# CMIS Compliance Test Foundation

Date: 2026-05-06

Status: active fixture foundation with conservative capability-flag tests.

## Purpose

Set up CMIS examples and compliance tests before implementation so the engine
can compare required CMIS behavior with current capabilities and planned
profiles.

## External Harness

Use Apache Chemistry OpenCMIS TCK 1.1.0 as an optional external conformance
harness.

Planned harness shape:

- `examples/cmis/` contains deterministic fixture descriptions grouped by CMIS
  service capability.
- `tests/cmis/test_cmis_contract_examples.py` validates fixture and profile
  behavior without external Java dependencies.
- `tests/cmis/opencmis-tck/` contains optional harness config, Maven
  invocation notes, and selected TCK group mapping.
- Default `pytest` skips external OpenCMIS TCK unless explicitly enabled.

## Example Groups

### Repository And Type Service

Fixtures:

- one repository profile with CMIS 1.1 Browser Binding,
- one read-only profile,
- one authoring profile,
- base types for document, folder, relationship, policy, item, and secondary.

Validates:

- repository info,
- capability flags,
- type definitions,
- property definitions,
- unsupported capability flags are explicit.

### Navigation Service

Fixtures:

- synthetic root folder,
- folder projection by collection/topic/source system,
- documents filed under one folder,
- unfiled asset projection when profile allows it.

Validates:

- root folder children,
- folder path lookup,
- getChildren,
- projection-only parent folders,
- explicit unsupported flags for getDescendants and getFolderTree,
- profile restrictions on folder visibility.

### Object And Content Stream Service

Fixtures:

- source document with content stream,
- normalized representation,
- derived representation,
- metadata-rich document,
- document with no stream.

Validates:

- getObject/getObjectByPath,
- getProperties,
- getContentStream,
- create/update/delete behavior by profile,
- content stream hash and media type mapping.

### Versioning Service

Fixtures:

- single-version document,
- multi-version document,
- derived output linked to source version,
- attempted checkout in read-only profile.

Validates:

- version series projection,
- latest version flags,
- checkout/checkin/PWC unsupported diagnostics,
- all-versions search unsupported flags.

### Discovery Query Service

Fixtures:

- lexical query examples,
- metadata filter examples,
- relationship-scoped query examples,
- unsupported CMIS SQL features.

Validates:

- query capability flags,
- supported subset behavior,
- paging,
- error diagnostics for unsupported grammar, joins, and ordering.

### Relationship Service

Fixtures:

- asset-to-asset relationship,
- asset-to-context-entity projection,
- derived lineage relation.

Validates:

- relationship object projection,
- source/target filters,
- profile-level relationship visibility.

### ACL And Policy Services

Fixtures:

- public asset,
- internal asset,
- confidential asset,
- denied actor,
- service-account actor.

Validates:

- allowable actions,
- ACL projection,
- applyACL/applyPolicy unsupported diagnostics,
- no protected metadata leakage on denial.

### Change Log Events

Fixtures:

- asset create,
- metadata update,
- content update,
- transformation output,
- workflow run,
- policy denial.

Validates:

- change tokens,
- change event ordering,
- correlation with audit records,
- paging.

### Retention Hold Renditions And Bulk Operations

Fixtures:

- retention metadata,
- legal hold metadata,
- preview/thumbnail representation,
- bulk metadata update request.

Validates:

- explicit capability flags,
- unsupported capability diagnostics,
- structured unsupported-operation diagnostics.

## Capability Profile Test Matrix

| Profile | Expected external TCK posture |
| --- | --- |
| `readonly-browser` | Pass repository/type/read/navigation/query/content-read groups where supported; skip mutation groups. |
| `governed-authoring` | Add selected create/update/delete/content stream checks with engine policy and audit. |
| `admin-export` | Not intended as general CMIS client profile; focus internal contract tests. |
| `compat-tck` | Tuned profile for OpenCMIS TCK subset and compatibility client smoke tests. |

## Certification Note

No current OASIS certification service was identified during planning. The
practical reusable foundation is OpenCMIS TCK/Workbench, plus our own
capability-profile contract tests.

## Established Artifacts

- `examples/cmis/capability-fixtures.json`
- `tests/cmis/test_cmis_contract_examples.py`
- `tests/cmis/opencmis-tck/README.md`
- `docs/cmis-readiness-gate.md`