# Project plan — quantiviaLive

Evidence date: 2026-10-05.

Source repository: `git@bitbucket.org:overdrive/quantivialive.git`.

Inspected revision: `master` at `0af11d2` (2019-08-15 14:26:27 +0200, author `siliconoverdrive`, message "First commit"). Only branch observed: `master`. `origin/HEAD` → `master`. The scan-host path `~/projects/sonar_scan/repos/quantiviaLive` was not on this machine. The tree was read from that git revision. A Windows checkout needed `core.longpaths=true` because of long filenames under `projectmanager/$SERVER_TEMP/jpgraph_cache/`. Credential values that appear in source are omitted.

This plan describes what the repository contains. It does not decide what the product should become.

Prior Silicon Ark set for this directory: none. A related knowledge set exists at `silicon_ark/quantivia-svn/` for a different repository (`quantivia-svn`, tip `ca64fae`, 2019-06-12). That set was not used as a source of requirements for this tree.

Source product documentation that was incorporated: PHP file headers on the Quantivia business and data classes, the in-code changelog in `quantivia/inc/common_functions.inc.php`, eGroupware app `setup/setup.inc.php` descriptions, and the root `README.md` (which describes a different product — see the discrepancy below). No Quantivia `setup/setup.inc.php` is present in this tree.

## Product

The repository is a **full eGroupware 1.8.x PHP groupware tree** plus a commercial Procon8 application named **Quantivia**.

**Documented** in `quantivia/inc/class.quantivia_bo.inc.php` and `class.quantivia_so.inc.php`:

> quantivia - Deliverable Progress and Performance Reporting tool (eGroupware Friendly)

Author Jean Thirion / PROCON8. Copyright 2017 on those class headers. License URL in the headers: `http://www.procon8.com/licenses/quantivia-license.php`.

**Implemented.** Quantivia uses eGroupware sessions and accounts, stores project data through its own PDO connection, and presents a SmartAdmin shell at `quantivia/main.php`. Runtime configuration in `quantivia/setup/quantivia_setings.php` and `header.inc.php` points the install at `EGW_SERVER_ROOT` `/var/www/html/online.quantivia.com` and at an Amazon RDS MySQL host in `eu-west-1`. Database names configured there are `quantivia` (Quantivia) and `quantiviagroupware` (eGroupware).

The same tree ships standard eGroupware apps (calendar, addressbook, FelamiMail, filemanager, projectmanager, tracker, wiki, and others) and several custom trackers (actions, NCR, permit, risk, SMT, WOMT).

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `0af11d2` | 2019-08-15 | Only remote branch observed. One commit: "First commit" |

History before this Git import is not in the repository. Inline `$Id` tags on Quantivia classes run into 2016–2017. The active changelog keys in `common_functions.inc.php` run `2.0.000` through `2.0.013`; older keys sit inside a block comment.

**Discrepancy with the 2026-09-28 onboarding scan:** last-commit metadata matches (`0af11d2`, 2019-08-15, "First commit"). The scan's truncated root matches this tree (about.php, actions, addressbook, admin, bitbucket-pipelines.yml, and the rest of the eGroupware layout). `sonar-project.properties` is not in git at this revision.

## Objectives (inferred from the implementation, not from a written plan)

- Capture and report **deliverable progress and performance** (earned-value style metrics, RAMP and STEP reporting) for engineering or construction programmes.
- Structure work with deliverables, control-point chains, resources, commitments, and budgets.
- Brand the UI per client programme via `quantivia/templates_*` folders.
- Gate project count and feature use with a license file, with an explicit hostname exception list that includes `online.quantivia.com`.
- Run import, download, and publish work through `quantivia/inc/worker.php` and related offload scripts.
- Optionally use the surrounding eGroupware suite for mail, calendar, address book, and the custom trackers.

## Scope

### In scope of `master`

1. eGroupware API and core apps (`phpgwapi` version `1.8.004` from `phpgwapi/setup/setup.inc.php`).
2. Quantivia under `quantivia/` (changelog tip `2.0.013`, `so_version` 216, `bo_version` 276).
3. Quantivia Framework Daemon scripts under `QFD/` (`union.bat`, `worker.vbs`).
4. Client template packs under `quantivia/templates_*`.
5. Custom trackers: `actions`, `ncr`, `permit`, `risk`, `smt`, `womt`.
6. A Flash organogram under `organogram/`.
7. Entry points: `login.php`, `loginextra.php`, GroupDAV/WebDAV, JSON/SOAP/XML-RPC, and `quantivia/main.php`.
8. Background workers: `quantivia/inc/worker.php`, `ofload.php`, `TaskMaster.php`, `TaskMasterLoop.bat`, and the QFD scripts.

### Out of scope of this repository (as observed)

- A separate SPA or microservice for Quantivia. The UI is server-rendered SmartAdmin plus PHP form endpoints.
- A Quantivia eGroupware setup registration file (`quantivia/setup/setup.inc.php` is absent).
- An automated test suite for Quantivia. Tests present are eGroupware API tests and a phpFreeChat testcase.
- A current deployment definition that matches the configured host. See the discrepancy below.

## System architecture

```text
Browser
  │
  ├─ login.php / loginextra.php
  │     └─ eGroupware session (cookie sessionid, last_loginid)
  │
  ├─ index.php  (eGroupware front controller)
  │     └─ standard EGW apps and custom trackers
  │
  ├─ quantivia/main.php  (SmartAdmin shell)
  │     ├─ forms/*.php          UI endpoints
  │     ├─ services/*.php       JSON feeds, charts, qvaapi
  │     ├─ dashboard/*.php      widgets
  │     ├─ api/qvaapi.php       token-checked table export
  │     └─ templates_*          client branding
  │
  ├─ quantivia/inc/worker.php   offloaded import / publish / download
  ├─ QFD/                       Windows worker loop aimed at quantivia.local.com
  │
  └─ groupdav.php / webdav.php / soap.php / xmlrpc.php / json.php

Data:
  eGroupware MySQL   accounts, ACL, config, EGW apps   (db name quantiviagroupware)
  Quantivia DB       projects and per-project tables   (db name quantivia)
  File storage       /var/www/html/online.quantivia.com/files
```

Provenance: **Implemented** (entry points, settings, class layout). Protocol behaviour of the stock eGroupware endpoints is **Inferred** from the presence of those files and eGroupware 1.8 structure.

## Major components

| Component | Path | Role |
|---|---|---|
| eGroupware API | `phpgwapi/` | Auth, accounts, ACL, sessions, GroupDAV |
| eGroupware config | `header.inc.php` | Install root, domain DB, session handler |
| Quantivia BO/SO | `quantivia/inc/class.quantivia_bo.inc.php`, `class.quantivia_so.inc.php` | Domain logic and PDO data access |
| Quantivia UI | `quantivia/main.php`, `forms/`, `smartadmin/` | Primary product UX |
| Settings | `quantivia/setup/quantivia_setings.php` | Dual-DB connection and runtime knobs |
| Licensing | `quantivia/inc/common_functions.inc.php`, `sg_.php` | MAC/domain license gate and hostname exceptions |
| Workers | `inc/worker.php`, `ofload.php`, `TaskMaster.php`, `QFD/` | Async import, publish, download |
| Client templates | `quantivia/templates_*` | Per-programme branding |
| Custom trackers | `actions/`, `ncr/`, `permit/`, `risk/`, `smt/`, `womt/` | Adjacent apps in the same install |
| Organogram | `organogram/` | Flash org chart labelled "ATE Organogram" |

## Dependencies (known from the tree)

- PHP with PDO. `class.quantivia_so.inc.php` defaults `PDO_type` to `mysql` when the setting is absent. The settings file in this tree does not set `PDO_type`. The same class names mysql, oracle, mssql, sqlite, and sybase as branches. `sqlite_construct.php` is referenced and is **not in the tree**.
- eGroupware 1.8-compatible stack (`phpgwapi` 1.8.004). Header file version string `1.29`.
- Bundled libraries under `quantivia/`: SmartAdmin, JPGraph, PHPExcel, PHPMailer, a phpMyAdmin-style UI (`quantiviasqladmin/`), phpLiteAdmin (`quantiviasqliteadmin/`).
- eGroupware bundled libraries under `phpgwapi/` (ADOdb, HTMLPurifier, and others).
- Windows Script Host for `QFD/worker.vbs` and `union.bat`.
- IIS default-document hint in root `web.config` (`index.php` first). The configured document root in PHP is a Linux path under `/var/www/html/`.

## Deployment configuration present in git

Two different deployment stories are in the tree. They do not describe the same target.

| Artefact | What it says | Provenance |
|---|---|---|
| `header.inc.php`, `quantivia_setings.php` | Install root `/var/www/html/online.quantivia.com`. Worker URL `online.quantivia.com` port 80. Offload URL `https://online.quantivia.com/quantivia/inc/ofload.php`. RDS MySQL in `eu-west-1`. | **Implemented** configuration |
| `QFD/worker.vbs` | Polls `http://quantivia.local.com/quantivia/inc/worker.php` | **Implemented** |
| `README.md` | Title "Indawo / Code Deploy with AWS and FTP Deploy". Local vhost `local.indawo`. AWS CodeDeploy steps for an application named `CodedeployDev`. | **Documented**, and it does not mention Quantivia |
| `bitbucket-pipelines.yml` | Image `python:3.5.7`. `master` runs `git ftp init` with live FTP variables. `development` runs `git ftp init` against `public_html/indawo.overdriveqa.co.za`. The `git ftp push` lines are commented out. | **Implemented** pipeline text |

No `appspec.yml` and no Dockerfile were found.

**Discrepancy / Requires Confirmation:** whether the Indawo README and pipeline were copied into this repository by mistake, and which path (if any) was used to deploy `online.quantivia.com`.

## Milestones / project status

| Observation | Provenance |
|---|---|
| Class headers copyright through 2017; BO `$Id` dated 2016-11-17 | **Implemented** |
| Git tip frozen at a single commit on 2019-08-15 | **Implemented** |
| Active changelog last key is `2.0.013`. Settings file still contains `'version' => '1.2.000'`, which `common_functions.inc.php` overwrites with the changelog key plus SO/BO numbers | **Implemented** — which string operators should quote is **Unknown / Requires Confirmation** |
| Seventeen client template directories are present (Aurecon, BACS, Bechtel, Bombardier, CCC, CRRC, CRTG_EEB, Downer, EC Harris, Elevo, Hyder, MCD, MMHKT, Parsons, Procon8, Sungard, WPA) | **Implemented** |
| Whether this snapshot is still production, and whether those programmes are still in scope | **Unknown / Requires Confirmation** |

## Known risks for documentation consumers

- `header.inc.php` and `quantivia/setup/quantivia_setings.php` contain live-looking database passwords, a header-admin password, a config password, an mcrypt initialisation vector, and an Excel password. Values are not copied into Silicon Ark. They are in Git history.
- `phpinfo.php` and `phpstats.php` sit at the web root.
- `header.inc.php` sets `setup_acl` to an empty string (no IP restriction recorded for setup).
- `common_functions.inc.php` calls `http_response_code(403)` when the `sessionid` cookie is missing and does not exit on that line.
- The license block treats a list of hostnames, including `online.quantivia.com` and `127.0.0.1`, as fully licensed without a MAC match.

## Human confirmation

1. Is `quantiviaLive` an archive of production `online.quantivia.com`, or something else?
2. Should the Indawo README and Bitbucket pipeline be treated as in-scope deployment for this product?
3. Which version identifier is the one to cite externally: settings `1.2.000`, changelog `2.0.013`, or `SO 216` / `BO 276`?
4. Which `templates_*` programmes are still customers?
5. Should the committed secrets be rotated, given they are in this snapshot?