
+            args.drive_count,
+            args.minimum_free_gib,
+            args.require_distinct_devices,
+        ))
+    blocked = [check for check in checks if check["status"] != "pass"]
+    print(json.dumps({"ready": not blocked, "checks": checks}, indent=2))
+    return 0 if not blocked else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/lib/jq_nwise.jq b/scripts/lib/jq_nwise.jq
new file mode 100644
index 00000000..7a9f49bd
--- /dev/null
+++ b/scripts/lib/jq_nwise.jq
@@ -0,0 +1,5 @@
+# Split an array into fixed-size arrays, including a shorter final batch.
+def nwise($size):
+  . as $items
+  | [range(0; ($items | length); $size) as $offset
+     | $items[$offset:$offset + $size]];
diff --git a/test_check_execution_environment.py b/test_check_execution_environment.py
new file mode 100644
index 00000000..c2f5302b
--- /dev/null
+++ b/test_check_execution_environment.py
@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Contract tests for the read-only execution-environment preflight."""
+
+import importlib.util
+from pathlib import Path
+import tempfile
+import unittest
+from unittest import mock
+
+
+ROOT = Path(__file__).resolve().parent
+SPEC = importlib.util.spec_from_file_location(
+    "execution_environment", ROOT / "scripts/check_execution_environment.py",
+)
+MODULE = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+SPEC.loader.exec_module(MODULE)
+
+
+class ExecutionEnvironmentTests(unittest.TestCase):
+    def test_bash_major_version_is_enforced(self):
+        version = mock.Mock(returncode=0, stdout="GNU bash, version 5.2.21(1)-release\n", stderr="")
+        with mock.patch.object(MODULE.shutil, "which", return_value="/bin/bash"), \
+             mock.patch.object(MODULE.subprocess, "run", return_value=version):
+            self.assertEqual(MODULE.bash_version_check(4)["status"], "pass")
+            self.assertEqual(MODULE.bash_version_check(6)["status"], "blocked")
+
+    def test_aws_cli_parser_failure_is_reported_as_blocked(self):
+        failed = mock.Mock(returncode=255, stdout="", stderr="badly formed help string\n")
+        with mock.patch.object(MODULE.shutil, "which", return_value="/usr/bin/aws"), \
+             mock.patch.object(MODULE.subprocess, "run", return_value=failed):
+            check = MODULE.aws_list_objects_check()
+        self.assertEqual(check["status"], "blocked")
+        self.assertIn("compatible AWS CLI v2", check["detail"])
+
+    def test_aws_cli_parser_success_is_accepted(self):
+        passed = mock.Mock(returncode=0, stdout="{}", stderr="")
+        with mock.patch.object(MODULE.shutil, "which", return_value="/usr/bin/aws"), \
+             mock.patch.object(MODULE.subprocess, "run", return_value=passed):
+            check = MODULE.aws_list_objects_check()
+        self.assertEqual(check["status"], "pass")
+
+    def test_drive_layout_reports_missing_and_shared_devices(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / "rustfs"
+            for index in range(1, 3):
+                (Path(temporary) / f"rustfs{index}").mkdir()
+            checks = MODULE.drive_layout_check(root, 3, 0, True)
+        self.assertEqual([item["status"] for item in checks], ["pass", "blocked", "blocked"])
+        self.assertIn("shares device", checks[1]["detail"])
+        self.assertIn("missing", checks[2]["detail"])
+
+    def test_port_check_detects_a_bound_port(self):
+        with MODULE.socket.socket(MODULE.socket.AF_INET, MODULE.socket.SOCK_STREAM) as listener:
+            listener.bind(("127.0.0.1", 0))
+            port = listener.getsockname()[1]
+            check = MODULE.port_check(port, "127.0.0.1")
+        self.assertEqual(check["status"], "blocked")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test_rustfs_performance_testing.py b/test_rustfs_performance_testing.py
index 795e45d3..99fe6792 100644
--- a/test_rustfs_performance_testing.py
+++ b/test_rustfs_performance_testing.py
@@ -10,6 +10,9 @@
 import unittest
 
 
+ROOT = Path(__file__).resolve().parent
+
+
 class PerformanceResultTests(unittest.TestCase):
     def setUp(self):
         self.temp = tempfile.TemporaryDirectory()
@@ -168,5 +171,16 @@ def test_parse_only_cannot_certify_failed_or_unverified_metrics(self):
                 self.assertIn("failed=1", (self.results / "summary.md").read_text())
 
 
+class PerformanceEnvironmentTests(unittest.TestCase):
+    def test_help_does_not_require_home(self):
+        environment = dict(os.environ)
+        environment.pop("HOME", None)
+        result = subprocess.run(
+            ["bash", str(ROOT / "rustfs_performance_test.sh"), "--help"],
+            env=environment, capture_output=True, text=True, timeout=10,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/test_rustfs_replication.py b/test_rustfs_replication.py
index d2159203..c0389497 100644
--- a/test_rustfs_replication.py
+++ b/test_rustfs_replication.py
@@ -67,5 +67,17 @@ def test_rejects_failed_listing_even_with_empty_json(self):
         self.assertNotEqual(self.run_case("list_error").returncode, 0)
 
 
+class JqBatchCompatibilityTests(unittest.TestCase):
+    def test_nwise_batches_without_jq_private_builtin(self):
+        helper = ROOT / "scripts/lib/jq_nwise.jq"
+        result = subprocess.run(
+            ["jq", "-nc", "-L", str(helper.parent),
+             'include "jq_nwise"; [1,2,3,4,5] | nwise(2)'],
+            capture_output=True, text=True, timeout=10,
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.strip(), "[[1,2],[3,4],[5]]")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/test_rustfs_table.py b/test_rustfs_table.py
new file mode 100644
index 00000000..08822db3
--- /dev/null
+++ b/test_rustfs_table.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Check that table-suite privileged commands are decided on the remote host."""
+
+from pathlib import Path
+import subprocess
+import unittest
+
+
+ROOT = Path(__file__).resolve().parent
+
+
+class TableRemotePrivilegeTests(unittest.TestCase):
+    def test_remote_root_checks_uid_after_ssh(self):
+        script = (
+            f'source "{ROOT / "rustfs-table-test.sh"}"; '
+            'ssh() { printf "%s" "$*"; }; '
+            'remote_root vm000 </dev/null'
+        )
+        result = subprocess.run(
+            ["bash", "-c", script], capture_output=True, text=True, timeout=10,
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn('if [ "$(id -u)" -eq 0 ]', result.stdout)
+        self.assertIn("sudo -n bash -s", result.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()

From 082055ba949c08be36a16828b87c97ece9553dae Mon Sep 17 00:00:00 2001
From: cxymds <cxymds@gmail.com>
Date: Wed, 4 Nov 2026 08:59:56 +0800
Subject: [PATCH 2/3] fix(test): make suite entrypoints executable

---
 .../environment-compatibility-tests.yml         | 17 +++++++++++------
 README.md                                       |  3 ++-
 rustfs-security-test.sh                         |  0
 rustfs-upgrade-test.sh                          |  0
 4 files changed, 13 insertions(+), 7 deletions(-)
 mode change 100644 => 100755 rustfs-security-test.sh
 mode change 100644 => 100755 rustfs-upgrade-test.sh

diff --git a/.github/workflows/environment-compatibility-tests.yml b/.github/workflows/environment-compatibility-tests.yml
index 856f0a60..447b3417 100644
--- a/.github/workflows/environment-compatibility-tests.yml
+++ b/.github/workflows/environment-compatibility-tests.yml
@@ -5,6 +5,7 @@ on:
     paths:
       - rustfs-table-test.sh
       - rustfs-replication-test.sh
+      - rustfs-security-test.sh
       - rustfs-upgrade-test.sh
       - rustfs_performance_test.sh
       - scripts/check_execution_environment.py
@@ -19,6 +20,7 @@ on:
     paths:
       - rustfs-table-test.sh
       - rustfs-replication-test.sh
+      - rustfs-security-test.sh
       - rustfs-upgrade-test.sh
       - rustfs_performance_test.sh
       - scripts/check_execution_environment.py
@@ -41,12 +43,15 @@ jobs:
         with:
           persist-credentials: false
       - name: Validate shell syntax
-        run: >-
-          bash -n
-          rustfs-table-test.sh
-          rustfs-replication-test.sh
-          rustfs-upgrade-test.sh
-          rustfs_performance_test.sh
+        run: |
+          bash -n \
+            rustfs-table-test.sh \
+            rustfs-replication-test.sh \
+            rustfs-security-test.sh \
+            rustfs-upgrade-test.sh \
+            rustfs_performance_test.sh
+          test -x rustfs-security-test.sh
+          test -x rustfs-upgrade-test.sh
       - name: Test portable execution helpers
         run: >-
           python3 -B -m unittest -v
diff --git a/README.md b/README.md
index e0df9ccd..04f743a0 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,8 @@ the root-filesystem disk-check bypass used by ad hoc single-disk deployments.
 
 The tier webhook receiver is configurable with `RUSTFS_RECEIVER_PORT`; choose a
 port that does not conflict with the local package server or another service.
-Scripts without an executable bit can be invoked with `bash <script>`.
+All top-level suite entrypoints are directly executable; `bash <script>` also
+works when a local checkout or transport drops executable modes.
 
 ## Release validation migration
 
diff --git a/rustfs-security-test.sh b/rustfs-security-test.sh
old mode 100644
new mode 100755
diff --git a/rustfs-upgrade-test.sh b/rustfs-upgrade-test.sh
old mode 100644
new mode 100755

From 8b128f72effa9b1878171f195c5a05be17704818 Mon Sep 17 00:00:00 2001
From: cxymds <cxymds@gmail.com>
Date: Wed, 4 Nov 2026 09:03:12 +0800
Subject: [PATCH 3/3] fix(test): emit valid portable delete batches

---
 .../environment-compatibility-tests.yml       |  5 ++++-
 rustfs-replication-test.sh                    |  2 +-
 rustfs-table-test.sh                          | 22 ++++++++++++-------
 rustfs-upgrade-test.sh                        |  2 +-
 test_rustfs_replication.py                    | 13 +++++++++++
 test_rustfs_table.py                          | 17 ++++++++++++++
 6 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/environment-compatibility-tests.yml b/.github/workflows/environment-compatibility-tests.yml
index 447b3417..bf215003 100644
--- a/.github/workflows/environment-compatibility-tests.yml
+++ b/.github/workflows/environment-compatibility-tests.yml
@@ -44,12 +44,15 @@ jobs:
           persist-credentials: false
       - name: Validate shell syntax
         run: |
-          bash -n \
+          for script in \
             rustfs-table-test.sh \
             rustfs-replication-test.sh \
             rustfs-security-test.sh \
             rustfs-upgrade-test.sh \
             rustfs_performance_test.sh
+          do
+            bash -n "${script}"
+          done
           test -x rustfs-security-test.sh
           test -x rustfs-upgrade-test.sh
       - name: Test portable execution helpers
diff --git a/rustfs-replication-test.sh b/rustfs-replication-test.sh
index 5c9284cf..c76aedd1 100755
--- a/rustfs-replication-test.sh
+++ b/rustfs-replication-test.sh
@@ -681,7 +681,7 @@ rm_bucket_force() {
         --delete "${payload}" >/dev/null 2>&1 || true
     done < <(aws --endpoint-url "${url}" --region "${REGION}" s3api list-object-versions \
         --bucket "${b}" --output json 2>/dev/null \
-        | jq -c -L "${JQ_LIB}" 'include "jq_nwise"; [.Versions[]?, .DeleteMarkers[]?] | map({Key, VersionId}) | select(length > 0) | nwise(1000) | {Objects: ., Quiet: true}')
+        | jq -c -L "${JQ_LIB}" 'include "jq_nwise"; [.Versions[]?, .DeleteMarkers[]?] | map({Key, VersionId}) | select(length > 0) | nwise(1000)[] | {Objects: ., Quiet: true}')
     aws --endpoint-url "${url}" --region "${REGION}" s3api delete-bucket --bucket "${b}" >/dev/null 2>&1 || true
     bucket_exists "${ep}" "${b}" || return 0
     sleep 2
diff --git a/rustfs-table-test.sh b/rustfs-table-test.sh
index 2caffbdc..fb98037b 100755
--- a/rustfs-table-test.sh
+++ b/rustfs-table-test.sh
@@ -151,6 +151,19 @@ remote_root() {
     "if [ \"\$(id -u)\" -eq 0 ]; then bash -s; else sudo -n bash -s; fi"
 }
 
+rustfs_table_config() {
+  cat <<CFG
+RUSTFS_ACCESS_KEY=${ACCESS_KEY}
+RUSTFS_SECRET_KEY=${SECRET_KEY}
+RUSTFS_VOLUMES="http://rustfs-node{1...4}:9000/data/rustfs{1...4}/mnmd"
+RUSTFS_ADDRESS=":9000"
+RUSTFS_CONSOLE_ADDRESS=":9001"
+RUSTFS_CONSOLE_ENABLE=true
+RUSTFS_OBS_LOGGER_LEVEL=error
+RUSTFS_OBS_LOG_DIRECTORY="/var/log/rustfs/"
+CFG
+}
+
 setup_environment() {
   local v
   for v in "${NODES[@]}"; do
@@ -166,14 +179,7 @@ EOF
     remote_root "$1" <<EOF
 set -e
 cat > /etc/default/rustfs <<'CFG'
-RUSTFS_ACCESS_KEY=${ACCESS_KEY}
-RUSTFS_SECRET_KEY=${SECRET_KEY}
-RUSTFS_VOLUMES=\"http://rustfs-node{1...4}:9000/data/rustfs{1...4}/mnmd\"
-RUSTFS_ADDRESS=\":9000\"
-RUSTFS_CONSOLE_ADDRESS=\":9001\"
-RUSTFS_CONSOLE_ENABLE=true
-RUSTFS_OBS_LOGGER_LEVEL=error
-RUSTFS_OBS_LOG_DIRECTORY=\"/var/log/rustfs/\"
+$(rustfs_table_config)
 CFG
 EOF
   }
diff --git a/rustfs-upgrade-test.sh b/rustfs-upgrade-test.sh
index 01f645ca..2b18d1c7 100755
--- a/rustfs-upgrade-test.sh
+++ b/rustfs-upgrade-test.sh
@@ -866,7 +866,7 @@ seed_warp_bucket() {
       assert_aws_ok || die "seed: trim ${bucket} (delete batch failed)"
     done < <(printf '%s' "${keys_json}" \
              | jq -c --argjson k "${keep}" -L "${JQ_LIB}" \
-               'include "jq_nwise"; .[0:(length - $k)] | nwise(1000) | {Objects: [.[] | {Key: .}], Quiet: true}')
+               'include "jq_nwise"; .[0:(length - $k)] | nwise(1000)[] | {Objects: [.[] | {Key: .}], Quiet: true}')
     aws_run s3api list-objects-v2 --bucket "${bucket}" --query 'length(Contents)'
     assert_aws_ok || die "seed: post-trim list ${bucket}"
     remaining="$(printf '%s' "${AWS_OUT}" | tr -d '[:space:]')"
diff --git a/test_rustfs_replication.py b/test_rustfs_replication.py
index c0389497..639ee978 100644
--- a/test_rustfs_replication.py
+++ b/test_rustfs_replication.py
@@ -78,6 +78,19 @@ def test_nwise_batches_without_jq_private_builtin(self):
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertEqual(result.stdout.strip(), "[[1,2],[3,4],[5]]")
 
+    def test_nwise_callers_stream_each_delete_batch(self):
+        helper = ROOT / "scripts/lib/jq_nwise.jq"
+        result = subprocess.run(
+            ["jq", "-nc", "-L", str(helper.parent),
+             'include "jq_nwise"; [1,2,3,4,5] | nwise(2)[] | {Objects: .}'],
+            capture_output=True, text=True, timeout=10,
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(
+            result.stdout.splitlines(),
+            ['{"Objects":[1,2]}', '{"Objects":[3,4]}', '{"Objects":[5]}'],
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/test_rustfs_table.py b/test_rustfs_table.py
index 08822db3..ac934512 100644
--- a/test_rustfs_table.py
+++ b/test_rustfs_table.py
@@ -10,6 +10,23 @@
 
 
 class TableRemotePrivilegeTests(unittest.TestCase):
+    def test_generated_config_does_not_escape_quotes(self):
+        script = (
+            f'source "{ROOT / "rustfs-table-test.sh"}"; '
+            'ACCESS_KEY=test-access; SECRET_KEY=test-secret; '
+            'rustfs_table_config'
+        )
+        result = subprocess.run(
+            ["bash", "-c", script], capture_output=True, text=True, timeout=10,
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn('RUSTFS_ADDRESS=":9000"', result.stdout)
+        self.assertIn(
+            'RUSTFS_VOLUMES="http://rustfs-node{1...4}:9000/data/rustfs{1...4}/mnmd"',
+            result.stdout,
+        )
+        self.assertNotIn('\\"', result.stdout)
+
     def test_remote_root_checks_uid_after_ssh(self):
         script = (
             f'source "{ROOT / "rustfs-table-test.sh"}"; '