# Project plan — skeleton

Evidence date: 2026-10-03.

Source repository: `https://bitbucket.org/overdrive/skeleton.git` (`git@bitbucket.org:overdrive/skeleton.git`).

Inspected revision: `master` at `43b57964507a15800b04099027f82eafffa515dc` (2020-02-27 23:23:40 +0200, Jaco Brits, "Update repo"). The scan-host path `~/projects/sonar_scan/repos/skeleton` was not on this machine. The tree was read from that git revision.

This plan describes what the repository contains. It does not decide what the product should become.

No formal project plan existed in the repository or in `silicon_ark/skeleton/` before this file.

## Product

The README title is **Silicon Skeleton CodeIgniter 4 Application Starter** (`README.md`). The Composer package name is still `codeigniter4/appstarter`, description "CodeIgniter4 starter app" (`composer.json`). The Bitbucket slug is `skeleton`.

The tree is the CodeIgniter 4 application starter, plus two application edits: `Home::index` returns `view('login/login')`, and that view prints the text `jaco`. The README's "Basic Description" then lists a password-protected login, 2FA, a dashboard, a profile, user management, and a weather widget. Those screens are not in the tree.

Provenance of the README title and the feature list: **Documented**. Provenance of the running page: **Implemented** in `app/Controllers/Home.php` and `app/Views/login/login.php`. Whether "Silicon Skeleton" or `skeleton` is the name to use in other systems is **Unknown / Requires Confirmation**.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `43b5796` | 2020-02-27 | The only branch. CodeIgniter 4 app starter, home route pointed at a three-line view, README rewritten |

There are no other remote branches. History is three commits, all by Jaco Brits (`jaco@overdrive.co.za`):

| Commit | Date | Subject | What changed |
|---|---|---|---|
| `e3803cc` | 2020-02-27 16:58 +0000 | Initial commit | Bitbucket README template only |
| `1eaca43` | 2020-02-27 22:36 +0200 | First Commit | CodeIgniter 4 app starter tree, including `Home` and `app/Views/login/login.php` |
| `43b5796` | 2020-02-27 23:23 +0200 | Update repo | `README.md` only (57 insertions, 20 deletions) |

Whether any host still serves this tree is **Unknown / Requires Confirmation**.

## Objectives

No objectives document exists in the repository. Two different stories are visible:

**Documented** in `README.md` under "Basic Description":

- A login screen that is password protected and uses 2FA.
- A user dashboard with a left-hand menu: Dashboard, Profile, Documentation, and Settings (User Management, User group).
- A weather widget on that dashboard.
- A user profile showing the logged-in user's details, an uploaded image, and the security group assigned to them.
- User management that can add and delete users and create roles or groups.

**Implemented** at `43b5796`:

- A PHP application that boots CodeIgniter 4 from `public/index.php` and `spark`.
- `GET /` renders `app/Views/login/login.php`, whose body is the text `jaco`.
- Framework defaults for config, filters, errors, and the PHPUnit examples that ship with the starter.

The README list is not reflected in controllers, models, views, routes, or migrations. Treating that list as approved scope is a product decision. Status of each item: **Documented**, not implemented. Whether it is still the intended product is **Unknown / Requires Confirmation**.

## Scope

### In the repository

- CodeIgniter 4 app-starter layout: `app/`, `public/`, `writable/`, `tests/`, `spark`, `composer.json`, `env`, `phpunit.xml.dist`.
- One application controller (`Home`) and one application view (`login/login`).
- A README that names a larger admin product and a local run command (`php spark serve`).
- Upstream CodeIgniter 4 files: `contributing.md`, `LICENSE`, `license.txt`, the `builds` script, stock config, stock error views, and `app/Views/welcome_message.php` (not selected by `Home`).

### Not in the repository

- Login, passwords, 2FA, sessions used by application code, users, roles, groups, dashboard, profile, documentation pages, settings, weather, or file upload.
- Models, migrations, seeds, filters, helpers, and libraries under `app/` (those directories contain only `.gitkeep`).
- `vendor/` and `composer.lock` (both gitignored). The framework is a Composer dependency, not committed source.
- `.env` (gitignored). The committed file is the template `env`.
- Docker, Bitbucket Pipelines, deployment manifests, queues, workers, and cron.
- `sonar-project.properties` and `sonarqube_scan.bat`. A 2026-09-28 directory listing named both. They are not in commit `43b5796`. Whether they exist only as untracked files on the scan host is **Unknown / Requires Confirmation**.

## System architecture

Browser or CLI request enters `public/index.php` or `spark`. Both load `app/Config/Paths.php`, which points the system directory at `vendor/codeigniter4/framework/system`. The framework (installed by Composer, not stored in git) boots the app, reads `app/Config/Routes.php`, and dispatches to `App\Controllers\Home::index` for `/`. That method returns the `login/login` view.

```text
HTTP  → public/index.php → Paths → vendor framework → Routes → Home::index → Views/login/login.php
CLI   → spark            → Paths → vendor framework → CodeIgniter\CLI\Console
```

`app/` and `writable/` ship with Apache rules that deny HTTP access (`Require all denied` / `Deny from all`). The web root intended by the starter is `public/`.

There is no database schema. `app/Config/Database.php` defines a MySQLi connection with empty username, password, and database name. Nothing in `app/` opens that connection.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `public/index.php` | HTTP front controller. Stops if PHP is below 7.2. | **Implemented** |
| `spark` | CLI entry. Refuses `php-cgi`. Loads the same framework bootstrap. | **Implemented** |
| `app/Config/Routes.php` | Default controller `Home`, default method `index`, explicit `GET /` → `Home::index`, auto-routing on. | **Implemented** |
| `app/Controllers/Home.php` | The only application controller. Renders the login view. | **Implemented** |
| `app/Views/login/login.php` | Prints `jaco`. No form. | **Implemented** |
| `app/Config/*` | Stock CodeIgniter 4 configuration shipped with the starter. | **Implemented** as files; not customised for the README product |
| `writable/` | File sessions, cache, logs, uploads. Placeholder `index.html` only. | **Implemented** as directories |
| `tests/` | PHPUnit examples and framework test fixtures under `tests/_support`. | **Implemented** |
| `builds` | PHP script that rewrites `composer.json` between a release constraint and the CodeIgniter `develop` branch. | **Implemented** as a script; the committed `composer.json` is the release-style require |
| `README.md` | Names the product and describes screens that are not built. | **Documented** |

## Milestones

No milestone list, issue tracker, or roadmap file is in the repository.

What history shows:

1. 2020-02-27 — empty Bitbucket repository with the default README (`e3803cc`).
2. 2020-02-27 — CodeIgniter 4 app starter committed, with `Home` already returning the login view (`1eaca43`).
3. 2020-02-27 — README replaced with the Silicon Skeleton description (`43b5796`).

No commits after 2020-02-27. Current project status: **starter imported, product screens not built, repository idle since that date.**

## Implementation plan

No implementation plan is written in the repository. `contributing.md` is the upstream CodeIgniter 4 contributing guide (GitHub flow, `develop` branch, GPG-signed commits). This repository has only `master`, and that guide does not describe how Overdrive changes `skeleton`. Provenance: **Documented** as copied upstream text. It is not an Overdrive plan.

The README "Installation & updates" block is a clone / add / commit / pull / push sequence. It does not say to run `composer install`. `spark` and `public/index.php` cannot boot until `vendor/codeigniter4/framework` exists. That dependency step is **Inferred** from `composer.json` and `app/Config/Paths.php`, and it is absent from the README.

## Known dependencies

| Dependency | Constraint | Where |
|---|---|---|
| PHP | `>=7.2` | `composer.json`. `public/index.php` exits when `phpversion()` is below 7.2. README lists the same floor. |
| `codeigniter4/framework` | `^4` | `composer.json` `require` |
| `phpunit/phpunit` | `8.5.*` | `composer.json` `require-dev` |
| `mikey179/vfsstream` | `1.6.*` | `composer.json` `require-dev` |

PHP extensions named in the README: `intl`, `libcurl` if the HTTP CURLRequest library is used, `json`, `mbstring`, `mysqlnd`, `xml`. Those are **Documented**. This tree does not call CURLRequest. No application code uses MySQL. `mysqlnd` is required by the README, not by a query in `app/`.

`composer.json` has no `repositories` key. Install resolves `codeigniter4/framework` from the default Composer repository (Packagist). Exact installed version is **Unknown**: `composer.lock` is gitignored and `vendor/` is not in the commit. The `builds` script's `LATEST_RELEASE` constant is `^4@rc`, which is not what `composer.json` currently requires.

README also names Bootstrap 4 and MySQL. No Bootstrap stylesheet or script is in the tree. The database config driver is `MySQLi`, with empty credentials. Bootstrap 4 as a runtime dependency is **Documented** and not present. MySQL as a configured driver default is **Implemented** in `app/Config/Database.php`; a database is not created or used.

## Current project status

- Last change: 2020-02-27, README only.
- Runnable product surface: one route that prints `jaco`, after Composer installs the framework.
- README feature list: not started in code.
- Tests: starter examples. They do not cover `Home` or the login view.
- Deployment target, environment beyond the local `baseURL`, and owners other than the commit author: **Unknown / Requires Confirmation**.