# Project plan — ieb

Evidence date: 2026-10-13.

Source repository: `git@bitbucket.org:overdrive/ieb.git`.

Inspected revision: `main` at `193927fc` (2026-08-04, Renier van Rooyen, "Refactor surface control handling and improve session management..."). The scan-host path `~/projects/sonar_scan/repos/ieb` was not on this machine. The tree was read from git objects at that revision. A full working-tree checkout on this Windows machine failed where paths under the repeated `Evolution Software Unified Framework` folder exceed MAX_PATH. Credential values, encryption keys, and hardcoded sign-in secrets are omitted on purpose.

This plan describes what the repository contains. It does not decide what the product should become.

`silicon_ark/ieb/` did not exist before this set. Related Silicon Ark sets already exist for extracted or forked trees. See [Related documentation](#related-documentation).

## Product

The repository is the **Evolution Software Unified Framework**: one ASP.NET Web Forms codebase that hosts many tenant websites under `core_custom/{code}`.

`library/Properties/AssemblyInfo.cs` sets:

| Attribute | Value |
|---|---|
| Assembly title | `framework_library` |
| Product | Evolution Software Framework |
| Company | Evolution SoftWare |
| Copyright | Copyright 2016 Evolution SoftWare |
| Version | 1.0.0.0 |

Provenance: **Implemented**.

The root `ReadME.txt` is the only product list in the repository. Provenance: **Documented**.

| Code | Name in the readme |
|---|---|
| INDE-1 | Exams |
| INDE-2 | CRM |
| INDE-4 | Docs (using the INDE-2 user table) |
| INDE-5 | CPS |
| INDE-6 | Postbox |
| INDE-8 | ISC CRM |
| INDE-9 | ISC Docs (using the INDE-8 user table) |

The readme does not expand "IEB". The letters IEB appear in tenant `website` app settings, in Postbox email subjects, in the Windows service name `IEB Email Queue Processor`, and in `ieb.co.za` hosts inside several `Web.config` files and `data/Scripts/INDE-6/`. Provenance: **Documented** for the project list; **Implemented** for those strings. The full organisation name is **Unknown / Requires Confirmation**.

`core/Web.config` names the generic site "Evolution Software Framework". Tenant `Web.config` files carry their own `website` values. Several of those values disagree with the readme. See [Discrepancies](#discrepancies).

There is no product requirements document inside the source repository.

## Branch reality

Default branch is `main`. Visible history on `main` is 39 commits, from `6624f7b` (2025-01-21, Abdurahmaan Ismail, "Initial commit") through `193927fc` (2026-08-04). The large source import is `18e2d86` (2025-02-05, maanie, "Initial code commit"). Comments and SQL filenames inside that import cite 2016–2020 dates. The git history does not contain those earlier years. That the 2025 commit imported an older working copy is **Inferred**.

| Commit | Date | Subject |
|---|---|---|
| `6624f7b` | 2025-01-21 | Initial commit |
| `9a86e79` | 2025-01-27 | upload test file |
| `18e2d86` | 2025-02-05 | Initial code commit |
| `9646cea`, `c9f20d8` | 2025-02-06 | Test.txt edited; renamed txt file |
| `e57e4df` | 2025-02-13 | ReadME.txt edited online with Bitbucket |
| `bec948b` | 2025-03-24 | revision numbering sequence fix |
| `1ee1420` | 2025-05-30 | set security protocol before sending email |
| `08358ed` | 2025-06-17 | added AET backup option |
| `cc9d2fe` | 2025-06-20 | Revert "added AET backup option" |
| `5c0dddd` | 2025-06-20 | Merge branch `main` |
| `03f9be2` | 2025-06-20 | AET Backup option |
| `2ba5813` | 2025-06-20 | bitbucket-pipelines.yml created online |
| `43afe80` | 2025-06-20 | sonar-project.properties created online |
| `8a9d537` through `eb65b53` | 2025-06-25 to 2025-06-30 | Eleven online edits of `bitbucket-pipelines.yml` (Jaco Brits) |
| `e69e29e` | 2025-08-12 | added missing custom controls surface files |
| `38b1cbb` | 2025-08-18 | INDE-6 (Postbox) - implemented email queue |
| `972cb4e` | 2026-04-17 | lock direct URL access for users not assigned to this subject + fix resource load error |
| `bc7f1f2` | 2026-05-27 | Duplicate issue fix, SubjectName empty fix, subject not showing for user fixed |
| `0010068` | 2026-05-29 | #125 added additional paper types |
| `bdc6799` | 2026-06-08 | Attempt fix for longfilenames |
| `638191d` | 2026-06-08 | Merge `main` into `josh_work` |
| `fd80a94` | 2026-06-19 | Missing info on record fix on open added |
| `1e06723` | 2026-06-23 | Merged main into josh_work |
| `83c4c22` | 2026-06-23 | Merged in josh_work (pull request #1) |
| `7cdc9bc` | 2026-06-24 | #140 Additional improvement on new subject create |
| `509c08f` | 2026-06-30 | #152, #153, #154 Unlink moderator bugfix |
| `2997ebf` | 2026-07-02 | Exam Paper filter updated |
| `193927fc` | 2026-08-04 | Surface control session handling, picklists, ViewState |

Other remote heads at inspection:

| Branch | Tip | Date | Subject | On `main`? |
|---|---|---|---|---|
| `josh_work` | `1e06723` | 2026-06-23 | Merged main into josh_work | Yes. Merged by `83c4c22` (pull request #1) |
| `feature/ieb-client-proposals` | `4740d58` | 2026-08-21 | `[ieb] Add AI model selection line item to pilot proposal` | No |

The feature-branch parent is `7c05b557`, which is not in the 39 commits on `main`. The diff of `4740d58` was not reviewed. What that branch changes is **Unknown / Requires Confirmation**.

**Discrepancy with the onboarding scan (2026-09-28):** the scan recorded `main` at `38b1cbb` (2025-08-18). That commit is an ancestor. `main` had already moved to `193927fc` on 2026-08-04. The scan host checkout was stale, or it was not fetched before the snapshot was taken.

## Objectives (inferred from the tree and the commit subjects, not from a written plan)

No objectives document exists. The following are **Inferred**:

- Keep one framework that renders data-driven canvases and surfaces for many tenants.
- Run the IEB products named in `ReadME.txt` (exams, CRM, docs, CPS, Postbox) as tenant sites.
- Keep other client sites in the same tree (`core_custom` codes outside the readme list).
- From 2026-04 onward, the commits that are not merges are INDE-1 exam fixes.
- From 2025-08-18, Postbox mail is queued instead of sent inline, and a Windows service drains the queue.

Whether every tenant folder is still deployed is **Unknown / Requires Confirmation**.

## Scope in the repository

In scope, because the files are in `193927fc`:

- Shared projects: `library`, `business`, `service`, `data`, `mobile`, `tools` (constructor, exporter, scheduler, dataImporter, EmailQueueProcessor, CEP, CAPI.Custom), `SchedulerTool`, `components`, `packages`, `BuildProcessTemplates`, `release`.
- Generic sites `core` and `core-dev`.
- 32 tenant sites under `core_custom`.
- Per-tenant solution files and `EvolutionSoftwareUnifiedFramework.sln`.
- SQL scripts under `data/Scripts` for a subset of tenants, plus archived framework script folders.
- Sonar pipeline files at the repository root.

Out of scope of this git revision, though the onboarding scan listed them at the scan host:

- `repos/`
- `sonar-project.old`
- `sonarqube_scan.bat`

`.gitignore` is present and was not in the scan listing.

## System architecture

```text
Browser
  |
  v
Tenant website  core_custom/{CODE}   (ASP.NET Web Forms)
  |                 also core/ and core-dev/ as generic copies
  |
  +-- canvases and surfaces (mostly data-driven from SQL Server)
  +-- tenant classes under App_Code and controls/surface_custom
  |
  v
framework_business  (xData, handlers, domain objects)
  |
  v
framework_library   (dataInteraction, mail, encryption, PayGenius models)
  |
  v
SQL Server catalog  Framework_{CODE}   via appSetting "conn"

Windows service tools/EmailQueueProcessor
  reads pal_ email-queue rows and calls communication.SendAnEmail

WCF service/framework_service.svc
  ProcessInteraction, GetVersion, SaveVersion

External (configured, not all traced):
  Mediswitch gateway, SendEasy SMS, country web services,
  service.ieb.co.za in several Web.config files
```

`App_Code` is compiled by the website, not by the class-library projects.

## Major components

| Component | Path | Role |
|---|---|---|
| Library | `library/` | Assembly `framework_library`, .NET Framework 4.5. Data access, mail, encryption, PayGenius types |
| Business | `business/` | Assembly used as `framework_business`. Domain objects, `xData`, `xEmailQueue`, surface handlers, `pNums` |
| Generic site | `core/` | Website. Solution binds it to `http://localhost:45935` |
| Dev site | `core-dev/` | Second copy of the generic website |
| Tenant sites | `core_custom/{CODE}/` | One website project per code |
| WCF host | `service/framework_service.svc` | `Iframework_service` |
| SQL project | `data/data.sqlproj` | Scripts plus `Framework_STUD-1.bak` |
| Email worker | `tools/EmailQueueProcessor/` | Windows service. Referenced by `INDE-6.sln` only |
| Other tools | `tools/constructor`, `exporter`, `scheduler`, `dataImporter`, `CEP`, `CAPI.Custom` | Desktop or helper projects. Behaviour of each tool was not fully traced |
| Scheduler UI | `SchedulerTool/` | WinForms tool with a Google Sheet import class. A secrets JSON file is committed; its contents are omitted |
| Vendored DLLs | `components/` | AjaxControlToolkit, EPPlus, SharpZipLib, Telerik, Newtonsoft.Json, Spire, PdfMetamorphosis, built framework DLLs |
| Releases | `release/1.0.0.1`, `release/1.0.5` | Each contains `files.zip` and `scripts.zip`. Not unpacked |

## Tenant inventory

Each row is a directory under `core_custom`. "Own .sln" means a `{CODE}.sln` exists beside `EvolutionSoftwareUnifiedFramework.sln`. The unified solution's project list includes the shared projects plus ASSE-1, BASE-1, BASE-2, BLUE-1, DEMO-1, EVOL-1, EVOL-2, GLOB-1, JEWE-1, OLIV-1, PROP-1, SHOU-1, STUD-1, and INDE-1. It does not include INDE-2. Other tenants are opened from their own solution files.

`website` is the appSetting value. Where the file contains two `website` keys, both are listed in file order. ASP.NET `AppSettings` returns the last duplicate. That last-wins reading is **Inferred** from the duplicate keys plus .NET Framework configuration behaviour.

Catalogs are `Initial Catalog` values found in that tenant's `Web.config`, including commented alternatives. Passwords and hosts are omitted.

| Code | Own .sln | `website` values in file order | SQL catalogs seen |
|---|---|---|---|
| AFRI-1 | Yes | Africa Skills (AFRI-1 Local); Africa Skills | `Framework_AFRI-1`, `Framework_EDES-2` |
| ASSE-1 | Yes | ASSET; ASSET | `Framework_ASSE-1`, `Framework_GLOB-1` |
| BASE-1 | No | Evolution Software Framework (twice) | `Framework_EVOL-1`, `Framework_GLOB-1` |
| BASE-2 | No | Evolution Software Framework (twice) | `Framework_EVOL-1`, `Framework_GLOB-1` |
| BLUE-1 | No | Evolution Software Framework (twice) | `Framework_EVOL-1`, `Framework_GLOB-1` |
| CAPI-1 | Yes | CEP (CAPI-1 Local); Palette One Framework | `Framework_CAPI-1`, `Framework_CAPI-1_Demo` |
| CHUU-1 | Yes | Chuuz; Palette One Framework | `Framework_GOPR-1`, `Framework_REAP-1` |
| CLOS-1 | Yes | IEB (INDE-1 Local); Palette One Framework | `Framework_INDE-1` |
| DEMO-1 | No | Evolution Software Framework (twice) | `Framework_EVOL-1`, `Framework_GLOB-1` |
| DISA-1 | Yes | Disa Scholarship Programme (twice) | `Framework_DISA-1` |
| EVOL-1 | No | Evolution Software Framework (twice) | `Framework_EVOL-1`, `Framework_GLOB-1` |
| EVOL-2 | No | Evolution Software Framework (twice) | `Framework_EVOL-1`, `Framework_GLOB-1` |
| FAST-2 | Yes | FastTrack (FAST-2) | `Framework_FAST-2` |
| GLOB-1 | Yes | Global Welness Centre (GLOB-1); Evolution Software Framework | `Framework_GLOB-1`, `Framework_STUD-1_Demo` |
| INDE-1 | Yes | IEB:: Exams (INDE-1) | `Framework_INDE-1` |
| INDE-2 | Yes | IEB (INDE-2 Local); IEB CRM | `Framework_INDE-2` |
| INDE-3 | Yes | IEB:: Website | `Framework_INDE-3` |
| INDE-4 | Yes | IEB (INDE-4 Local); IEB CRM | `Framework_INDE-4` |
| INDE-5 | Yes | IEB (INDE-5 Local); IEB CRM | `Framework_INDE-5` |
| INDE-6 | Yes | IEB (INDE-6 Local); IEB CRM | `Framework_INDE-6` |
| INDE-7 | No | IEB:: Website | `Framework_INDE-7` |
| JEWE-1 | Yes | Evolution Software Framework (twice) | `Framework_JEWE-1` |
| LIGS-1 | Yes | Ligstad Online (LIGS-1) | `Framework_LIGS-1` |
| OLIV-1 | Yes | Olivedale Superspar (OLIV-1); Palette One Framework | `Framework_OLIV-1` |
| PROP-1 | Yes | The Property Soluton (PROP-1 LOCAL) (twice) | `Framework_PROP-1`, `Framework_PROP-1_Demo` |
| REAP-1 | Yes | IEB (INDE-1 Local); Palette One Framework | `Framework_INDE-1` |
| SCHO-1 | Yes | IEB (INDE-1 Local); Palette One Framework | `SchoolAdvisor` |
| SHEN-1 | Yes | IEB (INDE-1 Local); Palette One Framework | `Framework_INDE-1` |
| SHOU-1 | Yes | The Shoulder Practice SHOU-1 DEV; Evolution Software Framework | `Framework_SHOU-1` |
| SPAC-1 | Yes | IEB (INDE-1 Local); Palette One Framework | `Framework_INDE-1` |
| STUD-1 | Yes | Evolution Software Framework DEV | `Framework_STUD-1`, `Framework_STUD-1_Dev` |
| TVET-3 | Yes | TVET College Website | `Framework_TVET-3` |

Spelling in the config files is kept as stored: "Welness", "Soluton".

SQL script folders under `data/Scripts`: CAPI-1, CHUU-1, CLOS-1, INDE-1, INDE-2, INDE-6, OLIV-1, REAP-1, ROBI-1, SCHO-1, SHEN-1, SHOU-1, STUD-1, four `archive major *` folders, and `published to LIVE-CAPI-1 on 190930`. There is no `INDE-3`, `INDE-4`, `INDE-5`, or `INDE-7` script folder. There is no `ROBI-1` directory under `core_custom`.

## Milestones visible in git

| When | What landed |
|---|---|
| 2025-02-05 | Framework import |
| 2025-02-13 | Readme edited into the project list above |
| 2025-05-30 | Outbound mail sets TLS 1.2, TLS 1.1, and TLS before send |
| 2025-06-17 to 2025-06-20 | AET backup option added, reverted, then added again |
| 2025-06-20 | Sonar pipeline files added |
| 2025-08-12 | EM compliance-feedback surface controls added |
| 2025-08-18 | Postbox email queue and Windows service |
| 2026-04-17 to 2026-08-04 | INDE-1 exam fixes only (URL lock, duplicates, paper types, filenames, subject create, unlink moderator, paper filter, surface session) |

No tagged release is described by the commit subjects. The `release/` zips were not opened.

## Current project status

`main` is the inspected line. Work after the 2025-08-18 Postbox queue commit is INDE-1 exam maintenance. The unmerged branch `feature/ieb-client-proposals` is newer than `main` (2026-08-21) and was not reviewed.

Whether production still deploys from this repository, or from the later forks documented under other Silicon Ark folders, is **Unknown / Requires Confirmation**.

## Known dependencies

- .NET Framework 4.5 for `library`, `business`, and the `core` compilation target. INDE-6 `Web.config` also mentions `httpRuntime targetFramework="4.6.2"` in a comment block.
- SQL Server, catalogs named above.
- Telerik.Web.UI, Ajax Control Toolkit, EPPlus, ICSharpCode.SharpZipLib. The readme says these must be re-added before a build, and that `Microsoft.CodeDom.Providers.DotNetCompilerPlatform` must be reinstalled. Ionic.Zip is listed as an INDE-2 NuGet reference.
- SendEasy SMS client under `business/Service References/send_easy`.
- Mediswitch gateway URLs in tenant `Web.config` files. The INDE-6 file leaves the QA gateway keys active and the live gateway keys commented.
- PayGenius types under `library/Payment` and `library/objects/PayGeniusModels`. Whether a tenant still calls them was not traced.
- Google Sheets helper classes in `business/handlers` and `SchedulerTool`. A secrets file is committed under `SchedulerTool`. Contents omitted.
- Bitbucket Pipelines image `maven:3.8.3-jdk-11` runs only the Sonar scanner. The application is not a Maven build.

The readme says `NReco.VideoConverter.dll` must be re-added from `components` or `packages`. `components/` contains `NReco.VideoConverter.xml` and does not list the dll. Provenance of the missing dll: **Implemented** as an absent filename in that directory listing.

## Related documentation

These Silicon Ark folders describe other repositories. They are not a substitute for this tree.

| Silicon Ark folder | Other repository | Relationship seen from this inspection |
|---|---|---|
| `ieb-inde-1` through `ieb-inde-6` | `ieb-inde-1.git` through `ieb-inde-6.git` | Snapshot-style trees of the same framework, cut around July 2025. This `ieb` `main` contains later INDE-1 commits through 2026-08-04, and the Postbox queue commit `38b1cbb` |
| `ieb_template` | `ieb_template.git` | A different solution, Evolution SoftWare Global Library / `EvoSoft_Lib`. It does not contain this framework. Same company string only |
| `SHOU-1` | `shou-1.git` | A Shoulder Practice tenant that continued to 2026-09-22, including password hashing and login lockout. Those later changes are not in this `ieb` tip |

Tenant product behaviour that those documents already traced (exam status mail, Postbox folder rules, Shoulder Practice billing) was not re-derived line by line here. Where this tip has later commits, those commits are specified in `features.md` and `prd.md`.

## Discrepancies

1. Onboarding scan tip `38b1cbb` versus `main` tip `193927fc`.
2. Scan listed `repos/`, `sonar-project.old`, and `sonarqube_scan.bat`. None are in `193927fc`.
3. Readme names INDE-8 and INDE-9. Neither code exists under `core_custom`.
4. Readme names Postbox as INDE-6. INDE-6 `Web.config` sets `website` twice: `IEB (INDE-6 Local)`, then `IEB CRM`. The string "Postbox" is not the website title. INDE-2, INDE-4, and INDE-5 have the same second value `IEB CRM`.
5. INDE-3 and INDE-7 exist on disk (`website` = `IEB:: Website`) and are in the readme's DLL checklist, but they are not in the readme's named project list. INDE-7 has no `.sln`.
6. CLOS-1, REAP-1, SHEN-1, and SPAC-1 `website` values say `IEB (INDE-1 Local)`. CLOS-1, REAP-1, SHEN-1, and SPAC-1 catalogs include `Framework_INDE-1`. SCHO-1 uses the same website string and catalog `SchoolAdvisor`. Whether those folders are copies that were never retitled is **Unknown / Requires Confirmation**.
7. CHUU-1 website says Chuuz, while its catalogs are `Framework_GOPR-1` and `Framework_REAP-1`.
8. `sonar-project.properties` sets `sonar.projectKey=overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189`. The pipeline `EXTRA_ARGS` also pass `-Dsonar.projectKey=my-project`. Which key Sonar uses is **Unknown / Requires Confirmation**.
9. `silicon_ark/ieb-inde-1` technical notes record compilation `targetFramework="4.8"` for that snapshot. This tree's `core` and INDE-1 `Web.config` compilation target is 4.5.
10. `silicon_ark/SHOU-1` records BCrypt passwords and login lockout on `shou-1` `main` at `30a710c` (2026-09-22). This tree's `Admin_SignIn.aspx.cs` still compares an encrypted submitted password to `pal_User.password`, and still contains the hardcoded bypass described in `technical-documentation.md`.

## Human confirmation

- What "IEB" stands for, and which legal entity owns the tenant sites.
- Which tenant folders are still deployed, and whether production builds from this repository or from `ieb-inde-*` and `shou-1`.
- Whether the second `website` value (`IEB CRM` on INDE-2, INDE-4, INDE-5, INDE-6) is intentional.
- Whether INDE-8 and INDE-9 were never imported, or live only in another repository.
- What `feature/ieb-client-proposals` is supposed to change, and whether it should be merged.
- Whether the email-queue retry behaviour in `business-rules.md` is an accepted defect.
- Removal of committed secrets and the hardcoded sign-in bypass. Values are not repeated in these documents.