Implement Maven remote repositories per the S14 spec (#281). Depends on the S13 foundation implementation (#280). ## Spec and plan - Spec: [`docs/specs/S14-maven-remote.md`](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S14-maven-remote.md) - Plan: [`docs/plans/2026-07-27-maven-remote.md`](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/plans/2026-07-27-maven-remote.md) ## Scope Maven remote (`kind=2`) vertical slice: the four `maven_remote_*` cache tables, the remote cache store and remote-repository store, upstream request composition (Basic auth, identity encoding, path-escaped URL construction), the read-path kind-dispatch seam, warm-cache read paths, artifact/metadata fill paths, checksum-sidecar synthesis (including cold-parent fill), and the Maven-remote observability surface. Delivered as **18 implementation steps** across two tracks: **Track A** (Steps 1-12, schema + stores + warm-cache paths) needs no S13 deliverable beyond the contract seam already merged; **Track B** (Steps 13-18, the fetch/fill paths) is gated on S13 pieces still in flight. Execution follows the dependency DAG below - **not numeric order**; each step's blockers are its direct predecessors. Step numbers are stable references for MR titles and review. **Out of scope:** S13 owns the format-agnostic foundation (Lookup/Probe/Fetch, teed Fetch + cache-fill pipeline, single-flight, cache freshness/fallback, SSRF-hardened upstream client, credential-manager behavior, health monitoring). S17 owns remote-repo REST CRUD + connection-test. S30 owns the Maven virtual repository; S29 cache eviction, S28 GC, S20 soft-delete cascade, S08/S09 real auth. ## Dependency DAG ```mermaid graph TD S1["Step 1: schema - maven_remote_repositories"] S2["Step 2: schema - maven_remote_packages"] S3["Step 3: schema - maven_remote_versions"] S4["Step 4: schema - maven_remote_files"] S5["Step 5: upstream URL, Basic auth, Central pin rule"] S6["Step 6: remote repository store - finder + health"] S7["Step 7: remote repository store - credentials"] S8["Step 8: remote cache store - Lookup + freshness"] S9["Step 9: remote cache store - cache-fill writes"] S10["Step 10: read-path kind-dispatch seam + 501 stubs"] S11["Step 11: cache-hit serve path - artifact and metadata"] S12["Step 12: sidecar synthesis from a warm parent"] S13["Step 13: remote operations glue over S13"] S14["Step 14: artifact proxy - miss and stale revalidation"] S15["Step 15: metadata proxy - miss and stale revalidation"] S16["Step 16: sidecar cold-parent fill"] S17["Step 17: observability - metrics + wide event"] S18["Step 18: hermetic end-to-end proxy harness"] S1 --> S2 S2 --> S3 S3 --> S4 S1 --> S6 S1 --> S7 S4 --> S8 S8 --> S9 S6 --> S10 S8 --> S11 S10 --> S11 S8 --> S12 S10 --> S12 S5 --> S13 S6 --> S13 S7 --> S13 S9 --> S13 S10 --> S13 S11 --> S14 S13 --> S14 S11 --> S15 S13 --> S15 S12 --> S16 S14 --> S16 S15 --> S16 S14 --> S17 S15 --> S17 S16 --> S17 S14 --> S18 S15 --> S18 S16 --> S18 ``` ## Status | Step | Description | MR | Status | Done | Assignee | Dependencies | |------|-------------|----|--------|------|----------|--------------| | 1 | Schema — `maven_remote_repositories`: root cache table for `kind=2` Maven repos, interim `tmp_plaintext_username`/`tmp_plaintext_password` columns, `snapshot_metadata_always_revalidate` | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1120 | ~"workflow::complete" | [x] | @mkhalifa3 | — | | 2 | Schema — `maven_remote_packages`: FKs into Step 1's table | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1189 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 1 | | 3 | Schema — `maven_remote_versions`: FKs into Step 2's table, six indexes | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1224 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 2 | | 4 | Schema — `maven_remote_files`: FKs into Steps 2 + 3, four digest columns, two blob FKs, six indexes | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1318 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 3 | | 5 | Upstream URL, Basic auth, Central pin rule: outbound coordinate re-validation, path-escaped URL construction, `RequestBuilder`, username `:` rejection, Central-host cache-validity pin | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1117 | ~"workflow::complete" | [x] | @mkhalifa3 | — | | 6 | Remote repository store — finder + health: reads/writes Step 1's table only | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1192 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 1 | | 7 | Remote repository store — credentials: own store type/file, doesn't extend Step 6's | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1191 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 1 | | 8 | Remote cache store — Lookup + freshness: resolves a path across all four tables, pure freshness selector | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1340 & https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1341 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 4 | | 9 | Remote cache store — cache-fill writes: write methods on Step 8's store, reuses its coordinate resolution | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1423 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 8 | | 10 | Read-path kind-dispatch seam + 501 stubs: attaches remote-repository row to `Resolution`, owns two new codes, wires `wire_maven.go` | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1319 | ~"workflow::complete" | [x] | @mkhalifa3 | Step 6 | | 11 | Cache-hit serve path — artifact and metadata: warm-cache serve for both byte-serving classes | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1439 | ~"workflow::complete" | [x] | @mkhalifa3 | Steps 8, 10 | | 12 | Sidecar synthesis from a warm parent: collapses duplicated GET-side digest selection into `shaSidecars` | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1435 | ~"workflow::complete" | [x] | @sylviashen | Steps 8, 10 | | 13 | Remote operations glue over S13: composes URL builder, remote-repo fields, credentials, cache-fill write, Step 10's codes | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1533 | ~"workflow::complete" | [x] | @mkhalifa3 | Steps 5, 6, 7, 9, 10 | | 14 | Artifact proxy — miss and stale revalidation: replaces its own stub | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1658 https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1659 https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1660 | ~"workflow::complete" | [x] | @mkhalifa3 | Steps 11, 13; external: `Content-Length` forwardable-header exemption for the cold-fill relay tracked in [#433](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/433) (open, shared with S16) | | 15 | Metadata proxy — miss and stale revalidation: replaces its own stub | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1745 | ~"workflow::in review" | [x] | @mkhalifa3 | Steps 11, 13; external: `Content-Length` forwardable-header exemption for the cold-fill relay tracked in [#433](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/433) (open, shared with S16) | | 16 | Sidecar cold-parent fill: cold parent may be artifact or metadata, needs both fill flows + Step 12's synthesis | https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1773 | ~"workflow::in review" | [x] | @mkhalifa3 | Steps 12, 14, 15; external: `Content-Length` forwardable-header exemption for the cold-fill relay tracked in [#433](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/433) (open, shared with S16) | | 17 | Observability — metrics + wide event: instruments the three landed read paths | | ~"workflow::in dev" | [x] | @mkhalifa3 | Steps 14, 15, 16; external: `Content-Length` forwardable-header exemption for the cold-fill relay tracked in [#433](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/433) (open, shared with S16) | | 18 | Hermetic end-to-end proxy harness: drives all three paths end to end | | ~"workflow::in dev" | [x] | @mkhalifa3 | Steps 14, 15, 16; external: `Content-Length` forwardable-header exemption for the cold-fill relay tracked in [#433](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/433) (open, shared with S16) | ## Cross-workstream dependencies (critical path) - **S13 (virtual/remote foundation, #280)** — all of Track B's S13 prerequisites have landed on `main`: the `Fetch` cache-fill pipeline ([#328 (closed)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/328), closed), the single-flight coalescer ([#329 (closed)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/329), closed), the secure upstream `RoundTripper`/`Client` ([#326 (closed)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/326), closed), and `VirtualRepositoriesConfig` ([#322 (closed)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/322), closed) are all merged. The `VirtualRepositoriesConfig`→`remote.Config` mapping is Step 13's own scope, not an external blocker. The one residual external gap is the `Content-Length` forwardable-header exemption needed for the cold-fill relay path, tracked in [#433](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/433) (open, shared with S16) — it gates the forwarding half of Steps 14-18's cold-fill criteria, not the rest of Track B. - **S06 (storage layer)** — merged; the `blob_storage_blobs` FK is active so both composite blob FKs in Step 4 are enabled from the start. - **S10 (Maven hosted)** — merged; S14 reuses `internal/format/maven/`'s path parser, coordinate grammar, Content-Type mapping, sidecar synthesis, RFC 9457 envelope, resolver/dispatcher, and the `PUT` kind gate. - **S17 (REST management API)** — downstream consumer of S14's remote-repository store, credential seams, and Central pin rule; not a prerequisite. - **Credential encryption at rest** — GA-blocking follow-up tracked in #68; Step 1 ships interim `tmp_plaintext_*` columns. ## Related - Spec: #281 - Foundation: #280 - AppSec review: #243