# Business rules — public-procon8.co.za Evidence date: 2026-10-06. Source revision: `f3f3b6d` (`master`). Rules below are only those visible in the repository. Marketing sentences are labelled **Documented** and are not treated as software rules unless the code enforces them. Rules deduced from control flow are labelled **Inferred**. There is no roles table, price list, or workflow engine. ## Identity and audience ### BR-001 — Public brand on the brochure The pages that `index.php` serves call the business PROCON8 CONSULTING SA and describe the audience as engineering, construction, and manufacturing, with rail and aviation called out on the home and about copy. Provenance: **Documented** (`index.php`, `aboutus.php`). Not enforced by code. `SLA.php` uses a different name, PROCON8 MANAGEMENT LIMITED. Provenance: **Documented** on that file only. Conflict: requires confirmation. ### BR-002 — Who may use the site Any visitor may read every menu panel and submit the contact form. The code has no login, role, or ownership check. Provenance: **Inferred** from the absence of authentication in application PHP. Confidence: High that no check exists. ## Enquiry rules ### BR-003 — Required contact fields (client) The browser script requires name, email, phone, and country. Email must match `/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i`. Provenance: **Implemented** in `contact_us_validate`. The same function also requires `frm.subject`. The form has no `subject` field. Comments are not required. Provenance: **Implemented** mismatch. See PRD edge cases. ### BR-004 — Server does not re-check required fields `thanks.php` HTML-escapes whatever was posted. It does not reject an empty name, email, phone, country, or comment. Provenance: **Implemented**. **Inferred** consequence: the client checks are not a security boundary. ### BR-005 — Captcha before send Mail is attempted only after Google `siteverify` returns `success == true`. Otherwise the script stops with "The reCAPTCHA wasn't entered correctly. Go back and try it again." Provenance: **Implemented** (`thanks.php`). ### BR-006 — Submit control must be present Inside the captcha-success branch, mail runs only when `contact_us_submit` is set. Provenance: **Implemented**. ### BR-007 — Inbox and subject The recipient is `support@procon8.com`. The email subject is the fixed string "Contact us". Visitor comments are labelled "Subject" inside the HTML body. They do not become the email subject. Provenance: **Implemented**. A commented line names `heinrich@overdrive.co.za` as an alternate recipient. It is not active. Provenance: comment only. ### BR-008 — Sender identity The live mailer sets From to `support@procon8.com` with the visitor's name as the display name, and sets Reply-To to the visitor. It does not send From as the visitor address. The backup `thanks.php.bak` does set From to the visitor address and uses PHP `mail()`. That file is not the live path. Provenance: **Implemented**. ### BR-009 — Acknowledgement copy Success text: "Your message was successfully sent! Thank you for contacting us, we will reply to your inquiry as soon as possible!" The promise to reply is **Documented** in that string. Nothing in the repository tracks a reply or a ticket. Failure text starts with "Email not sent." and includes the PHPMailer error. Provenance: **Implemented**. ### BR-010 — Field cleaning Posted name, email, phone, country, and comments are trimmed, `stripslashes`'d, and passed through `htmlspecialchars` before being placed in the HTML mail body. Provenance: **Implemented** (`check_input`). This is encoding for HTML, not a validation rule. ## Content rules (copy, not software) These are statements the site makes. The application does not calculate or enforce them. ### BR-011 — Experience claim About copy says each employee has a minimum of 15 years' relevant experience. Provenance: **Documented** (`aboutus.php`). Not implemented as a check. ### BR-012 — How engagements are described About copy says the company defines project-control and contract-management requirements with the project team, plans implementation, and drives setup to completion, using DMAIC, and that the contribution is best realised early in a project. Provenance: **Documented** (`aboutus.php`). ### BR-013 — Baseline timing Overview copy says the project baseline is developed within a reasonable period, typically three months after Notice to Proceed, and that the initial baseline changes only to include later approved changes. Provenance: **Documented** (`Overview.php`). ### BR-014 — Integration rule stated in copy Overview copy says scope, cost, schedule, change, and risk are integrated through one work breakdown structure. Provenance: **Documented** (`Overview.php`). ### BR-015 — Contract deviation categories Contract-management copy says deviations from the contract baseline may be categorised as recoverable or non-recoverable based on the contract. Provenance: **Documented** (`contract_management.php`). No code classifies a deviation. ### BR-016 — Critical issue definition Specialist-services copy defines a critical issue as one that affects the critical path now, or could affect it if left unattended, and says those issues are identified during schedule updates and reported at weekly meetings. Provenance: **Documented** (`specialist_services.php`). Not implemented here. ### BR-017 — Reference list meaning The reference page says the list is projects employees have been directly involved with, not a claim that PROCON8 contracted those projects as prime. GoldLinkQ appears under both rail projects and rail bids. Provenance: **Documented** (`reference_projects.php`). The wording "directly involved" is the page's own scope limit. ## Email disclaimer (file only) ### BR-018 — Disclaimer clauses `disclaimer.html` states: - The email is confidential and intended for the named recipient. Misdelivery should be reported to `postmaster@procon8.com`. - PROCON8 accepts no liability for viruses or for loss arising from using the email or attachments. - No employee or agent may conclude a binding agreement for PROCON8 by email without express written confirmation by "Alastair Davisdon" (spelling as in the file). - PROCON8 accepts no liability for the content unless it is later confirmed in writing. - Views are the author's. Defamatory statements and copyright infringement by email are outside employment. The employee is personally liable. Provenance: **Documented** in `disclaimer.html`. The contact email built by `thanks.php` does not append this file. The menu does not link to it. Whether mail clients still attach it is **Unknown / Requires Confirmation**. ## Access rules ### BR-019 — No application permissions There is no user, group, or row-level rule in this repository. Quantivia marketing copy says Quantivia has "user access restrictions". That sentence is about the other product. Provenance: **Inferred** for this site (no auth code). **Documented** for Quantivia on `dbr.php`, not implemented here. ### BR-020 — Dashboard page is unlisted `SLA.php` is not in `navigator_bar_options`. Anyone who knows the URL can request it. The iframe URL contains a `pagekey`. There is no additional gate in this repository. Provenance: **Inferred** from `content.php` and `SLA.php`. ## Navigation rules ### BR-021 — Panel ids A section's DOM id is its filename with "." removed. Deep links use `index.php?show=` plus that id. Provenance: **Implemented** (`index.php`, `common_functions.php`). ### BR-022 — Home panel is inline The first menu entry is not loaded from `index.php` as an include. `index.php` prints the home HTML itself and includes the other files. Provenance: **Implemented**. ## Rules that are not in this repository No prices, taxes, SLAs with response times, data-retention periods, or approval chains are defined in code. The filename `SLA.php` does not contain a service-level agreement; it embeds a dashboard.