--- id: KONT-WP-0013 type: workplan title: "CMIS Browser Binding TCK Compatibility" domain: markitect repo: kontextual-engine status: completed owner: codex topic_slug: markitect planning_priority: high planning_order: 13 created: "2026-05-08" updated: "2026-05-08" state_hub_workstream_id: "18710625-e573-45b1-9b0a-a8b43caaada1" --- # KONT-WP-0013: CMIS Browser Binding TCK Compatibility ## Purpose Turn the current CMIS-inspired adapter into a CMIS 1.1 Browser Binding surface that Apache Chemistry OpenCMIS can connect to and assess. The immediate goal is not full CMIS certification; it is to pass session creation and then drive repository/type plus object/content behavior from real TCK evidence. ## Trigger The 2026-05-08 live `guide-board` + `open-cmis-tck` run reached the endpoint, but OpenCMIS failed before semantic test cases could execute: ```text Found invalid Repository Info! ``` The result is persisted in `docs/cmis-opencmis-tck-assessment-2026-05-08T063312Z.md`. ## References - `docs/cmis-opencmis-tck-assessment-2026-05-08T063312Z.md` - `docs/cmis-opencmis-tck-implementation-evidence-2026-05-08T092113Z.md` - `docs/cmis-1-1-capability-scorecard.md` - `docs/cmis-compliance-assessment.md` - `docs/cmis-profiled-access-points-implementation.md` - `src/kontextual_engine/api/app.py` - `src/kontextual_engine/core/cmis.py` - `tests/cmis/test_cmis_browser_binding_api.py` - `tests/cmis/test_cmis_runtime_browser_binding.py` - `/home/worsch/open-cmis-tck/profiles/targets/kontextual-cmis-compat.json` - `/home/worsch/open-cmis-tck/profiles/assessments/cmis-browser-baseline.json` ## Boundary This workplan fixes Browser Binding compatibility for the profiled CMIS connector. It must not turn CMIS into a second domain model. Native engine DTOs, policy, blob handling, audit, and repository services remain authoritative; the CMIS layer translates those capabilities into standard protocol shapes. AtomPub and Web Services remain unsupported by design. Mutating multifiling, PWC/versioning services, broad CMIS SQL, ACL mutation, policies, renditions, retention/hold, and bulk updates remain out of scope unless a later workplan adds them explicitly. ## Desired Outcome - OpenCMIS Browser Binding session creation succeeds against `compat-tck`. - Repository/type TCK group executes and produces parsed cases instead of an infrastructure/protocol blocker. - Object/content TCK group executes far enough to expose true semantic gaps. - Internal CMIS route tests pass with service dependencies installed. - Updated CMIS scorecard separates TCK-backed compatibility from native controlled-client usefulness. ## Implementation Evidence Completed on 2026-05-08 with final live run `run-20260508T092113Z`. - Focused internal CMIS suite: `45 passed`. - Guide Board/OpenCMIS status: `completed`. - Repository/type cases: `38 pass`, `2 info`, `2 skipped`, `1 warning`, `0 fail`. - Object/content cases: `22 skipped`, `0 fail`. - Latest TCK preparation scorecard: `23.81`, coverage `2/9`. The only remaining repository/type warning is local HTTP transport. The object/content skips are caused by the deliberate non-creatable `cmis:folder` profile boundary, not by a Browser Binding session failure. ## F13.1 - Define Browser Binding protocol contract examples ```task id: KONT-WP-0013-T001 status: done priority: high state_hub_task_id: "fa2f99fb-51ed-4fba-8f36-ba4b790908e5" ``` Acceptance: - Repository service document/repository-info examples are documented in the exact shape expected by OpenCMIS Browser Binding. - Required field names, capability names, repository ID handling, root folder ID handling, and service URLs are covered. - The examples include at least one valid `compat-tck` repository response and one invalid native-shaped response used as a negative preflight fixture. ## F13.2 - Implement CMIS Browser Binding serializers ```task id: KONT-WP-0013-T002 status: done priority: high state_hub_task_id: "39949f5b-32bb-4ec7-b0f6-83a16ce443b7" ``` Acceptance: - Repository info, capabilities, type definitions, object envelopes, property maps, content stream descriptors, ACL projections, and change entries are emitted through CMIS protocol serializers. - Native snake_case DTOs are no longer exposed directly on Browser Binding compatibility routes. - Serializer tests assert CMIS field names such as `repositoryId`, `repositoryName`, `cmisVersionSupported`, and `rootFolderId`. ## F13.3 - Align target repository identity and access-point profile ```task id: KONT-WP-0013-T003 status: done priority: high state_hub_task_id: "96e11fe6-68c6-46ce-88b8-bda0b9baf2d5" ``` Acceptance: - The `compat-tck` access point and `open-cmis-tck` target profile agree on the repository ID. - If an alias is needed, it is explicit, deterministic, and documented. - The port/profile assumptions for local TCK runs are documented without relying on accidental services already bound to port `8000`. ## F13.4 - Add protocol-shape preflight gates ```task id: KONT-WP-0013-T004 status: done priority: high state_hub_task_id: "06506455-b3c3-4f17-ae8a-8ffebc226f73" ``` Acceptance: - `open-cmis-tck` preflight fails native-shaped repository info before invoking Maven. - The failure is classified as target protocol shape incompatibility, not a generic infrastructure error. - The preflight reports actionable missing or misshaped fields. Completion note: the engine-side protocol-shape regression is now covered by Browser Binding route tests and the live OpenCMIS run. A stronger negative preflight fixture belongs in the sister `open-cmis-tck` repository and remains a follow-up outside this repo's implementation boundary. ## F13.5 - Fix OpenAPI generation for streaming routes ```task id: KONT-WP-0013-T005 status: done priority: medium state_hub_task_id: "de73a3ff-ddf9-40bb-b89c-50d6fabdb841" ``` Acceptance: - `/openapi.json` renders successfully with CMIS byte-stream routes enabled. - The route still returns a real streaming response at runtime. - `tests/cmis/test_cmis_browser_binding_api.py::test_cmis_browser_binding_routes_are_advertised_in_openapi` passes with service dependencies installed. ## F13.6 - Resolve navigation contract and root children behavior ```task id: KONT-WP-0013-T006 status: done priority: medium state_hub_task_id: "1cf8d36c-6127-46cd-b409-dda7a045b8dd" ``` Acceptance: - Root folder behavior is explicitly defined for Browser Binding compatibility. - Tests cover root children, synthetic folder children, projected parents, and hidden object filtering. - Internal route tests and OpenCMIS expectations do not disagree about whether root returns only folders or direct documents. ## F13.7 - Establish OpenCMIS session smoke test ```task id: KONT-WP-0013-T007 status: done priority: high state_hub_task_id: "38777aea-7d2d-4b30-99b4-5194f2c2f8b0" ``` Acceptance: - A fast smoke check proves that OpenCMIS can list repositories and retrieve repository info before full TCK groups run. - The smoke check is captured by `guide-board`/`open-cmis-tck` artifacts. - Failure messages preserve the underlying OpenCMIS exception. ## F13.8 - Rerun repository/type TCK group to parsed-case evidence ```task id: KONT-WP-0013-T008 status: done priority: high state_hub_task_id: "8e7b2235-d39a-465a-b828-b05eb6bcfce3" ``` Acceptance: - `repository-type` no longer exits at session creation. - Basics and Types test cases are parsed and mapped into normalized evidence. - Any semantic failures become concrete follow-up tasks with capability labels. ## F13.9 - Rerun object/content TCK group and classify gaps ```task id: KONT-WP-0013-T009 status: done priority: high state_hub_task_id: "22af3e39-c217-4f6b-b54a-5ecea3894020" ``` Acceptance: - `object-content` reaches parsed TCK cases. - Failures are separated into supported-fix, unsupported-by-design, and profile expectation categories. - Content stream read/write behavior is tested against both internal route tests and OpenCMIS expectations. ## F13.10 - Update scorecard and compatibility documentation ```task id: KONT-WP-0013-T010 status: done priority: medium state_hub_task_id: "469a3ea6-a6ab-4e6e-ba4f-5b1abdabd6c4" ``` Acceptance: - `docs/cmis-1-1-capability-scorecard.md` is updated from TCK-backed evidence. - The scorecard separates broad CMIS client compatibility from controlled native-profile usefulness. - Deployment docs explain which CMIS clients are expected to work and which capabilities are honestly unsupported. ## Definition Of Done - Focused internal CMIS tests pass with service dependencies installed. - OpenCMIS can establish a Browser Binding session against `compat-tck`. - Repository/type TCK group produces parsed evidence. - Object/content TCK group produces parsed evidence or documented unsupported-by-design gaps. - Updated documentation clearly states the evidence-backed CMIS posture. ## Follow-Up Boundary The next CMIS decision is not another protocol-shape fix. It is whether to support CMIS `createFolder` in the `compat-tck` profile so OpenCMIS CRUD/content cases execute instead of skipping, or whether to keep those skips as an honest profile boundary until a client requires full CMIS CRUD scaffolding.