# Business rules — quantivia-clean (Quantivia demo tree)

Evidence date: 2026-10-05. Revision: `master` `808df0f`.

Rules below are taken from implementation and from the embedded Quantivia user guides. **Do not treat inferences as approved business policy.** Where a rule is only suggested by code or docs, it is labelled **Inferred** or **Documented**. Conflicts or gaps are called out for human confirmation.

## Access and permissions

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-A01 | A Quantivia request without an eGroupWare `sessionid` cookie is redirected to the platform entry (`../index.php`). | Implemented | `quantivia/index.php` |
| BR-A02 | Site Admin rights require membership of the eGroupWare `Admins` group. | Implemented | `is_user_admin()` |
| BR-A03 | Project Admin rights require membership of group `P_{project_id}_admin` and/or being the project's `administrator` field value. | Implemented | `is_user_project_admin()` |
| BR-A04 | Progress Admin rights require membership of group `P_{project_id}_p_admin` (or Project Admin). | Implemented | `is_user_project_progress_admin()` |
| BR-A05 | Project view membership requires group `P_{project_id}`. | Implemented | `is_user_project_user()` |
| BR-A06 | Page handlers call `checkCurrentUserAutherization(...)` and exit HTTP 401 with a translated denial when the role set is insufficient. | Implemented | `common_pageSetup.php` |
| BR-A07 | When authorisation flags disallow all roles for a feature, the denial message states the feature is locked for all user types. | Implemented | `checkCurrentUserAutherization` final branch |
| BR-A08 | Special worker uid `-1` bypasses normal user resolution paths used by interactive users. | Implemented | `get_uid()` in SO layer |

## Licensing / demo mode

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-L01 | If `$_SESSION['licensed']` is false, `requireFullLicence()` blocks the function with message that the system is in Demo mode. | Implemented | `common_pageSetup.php` |
| BR-L02 | Unlicensed/demo sessions may see a limited project list. | Implemented | licensed checks in BO (~session gated list behaviour) |
| BR-L03 | How/when `$_SESSION['licensed']` becomes true on this demo host. | Unknown / Requires Confirmation | Not fully traced in this tree |

## Project configuration

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-P01 | Only System/Site Administrators create projects (user-guide narrative); Site Admin menus expose Project List / Users / Programmes. | Documented + Implemented (menu) | user guide; `Menu.php` |
| BR-P02 | Project status must be `control` for Publish Report to be available. | Implemented | `Menu.php` |
| BR-P03 | Graphs that depend on published values are unavailable until a report has been published. | Implemented | `Menu.php` |
| BR-P04 | Actual Hours Structure is only usable when the project's timekeeping method is Structured. | Implemented | `Menu.php` vs `$time_keeping` |
| BR-P05 | Timekeeping methods are Structured, Detailed, or None. | Implemented | `quantivia_bo::$time_keeping` |
| BR-P06 | Portfolio view uses project id `-1` and aggregates rights across selected multi-project ids. | Implemented | `Menu.php` |

## Deliverables, control points, budgets

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-D01 | Deliverables are managed in a controlled manner via wizards/uploads rather than free-form ad hoc entry (user-guide narrative). | Documented | `user_guide.php` |
| BR-D02 | Control-point chains should be assigned before schedule upload; undocumented CP dates use a sentinel data date in the guide (`1980-05-23`). | Documented | user guide |
| BR-D03 | When a budget is locked, further budget changes go through the Change Register. | Documented; enforcement completeness Requires Confirmation | user guide; `budget_changes` table / Change Register menus |
| BR-D04 | Per-project deliverable storage uses dynamically named tables `p_{project_id}_deliverables` (and related dynamic SQL). | Implemented | SO layer / `sql_construct.php` |
| BR-D05 | Budget overflow methods are Remaining Budget or Current Budget. | Implemented | `$budget_overflow` |

## Earned value and forecasting

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-E01 | Reporting methods are RAMP or STEP. | Implemented | `$reporting_method` |
| BR-E02 | Forecasting methods are Original Duration, Current Trend, or Remaining Duration. | Implemented | `$forecasting_method` |
| BR-E03 | EAC methods are Budget Rate, CPI, CPI and SPI Compounded, or CPI and SPI (80:20). | Implemented | `$eac_method` |
| BR-E04 | Report retention options include Last 1/3/10/25/50/100 or All. | Implemented | `$reporting_retention` |
| BR-E05 | S-curve / Gantt ordering options include alphabetical, chronological plan/actual starts/ends, and ascending budget. | Implemented | `$gantt_order` |
| BR-E06 | Published EV metrics are stored for reporting (published_values). | Implemented | schema + publish flow |

## Progress updates

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-U01 | Progress update views use statuses: Invalid, Issued, Submitted, Reviewed, Archived, Rejected, Void, Proposed To Delete, Expired (plus duplicate Invalid key). | Implemented | `$view_statuses` |
| BR-U02 | Progress packages can expire at/after due date; users are notified via email templates. | Documented; expiry enforcement Inferred from templates/statuses | user guide / email templates / status `Expired` |
| BR-U03 | Online filing supports Excel download password protection using configured excel password. | Implemented | settings + `TurnAroundFiling.php` (password value omitted here) |

## Risk (shared module)

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-R01 | Risk statuses include Raised, Closed, Canceled, Acknowledged. | Implemented | `$risk_status` in Quantivia BO (shared vocabulary) |
| BR-R02 | Risk severity includes High, Moderate, Low, Unknown. | Implemented | `$risk_severity` |
| BR-R03 | Risk application loads Quantivia settings/BO. | Implemented | `risk/inc/class.risk_bo.inc.php` |

Ticket status vocabulary also exists on the Quantivia BO (`Open`, `Closed`, `Deleted`, `Pending`, `Verify`) for ticket-like entities. Exact entity binding: **Requires Confirmation** beyond the static arrays.

## eGroupWare platform rules (relevant to Quantivia)

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-G01 | Application ACL is stored in eGroupWare ACL tables and enforced by the EGW ACL class for EGW apps. | Implemented | `phpgwapi` ACL; `egw_acl` |
| BR-G02 | Quantivia project access is primarily group-name based (`P_*`), not a registered EGW app ACL entry (no `quantivia/setup/setup.inc.php`). | Implemented / Inferred | missing setup.inc; group checks in SO |
| BR-G03 | Setup header admin credentials control who may rewrite `header.inc.php` via setup. | Implemented | `header.inc.php` (values omitted) |

## Demo-specific behaviour

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-DEM01 | `auto_login.php` can auto-provision a session for idle `webdemo*` accounts and preload sample project dashboard state. | Implemented | `auto_login.php` |
| BR-DEM02 | This backup is configured against demo databases `demo` / `demodppr` and path `demo.quantivia.com`. | Implemented | config files |
| BR-DEM03 | Whether demo auto-login is an approved ongoing business capability vs a temporary sales tool. | Requires Confirmation | product decision |

## Validation rules (observed)

| ID | Rule | Provenance | Evidence |
|---|---|---|---|
| BR-V01 | API calls through `qvaapi.php` must pass token validation. | Implemented | `validate_token()` |
| BR-V02 | PHP version for EGW setup must be ≥ 5.2 (recommended 5.3+). | Documented | `setup/inc/class.setup.inc.php` |

Field-level validation for every wizard upload format was not exhaustively inventoried; treat spreadsheet column contracts in the user guide as **Documented** until confirmed against the corresponding upload parsers.

## Conflicts and gaps

1. **Budget lock vs Change Register:** Documented strongly in the user guide; not every write path was proven to check the lock in this pass.
2. **Licence truth:** Code gates on `$_SESSION['licensed']`, but the authoritative licence source for this demo tree is unclear (related repos mention MAC/domain licence files / hostname exceptions; this tree lacks `QFD/`).
3. **Master vs development:** Commit subjects say master is main site and development holds QA changes — business baseline unclear.
4. **Sibling repositories:** `quantiviaLive` and `quantivia-svn` may embody newer or different rules; do not assume this demo tree is the commercial baseline.

## Rules not found

- Formal SLA / contractual reporting calendar rules outside project calendar data.
- GDPR / POPIA retention policy statements.
- Explicit multi-tenant isolation beyond separate projects/groups/databases.
- Modern OAuth / SSO product policy (CAS exists as EGW option only).