The lean set of capabilities required for **GA** (.com & Self-Managed). Source of truth: [**ga-scope.md**](https://gitlab.com/gitlab-org/ci-cd/package-stage/unified-artifact-management/-/blob/main/ga-scope.md) · dates: [spine.md](https://gitlab.com/gitlab-org/ci-cd/package-stage/unified-artifact-management/-/blob/main/spine.md). Feeds **G6 — GA definition complete**. Each child issue is a product story: **what it helps users do · user flow · how it works (high level) · acceptance criteria · success metrics.** Priority: **P0** = GA blocker · **P1** = fast follows (post GA) · **P2** = post GA ### Scope by priority - **P0:** lifecycle policies · AR role management UI · Migration from JFrog (Artifactory) - **P1:** PyPI & NuGet formats · repository & artifact protection · cloud-provider upstreams · proxying beyond Docker Hub · anonymous/public pull · higher limits & shareable upstreams · allow/deny (upstream) · clean machine-readable errors · Virtual Registries → GA transition · Dedicated deployment · free trial · Orbit knowledge-graph · audit logging · rate limits (per-user) · dependency firewall integration · Migration from Sonatype (Nexus) · Migration from GitLab project-level - **P2:** Debian / RPM / Go formats · custom properties · organization-level dashboard · AI agent (CLI + skills) > **Deployment:** `.com` and Self-Managed (CNG) are **delivered in closed beta** (not GA-net-new); **Dedicated** is the net-new GA deployment piece (P1, #605684). ### Cross-team dependencies (owned elsewhere, not children here) - **Fulfillment** — usage-based billing (&22252), purchase/provisioning ([#591904](https://gitlab.com/gitlab-org/gitlab/-/work_items/591904), &22493), SM annual true-up (#605783) - **Runner** — `CI_JOB_TOKEN` for `image:` pulls - **Organizations** — SM/Dedicated Organization support (&22427) - **Security** — dependency firewall _engine_ & vulnerability scanning (&22126) — the AR-side firewall **integration** is a P1 child here ### Deferred (post-GA / awaiting demand) OPA, artifact signing & attestations, workspaces, quarantine, storage tiering, advanced webhooks, cost forecasting, predictive AI, advanced/conditional retention beyond the core lifecycle policies, etc. — see the "Awaiting demand / Post-GA / Not planned" sections in ga-scope.md.