# Service And Retention Integration

Status: draft
Created: 2026-05-07

## Local Service

`open-cmis-tck` does not run its own service. It plugs into the guide-board
local API as an external extension:

```sh
cd ../guide-board
PYTHONPATH=src python3 -m guide_board \
  --extension-dir ../open-cmis-tck \
  serve --host 127.0.0.1 --port 8080
```

The guide-board service can then:

- list `open-cmis-tck` from `GET /extensions`,
- build CMIS run plans with `POST /assessments/plan`,
- start CMIS runs with `POST /runs`,
- inspect jobs with `GET /runs/{job_id}`,
- fetch reports with `GET /runs/{job_id}/reports`.

CLI execution remains the primary and most transparent path. The service is a
transport and job-tracking layer over the same runner contracts.

## Retention

CMIS runs use the guide-board run directory contract. Each run writes:

- `run.json`
- `retention-summary.json`
- `plan.json`
- `normalized/evidence.json`
- `normalized/findings.json`
- `normalized/mappings.json`
- `reports/assessment-package.json`
- `reports/report.md`

Extension-side post-processing can also add:

- `reports/cmis-maturity-scorecard.json`
- `reports/cmis-maturity-scorecard.md`
- `reports/opencmis-log-review.json`
- `reports/opencmis-log-review.md`

The sample assessment profile keeps summaries for 365 days and raw artifacts for
30 days:

```json
{
  "retention_policy": {
    "summary_days": 365,
    "raw_artifact_days": 30
  }
}
```

Compact `retention-summary.json` files are suitable for guide-board trend
summaries and downstream CMIS capability scorecards without retaining unbounded
raw TCK logs.

## Durable Local Archive

For product-facing assessment evidence, do not rely on `/tmp` as the only copy.
Archive completed runs after scorecard and log-review generation:

```sh
cd /home/worsch/open-cmis-tck
PYTHONPATH=src python3 scripts/archive_assessment_run.py \
  --run-dir /tmp/open-cmis-tck-live \
  --archive-root .local/runs/archive
```

The archive command copies the full run directory and writes
`archive-manifest.json` with SHA-256 hashes, file sizes, source path, archive
path, run ID, target profile reference, and assessment profile reference.

The default local archive root remains under `.local/`, so it is not committed.
Move selected archive packages into a controlled evidence store when the run is
used for release or external audit preparation.