**Previous sprint:** https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/823\ **Defect tracking:** [&23325 Artifact Registry Closed Beta — Defect Tracking](https://gitlab.com/groups/gitlab-org/-/work_items/23325)\ **Roadmap:** [docs/roadmap/closed-beta.md](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/roadmap/closed-beta.md) --- ## Scope of this plan > **This issue was created retroactively on 2026-09-07, after the sprint closed.** No W36 sprint > issue was opened at the time. It is deliberately **smaller** than a normal sprint issue: there is > no forward-looking Workstream Plan or expected-outputs list, because the week is over and > inventing targets after the fact would be a fiction. What it carries instead is the record — > what landed, what the bug bash found, and the metrics — so the sequence W35 → W36 → W37 is not > missing a link, and so the roadmap sync has a source for the week. **W36 was the integration week.** The plan going in, insofar as it was stated anywhere, was to bring the pieces together rather than start anything: close out the streams that were one or two steps from done, get the service deployed and exercised end to end, and then **bug bash it**. That is what happened, in two distinct halves: - **Mon 08-31 → Tue 09-01**: closing out. S09 enforcement, S16 container remote and S17 Phase 8 all finished. - **Tue 09-01 → Fri 09-04**: the bug bash, against a deployed service. **53 issues filed in four days**, tracked in [&23325](https://gitlab.com/groups/gitlab-org/-/work_items/23325). ## What landed Derived from the repository — plan Status tables, `(plan: X/Y)` markers on merged MR titles, and tracking-item state. Three workstreams completed. | Workstream | Verified at 2026-09-06 | What moved in W36 | |---|---|---| | **S09 AuthZ — enforcement** | :white_check_mark: **Complete, 20/20** | Steps 13, 17, 18, 19 and 20 landed (19 MRs, most of them four-part splits). Capstone is [!2266](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2266) `feat(authz)!: fail closed on an unconfigured authorization posture` on 09-03 — **the only breaking change in either W35 or W36**, and a deliberate posture flip. [#652](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652) closed 09-03 | | **S16 Container remote** | :white_check_mark: **Complete, 26/26** | Step 17 finished ([!2078](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2078), 09-01) and step 18, the hermetic end-to-end proxy harness, landed as [!2103](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2103) on 09-03. The prose/table denominator contradiction is resolved at **26** | | **S17 Management API Phase 8** | :white_check_mark: **Complete, 13/13** | [#316](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/316) closed 09-01. The denominator had moved 21 → 13 on 08-25 | | S17 — namespace connection test | :white_check_mark: **Complete, 2/2** | New plan, both steps merged 09-04 ([!2212](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2212), [!2224](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2224)) | | S15 npm remote — observability | :white_check_mark: **Complete, 5/5** | A companion plan to S15 proper. Steps 1a, 1b, 2 and 4 landed in W36 | | S20-A Lifecycle | :green_circle: **23/24** | Steps 19b ([!1916](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1916)) and 20a ([!2162](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2162)) merged. **Denominator moved 22 → 24 on 09-01** when steps 20a/20b were appended for remote parent tombstone scans. Only 20b remains | | S31 npm virtual | :green_circle: **12/19** | Steps 3, 4, 10, 11 and 12 landed (11 MRs). Steps 13–19 have no MR and no branch; step 13 depends on the shared `internal/virtual` collection mode | | S32 Container virtual | :yellow_circle: **5/19** | Went from "blocked on an open spec" to five merged steps: 1, 5, 6, 7 and 13, **all inside W36**. Step 2 ([!2277](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2277)) open | | S30 Maven virtual | :red_circle: Not started | **Spec merged 09-02** ([!2018](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2018)), now `Approved`. **No plan file, no plan MR, no branch** — so under guardrail 3 no step MR may open | | S08 AuthN — real path | :green_circle: On track | [#473](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/473) **closed 09-01** with an end-to-end staging validation: org-scoped claims, `artifactRegistryRoleBulkGrant`, and a Maven push/pull round-trip under a granted role. This was the real S08/S09 gate and it closed with proof | | S22 Storage accounting | :white_check_mark: Complete | Already 21/21. On 09-01 [!1973](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1973) **deleted the plan file** (1,505 lines) and folded it into `docs/dev/storage-accounting.md` | | S04 encryption | :green_circle: Review delivered | **AppSec review delivered 09-01** by `@ssanoop` → 35 findings. All three closed-beta-blocking findings closed 09-02. The live gate is [#417](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/417) per-format wiring, **not** [#513](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/513)/[#514](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/514) | | Frontend (monolith) | :yellow_circle: At risk **on reporting** | 6 MRs merged closing 7 rows, all S05/S07 remote surfaces. Every filled row across all 17 plans resolves to a merged MR — zero open, zero blocked. But **seven new plans appeared, taking the denominator 92 → 166** | | S28 Garbage collection | :red_circle: Blocked, and De-risk | [!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728) rebased 08-31 and **re-drafted 09-02**. 72 days, 60 unresolved threads, 0/2 approvals | **The service shipped continuously all week.** 107 releases cut in W36, and the major version rolled over — **v2.0.0 on 2026-09-03**, reaching v2.13.1 by 09-04. ## Bug bash Run 2026-09-01 → 2026-09-04 against the deployed service, tracked in [&23325](https://gitlab.com/groups/gitlab-org/-/work_items/23325) (*Artifact Registry Closed Beta — Defect Tracking*). | | | |---|---| | Issues filed in the window | **53** — 2 on 08-31, 9 on 09-01, 23 on 09-02, 17 on 09-03, 4 on 09-04 | | Closed in the window | **23** across the whole epic tree — **every closure the tree has ever had landed in W36** | | Epic tree size | 58 direct children + a 32-finding encryption sub-tree (`ops&22`) = 90 issues; 67 open / 23 closed | | Closed-beta blocking | **28** labelled `~AR-Blocks::Closed-Beta`, 16 still open | | Deferred to GA | **21** labelled `~AR-Blocks::GA`, 18 still open | | Severity | S1 **2** · S2 20 · S3 21 · S4 9 · none 6 | A full triage pass ran on **2026-09-03**, and it did three things worth carrying forward: 1. Promoted eight items to `~AR-Blocks::Closed-Beta` (#1140, #1131, rc#55, #1134, #1128, #1133, #1125, #1083). 2. Split [#1158](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1158) out of [#1025](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1025) — #1025 stays GA, the measurement task becomes a closed-beta deliverable. 3. **Redefined `priority::` to mean effort, not criticality.** `priority::1` = missing implementation or cross-service work (longer lead, start first); `priority::2` = self-contained and quick. Severity is unchanged. **Anyone reading priority labels filed before 09-03 will misread them**, and reading the blocker list by priority alone mis-orders the S1s. ### The gate is RED The epic defines the launch gate as a rule rather than a stored value: *CB proceeds while the `severity::1` search returns nothing, and is blocked the moment it returns anything.* Two open S1s, **both cross-service** — neither closes on AR review velocity: | Issue | Owner | What it is | |---|---|---| | [#1070](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1070) | `@10io` | Private Maven `.jar` reads served from a **shared edge cache without varying on the credential** — an unauthorized principal receives the signed storage redirect. A live authz bypass on the data plane | | [#1162](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1162) | `@jaime` | **Cloudflare rejects any upload over 500 MiB** | Both need a [Runway provisioner](https://gitlab.com/gitlab-com/gl-infra/platform/runway/provisioner) MR ([!1850](https://gitlab.com/gitlab-com/gl-infra/platform/runway/provisioner/-/merge_requests/1850), [!1838](https://gitlab.com/gitlab-com/gl-infra/platform/runway/provisioner/-/merge_requests/1838), [!1839](https://gitlab.com/gitlab-com/gl-infra/platform/runway/provisioner/-/merge_requests/1839)), all open. ### What the bash proved about the deployment, not the code Three of the highest-severity finds were **infrastructure and deployment**, not AR logic, and they are the reason the bash was worth running against a real environment rather than a test suite: - [#1136](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1136) — Cloudflare WAF blocked **every** request to staging *and* production with a 403. Filed and closed 09-03. - [#1164](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1164) — production rejected every body over 5 MB, from a **stale v1.454.1 pre-check still deployed**. Filed and closed 09-03. - [#1023](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1023) / [#1024](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1024) — staging pod OOMKilled at 512Mi during a `docker push` of a *small* image, and the transport body-size pre-check plus read timeout capping the upload data plane. Both closed 09-03 across 14 MRs. ### Findings that escaped the epic **20 `type::bug` issues** filed in the window are **not** children of [&23325](https://gitlab.com/groups/gitlab-org/-/work_items/23325), so they appear in none of its live views and in none of the digest queries. 13 are still open. Only one carries an `AR-Blocks` label. Two need attention regardless of scope: - [#1121](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1121) — **public and open**, and it tracks a confidential work-item number left in public git history. It carries `security`, `security-triage-psirt` and `security-sp-label-missing`. - [#1049](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1049) — **no AR alert reaches `#f_artifact_registry_alerts`.** Open, unassigned, during a live beta. There is also a coherent cluster of **five lock-ordering / reaper-ordering defects** (#1068, #1168, #1199, #1200 outside the epic; #1122, #1135 inside it) split across the epic boundary — four of the outside ones are `bug::availability` deadlock risks with no gate recorded. --- ## Metrics | Metric | This week (W36) | Last week (W35) | Trend | |--------|-----------------|-----------------|-------| | MRs merged (feat/fix/docs) | **193** (172 excl. bots) | 161 (141 excl. bots) | :arrow_upper_right: +32 | | MRs merged (other/bot) | **67** (48 excl. bots) | 69 (49 excl. bots) | :arrow_right: -2 | | MRs open / in review | **47** non-bot non-draft | 48 non-bot non-draft | :arrow_right: -1 | | Review queue depth (oldest open MR, days) | **67 days** ([!764](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/764)) | 65 days ([!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728)) | :arrow_upper_right: new holder | | Specs approved (of total needed) | **32/54** Approved; **39/54** approved-or-better | 32/54 Approved; 38/54 approved-or-better | :arrow_upper_right: +1 better | | Workstreams | **6 complete, 3 on track, 3 at risk, 1 blocked, 1 descoped** (of 14 tracked) | 3 complete, 6 on track, 3 at risk, 1 blocked, 1 descoped | :arrow_upper_right: +3 complete | | Active blockers | **16** open `~AR-Blocks::Closed-Beta`, 2 of them `severity::1` | 6 | :arrow_upper_right: see note | **Blockers rose 6 → 16 because the bug bash worked.** This is discovery, not regression: the count went up by pointing a week of deliberate testing at a deployed service. The two `severity::1` entries are new information the program did not have on 08-30. **260 MRs landed on `main` in five working days** — Saturday 09-05 and Sunday 09-06 were both empty, and no MR was even opened on the 5th. That is **52/day against W35's 38/day, a 35% rise in daily rate** behind a 13% headline. --- ## Changes From Last Week - **Three workstreams completed**: S09 enforcement (20/20), S16 container remote (26/26), S17 Phase 8 (13/13). Two more small plans finished outright (S17 namespace connection test 2/2, S15 observability 5/5). - **The virtual formats started moving.** S32 went from a blocked spec to 5/19 in one week; S31 reached 12/19; S30's spec cleared. All three remain **fast-follow** per the roadmap's Aug 14 cut. - **The real auth path was validated end to end on staging** and [#473](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/473) closed — the gate that had been carried since 2026-07-31. - **AR now fails closed on an unconfigured authorization posture** ([!2266](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2266)). It had been failing *open*, tracked as [#597](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/597). - **The AppSec encryption review landed** after 26 days, and all three closed-beta-blocking findings closed the next day. - **`docs` overtook `feat` as the largest prefix** (81 vs 61), and `docs(plans)` went 28 → 40 while `feat` *fell* 69 → 61. A material share of that is plan-table churn — status fills, corrections, denominator re-measurements — rather than new plans. - **Author concentration sharpened hard.** `@dmeshcharakou` landed **83 MRs, 32% of everything merged on `main`** (38% excluding bots), against a second place of 31. W35's load was split 49/44 between two leads. Contributor count is flat at 16–17, so this is concentration, not headcount. - **`test` and `ci` roughly doubled** (11 → 22, 4 → 11) on the e2e harness work, while `refactor` collapsed 13 → 4. - **Stacked-branch merges jumped 1 → 6**, all `@suleimiahmed`'s e2e work. Those are invisible to the first-parent count until their parent lands. --- ## Closing Checklist * Async updates: **not applicable** — no sprint issue existed during the week, so no DRI could post to one * [x] Metrics table filled in * [x] Blockers table current — the `~AR-Blocks::Closed-Beta` label on [&23325](https://gitlab.com/groups/gitlab-org/-/work_items/23325) is the live source * [x] Roadmap updated at docs/roadmap/closed-beta.md — [!2394](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2394), carrying W35 **and** W36 to a 2026-09-06 cutoff * [x] Changes from last week documented * [x] Next week's workstream targets confirmed with DRIs — carried into the W37 issue * [ ] Sprint summary posted to #f_artifact-registry Slack channel **Sprint summary for Slack:** > Sprint W36 closed. MRs merged: 193 feat/fix/docs, 67 other — 260 total in five working days. Three workstreams completed: S09 enforcement 20/20, S16 container remote 26/26, S17 Phase 8 13/13. Bug bash filed 53 issues in four days and closed 23. Blockers: 16 closed-beta blocking, 2 of them S1. Win: the real auth path validated end to end on staging, #473 closed. Risk: the CB gate is red on two S1s, both needing Runway MRs rather than AR ones. Sprint W37: https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1202