# Business rules — evolve-infra

Evidence date: 2026-10-15. Source: `git@bitbucket.org:overdrive/evolve-infra.git`, `master` at `35effc1` (2019-03-15).

Rules of the Magus accreditation product (registration, permits, roles, passwords) are in `silicon_ark/magus-core/business-rules.md`. This file records only rules this repository states or encodes. Nothing was inferred into a product policy that the files do not support.

The stack was not started.

## What this repository is for

### BR-001 — Local Magus development stack

**Documented.** The README says the repository holds base primitives for development and deployment of the Evolve applications, then describes one Magus development environment and the command `docker-compose up`.

**Implemented** scope is narrower: four Compose services and a Magus submodule. No deployment target other than the developer's machine is configured.

### BR-002 — Application source stays in magus-core

**Documented.** The README says changes in the `magus-core` folder must be committed to the magus-core git repo.

**Implemented** as a submodule (`path = magus-core`), not as a copy of the PHP tree. This repo stores a gitlink.

## Runtime rules encoded in Compose and nginx

### BR-003 — The PHP process is always "development"

**Implemented.** `docker-compose.yml` sets `APPLICATION_ENV: development` on service `php`. There is no other value in this repository.

**Inferred** effect, from Magus `public/index.php` and the pinned `application.ini` at `9b5b3e2`: Zend loads `[development : production]`, which overrides the database host, user, password, and name. The production block in that INI is not the block this environment variable selects.

The production block's user name and password are not copied here. They are not the Compose credentials.

### BR-004 — Development database coordinates

**Implemented** in `docker-compose.yml` and the README `docker exec` example:

| Setting | Value |
|---|---|
| Hostname from other containers | `database` (service name). phpMyAdmin links it as `db` |
| Database name | `magus_dev` |
| User | `root` |
| Password | `root` |

**Implemented** match at Magus `9b5b3e2`, `[development]`: host `database`, user `root`, password `root`, database `magus_dev`.

**Not a match** at Magus `f806a7e` `[development]`: host `localhost`, user `root`, empty password, database `magus`. That revision is not the gitlink.

### BR-005 — Database is created from the Magus dump file

**Implemented** mount: `./magus-core/admin_magus.sql` → `/docker-entrypoint-initdb.d/dump.sql`.

The dump header comment names `admin_magus`. The file contains no `CREATE DATABASE` statement. Compose also sets `MYSQL_DATABASE` to `magus_dev`.

Which of those names receives the tables is **Unknown / Requires Confirmation**. The MariaDB image's entrypoint is not in this repository, and it was not run.

**Inferred** from the image contract, not verified: scripts in `docker-entrypoint-initdb.d` run when the data directory is empty, not on every start.

### BR-006 — HTTP is served from `public/` and PHP goes to the `php` service

**Implemented** in `nginx-site.conf`:

- `root /code/public`
- `index index.php index.html`
- `/` falls through to `/index.php` when the file or directory is missing
- `\.php$` is sent to `php:9000`, or 404 when the file is missing
- `\.htaccess` is denied

**Inferred:** Apache rewrite rules inside Magus `.htaccess` do not apply, because this server is nginx and the site root is already `public/`.

### BR-007 — phpMyAdmin uses the same root credentials

**Implemented.** `PMA_USER` and `PMA_PASSWORD` are `root`. The README publishes the UI at `http://localhost:8081`.

No separate operator account is defined.

### BR-008 — Ports are the host contract

**Documented** and **Implemented.**

| URL | Service |
|---|---|
| `http://localhost:8080` | `http` (nginx) |
| `http://localhost:8081` | `phpmyadmin` |

The Compose port strings do not bind to loopback only.

## Rules that are not enforced here

### BR-009 — README submodule command versus the gitlink

**Documented** command: `git submodule update --recursive --remote`.

**Implemented** gitlink: `9b5b3e2`. `.gitmodules` records `branch = master`.

`--remote` updates the work tree to the remote branch tip. That is a different rule from "check out the committed gitlink". The repository does not say which one operators must keep. **Requires confirmation.**

### BR-010 — No application validation in this repo

This tree does not check permits, emails, roles, or passwords of Magus users. `php-test/public/index.php` runs a single `SELECT` on `users` and prints `phpinfo()`. It is not mounted, and it is not a business rule of the product.

### BR-011 — No environment split

There is no `production` Compose file, no secret store, and no rule that `root` / `root` must be changed before a shared network. The values are committed in `docker-compose.yml`, `Readme.md`, and `php-test/public/index.php`.

Treating those values as workstation-only is **Inferred** from `APPLICATION_ENV=development` and the README's "development desktop" wording. The files do not forbid another use.

## Explicitly not a rule

- Image tags (`nginx:stable-alpine`, `mariadb`, `php:fpm-alpine`, `phpmyadmin/phpmyadmin`) do not pin a version or digest. No rule in the repo says which release is approved.
- `nginx.conf` does not govern the running server. Compose never mounts it.
- The scan-host Sonar files are not rules. They are not in git.
- Container name `evolve-infra_database_1` is an example in the README, not a `container_name` field.