# CMIS 1.1 Capability Scorecard Date: 2026-05-14 Evidence update: the 2026-05-14 post-WP-0016 release-readiness pass completed the selected Browser Binding `repository-type` and `object-content` baseline. The latest run, `run-20260514T003705Z`, reports `0` unexpected findings. The `object-content` group passes without warnings; the only remaining OpenCMIS warning is the local harness using HTTP rather than HTTPS. See `docs/cmis-opencmis-tck-release-readiness-evidence-2026-05-14T003705Z.md`. The score below remains a product-depth estimate against mature CMIS products. The selected OpenCMIS baseline is now stable preparation evidence for repository/type and object/content services, not a full CMIS certification. Read-side contract update: `KONT-WP-0016` adds a documented bounded query subset, common CMIS `ORDER BY`, target/either relationship filters, enriched relationship and ACL projections, and explicit `notSupported` diagnostics for unsupported navigation selectors. The release-readiness rerun also confirms that child navigation is ordered deterministically by `cmis:name` when `capabilityOrderBy=common` is advertised. Status: baseline scorecard for the current Browser Binding subset. ## Purpose Estimate how deep the current `kontextual-engine` CMIS 1.1 surface is when compared with a mature, market-grade content services implementation. This scorecard is not a certification claim and not a judgment of the engine's native architecture. It measures only CMIS compatibility depth: how much a generic CMIS client can expect to use without knowing Kontextual-specific semantics. ## Benchmark Primary CMIS-depth benchmark: **Hyland Alfresco Content Services**. Rationale: - Hyland/Alfresco documentation states that Alfresco Content Services fully implements CMIS 1.0 and CMIS 1.1. - The same documentation describes CMIS Browser, AtomPub, and Web Services bindings as supported CMIS client entry points. - Hyland is a recognized content services/document management vendor; Gartner's 2024 Document Management Magic Quadrant vendor list includes Hyland, Laserfiche, M-Files, Microsoft, OpenText, and others. Secondary market comparators for product context: OpenText, Hyland OnBase, M-Files, and Laserfiche. These are useful commercial reference points, but Hyland Alfresco is the cleanest CMIS-specific benchmark because its public docs make a direct full-CMIS implementation claim. Sources: - OASIS CMIS 1.1 specification: - Hyland Alfresco Content Services 25.1 CMIS API docs: - Gartner 2024 Document Management Magic Quadrant vendor list: ## Scoring Rubric | Score band | Meaning | | --- | --- | | 0-10% | Absent or intentionally unsupported. | | 15-30% | Projection, metadata, or diagnostics exist, but CMIS clients cannot rely on the full service. | | 35-55% | Useful constrained subset with explicit unsupported flags. | | 60-75% | Production-usable subset for controlled clients, still missing notable optional or advanced behavior. | | 80-95% | Mature implementation with broad client compatibility but not necessarily certified. | | 100% | Benchmark-grade full CMIS 1.1 behavior for the capability area. | Overall score uses weighted capability areas. The weights estimate practical CMIS interoperability importance rather than engine-internal importance. ## Overall Estimate | Metric | Score | | --- | ---: | | OpenCMIS selected-baseline infrastructure score | 99.1% | | Weighted CMIS 1.1 depth vs Hyland Alfresco benchmark | 63% | | Controlled-client Browser Binding usefulness | 84% | | Broad commodity CMIS client compatibility | 57% | Interpretation: the OpenCMIS infrastructure score measures the selected `repository-type` and `object-content` harness baseline only. The current CMIS layer is a credible Browser Binding subset for known clients and profile-specific integrations, especially around repository, type, object, folder, content, move/copy, and controlled mutation workflows. It is not yet a broad ECM/CMIS replacement surface. ## Capability Scorecard | CMIS capability area | Weight | Current depth | Most worthy contender | Gap basis behind the percentage | | --- | ---: | ---: | --- | --- | | Repository service and repository info | 5 | 86% | Hyland Alfresco ACS | - Repository info and conservative capability flags exist.
- Unsupported feature catalog exists.
- OpenCMIS `repository-type` completes with only the local HTTP warning. | | Type definitions | 6 | 55% | Hyland Alfresco ACS | - Base types, Browser Binding type definitions, secondary type projection, and nullable content stream properties exist.
- No mutable types or custom schema/type management.
- Property definition depth remains intentionally narrow. | | Navigation service | 8 | 62% | Hyland Alfresco ACS | - Root and folder-scoped children, path lookup, folder parent lookup, parent path segments, move, and delete-tree work in the selected baseline.
- Projection-only parents exist.
- Missing `getDescendants`, `getFolderTree`, and real filing mutations. | | Object read service | 10 | 84% | Hyland Alfresco ACS | - Object envelopes, properties, content descriptors, ACL projection, relationships, allowable actions, property filters, and path-addressed Browser Binding reads exist.
- Deleted/hidden objects are correctly not exposed.
- OpenCMIS object/content read-side baseline now completes with warnings only. | | Object write service | 8 | 72% | Hyland Alfresco ACS | - `createDocument`, `createFolder`, scoped `moveObject`, folder rename, selected standard property updates, custom metadata updates, content stream set/append/delete, `bulkUpdateProperties`, and `createDocumentFromSource` exist.
- No broad filing mutation, raw physical delete, checkout/checkin, or policy/item creation.
- Delete remains intentionally governed, not raw repository removal. | | Content stream read/write | 8 | 86% | Hyland Alfresco ACS | - Byte streaming, explicit content headers, multipart Browser Binding create, deduplicating `setContentStream`, whole-object `appendContentStream`, no-content compatibility streams, content tombstones, partial body slicing, and offset-zero full-stream classification exist.
- Digest verification and governed access exist.
- Chunk-level blob composition remains a later optimization for very large append workloads. | | Versioning service | 8 | 25% | Hyland Alfresco ACS | - Version properties can be projected from engine versions.
- No checkout/checkin/cancelCheckout/PWC services.
- No version history route or all-versions query behavior. | | Discovery/query | 8 | 42% | Hyland Alfresco ACS | - Bounded `SELECT *` document queries support equality, `LIKE`, `IN`, `AND`, paging, and common CMIS property ordering.
- Capability flags now advertise `capabilityOrderBy=common` rather than overclaiming custom ordering.
- Missing joins, full text, nested predicates, arbitrary projections, and broad CMIS SQL coverage. | | Relationships | 5 | 70% | Hyland Alfresco ACS | - Relationship object projection, source filters, target filters, either-direction filters, confidence, direction, provenance, and visibility gates exist.
- Protected relationship leakage is covered by profile gates.
- Missing relationship creation through CMIS and deeper relationship type hierarchy maturity. | | ACL service | 6 | 48% | Hyland Alfresco ACS | - Discover-only ACL projection has stable principal ids, principal kinds, permission mapping, direct/inherited markers, and policy authority metadata.
- `applyACL` is blocked as not implemented.
- Missing propagation, ACL mutation, and repository-wide principal/group enumeration. | | Policy service | 3 | 10% | Hyland Alfresco ACS | - Native policy decisions govern exposure.
- No CMIS policy objects, `applyPolicy`, `removePolicy`, or `getAppliedPolicies` service surface.
- Explicitly unsupported. | | Change log | 5 | 60% | Hyland Alfresco ACS | - Audit-backed object-id change entries and paging exist.
- CMIS change-token conflicts are now enforced for property/content mutations.
- Missing richer change event typing and broader token semantics across optional services. | | Multi-filing and unfiling | 4 | 25% | Hyland Alfresco ACS | - Projection-only parent maps exist and are useful for navigation.
- Standard CMIS `capabilityMultifiling` is correctly false.
- No add/remove filing mutations or canonical folder membership model. | | Renditions | 3 | 15% | Hyland Alfresco ACS | - Native representations could become rendition candidates later.
- CMIS rendition capability is currently `none`.
- No rendition taxonomy or rendition stream routes. | | Retention and hold | 2 | 5% | OpenText / Hyland governance stacks | - Native governance metadata can represent intent later.
- No CMIS retention/hold model or mutation services.
- Explicitly unsupported. | | Bulk update | 2 | 65% | Hyland Alfresco ACS | - `bulkUpdateProperties` works for the `compat-tck` profile by batching existing property updates with change-token handling.
- It is intentionally narrow and not enabled on the normal governed-authoring profile yet.
- No advanced partial-success envelope beyond the Browser Binding response list. | | Browser Binding protocol fidelity | 7 | 80% | Hyland Alfresco ACS | - Browser-style routes, JSON envelopes, CMIS exception names, action aliases, multipart forms, path-addressed root routes, property filters, path segments, and range responses exist.
- Selected OpenCMIS Browser Binding repository/type and object/content baseline completes with only the local HTTP warning.
- Optional services and broader CMIS SQL/versioning protocol surfaces remain incomplete. | | AtomPub binding | 2 | 0% | Hyland Alfresco ACS | - No AtomPub/XML service document or feeds.
- Intentionally deferred until monetized need. | | Web Services binding | 2 | 0% | Hyland Alfresco ACS | - No SOAP/WSDL stack.
- Intentionally deferred until monetized need. | | External conformance evidence | 3 | 86% | OpenCMIS TCK against Alfresco-like server behavior | - OpenCMIS Browser Binding session creation succeeds against `compat-tck`.
- Selected `repository-type` and `object-content` baselines complete with one local transport warning and no object/content warnings.
- Evidence still covers a selected baseline, not the full OpenCMIS TCK surface. | Weighted result from this table: **63%**. ## Most Important Gaps 1. **External conformance expansion** - Keep the selected OpenCMIS TCK baseline running against `compat-tck`. - Treat the remaining local HTTP warning as a harness/deployment topology issue, not an adapter behavior failure. - Expand selected groups after the supported baseline remains stable. 2. **Browser Binding fidelity** - Align route/action/selector shapes more closely with CMIS Browser Binding. - Add non-skipped FastAPI route tests in CI with service extras installed. - Add client smoke tests with Apache Chemistry/OpenCMIS where feasible. - Continue returning CMIS-specific exception classes/statuses as more optional services are added. 3. **Query depth** - Expand only where it stays natural: additional indexed metadata fields, richer comparator support, and selected client-requested predicates. - Keep joins, full text, and arbitrary CMIS SQL unsupported unless a real integration need appears. 4. **Navigation depth** - Decide whether `getDescendants` and `getFolderTree` are worth implementing over projection-only folders. - Keep mutating filing unsupported unless a client explicitly needs it. 5. **Versioning depth** - Keep PWC/checkin/checkout unsupported for now. - Add version-history read support if document-management integrations begin depending on it. 6. **Renditions** - Map selected derived representations to CMIS renditions only after we have stable representation taxonomy and real preview/thumbnail use cases. 7. **Release transport and operational posture** - Terminate CMIS access over HTTPS in deployable environments. - Keep the local HTTP warning accepted only for loopback TCK runs. - Revisit blob composition if large append workloads become a real usage pattern. ## Product Positioning Takeaway Against a mature CMIS implementation such as Hyland Alfresco ACS, Kontextual is not trying to win by being a full ECM clone. Its current strength is a governed, profiled, source-grounded knowledge runtime with enough CMIS Browser Binding surface for controlled interoperability. The right strategic posture is therefore: - advertise a conservative CMIS 1.1 Browser Binding subset, - keep unsupported capability flags honest, - use the scorecard to decide which gaps are worth closing for real clients, - avoid AtomPub/Web Services and full ECM semantics unless revenue or a named integration justifies the complexity.