# Project plan — jumpstarter_crowdfunding

Evidence date: 2026-10-11.

Source repository: `git@bitbucket.org:overdrive/jumpstarter_crowdfunding.git`.

Inspected revision: `39ef15abade9ea4ecf7ccca1c7412392ceb72f18` (2023-08-04, Joshua G-D, "wp-content/plugins/ignitiondeck-crowdfunding/idf/ignitiondeck-idf.php. edited online with Bitbucket") on `master`. That commit is `origin/HEAD`. The only remote branch is `master`. There are no tags.

The scan-host path `~/projects/sonar_scan/repos/jumpstarter_crowdfunding` was not on this machine. The tree below was read from that git revision. Secret values (SnapScan API key and token, PayGate checksum secret, merchant IDs) are omitted. File paths and constant names are recorded so a human can find them.

This plan describes what the repository contains. It does not decide what the product should become. There was no `silicon_ark/jumpstarter_crowdfunding/` directory before this set.

## Product

`jumpstarter_crowdfunding` is a WordPress 4.9.14 site for a crowdfunding platform. The repository README is the only product statement in git:

> Jumpstarter is a crowdfunding platform where campaigns are launched to raise funds for projects. The public can back support a project and optionally choose to receive a voucher/reward.

Provenance: **Documented** (`README.md`).

The public site strings in code use the host `jumpstarter.co.za` (plugin headers, PayGate return URL, a commented project URL). Provenance: **Implemented**. Whether that host is still the production site is **Unknown / Requires Confirmation**.

Campaigns are IgnitionDeck projects (`ignition_product`). The theme is Fundify 2.0.14 with a Fundify child theme. Custom Overdrive code adds SnapScan QR payments, a PayGate PayWeb v2 card checkout in South African rand (ZAR), reward-level images, and a backer CSV export.

Overdrive is named as the author of the SnapScan and reward-image plugins ("Silicon Overdrive", `https://www.overdrive.co.za`). Provenance: **Implemented** in those plugin headers.

## Branch reality

| Branch | Tip | Date | What it is |
|---|---|---|---|
| `master` (only branch; `origin/HEAD`) | `39ef15a` | 2023-08-04 | Full WordPress tree plus Overdrive customisations |

History, oldest first. Twelve commits. No commits after 2023-08-04.

| Date | Commit | Author | What the message says |
|---|---|---|---|
| 2020-05-20 | `b99d915` | Kagiso Malepe | Init (full WordPress tree) |
| 2020-05-20 | `231da62` | Kagiso Malepe | Reward/Voucher Image Upload |
| 2020-05-20 | `d5341f6` | Kagiso Malepe | SnapScan Integration |
| 2020-05-20 | `19a4c8a` | Kagiso Malepe | SnapScan Integration - Record payment |
| 2020-05-20 | `be40cf4` | Kagiso Malepe | SnapScan Integration - Sync event endpoint |
| 2020-05-22 | `be1d7a5` | Kagiso Malepe | Retrieve backer email from SnapScan API |
| 2020-05-23 | `ea3c0d9` | Kagiso Malepe | Project Backers CSV Export |
| 2020-05-24 | `bc226f1` | Kagiso Malepe | Admin Page-> Display Project QR Codes |
| 2020-05-24 | `4f2ebaa` | Kagiso Malepe | Add Shipping Address to Backers Export |
| 2020-08-17 | `59523e6` | Kagiso Malepe | Payments Sync Mods |
| 2020-08-17 | `a1a63cc` | Kagiso Malepe | IGN JS |
| 2023-08-04 | `39ef15a` | Joshua G-D | Renamed a stray `ignitiondeck-idf.php.` file to `ignitiondeck-idf.php.back` |

Authors:

| Author | Email | Commits |
|---|---|---|
| Kagiso Malepe | `kagiso@overdrive.co.za` | 11 |
| Joshua G-D | `joshua@overdrive.co.za` | 1 |

The 2023 commit is a rename of a filename that ends in `.php.` (trailing dot). The real plugin file `ignitiondeck-idf.php` is still present. Provenance: **Implemented** (`git show 39ef15a`).

Backup copies inside the theme (`*.bck26042020`, `*.bck27042020`, `*.bck28042020`, `*.bck30042020`, `*.bck13052020`) predate or match the May 2020 init. They show that PayGate and pledge edits were made on disk before the repository's first commit, then committed as part of `b99d915`. Provenance: **Implemented** (filenames and dates in the tree).

## Objectives (from the README and the custom code)

No project plan or requirements document exists beyond the two-line README. The following are **Documented** only for the first bullet, and **Inferred** from the custom plugins and theme edits for the rest:

- Let the public back a project and optionally receive a voucher or reward (README).
- Publish IgnitionDeck campaigns on the Fundify theme.
- Take card payments in ZAR through PayGate PayWeb v2 and return the backer to `https://jumpstarter.co.za/payment-status/`.
- Let a backer pay a published project by SnapScan QR, then record completed SnapScan payments into IgnitionDeck order tables.
- Let a project creator attach an image to a reward level.
- Let the project creator or an administrator download a CSV of backers.
- Show a rand total of pledges in the footer.

Which plugins are actually active, and which of these paths run in production, is **Unknown / Requires Confirmation**. Activation lives in the database, and `wp-config.php` is not in git.

## Scope

### In scope of the repository

- WordPress 4.9.14 core (`$wp_version` in `wp-includes/version.php`). Required PHP and MySQL recorded by core are 5.2.4 and 5.0. The PHP version that actually runs the site is **Unknown**.
- Themes: `fundify` 2.0.14 and `fundify-child` (style header version `2.0.14.1537361961`, "Updated: 2018-09-19").
- IgnitionDeck 1.3.5, IgnitionDeck Crowdfunding 1.7.1, IgnitionDeck Commerce 1.9.37, IgnitionDeck Social 1.0.3.
- Overdrive plugins: Jumpstarter SnapScan Integration 1.0, Jumpstarter Reward Image Upload 1.0, Jumpstarter IgnitionDeck Customization (`idjs`) 1.0.
- Other vendored plugins listed in `technical-documentation.md`.
- `en_GB` language files under `wp-content/languages/`. `$wp_local_package` is not set in `wp-includes/version.php`. The active locale is **Unknown**.
- `.htaccess` with the standard WordPress front-controller rules plus a deny rule for `wp-content/debug.log`.
- `wordfence-waf.php` pointing at an absolute path under `/usr/www/users/jumpszecsx/`.
- `robots.txt` disallowing `/wp-admin/` except `admin-ajax.php`.

### Out of scope / not in this repository

- `wp-config.php` (gitignored and absent). Database name, user, host, salts, and table prefix are **Unknown**. A commented query in `wp-admin/test.php` names the database `jumpstarter_wp`. That is a comment in a debug script, not a live config. Provenance: **Inferred**, requires confirmation.
- Uploaded media (`wp-content/uploads/` is gitignored and absent).
- Page, post, project, menu, and widget content. Those live in the database.
- Which theme and which plugins are active.
- Bitbucket Pipelines, Docker, Composer, npm, and PHPUnit. None of those files exist.
- `sonar-project.properties`, `sonarqube_scan.bat`, and `wp-snapshots` were listed in the onboarding task's top-level scan (2026-09-28). They are not in `39ef15a`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Architecture (what the tree shows)

```text
Browser
  -> WordPress 4.9.14
       -> Fundify or Fundify child (active theme is Unknown)
            -> ignition_product single template
            -> PayGate PayWeb v2 form (ZAR)
            -> page template update.php (PayGate return)
       -> IgnitionDeck Crowdfunding + Commerce (projects, levels, orders)
       -> so-snapscan (QR, payment sync, backer CSV, admin QR table)
       -> idjs + img-upload (reward level images)
  -> SnapScan POS API (https://pos.snapscan.io/)
  -> PayGate (https://www.paygate.co.za/paywebv2/process.trans)
```

IgnitionDeck Commerce also vendors PayPal Adaptive, Stripe (PHP SDK 4.2.0), Authorize.Net, and Coinbase libraries. The theme's live checkout path that this repository customised is PayGate, not those libraries. Whether the vendored gateways are enabled in wp-admin is **Unknown**.

A second crowdfunding plugin, WP Crowdfunding 2.0.3, and WooCommerce 4.0.1 are in the tree. The custom theme and plugins call IgnitionDeck types and tables (`ignition_product`, `ign_pay_info`, `memberdeck_orders`, `mdid_orders`). They do not call WooCommerce or WP Crowdfunding. Provenance: **Implemented** that the files exist; **Inferred** that IgnitionDeck is the product engine. Activation is **Unknown**.

## Major components

| Component | Role | Provenance |
|---|---|---|
| Fundify parent | Campaign layout, project single, purchase partial, PayGate return template | Implemented, edited in place |
| Fundify child | Parent CSS enqueue, home shortcodes, ZAR admin options, footer rand total, header analytics tag | Implemented. Active only if selected in the database |
| IgnitionDeck stack | Projects, rewards, orders, front-end submission, social embed | Vendored. Versions above |
| `so-snapscan` | SnapScan QR, sync into order tables, CSV export, admin QR list | Implemented |
| `idjs` + `img-upload` | Reward image field and upload | Implemented |
| Wordfence | WAF bootstrap with a hardcoded server path | Implemented |
| PayGate return template | Records a successful PayWeb transaction | Implemented in `update.php`. Which page uses the template is Unknown |

## Milestones (from git, not from a plan)

No roadmap document exists. The commit sequence is the only milestone evidence:

1. 2020-05-20 — WordPress site committed, already containing PayGate templates and dated backup copies.
2. 2020-05-20 to 2020-05-24 — Reward images, SnapScan, backer export, admin QR list.
3. 2020-08-17 — SnapScan sync adjustments and IgnitionDeck minified JS that appends a pure-donation price to the pledge form.
4. 2023-08-04 — Filename rename of a stray IgnitionDeck file. No product behaviour change in that commit.
5. No later commits. Current status: frozen tree, last touched August 2023.

## Known dependencies

- PHP and MySQL compatible with WordPress 4.9.14. Runtime versions are **Unknown**. `money_format()` is called in the child footer; that function was removed in PHP 8.
- Apache `mod_rewrite` (`.htaccess` WordPress block). Whether the host is Apache is **Inferred** from `.htaccess` and the Wordfence path.
- SnapScan merchant API at `https://pos.snapscan.io/`.
- PayGate PayWeb v2.
- IgnitionDeck database tables created by those plugins on activation (`ign_pay_info`, `memberdeck_orders`, `mdid_orders`, and the IgnitionDeck project tables). The CREATE statements are in the vendor plugins. Whether the tables exist in production is **Unknown**.
- A WordPress user with email `anonymous@jumpstarter.co.za`. The SnapScan sync looks that user up and stops if the user id is missing. Whether the account exists is **Unknown**.
- Google Analytics property `UA-55077943-1`, hardcoded in the child theme header.

## Current project status

The repository is a snapshot of a production-style WordPress tree, not an application with its own build. There is no automated test, no CI file, and no deployment script in git.

`wordfence-waf.php` loads Wordfence from `/usr/www/users/jumpszecsx/wp-content/plugins/wordfence/waf/bootstrap.php` and sets the log path to `/usr/www/users/jumpszecsx/wp-content/wflogs/`. That absolute path is **Implemented**. The hosting company is **Unknown / Requires Confirmation**. The `/usr/www/users/<account>/` layout is the kind used by some South African shared hosts.

Items that need a human before this documentation can be treated as production truth are listed in `prd.md` under "Requires confirmation".