# PRD — russel-serverless-api

Evidence date: 2026-10-05. Source: `git@bitbucket.org:overdrive/russel-serverless-api.git`, `master` at `c6a6cd889f2da571fc0f10bb037041e5dfb65114`.

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Unknown**.

No formal PRD existed in the repository or in `silicon_ark/russel-serverless-api/` before this file. The committed tree has no application from which to recover requirements. The statements below record that absence, plus the two untracked scan files on the backup copy. They are not a product decision.

## Product purpose

**Unknown / Requires Confirmation.**

The repository slug is `russel-serverless-api`. No README, route, handler, comment, or ticket defines a purpose. A name is not a requirements statement.

**Implemented:** a Bitbucket Git repository whose only tracked file is `.gitignore` (the Atlassian sample ignore list).

What a future product should do is out of scope for this document.

## Users and roles

No user, role, permission, account, or tenancy model is present in git or in the untracked scan files.

| Role | Evidence | Provenance |
|---|---|---|
| Repository author | Commit `c6a6cd8` is by Jaco Brits `<jaco@overdrive.co.za>` | **Implemented** as git metadata. This is authorship, not an application role |
| Scan operator | `sonarqube_scan.bat` is a Windows batch file that a person or a scheduler would start. It names no user | **Inferred** from the file being a double-clickable script (`pause` on failure). Who runs it is **Unknown** |

Who would call an API in this repository, if one is added later, is **Unknown / Requires Confirmation**.

## Major workflows

No product workflow is implemented. There is no trigger, input, validation, output, or error path for an API.

### Repository state

- Trigger: `git fetch` of `git@bitbucket.org:overdrive/russel-serverless-api.git` on 2026-10-05.
- Behaviour: `origin/master` remained at `c6a6cd8`. `git ls-tree -r HEAD` lists `.gitignore` only.
- Provenance: **Implemented** as remote state. This is repository state, not application behaviour.

### Local SonarQube scan (not in git)

The backup copy at `E:\backup\sonar_scan\repos\russel-serverless-api` contains `sonarqube_scan.bat`. It is untracked. A clone of `c6a6cd8` does not include it. Provenance: **Implemented** as a local file. It was not executed during this inspection.

Steps written in the file:

1. Change directory to the folder that contains the batch file.
2. Run `git pull`. If that fails, print a warning and continue.
3. Choose a token: `SONAR_TOKEN` when that environment variable is set, otherwise `SONARQUBE_TOKEN`.
4. Run `C:\wamp64\www\sonar_scan\sonar-scanner\bin\sonar-scanner.bat` with project key `overdrive_russel_serverless_api`, sources `.`, host `https://scan.appmonitor.co.za`, and the token.
5. On a non-zero exit: print "Scan failed!", `pause`, and exit 1.
6. On success: print "Scan completed successfully!".

Inputs: the working tree as Sonar sources, plus one of the two environment variables. The file does not store a token value.

Outputs: scanner stdout, and a console message. No report file path is written in the batch file.

`sonar-project.properties` in the same directory sets the same project key and host, and also sets `sonar.projectName=russel-serverless-api` and `sonar.sourceEncoding=UTF-8`. The batch file repeats key, sources, host, and token as `-D` arguments and does not repeat the project name or encoding. Whether the scanner merges the properties file with those arguments is **Inferred** from ordinary SonarScanner behaviour (properties file in the working directory, `-D` overrides). It was not observed by running the scanner.

Whether any scan has succeeded is **Unknown / Requires Confirmation**.

## Integrations

| System | Direction | What is exchanged | Auth | Provenance |
|---|---|---|---|---|
| Bitbucket Git | This repo is hosted there | The commit `c6a6cd8` | SSH remote URL on `origin`. Push rights were not listed | **Implemented** |
| SonarQube at `https://scan.appmonitor.co.za` | The batch file would send a scan of `.` | Project key `overdrive_russel_serverless_api`. Token via environment variable. No response body is defined in the file | `SONAR_TOKEN`, else `SONARQUBE_TOKEN` | **Documented** in the untracked files. Not in git. The server was not called |
| Scanner binary at `C:\wamp64\www\sonar_scan\sonar-scanner\bin\sonar-scanner.bat` | Local process start | Command-line `-D` properties | None in the file | **Documented** in the batch file. The binary is not in this repo. Whether the path exists is **Unknown** |

No HTTP API client, webhook, queue, database, or cloud account is named in git.

`git pull` inside the batch file is a call back to the same Bitbucket remote. Failure is non-fatal by design of the script.

## Constraints

- This PRD must not treat the repository name as a specification.
- Functional requirements cannot be tested against this repository until code or a written spec exists.
- The Sonar files are scan-host artefacts. They are not committed behaviour of `master`.
- No secret value was present in the files that were read. Token values must stay in the environment variables the batch file already names.

## Requirements discovered from the implementation

No functional product requirement was discovered. There is no handler, route, screen, schema, test, or domain config to cite.

The ignore file is a VCS sample. It is recorded in technical documentation. It is not a product requirement.

The scan script is local automation for code quality scanning. It does not state a product rule about what the API must do.

## Requirements explicitly not adopted

The following were not written as requirements, because the evidence does not support them:

- "The system exposes a serverless HTTP API." Only the slug says so. **Not a requirement.**
- "The system belongs to the website branch `development_russel` or to a person named Russel Sauer." Other Silicon Ark documents use those names. None of them cite this slug. **Not a requirement.**
- "SonarQube quality gates block a release." The batch file runs a scanner and prints success or failure. It defines no gate, no threshold, and no pipeline. **Not a requirement.**

## Human confirmation

- The intended product, users, and workflows, if this repository is still planned.
- Whether the untracked scan files are in scope for the product or only for the scan host.
- Whether a SonarQube project for this key already exists and what its history shows.