# Project plan — dev.knowmore (Knowmore)

Evidence date: 2026-10-17.

Source repository: `git@bitbucket.org:overdrive/dev.knowmore.git`.

Inspected revision: `master` at `43f9c23` (2021-02-10 11:31:31 +0200, rachelmogano, "Initial Commit"). The scan-host path `~/projects/sonar_scan/repos/dev.knowmore` was not on this machine. The tree below was read from that git revision. Passwords, payment keys, and personal data in the tree are not reproduced.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The running product name in the learner shell is **KnowMore**. The footer in `training/_nemo.basic.cls.php` reads "+27 21 524 4669 | info@knowmore.co.za | KnowMore © 2018 | Developed by Silicon Overdrive". Invoice PDFs address accounts@knowmore.co.za and link www.knowmore.co.za. The public host configured for live is `www.knowmore.co.za`.

Older names remain in the same tree:

| String | Where | Status |
|---|---|---|
| KnowMore / Knowmore | Footer, emails, CPD copy, SLA package names, FIM report filename | **Implemented** |
| Celestis | Cookie names `celusername` / `celpassword`, forgot-password page title, commented database names `celestis`, `celestis_academy`, `celestis_tools` | **Implemented** leftovers |
| qa-celestis.co.za | QA host key and the tools header logo URL | **Implemented** |
| Old Mutual Wealth | Commented and live CPD catalogue copy in `training/my.assignments.php`; tools home comment "Old Mutual Wealth Business Tools" | **Implemented** copy |
| American Shutters | `fim_2.0/fim.config.php` project name, database, and mail From address | **Implemented** in that config file. It does not match Knowmore |

**Inferred:** Knowmore is an online academy and practice-management site for financial-planning practices. Learners take courses and workshops, claim CPD points, and, when linked to a practice, use licensed business tools (assessment, gap analysis, client surveys). Staff administer content, licences, invoices, and SLA proposals. The public brochure site is a separate WordPress (and earlier TYPO3) installation that this repository expects to sit beside.

There is no README, PRD, or project plan in the source repository. There was no existing `silicon_ark/dev.knowmore/` directory.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `43f9c23` | 2021-02-10 | Only branch. One commit: "Initial Commit" |

No other local or remote branches were present at inspection. Git history does not show later releases, a `develop` branch, or a removed feature. Dated copies of PHP files are stored in the tree itself (for example `webadmin/includes/course.cls.20190808.php`).

**Discrepancy:** the task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in git at `43f9c23`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Scope of this repository

In this commit:

- `training/` — learner portal pages (courses, workshops, publications, CPD, forums, purchases, profile).
- `tools/` — business-tools front end, registration and purchase scripts, cron jobs, and the tools admin under `tools/webadmin/`.
- `webadmin/` — class library for the academy admin (courses, learners, SLA quotes, invoices). No page controllers sit at `webadmin/*.php`.
- `layouts/` — learner and AVP page layouts.
- `fim_2.0/` — file-integrity monitor. Its checked-in config points at a different product.
- `htmltopdf/`, `tools/htmltopdf/`, `tools/fpdi/`, `webadmin/fpdi/` — PDF libraries.
- `css/`, `js/`, `images/`, `flowplayer/` — shared front-end assets.
- `webadmin/import/` — CPD CSV extracts. These files contain learner identifiers. They are not copied into this document.

Not in this commit, but required by includes or links:

| Expected path | Referenced from | Status |
|---|---|---|
| `webadmin/_system.php` | `training/_nemo.basic.cls.php` | **Not in git** |
| `webadmin/_nemo.control.cls.php` | same | **Not in git** |
| `webadmin/_nemo.email.cls.php` | training bootstrap; `tools/iwp.invite.accept.php` | **Not in git** (a different copy exists at `tools/webadmin/_nemo.email.cls.php`) |
| `webadmin/_nemo.password.cls.php` | `tools/webadmin/login.php` | **Not in git** |
| `second.wp.php`, `login.wp.php`, `wp-login.php` | learner logout and the redirect when `$_SESSION[LEARNER]` is missing | **Not in git** |
| TYPO3 / WordPress page bodies loaded by `getTypoIframe` | overview articles, publications, AVP pages, business-tools iframe | **Not in git** |

**Unknown / Requires Confirmation:** whether production deploys this commit together with those missing files from another repository or from untracked paths on the host.

## System shape

```text
Browser
  |
  +-- WordPress shell (not in this repo)
  |     login / logout: second.wp.php, login.wp.php, wp-login.php
  |
  +-- training/          learner session LEARNER
  |     NemoBasic + layouts/
  |     needs webadmin/_system.php (missing)
  |
  +-- tools/             advisor session ADVISOR
  |     tools/webadmin/system.php  (host -> MySQL)
  |     engines: BAT, TCF/PoPI/RDR/SCP gap, CAT, LIT
  |     tools/webadmin/  staff session USER
  |
  +-- CMS iframes        hidden/* content (not in this repo)
  |
  +-- MySQL on Hetzner host-h.net, selected by HTTP host
  |
  +-- cron.daily / cron.hourly / cron.weekly
        emails, licence renewal, CAT reminders, consulting-hours import
```

Three MySQL profiles are declared per host (`DATABASE_SETTINGS`, `DATABASE_SETTINGS2`, `DATABASE_SETTINGSBAT1`). A 2016 comment says they were collapsed onto one database. On the live and QA host blocks that are not commented out, all three profiles name the same database.

## Major components

| Component | Role | Evidence |
|---|---|---|
| Learner portal | Overview, courses, workshops, business tools, publications, CPD | `training/_nemo.basic.cls.php` `Menu()` |
| Business Assessment Tool (BAT) | Licensed questionnaire, red/amber/green results, benchmarks | `tools/bat.engine.php`, `tools/bat.class.php`, dashboard query in `training/index.php` |
| Gap tools | TCF, PoPI, RDR, succession (SCP) | `tools/gap.*.engine.php` and matching admin controllers |
| Client survey (CAT) | Survey, PDF report, email reminders | `tools/cat.engine.php`, `tools/cat.pdf.php`, `tools/cron.daily.php` |
| Literacy tool (LIT) | Intro / save / finish flow | `tools/lit.engine.php` |
| Practice setup | Industry, income, expenses, staff | `tools/practice.setup.php`, `tools/ie.*.php` |
| Commerce | Licences, invoices, PayGate return, Netcash, Sage Pay keys | `tools/purchase*.php`, `tools/payGateResults.php`, `tools/webadmin/system.php` |
| Academy admin classes | Courses, modules, learners, workshops, SLA quotes, CPD | `webadmin/includes/*.cls.php` |
| Tools admin | Questions, questionnaires, practices, users, licences, invoices | `tools/webadmin/*.php` |
| Jobs | Daily, hourly, weekly | `tools/cron.*.php` |
| File integrity | Hash and email a change report | `fim_2.0/`, `webadmin/_framework/_nemo.fim.cls.php` |

## Milestones visible in comments

These dates are comments in the code, not a published plan. Provenance: **Implemented** as comments. Whether each change shipped is **Inferred** from the comment remaining in the 2021 snapshot.

| When | What the comment says |
|---|---|
| 2010 | BAT access checks, licence-renewal cron, SMS via MyMobileAPI, Netcash purchase steps |
| 2011 | Security lockout after failed logins; consulting-hours CSV import |
| 2012 | Courses stay listed for one week after the start date |
| 2013 | Learner assignments; tools session path must be the Knowmore session path |
| 2015 | PHP 5.6 compatibility; CPD page; CPD points granted from gap tools |
| 2016 | Column renames (`dtDateExpiry`, `strStatus`, `blnDeleted`); one-database switch; VAT still 14% in older invoice code |
| 2017 | Phase 3 hides the user-category and WPS blocks and drops the ads table; Hetzner breach password reset noted; Sage Pay keys per environment; "better password" class for admin login; Wealth Intelligence CPD counted on every third item |
| 2018 | VAT 15% from 2018-04-01 via `SystemSettings[VAT]`; SLA proposals; footer year 2018; IWP option on proposals |
| 2019 | Menu label "Publications" replaces "Wealth Intelligence"; CPD cycle dates and report disclaimer; Xplan naming replaces CRMIntegrator in SLA comments |
| 2020 | BAT 2020 results (`dwfBatResults_2020`); personalised corporate-partner prices on SLA quotes |
| 2021-02-10 | This snapshot committed. CPD catalogue rows in `training/my.assignments.php` list assessment end dates in 2021 |

No milestone after 2021-02-10 is in git.

## Dependencies known from the tree

- PHP with `mysqli`, sessions, and the SOAP extension (used by `tools/soap.php`). The 2015 comments target PHP 5.6. The exact runtime on the 2021 host is **Unknown**.
- MySQL databases named in config (see technical documentation). Credentials are committed in plaintext and are omitted here.
- Apache, inferred from TYPO3 example files named `_.htaccess` (the leading underscore means Apache will not load them as `.htaccess`).
- WordPress theme `knowmore` on the public host, inferred from logo and logout URLs.
- Earlier TYPO3 content, inferred from `getTypoIframe` and the example htaccess.
- Hetzner (`host-h.net`) for MySQL. A 2012 comment says cron on Hetzner could run at most every two hours and send at most 500 emails.
- PayGate (PayXML return), Netcash (purchase and a SOAP validation client), Sage Pay Pay Now service keys.
- MyMobileAPI HTTP SMS (`http://www.mymobileapi.com/api5/http5.aspx`), credentials taken from `sysSettings`.
- Google Analytics hook on `NemoBasic`, and Google Visualization pie charts in the tools system functions.
- jQuery 1.4.2 and 1.10.2, jQuery UI 1.8.6, Flowplayer 3.2.6, FPDF / HTML2FPDF / FPDI, a PHP Excel reader, MAIL5.

No `composer.json`, `package.json`, test suite, Dockerfile, or pipeline file is in the commit.

## Current status

**Implemented** as a single snapshot dated 2021-02-10. Deployment of that snapshot, and whether a newer tree exists outside this repository, is **Unknown / Requires Confirmation**.

The training portal cannot be executed from this commit alone: its bootstrap includes three `webadmin/` files that are not in git. The tools admin login includes `webadmin/_nemo.password.cls.php`, which is also absent.

## Human confirmation

1. Is `www.knowmore.co.za` still the live product, or was it replaced after 2021?
2. Which repository or host path supplies `webadmin/_system.php`, the Nemo control/email/password classes, and the WordPress login pages?
3. Are the committed database passwords and Sage Pay keys still valid? They should be treated as exposed. This document does not repeat them.
4. Is the admin login file `tools/webadmin/login.php` still the live staff entry? Its password check is bypassed when the Login button is posted (see business rules).
5. Should the `fim_2.0` American Shutters configuration be treated as unused sample code?
6. Are the CPD CSV files under `webadmin/import/` supposed to be in git? They contain learner email addresses.