<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=601770) </details> <!--IssueSummary end--> ## Summary This issue tracks the technical readiness criteria for transitioning VAC (Vulnerabilities Across Contexts) from Closed Beta to Open Beta. Closed Beta launched May 11, 2026. See #598568 for the Closed Beta readiness checklist. ## Open Beta Philosophy **Open Beta = feature-complete + organization-wide opt-in.** The goal is full feature parity for participating customers, so we can validate **performance and scalability at scale** leading into GA. Partitioning and scalability work (&19372) remains GA-critical, but Open Beta is where we collect the real-world data that validates it. | Aspect | Closed Beta | Open Beta | |--------|-------------|-----------| | Enablement scope | Per-project (FF) | Per-organization | | Branch limit | 1 tracked branch/project | 2 tracked branches/project | | Quota system | Manual per-customer | Org-level quota, grandfathered | | Feature scope | Core MVP | **Feature-complete** | | Customer access | Hand-picked volunteers | Broader opt-in | | Primary goal | Validate core functionality | Validate performance & scalability | ## Feature Completeness (all required for Open Beta) - [ ] SBOM/Dependencies Across Contexts (&19809) - [ ] Composition Analysis per-branch - [ ] Dependency list filtering by branch + multi-branch selection - [ ] Exports (CycloneDX, JSON, SPDX) respect branch filter - [ ] MR Cross-Context Merging (&19810) - [ ] Pipeline security tab: tracked branch changes propagate to default branch - [ ] MR widget is non-default-branch aware - [ ] Vulnerability state/severity/comment changes default to local (per-branch) with optional global - **Open Beta blocker (not a follow-on):** if state, severity, and comment changes are not local by default, acting on a vuln on one tracked branch applies across all of them and the default branch. Dismissing a finding would silently dismiss it everywhere, a severity change would rewrite it on every branch, and a branch-scoped comment would appear on all. That is a bulk action without bulk intention or labelling, which risks silently hiding real vulnerabilities on untouched branches, and contradicts the closed-beta comms (state changes on one branch do not affect another). Must ship with Open Beta. ### Fast-follow (not blocking Open Beta) - [ ] Security Dashboard across contexts (&20476) — per @mclausen35, [#558134](https://gitlab.com/gitlab-org/gitlab/-/work_items/558134) (filter Security Dashboard by tag/branch) is still in dev. Treat as a follow-on improvement rather than an Open Beta blocker. - [ ] VR items in [gitlab-org#21396 (comment)](https://gitlab.com/gitlab-org/gitlab/-/work_items/21396#note_3339776890) — pending timeline/ownership analysis from @ajbiton and @ryaanwells; some may be GA blockers or fast-follows. ## Organization-Wide Opt-In (the defining Open Beta change) - [ ] **FF actor change** from project to organization/namespace (#601815) - [ ] Org-level enablement cascades to all projects - [ ] Existing project-level (Closed Beta) enablements preserved ## Organization Quota System (&20475) The quota epic &20475 is now an **Open Beta prerequisite** (moved from GA). Org-wide opt-in requires the quota system to prevent over-allocation. - [ ] Quota enforcement service operational (#598087) - [ ] ProjectTrackedContext validates against org quota (#598088) - [ ] Admin API to query/update org quota (#585971, #585972) - [ ] Admin Area UI for quota management (#585970) - [ ] **Grandfather existing namespaces** with sufficient buffer (#556012) - [ ] **Customer Support process** for quota increase requests established (#585974) ### Grandfathering Approach (NEEDS DISCUSSION) When org-wide opt-in launches, existing customers must not be disrupted. **Proposed starting point**: Set quota to `2 × current tracked branches` per organization. :warning: **Open question**: We lack scalability data to assert the appropriate buffer value. The `2×` multiplier is a safe starting proposal, but the real limit depends on infrastructure impact data Open Beta is designed to surface. This needs: - Scalability testing / data collection during Open Beta - Data-driven buffer calculation - Agreement on the formula before backfill (#556012) ## Data Consistency - [ ] Consistency worker sweep operational (#591633) - [ ] DuplicateDefaultTrackedContextsCheck wired into Orchestrator (#601618) - [ ] OrphanedTrackedContextRefsCheck active (#589837) - [ ] AutoDismissService context-awareness gap resolved (#589786) ## Scale & Performance (validated during Open Beta, critical for GA) - [ ] Validated performance with 2 branches/project across Open Beta cohort - [ ] Scalability data collected to inform grandfather buffer AND partitioning timing - [ ] Partitioning/scalability progress tracked (&19372 - GA-critical) - [ ] DB replica lag within thresholds at increased scale - [ ] No statement timeouts under Open Beta load ## Feature Flag & Rollout - [ ] Org-level enablement mechanism ready (#601815) - [ ] FF rollout plan for Open Beta cohort - [ ] Rollback procedure validated at scale - [ ] Self-managed & Dedicated configuration documented (!225980) ## Monitoring & Observability - [ ] VAC-specific dashboards (recommended for Open Beta scale) - [ ] Alert thresholds for increased load - [ ] Quota usage monitoring ## Go/No-Go Decision Before Open Beta launch: 1. All features feature-complete for participating orgs 2. Org-level enablement + quota system operational with grandfathering complete 3. No active ~"severity::1" or ~"severity::2" VAC issues 4. Closed Beta stability confirmed (baseline: 11 projects, 0 errors as of May 18) ## Related - Parent Epic: &3430 - Closed Beta checklist: #598568 - FF org-level actor: #601815 - Quota Management (Open Beta): &20475 - SBOM Across Contexts (Open Beta): &19809 - MR Cross-Context Merging (Open Beta): &19810 - Scalability/Partitioning (GA): &19372 - Closed Beta process: #591548