query parsing and diagnostics

workplans/KONT-WP-0016-cmis-read-side-contract-maturity.md

@@ -4,7 +4,7 @@ type: workplan
 title: "CMIS Read-Side Contract Maturity"
 domain: markitect
 repo: kontextual-engine
-status: active
+status: completed
 owner: codex
 topic_slug: markitect
 planning_priority: high
@@ -100,7 +100,7 @@ remain intentionally unsupported.
 
 ```task
 id: KONT-WP-0016-T001
-status: todo
+status: done
 priority: high
 state_hub_task_id: "961bb720-0825-44d9-bb30-b6aed0f3f2cc"
 ```
@@ -117,7 +117,7 @@ Acceptance:
 
 ```task
 id: KONT-WP-0016-T002
-status: todo
+status: done
 priority: high
 state_hub_task_id: "f393271e-4e0a-4a60-8570-2f2bc1d84c0f"
 ```
@@ -138,7 +138,7 @@ Acceptance:
 
 ```task
 id: KONT-WP-0016-T003
-status: todo
+status: done
 priority: high
 state_hub_task_id: "468221a0-111c-4a68-b0b2-392f83e5a70b"
 ```
@@ -158,7 +158,7 @@ Acceptance:
 
 ```task
 id: KONT-WP-0016-T004
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "86d117a8-f569-4708-8687-5a53e6210813"
 ```
@@ -178,7 +178,7 @@ Acceptance:
 
 ```task
 id: KONT-WP-0016-T005
-status: todo
+status: done
 priority: high
 state_hub_task_id: "6214aac1-4b3a-41f8-9e61-ab6844171dd1"
 ```
@@ -197,7 +197,7 @@ Acceptance:
 
 ```task
 id: KONT-WP-0016-T006
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1f492036-0ba0-4a85-addb-b73397e9e966"
 ```
@@ -215,7 +215,7 @@ Acceptance:
 
 ```task
 id: KONT-WP-0016-T007
-status: todo
+status: done
 priority: high
 state_hub_task_id: "73d9b377-1f03-4e12-8028-af43496457b6"
 ```
@@ -231,6 +231,64 @@ Acceptance:
 - Update the CMIS scorecard and first-release readiness notes from the final
   evidence.
 
+## Implementation Evidence
+
+Implemented on 2026-05-14:
+
+- Added `docs/cmis-read-side-contract.md` as the release-stable read-side
+  contract.
+- Replaced the query allowlist with a bounded parser for `SELECT *` document
+  queries, `AND` predicates, equality, `LIKE`, `IN`, deterministic paging, and
+  common CMIS `ORDER BY`.
+- Kept `descendants` and `folderTree` explicitly unsupported with CMIS
+  `notSupported` diagnostics and false capability flags.
+- Added relationship target and either-direction filters, relationship change
+  tokens, provenance, direction, actor, and creation metadata.
+- Enriched ACL discovery with principal kind, direct/inherited markers,
+  source, permission mapping, and policy authority metadata.
+- Updated examples, the OpenCMIS subset map, scorecard, compliance assessment,
+  and release readiness notes.
+- Added opt-in capacity coverage in
+  `tests/cmis/test_cmis_read_side_capacity.py`.
+
+Focused verification:
+
+```text
+python3 -m pytest \
+  tests/cmis/test_cmis_runtime_browser_binding.py \
+  tests/cmis/test_cmis_browser_binding_api.py \
+  tests/cmis/test_cmis_compliance_flags.py \
+  tests/cmis/test_cmis_contract_examples.py
+
+Result: 21 passed, 16 skipped in 5.19s
+```
+
+The skipped tests require optional FastAPI/HTTPX test extras in this local
+environment. They remain part of the release verification gate when the service
+extras are installed. No new OpenCMIS run was required for the selected
+object/content baseline because this workplan changes read-side query,
+relationship, ACL, and diagnostics contracts outside that selected baseline.
+
+Browser Binding API verification with service extras:
+
+```text
+.venv/bin/python -m pytest tests/cmis/test_cmis_browser_binding_api.py -q
+
+Result: 16 passed in 39.09s
+```
+
+Full suite verification with service extras:
+
+```text
+.venv/bin/python -m pytest -q
+
+Result: 166 passed, 15 skipped in 55.94s
+```
+
+The run emitted advisory performance-drift warnings for several API tests. They
+do not indicate functional failures and should be watched through the existing
+compact performance-history monitor.
+
 ## Release Advice
 
 This workplan should run before `KONT-WP-0015` unless the first release is