open-cmis-tck/docs/SERVICE-AND-RETENTION.md

Service And Retention Integration

Status: draft Created: 2026-05-07

Local Service

open-cmis-tck does not run its own service. It plugs into the guide-board local API as an external extension:

cd ../guide-board
PYTHONPATH=src python3 -m guide_board \
  --extension-dir ../open-cmis-tck \
  serve --host 127.0.0.1 --port 8080

The guide-board service can then:

• list open-cmis-tck from GET /extensions,
• build CMIS run plans with POST /assessments/plan,
• start CMIS runs with POST /runs,
• inspect jobs with GET /runs/{job_id},
• fetch reports with GET /runs/{job_id}/reports.

CLI execution remains the primary and most transparent path. The service is a transport and job-tracking layer over the same runner contracts.

Retention

CMIS runs use the guide-board run directory contract. Each run writes:

• run.json
• retention-summary.json
• plan.json
• normalized/evidence.json
• normalized/findings.json
• normalized/mappings.json
• reports/assessment-package.json
• reports/report.md

Extension-side post-processing can also add:

• reports/cmis-maturity-scorecard.json
• reports/cmis-maturity-scorecard.md
• reports/opencmis-log-review.json
• reports/opencmis-log-review.md

The sample assessment profile keeps summaries for 365 days and raw artifacts for 30 days:

{
  "retention_policy": {
    "summary_days": 365,
    "raw_artifact_days": 30
  }
}

Compact retention-summary.json files are suitable for guide-board trend summaries and downstream CMIS capability scorecards without retaining unbounded raw TCK logs.

Durable Local Archive

For product-facing assessment evidence, do not rely on /tmp as the only copy. Archive completed runs after scorecard and log-review generation:

cd /home/worsch/open-cmis-tck
PYTHONPATH=src python3 scripts/archive_assessment_run.py \
  --run-dir /tmp/open-cmis-tck-live \
  --archive-root .local/runs/archive

The archive command copies the full run directory and writes archive-manifest.json with SHA-256 hashes, file sizes, source path, archive path, run ID, target profile reference, and assessment profile reference.

The default local archive root remains under .local/, so it is not committed. Move selected archive packages into a controlled evidence store when the run is used for release or external audit preparation.