VAC GA: Rollout Readiness Checklist

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Summary

This issue tracks the technical readiness criteria to move VAC (Vulnerabilities Across Contexts) from Open Beta to General Availability.

Companion to the Open Beta readiness checklist #601770.

Last reconciled 2026-09-15 against the GA readiness discussion held in Slack. The sections below now cover reachability, SBOM and dependency list work, and the untrack data lifecycle. Earlier revisions of this checklist did not track those.

GA Philosophy

GA = the Open Beta feature set, validated at scale, with write/VACUUM tractability either proven (quota governed) or resolved (partitioning landed).

Elasticsearch serves read, filter and sort traffic. That traffic is not a GA scale gate. The GA scale gate is write and upsert throughput, plus autovacuum and bloat tractability on the tables that grow per tracked context.

The GA Scale Gate: Write / VACUUM

The quota system (&20475) caps security_project_tracked_contexts at one row per project and ref. A project's default branch counts against the tracked quota. The quota therefore acts as a soft hard cap on tracked-context growth, and it bounds write and VACUUM amplification on the multiplied tables.

The rollout does not commit to a fixed grandfather buffer up front. It starts the quota low and raises the peg gradually. We watch stability at each step until we reach the planned grandfathering value. If stability shows strain, we hold or back off.

Highest-risk tables (multiplied per tracked context):

  • vulnerability_reads. Very large, high index count. Scaffolded with partition_id and security_project_tracked_context_id, but not yet partitioned. Top risk.
  • vulnerability_occurrences. High index count. Scaffolded, not yet partitioned (&18584).
  • Satellite cluster keyed on vulnerability_occurrence_id. Multiplies transitively.

security_findings is already LIST partitioned. Follow that precedent.

Partitioning Decision (P1 / P2 / P3)

  • P1. Hard gate. Partition before GA.
  • P2. Fast follow. GA on the current schema. BBMs and consistency workers hold correctness. Partition post-GA.
  • P3. Deferred. Quota-bounded growth keeps write and VACUUM tractable. Partitioning becomes future scale-headroom work. Recorded 2026-08-24, provisional. See the decision comment and #621734.
  • Decision recorded with Open Beta evidence (autovacuum keep-up, bloat rate, upsert latency at scale)

Scale & Write/VACUUM Criteria

  • Autovacuum keeps up with vulnerability_reads at quota-bounded scale
  • Upsert and ingestion latency within SLO at target tracked-context volume
  • Bloat rate on vulnerability_reads and vulnerability_occurrences stable
  • If P1 or P2, vulnerability_occurrences partitioning (&18584) complete and soaked
  • If P1 or P2, UUID-swap chain (&19372) complete and soaked
  • Consistency workers operational and covering drift (&20929, #591633, #601618, #589837, #589786)

Quota (scale governor)

  • Enforcement solid (#598087 (closed), #598088 (closed))
  • Org-level FF actor change (#601815 (closed)). Shipped 19.3.
  • Gradual quota peg-raise reaches the planned grandfathering value, stability confirmed (#556012)
  • Customer Support quota-increase process live (#585974)
  • Quota-setting policy decided for existing and new customers (#627145)
  • traversal_ids backfilled on security_project_tracked_contexts (#627197 (closed)). Backfill finalized in !262660 (merged) (19.6).
  • default_ref_cannot_be_untracked invariant revisited before the quota release (#621576)

Reachability and finding to SBOM resolution

Ingestion does not populate sbom_occurrences_vulnerabilities.vulnerability_occurrence_id. Existing rows also need a backfill. Until both land, vulnerability to SBOM occurrence resolution and reachability presentation stay incomplete on non-default refs.

  • Set vulnerability_occurrence_id during SBOM ingestion (!228448 (merged)). Merged 2026-09-10.
  • Backfill occurrence_id to sbom_occurrences_vulnerabilities (#602158, !254774 (merged)). Approved. Queued on MWPS.
  • Make Vulnerability#reachability finding-context aware (#602157, !241042). Work in progress.
  • Make GraphQL VulnerabilityType reachability finding-context aware (#602157, !241043). Work in progress.
  • End-to-end validation matrix for branch-contextualized vulnerability management (#602161)

SBOM and dependency list across contexts

SBOM ingestion runs on every tracked ref under vulnerabilities_across_contexts. This was verified against the ingestion call chain on 2026-09-15. Dependency list querying is the unfinished half.

  • Dependency GraphQL query supports trackedRefIds and trackedRefsScope (#599507)
  • trackedRef field on DependencyInterface (#599508 (closed))
  • AggregationsFinder supports the tracked-ref filters (#599993)
  • Elasticsearch DependenciesFinder supports the tracked-ref filters (#627902 (closed))
  • Group-level Dependency List REST API tracked-ref filters (#598663)
  • Backfill sbom_occurrence_refs with the default ref for each project (#557132)
  • Roll out dependencies_across_contexts (#599698)
  • Roll out project_dependency_tracked_ref (#602656). Disabled by default today.
  • Verify the frontend ref filter on the project dependency list (#604747). Blocked.
  • Dependency Report and Export allow filtering by the desired refs (#557148)
  • Update the docs for project dependency tracked refs (#603606)

Feature completeness

Each capability below needs an API change and a UX change. All items are open and unscheduled.

Data lifecycle on untrack

Elasticsearch and SBOM ref cleanup on tracked-context deletion has landed. Untracking a ref does not archive vulnerability history, and it does not warn the user about the loss. The tracked-ref vulnerability count shown by the untrack modal was also incorrect. See #628936.

  • Tracked-context identifier on vulnerability backup records (#627201)
  • Archive-on-untrack wired into the tracked-context DestroyService, with a user warning (#627203)
  • Restoration entry point for archived tracked-context vulnerability data (#627204)
  • Scope SecurityTrackedRef.vulnerabilitiesCount to open states (#628936, !255408 (closed))
  • Untrack confirmation modal uses the total count (!255595 (closed))

Current position. The archival path must work before GA. An earlier reading treated SBOM data as regenerable by re-tracking the ref and running a pipeline, which placed #627201, #627203 and #627204 outside the GA gate. #627203 warns the user about data loss, so the three items stay in scope until Product overrules this. Raise the override on this issue if you disagree.

Explicitly out of scope for GA

Go / No-Go

  1. Open Beta feature set stable for participating orgs
  2. Scale data affirms the partitioning posture (P1, P2 or P3)
  3. No active severity1 or severity2 VAC issues
  4. Rollback validated at GA scale
  5. Reachability resolution chain merged, or an explicit fast-follow agreed for all deployments
  6. Dependency list ref filtering rolled out, or documented as disabled at GA

Related

  • Parent Epic: &3430
  • Open Beta checklist: #601770
  • Quota Management: &20475
  • Scalability/Partitioning: &19372. vulnerability_occurrences partitioning: &18584
  • Data Consistency: &20929
  • SBOM Across Contexts: &19809. Dependencies Across Multiple Branches: &18587. Iteration 1: &18681
  • AI flows on non-default refs: &21396
Edited by 🤖 GitLab Bot 🤖