# Business rules — Webformulys

Evidence date: 2026-09-28.

Source: `git@bitbucket.org:overdrive/webformulys.git`, `main` at `b94306f` (2024-04-03).

No business-rules document exists in the source repository. The tree has no application code, so there are no domain rules for users, orders, pricing, or permissions. The rules below are the constraints the committed pipeline and ignore file actually state. Anything marked **Inferred** is a conclusion from that evidence, not a written policy.

## Pipeline selection

### BR-001 — The defined pipeline runs for `master` only

**Implemented.**

`bitbucket-pipelines.yml` sets `pipelines.branches.master`. It does not set `pipelines.default` or `pipelines.pull-requests`. A commit on `main` does not match this definition.

Evidence: `bitbucket-pipelines.yml`.

The file comment says the workflow runs on the default branch. The default branch is `main`. The comment and the key disagree. The key is what Bitbucket selects on.

### BR-002 — Build precedes publish

**Implemented** as step order.

Step 1 runs `npm install` and `npm run build` and declares artifact `build/**`. Step 2 runs only after that step, and runs `git ftp push`.

There is no `fail-fast` override, manual trigger, or condition. Bitbucket's default is that a failed step stops the pipeline. That default is **Inferred** from Bitbucket Pipelines behaviour, not from a line in this file.

## Publish target

### BR-003 — The FTP URL is a QA path named Pestelite

**Implemented.**

The push URL is:

```text
ftp://$FTP_HOST_QA/public_html/pestelite.overdriveqa.co.za
```

The host is not hardcoded. The path's last segment is `pestelite.overdriveqa.co.za`.

**Unknown / Requires Confirmation:** whether Webformulys is supposed to publish to a Pestelite QA site. No other file in the repository mentions Pestelite or a Webformulys hostname.

### BR-004 — QA FTP credentials come from pipeline variables

**Implemented** as variable references.

The command reads `FTP_USERNAME_QA` and `FTP_PASSWORD_QA`. It does not contain a literal username or password. The values are not in git.

Whether those variables are configured, and in which environment, is **Unknown / Requires Confirmation**.

### BR-005 — The publish transport written in the URL is FTP

**Implemented.**

The scheme is `ftp://`, not `sftp://` or `ftps://`. No rule in the repository requires TLS for this upload.

## Build

### BR-006 — The build command is npm, and the project file is absent

**Implemented** command. **Inferred** consequence.

The script always runs `npm install` then `npm run build`. No `package.json` is in the repository, so those commands have no project to read. No rule selects another package manager.

The comment "required to install zip" is not a rule the script enforces. Nothing in the script invokes `zip`.

### BR-007 — The image is Node 16

**Implemented.**

`image: node:16` applies to the whole file. No step overrides it. No `.nvmrc` or `engines` field exists, because there is no Node project file.

## What the ignore file does not decide

### BR-008 — The ignore list is the stock template

**Implemented.**

`.gitignore` is the example file Bitbucket adds at repository creation. The header says to customize it. Commit `71d3c3f` added it; commit `b94306f` did not change it.

It ignores `node_modules/`, `dist/`, Java class files, Python bytecode, logs, jars, Maven `target/`, `.idea/`, `TEST*.xml`, OS junk, `*.exe` / `*.war` / `*.app`, and several media types. It does not ignore `build/`. It does not ignore `.env`.

This is not a business rule about which languages the product uses. Provenance of a stack choice: **Unknown**.

## Rules that were not found

No evidence in this repository for:

- User roles, authentication, or authorization.
- Data validation, uniqueness, or required fields.
- Pricing, tax, or billing.
- Retention, audit, or privacy rules.
- A SonarQube quality gate. The scan-host names `sonar-project.properties` and `sonarqube_scan.bat` are not in git.
- A production deploy target. The only URL is the QA path in BR-003.
- Retry, approval, or rollback of the FTP push.