# Project plan — neoafrica_qa

Evidence date: 2026-10-09.

Source repository: `git@bitbucket.org:overdrive/neoafrica_qa.git`.

Inspected revision: `main` at `3f8d683` (2026-06-19, Renier van Rooyen, "Merged in Test (pull request #53)"). The scan-host path `~/projects/sonar_scan/repos/neoafrica_qa` was not on this machine. The tree below was read from that git revision. Credential values are omitted.

This plan describes what the repository contains. It does not decide what the product should become.

There was no `silicon_ark/neoafrica_qa/` directory before this set.

## Product

The repository holds the **Legitimate Licences** system (assembly and membership application name **Neo Legitimate**), maintained as the Neo Africa QA codebase. It is a .NET Framework 4.6.2 back-office system for operating-licence, accreditation, route, vehicle, and e-hailing provider work used by National Public Transport Regulator (NPTR) and Provincial Regulatory Entity (PRE) staff.

Provenance: **Implemented** in `LegitimateLicences_QA/` (solutions, views, and SQL). The short product note in `LegitimateLicences_QA/README.md` only points at the e-hailing module. The environment checklist in `LegitimateLicences_QA/Environment_Readiness_Checklist.md` describes the wider system. Division IDs are **Documented** in `DBUp/Scripts/2026/121_Scholar_Contracted_Gazetting_Rule.sql`: PRE is `DivisionTypeID = 1`, NPTR is `DivisionTypeID = 2`.

The repository root also carries a Bitbucket Pipelines SonarQube scan. That scan is packaging around the product; it is not the product.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `main` (default; `origin/HEAD`) | `3f8d683` | 2026-06-19 | 147 commits from 2024-12-03 to 2026-06-19. Last change merges `Test` (pull request #53) |
| `origin/Test` | present | — | Integration line repeatedly merged to `main` in 2026 |
| `origin/dev` | present | — | Named development line. How it relates to `Test` after 2026-06-19 was not diffed |
| `origin/e-hailing` | present | — | Named feature line. E-hailing scripts and docs are already on `main` |

Many other remote branches exist (hotfixes, ticket merges, report and eNatis features). They were not each compared to `main`.

History, in outline:

- 2024-12-03 — Jaco Brits and Dewald Stander, initial commits.
- 2025-01 to 2025-04 — Dewald Stander and maanie: referrals, eNatis.
- 2025-05 onward through 2026-06 — Renier van Rooyen, Andile Dimba, Abdurahmaan Ismail, Dakalo, maanie: conversions, reports, scholar gazetting, e-hailing, inspection SMS, and repeated `Test` → `main` merges.

Commit counts by author name (names are not de-duplicated where the same person used two spellings): Renier van Rooyen 100, maanie 76, AndileDimba 50, Andile Dimba 29, dakalo 17, Abdurahmaan Ismail 13, Dakalo 10, Dewald Stander 6, Jaco Brits 3.

**Discrepancy:** the task-creation scan listed `repos/` and `sonarqube_scan.bat` at the repository root. Neither path is in git history. Provenance: **Unknown** — they may have been untracked files on the scan host. The root that is in git is `.gitignore`, `bitbucket-pipelines.yml`, `checklist.csv`, `LegitimateLicences_QA/`, and `sonar-project.properties`.

## Objectives (inferred from the implementation and the in-repo docs, not from a written plan)

- Run operating-licence and accreditation workflows for PRE and NPTR, including capture, verification, gazetting, inspection, adjudication, issue, and cancellation.
- Keep a register of members, associations, vehicles, routes, operating licences, and stationery.
- Register e-hailing app providers at NPTR, issue seven-year certificates, and expose a read-only registry to NPTR and PRE.
- Let PRE convert a metered taxi authority toward e-hailing (application type 63).
- Validate vehicles against eNatis and send SMS through Clickatell.
- Print and scan controlled stationery from a desktop client.
- Migrate historical OLAS, LTPS, and related data into the Legitimate database.

## Scope

### In scope of `main`

1. ASP.NET MVC web application `Neo.LegitimateLicences.Web`, plus the module projects it references (applications, licences, accreditations, gazette, consoles, reports, provider registry).
2. ASP.NET Web API `Neo.LegitimateLicences.Api` for print data, scan upload, and verified-licence XML lookup.
3. Windows service `Neo.LegitimateLicences.WinService` (Topshelf) that schedules database-defined jobs.
4. Desktop client `Neo.LegitimateLicences.Desktop`, updater, and ActiveX print/scan projects.
5. SQL Server schema evolution under `Neo.LegitimateLicences.Web/DBUp/Scripts/` (2024, 2025, 2026, and `Migration/`), applied at web startup when those scripts are embedded.
6. Shared Neo.Afx platform projects (workflow, documents, security, services) vendored in this tree. `RefreshAssembliesFromNeoAfxMaster.bat` copies binaries from a sibling `C:\Development\NeoAfrica\Neo.Afx` tree that is not in this repository.
7. Operator setup material: `Environment_Readiness_Checklist.md`, root `checklist.csv`, and `docs/EhailingProviders.md` plus `QA/TestPlan_EhailingProviders/`.
8. Bitbucket Pipelines SonarQube analysis on `main`, and three Azure DevOps YAML files aimed at a Neo Africa development build.

### Out of scope / not in this repository

- The Neo.Afx master source named by `RefreshAssembliesFromNeoAfxMaster.bat`.
- A public anonymous applicant portal. The web `Web.config` denies unauthenticated users.
- A written product roadmap, release calendar, or statement of which environment (dev, test, national production) `main` is deployed to.
- Live database contents. Scripts target a database named `LegitimateNational` in SQL and `LegitimateNATIONAL` in the checklist. See discrepancies.

## System architecture

```text
Staff browser
   |  Forms auth, Neo Legitimate membership
   v
IIS — Neo.LegitimateLicences.Web (.NET Framework 4.6.2, MVC 5)
   |-- module projects (applications, licences, gazette, consoles, reports, providers)
   |-- SignalR MessageHub (verification queue broadcast)
   |-- DbUp on Application_Start against ConnectionString
   |-- Sentry
   v
SQL Server
   |-- LegitimateNational (checklist name: LegitimateNATIONAL)
   |-- LegitimateKZN_LTPS (checklist; connection name LtpsEntities)
   |-- CLR assemblies (Neo.Afx.SqlServer and framework assemblies)
   |
Windows service DatabaseServiceScheduler (Topshelf, Local System)
   |  polls a Services table and runs configured workers (SMS, workflow triggers)
   |
Desktop + ActiveX (legitimatedesktop protocol)
   |  calls Neo.LegitimateLicences.Api
   v
API (CORS *, claims with UserID)
   |
External
   |-- eNatis HTTPS (vehicle lookup; certificate on disk)
   |-- Clickatell SMS (SmsVodazone)
   |-- Sentry
   |-- SonarQube (Bitbucket Pipelines on main only)
```

## Major components

| Component | Path | Role |
|---|---|---|
| Web | `LegitimateLicences_QA/Neo.LegitimateLicences.Web` | Staff UI, workflow host, DbUp |
| API | `LegitimateLicences_QA/Neo.LegitimateLicences.Api` | Print, scan, verified-data XML |
| Windows service | `LegitimateLicences_QA/Neo.LegitimateLicences.WinService` | Job host |
| Desktop | `LegitimateLicences_QA/Neo.LegitimateLicences.Desktop` | Print/scan client |
| AFX platform | `Neo.Afx.*` projects | Workflow, documents, security, messages |
| SQL | `DBUp/Scripts` | Schema, procedures, seeds |
| CDN | `Neo.LegitimateLicences.Cdn` | Static plugin assets (jQuery, DevExpress-era UI plugins) |
| Sonar | root `bitbucket-pipelines.yml`, `sonar-project.properties` | Code scan of this repo |

## Milestones visible in git (historical, not a forward plan)

| When | Evidence | What landed |
|---|---|---|
| 2024-12 | Initial commits | Repository created |
| 2025-01 to 2025-04 | Dewald / maanie commits | Referrals and eNatis |
| 2025-09 onward | `DBUp/Scripts/2025/0923_*` through `1150_*`, `docs/EhailingProviders.md` | NPTR e-hailing provider registration |
| 2025-11 / 2026-03 | type 63 script; PR #3 merged 2026-03-30 | Metered taxi to e-hailing conversion |
| 2026-03-31 | PR #4 | Commit message: make Professional Drivers Permit optional |
| 2026-05 to 2026-06 | PRs #11–#53 | Annexure fonts, referral period, scholar gazetting question, inspection SMS, Test merged to main |

No future milestone is written in the repository.

## Known dependencies

- .NET Framework 4.6.2, ASP.NET MVC 5.2.7, Web API, Entity Framework 6.2.0, SignalR 2.2.1, OWIN.
- DbUp 5.0.8 (SQL Server).
- DevExpress Web 19.1 (report handlers in `Web.config`).
- DigitalPersona `DPUruNet` for fingerprint capture.
- Topshelf for the Windows service.
- Sentry 4.6.0.
- Clickatell interop (`Interop.Clickatell`) behind `SmsVodazone`.
- SQL Server with CLR enabled, as required by the environment checklist.
- IIS for the web, API, AFX services, and CDN.
- A separate Neo.Afx build tree for `RefreshAssembliesFromNeoAfxMaster.bat`.
- SonarQube via Bitbucket pipe `sonarsource/sonarqube-scan:3.0.2`, using repository variables `SONAR_HOST_URL` and `SONAR_TOKEN`.

## Current project status

`main` is a snapshot merged from `Test` on 2026-06-19. The e-hailing provider module is documented and scripted on that snapshot, including known MVP limits (no live suspension API, return-for-correction email not wired, no QR on the certificate). Automated test projects exist (`Neo.LegitimateLicences.Api.Test`, `Neo.Afx.WinService.UnitTests`). The Bitbucket pipeline on `main` runs SonarQube only. It does not build or test.

Which branch is deployed to which environment is **Unknown / Requires Confirmation**.

## Discrepancies

1. Scan listing included `repos/` and `sonarqube_scan.bat`. They are not in git.
2. Checklist database name `LegitimateNATIONAL` versus SQL `USE [LegitimateNational]`. SQL Server collations are often case-insensitive, so these may be one database. **Requires confirmation.**
3. `azure-pipelines.yml` triggers on `master`. The default branch is `main`. The three `NeoAfricaDevelopment*.yaml` files reference undefined pipeline variables.
4. `Environment_Readiness_Checklist.md` and root `checklist.csv` contain credential material (database, eNatis certificate, eNatis account). Values are omitted here. **Human review:** treat them as exposed if they were ever real, and do not copy them into further docs.
5. E-hailing doc `docs/EhailingProviders.md` still says feature code names `NPTR_EhailingProviderRegistration` for types 60–62. Script `1103_Update_NPTR_ApplicationRequestTypes_RemovePrefix.sql` renames the stored titles and drops the `NPTR:` prefix. Both can be true at different layers (code constant versus display title). **Requires confirmation** which label the UI shows after all scripts run.
6. Windows service install path differs: checklist section 3 says `C:\Installs\LegitimateLicense\`; `checklist.csv` says `C:\Applications\Legitimate Licences Windows Service`.

## Items requiring human confirmation

- Whether operators (applicants) ever sign in, or only regulator staff do.
- Production, test, and dev host names, and which git branch each environment runs.
- Whether seeded application fees in the OLAS migration are still the live tariff.
- Whether every SQL file under `DBUp/Scripts` is an embedded resource that startup actually runs.
- Whether committed secrets in the checklist are still valid.
- The role of the KZN LTPS database versus the national database in day-to-day work.
- Whether `origin/dev` and `origin/e-hailing` still contain work that is not on `main`.