# Project plan — encryptionatrestphp

Evidence date: 2026-10-15.

Source repository: `git@bitbucket.org:overdrive/encryptionatrestphp.git`.

Inspected revision: `main` at `9b3df5c` (2025-08-05, Wessels De Wet `<wessels@overdrive.co.za>`, "Add project and readme files"). The scan-host path `~/projects/sonar_scan/repos/encryptionatrestphp` was not on this machine. The tree below was read from that git revision.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The repository README titles the product **PHP Encryption at Rest**. It is a single-class PHP library that encrypts and decrypts string (or binary-as-string) payloads with AES-256-GCM via PHP’s OpenSSL extension, returns base64-encoded ciphertext, and supports key generate / export / import.

Provenance: **Documented** in `README.md` and `PROJECT_SUMMARY.md`. Behaviour is **Implemented** in `src/EncryptionAtRest.php`.

There was no Silicon Ark directory for this project before this onboarding set.

The library is intended to be copied or Composer-autoloaded into other PHP applications. It is not a hosted service, web product, or multi-user application. A small `index.php` demo form exists for local browser smoke tests.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `main` (default; `origin/HEAD`) | `9b3df5c` | 2025-08-05 | Only branch. One commit |

History:

- 2025-08-05 — Wessels De Wet added the full project tree (library, examples, tests, docs, `composer.json`, `index.php`, `.gitignore`) in a single commit.

**Discrepancy:** the task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Those files are not in git history. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives (inferred from README / PROJECT_SUMMARY, not from a written roadmap)

- Provide a reusable, framework-agnostic AES-256-GCM encrypt/decrypt API for data at rest.
- Keep dependencies to PHP ≥ 7.4 and `ext-openssl` only.
- Document Laravel, Symfony, database-field, and sensitive-data usage patterns.
- Ship runnable examples and a custom PHP test script.

## Scope

### In scope of `main`

1. Core class `EncryptionAtRest` in `src/EncryptionAtRest.php` (global namespace, not PSR-4 namespaced).
2. Composer package metadata `encryption-at-rest/php` with classmap autoload of `src/`.
3. CLI-oriented examples under `examples/` (`basic_usage.php`, `framework_integration.php`, `sensitive_data_examples.php`).
4. Custom test runner `tests/test_encryption.php` (not PHPUnit).
5. Browser demo `index.php` (POST form encrypt/decrypt round-trip).
6. Documentation: `README.md`, `PROJECT_SUMMARY.md`, `SENSITIVE_DATA_GUIDE.md`.

### Out of scope / not in this repository

- Key vault, HSM, or KMS integration.
- Key rotation automation or multi-key / envelope encryption.
- Database drivers, ORM plugins, or framework packages as first-class code (examples only).
- HTTP API, authentication, authorization, or multi-tenant product surface.
- CI pipeline, SonarQube config, Docker, or deployment manifests (**not present** in git).
- A committed `LICENSE` file (license is declared MIT in `composer.json` and README text only).

## Architecture (as implemented)

```text
Consumer PHP app
    │
    ▼
EncryptionAtRest  (src/EncryptionAtRest.php)
    │  openssl_encrypt / openssl_decrypt  (aes-256-gcm)
    │  random_bytes for key and IV
    ▼
Base64 string: IV (12) || tag (16) || ciphertext
```

No database, queue, network client, or background worker is part of the library.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `EncryptionAtRest` | Encrypt, decrypt, key get/export/import, capability probes | `src/EncryptionAtRest.php` |
| Examples | Demonstrate usage patterns | `examples/*.php` |
| Test script | Manual/scripted verification | `tests/test_encryption.php` |
| Demo UI | Single-page POST form | `index.php` |
| Composer metadata | Package name, PHP/OpenSSL requirements, scripts | `composer.json` |

## Milestones / status

| Milestone | Status | Evidence |
|---|---|---|
| Initial library + docs + examples + tests | **Completed** (single commit) | `9b3df5c` |
| Publish to Packagist | **Planned / aspirational** in docs | `PROJECT_SUMMARY.md` mentions `composer require encryption-at-rest/php` “if published”; `homepage` / `support` URLs are placeholders (`github.com/yourusername/...`) |
| Sonar / CI | **Not in repo** | Files named by scan host missing from git |
| Customize composer.json author/homepage | **Documented next step** | `PROJECT_SUMMARY.md` “Next Steps” |

Current project status: **library present on `main`, single commit, no further git activity after 2025-08-05.** Whether it is used in production applications is **Unknown / Requires Confirmation**.

## Dependencies

| Dependency | Kind | Evidence |
|---|---|---|
| PHP `>=7.4` | Runtime | `composer.json`, README |
| `ext-openssl` | Runtime extension | `composer.json`, `isSupported()` |
| AES-256-GCM in OpenSSL cipher list | Runtime capability | `CIPHER = 'aes-256-gcm'`, `isSupported()` |
| Composer | Optional packaging | `composer.json` present; install docs also allow copying the single PHP file |
| Frameworks (Laravel, Symfony, etc.) | Optional consumer | Examples and README only — not required by the class |

## Risks and unknowns requiring confirmation

1. Is the package published anywhere under `encryption-at-rest/php`, or is that name aspirational only?
2. Should Bitbucket (not the placeholder GitHub URLs) be the canonical support/source location?
3. Are `sonar-project.properties` / `sonarqube_scan.bat` expected to be added, or were they scan-host artefacts only?
4. Is MIT licensing intentional without a `LICENSE` file in the tree?
5. Is `index.php` meant for local demo only, or for any shared/hosted use? (Each POST creates a new random key, so ciphertext cannot be decrypted across requests.)
6. Which Overdrive / Silicon applications consume this library today?

## Related Silicon Ark documents

- `prd.md` — functional requirements recovered from implementation and docs
- `features.md` — feature inventory
- `business-rules.md` — behavioural rules enforced by the class
- `technical-documentation.md` — structure, API, crypto layout, testing