# Project plan — siliconscan

Evidence date: 2026-10-03.

Source repository: `git@bitbucket.org:overdrive/siliconscan.git`.

This plan describes what that repository contains. It does not decide what the product should become.

## Product

The git repository is named **siliconscan**. The only remote branch is `master`. Its only commit is `56c90dc065177466747b45ea43b8b533007877f2` (2024-01-31, author Jaco Brits), message `latest code base , copy of label system`.

The application in that commit does not call itself siliconscan.

| Identity found in the tree | Where |
|---|---|
| Admin Overdrive Starter | `README.md` title |
| Admin Overdrive | `composer.json` `description`; mail from-name in `app/Helpers/mail_helper.php` |
| Composer package name `codeigniter4/adminstarter` | `composer.json` |
| SonarQube project key `overdrive_label_system_AYr5qv21RY8iIL6fFGD4` | `sonar-project.properties` |
| Database name `labelsystem` | `env` |
| Page title "Label System Settings" | `SystemSettings` |
| Header "SA Wine Industry information & Systems" and a SAWIS logo | `app/Views/layouts/sawis-header.php` |
| Wine and Spirit Board label certificate | `Labels::labelApprovalPDF` |

Provenance of the names above: **Documented** in those files. Provenance of "this repository is a copy of a label system": **Documented** in the sole commit message. Whether siliconscan is the product that users run, or a SonarQube mirror of a separate label-system repository, is **Unknown / Requires Confirmation**.

External documentation named in the README, and not present in this repository:

- Jira board `https://siliconsoftware.atlassian.net/jira/software/projects/SI/boards/12` (section "Development TODOS")
- Wiki `https://siliconsoftware.atlassian.net/wiki/spaces/AO/overview` (section "Documentations / Functions")

Those pages were not fetched for this onboarding.

## Branch reality

`git ls-remote --heads` on 2026-10-03 returned one head:

| Branch | Tip | Date | Subject |
|---|---|---|---|
| `master` | `56c90dc0` | 2024-01-31 | latest code base , copy of label system |

There is no other remote branch to compare. The history available from the remote is that single commit, so earlier evolution of the label workflow is not in this repository. Migrations inside the commit are dated from 2022-11-20 through 2024-01-29, which shows the copied tree contains schema history even though git history does not.

The task-creation scan (2026-09-28) listed `sonarqube_scan.bat` at the repository root. That file is not in `56c90dc0`. Provenance: **Unknown** — it may have been an untracked file on the scan host.

## Scope in the repository

In scope of what is implemented on `master`:

- A CodeIgniter 4.4.1 PHP application (`vendor/codeigniter4/framework` constant `CI_VERSION`) for wine-label submission, review, approval, rejection, contest, email, and a PDF certificate.
- Session login, self-registration, roles, and menu-based authorization inherited from the Admin Overdrive starter.
- A SAWIS Online navigation shell that links out to `sawis.local`, `qa.sawisonline.co.za`, or `sawisonline.co.za`.
- Configurable label statuses, meeting groups, and email templates (role 1 only for those admin screens).
- An organisations HTTP API with a bearer token.
- Modules that are not part of the label letterhead: vehicle cost and an affordability session API, master-file import, site health, media and uploaded files, a Selenium IDE (`.side`) runner, ChatGPT, and developer tools (menu management, CRUD generator, database admin).
- Bitbucket Pipelines configuration whose only step is a SonarQube scan on `master`.

Out of scope of the committed application, or not present as running code:

- A native mobile app. None was found.
- Product tests for labels, auth, or the APIs. `tests/` contains the CodeIgniter examples plus `HealthTest`, which only checks that `APPPATH` is defined and that a base URL is set.
- Salesforce and Africa's Talking SMS. Helpers exist. The Salesforce function body is commented out. The SMS function body is commented out. `Home::index` calls both only inside comments.
- A defined `SIDEFILEPATH`. `Test::runsideproject` calls `chdir(SIDEFILEPATH)` and `selenium-side-runner`. No definition of `SIDEFILEPATH` was found in `app/` or `env`.
- `sonarqube_scan.bat`. Named by the task scan, absent from git.
- `composer.lock`. Absent. Installed framework version is whatever is in the vendored tree (4.4.1).

## System architecture

```text
Browser
  → CodeIgniter 4.4.1 (public/index.php)
      → Filters: session login, then menu grant
      → Controllers (auto-routing on)
      → MySQL database labelsystem (MySQLi, from env)
      → Local uploads/ for label PDFs and approval certificates
  → SMTP smtp.overdriveqa.co.za (app/Config/Email.php)
  → SAWIS Online (links only, from sawis-menu.php)
  → SonarQube (Bitbucket Pipelines on master)
```

ChatGPT calls the OpenAI package when `chatGPT/sent` is used. The organisations API checks a JWT and does not use the session filters. Pixel tracking is a public image route.

## Major components

| Component | Role | Evidence |
|---|---|---|
| Welcome / Home | Login, registration, dashboard counts | `Welcome.php`, `Home.php` |
| Labels | List, form, files, approve, reject, contest, PDF | `Labels.php`, `LabelModel.php` |
| Label admin | Statuses, meeting groups, email templates | `LabelStatus.php`, `LabelUserGroups.php`, `LabelEmailTemplates.php` |
| Email | Template merge, SMTP send, sent queue, tracking pixel | `Email.php`, `mail_helper.php`, `EmailPixelTracking.php` |
| Users and menus | Users, roles, menu permissions | `Users.php`, `Authorization.php`, seeds |
| SAWIS shell | Header, logo, outbound industry menu | `sawis-header.php`, `sawis-menu.php` |
| Organisations API | JSON login and CRUD behind a bearer token | `Organisations.php`, `JwtLibrary.php` |
| Car / session | Vehicle costs and a stepped session API | `Car.php`, `CarApi.php` |
| Master file | Taste notes, history, Overland and ModelliQ import | `MasterFile.php` |
| UI tests | Upload and run `.side` files | `Test.php` |
| SonarQube | Scan `master` | `bitbucket-pipelines.yml` |

## Milestones visible in the tree

These are schema dates inside the single commit, not separate releases.

| Date | What landed in migrations |
|---|---|
| 2022-11-20 | Users, roles, menus, sessions, organisations |
| 2023-06 | Cars, app sessions, media, cronjob tables, settings, language |
| 2023-08 | Test and test log |
| 2023-10-16 | `label`, `label_note` |
| 2023-10-24 to 2023-11 | `file`, `label_log`, `label_status`, `label_provision`, meeting groups |
| 2023-12 | Email templates, file approval, file version, alcohol percentage as decimal |
| 2024-01 | Meeting group on labels, provisions on labels, `sent_queue`, tracking code |

No version tags were found. The remote has no other branch.

## Implementation plan

There is no roadmap file in the repository. The README lists a Jira board and a wiki as "Development TODOS" and "Documentations / Functions" and does not paste the items. A code comment in `Labels::createLabel` says tamper protection breaks that function and is left commented out. `LabelModel::resubmitLabelFile` has a TODO about marking the replaced file inactive.

A written implementation plan beyond those notes was **not found**.

## Known dependencies

From `composer.json` and the vendored tree:

- PHP `^8.0` (README says PHP 8.0, with intl, mbstring, mysqlnd, json, xml, and libcurl if HTTP is used)
- `codeigniter4/framework` `^4.0`, vendored as 4.4.1
- `aws/aws-sdk-php` `^3.254`
- `mpdf/mpdf` `^8.1` (used by the approval certificate)
- `phpoffice/phpspreadsheet` `^1.25`
- `orhanerday/open-ai` `^3.5`
- Dev: PHPUnit `^9.1`, Faker, vfsStream

Runtime services named in config:

- MySQL database `labelsystem` on localhost
- SMTP host `smtp.overdriveqa.co.za`, port 587, from `admin@overdriveqa.co.za`
- Optional env keys, commented out: `OPENAI_API_KEY`, `SENDGRID_API_KEY`, `GOOGLE_MAP_API_KEY`, `SMTP_HOST`, `SMTP_USERNAME`, `SMTP_PASSWORD`
- Selenium IDE runner binary `selenium-side-runner` (called, not vendored)

The AWS SDK is required by Composer. No `Aws\` usage was found under `app/` during this inspection. Whether application code calls it is **Unknown** beyond that search.

## Current project status

| Item | State |
|---|---|
| Git activity | One commit, 2024-01-31. No later commit on `master` as of 2026-10-03 |
| Silicon Ark docs before this change | None under `siliconscan/` |
| Pipeline | SonarQube analysis on `master` only. Build, test, and deploy steps were not found |
| Deployment target | **Unknown / Requires Confirmation**. README describes a WAMP vhost `adminOverdrive.local`. The SAWIS menu switches hosts by the current base URL |
| `app.baseURL` | Empty string in `app/Config/App.php`. README says to set it in `.env` |
| Default environment in `env` | `CI_ENVIRONMENT = development` |

## Human confirmation

- Is siliconscan the live label system, a scan copy, or both?
- Which host is production, and is the database still `labelsystem`?
- Are the car, master-file, ChatGPT, and Selenium modules still in use?
- Should the committed mail credentials, encryption key, JWT secret, and seeder account be rotated? Values are not repeated in this plan.