# Features — skeleton

Evidence date: 2026-10-03. Source: `https://bitbucket.org/overdrive/skeleton.git`, `master` `43b5796` (2020-02-27).

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Unknown**.

No features list existed in the repository or in `silicon_ark/skeleton/` before this file.

The README describes a product. The code is a CodeIgniter 4 starter with one custom response. Those are recorded separately so a later reader does not treat the README list as working software.

## Current (implemented)

### F-001 — HTTP front controller

`public/index.php` checks PHP `>= 7.2`, defines `FCPATH`, loads `app/Config/Paths.php`, and runs the framework. **Implemented**.

### F-002 — CLI spark entry

`spark` refuses `php-cgi`, sets `FCPATH` to `public/`, boots the same framework, and runs `CodeIgniter\CLI\Console`. **Implemented**. Commands such as `serve` and `migrate` are not defined in this repository. They arrive with `codeigniter4/framework`. **Inferred** from `Paths.php` and the README's `php spark serve`.

### F-003 — Route `/` renders a placeholder view

`GET /` calls `App\Controllers\Home::index`, which returns `view('login/login')`. The view file prints `jaco` and nothing else. Auto-routing is enabled, so `/home` and `/home/index` hit the same method. **Implemented**.

Files: `app/Config/Routes.php`, `app/Controllers/Home.php`, `app/Views/login/login.php`.

This is not a login feature. There is no form and no credential check.

### F-004 — Framework configuration shipped with the starter

`app/Config/` contains the CodeIgniter 4 app-starter config set (app, cache, database, email, encryption, filters, logger, migrations, modules, routes, validation, and the rest of that directory). Values that affect behaviour are recorded in `business-rules.md` and `technical-documentation.md`. They were not edited to match the README product. The only route change from a stock starter is the `Home` method body and the added view. **Implemented** as files. Comparison with an upstream tarball was not done file-by-file beyond `Home`, the login view, and the README diff. Anything else in `app/Config/` matching upstream defaults is **Inferred** from the file comments and the "First Commit" importing the starter in one shot.

### F-005 — Apache hardening for non-public directories

`app/.htaccess` and `writable/.htaccess` deny all HTTP access. `app/index.html` is a static 403 page. `public/.htaccess` enables rewrite to `index.php`, strips trailing slashes, redirects `www.` to the bare host over `http` only when HTTPS is off, and copies the `Authorization` header into the environment. **Implemented**.

### F-006 — Writable directories for sessions, cache, logs, and uploads

`writable/session`, `writable/cache`, `writable/logs`, and `writable/uploads` each contain `index.html` only. `.gitignore` ignores their contents except `index.html`. Session save path and file cache path point here. No application code writes a session, a cache entry, or an upload. **Implemented** as locations. Unused by the current controller.

### F-007 — Environment template and gitignore

`env` is the commented CodeIgniter environment template. `.gitignore` excludes `.env`, `vendor/`, `composer.lock`, `writable` contents, IDE folders, and PHPUnit output. **Implemented**.

### F-008 — PHPUnit harness and example tests

`phpunit.xml.dist` bootstraps `vendor/codeigniter4/framework/system/Test/bootstrap.php`, collects `./tests`, and points the test database at SQLite `:memory:`. Application tests:

| Test | What it asserts | Covers the product? |
|---|---|---|
| `tests/unit/HealthTest.php` | `APPPATH` is defined, and base URL is set in `.env` or in config | No assertion on `Home` or the login view |
| `tests/database/ExampleDatabaseTest.php` | `Tests\Support\Models\ExampleModel` findAll count and soft delete | Support fixture, not `app/Models` |
| `tests/session/ExampleSessionTest.php` | Session key `logged_in` can be set to `123` and read back | Example only. Not an application login |

`tests/_support/` holds framework fixtures (migrations, seeders, sample models, images, language files). **Implemented** as starter tests. They do not encode the README product.

### F-009 — Dependency stability script

`builds` is a PHP CLI script. `php builds release` forces `codeigniter4/framework` to `^4@rc` and points path strings at `vendor/codeigniter4/framework`. `php builds development` sets minimum stability `dev`, adds the GitHub VCS repository, and requires `codeigniter4/codeigniter4: dev-develop`. The committed `composer.json` requires `codeigniter4/framework: ^4` and has no `repositories` key, which matches the release side of that script except the script's pin is `^4@rc` and the file says `^4`. **Implemented** as a tool. Not wired to a pipeline.

### F-010 — Stock welcome and error views

`app/Views/welcome_message.php` and `app/Views/errors/` are present. `Home` does not render the welcome view. Error views are selected by `Config\Exceptions::$errorViewPath`. **Implemented** as files. Welcome page is unused.

### F-011 — Licenses

`LICENSE` and `license.txt` are MIT licenses for CodeIgniter. `composer.json` `"license": "MIT"`. **Implemented** as files.

## Documented, not implemented

These appear in `README.md` "Basic Description" or "Tech Stack". No route, class, or asset implements them.

| Id | README item | Source location that would be expected | Status |
|---|---|---|---|
| F-101 | Password-protected login | No form in `app/Views/login/login.php`. No auth filter. | **Documented**. Not implemented. |
| F-102 | 2FA | No library, route, or view. | **Documented**. Not implemented. |
| F-103 | User dashboard and left menu (Dashboard, Profile, Documentation, Settings) | No views or routes. | **Documented**. Not implemented. |
| F-104 | Settings: User Management and User group | No controllers. | **Documented**. Not implemented. |
| F-105 | Weather widget | No widget view or external client. | **Documented**. Not implemented. |
| F-106 | User profile: details, image upload, security group | `writable/uploads` is empty. No profile controller. | **Documented**. Not implemented. |
| F-107 | Add and delete users; create roles or groups | `app/Models` and `app/Database` are empty. | **Documented**. Not implemented. |
| F-108 | Bootstrap 4 UI | No CSS or JS vendor files. `public/` has `index.php`, `.htaccess`, `robots.txt`, and `favicon.ico` only. | **Documented**. Not implemented. |

`robots.txt` allows all user agents (`Disallow:` empty). That is a file, not a product feature. **Implemented**.

## Planned

Nothing in the repository is marked TODO, FIXME, or "coming soon" in application code. The README list above is the only forward-looking text, and it is written as a description of the product rather than as a schedule.

Status of that list: **Documented**. Calling it an approved roadmap would be a product decision. **Unknown / Requires Confirmation**.

`app/Database/Migrations/` is empty, so there is no in-progress schema. `Filters.php` contains a commented example of an `isLoggedIn` filter and does not register one. That comment is framework sample text, not an Overdrive task.

## In development

No branch other than `master`. No commit after 2020-02-27. Nothing is in development inside this repository.

## Recently changed

The newest commit, `43b5796` ("Update repo", 2020-02-27), changes only `README.md`.

The previous commit, `1eaca43` ("First Commit", same day), adds the app starter. `Home::index` already returns `login/login` in that commit. The placeholder view is not part of the later README edit.

`e3803cc` ("Initial commit") is the Bitbucket README template and nothing else.

## Completed

Relative to a CodeIgniter 4 app starter checkout: the starter files are committed and the home controller points at a placeholder view. Relative to the README product: nothing in that list is completed.

## Deprecated or removed

Git history does not delete a feature after it was added. The Bitbucket README template from `e3803cc` was replaced by the Silicon Skeleton README in `43b5796`. The stock welcome view remains in the tree and is simply not routed.

`contributing.md` describes CodeIgniter 4's own contribution process. It was added in `1eaca43` and not removed. It does not describe a deprecated Overdrive feature.

## Not present (scan listing versus git)

A directory listing captured on 2026-09-28 named `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Commit `43b5796` does not contain them. They are not a feature of this revision. Whether the scan host had untracked copies is **Unknown / Requires Confirmation**.