Asset handover: new wiki pair for discussion #56
New pages (app commits 605811aa + 2aed483e):
- Asset-Handover (user)
- Asset-Handover-Developer-Guide
The dev guide records three decisions worth keeping:
1. The designer is BLOCKS, not a canvas, because the middle of the document
is a repeating region -- one row per asset, count unknown until render.
A WYSIWYG either cannot express that or makes the admin write a loop.
2. Escape FIRST, substitute SECOND. Merge values are user-supplied
(users.display_name arrives from the portal, from mail, from imports) and
this document is EMAILED, so getting the order backwards would put stored
markup into a mail client. Includes the test that proves it.
3. One renderer serves the printed page, the preview and the email. A preview
that is a separate approximation is a preview nobody can trust, and the
divergence surfaces on a document somebody has already signed.
Also records the users_assets stale-row trap (no foreign key; an INNER JOIN is
deliberate), why printing beats generating a PDF, and four honest gaps: no logo
in the emailed copy, one default template for the whole install, no record that
a handover happened, and 23 untranslated locales.
Every named file verified to exist; every link verified to resolve; the
factual claims (logo_path null, the 2000-char cap, the INNER JOIN) checked
against the source rather than recalled.
Notifications: new wiki pair for discussion #55
New pages (app commits bbd49c50 + 75803509):
- Notifications (user)
- Notifications-Developer-Guide
The user page leads with what the bell does NOT do, because the four noise
rules are the feature -- a bell that fills faster than it can be read is dead
while still appearing to work.
The dev guide records two things worth keeping:
1. The bell is a SUBSCRIBER to WorkflowEngine::dispatch(), not a second
instrumentation layer. ~32 event types already fired from 48 call sites,
so adding a notification type must never mean editing call sites.
2. EVERY failure mode in this feature is silent. Suppressed, rejected,
thrown-and-swallowed and correctly-quiet all look like an empty table, so
every rule needs a POSITIVE control and not just a negative one. The four
bugs found during the build are written up for the same reason -- three of
them presented as "notifications just never arrive".
Also records three pre-existing broken ticket deep links (tickets/?id= in
escalate_ticket.php and engine.php, tickets/?ticket= in forms/approvals.php).
inbox.js reads only ?ticket_id=, so those return HTTP 200 and never open the
ticket. Verified present, not fixed.
Every named file verified to exist; every link verified to resolve.
Landing page: new wiki pair for discussion #63
New pages (app commit f1673644):
- Landing-Page (user)
- Landing-Page-Developer-Guide
The dev guide leads with the constraint that shaped the whole design: the
decision happens before authentication and before anything renders, so
user_preferences cannot hold it on its own (analyst_id is NOT NULL) and
localStorage cannot hold it at all (PHP cannot see it). The cookie is a cache
of the preference, not the setting.
Also records, for whoever touches this next:
- the stored value is a KEY and never a path, with the attack tests that
prove it, because this drives a redirect on the most-visited URL
- an endpoint writing several rows without a transaction must finish
validating before it starts writing (save_branding blanked the header
and footer on a rejected request)
- when a server-side upload rule is tightened, grep for the client-side
restatements of it (the accept attribute and the help text both still
recommended SVG after the server stopped taking it)
Cross-linked from Self-Service-Portal, Home and the sidebar. Every named file
verified to exist; every link verified to resolve.
Morning check groups and routing: new wiki pair, plus corrections to the module page
New pages for discussion #64 (app commit 262d7af8):
- Morning-Check-Groups-and-Routing (user)
- Morning-Check-Groups-and-Routing-Developer-Guide
Both lead with the rule the design hangs on: routing is GUIDANCE, never
PERMISSION. No authorisation check anywhere consults AssignedAnalystID --
if it did, the round would stop on exactly the morning it matters most.
Corrections to Morning-Checks.md, which had gone stale:
- "Raise Ticket from a Check" said the button appears only on statuses
whose Requires notes flag is true. It is now on every check.
- Settings listed three tabs; there are four.
- Key Tables was missing morningChecks_Groups and _ResultLinks, and the
CreatedBy / ModifiedBy distinction.
- Added the Undo section.
Every file named in the dev guide verified to exist; every wiki link
verified to resolve.
Point the Updates links at updates.php
The wiki still linked to the retired updates.html on every page via the
sidebar, plus once on Home. That stale page is what search engines and
LLM crawlers were finding and quoting, so the project looked like it had
not shipped anything since 30 May 2026.
Add a Scheduled tasks page; bring the tracker dev guides current
New page: Scheduled-Tasks. Ed asked for one place covering every cron
job / Windows task FreeITSM needs, because "you must schedule something
or comments never arrive" was buried in the Jira page. Covers all four
jobs, what silently breaks without each, Windows and Linux commands, how
to run one by hand, and how to tell whether they are working.
Also documents what is NOT a scheduled task, so nobody goes looking for
a job that does not exist or schedules the InTune workers, which the app
starts itself. Notes that mail is fetched by the browser, so nothing is
collected overnight with every browser closed.
Windows gotchas that cost time today: /ru SYSTEM tasks are invisible to
a non-elevated session, 0x41303 means "not yet run", and the escaped
quoting fails if a path has spaces.
Linked from Home, the sidebar, and five places in Issue-Trackers.
Dev guides brought current for #954-956: assertion count 227, range
#945-956, the pipeline diagram no longer shows the removed author
guard, and a new note on inbound_enabled — a column that shipped in V1
with no writer, so the feature it gated could never be turned on. That
is a trap worth naming for the other columns V1 shipped early.
Absorb the README's deep-dive content ahead of the README slim-down
The project README is being reduced to a landing page; every fact it
held that the wiki lacked is merged here first (615 lines across 33
pages): the full email-threading & reply-flow design onto Tickets,
directory layout + module-page pattern + file-locations reference onto
Architecture, per-endpoint tables onto API Reference, MFA login flow +
LDAP subsection + injection/audit notes onto Security, the icon library
and editor internals onto Network Mapper, Branding + landing-page and
help/search internals + debug-tool depth onto System, planned objects
onto CMDB, custody/locations/warranty onto Assets, and more.
Also corrects stale claims found during the audit: the Knowledge
audience table still said customer-visible articles had no reader
(the portal Knowledge section shipped), a pre-#903 Portal-Privacy
ambiguity row, the Workflows trigger-wiring section (catalogue spans
every module now), the superseded System module-access bullet, the
Multi-Tenancy users page marked "Planned" for a shipped feature,
and the locale count (21 languages incl. Ukrainian, not 20).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
LMS authoring + AI + Roles: new deep-dive pages, refreshed LMS hub
- LMS.md: rewritten for the two course kinds (authored + SCORM), the
learner/manager split, correct table names, links to the new sub-pages.
- LMS-Authoring.md: native content model, editor, native player, server-side
grading (answer key never on the wire), the CMI-reuse trick, learner/manager
enforcement, SCORM upload safety.
- LMS-AI-Authoring.md: mechanics of the three AI helpers (outline / article→lesson /
lesson→quiz) — grounding, JSON contracts, the draft-never-writes safety model.
- Roles-and-Permissions.md: RBAC Layer 2 (settings permissions) — two layers,
deny-by-default, is_admin bypass, server-side enforcement, the LMS pilot.
- Roles-Developer-Guide.md: add/edit/remove a capability and wire a module's
settings in — registry, guards, the operational-vs-settings split, splitting
a capability later, gotchas.
- _Sidebar.md + Home.md wired up.
REST API: Service Status module guide (derived health board, monitoring round-trip) + how-it-works updates
REST API: Software module guide (computed compliance, renewal filters) + how-it-works updates
REST API: Calendar module guide (naive-local datetimes, generated-event protection) + how-it-works updates
REST API: Contracts module guide (renewal radar, suppliers, terms) + how-it-works updates
REST API: CMDB module guide (schema-driven writes, impact, scoped ticket links) + how-it-works updates
REST API: Tasks module guide (board moves, parity notes) + how-it-works updates
REST API: Knowledge module guide + how-it-works updates
REST API: Changes module guide incl. CAB workflow + how-it-works updates
REST API: Problems module guide (company-scoped) + how-it-works updates
REST API: Assets module guide + how-it-works updates (assets shipped, scope note)
REST API v1: how-it-works deep dive + Tickets endpoint guide (per-module pattern); link from Home/sidebar/API-Reference
Add Workflows module page
New Workflows.md covering: anatomy (trigger/conditions/actions),
visual canvas builder, condition lookups + operator-per-type filtering,
8 action handlers, variable substitution, AI co-author (Anthropic +
OpenAI), Test fire, host module trigger wiring, engine internals,
key files and tables, what's still ahead.
Home.md and _Sidebar.md updated to bump module count 19 -> 20 and
add Workflows to the module list / sidebar.
i18n region wording: be specific about single-language countries
Update locale count: 18 → 20 (added Afrikaans, Indonesian)
Add Network Mapper page; bump module count to 19 in Home + Sidebar
Wiki: document native multi-language support (18 locales)
- Home.md: lead paragraph now states the project is multi-lingual
with the full list of 18 starter locales and a deep link to
the Architecture i18n section.
- Architecture.md: new i18n subsection under Shared Components
covering the t() pattern, namespaced files, per-key fallback,
locale resolution chain, JS bridge, supported locales, and
how to add a new language.
- Process-Mapper.md: header now shows the 18 supported locale
codes plus a callout explaining the module is fully translated
end-to-end with a link to the architecture section.
Process Mapper: document swimlanes, groups, gradients, autosave, Mermaid export
Major rewrite of Process-Mapper.md to cover features added since
the wiki was first populated:
- Groups (visual underlays + step ownership via group_id)
- Swimlanes (reorder, resize, step ownership via lane_id,
auto-tag pass, divider snap-to-grid)
- Gradient fills (color2 column on steps/groups/lanes)
- Autosave (Word-style status, defers during drag, panel
survives reload via stable-identity restoration)
- Mermaid export (lanes -> subgraphs, classic shapes, LR
direction, full markup generator)
Home.md tagline updated from "Visual flowchart builder" to
"Flowchart builder with swimlanes, groups, and Mermaid export".
Initial wiki: home, 18 module pages, installation, architecture, security, API reference, browser extension, sidebar