# Project plan — tom

Evidence date: 2026-10-01.

Source repository: `git@bitbucket.org:overdrive/tom.git` (cloned from `https://bitbucket.org/overdrive/tom.git`).

Inspected revision: `0ceed11` (2022-09-30, "Prolong cookie expiry time") on `master`. That commit is `origin/HEAD`. There are no other remote branches.

The scan-host path named in OVER-310 (`~/projects/sonar_scan/repos/tom`) was not present on this machine. The clone tip matches the commit OVER-310 recorded (`0ceed11`, 2022-09-30, "Prolong cookie expiry time").

This plan describes what the repository contains. It does not decide what the product should become.

## Product

`tom` is a WordPress 4.9.21 site for the **Old Mutual Two Oceans Marathon** (OMTOM). The only theme is **OMTOM** 1.0, written by Hero Digital / Hero Strategic Marketing (`https://hero.co.za`) for that event. Provenance: **Documented** in `wp-content/themes/omtom/style.css` and `README.txt` (copyright 2018, changelog "Released: September 10, 2018").

The public site identity used in templates is "Two Oceans Marathon". The Twitter card site handle is `@2OceansMarathon` (`wp-content/themes/omtom/header.php`). Root favicon files are named `omtom-favicon.ico`, `two-oceans-favicon.ico`, and `two-oceans-favicon.png`.

WordPress core, the custom theme, and nine plugins are vendored in git. Page, event, and media records live in MySQL. The database name in `wp-config.php` is `twooceansmarathon`. Provenance: **Implemented**.

No project plan, product requirements document, or deployment pipeline file exists in the repository. `readme.html` is the stock WordPress readme.

## Branch reality

| Branch | Tip | Date | What it is |
|---|---|---|---|
| `master` (only branch; `origin/HEAD`) | `0ceed11` | 2022-09-30 | Full WordPress tree, OMTOM theme, nine plugins |

History, oldest first:

| Commit | Date | Author | Subject |
|---|---|---|---|
| `aa65c90` | 2022-09-29 | Jaco Brits (`jaco@overdrive.co.za`) | Initial commit |
| `c5cd0fb` | 2022-09-29 | Rachel Mogano (`rachel@overdrive.co.za`) | First commit |
| `2f1a52b` | 2022-09-30 | liam-ovd | Fix cookie issue, set the notice cookie on page load in footer, thereafter it won't show the popup again |
| `0ceed11` | 2022-09-30 | liam-ovd | Prolong cookie expiry time |

No commits after 2022-09-30. Provenance: **Implemented** (`git log`).

The two commits after the WordPress import both edit only `wp-content/themes/omtom/functions.php` (cookie notice).

OVER-310 listed `sonar-project.properties` and `sonarqube_scan.bat` at the scan-host root. Those files are not in `0ceed11`. Provenance: **Unknown** — they may have been untracked files on the scan host. `phpinfo.php` is in git.

## Objectives (inferred from the theme, not from a written plan)

No written product objective exists beyond the theme description. The following are **Inferred** from templates, post types, and assets:

- Publish the public website for the Old Mutual Two Oceans Marathon.
- Present race events, route maps, race-day information, prizes and medals, entry information, and T-shirts.
- Publish news, a blog, press releases, a medical corner, photo and video galleries, sponsors, FAQs, hospitality, history, and charity content.
- Collect newsletter subscriptions and contact-form messages.
- Show a cookie notice.
- Serve theme assets from CloudFront and store media in Amazon S3.

Which of those are turned on in a live environment is **Unknown / Requires Confirmation**. Plugin activation and most page content are stored in the database, which is not in git.

## Scope

### In scope of the repository

- WordPress 4.9.21 core (`wp-admin`, `wp-includes`, root bootstrap PHP files). `$wp_version` in `wp-includes/version.php` is `4.9.21`. `$wp_db_version` is `38590`. No `$wp_local_package` assignment was found.
- Theme: `wp-content/themes/omtom` only. No bundled default themes (Twenty Seventeen and similar) are in the tree.
- Plugins under `wp-content/plugins/`: WP Offload Media Lite 2.0.1, Crazy Egg 2.1, Disable XML-RPC Pingback 1.1, SSL Insecure Content Fixer 2.7.2, TablePress 1.9.1, W3 Total Cache 0.9.7.2, Wordfence Security 7.2.1, Yoast SEO 9.6, SEOPress 3.3.8.1.
- `wp-config.php` (tracked). See technical documentation. Secret values are not copied into Silicon Ark.
- `wordfence-waf.php` at the web root, pointing at `/var/www/html/twooceansmarathon/`.
- `phpinfo.php` at the web root.
- Theme route files: KML and JSON under `wp-content/themes/omtom/assets/kml/` and `assets/objects/`.

### Out of scope / not in this repository

- The MySQL database. Posts, pages, menus, theme-option values, plugin activation, and users are **Unknown** from git alone.
- A `CREATE TABLE` for `wp_omtom_subscriptions`. The theme inserts into that table. How the table is created is **Unknown**.
- `wp-content/uploads/` was not part of the inspected tree as a populated media library. Media delivery is configured toward S3 and CloudFront.
- Bitbucket Pipelines, Composer, npm, Docker, and automated tests. None of those files are at the repository root.
- SonarQube project files named by OVER-310. Not in git.

## System architecture

```text
Browser
  -> WordPress 4.9.21 (PHP)
       -> theme OMTOM (templates, admin meta, AJAX)
       -> MySQL database `twooceansmarathon` (table prefix `wp_`)
       -> PHP mail() for the contact form
       -> Touchbase Pro HTTPS API for newsletter subscribers
       -> Instagram legacy API, Facebook JS SDK, Twitter widgets, Google Maps JS
       -> Amazon S3 bucket `twooceans-marathon` (eu-west-1) and CloudFront
            host d19jcneif5xmtf.cloudfront.net for theme asset URLs
```

Provenance: **Implemented** in theme PHP/JS and `wp-config.php`, except the live binding of CloudFront and S3, which is **Inferred** from hardcoded asset URLs plus the WP Offload Media settings constant. Whether that CDN still serves the site is **Unknown / Requires Confirmation**.

Wordfence's WAF bootstrap expects the site directory `/var/www/html/twooceansmarathon/`. Provenance: **Implemented** in `wordfence-waf.php`. Whether that path is the current production host is **Unknown / Requires Confirmation**.

A commented block in `wp-config.php` names an Amazon RDS host in `eu-west-1`. The active `DB_HOST` in the same file is `localhost`. Provenance: **Implemented** as file contents. Which host a deployed site uses is **Unknown / Requires Confirmation**.

## Major components

| Component | Role | Evidence |
|---|---|---|
| WordPress core 4.9.21 | CMS, admin, cron, login | `wp-includes/version.php` |
| Theme OMTOM 1.0 | Public templates, custom post types, forms, maps | `wp-content/themes/omtom/` |
| WP Offload Media Lite 2.0.1 | Copy uploads to S3 / Spaces | Plugin header; `AS3CF_SETTINGS` in `wp-config.php` |
| W3 Total Cache 0.9.7.2 | Page cache plugin. `WP_CACHE` is `false` in `wp-config.php` | Plugin header; `wp-config.php` |
| Wordfence 7.2.1 | Firewall / malware scan | Plugin header; `wordfence-waf.php` |
| Yoast SEO 9.6 and SEOPress 3.3.8.1 | Both vendored. Which one is active is unknown | Plugin headers |
| TablePress 1.9.1 | Tables in content | Plugin header |
| Crazy Egg 2.1 | Heatmap script | Plugin header |
| Disable XML-RPC Pingback 1.1 | Removes pingback from XML-RPC | Plugin header |
| SSL Insecure Content Fixer 2.7.2 | HTTPS mixed-content cleanup | Plugin header |
| Custom table `wp_omtom_subscriptions` | Newsletter name and email rows | `classes/forms/forms.php`, `classes/reporting/reporting.php` |

## Milestones visible in git

There is no milestone plan in the repository. The observable history is:

1. 2018-09-10 — theme README says version 1.0 was released. That date is documentation inside the theme, not a git tag.
2. 2022-09-29 — repository created and the WordPress tree committed.
3. 2022-09-30 — cookie notice changed so the disclaimer cookie is set from the footer on load, then the expiry was lengthened to 10 years.

Nothing in git describes work after 2022-09-30.

## Implementation plan

No forward implementation plan is in the repository or in `silicon_ark/tom/` (this directory did not exist before this onboarding).

## Known dependencies

- PHP and MySQL sufficient for WordPress 4.9.21. Exact PHP version is **Unknown**. `phpinfo.php` would print it on a server where that file is web-accessible.
- Amazon S3 and CloudFront, as hardcoded and as configured for WP Offload Media.
- Google Maps JavaScript API key stored in the `api-google-maps` option (admin field). A key is also present in a comment in `assets/js/maps.js`. The value is omitted here.
- Facebook, Twitter, and Instagram credentials stored in WordPress options, not in git.
- Touchbase Pro (`api.touchbasepro.com`) for newsletter sync. A list identifier and bearer token are hardcoded in `classes/forms/forms.php`. Values are omitted here.
- Google Forms embed on the charity application template.
- Webtickets is named by CSS classes and image assets (`webtickets`). The "ENTER NOW" anchors in `single-events.php` have an empty `href`. A working entry URL is **not** implemented in that template.

## Current project status

- Repository state: idle since 2022-09-30. One branch, `master`, in sync with `origin/master` at inspection time.
- Product documentation in the source repo: theme `README.txt` and stock `readme.html` only.
- Silicon Ark: this onboarding set is the first `silicon_ark/tom/` documentation.
- Production status in 2026 (still deployed, retired, or replaced) is **Unknown / Requires Confirmation**.

## Human confirmation

- Confirm the public domain and whether `/var/www/html/twooceansmarathon/` is still the deploy path.
- Confirm whether production uses `localhost` or the commented RDS host, and rotate every secret committed in `wp-config.php`, `forms.php`, and the commented key in `maps.js`. Do not treat this document as a copy of those secrets.
- Confirm which plugins are active, and whether Yoast or SEOPress is the live SEO plugin.
- Confirm that post IDs hardcoded in the theme (3, 31, 76, 79, 85, 97, 2594) still match the intended pages.
- Confirm whether `sonar-project.properties` and `sonarqube_scan.bat` should be tracked. They are not in git.