feat(portfolio): score the applications you use on value, fit and risk, and see where the scores contradict the TIME class

docs/features/portfolio-value-assessment.md

@@ -0,0 +1,44 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+  - SPDX-License-Identifier: EUPL-1.2
+  -->
+
+# Value assessment
+
+An information manager scores each application the organisation uses on business value, technical fit and risk. The scores sit next to the cost stackiq already adds up from contracts, and they point to a TIME class. The TIME class the organisation records stays the decision: the scores back it up or question it, they never change it.
+
+Specification: [`openspec/specs/application-value-assessment/spec.md`](https://github.com/ConductionNL/stackiq/blob/development/openspec/specs/application-value-assessment/spec.md).
+
+## Scoring an application
+
+Open the application under **Applications in use** and edit it. Fill in:
+
+- **Business value**: how much the organisation depends on it, from 1 (little) to 5 (critical).
+- **Technical fit**: how well it fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).
+- **Risk**: the risk the organisation sees in running it, from 1 (low) to 5 (high).
+- **Scored on**: the date you set the scores.
+
+When you save, stackiq fills in **Suggested TIME classification**:
+
+| Business value | Technical fit | Suggested class |
+|---|---|---|
+| 3 or more | 3 or more | Invest |
+| 3 or more | below 3 | Migrate |
+| below 3 | 3 or more | Tolerate |
+| below 3 | below 3 | Eliminate |
+
+While either score is missing there is no suggestion. The **Value assessment** section of the page shows the scores, the recorded TIME class and the suggestion side by side.
+
+## Risk signals
+
+Below the data of the page, **Risk signals** shows what backs a risk score: whether the version you run is past its end of support (or withdrawn), and how many known vulnerabilities are linked to the application. You set the risk score yourself; the signals only inform it.
+
+## The portfolio report
+
+The portfolio report (**Reports**, then **Portfolio rationalization**) adds, for the organisation you select:
+
+- **Business value against technical fit**: one circle per scored application, its size the annualised cost. The circle's colour is the suggested class; a dark ring marks a recorded class that differs from the scores. Applications without both scores are counted below the chart.
+- Two columns in the table: **Suggested by scores** and **Value / fit / risk**.
+- The switch **Recorded class differs from scores**, which lists only the applications whose recorded class and suggestion disagree.
+
+The CSV export carries the columns businessValue, technicalFit, riskScore, scoredOn, suggestedTimeClassification and timeMismatch.

l10n/en.js

@@ -868,7 +868,40 @@ OC.L10N.register(
         "Loading the roadmap": "Loading the roadmap",
         "The roadmap could not be loaded.": "The roadmap could not be loaded.",
         "The supplier has not published a roadmap for this application": "The supplier has not published a roadmap for this application",
-        "No versions with a date yet": "No versions with a date yet"
+        "No versions with a date yet": "No versions with a date yet",
+        "{name}: business value {value}, technical fit {fit}, annualised cost {cost}": "{name}: business value {value}, technical fit {fit}, annualised cost {cost}",
+        "%n application in use is not scored yet.": "%n application in use is not scored yet.",
+        "%n applications in use are not scored yet.": "%n applications in use are not scored yet.",
+        "%n vulnerability linked to this application": "%n vulnerability linked to this application",
+        "%n vulnerabilities linked to this application": "%n vulnerabilities linked to this application",
+        "Business value": "Business value",
+        "Business value against technical fit": "Business value against technical fit",
+        "Business value against technical fit for %n scored application in use": "Business value against technical fit for %n scored application in use",
+        "Business value against technical fit for %n scored applications in use": "Business value against technical fit for %n scored applications in use",
+        "Each circle is an application in use, its size the annualised cost. A dark ring marks a recorded TIME class that differs from the scores.": "Each circle is an application in use, its size the annualised cost. A dark ring marks a recorded TIME class that differs from the scores.",
+        "Known vulnerabilities": "Known vulnerabilities",
+        "Loading the risk signals": "Loading the risk signals",
+        "No end of support date known": "No end of support date known",
+        "Not scored": "Not scored",
+        "Passed on {date}": "Passed on {date}",
+        "Recorded class differs from scores": "Recorded class differs from scores",
+        "Risk score": "Risk score",
+        "Risk signals": "Risk signals",
+        "Suggested by scores": "Suggested by scores",
+        "Supported until {date}": "Supported until {date}",
+        "Technical fit": "Technical fit",
+        "The risk signals could not be loaded.": "The risk signals could not be loaded.",
+        "This version was withdrawn": "This version was withdrawn",
+        "Value / fit / risk": "Value / fit / risk",
+        "Value assessment": "Value assessment",
+        "How much the organisation depends on this application, from 1 (little) to 5 (critical).": "How much the organisation depends on this application, from 1 (little) to 5 (critical).",
+        "How well the application fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).": "How well the application fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).",
+        "Risk": "Risk",
+        "The risk the organisation sees in running this application, from 1 (low) to 5 (high). The page shows end of support and known vulnerabilities next to it.": "The risk the organisation sees in running this application, from 1 (low) to 5 (high). The page shows end of support and known vulnerabilities next to it.",
+        "Scored on": "Scored on",
+        "The date the scores were set.": "The date the scores were set.",
+        "Suggested TIME classification": "Suggested TIME classification",
+        "The TIME class the business value and technical fit point to. Calculated when the usage is saved; the recorded TIME classification stays the decision.": "The TIME class the business value and technical fit point to. Calculated when the usage is saved; the recorded TIME classification stays the decision."
     },
     "nplurals=2; plural=(n != 1);"
 )

l10n/en.json

@@ -867,6 +867,39 @@
         "Loading the roadmap": "Loading the roadmap",
         "The roadmap could not be loaded.": "The roadmap could not be loaded.",
         "The supplier has not published a roadmap for this application": "The supplier has not published a roadmap for this application",
-        "No versions with a date yet": "No versions with a date yet"
+        "No versions with a date yet": "No versions with a date yet",
+        "{name}: business value {value}, technical fit {fit}, annualised cost {cost}": "{name}: business value {value}, technical fit {fit}, annualised cost {cost}",
+        "%n application in use is not scored yet.": "%n application in use is not scored yet.",
+        "%n applications in use are not scored yet.": "%n applications in use are not scored yet.",
+        "%n vulnerability linked to this application": "%n vulnerability linked to this application",
+        "%n vulnerabilities linked to this application": "%n vulnerabilities linked to this application",
+        "Business value": "Business value",
+        "Business value against technical fit": "Business value against technical fit",
+        "Business value against technical fit for %n scored application in use": "Business value against technical fit for %n scored application in use",
+        "Business value against technical fit for %n scored applications in use": "Business value against technical fit for %n scored applications in use",
+        "Each circle is an application in use, its size the annualised cost. A dark ring marks a recorded TIME class that differs from the scores.": "Each circle is an application in use, its size the annualised cost. A dark ring marks a recorded TIME class that differs from the scores.",
+        "Known vulnerabilities": "Known vulnerabilities",
+        "Loading the risk signals": "Loading the risk signals",
+        "No end of support date known": "No end of support date known",
+        "Not scored": "Not scored",
+        "Passed on {date}": "Passed on {date}",
+        "Recorded class differs from scores": "Recorded class differs from scores",
+        "Risk score": "Risk score",
+        "Risk signals": "Risk signals",
+        "Suggested by scores": "Suggested by scores",
+        "Supported until {date}": "Supported until {date}",
+        "Technical fit": "Technical fit",
+        "The risk signals could not be loaded.": "The risk signals could not be loaded.",
+        "This version was withdrawn": "This version was withdrawn",
+        "Value / fit / risk": "Value / fit / risk",
+        "Value assessment": "Value assessment",
+        "How much the organisation depends on this application, from 1 (little) to 5 (critical).": "How much the organisation depends on this application, from 1 (little) to 5 (critical).",
+        "How well the application fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).": "How well the application fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).",
+        "Risk": "Risk",
+        "The risk the organisation sees in running this application, from 1 (low) to 5 (high). The page shows end of support and known vulnerabilities next to it.": "The risk the organisation sees in running this application, from 1 (low) to 5 (high). The page shows end of support and known vulnerabilities next to it.",
+        "Scored on": "Scored on",
+        "The date the scores were set.": "The date the scores were set.",
+        "Suggested TIME classification": "Suggested TIME classification",
+        "The TIME class the business value and technical fit point to. Calculated when the usage is saved; the recorded TIME classification stays the decision.": "The TIME class the business value and technical fit point to. Calculated when the usage is saved; the recorded TIME classification stays the decision."
     }
 }

l10n/nl.js

@@ -938,7 +938,40 @@ OC.L10N.register(
         "Loading the roadmap": "Roadmap laden",
         "The roadmap could not be loaded.": "De roadmap kon niet worden geladen.",
         "The supplier has not published a roadmap for this application": "De leverancier heeft geen roadmap voor deze applicatie gepubliceerd",
-        "No versions with a date yet": "Nog geen versies met een datum"
+        "No versions with a date yet": "Nog geen versies met een datum",
+        "{name}: business value {value}, technical fit {fit}, annualised cost {cost}": "{name}: bedrijfswaarde {value}, technische geschiktheid {fit}, jaarlijkse kosten {cost}",
+        "%n application in use is not scored yet.": "%n applicatie in gebruik heeft nog geen score.",
+        "%n applications in use are not scored yet.": "%n applicaties in gebruik hebben nog geen score.",
+        "%n vulnerability linked to this application": "%n kwetsbaarheid gekoppeld aan deze applicatie",
+        "%n vulnerabilities linked to this application": "%n kwetsbaarheden gekoppeld aan deze applicatie",
+        "Business value": "Bedrijfswaarde",
+        "Business value against technical fit": "Bedrijfswaarde tegenover technische geschiktheid",
+        "Business value against technical fit for %n scored application in use": "Bedrijfswaarde tegenover technische geschiktheid voor %n applicatie in gebruik met een score",
+        "Business value against technical fit for %n scored applications in use": "Bedrijfswaarde tegenover technische geschiktheid voor %n applicaties in gebruik met een score",
+        "Each circle is an application in use, its size the annualised cost. A dark ring marks a recorded TIME class that differs from the scores.": "Elke cirkel is een applicatie in gebruik, de grootte staat voor de jaarlijkse kosten. Een donkere rand markeert een vastgelegde TIME-klasse die afwijkt van de scores.",
+        "Known vulnerabilities": "Bekende kwetsbaarheden",
+        "Loading the risk signals": "Risicosignalen laden",
+        "No end of support date known": "Geen datum voor einde ondersteuning bekend",
+        "Not scored": "Geen score",
+        "Passed on {date}": "Verlopen op {date}",
+        "Recorded class differs from scores": "Vastgelegde klasse wijkt af van de scores",
+        "Risk score": "Risicoscore",
+        "Risk signals": "Risicosignalen",
+        "Suggested by scores": "Voorgesteld door de scores",
+        "Supported until {date}": "Ondersteund tot {date}",
+        "Technical fit": "Technische geschiktheid",
+        "The risk signals could not be loaded.": "De risicosignalen konden niet worden geladen.",
+        "This version was withdrawn": "Deze versie is ingetrokken",
+        "Value / fit / risk": "Waarde / geschiktheid / risico",
+        "Value assessment": "Waardebeoordeling",
+        "How much the organisation depends on this application, from 1 (little) to 5 (critical).": "Hoe sterk de organisatie van deze applicatie afhangt, van 1 (weinig) tot 5 (kritiek).",
+        "How well the application fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).": "Hoe goed de applicatie past bij de architectuur en de standaarden die de organisatie volgt, van 1 (slecht) tot 5 (goed).",
+        "Risk": "Risico",
+        "The risk the organisation sees in running this application, from 1 (low) to 5 (high). The page shows end of support and known vulnerabilities next to it.": "Het risico dat de organisatie ziet in het gebruik van deze applicatie, van 1 (laag) tot 5 (hoog). De pagina toont het einde van de ondersteuning en bekende kwetsbaarheden ernaast.",
+        "Scored on": "Gescoord op",
+        "The date the scores were set.": "De datum waarop de scores zijn vastgesteld.",
+        "Suggested TIME classification": "Voorgestelde TIME-classificatie",
+        "The TIME class the business value and technical fit point to. Calculated when the usage is saved; the recorded TIME classification stays the decision.": "De TIME-klasse waar de bedrijfswaarde en de technische geschiktheid op wijzen. Berekend bij het opslaan van het gebruik; de vastgelegde TIME-classificatie blijft het besluit."
     },
     "nplurals=2; plural=(n != 1);"
 )

l10n/nl.json

@@ -937,6 +937,39 @@
         "Loading the roadmap": "Roadmap laden",
         "The roadmap could not be loaded.": "De roadmap kon niet worden geladen.",
         "The supplier has not published a roadmap for this application": "De leverancier heeft geen roadmap voor deze applicatie gepubliceerd",
-        "No versions with a date yet": "Nog geen versies met een datum"
+        "No versions with a date yet": "Nog geen versies met een datum",
+        "{name}: business value {value}, technical fit {fit}, annualised cost {cost}": "{name}: bedrijfswaarde {value}, technische geschiktheid {fit}, jaarlijkse kosten {cost}",
+        "%n application in use is not scored yet.": "%n applicatie in gebruik heeft nog geen score.",
+        "%n applications in use are not scored yet.": "%n applicaties in gebruik hebben nog geen score.",
+        "%n vulnerability linked to this application": "%n kwetsbaarheid gekoppeld aan deze applicatie",
+        "%n vulnerabilities linked to this application": "%n kwetsbaarheden gekoppeld aan deze applicatie",
+        "Business value": "Bedrijfswaarde",
+        "Business value against technical fit": "Bedrijfswaarde tegenover technische geschiktheid",
+        "Business value against technical fit for %n scored application in use": "Bedrijfswaarde tegenover technische geschiktheid voor %n applicatie in gebruik met een score",
+        "Business value against technical fit for %n scored applications in use": "Bedrijfswaarde tegenover technische geschiktheid voor %n applicaties in gebruik met een score",
+        "Each circle is an application in use, its size the annualised cost. A dark ring marks a recorded TIME class that differs from the scores.": "Elke cirkel is een applicatie in gebruik, de grootte staat voor de jaarlijkse kosten. Een donkere rand markeert een vastgelegde TIME-klasse die afwijkt van de scores.",
+        "Known vulnerabilities": "Bekende kwetsbaarheden",
+        "Loading the risk signals": "Risicosignalen laden",
+        "No end of support date known": "Geen datum voor einde ondersteuning bekend",
+        "Not scored": "Geen score",
+        "Passed on {date}": "Verlopen op {date}",
+        "Recorded class differs from scores": "Vastgelegde klasse wijkt af van de scores",
+        "Risk score": "Risicoscore",
+        "Risk signals": "Risicosignalen",
+        "Suggested by scores": "Voorgesteld door de scores",
+        "Supported until {date}": "Ondersteund tot {date}",
+        "Technical fit": "Technische geschiktheid",
+        "The risk signals could not be loaded.": "De risicosignalen konden niet worden geladen.",
+        "This version was withdrawn": "Deze versie is ingetrokken",
+        "Value / fit / risk": "Waarde / geschiktheid / risico",
+        "Value assessment": "Waardebeoordeling",
+        "How much the organisation depends on this application, from 1 (little) to 5 (critical).": "Hoe sterk de organisatie van deze applicatie afhangt, van 1 (weinig) tot 5 (kritiek).",
+        "How well the application fits the architecture and the standards the organisation follows, from 1 (poor) to 5 (good).": "Hoe goed de applicatie past bij de architectuur en de standaarden die de organisatie volgt, van 1 (slecht) tot 5 (goed).",
+        "Risk": "Risico",
+        "The risk the organisation sees in running this application, from 1 (low) to 5 (high). The page shows end of support and known vulnerabilities next to it.": "Het risico dat de organisatie ziet in het gebruik van deze applicatie, van 1 (laag) tot 5 (hoog). De pagina toont het einde van de ondersteuning en bekende kwetsbaarheden ernaast.",
+        "Scored on": "Gescoord op",
+        "The date the scores were set.": "De datum waarop de scores zijn vastgesteld.",
+        "Suggested TIME classification": "Voorgestelde TIME-classificatie",
+        "The TIME class the business value and technical fit point to. Calculated when the usage is saved; the recorded TIME classification stays the decision.": "De TIME-klasse waar de bedrijfswaarde en de technische geschiktheid op wijzen. Berekend bij het opslaan van het gebruik; de vastgelegde TIME-classificatie blijft het besluit."
     }
 }