# PRD — public-quantivia.com

Evidence date: 2026-10-06. Source: `git@bitbucket.org:overdrive/public-quantivia.com.git`, `master` at `9e3c6f2` (2020-08-27, "initial commit of full repository").

There is no prior PRD in this Silicon Ark directory and no product README in the repository. Requirements below come from the PHP pages, `js/scripts.js`, `sitemap.xml`, and `mail/`. Provenance is marked on each item.

This repository is the **public website**. It does not contain the Quantivia application. Application behaviour is documented separately under `silicon_ark/quantivia/`, `quantivia-clean/`, `quantiviaLive/`, and `quantivia-svn/`.

The root pages are the set named by the navigation and by `sitemap.xml`. `website_new/`, `returned/`, and `index_new.php` are other copies stored in the same commit. Requirements below are for the **root** pages unless a requirement says otherwise.

Whether this commit is what `www.quantivia.com` serves is **Unknown / Requires Confirmation**.

## Product purpose

Quantivia, as described on the site, is project-management software for organisations that need to measure deliverables, report progress and cost, and forecast from past trends. The published audience is medium to large companies in engineering, construction, manufacturing, rail, aviation, and infrastructure (`explanation.php`).

The site's job is to explain the product, show case studies, publish prices as "on request", and collect demo, contact, and download leads.

Provenance: **Documented** (`index.php`, `why_quantivia.php`, `explanation.php`).

`why_quantivia.php` says the product was started by three unnamed colleagues for their own consulting on mega-infrastructure projects, and that it is now used worldwide. Counts on that page: 25+ global companies, $22b+ budgets, 7m+ man hours, 13k+ deliverables. `casestudy.php` states 10,000+ project deliverables. The two counts are not reconciled. Provenance: **Documented**. Whether the figures are still accurate is **Unknown**.

Footer copyright: © Copyright 2016 Procon8 (`footer.php`). Provenance: **Documented**.

## Users and roles

| Role | What they do | Evidence | Provenance |
|---|---|---|---|
| Anonymous visitor | Reads pages. No account | All public PHP pages | Implemented |
| Prospect | Submits a contact, demo, or download form | `contact.php`, `form.php`, `viewdemo.php`, `download.php` | Implemented |
| Sales recipient | Receives form email | `mail/lib/mail_sender.php` addresses `info@quantivia.com` and `alastair.davidson@procon8.com` | Implemented |
| Demo user | After a successful mail response, the browser opens the external demo | `js/scripts.js` redirect | Implemented as a redirect only. The demo application is not in this repo |
| Customer buying a license | Described in the FAQ as completing a card payment and receiving a license number | `support.php` | **Documented** on the FAQ. **Not implemented** in this repository |

There is no staff login, no member area, and no permission model in this site.

Published contact details (`header.php`, `form.php`, `contact.php`):

- Address: 18 – 20 Le Pollet, St Peter Port, Guernsey, GY1 1WH
- Email: info@quantivia.com
- Europe: +44 (0)745 203 4633
- USA: +1 (0) 915 229 3160
- Africa: +27 (0)79 498 9114

## Main workflows

### W1 — Read the product story

Trigger: visitor opens `http://www.quantivia.com/` (links are absolute in `header.php`).

Steps shown on `index.php`:

1. Hero "meticulously measured", with a YouTube modal (`https://www.youtube.com/embed/E9wpku9WseE`).
2. Three blocks: Measure, Report, Deliver.
3. Buttons "Take a Tour" → `demo.php`, and "View a demo version" → `viewdemo.php`.
4. Client logos and a quote attributed to Dave Bush, BACS Consortium, Riyadh Metro Project.
5. "Latest updates": Multiple Project Review (May 2016 copy, also on `demo.php`).
6. A band linking to the Durban Resignalling case study.
7. The shared contact block `form.php`.

Navigation (`header.php` / `header_inner.php`): Home, key features (`demo.php`), Why Quantivia, View live Demo (`viewdemo.php`), Pricing, Customer Success (`casestudy.php`), support. "Live Status" (`status.php`) is in the menu with `style='display:none;'`.

Provenance: **Implemented**.

### W2 — Ask for contact or a consultant demo

Trigger: visitor submits `form.form-email` on `contact.php` or on the home block `form.php`.

`contact.php` is titled "Arrange A Demo". Inputs:

| Field | Name | Required by `validateFields` |
|---|---|---|
| Name | `name` | Yes (`.validate-required`) |
| Email | `email` | Yes, and must match `/(.+)@(.+){2,}\.(.+){2,}/` |
| Company | `website` | No |
| Comments | `message` | No on `contact.php`. Yes on `form.php` |
| How they heard | `referrer` | No. Options: Default, google, website, friend, other |

`js/scripts.js` also appends a hidden `referrer` from the `ref` query parameter onto `form.form-email` when the page loads (around the `getURLParameter("ref")` call). A visitor can therefore post two `referrer` fields. Provenance: **Implemented**.

On valid submit the browser POSTs the serialised form plus `url=<current page>` to `mail/mail.php`.

Success: the response is numeric and greater than 0. The form shows `data-success` ("Thanks for taking the time to complete the planner…" on `contact.php`; "Thanks for your submission, we will be in touch shortly." on `form.php`). Fields are cleared. There is no `success-redirect` on these forms.

Failure: non-numeric response text is shown in `.form-error`. HTTP failure shows the HTTP error text. Empty required fields add `.field-error` and show `data-error`.

`mail/lib/mail_sender.php` emails every POST field, one per line, to:

- info@quantivia.com ("INFO Quantivia")
- alastair.davidson@procon8.com ("Alastair Davidson")

Subject from `mail/mail.php`: "Quantivia Project Management Website Request". From address, when `email` and `name` are present: `info@quantivia.com` with the visitor's name as the display name. Reply-To header: `Name<email>`.

Provenance: **Implemented**.

`form.php` body text says the questions are about **Procon8**, not Quantivia. Provenance: **Documented** on that include. **Requires Confirmation** whether that wording is still intended.

### W3 — Open the live demo

Trigger: visitor submits `form.demo-email` on `viewdemo.php`.

Inputs: First Name (`name`), Last Name (`LastName`), Email (`email`), hidden `list` set to `$_SERVER['REMOTE_ADDR']`.

Those inputs do **not** have `validate-required` or `validate-email`. `validateFields` therefore does not block an empty submit. Provenance: **Implemented**.

The same mail POST as W2 runs. If the response is numeric — including a numeric zero, because the redirect sits outside the `parseInt(response) > 0` check — the browser goes to:

`https://demo.quantivia.com/auto_login.php?demo=true`

Provenance: **Implemented** (`js/scripts.js`).

`thanks.php` is a separate thank-you page. It links to `https://demo.quantivia.com/auto_login.php?demo=ref`. Nothing in the root scripts navigates to `thanks.php`. Provenance: **Implemented** as a page. What links to it is **Unknown**.

The demo application is not in this repository. Related documentation: `silicon_ark/quantivia-clean/` describes a demo tree for `demo.quantivia.com` with `auto_login.php?demo`.

### W4 — Request the download

Trigger: visitor submits the form on `download.php`.

The form is a normal browser POST, not `form.form-email`. No client-side required check is on the fields.

| Input | Name |
|---|---|
| First name | `name` |
| Last name | `LastName` |
| Email | `email` |
| Hidden list id | `list` = `DwvWej120xMqsls0AYn6Xw` |

Action: `http://send.cotomo.com/subscribe` (Cotomo). Method POST.

The page says the visitor will receive an email directing them to the download page. That email is not generated by this repository. Provenance: **Documented** on the page. Delivery depends on Cotomo. **Unknown** whether that list still exists.

`download_thanks.php` tells the visitor the file is just under 200 MB and links to `http://www.quantivia.com/Quantivia_Setup.exe`. The executable is not in git. Nothing in this tree redirects `download.php` to `download_thanks.php`. Provenance: **Implemented** as a page and a link. The hand-off from Cotomo to that page is **Unknown**.

### W5 — Read pricing and enquire

Trigger: visitor opens `prices.php`.

The page states three licensing types and two payment options for Project and Corporate:

| Offer on the page | Price shown | Next step |
|---|---|---|
| Desktop, per user. Local install. No enterprise tools (Risk and task tracking named in the intro). Not recommended for large projects | On Request | `contact.php` |
| SaaS, per user. Hosting is provided. No license ownership and therefore no SLA | On Request | `contact.php` |
| Outright purchase, per license. Customer keeps rights to use the software and may customise with the team. SLA for updates is not included | On Request | `contact.php` |

User bands in the introduction: Desktop; Project up to ten users; Corporate more than ten users. The three cards are Desktop, SaaS, and Outright purchase. Project and Corporate are not separate cards.

Provenance: **Documented** and **Implemented** as page content. No price figure and no checkout are implemented.

`website_new/prices.php` is an older wording of the same three cards. Its "Get Started" links are `href="#"` and do not open `contact.php`. It also says a Corporate outright license includes API access with PROCON8. That API sentence is not on the root `prices.php`. Provenance: **Documented** in `website_new` only.

### W6 — Read customer stories

Trigger: visitor opens `casestudy.php`.

Three studies:

| Card | Page | Parties named on the page |
|---|---|---|
| Durban Resignalling Project | `durban_resignalling_project.php` | Bombardier Africa Alliance (Basil Read, Bombardier Transportation, ERB Technologies, R&H Rail, Tractionel Enterprise, SIMS). Client: PRASA. Quantivia implemented December 2013 |
| Riyadh Metro Project (RMP) | `riyadh_metro_project.php` | BACS Consortium. Quote: Dave Bush |
| Rolling stock for S-Bahn Hamburg | `s_bahn_hamburg.php` | Bombardier Transportation. Quote: Dave Barry |

Provenance: **Documented** and **Implemented** as pages.

`explanation.php` also names Parsons, Mitsubishi, Systra, Hyundai, Samsung, Siemens, CCC, CH2M, KBR, Aurecon, Worley Parsons, Fluor, Parsons Brinkerhof, Gibb, Louis Berger, Carillion, Stadler Rail, Ruag, Transnet, and PRASA, and links several of those names to `casestudy_bombardier.php` or `casestudy_rtp.php`. Those two files are **not in the repository**. Provenance: **Implemented** as broken links.

### W7 — Read support answers

Trigger: visitor opens `support.php`.

The page is an accordion of 14 questions. Answers are static HTML. Nothing is loaded from a knowledge base. Full answer text is the business-rule source in `business-rules.md`.

Provenance: **Documented** and **Implemented** as content.

The FAQ describes a purchase and download flow that the rest of the site does not implement. See FR-012.

## Functional requirements

### FR-001 — Public pages render without a login

The site serves marketing pages to any visitor. No session is started in the root PHP files that were read.

Evidence: page sources under the repository root. Implementation: **Implemented**. Confidence: High.

### FR-002 — Shared navigation and footer

Home uses `header.php` (transparent nav). Inner pages use `header_inner.php`. Both include `analyticstracking.php` and the same menu. Every page that was read closes with `footer.php`.

Footer links: Home, About (`why_quantivia.php`), Features (`demo.php`), Pricing, "View a live demo" (also `demo.php`), FAQ (`support.php`), Contact. LinkedIn company follow widget id `9295426`. Copyright 2016 Procon8.

Evidence: `header.php`, `header_inner.php`, `footer.php`. Implementation: **Implemented**. The footer demo label does not match the menu demo URL. Confidence: High.

### FR-003 — Contact and demo-request email

A valid `form.form-email` submit emails the posted fields to the two addresses in `mail_sender.php`.

Validation is client-side only. `mail/lib/mail_sender.php` does not check required fields, email format, or origin. It writes every POST key into the body, sets HTML mode, and echoes the boolean result of `PHPMailer::send()`.

Evidence: `contact.php`, `form.php`, `js/scripts.js`, `mail/mail.php`, `mail/lib/mail_sender.php`. Implementation: **Implemented**. Confidence: High.

Error conditions:

- Missing required fields: browser shows `data-error` and does not POST.
- SMTP failure: PHPMailer 5 `send()` returns false unless exceptions are enabled. `echo(false)` prints an empty string, which is not numeric, so the form shows an empty error. An exception message, if thrown, is shown as the error text.
- `setFrom` runs only when both `email` and `name` are set. If they are absent, no From address is set before send.

### FR-004 — Live demo hand-off

After `form.demo-email` receives a numeric mail response, the browser navigates to `https://demo.quantivia.com/auto_login.php?demo=true`.

The form posts the visitor IP in `list`. The mail body therefore includes that IP because every POST field is copied into the email.

Evidence: `viewdemo.php`, `js/scripts.js` lines that handle `form.demo-email`. Implementation: **Implemented**. Confidence: High.

The fields are not marked required. An empty demo request can still be posted. Confidence: High.

### FR-005 — Download lead via Cotomo

`download.php` posts name, last name, and email to Cotomo list `DwvWej120xMqsls0AYn6Xw`.

Evidence: `download.php`. Implementation: **Implemented** as a form. Cotomo's response is **Unknown**. Confidence: High for the form, Low for delivery.

### FR-006 — Installer link

`download_thanks.php` offers `http://www.quantivia.com/Quantivia_Setup.exe` and states the file is just under 200 MB. `support.php` says the install file is about 200 MB and that 2 to 3 GB of disk is required.

Evidence: those two files. The binary is not in git. Implementation of the link: **Implemented**. Existence of the file on the server: **Unknown**.

### FR-007 — Pricing display

Prices are the words "On Request". Calls to action open `contact.php`. No amount, currency, or tax is shown.

Evidence: `prices.php`. Implementation: **Implemented**. Confidence: High.

### FR-008 — Feature catalogue is editorial

`demo.php` lists benefits, features, and "what's new" as HTML. It does not query the application.

Features named: interactive dashboard; S-curves, Pareto, bull's-eye charts; summary and detailed tabular reports; rules of credit and unlimited chains; integrated calendar; user access restrictions; help; change control; integrated actions and risk register; "customisation not configuration".

What's new: trend charts; data-integrity checking through tables; wizards for up/downloading; budget reconciliation; resource planning module. A separate May 2016 paragraph describes Multiple Project Review.

Evidence: `demo.php`, `index.php`. Provenance: **Documented**. These behaviours are not executable in this repository.

### FR-009 — Case studies

Three case-study pages are linked from `casestudy.php` and from the sitemap. Content is static HTML.

Evidence: `casestudy.php`, `durban_resignalling_project.php`, `riyadh_metro_project.php`, `s_bahn_hamburg.php`. Implementation: **Implemented**. Confidence: High.

### FR-010 — Support FAQ

`support.php` shows 14 accordion answers. See `business-rules.md` for the rules those answers state.

Evidence: `support.php`. Implementation: **Implemented** as content. Confidence: High.

### FR-011 — Hidden live status

`status.php` embeds two iframes:

- `http://156.38.136.112:9090/publishPage.do?method=getPublishedDashboard&pagekey=04fb46dd38deb69e86e66eaed2307bc2&template_resid=10000140`
- `http://156.38.136.112:9090/publishPage.do?method=getPublishedDashboard&pagekey=6842b2f451f105ff779ef3c685e3dd05`

The menu item is hidden. The page is not in `sitemap.xml`.

Evidence: `status.php`, `header.php`. Implementation: **Implemented** but not offered in the visible menu. Whether the dashboards still publish is **Unknown**.

### FR-012 — Purchase described in the FAQ is not built here

The FAQ says a visitor pays by credit card on the website, is forwarded to download links after payment is verified, receives a license number by email, and receives the license file within 12 hours. It also says clicking a Quantivia link only opens a transaction page, and that terms must be accepted before purchase.

No payment form, gateway, terms page, or license mailer is in this repository. Pricing sends the visitor to the contact form.

Provenance: **Documented** on `support.php`. **Not implemented** in this tree. **Requires Confirmation** whether checkout lived on another host.

### FR-013 — Analytics and verification files

Each header includes Google Analytics `UA-82505981-3` (`analyticstracking.php`). `google4733d946ea073d91.html` is a Google site-verification file. `BingSiteAuth.xml` is a Bing verification file. `robots.txt` is `User-agent: *` / `Disallow:` with an empty disallow, so it does not block crawlers.

Evidence: those files. Implementation: **Implemented**. Confidence: High.

### FR-014 — News and newsletters

Static HTML newsletters: `march_newsletter.html`, `may2016_newsletter.html`, `september2016_newsletter.html`. They are listed in `sitemap.xml`.

`news/multi-database.php` is an article contrasting single-database and multi-database project/finance systems. It includes `header_inner.php` by a relative path. The header file is in the repository root, not in `news/`. Whether PHP's include path makes that succeed is **Unknown**.

`news/contruction_project_management.php` (spelling as stored) is a short article "What Is Construction Project Management (CPM)?" dated "September 8th" with no year. It includes `/header_inner.php` (leading slash), which is an absolute filesystem path, not a URL under the site.

Evidence: those files and `sitemap.xml`. Implementation: **Implemented** as files. The news includes are likely broken. Confidence: Medium on runtime, High on the source as written.

### FR-015 — Other root pages

| Page | Behaviour |
|---|---|
| `why_quantivia.php` | Origin story and the 25+ / $22b+ / 7m+ / 13k+ figures |
| `inspiration.php` | Embeds Pinterest board `https://za.pinterest.com/cotomo/dashboards/` |
| `testimonials.php` | PHP array of two quotes (Dave Bush, Dave Barry). Included by `index_new.php` and `returned/index.php`, not by `index.php` |
| `explanation.php` | Keyword-style summary and company name list, including links to missing case-study files |
| `404.html` | Static 404 page |
| `new.html`, `test.html` | Present. Not in the menu or the first sitemap URLs that were read. Role **Unknown** |

## Integrations

| System | Direction | Trigger | Data | Auth | Failure |
|---|---|---|---|---|---|
| Amazon SES SMTP `email-smtp.eu-west-1.amazonaws.com:587` TLS | Outbound | POST `mail/mail.php` | All POST fields, subject "Quantivia Project Management Website Request", SES configuration set `ConfigSet_www_quantivia_com` | SMTP username and password hardcoded in `mail/mail.php`. Values omitted | `send()` false or exception text returned to the browser |
| Cotomo `http://send.cotomo.com/subscribe` | Outbound browser POST | `download.php` submit | name, LastName, email, list id | None in this repo | Browser shows Cotomo's response. Not handled in this code |
| `demo.quantivia.com` | Browser redirect | Numeric response from the demo form | Query `demo=true` | Not in this repo | If mail does not return a number, the redirect does not run |
| YouTube | Embed | Home play button | Video `E9wpku9WseE` | None | Player fails on its own |
| Google Analytics | Browser beacon | Every page that includes the header | Property `UA-82505981-3` | None | Script failure is silent |
| LinkedIn | Widget | Footer | Company `9295426` | None | Widget failure is silent |
| Pinterest | Embed | `inspiration.php` | Board `za.pinterest.com/cotomo/dashboards` | None | Embed failure is silent |
| Dashboard host `156.38.136.112:9090` | iframe | `status.php` | Two published page keys | None in the URL | Iframe stays empty if the host refuses |
| Google Fonts | Stylesheet | Header | Lato, Raleway, Open Sans over `http://` | None | Fonts fall back |
| Installer URL | Link | `download_thanks.php` | `Quantivia_Setup.exe` | None | 404 if the file is not deployed |

Commented recipients in `mail_sender.php` (`heinrich@albatroscs.co.za`, `heinrich@overdrive.co.za`) are not passed to `addAddress`. Provenance: **Implemented** as comments only.

`website_new/mail/mail.php` is a different, older configuration (SMTP host `www.procon8.co.za`, port 25, recipient name "John Doe"). It is not what the root pages call. Credentials in that file are omitted here.

## Constraints

- No server-side validation or CSRF token on `mail/mail.php`. Any client that can reach the script can POST.
- SMTP secrets are in git. They must not be copied into documentation or new commits. Rotation is a human action.
- The mail script echoes send results and can echo exception text to the browser.
- Prices, license rules, and operating-system rules are copy. They are not enforced by this site.
- The site records a visitor IP only on the demo form, inside the emailed body.
- Pages mix `http://www.quantivia.com` links with protocol-relative and root-relative asset URLs.

## Edge cases

| Case | Behaviour in this tree |
|---|---|
| Empty contact form | Client validation blocks submit when `.validate-required` is empty |
| Empty demo form | Not blocked. Fields have no validate classes |
| Empty download form | Not blocked. Native POST to Cotomo |
| Duplicate submits | Demo and contact scripts disable the button while the request runs. No server-side idempotency key |
| Mail transport down | Form shows the non-numeric body or HTTP error. No retry queue |
| `email` or `name` missing on a request that still reaches PHP | `setFrom` is skipped. Reply-To still reads `$_POST['name']` and `$_POST['email']` with no `isset` check |
| Sitemap URL `why_www.quantivia.php` | File does not exist |
| `casestudy_bombardier.php`, `casestudy_rtp.php` | Linked from `explanation.php`. Files do not exist |
| `news/*.php` headers | Includes do not point at the root header in a way that is reliable (see FR-014) |
| Live Status | Reachable by URL, hidden in the menu |
| `website_new` contact buttons | `href="#"` — they do not open the contact page |