# Project plan — sabullion_current_live (SA Bullion WordPress snapshot)

Evidence date: 2026-10-05.

Source repository: `git@bitbucket.org:overdrive/sabullion_current_live.git`, `master` at `6cbf6777` (2022-10-01 17:52:13 +0200, message "initial commit", author AzureAD\RachelMogano, rachel@overdrive.co.za).

`git ls-remote --heads` on 2026-10-05 returned only `refs/heads/master` at that commit. There is no README, issue list, or milestone file at the repository root. This plan describes what that commit contains. It does not decide what the product should become.

The scan-host path named on the onboarding issue (`~/projects/sonar_scan/repos/sabullion_current_live`) was not on the machine that wrote this document. The tree was read from a partial clone of `6cbf6777`. Checkout of the full working tree failed on Windows because some vendored plugin paths exceed the path length limit. Custom theme and `sab-api` files were read from Git. Image, font, and upload blobs were not opened.

A plaintext mailbox password in `wp-content/themes/sabullion/config/mailer.php` is not copied into this document.

## Product

The site name constant is `Sa Bullion` (`wp-content/themes/sabullion/config/site.php`). The custom plugin calls itself "SA Bullion Custom API Handler" and sets its plugin URI to `https://sabullion.co.za/`. Shop, cart, and email copy hardcode `https://sabullion.co.za`.

Provenance: **Implemented**.

The repository is a WordPress 6.0.2 tree with WooCommerce 6.9.4, a Sage 8 theme that has been extended for bullion calculators and a shop, a child theme, and one custom plugin. South African English language files (`en_ZA`) are in `wp-content/languages`. Provenance: **Implemented**.

No written product goal, owner, or operating status after October 2022 was found. Provenance: **Unknown**.

A separate Silicon Ark directory, `sabullion/`, documents a different remote (`git@bitbucket.org:overdrive/sabullion.git`). This plan does not treat that repository as part of this commit. Calculator emails in this tree link to `https://sabullion.co.za/dashboard/login.php`. That file is not in this commit. Whether another system serves that URL is **Unknown / Requires Confirmation**.

## What this repository is

A single-commit import of a WordPress content and core directory snapshot. The Git root contains only:

- `.gitignore` (a generic Atlassian example, not a WordPress ignore list)
- `license.txt` (WordPress GPL text, present as a root blob)
- `wp-admin/`
- `wp-content/`
- `wp-includes/`

WordPress root bootstrap files are not in the commit. There is no root `index.php`, `wp-blog-header.php`, `wp-load.php`, `wp-config.php`, `wp-login.php`, `xmlrpc.php`, or `.htaccess`. Provenance: **Implemented** as an absence in `git ls-tree HEAD`.

The onboarding scan listed `sonar-project.properties` and `sonarqube_scan.bat` beside those directories. Those two files are not in `6cbf6777`. Provenance: the issue text records them on the scan host; Git does not. **Requires Confirmation** whether they were untracked local files.

`wp-includes/version.php` sets `$wp_version = '6.0.2'`. Provenance: **Implemented**.

## History

| Marker | Evidence | Provenance |
|---|---|---|
| Theme comments from 2018-03-26 through 2019-07-01 (VAT change, PHP 7 test host, XAMPP) | comments in `config/site.php` | **Implemented** as comments. The host `switch` those comments describe is not in the current `site.php` |
| Email comment 2018-06-05, "as requested by Imran" | `sab-api/api/email/index.php` | **Implemented** as a comment |
| Mailer comment 2018-06-01, Office 365; "2020April Updated PHPMailer version" | `config/mailer.php` | **Implemented** as comments |
| Media directories `uploads/2016` through `uploads/2022` | `wp-content/uploads` | **Implemented** as directory names. File contents were not opened |
| WordPress 6.0.2 and WooCommerce 6.9.4 | version headers | **Implemented**. WordPress 6.0.2 was current in August 2022 |
| Git import 2022-10-01 | the only commit | **Implemented** |

The Git date is the import of an already-running site (uploads back to 2016, plugin versions from 2022). It is not evidence that the site was created in October 2022. Provenance: **Inferred** from the contents of the only commit.

## Branches

Default branch is `master`. No other remote head was listed on 2026-10-05.

## Scope that is in the repository

- WordPress core directories `wp-admin` and `wp-includes` at 6.0.2, without the root front-controller PHP files.
- Parent theme `wp-content/themes/sabullion` (header name "Rocket Theme", Sage 8.5.2 package, bullion templates and WooCommerce hooks).
- Child theme `wp-content/themes/sabullion-child` (header name "Rocket Theme Child", `Template: sabullion`).
- Custom plugin `wp-content/plugins/sab-api` version 1.0.
- A large set of third-party plugins under `wp-content/plugins/` (listed in `technical-documentation.md`). Activation is a database option and is **Unknown**.
- Uploaded media year folders, WooCommerce placeholders, Elementor uploads, and Wordfence log files.
- Backup-plugin directories `ai1wm-backups` and `backupwordpress-623de44a27-backups`. The All-in-One listing at that path is guard files (`index.php`, `.htaccess`, `robots.txt`, `web.config`), not a `.wpress` archive. The BackUpWordPress path contains `.files`, `.htaccess`, and `index.html`. Payload contents were not opened.

Out of scope of what Git can show:

- Which theme and plugins are active.
- Pages, products, orders, Gravity Forms definitions, and menus. Those live in the database.
- Definitions of `DB_ACCESS_*` and `DB_WEB_*`. The theme reads them and this commit does not define them.
- Tests, a pipeline, and a deployment script. None are at the repository root. The parent theme still has Sage's `.travis.yml`, `gulpfile`, and `bower.json` from the starter.

## Architecture

```text
Browser
  → WordPress (core files in wp-admin / wp-includes; root front controller not in Git)
      → theme sabullion (Sage 8) and/or sabullion-child
      → WooCommerce shop templates and fees in the theme
      → plugin sab-api (REST routes under api/v1, calculators, gold chart, uploads, email)
      → other plugins present on disk (activation unknown)
  → MySQL via PDO in the theme
      → $SA  constants DB_ACCESS_*   (VAT, gold_price, and other legacy queries)
      → $DBH constants DB_WEB_*      (second connection; called the web database in a comment)
  → SMTP smtp.office365.com as business@sabullion.co.za (non-lamp hosts)
```

Which theme WordPress loads is **Unknown**. The child theme declares the parent as `sabullion`. Provenance: **Implemented** header, **Unknown** activation.

## Environments named in code

| `SERVER_NAME` | What the code does | Provenance |
|---|---|---|
| `lamp` | `config/mailer.php` uses PHP `sendmail` and turns SMTP debug on. Investment email BCC is `rachel@overdrive.co.za` | **Implemented** |
| `sabullion.co.za` | Investment and minted-bar emails CC `coins@sabullion.co.za`. Investment email also BCC `imran.obrien@gmail.com` | **Implemented** |
| any other host | Mailer uses Office 365 SMTP. Minted-bar email has an empty `default` branch (a Jacques BCC is commented out) | **Implemented** |

Comments in `config/site.php` mention `dev.overdrive.co.za` and XAMPP. The current file does not branch on those names. Provenance: **Implemented** as comments only.

Public URLs hardcoded to `https://sabullion.co.za` include the shop, the IE splash page, the email logo, the investment application link, and an FNB bank-confirmation PDF under `wp-content/uploads/2022/03/`. Provenance: **Implemented**. Whether that host still serves this tree is **Unknown / Requires Confirmation**.

## Dependencies known from the tree

- PHP `>= 5.4.0` in the theme `composer.json`. WooCommerce Payments' readme says it requires PHP 7.0. WordPress 6.0.2's own requirement is not re-stated here beyond the version constant. Which PHP the live host ran is **Unknown**.
- Composer package `phpmailer/phpmailer` `^6.1` for the theme mailer.
- Node, gulp, and Bower, documented in the theme README as the Sage build. Whether anyone still builds assets that way is **Unknown**.
- MySQL, two logical databases, connection constants not in Git.
- Office 365 SMTP.
- Google Analytics property `UA-1288630-36` in `analyticstracking.php`. Whether the theme still prints that file is **Unknown** (the file exists; a call site was not confirmed in this pass).
- External page `https://sabullion.co.za/dashboard/login.php` linked from calculator emails. Not in this commit.

## Current status

| Item | State |
|---|---|
| Git history | One commit, 2022-10-01, branch `master` only |
| Product documentation inside the source repo | Theme README is the upstream Sage / Rocket Theme readme. No SA Bullion project plan |
| Silicon Ark before this change | No `sabullion_current_live/` directory. `sabullion/` is a different remote |
| Runnable from this commit alone | No. Root WordPress bootstrap and `wp-config.php` are absent, and database constants are undefined in Git |
| Active development in this remote | No commits after the import |

## Milestones

No milestone document exists. The only dated markers are the comments and the import commit above.

## Implementation plan

There is no plan file in the repository. Nothing in Git describes future work. Provenance: **Unknown**.

## Human confirmation

- Whether `https://sabullion.co.za` still runs this snapshot, a later tree, or another repository.
- Where `DB_ACCESS_HOST`, `DB_ACCESS_USER`, `DB_ACCESS_PASSWORD`, `DB_ACCESS_NAME`, and the matching `DB_WEB_*` constants are defined at runtime.
- Which theme is active, and which of the vendored plugins are active.
- Whether the missing root PHP files exist on the server outside Git.
- Whether `sonar-project.properties` and `sonarqube_scan.bat` were only local scan files.
- The Office 365 password in `config/mailer.php` is in Git. It should be treated as exposed. The value is intentionally omitted here.
- Relationship to the `sabullion` repository and to `/dashboard/login.php`.