Crossexamination of utility based on the content management interoperability standard

docs/cmis-compliance-test-foundation.md

@@ -0,0 +1,190 @@
+# CMIS Compliance Test Foundation
+
+Date: 2026-05-06
+
+Status: planned test foundation for CMIS access-point work.
+
+## Purpose
+
+Set up CMIS examples and compliance tests before implementation so the engine
+can compare required CMIS behavior with current capabilities and planned
+profiles.
+
+## External Harness
+
+Use Apache Chemistry OpenCMIS TCK 1.1.0 as an optional external conformance
+harness.
+
+Planned harness shape:
+
+- `tests/cmis/examples/` contains deterministic fixture descriptions grouped by
+  CMIS service capability.
+- `tests/cmis/test_cmis_contract_examples.py` validates mapper and profile
+  behavior without external Java dependencies.
+- `tests/cmis/opencmis-tck/` contains optional harness config, Maven
+  invocation notes, and selected TCK group mapping.
+- Default `pytest` skips external OpenCMIS TCK unless explicitly enabled.
+
+## Example Groups
+
+### Repository And Type Service
+
+Fixtures:
+
+- one repository profile with CMIS 1.1 Browser Binding,
+- one read-only profile,
+- one authoring profile,
+- base types for document, folder, relationship, policy, item, and secondary.
+
+Validates:
+
+- repository info,
+- capability flags,
+- type definitions,
+- property definitions,
+- unsupported capability flags are explicit.
+
+### Navigation Service
+
+Fixtures:
+
+- synthetic root folder,
+- folder projection by collection/topic/source system,
+- documents filed under one folder,
+- unfiled asset projection when profile allows it.
+
+Validates:
+
+- root folder children,
+- folder path lookup,
+- getChildren/getDescendants/getFolderTree,
+- profile restrictions on folder visibility.
+
+### Object And Content Stream Service
+
+Fixtures:
+
+- source document with content stream,
+- normalized representation,
+- derived representation,
+- metadata-rich document,
+- document with no stream.
+
+Validates:
+
+- getObject/getObjectByPath,
+- getProperties,
+- getContentStream,
+- create/update/delete behavior by profile,
+- content stream hash and media type mapping.
+
+### Versioning Service
+
+Fixtures:
+
+- single-version document,
+- multi-version document,
+- derived output linked to source version,
+- attempted checkout in read-only profile.
+
+Validates:
+
+- version series projection,
+- latest version flags,
+- checkout/checkin unsupported or supported per profile,
+- version history listing.
+
+### Discovery Query Service
+
+Fixtures:
+
+- lexical query examples,
+- metadata filter examples,
+- relationship-scoped query examples,
+- unsupported CMIS SQL features.
+
+Validates:
+
+- query capability flags,
+- supported subset behavior,
+- paging,
+- error diagnostics for unsupported grammar.
+
+### Relationship Service
+
+Fixtures:
+
+- asset-to-asset relationship,
+- asset-to-context-entity projection,
+- derived lineage relation.
+
+Validates:
+
+- relationship object projection,
+- source/target filters,
+- profile-level relationship visibility.
+
+### ACL And Policy Services
+
+Fixtures:
+
+- public asset,
+- internal asset,
+- confidential asset,
+- denied actor,
+- service-account actor.
+
+Validates:
+
+- allowable actions,
+- ACL projection,
+- applyACL/applyPolicy supported or unsupported by profile,
+- no protected metadata leakage on denial.
+
+### Change Log Events
+
+Fixtures:
+
+- asset create,
+- metadata update,
+- content update,
+- transformation output,
+- workflow run,
+- policy denial.
+
+Validates:
+
+- change tokens,
+- change event ordering,
+- correlation with audit records,
+- paging.
+
+### Retention Hold Renditions And Bulk Operations
+
+Fixtures:
+
+- retention metadata,
+- legal hold metadata,
+- preview/thumbnail representation,
+- bulk metadata update request.
+
+Validates:
+
+- explicit capability flags,
+- supported subset behavior,
+- structured unsupported-operation diagnostics.
+
+## Capability Profile Test Matrix
+
+| Profile | Expected external TCK posture |
+| --- | --- |
+| `readonly-browser` | Pass repository/type/read/navigation/query/content-read groups where supported; skip mutation groups. |
+| `governed-authoring` | Add selected create/update/delete/content stream checks with engine policy and audit. |
+| `admin-export` | Not intended as general CMIS client profile; focus internal contract tests. |
+| `compat-tck` | Tuned profile for OpenCMIS TCK subset and compatibility client smoke tests. |
+
+## Certification Note
+
+No current OASIS certification service was identified during planning. The
+practical reusable foundation is OpenCMIS TCK/Workbench, plus our own
+capability-profile contract tests.