# Project plan — knowmore_current (Knowmore)

Evidence date: 2026-10-11.

Source repository: `git@bitbucket.org:overdrive/knowmore_current.git`.

Inspected default branch: `master` at `98e19240` (2025-04-04, "Repo update", rachelmogano). `origin/HEAD` points at `master`. History on `master` has 43 commits, from 2022-09-20 through 2025-04-04.

This plan describes what the repository contains. It does not decide what the product should become. There was no prior Silicon Ark folder for this repository.

Related Silicon Ark folders document different remotes and are not evidence for this tree:

- `knowmore_php84/` — `knowmore_php84.git`, `master` tip 2020-10-19.
- `knowmorescan/` — `knowmorescan.git`, `master` tip 2022-06-02.

## Product

**Knowmore** is an online learning and business-tools site for financial planners, support staff, and business owners in the South African financial profession.

Provenance: **Documented** on the static page `about.html` (Open Graph description and visible headings) and `terms-and-conditions.html`.

The terms page states that products and services provided to financial planners and support staff in South Africa include business-management services, online training courses, access to workshops and seminars, and publications and newsletters relevant to the financial services industry, subject to availability.

The privacy policy names the owner of KnowMore as **Old Mutual Wealth (Proprietary) Limited**, registration number 2011/134187/07. The terms page says the trademark and `www.knowmore.co.za` are owned by that company and operated via its subsidiary, Old Mutual Wealth Services Company (Pty) Ltd, and that references to the Website or KnowMore in the terms mean that subsidiary. Provenance: **Documented**.

The static footer credits **Silicon Overdrive** (`https://www.overdrive.co.za/`) and a copyright line "Knowmore © 2024". Public contact on that footer: `info@knowmore.co.za` and the printed number `+21 524 4669`. The contact page address is Old Mutual Wealth, Jan Smuts Drive, Mutualpark, Pinelands, 7495, Cape Town, South Africa. Provenance: **Documented** in `about.html` / `privacy-policy.html` / `contact-us.html`.

Older PHP still speaks as **Celestis**. `contact.us.php` invites the reader to "Let Celestis put you on track", lists Skype `CelestisBB`, telephone `+27 21 5244 668`, and postal address PO Box 856, Howard Place, 7450. A commented sample in `webadmin/cron.daily.php` names Celestis as the firm running a client survey. Provenance: **Implemented**. Whether Celestis is a former brand is **Unknown / Requires Confirmation**. The two telephone strings do not match. Which number is current is **Unknown / Requires Confirmation**.

## Branch reality

| Branch | Tip | Relative to `master` |
|---|---|---|
| `master` | `98e19240` 2025-04-04 | Default. This document set treats this tree as the implemented baseline |
| `origin/uriel_sso_changes` | ancestor of `master` | 0 commits that are not already on `master`. `master` is 6 commits ahead (`4cd71829` through `98e19240`) |

`uriel_sso_changes` is not an unmerged line. SSO work was merged into `master` through merges `ad118f8a`, `6db2ba3d`, and `97b5cf27`.

History, compressed:

| When | What the commits record |
|---|---|
| 2022-09-20 | Initial commit, then separate first commits for training, webadmin, and WordPress files (Rachel Mogano) |
| 2022-12 | PHP 8 upgrades, login updates, SSO login page, FIM PHP 8 fixes (Rachel Mogano, Uriel Balela) |
| 2023-02 to 2023-11 | Page flow, then PHP 8.2 updates across tools, training, and webadmin |
| 2024-02 | Further PHP 8.1 / 8.2 commits |
| 2024-08 | Azure AD integration and Azure AD config updates |
| 2024-09-02 to 2024-09-05 | Repo cleanup and removal of WordPress core (`wordpress removal`, `wp-content removal`, `wp-includes removal`, `wp-admin removal`) |
| 2024-09-17 to 2024-09-18 | WordPress page cleanup, OAuth2 library debug removal, AWS S3 changes, merge of `uriel_sso_changes` |
| 2024-09-26 to 2024-10-02 | HTML updates, Bitbucket Pipelines, `sonar-project.properties` |
| 2025-04-04 | `98e19240` "Repo update": training course/assignment/module screens, webadmin course and learner classes, `webadmin/system.php`, a banner image |

No project plan, README, or requirements document exists in the repository. `license.txt` is present. Two root files named `readme.<hash>.html` are WordPress readme exports, not a product README.

## Objectives (inferred from the modules, not from a written plan)

- Publish the Knowmore marketing site (now a static HTML export of the former WordPress/Elementor site).
- Register and sign in learners, enrol them on courses, workshops, and publications, and track modules, assignments, forums, and CPD points.
- Give practices online tools: Business Assessment (including BAT 2020), client satisfaction survey, gap analyses, invoices, and PDF/Excel output.
- Operate a Nemo `webadmin` for learners, courses, modules, practices, licences, invoices, email, vouchers, workshops, and security groups.
- Send scheduled course, survey, licence, AML, and IBC emails from cron scripts.
- Offer Old Mutual single sign-on beside the password form. The callback in this tree does not create a learner or admin session. See the PRD.
- Deploy `master` by FTP from Bitbucket Pipelines.

## Scope in this repository

In scope of `master` at `98e19240`:

- Static public HTML at the repository root (`index.html`, `about.html`, course and tool marketing pages, legal pages, `login.html`, `register.html`) plus exported CSS under `css/` and images under `images/`.
- Learner area under `training/` (40 PHP files).
- Nemo web admin under `webadmin/` (165 PHP files), including cron scripts and the Nemo class family.
- Business-tool engines under `tools/` (564 PHP files), including a nested older `tools/webadmin/`.
- Shared layouts under `layouts/` and small modules under `modules/`.
- OAuth start and callback scripts at the root (`bootstrap.php`, `init_oauth.php`, `authorize.php`, `process_auth_code.php`) and an Azure AD sample under `phpazure/`.
- File-integrity monitor under `fim_2.0/`.
- Composer dependencies under `vendor/` (`league/oauth2-client` 2.6.0, `vlucas/phpdotenv` 5.3.0, Guzzle 7.3.0).
- `training7.4/` content directories (`dcontent`, `profilepictures`, `webadmin7.4`). This folder contains no PHP.
- Pipeline and Sonar files: `bitbucket-pipelines.yml`, `sonar-project.properties`.

Out of scope of this repository, or removed from it:

- WordPress core (`wp-admin`, `wp-includes`, `wp-content`). Commit messages from 2024-09-02 through 2024-09-05 record the removal. CSS and HTML class names from that export remain.
- The Wordfence WAF file named by `.user.ini`. The prepend path is `/usr/www/users/knowmvpnxm/wordfence-waf.php`. That file is not in git.
- The MySQL server. Connection targets are hardcoded in `webadmin/system.php`. Passwords are in that file and are omitted from these documents.
- A `.env` file. `bootstrap.php` calls Dotenv `load()` on the repository root. No `.env` is committed.
- The FTP host used by Pipelines. The host, user, and password are pipeline variables (`FTP_HOST`, `FTP_USER`, `FTP_PWD`), not values in git.
- Crontab entries. Cron PHP scripts exist. Nothing in git says which host runs them or on what schedule.
- Automated tests. Files named `test` under `tools/` are debug scripts, not a test suite.

## System architecture

One PHP application plus a static public site, both intended to be served from the same host (`www.knowmore.co.za` in the HTML canonical URLs and in the live database key).

```text
Browser
  ├─ Static HTML export (former WordPress / Elementor / GeneratePress)
  ├─ login.php / register*.php / contact.us.php          password and registration
  ├─ init_oauth.php → external authorize URL → authorize.php
  │                                              prints the identity response and stops
  ├─ training/                                        learner session LEARNER
  ├─ webadmin/                                        admin session USER + security group
  └─ tools/                                           advisor session ADVISOR
        │
        ├─ MySQL, chosen by HTTP host in webadmin/system.php
        ├─ SMTP settings from the sysSettings table
        ├─ CloudFront host d1ogvodmq23438.cloudfront.net for s3:// URLs
        └─ cron PHP scripts (daily, hourly, weekly, FIM) invoked outside this repo
```

Deployment of `master` is `git ftp push` from Bitbucket Pipelines. A SonarQube step is declared and not used by that pipeline.

## Major components

| Component | Role | Evidence |
|---|---|---|
| Static site | Marketing, legal, login shell | Root `*.html`, `css/`, `images/` |
| Nemo learner area | Courses, workshops, publications, CPD, assignments, forums | `training/` |
| Nemo web admin | Back office, email templates, cron, security groups | `webadmin/` |
| Practice tools | BAT, surveys, gap analyses, invoices, payments | `tools/` |
| Password framework | Salted SHA-256, history, reset-link expiry | `webadmin/_nemo.password.cls.php` |
| OAuth (Ping-named settings) | Authorization-code + PKCE start and token exchange | `bootstrap.php`, `init_oauth.php`, `authorize.php` |
| Azure AD sample | Graph/OAuth classes reading the same settings table | `phpazure/` |
| AWS helpers | S3 put and CloudFront URL rewrite | `webadmin/aws.functions.inc.php` |
| FIM | File-integrity cron | `fim_2.0/fim.cron.php` |
| Pipeline | FTP deploy of `master` | `bitbucket-pipelines.yml` |

## Milestones visible in git

There is no milestone plan in the repository. The commit subjects above are the only milestone evidence. Provenance: **Implemented** as history, not as a documented roadmap.

Nothing in the tree describes work planned after `98e19240`.

## Known dependencies

- PHP. Commit subjects from 2022-12 through 2024-02 say PHP 8, PHP 8.1, and PHP 8.2. `composer.json` does not constrain a PHP version. The production interpreter is **Unknown / Requires Confirmation**.
- MySQL, via `mysqli` in `webadmin/system.php`.
- Composer packages listed above. `aws_put_file()` constructs `Aws\S3\S3Client`, and `aws/aws-sdk-php` is not in `composer.json` or `vendor/`.
- An external OAuth authorization server. Setting keys are `PING_CLIENT_ID`, `PING_CLIENT_SECRET`, `PING_REDIRECT_URI`, `PING_AUTHORIZE_URL`, `PING_ACCESS_TOKEN_URL`, `PING_RESOURCE_OWNER_DETAILS_URL`, `PING_SCOPE`, `PING_AUTHORIZATION_CODE_METHOD`, `PING_CHALLENGE_METHOD`. Values live in system settings, not in git.
- SMTP, SMS (`smsUsername`, `smsPassword`, `smsLive`), and reCAPTCHA keys, all read from system settings.
- Netcash and PayGate scripts under `tools/`. `tools/purchase.netcash.php` exits on the first executable line after its includes (`print_rr('yes include'); die;`).
- `git-ftp` and an FTP account, used only in Pipelines.
- Optional SonarQube (`SONAR_HOST_URL`, `SONAR_TOKEN`). The scan step is not wired to `master`.
- Wordfence, if the host still applies `.user.ini`. The WAF file is outside this repository.

## Current project status

The repository is a maintained snapshot of the Knowmore application after WordPress core was removed and a PHP 8.2 pass and an OAuth experiment were added. The last commit is 2025-04-04. No open branch contains commits that `master` does not already have.

What is running at `https://www.knowmore.co.za/` on the evidence date was not checked over HTTP. Whether this tree is the deployed tree is **Unknown / Requires Confirmation**.

## Human confirmation

1. Is `master` at `98e19240` what is deployed to `www.knowmore.co.za`?
2. Which OAuth server is production: the Ping-named settings, the Azure AD classes under `phpazure/`, or neither?
3. Should the public "LOGIN WITH OLD MUTUAL SSO" control be considered a shipped feature? The link target `oauth/init_oauth.php` is not in the tree, and `authorize.php` does not open a learner or admin session.
4. Is Celestis a retired brand, and which contact telephone is current?
5. Are the hardcoded database passwords in `webadmin/system.php` still valid, and should they be removed from git? Values are intentionally not copied here.
6. Is the PHP runtime 8.2, as the 2023–2024 commit subjects say?
7. Who invokes the cron scripts, and on what schedule?
8. Should the CPD "current" window, hardcoded as 2024-06-01 to 2025-05-31 in `training/my.cpd.points.php`, have been rolled forward? On the evidence date that window is in the past.