docs(qualification): GitLab.com qualified live -> dev

CHANGELOG.md

@@ -40,8 +40,9 @@ project adheres to [Semantic Versioning](https://semver.org/).
 - **GitLab provider (Release V3)** (#166): Releases for discovery, the
   Generic Package Registry as the canonical integrity surface (`file_sha256`
   + `size`), exact package lookup, bounded pagination, and `PRIVATE-TOKEN`
-  confined to the configured origin. GitLab.com live qualification is
-  UNTESTED and therefore not declared supported —
+  confined to the configured origin. **GitLab.com is qualified live**
+  (2026-09-16): a published package and release were enumerated, anchored,
+  downloaded and verified end to end against the real API —
   `docs/MULTIFORGE-QUALIFICATION.md` states exactly what was verified.
 - **Work Authority observation and claims** (#163/#164, ADR-0018):
   `ainative forge detect | status` (zero network, credentials, writes or

SUPPORT.md

@@ -11,7 +11,7 @@
 | Harnesses | Claude Code, Codex, OpenCode, Cursor, Gemini CLI, MiniMax/Mavis — for the shared method, skills and hooks |
 | Work management | Generic Git; GitHub (mapping); GitLab (mapping). The Work Authority is resolved locally, purely and fail-closed (ADR-0018) |
 | Features | Project-scope features independent of the profile (`forge-github` default, `forge-gitlab`), State schema V2 (ADR-0017) |
-| Release sources | GitHub.com (built-in, qualified); a local mirror; an anonymous HTTPS release API (`AINATIVE_UPDATE_URL`, never credentialed); GitLab.com provider implemented and contract-tested, live-service qualification UNTESTED — **not declared supported**; GitLab Self-Managed and GitHub Enterprise Server UNTESTED — **not supported** |
+| Release sources | GitHub.com (built-in, qualified); a local mirror; an anonymous HTTPS release API (`AINATIVE_UPDATE_URL`, never credentialed); GitLab.com (qualified live: Generic Package Registry anchor, managed releases, exact version chain — 2026-09-16); GitLab Self-Managed and GitHub Enterprise Server UNTESTED — **not supported** |
 
 Only the latest release is supported; fixes ship as a new patch version.
 

docs/MULTIFORGE-QUALIFICATION.md

@@ -34,7 +34,7 @@ Declared support never exceeds qualified support (`SUPPORT.md`, ADR-0019 §13).
 |---|---|
 | Generic Git | GREEN — `feature switch none`, zero-feature states valid, observation resolves `UNAVAILABLE` |
 | GitHub.com | GREEN for the release source (existing qualified releases + provider contract tests); GREEN for work management (mapping + observation) |
-| GitLab.com | Provider implemented and contract-tested against a scripted GitLab API. **Live-service qualification UNTESTED — not declared supported** |
+| GitLab.com | **GREEN — qualified live** (2026-09-16) against a public test project (`barat.erwan/ai-native-dev-stack-probe`): Generic Package Registry published `ai-native-dev-stack` 2.4.4 (manifest 514 B `sha256:84a921eb…`, bundle 119 895 B `sha256:67670398…`) plus release `v2.4.4`. Authenticated enumeration (`PRIVATE-TOKEN`), anchor read from the package-file API's `file_sha256` + `size`, anchored manifest parsed, exact version chain held, artifact downloaded with size + SHA-256 verified, lifecycle protocol 3 accepted, and `update check` reported `UPDATE_AVAILABLE 2.4.4` with the exact-runtime gate (`runtime_ready=false` for the 2.4.3 runtime) |
 | GitLab Self-Managed | UNTESTED — not supported |
 | GitHub Enterprise Server | UNTESTED — not supported |
 
@@ -43,7 +43,7 @@ Declared support never exceeds qualified support (`SUPPORT.md`, ADR-0019 §13).
 | # | Scenario | Evidence | Status |
 |---|---|---|---|
 | A | Generic Git | `test_lifecycle_features` (switch none, zero features), `test_forge_claims` (UNAVAILABLE) | GREEN |
-| B | New GitLab project | feature switch to `forge-gitlab` + GitLab provider tests (scripted) | PARTIAL — no live GitLab project exists to qualify |
+| B | New GitLab project | live qualification probe (above) + feature switch to `forge-gitlab` | GREEN |
 | C | Legacy GitHub project | V1 projection + migration tests | GREEN |
 | D | GitHub → GitLab → none → GitHub | `test_a_round_trip_loses_no_user_data` | GREEN |
 | E | Fork origin/upstream ambiguity | resolver + `forge detect` rendering (AMBIGUOUS, exit 0) | GREEN |
@@ -78,21 +78,18 @@ Declared support never exceeds qualified support (`SUPPORT.md`, ADR-0019 §13).
 ## Known limitations and remaining work
 
 **P1 — the declared-support gate:**
-- GitLab.com live qualification (requires a real GitLab project publishing
-  `ai-native-dev-stack` generic packages and an `ainative-release-v3.json`
-  manifest). Until then GitLab.com stays UNTESTED and is not declared
-  supported.
 - Full CI matrix (Linux/Windows/macOS, py3.11/3.13) — runs on the `dev`
-  proposals; the first run of the complete implementation was green 52/52.
+  proposals; every run so far has been green (52/52, then 76/76).
 - The V2 bridge release and the V3 release have not been published: the plan's
   release choreography (§92) starts after the branch is promoted to `dev`, and
   the first V3 publication stays gated by `V3_BRIDGE_RELEASE`.
 
-**Resolved since the first draft of this report:** scenario Q (mandatory
-secret patterns with operator extras), scenario J (GitLab object-storage
-blob), scenario M (legacy GitLab remote warning), scenario P (one
-cross-command selector-conflict E2E) and the EN/FR documentation parity
-automation (`tests/purity/test_docs_parity.py`: heading hierarchy, operational
-surface, critical security statements — no raw line-count equality).
+**Resolved since the first draft of this report:** the GitLab.com **live**
+qualification (scenario B), scenario Q (mandatory secret patterns with
+operator extras), scenario J (GitLab object-storage blob), scenario M (legacy
+GitLab remote warning), scenario P (one cross-command selector-conflict E2E)
+and the EN/FR documentation parity automation
+(`tests/purity/test_docs_parity.py`: heading hierarchy, operational surface,
+critical security statements — no raw line-count equality).
 
 **P0:** none known.