v1.0 acceptance checklist — real status (2026-10-22)
Verdict: 1.0.0 was released on 2026-10-22 at the project owner's decision. That is not a claim that every row below is complete: the 🟡, ⬜ and ❌ rows are the known limits of this release. It is on the VS Code Marketplace and attached to the GitHub release; it is not on Open VSX.
Key: ✅ done and verified · 🟡 partial · ❌ not done · ⬜ not started
| Criterion | Status | Evidence / limit |
|---|---|---|
| Tier 1 (PostgreSQL, MySQL/MariaDB, SQLite, SQL Server, Oracle, MongoDB, Redis/Valkey) tested against a real engine | ✅ | Conformance kit + per-engine tests (Docker containers), also in CI |
| Testing by other people | ⬜ | Nobody else has tested the extension. There is a guide ("Help test RizomaDB") and a "Test report" issue form; it still needs someone to use it |
| Real cloud (AWS, Google Cloud, Atlas, managed services) | ⬜ | Never tested: there is no account. Documented as "not confirmed" in the README, the connections guide, the engines page and the site; testing with a read-only user is recommended before relying on it |
| Tier 2 complete | 🟡 | Tested against a real engine: ClickHouse, Elasticsearch/OpenSearch, DuckDB, Neo4j 5.26, DynamoDB Local 2.5.2, InfluxDB 2.7 and 3 Core, Cassandra 5.0 and ScyllaDB 6.2, Firestore (emulator), Trino 470, and by protocol CockroachDB 24.3, YugabyteDB 2025.2 and TiDB 8.5 (CockroachDB, YugabyteDB, InfluxDB 3, Firestore and HydraDB also run in CI, job engines-extra). Pending: Redshift (needs an AWS account). Real AWS and Google Cloud NOT tested. See docs/engines |
| HydraDB | 🟡 | Experimental driver over the HTTP API; 16 tests against the official image, also in CI (engines-extra). It cannot list labels or properties (an engine limitation) |
| Zero telemetry | ✅ | Activation test with no sockets |
| Secrets only in SecretStorage | ✅ | Secret-redaction tests and a self-audit |
| Policy/audit in a single place | ✅ | guardConnection, policy-paths.test.ts; custom environments are one more layer that can only add restrictions |
| WCAG 2.2 AA accessibility | 🟡 | axe: 0 violations in light and dark themes on the grid (with tabs, record panel and menus), new and saved connections, settings, history, guide, ER, plan, designer and metrics; a keyboard audit script on every screen; manual screen-reader review with VoiceOver (macOS, VS Code) by the project owner: no problems; also reviewed by hand on Windows and Linux by the same person, no problems (which screen reader was used on each system was not recorded). No independent audit |
| UI in English and Spanish | 🟡 | A test against text drift; the extension language is independent from VS Code's; a script audits fixed texts. Messages from the database server come out as the server wrote them |
| Documentation in English and Spanish | 🟡 | Guides, engines, enterprise, security, references, comparison, this checklist, the design guide, the licence list, the site and the community files (README, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, CHANGELOG, GOVERNANCE, ROADMAP) exist in both languages; scripts/check-docs-parity.mjs checks it in CI. AGENTS.md stays in English only |
| Tested in a real VS Code | 🟡 | pnpm --filter rizomadb test:e2e: VS Code 1.142 activates the extension, registers the 62 commands, activation time is measured (82–110 ms against a 1000 ms budget), screen titles switch between English and Spanish, the run lenses appear in SQL and Mongo, and the settings, connection, guide and history screens open as tabs. Table filter, paging and column edits are tested against real PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Elasticsearch and Neo4j, and filter and paging against ClickHouse (engines.integration.test.mts); that test found, and we fixed, three late-cancel bugs (MySQL, PostgreSQL, Oracle) and the missing real DDL for changing a default in SQL Server. Paste editing, favourites, column statistics and Redis value editing have their own tests (Redis against a real server). No manual walk-through of the interface |
| 8-hour endurance test | ✅ | pnpm soak 480 min against PostgreSQL: 24,659,932 iterations, heap 10.8 MB, no sustained growth (0.00 MB/min). Extended on 2026-10-22 (SQLite, PostgreSQL and MySQL, with cancellations in the middle of a result): 10 min, 2,102 iterations, 0 statements hit by an earlier cancel, heap 15 MB with no sustained growth. The extension found a real bug (MySQL and SQL Server blocked when the caller stopped reading a large result), now fixed; the extended version has not been run for 8 hours |
| CI and release run on GitHub | 🟡 | CI green on dev and main (tests with real engines as services, licences, reference pages up to date, site, CodeQL, gitleaks). cockroach, yugabyte, firestore, influxdb3, hydradb and the real proxies (Squid, SOCKS5) run in the engines-extra job. GitHub Actions use versions without the Node 20 warning (except those of the release workflow, which has not run). The release workflow ran for 1.0.0 (build and attestation succeeded) |
| Large tables in the grid | 🟡 | Measured in a browser with 100,000 rows × 20 columns (synthetic data, no server): loads in 0.2 s, ~1,200 DOM nodes (rows are virtualised), smooth scrolling, sorting 0.04–0.06 s (before 0.3 s and 2.7 s: every cell was parsed on every comparison) and find 0.09 s with a typing delay. Not measured with millions of rows or on a slow machine; the row limit (query.maxRows, 100,000) bounds them |
| VSIX size / startup | 🟡 | 3.36 MB (budget 8 MB; the big parts are the driver worker, 9 MB uncompressed, and the MCP server, 5 MB), checked in tests; startup measured in a real VS Code: 82–110 ms (e2e), also with the CPUs busy; measured on one laptop only, not on a slow machine |
| Licences and SBOM | ✅ | pnpm audit:licenses, pnpm sbom:generate; engine logos come from CC0/MIT sets (scripts/gen-logos.mjs) |
| HTTP/SOCKS proxy | 🟡 | HTTP CONNECT and SOCKS5 (with user/password, DNS at the proxy) to the database server, tested against test proxies written in the repo and, in CI, against a real Squid 6 (with and without authentication) and a real SOCKS5 server reaching a real PostgreSQL. NOT against Dante or other products, nor NTLM/Kerberos. It does not cover the SSH hop or the AI calls |
| Per-platform VSIX (DuckDB) | 🟡 | scripts/package-platform.mjs builds one VSIX per platform with DuckDB's native library (37.9 MB on darwin-arm64, budget 60 MB) and scripts/smoke-vsix-duckdb.mjs runs a real query from the package: tested on darwin-arm64 and, in CI, on linux-x64. The release workflow builds all six (the build succeeded on 2026-10-22), but only those two were smoke-tested: the other four are untested |
| Documentation site in English and Spanish | ✅ | Deployed to GitHub Pages from main (https://andercmd.github.io/RizomaDB/); usage guides and generated references in both languages; no complete visual review |
| Guide and tour for new users | 🟡 | Interactive guide inside the extension and a VS Code welcome walkthrough; no testing with real users |
| Artifact signing | 🟡 | The release workflow produces SHA256SUMS, the SBOM and a GitHub build-provenance attestation for each VSIX (actions/attest-build-provenance); there is no signature with its own key. The workflow ran for 1.0.0 and generated the attestation |
| Publishing | 🟡 | GitHub release v1.0.0 created by the release workflow (universal VSIX, one VSIX per platform, checksums, SBOM, build-provenance attestation). The VS Code Marketplace listing (AnderCMD.rizomadb 1.0.0, universal package) was uploaded by hand because automated publishing is not available to the owner, and it passed verification and is live. The per-platform VSIX files (with DuckDB) are only in the GitHub release. Open VSX is not published (account problem) |