# Business rules — storefront

Evidence date: 2026-10-02. Source: `git@bitbucket.org:overdrive/storefront.git`, `main` at `1f3fb2c`.

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Unknown**.

No business-rules document existed in the repository or in `silicon_ark/storefront/` before this file.

## Rules found in the repository

None that govern a product. The only tracked file is `.gitignore`. An ignore list does not enforce validation, pricing, permissions, stock, tax, or workflow gates.

No rule below is inferred from the repository name. A name is not a domain rule.

## Identity and access

No login, role, or permission check exists in the tree.

The commit metadata records one email, `wessels@overdrive.co.za`, on both commits (2025-02-04 and 2025-02-06). The display name is Wessels de Wet on the first commit and Wessels on the second. That is history, not an access-control rule.

**Unknown / Requires Confirmation** who is allowed to push to the Bitbucket repository. Hosting permissions were not inspected. The Bitbucket API client returned HTTP 401, so project settings were not read. A clone of `main` succeeded on 2026-10-02.

## Domain behaviour

No domain object is defined. There is no product, SKU, cart, price, tax, customer, order, invoice, or shipment entity in this repository.

`writable/company_orders_xml/` and `writable/company_invoices_xml/` appear as ignore patterns. They are not entities. Rules written for another repository are not rules of this one:

- `silicon_ark/wca_dms/business-rules.md` describes Admin Overdrive behaviour, including writing pulled XML under `writable/company_orders_xml/shoprite/` and `.../pnp/` (BR-055 in that file). That file does not name slug `storefront`.
- The `.gitignore` files are almost the same (see `technical-documentation.md`). A shared ignore pattern does not copy the rule that produces the files.

Whether any `wca_dms` rule was meant to apply to this repository is **Unknown / Requires Confirmation**.

## Validation

No validator, schema, form rule, or argument parser exists in this repository.

`.gitignore` causes Git to skip matching untracked paths. That is a version-control filter. The patterns are listed in `technical-documentation.md`. They are not input validation for a product.

One comment inside the file is a security note about environment files: "These should never be under version control, as it poses a security risk." It sits above `.env`, `.vagrant`, and `Vagrantfile`. Provenance: **Documented** in `.gitignore`. No `.env` file is in the tree, so the note is not currently excluding a committed secret. It is not a product validation rule.

## Workflows

No status machine, approval step, retry, or scheduled job is defined.

## Explicit non-rules

The following were not adopted, because the evidence does not support them:

- "The product is a storefront." Only the slug says storefront. **Not a rule.**
- "The product sells to customers, or takes payment." No price, cart, or payment field exists. **Not a rule.**
- "Company orders and invoices are processed here." Those words appear as directory names in `.gitignore`. No code reads or writes them. **Not a rule.**
- "Order and invoice rules from `wca_dms` apply here." Those rules live in another repository and are not referenced from this remote. **Not a rule.**
- "SonarQube quality gates apply." Two filenames were reported on a scan host and were not read. **Not a rule.**
- Any threshold, fee, eligibility check, or permission matrix. **Not present.**

## Human confirmation

- Whether any business rule for this slug is kept outside the repository.
- Whether rules already written for `wca_dms` should ever be attached to this repository.
- Whether the environment-file comment was copied with the CodeIgniter ignore template or written as a rule for this project.