kontextual-engine/docs/cmis-1-1-capability-scorecard.md

# CMIS 1.1 Capability Scorecard

Date: 2026-05-13

Evidence update: the 2026-05-13 WP-0014 OpenCMIS pass completed the selected
Browser Binding `repository-type` and `object-content` baseline. The latest
run, `run-20260513T210255Z`, reports `0` unexpected findings:
`repository-type` is warning-only because the local harness uses HTTP, and
`object-content` is warning-only because `appendContentStream()` is not
supported. See
`docs/cmis-opencmis-tck-wp0014-evidence-2026-05-13T210255Z.md`.

The score below remains a product-depth estimate against mature CMIS products.
The selected OpenCMIS baseline is now stable preparation evidence for
repository/type and object/content services, not a full CMIS certification.

Status: baseline scorecard for the current Browser Binding subset.

## Purpose

Estimate how deep the current `kontextual-engine` CMIS 1.1 surface is when
compared with a mature, market-grade content services implementation.

This scorecard is not a certification claim and not a judgment of the engine's
native architecture. It measures only CMIS compatibility depth: how much a
generic CMIS client can expect to use without knowing Kontextual-specific
semantics.

## Benchmark

Primary CMIS-depth benchmark: **Hyland Alfresco Content Services**.

Rationale:

- Hyland/Alfresco documentation states that Alfresco Content Services fully
  implements CMIS 1.0 and CMIS 1.1.
- The same documentation describes CMIS Browser, AtomPub, and Web Services
  bindings as supported CMIS client entry points.
- Hyland is a recognized content services/document management vendor; Gartner's
  2024 Document Management Magic Quadrant vendor list includes Hyland,
  Laserfiche, M-Files, Microsoft, OpenText, and others.

Secondary market comparators for product context: OpenText, Hyland OnBase,
M-Files, and Laserfiche. These are useful commercial reference points, but
Hyland Alfresco is the cleanest CMIS-specific benchmark because its public docs
make a direct full-CMIS implementation claim.

Sources:

- OASIS CMIS 1.1 specification:
  <https://docs.oasis-open.org/cmis/CMIS/v1.1/os/CMIS-v1.1-os.html>
- Hyland Alfresco Content Services 25.1 CMIS API docs:
  <https://support.hyland.com/r/Alfresco/Alfresco-Content-Services/25.1/Alfresco-Content-Services/Develop/Reference/CMIS-API>
- Gartner 2024 Document Management Magic Quadrant vendor list:
  <https://www.gartner.com/en/documents/6030235>

## Scoring Rubric

| Score band | Meaning |
| --- | --- |
| 0-10% | Absent or intentionally unsupported. |
| 15-30% | Projection, metadata, or diagnostics exist, but CMIS clients cannot rely on the full service. |
| 35-55% | Useful constrained subset with explicit unsupported flags. |
| 60-75% | Production-usable subset for controlled clients, still missing notable optional or advanced behavior. |
| 80-95% | Mature implementation with broad client compatibility but not necessarily certified. |
| 100% | Benchmark-grade full CMIS 1.1 behavior for the capability area. |

Overall score uses weighted capability areas. The weights estimate practical
CMIS interoperability importance rather than engine-internal importance.

## Overall Estimate

| Metric | Score |
| --- | ---: |
| OpenCMIS selected-baseline infrastructure score | 98.3% |
| Weighted CMIS 1.1 depth vs Hyland Alfresco benchmark | 59% |
| Controlled-client Browser Binding usefulness | 80% |
| Broad commodity CMIS client compatibility | 54% |

Interpretation: the OpenCMIS infrastructure score measures the selected
`repository-type` and `object-content` harness baseline only. The current CMIS
layer is a credible Browser Binding subset for known clients and
profile-specific integrations, especially around repository, type, object,
folder, content, move/copy, and controlled mutation workflows. It is not yet a
broad ECM/CMIS replacement surface.

## Capability Scorecard

| CMIS capability area | Weight | Current depth | Most worthy contender | Gap basis behind the percentage |
| --- | ---: | ---: | --- | --- |
| Repository service and repository info | 5 | 86% | Hyland Alfresco ACS | - Repository info and conservative capability flags exist.<br>- Unsupported feature catalog exists.<br>- OpenCMIS `repository-type` completes with only the local HTTP warning. |
| Type definitions | 6 | 55% | Hyland Alfresco ACS | - Base types, Browser Binding type definitions, secondary type projection, and nullable content stream properties exist.<br>- No mutable types or custom schema/type management.<br>- Property definition depth remains intentionally narrow. |
| Navigation service | 8 | 62% | Hyland Alfresco ACS | - Root and folder-scoped children, path lookup, folder parent lookup, parent path segments, move, and delete-tree work in the selected baseline.<br>- Projection-only parents exist.<br>- Missing `getDescendants`, `getFolderTree`, and real filing mutations. |
| Object read service | 10 | 84% | Hyland Alfresco ACS | - Object envelopes, properties, content descriptors, ACL projection, relationships, allowable actions, property filters, and path-addressed Browser Binding reads exist.<br>- Deleted/hidden objects are correctly not exposed.<br>- OpenCMIS object/content read-side baseline now completes with warnings only. |
| Object write service | 8 | 70% | Hyland Alfresco ACS | - `createDocument`, `createFolder`, scoped `moveObject`, folder rename, selected standard property updates, custom metadata updates, content stream set/delete, `bulkUpdateProperties`, and `createDocumentFromSource` exist.<br>- No broad filing mutation, raw physical delete, checkout/checkin, or policy/item creation.<br>- Delete remains intentionally governed, not raw repository removal. |
| Content stream read/write | 8 | 82% | Hyland Alfresco ACS | - Byte streaming, explicit content headers, multipart Browser Binding create, deduplicating `setContentStream`, no-content compatibility streams, content tombstones, partial body slicing, and offset-zero full-stream classification exist.<br>- Digest verification and governed access exist.<br>- Remaining warning is unsupported append semantics. |
| Versioning service | 8 | 25% | Hyland Alfresco ACS | - Version properties can be projected from engine versions.<br>- No checkout/checkin/cancelCheckout/PWC services.<br>- No version history route or all-versions query behavior. |
| Discovery/query | 8 | 25% | Hyland Alfresco ACS | - Narrow document select subset exists.<br>- Unsupported joins/order-by return diagnostics.<br>- Missing CMIS SQL predicates, type joins, full-text, ordering, and rich projection rules. |
| Relationships | 5 | 60% | Hyland Alfresco ACS | - Relationship object projection and source filtering exist.<br>- Visibility gates prevent protected relationship leakage.<br>- Missing full relationship service filters, relationship creation through CMIS, and type hierarchy maturity. |
| ACL service | 6 | 35% | Hyland Alfresco ACS | - Discover-only ACL projection exists.<br>- `applyACL` is blocked as not implemented.<br>- Missing inherited/direct ACL fidelity, propagation, ACL mutation, and repository principal model. |
| Policy service | 3 | 10% | Hyland Alfresco ACS | - Native policy decisions govern exposure.<br>- No CMIS policy objects, `applyPolicy`, `removePolicy`, or `getAppliedPolicies` service surface.<br>- Explicitly unsupported. |
| Change log | 5 | 60% | Hyland Alfresco ACS | - Audit-backed object-id change entries and paging exist.<br>- CMIS change-token conflicts are now enforced for property/content mutations.<br>- Missing richer change event typing and broader token semantics across optional services. |
| Multi-filing and unfiling | 4 | 25% | Hyland Alfresco ACS | - Projection-only parent maps exist and are useful for navigation.<br>- Standard CMIS `capabilityMultifiling` is correctly false.<br>- No add/remove filing mutations or canonical folder membership model. |
| Renditions | 3 | 15% | Hyland Alfresco ACS | - Native representations could become rendition candidates later.<br>- CMIS rendition capability is currently `none`.<br>- No rendition taxonomy or rendition stream routes. |
| Retention and hold | 2 | 5% | OpenText / Hyland governance stacks | - Native governance metadata can represent intent later.<br>- No CMIS retention/hold model or mutation services.<br>- Explicitly unsupported. |
| Bulk update | 2 | 65% | Hyland Alfresco ACS | - `bulkUpdateProperties` works for the `compat-tck` profile by batching existing property updates with change-token handling.<br>- It is intentionally narrow and not enabled on the normal governed-authoring profile yet.<br>- No advanced partial-success envelope beyond the Browser Binding response list. |
| Browser Binding protocol fidelity | 7 | 78% | Hyland Alfresco ACS | - Browser-style routes, JSON envelopes, CMIS exception names, action aliases, multipart forms, path-addressed root routes, property filters, path segments, and range responses exist.<br>- Selected OpenCMIS Browser Binding repository/type and object/content baseline completes with warnings only.<br>- Optional services and broader CMIS SQL/versioning protocol surfaces remain incomplete. |
| AtomPub binding | 2 | 0% | Hyland Alfresco ACS | - No AtomPub/XML service document or feeds.<br>- Intentionally deferred until monetized need. |
| Web Services binding | 2 | 0% | Hyland Alfresco ACS | - No SOAP/WSDL stack.<br>- Intentionally deferred until monetized need. |
| External conformance evidence | 3 | 82% | OpenCMIS TCK against Alfresco-like server behavior | - OpenCMIS Browser Binding session creation succeeds against `compat-tck`.<br>- Selected `repository-type` and `object-content` baselines complete with warnings only.<br>- Evidence still covers a selected baseline, not the full OpenCMIS TCK surface. |

Weighted result from this table: **59%**.

## Most Important Gaps

1. **External conformance expansion**
   - Keep the selected OpenCMIS TCK baseline running against `compat-tck`.
   - Treat the current repository/type and object/content warnings as known:
     local HTTP and unsupported append.
   - Expand selected groups after the supported baseline remains stable.

2. **Browser Binding fidelity**
   - Align route/action/selector shapes more closely with CMIS Browser Binding.
   - Add non-skipped FastAPI route tests in CI with service extras installed.
   - Add client smoke tests with Apache Chemistry/OpenCMIS where feasible.
   - Continue returning CMIS-specific exception classes/statuses as more
     optional services are added.

3. **Query depth**
   - Add a real CMIS SQL subset parser instead of a two-query allowlist.
   - Support basic `WHERE`, equality predicates, paging, ordering where claimed,
     and diagnostics for everything outside the subset.

4. **Navigation depth**
   - Decide whether `getDescendants` and `getFolderTree` are worth implementing
     over projection-only folders.
   - Keep mutating filing unsupported unless a client explicitly needs it.

5. **Versioning depth**
   - Keep PWC/checkin/checkout unsupported for now.
   - Add version-history read support if document-management integrations begin
     depending on it.

6. **Renditions**
   - Map selected derived representations to CMIS renditions only after we have
     stable representation taxonomy and real preview/thumbnail use cases.

7. **Append streams**
   - Keep `appendContentStream()` unsupported unless a real client requires it.
   - If implemented later, design it through blob composition/deduplication
     rather than byte concatenation in the CMIS adapter.

## Product Positioning Takeaway

Against a mature CMIS implementation such as Hyland Alfresco ACS, Kontextual is
not trying to win by being a full ECM clone. Its current strength is a governed,
profiled, source-grounded knowledge runtime with enough CMIS Browser Binding
surface for controlled interoperability.

The right strategic posture is therefore:

- advertise a conservative CMIS 1.1 Browser Binding subset,
- keep unsupported capability flags honest,
- use the scorecard to decide which gaps are worth closing for real clients,
- avoid AtomPub/Web Services and full ECM semantics unless revenue or a named
  integration justifies the complexity.