Skip to content

STABLE-SCOPE.md

Latest commit

 

History

History
97 lines (82 loc) · 5.18 KB

STABLE-SCOPE.md

File metadata and controls

97 lines (82 loc) · 5.18 KB
Raw

Stable Release Scope

Baseline: guacamole-angular-port-2026-09-21-preview.zip SHA-256: b6d8f7b309e225a4d2e764103695c3f1d4e0d8ed5b221fba6630d0388a84693f

This document states exactly which capabilities this release claims as stable, and which are explicitly out of scope. The release verdict applies only to the scope declared here.

Supported stack (verified end-to-end)

Component Version / configuration
Guacamole server (backend) Apache Guacamole 1.6.0, pinned by digest
guacd Apache Guacamole 1.6.0, pinned by digest
Database PostgreSQL 16, stock 1.6.0 schema (initdb.sh --postgresql)
Authentication Stock PostgreSQL database authentication
TOTP Stock guacamole-auth-totp 1.6.0 extension: first-time enrollment through the candidate UI (server QR code + manual key + instructions) and code login
Frontend This project's production build (ng build), served as static files
Proxy nginx: origin root and /guacamole/ subpath, REST/WebSocket/HTTP tunnel routing, TLS termination, no-WebSocket listener
Browser Installed Chrome (153 at acceptance) for functional gates; isolated container Chromium (153) with its own trust store for the TLS gate; 1280×800 declared viewport
Remote targets Disposable Linux SSH/SFTP, VNC and xrdp fixtures

Deployment requirement: the reverse proxy must allow the file-upload request size used by the client (the staging proxy configures client_max_body_size; the upstream manual documents this caveat). Uploads above a configured limit must be surfaced as errors — the frontend does not truncate silently.

TLS acceptance is performed with normal certificate validation: the test CA is trusted only inside an isolated browser container's trust store (no host or machine trust changes), and no certificate-error suppression flags are used.

Supported capabilities

  • Login/logout with the stock PostgreSQL data source, including first-time TOTP enrollment through the UI, MFA/TOTP continuations, invalid-credential handling, token revocation and session invalidation on logout.
  • Connection browsing, launching connections over SSH, VNC and RDP through real guacd, multiple concurrent sessions with tiling and focus management, closing/disconnecting sessions without orphan state.
  • In-session features: keyboard/mouse input, terminal resize, clipboard (VNC, both directions), file transfer (SFTP), Ctrl+Alt+End → remote Delete, advertised on-screen keyboard and text-input modes, saved timezone/input method/mouse preferences.
  • Administration through the candidate UI against the real REST API: connection create/edit/delete, user attributes, permission grant/revoke transitions, user-group membership, CSV bulk import — each with backend re-reads.
  • Active-connection sharing links (read-only profile), including live verification that the recipient reaches the intended session, tampered links rejected at the authentication boundary, and host-disconnect behavior.
  • Deployment shapes: origin root, /guacamole/ subpath (with redirect from the bare path), TLS termination validated with a normally trusted test certificate in an isolated trust store, and operation with WebSockets unavailable (HTTP tunnel fallback).
  • Stability: 25 connect/disconnect cycles with no orphan sessions or page errors; a strict 30-minute two-session soak with periodic real input.

Explicitly out of scope (not claimed stable)

These exclusions existed in the preview and remain; no supported feature was moved here to make results green. The owner approved this exclusion list on 2026-09-21 (recorded in evidence/delivery-record.json).

  • Databases other than PostgreSQL; other auth extensions (LDAP, OpenID/SSO, SAML, CAS, Duo, RADIUS, header auth) — only PostgreSQL auth and TOTP were exercised.
  • Protocols/targets beyond the tested fixtures: the Linux xrdp fixture is not evidence about a specific Windows RDP server; RDP feature coverage beyond keyboard input is not claimed; audio, printing, session recording and transfer features beyond SFTP upload/download/cancel are not claimed.
  • Browsers other than the tested Chrome version; touch/gesture input and real mobile devices.
  • Guacamole versions other than 1.6.0.
  • Upgrade-in-place from the legacy frontend with warm/stale caches.
  • Accessibility conformance (no WCAG audit).

Known deviations from stock (documented, non-blocking)

  • Login form inputs carry id="login-field-<name>" but not a name attribute: Angular's NgModel declares a name input which consumes the binding. Fields are fully functional; external tools should use the id.
  • The sharing link carries the credential in the profile's query parameter (key=...), exactly as the server's sharingCredentials response specifies.
  • The upload size limit is a deployment/proxy configuration, not an application constant; the application surfaces the rejection.

Release-blocking criteria

A release-blocking defect is any failure in the gates listed in docs/STABLE-ACCEPTANCE.md (groups A–H plus the strict soak) that reproduces against the final candidate with the real backend, or any unresolved required case reported as BLOCKED. All required gates passed for this scope.