**Previous sprint:** https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/665\ **Roadmap:** [docs/roadmap/closed-beta.md](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/roadmap/closed-beta.md) --- ## Scope of this plan This sprint tracks **only the closed-beta roadmap items that are still open**. Everything already Completed, the dropped S02 CLI row, and the De-risk streams deferred post-closed-beta are deliberately out of scope and are not listed. Fourteen rows: thirteen `Build` rows that are not Completed, plus **S28**, which is `De-risk` but included because it is the only genuinely blocked item and its spec MR is the repo's oldest open non-draft. Rows are ordered by spec number, with Frontend last. Every status below was derived from the repository at the W34 close, not from async updates — 2 of 26 DRIs posted last sprint. Working: [W34 results](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/665#note_3717697899). ## Workstream Plan | Workstream | Work Items | Spec(s) | DRI | Engineers | Status | Notes | Weekly Update | |------------|------------|---------|-----|-----------|--------|-------|---------------| | S08 AuthN — real path | [#473](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/473), [&22504](https://gitlab.com/groups/gitlab-org/-/work_items/22504) | S08 | `@bmarjanovic` | `@10io` `@jdrpereira` | 🟡 At risk | Stub done; clients shipped. The "blocked on external GLGO/GLAZ" framing is **retired** — [#218](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/218) closed 08-10 as obsolete and four service-auth MRs merged in W34. Remaining gate is internal: [#473](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/473) staging rollout, open 23d. ADR-020 still `Proposed` | :x: | | S09 AuthZ — enforcement | [#652](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652), [#597](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/597), [#473](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/473) | S09 | `@bmarjanovic` | `@10io` | 🔴 Blocked | Both clients closed 07-13. Two gaps the roadmap never listed: [#652](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652) Maven, npm and the management API still run the **allow-all stub** (GLAZ covers OCI only; plan [!1832](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1832) open), and [#597](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/597) AR **fails open** when authz is unconfigured — unassigned 11d, security-relevant | :x: | | S15 npm remote | [#287](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/287) | S15 | `@10io` | `@dmeshcharakou` | 🟡 At risk | **14/16.** Only steps 15 (observability) and 16 (e2e conformance harness) remain and **neither has an MR in any state** — the risk is absence of work, not a dependency. Denominator is 16, not 14. Rows 1–4 landed but are unrecorded; a `docs(plans)` fill is owed | :x: | | S16 Container remote | [#288](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/288) | S16 | `@radbatnag` | `@sylviashen` | 🟡 At risk | **21/26.** Step 16 stack is red: [!1717](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1717) has conflicts + unresolved threads and blocks [!1718](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1718); all three of !1716/!1717/!1718 have failing pipelines. Steps 14 and 15 unblocked in W34 but have no MR. Plan self-contradicts on the denominator (prose 29, table 26) | :x: | | S17 Management API | [#314](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/314), [#316](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/316) | S17 | `@hswimelar` | — | 🟡 At risk | **P4 37/38** (only [!1754](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1754), pipeline green, waiting on threads). **P6 22/42**, 11 MRs in review. **P8 0/21 — the gap**: plan merged 08-14, not one step started, and its S22 dependency cleared in W34 | :x: | | S18 Download tracking | [&22812](https://gitlab.com/groups/gitlab-org/-/work_items/22812), [#292](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/292), [#293](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/293) | S18 | **unassigned** ⚠️ | — | 🔴 Blocked | **Standup decision, 08-24.** `Build` scope, not De-risk. Spec and impl issues both open **40d**, unassigned; spec is `Planned`. The deferral lever ("ship counter columns, defer recording wiring") was **withdrawn** — the merged CB scope doc commits to per-artifact counts on the repository list and detail, so re-cutting needs a **product decision, not a roadmap edit**. Frontend depends on it. Live defect already: [#783](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/783) npm remote reads emit no `artifact_pulled`. Note [&22812](https://gitlab.com/groups/gitlab-org/-/work_items/22812)'s description still quotes the withdrawn reduction as if live | :x: | | S20-A Lifecycle | [#464](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/464), [#470](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/470) | S20-A | `@vespian_gl` | — | 🟢 On track | **16/21**, up from 4/21 — sixteen steps landed in W34, the largest single-sprint movement in the program. Remaining: 15a, 16, 17b, 18, 19. Steps 17b and 19 depend on S22. [#464](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/464) and [#470](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/470) untouched 17d while the implementation moved — whether the merged reaper closes them is unverified | :x: | | S22 Storage accounting | plan `2026-08-04-s22-storage-accounting.md` | S22 | `@vespian_gl` | — | 🟢 On track | **19/21.** Remaining: step 15 [!1803](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1803) and step 17 [!1798](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1798), both open and non-draft. Epic `ops&5` is closed with zero children and [#265](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/265) closed — the plan file is the only usable tracker | :x: | | S28 Garbage collection | [!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728), [#661](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/661)–[#664](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/664) | S28 | `@hswimelar` | `@vespian_gl` (rev) | 🔴 Blocked | De-risk, included because it is the only blocked item. Spec [!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728) open **58d**, at `requested_changes` after three change requests in five days. **No S28 spec file and no GC plan on `main`**, so per the spec→plan→step gate nothing downstream can open. Four follow-ups spun out of its review 08-17, all unassigned | :x: | | S30 Maven virtual | — | S30 | `@mkhalifa3` | — | 🔴 Not started | **Fast-follow after 2026-09-07.** No spec file and no MR in any state — the largest gap between committed and started. S14 completed 19/19 in W34, so the DRI has capacity. Depends on S14 (met) | :x: | | S31 npm virtual | [!1833](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1833) | S31 | `@dmeshcharakou` | `@10io` | 🟡 At risk | Spec **Approved** (first virtual format to clear its gate). Plan [!1833](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1833) opened 08-21, non-draft, in review. Implementation not started; no step MR may open until the plan merges | :x: | | S32 Container virtual | [!972](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/972) | S32 | `@radbatnag` | — | 🔴 Blocked | Spec [!972](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/972) open **37d** — third-oldest open MR in the repo. Blocks plan and implementation. Depends on S16, which is itself 21/26 with a red stack | :x: | | S33 GitLab API | [#692](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/692) | S33 | `@jdrpereira` | — | 🟢 On track | Phase 1 **8/8**; service-auth **2/4**. Remaining: Step 3 ops rollout (staging first, no MR recorded) and [#692](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/692) remove the bootstrap token, unassigned, opened 08-19. Epic [&22846](https://gitlab.com/groups/gitlab-org/-/work_items/22846) closed 08-10, **before** the service-auth work landed — use the plan file, not the epic | :x: | | Frontend (monolith) | tracker **needs replacing** | monolith/S06, S10, S14 | `@rchanila` | `@fmccawley` `@zcuddy` | 🟢 On track | Actively shipping: 4 MRs merged and 4 opened in W34. Foundations complete (S01 8/8, S02 3/3, S03 3/3), S07 8/8, S04 8/10, S05 11/14. Remaining: **S10 8/18, S14 0/18**, S06 spec merged 08-20. **Both previously carried blockers are gone** — the Authorization ADR merged 2026-06-26 and RBAC [gitlab#602144](https://gitlab.com/gitlab-org/gitlab/-/work_items/602144) is 77d (not 119) and owned by `@dlrussel` elsewhere. The cited tracker [gitlab#591887](https://gitlab.com/gitlab-org/gitlab/-/issues/591887) is a **closed** ADR-authoring issue | :x: | **This week's expected outputs** (MRs merged or ready for review by Friday): * S17: close Phase 4 by merging [!1754](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1754); start Phase 8 (0/21 is the single largest untouched block) * [ ] Phase 4 at 38/38 * [ ] Phase 8 first steps opened * S20-A: land 15a, 16, 17b, 18, 19 * [ ] S20-A complete at 21/21 * S22: land steps 15 and 17 * [ ] S22 complete at 21/21 * S15: open MRs for steps 15 and 16 — nothing exists for either today * [ ] S15 complete at 16/16 * S16: unblock the Step 16 stack (conflicts, threads, pipelines), then open steps 14 and 15 * [ ] !1717 green and merged * S09: land [!1832](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1832) and assign [#597](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/597) * [ ] Authz enforced beyond the OCI data plane * S28: get [!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728) to merge — it gates the entire GC stream * [ ] S28 spec merged * S31: merge the plan [!1833](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1833) so step MRs can open * [ ] S31 plan merged * S32: get [!972](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/972) reviewed and merged * [ ] S32 spec merged * S18: decide ownership and scope at Monday standup * [ ] S18 has a DRI, or a product decision to re-cut scope ### Weekly Status Updates DRIs to post a weekly status update as a thread by EOD on Thursdays. Copy/Paste template below: ``` ## Workstream Weekly Update {Workstream Name} - [ ] Spec completion XX% -> Link to spec or work item - [ ] Plan completion YY% -> Link to plan - [ ] Implementation step 3 / 13 - MR #1 - MR #2 - ... - Status: 🟢 On track / 🟡 At risk / 🔴 Blocked - [ ] Workstream plan updated (work item description is up to date!) Notes: - XYZ... - Blockers: Pending ADRs / Missing designs / etc... ``` --- ## Metrics > Filled 2026-09-07, not on Friday 2026-08-28 — this sprint's close was written up late. Figures > cover the **full** week rather than a partial Friday cut. Working, with method and caveats: > [W35 end-of-week results](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/823#note_3795354348). | Metric | This week | Last week | Trend | |--------|-----------|-----------|-------| | MRs merged (feat/fix/docs) | **161** (141 excl. bots) | 162 (150 excl. bots) | :arrow_right: -1 | | MRs merged (other/bot) | **69** (49 excl. bots) | 76 (60 excl. bots) | :arrow_lower_right: -7 | | MRs open / in review | **48** non-bot non-draft | 58 non-bot non-draft | :arrow_lower_right: -10 | | Review queue depth (oldest open MR, days) | **65 days** ([!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728)) | 58 days ([!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728)) | :arrow_upper_right: same MR, +7d | | Specs approved (of total needed) | **32/54** Approved; **38/54** approved-or-better | 31/54 Approved; 37/54 approved-or-better | :arrow_upper_right: +1 | | Workstreams on track | **3 complete, 6 on track, 3 at risk, 1 blocked, 1 descoped** (of 14 tracked) | 11 complete, 8 on track, 6 at risk, 1 blocked (of 26) | :arrow_upper_right: | | Active blockers | **6** — 5 of the 11 listed were already resolved | 10 | :arrow_lower_right: -4 | > **The 14 rows in this sprint's plan are not the 26 rows W34 counted.** W35 deliberately scoped to > the still-open closed-beta items, so the workstream row is not comparable week over week; the > completion profile inside the 14 is what moved. --- ## Blockers > Age = days since created, to 2026-08-24. Owner = person responsible for resolution. | Blocker | Owner | Age (days) | Status | |---------|-------|------------|--------| | [!728](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/728) S28 spec — gates the whole GC stream | `@hswimelar` / rev `@vespian_gl` | 59 | `requested_changes`; no S28 spec file or GC plan exists on `main` | | [#513](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/513) / [#514](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/514) AppSec review of S04 encryption | **unassigned** | 20 | Gates closing S04; open since 2026-08-04 | | [#473](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/473) Deploy the S08/S09 real auth path to staging | `@jdrpereira` `@bmarjanovic` | 24 | The real S08/S09 gate, and it is internal | | [#597](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/597) Fail closed when authz is unconfigured | **unassigned** | 12 | **Security** — AR currently fails open | | [#652](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652) Enforce authz on Maven, npm, management API | `@10io` | 7 | Plan [!1832](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1832) opened 08-21 | | [!972](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/972) S32 spec | `@radbatnag` | 38 | Blocks S32 plan and implementation | | S16 Step 16 stack ([!1716](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1716), [!1717](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1717), [!1718](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1718)) | `@radbatnag` | 3 | Conflicts, unresolved threads, three failing pipelines | | S15 steps 15–16 | `@10io` | — | 14/16 done and nothing in flight | | [#278](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/278) npm conformance CI gate | **unassigned** | 42 | The genuine S11 tail; [#141](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/141) tracks a merged step and should be closed | | registry-conformance [#32](https://gitlab.com/gitlab-org/ops/registry-conformance/-/work_items/32) / [#33](https://gitlab.com/gitlab-org/ops/registry-conformance/-/work_items/33) | **unassigned** | 74 | Never touched since creation; #33 is the AR handoff | | S18 ownership | **unassigned** | 41 | Standup 08-24. Deferral lever withdrawn — re-cutting needs a product decision | --- ## Changes From Last Week - **S14 Maven remote completed** (19/19) — the DRI now has capacity, which is why S30 carries `@mkhalifa3`. - **S20-A went 4/21 → 16/21 and S22 9/21 → 19/21.** The "S20-A at 3/21 against a 2026-09-07 closed beta" blocker is retired; it was ten steps stale when last restated. - **Three carried blockers were struck as already resolved**: the frontend Authorization ADR (merged 2026-06-26), and the S08/S09 "blocked on external GLAZ/IAM" framing (both clients closed 2026-07-13). - **Four rows were tracking closed issues** (#218, #219, #220, #222) while marked Blocked or At risk. - **Two real risks surfaced that were not previously tracked**: [#652](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652) and [#597](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/597). - Active blockers rose 6 → 10 through **visibility**, not regression. --- ## Closing Checklist * 2 of 14 workstream DRIs posted async updates on their issues (`@radbatnag`, S16 and S32) * [x] Metrics table filled in * [x] Blockers table current — verified, 5 of 11 struck as already resolved * [x] Roadmap updated at docs/roadmap/closed-beta.md — [!2394](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2394), carrying W35 **and** W36 to a 2026-09-06 cutoff * [x] Changes from last week documented * [x] Next week's workstream targets confirmed with DRIs — carried into the W36 and W37 issues * [ ] Sprint summary posted to #f_artifact-registry Slack channel **Sprint summary for Slack** (copy-paste when closing): > Sprint W35 closed. MRs merged: {N}. Workstreams on track: {N}/{total}. Blockers: {N}. {One sentence on biggest risk or win.} Sprint W36: https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1201 <details> <summary>Duo Queries</summary> MRs Merged This Week: ``` Walk git log --first-parent main between 2026-08-24 and 2026-08-30 in the project gitlab-org/ops/artifact-registry. List all MRs merged in that window with title, author, and merge date. Filter to feat:, fix:, and docs: prefixes only. Add a single line at the end: "Other changes: N merged" covering chore:, ci:, revert:, and bot-authored dependency bumps. Paginate fully — do not report from a truncated result set, and cross-check the count against git first-parent history before reporting it. Count an MR merged into a stacked parent branch as not yet on main. ``` Review Queue: ``` List all open, non-draft merge requests in gitlab-org/ops/artifact-registry that have been open for more than 2 days. Exclude Renovate/bot-authored MRs. Exclude MRs that include `draft` in their title. Include title, author, created date, and days open. Sort oldest first. State the oldest open MR at the end. Paginate fully — the full open set is ~110 MRs, so a single page is not the answer. ``` Spec Coverage: ``` Read the file docs/specs/README.md in the repository gitlab-org/ops/artifact-registry. It has three tables — service, GitLab monolith (frontend), and descoped from closed beta. Count each separately as well as in total; the same S-numbers appear in more than one table. List all specs with their current status (Planned, Draft, Approved, Implemented). Note any specs that have open MRs in review but are still listed as Planned in the README. ``` Workstream Status: ``` Read the async update threads posted as comments on this issue this week. For each workstream, summarize: completion percentage, current status emoji, and any blockers mentioned. Name any DRI who did not post, and do not present a carried-forward row as if it were reported. Where a row is carried, verify it against the repository before repeating it. Derive step counts from the plan Status table row count and the (plan: X/Y) markers in MR titles, not from the previous sprint issue — in W34 nine rows were stale, one by ten steps, and denominators had moved on three plans. ``` Age of blockers: ``` From the async update threads on this issue, list any mentions of blockers, dependencies on other teams, or open questions that must resolve before an implementation MR can open. Include workstream, owner, estimated age, and current status. Verify each carried blocker is still open before repeating it — in W34 three carried blockers had already been resolved, one of them eight weeks earlier. Note any confidence drops below 70%. ``` Weekly Summary: ``` Based on this sprint issue, write a one-paragraph Slack summary for #f_artifact-registry covering: MRs merged (feat/fix/docs count + other count), workstreams on track vs. at risk vs. blocked, active blocker count, and the single biggest risk or win this week. Keep it under 60 words. End with: Sprint W36: https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1201 ``` </details>