# Business rules — quantivia-svn

Evidence date: 2026-10-05.

Source: `git@bitbucket.org:overdrive/quantivia-svn.git`, `master` at `ca64fae` (2019-06-12).

No standalone business-rules document exists in the source repository. Rules below are taken from Quantivia PHP classes, forms, settings, and eGroupware auth. Anything marked **Inferred** is a conclusion from that evidence, not a written policy. Secret values are not reproduced.

## Identity, access, and licensing

### BR-001 — Quantivia requires an eGroupware session

**Implemented.**

`quantivia/main.php` redirects to `../index.php` unless `sessionid` and `last_loginid` cookies are present. Shared helpers return HTTP 403 when the session cookie is missing.

Evidence: `quantivia/main.php`, `quantivia/inc/common_functions.inc.php`.

### BR-002 — License is bound to MAC address and domain

**Implemented.**

Runtime license validation loads constants from a license file via `sg_get_const()` / MAC helpers. A host is licensed when `L_MAC` matches a server MAC **and** `L_DOMAIN` matches `SERVER_NAME`. Session flags include licensed state, max projects (`N_PROJECTS`), and feature tiers (`Qlicensed`, `Elicensed`).

Evidence: `common_functions.inc.php`.

### BR-003 — Named development hosts auto-license

**Implemented.**

A hard-coded set of hostnames (including local/dev patterns such as `127.0.0.1` and `sdev.quantivia.com`) bypasses full license checks and receives a fixed project allowance (25 in the inspected code path).

**Inferred** product intent: developer convenience. **Requires Confirmation** whether this remains acceptable outside lab hosts.

### BR-004 — Full-licence gate and demo write block

**Implemented.**

`requireFullLicence()` in `common_pageSetup.php` gates licensed features. Demo/unlicensed mode blocks write operations on forms such as `EditDeliverable.php` and `EditProject.php`.

### BR-005 — Optional TOTP after password

**Implemented.**

`loginextra.php` verifies RFC 6238 OTP after successful password authentication using a per-user secret from `get_user_rfc6238()`. Failed OTP destroys the session.

### BR-006 — Demo auto-login may reset webdemo passwords

**Implemented.** Security-sensitive.

`auto_login.php?demo` locates an idle `webdemo*` account, sets password equal to username, creates a session, and preloads dashboard UI settings.

**Requires Confirmation:** whether this endpoint is reachable in any deployed environment.

## Programme / multi-client rules

### BR-007 — Default template is Procon8

**Implemented.**

`quantivia_bo` construction defaults `$_SESSION['template']` to `templates_procon8_01` unless overridden.

### BR-008 — Per-user template override

**Implemented.**

Config key `{username}_template` stores the user’s chosen template. `services/TemplateSelection.php` lists and saves choices. Available options are filtered by programme group membership (`is_user_programme_user()` / related helpers).

**Inferred:** templates act as programme (client) tenants for branding and access scoping.

### BR-009 — Template packs map to eGroupware groups

**Implemented / Inferred.**

`read_template_options()` scans `templates_*` directories and associates them with eGroupware groups (`create_eGroupware_group()`). Users only see packs their groups allow.

## Project and work breakdown

### BR-010 — Projects carry breakdown dimensions PBS/WBS/LBS/OBS

**Implemented.**

Project and deliverable structures use Product / Work / Location / Organisation breakdown filters. UI filter controls appear in `main.php`; fields appear on project/deliverable edit forms and CP definitions.

### BR-011 — Each project gets its own physical tables

**Implemented.**

`confirm_project_tables($p_id)` ensures per-project tables such as deliverables, live/archive chains, resources, commitments, profiles, and published value partitions.

**Inferred** operational rule: deleting or renumbering projects has schema consequences beyond a single row delete.

### BR-012 — Timekeeping method is one of Structured / Detailed / None

**Implemented.**

`quantivia_bo::$time_keeping` enumerates allowed values stored on the project (`book_time`).

### BR-013 — Reporting method is RAMP or STEP

**Implemented.**

`quantivia_bo::$reporting_method` defines Ramp Method and Step Method for tabular/graphical reporting configuration on the project.

## Deliverables, control points, and chains

### BR-014 — Control points have weight and dimensional filters

**Implemented.**

CP definitions (`contol_point_defs` table name spelling as in code) store display name, detail, weight, value, project filter, and PBS/WBS/LBS/OBS filters.

### BR-015 — A chain is an ordered list of control-point definition IDs

**Implemented.**

`control_point_chains` stores serialized `links` as ordered CP def IDs per project. Live instances on `p_{id}_chains` track planned/actual/forecast dates, cost, and current budget per data date.

### BR-016 — Deliverables may be abandoned

**Implemented.**

BO method `abbandon_deliverable()` (spelling as in code) exists for retiring a deliverable from active tracking.

## Budget, forecasting, and change control

### BR-017 — Budget overflow behaviour is selectable

**Implemented.**

`$budget_overflow`: Remaining Budget (1) or Current Budget (2).

### BR-018 — Forecasting and EAC methods are enumerable

**Implemented.**

Forecasting: Original Duration, Current Trend, Remaining Duration.  
EAC: Budget Rate, CPI, CPI and SPI Compounded, CPI and SPI (80:20).

### BR-019 — Progress views follow a fixed status set

**Implemented.**

`$view_statuses` includes Invalid, Issued, Submitted, Reviewed, Archived, Rejected, Void, Proposed To Delete, Expired (and duplicate Invalid code).

**Inferred** workflow: Issued → Submitted → Reviewed → Archived is the happy path; Rejected/Void/Expired/Proposed To Delete are terminal or exceptional. Exact transition matrix enforcement was not fully enumerated — **Requires Confirmation** for allowed transitions.

### BR-020 — Reporting retention windows are discrete

**Implemented.**

`$reporting_retention`: Last 1 / 3 / 10 / 25 / 50 / 100 / All (999).

### BR-021 — Budget and structure changes are logged as change events

**Implemented.**

`quantivia_change` / `budget_changes` record typed events (including budget increase/decrease and deliverable/chain/resource mutations) with open/closed style status fields.

## Resources and units

### BR-022 — Resources use a defined unit-of-measure catalogue

**Implemented.**

`quantivia_bo::$UOM` maps codes (item count, length, area, volume, mass, time, …) with labels and conversion factors relative to base units (meter, kg, days).

### BR-023 — Commitments link deliverable, resource, and profile/chain

**Implemented.**

Resource commitment rows reference `del_id`, `res_id`, and profile/chain identifiers with quantities, values, and progress over time.

## Notifications and reporting periods

### BR-024 — Default reporting windows are measured in weeks

**Implemented** in settings.

`report_period` and `time_report_period` default to `4` weeks in `quantivia_setings.php` (actuals reporting and auto-allocation window to open CPs).

### BR-025 — Email notifications use eGroupware SMTP config

**Implemented.**

`quantivia_notifier` sends via PHPMailer using phpgwapi mail configuration. Template user guides describe progress-update emails.

## Workers and concurrency

### BR-026 — Offload tasks run as a privileged worker identity

**Implemented.**

Workers set `$_SESSION['worker']=true` and `$GLOBALS['current_user']='worker'`, then process `offload_tasks` by `task_type` (0–15: maintenance, import/export, publish, resource upload, …).

### BR-027 — Worker parallelism follows configured CPU cores

**Implemented.**

`TaskMaster.php` uses `cpu_cores` from Quantivia settings to spawn worker processes.

## Platform / adjacent rules (brief)

### BR-028 — eGroupware ACL and application enablement still apply

**Implemented** (platform).

Users only see eGroupware applications that are installed/enabled and allowed by ACL, independent of Quantivia template selection.

### BR-029 — ATE trackers follow tracker-style lifecycles

**Implemented** (adjacent apps).

NCR, risk, permit, SMT, WOMT, and actions share the eGroupware tracker pattern (tickets/replies, assignees, votes/bounties where enabled). Quantivia BO also defines `$ticket_status`, `$risk_status`, and `$risk_severity` maps used in Quantivia risk-related hooks (note: Quantivia `setup.inc.php` incorrectly wires some hooks to `risk_hooks::*` — possible copy-paste defect; **Requires Confirmation**).

## Discrepancies and unknowns

| Item | Notes |
|---|---|
| Quantivia setup hooks reference `risk_hooks` | Likely defect vs missing Quantivia hooks class — **Requires Confirmation** |
| Setup version `1.3.000` vs settings `2.0.000` vs `bo_version` 276 | Conflicting version signals |
| `Procedures.sql` interpolate rules | Present as SQL samples; not confirmed as enforced app rules |
| Exact CP date-gap interpolation in PHP vs SQL | **Unknown** which path production uses |