docs(specs): add the widened upstream summary to monolith S05, S07, S15

Why

feat(managementapi): serve upstream visibility,... (!2959 - merged) • Hayley Swimelar • 19.5 widened the upstream repository summary on the upstream-list route. A summary gains visibility and size_bytes, and a remote upstream's summary gains a settings object of url and last_health_status.

AR serves all three only to a caller holding read_repository on that upstream, and omits them otherwise, so one list can mix both kinds of row. S17 rejected serving them to every reader of the list.

The monolith specs S05, S07, and S15 still describe the four-field summary. S05 also defers the upstream table's visibility, size, URL, and connection status columns to Phase 2, because the summary had nothing behind them.

The S05 virtual plan, whose eight steps have all merged, has no steps for the work that implements the widened summary.

What changes

• S05, AR REST endpoints consumed: the upstream-list row lists the widened summary and its read_repository condition, says the page's upstream read sends include_permissions for the row's verdicts, and says the route is implemented for all four formats rather than "Contracted, not implemented".

• S05, Remote and virtual gating: the upstream association list row and the Virtual detail bullet record the route as served for all four formats.

• S05, Phase 2: the upstream table row leaves the deferral table.

• S05, Virtual upstreams: the element exposes visibility, sizeBytes, settings of url and lastHealthStatus, and userPermissions. The three summary fields are nullable because the contract makes them optional, and settings is also null on every hosted upstream. settings gets its own type rather than reusing the remote settings type. The view selects every field except format and visibility.

• S05, Upstream table:

  • Adds the Size column and maps each design element to its field.
  • The row renders no visibility icon: closed beta creates Private only, so it would repeat the header's lock on every row, as Address the repositories list design review (gitlab-org/gitlab!248512 - merged) • Rahul Chanila • 19.3 found for the repositories list.
  • The URL renders as text with no link and no copy action.
  • The connection status is the icon the design draws after the URL, with the sidebar indicator's icon and label per value and no timestamp, because the summary carries no last_health_checked_at. It is not the sidebar's indicator.
  • A remote upstream the viewer cannot read keeps its name, Remote badge, and position. It shows no URL or status icon, and a blank Size cell, and the page fetches none of the withheld fields another way.
  • The row's Clear cache still refetches nothing, so the row's Size keeps the value the page loaded. The Size moves only once the apply's counter deltas flush from AR's buffer, so a refetch on acceptance would usually return the value it replaced, for a second AR call and its per-upstream authorization batch. The States row, the Apollo section, the resolved-eviction criterion, and the Resolutions entry say so.

• S05, other sections:

  • Accessibility: the row status icon sits in a compact tertiary button, so its tooltip is focusable, and the button's accessible name carries the verdict and the upstream.
  • Compatibility: a missing field is a state the row renders, not a version-skew case.
  • Error cases: Clear cache and Edit repository on a row whose upstream the viewer cannot read, reached only when the upstream's verdict allowed the item and the upstream is unreadable by the time it is selected. The repository-clear mutation's own repository read answers the masked 404, so it raises a top-level resource-not-available error without calling AR's eviction route, and the view renders the rejected state from its client-raised trigger.
  • Security considerations: which viewers see the four fields.
  • Resolutions: a new entry recording the move out of Phase 2, and why the row renders no visibility icon.

• S05, Acceptance criteria: the upstream field and table criteria cover the new fields. New criteria cover a summary without them (a mixed list included), the unreadable remote row, and the row status icon's accessible name.

• S07, Upstream associations: the summary lists the new fields and their read_repository condition, and the summary type declares them nullable.

• S15, Out of scope and Resolutions: the summary lists the new fields. #1461 (closed) proposed leaving S15's permissions clause alone, but that clause said the summary carries no permissions object. That has been false since #1174 (closed) added one under include_permissions. S15 now records that Gate Artifact Registry upstream row actions (Ed... (gitlab-org/gitlab#629674 - closed) • Fiona McCawley • 19.5 gated the upstream row's Edit repository and Clear cache on those verdicts, in Gate Artifact Registry upstream row actions on ... (gitlab-org/gitlab!258323 - merged) • Fiona McCawley • 19.5, outside this slice's steps. The ### The rule bullet and the cross-resource row in ### Surfaces not gated by this slice, and why say the same.

• Monolith S05 virtual plan (docs/plans/monolith/2026-09-10-repository-detail-virtual.md): the plan's eight steps have all merged on the monolith, so an upstream summary track adds two steps. Steps 1 to 8's step text is unchanged.

  • Step 9 brings the three fields through the summary value object and the GraphQL summary type, with settings as ArtifactRegistryUpstreamRepositorySummarySettings. It merged as monolith/S05 virtual: expose upstream visibilit... (gitlab-org/gitlab!258049 - merged) • Fiona McCawley • 19.5, tracked in monolith/S05 virtual: expose upstream visibilit... (gitlab-org/gitlab#631074 - closed) • Fiona McCawley • 19.5.
  • Step 10 renders them in the upstream table: the URL and the connection status icon on a row whose settings is present, and a Size column, with no row visibility icon. It also passes each stored upstream's size and URL to the edit page's order table. It is monolith/S05 virtual: render upstream size, URL... (gitlab-org/gitlab!258346 - merged) • Fiona McCawley • 19.5, tracked in monolith/S05 virtual: render upstream visibilit... (gitlab-org/gitlab#631075 - closed) • Fiona McCawley, and the post-eviction Size case it does not carry is monolith/S05 virtual: test the upstream row's S... (gitlab-org/gitlab#631623) • Fiona McCawley • 19.6. Gate Artifact Registry upstream row actions on ... (gitlab-org/gitlab!258323 - merged) • Fiona McCawley • 19.5, the row gating for Gate Artifact Registry upstream row actions (Ed... (gitlab-org/gitlab#629674 - closed) • Fiona McCawley • 19.5, merged first; its Shared seams field records the six files the two share.
  • Research Findings: records that Steps 1 to 8 merged, what the contract now serves and to whom, the monolith baseline Steps 9 and 10 build on, and that both step MRs opened ahead of this amendment, with the three places Step 10's review moved it off this amendment's first text.
  • Approach: why the fields are nullable, why settings is a type of its own, why a row whose settings is null renders no second line whatever its kind, why the row's status is an icon in the cell rather than a mode of the sidebar indicator, why the row renders no visibility icon, and why the row's Size is not refetched after its Clear cache.
  • Dependencies and Testing Strategy: the related issues, an AR gate row for the widened summary, the #1174 (closed) bullet updated for Expose upstream repository verdicts on the Arti... (gitlab-org/gitlab!258050 - merged) • Fiona McCawley • 19.5 and Gate Artifact Registry upstream row actions (Ed... (gitlab-org/gitlab#629674 - closed) • Fiona McCawley • 19.5 (in Gate Artifact Registry upstream row actions on ... (gitlab-org/gitlab!258323 - merged) • Fiona McCawley • 19.5), the omission list narrowed, the criterion mapping for S05's new and widened criteria, and the unreadable-upstream Clear cache mapped to Step 7's outright-failure branch.
  • Status: rows 9 and 10, filled with the two step MRs.

Size

The diff is 634 lines added and 103 removed at 320eb72b3, past the 500-line guideline:

File group	Added	Removed
Specs (S05, S07, S15)	256	73
Plan (the S05 virtual plan)	378	30

The plan steps and the spec text they implement land together in one MR, so the plan never describes columns the spec on main still defers. Each half on its own is under the guideline.

Notes for review

• Both step MRs opened before this MR merged, against guardrail 3, so the two steps could land this week. Step 9, monolith/S05 virtual: expose upstream visibilit... (gitlab-org/gitlab!258049 - merged) • Fiona McCawley • 19.5, has merged, and Step 10, monolith/S05 virtual: render upstream size, URL... (gitlab-org/gitlab!258346 - merged) • Fiona McCawley • 19.5, is in review. The plan's Research Findings records both. Step 10's post-eviction Size case follows in monolith/S05 virtual: test the upstream row's S... (gitlab-org/gitlab#631623) • Fiona McCawley • 19.6, so the plan treats Step 10 as complete once both have merged.
• docs(plans): batch-fill the monolith plan statu... (!2664) • Jaime Martinez • 19.5 batch-fills this plan's Status rows 1 and 2, and this MR fills rows 9 and 10.

Scenario and user documentation impact

• e2e scenarios: none added or changed. The monolith surface ships dark behind the disabled artifact_registry_ui flag, and no row in docs/testing/e2e/ describes a virtual repository's detail page. The AR-side rows for the fields themselves, e2e.maven.upstreams.summary-fields and e2e.npm.upstreams.summary-fields, already describe the read_repository condition.
• User documentation: none changed. The page is not enabled yet, and docs/user/repositories/_index.md already says a viewer sees an upstream's URL, health, visibility, and size only with read access to that upstream.

Closes #1461 (closed)