Step 20 of 20 of the [S09 enforcement plan](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/plans/2026-08-21-s09-authorization-enforcement.md#step-20-fail-closed-boot-and-stub-retirement). ## :dart: Scope Make the wraps unconditional, refuse to boot unconfigured without the opt-in, and delete the pass-through and its seam, per the spec's Boot posture and stub retirement section. ## :alarm_clock: What this step hands to the development-mode work This step rewrites `logStubWarning` in `cmd/artifact-registry/main.go`: it deletes `internal/authz/bootstrap`, which is what `allow_all_authz_stub: true` is justified by, so that field and its rationale paragraph go with it. It also makes the `authorization.unenforced` reader real. https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/692 builds on both: it removes the bootstrap-token stub end to end and replaces it with a purpose-built development mode, whose loader guard rejects the dev credential or `unenforced` alongside a configured `iam` block. That guard closes a gap this step leaves open — a stub-authenticated deployment with authorization enforced boots clean and returns a masked 404 to every request, because the stub yields a zero-value `relationships.Subject` and `authz.AnonymousDenied` gates ahead of the resolve. 692 is sequenced after this step, since the condition its guard reasons about only becomes a single process-wide posture once this step removes the per-format gates. Nothing here needs to change for it; this note is the heads-up that the follow-up exists and what it depends on. ## :link: Dependencies Blocked by: - [step 1](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/843) — the unenforced opt-in and the rigs that will need it - [step 9](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/851) — Maven wiring - [step 13](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/855) — npm wiring and route-table parity - [step 17](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/859) — management enforcement at the slugMiddleware seam - [step 19](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/861) — permission-filtered repository listing ## :open_file_folder: Files - `cmd/artifact-registry/wire_oci.go`, `wire_root_dispatcher.go`, `wire_management.go` (Modify): remove the per-format nil-client gates; wire every wrap unconditionally when enforcement is on. - `cmd/artifact-registry/main.go` (Modify): fail before listening when no IAM client is constructible and `unenforced` is unset; log the unenforced posture at WARN once at boot when it is set. - `internal/server/server.go` (Modify): drop the `authz.Middleware()` chain slot. - `internal/authz/authz.go` (Delete): the package-level slot, `Middleware`, and `Register`. - `internal/authz/bootstrap/` (Delete), `cmd/artifact-registry/bootstrap_authz_link.go` (Delete). - `docs/testing/e2e/docker.md` (Modify): its Access control section still describes the pass-through this step deletes. - `.golangci.yaml` (Modify): drop `authz-bootstrap-only-via-link-files`. The negative-control job needs no edit: that rule has no probe, and the job's rule loop names only rules that have one. ## :white_check_mark: Acceptance With `unenforced` unset and no `iam:` block the process exits with a configuration error before listening; with it set the process boots and logs the posture at WARN once; `authz.Middleware`, `authz.Register`, and the bootstrap package are absent from the binary. With enforcement on, every dispatcher and the management binding middleware are wrapped with no nil-client gate remaining. ## :test_tube: Tests `cmd/artifact-registry/wire_services_authz_boot_test.go` (Modify) for both boot postures; `internal/server/server_test.go` (Modify) for the removed chain slot; `internal/authz/authz_test.go` (Delete) with the seam it covers. Re-run `driver.sh smoke` and the OCI, Maven, and npm conformance suites, all three of which now boot through the opt-in step 1 gave them. ### :rotating_light: This is the step that closes the gap Until this merges, `internal/authz/bootstrap` registers a literal `return next` in the chain-position-10 slot, and a valid JWT from any user grants read and destructive write everywhere except containers. It merges only once every surface enforces. This step changes how the service boots, so `.claude/skills/run-artifact-registry/` is updated in the same MR and `driver.sh smoke` re-run. ### :twisted_rightwards_arrows: The plan text diverges from the amended spec S09 gained a `Permission verdicts` design section and acceptance criteria 21–27 in https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2125 (merged 2026-08-31, a61fa9c69), which also updated S17's list contract. The enforcement plan was written before that amendment, so the fields above are behind the spec in the ways below. The spec is the source of truth; read its criteria rather than the plan's step text when building this. The plan-side correction collects in https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/941, never in this step's MR. 1. **Criterion 20 gained a verdict clause.** Under the unenforced posture, requested permission verdicts answer all-allow, matching what the posture already permits. Step 4 of the permission-verdicts plan (https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/2166) owns that clause, so nothing in this step's scope changes for it. The ordering is what matters: if this step merges first, its boot-posture tests cover criterion 20 only in part, and the verdict half lands with that step. 1. **The verdict seam carries a fail-closed arm that this step makes unreachable.** Verdicts step 4 wires a third posture arm — no relationship resolver and no `unenforced` opt-in — answering 503 to any verdict request rather than all-allow. That arm exists because the interim wiring boots in exactly that state. This step ends it: a boot with no constructible IAM client and `unenforced` unset exits before listening. Once both have merged, no production wiring path reaches the arm, and whichever merges second is the one that says so where the arm is declared, rather than leaving a comment that reads as live. ## :books: References - Plan: [`docs/plans/2026-08-21-s09-authorization-enforcement.md`](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/plans/2026-08-21-s09-authorization-enforcement.md#step-20-fail-closed-boot-and-stub-retirement) - Spec: [S09 (authorization)](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S09-authorization.md) - Parent work item: https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652 - MR title must end with the literal marker `(S09 Enforcement plan: 20/20)` Related to https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/652