# PRD — unity

Evidence date: 2026-09-30.

Source: `git@bitbucket.org:overdrive/unity.git`, `master` at `7ac64a5` (2019-04-09, "wiki testing"). Differences on `develop` at `7a19009` are called out where they change behaviour.

There is no prior PRD in the source repository or in `silicon_ark/unity/`. `README.md` is Bitbucket's starter tutorial and states no product requirement. Requirements below are recovered from the implementation. Provenance is labelled. The committed private key is not reproduced.

The repository name "unity" is not used in the user interface. The screens say Silicon Overdrive, SO2, and SO.2.

## Product purpose

**Implemented.** A browser can open a Silicon Overdrive login screen and continue into a static admin shell built on INSPINIA 2.8. The shell lists dashboards named Software, Technical, Support, HR, and Finance. Those pages are theme samples. They do not read or write department data.

**Implemented, `master` only.** The directory `wiki/` is TiddlyHome 0.1.3, a PHP multi-site host for TiddlyWiki 2.4.1 (BidiX, 2005–2008, described in `wiki/index.xml` as a "Multi-site & multi-user hosting service package for TiddlyWiki"). The shell does not link to it. Commit message: "wiki testing".

**Unknown / Requires Confirmation:** whether the product is the admin shell, the wiki package, or an unfinished combination, and what "unity" was supposed to mean.

## Users and roles

| Actor | Evidence | Status |
|---|---|---|
| Person at the login screen | `index.html` form. Inputs have no `name`. Action is `views/dashboard/index.html` | **Implemented** as navigation. Credentials are not checked |
| Person shown in the shell | Static text "Jaco Brits", "Software Director" in `views/dashboard/index.html` | **Implemented** markup. Not loaded from a session |
| Deploy operator | Pipeline and CodeDeploy scripts | **Inferred** from those files. No user interface |
| TiddlyHome Admin | `wiki/_th/admin/init.php` creates user `Admin` and an `.htaccess` with `Require user Admin` | **Implemented** in the bundled package, `master` only. Runs only after that script is requested on a PHP host |
| TiddlyHome site owner and author-team members | `wiki/_th/lib/siteForm.php`, `Site::setGroup()` | **Implemented** in the bundled package. Apache group on the site directory |
| Reader / Author / default mode | Described inside the TiddlyWiki content (`wiki/index.xml` NewsWiki item) | **Documented** by the third-party wiki content. Not a Silicon Overdrive account role |

No login session connects the shell to TiddlyHome users.

## Systems the product talks to

1. The visitor's browser, loading HTML, CSS, and JavaScript from the same tree.
2. Google Fonts, imported by `assets/css/style.css`.
3. AWS S3 and AWS CodeDeploy, if the pipeline scripts run. Application names, bucket, deployment group, and deployment config are environment variables. Their values are not in git.
4. `httpd` on the CodeDeploy host. The install script uses `yum`.
5. PHP and Apache auth files, if someone uses `wiki/`. The deploy scripts do not install PHP.

There is no database, identity provider, mail sender, or queue. Email screens under `views/template/` are theme samples. Nothing in the application sends mail.

## Major workflows

### WF-1 — Open the login screen and continue

`index.html` shows logo `SO2`, heading "Welcome to Silicon Overdrive", and the sentence "Silicon Overdrive user login to manage your services , projects."

The form:

- `action` is `views/dashboard/index.html`.
- Method is the HTML default, GET.
- Email input: `type="email"`, placeholder "Username", `required`, no `name`.
- Password input: `type="password"`, placeholder "Password", `required`, no `name`.
- Submit button label is "Login".

Because the inputs have no `name`, a successful submit does not put the typed values on the query string. The browser navigates to the dashboard file. Any non-empty password and any string the browser accepts as an email will pass the `required` / `type="email"` checks. Empty fields are blocked by the browser's built-in validation.

Provenance: **Implemented**.

On `master` the title is "Silicon Overdrive - jaco" and the footer is "Silicon Overdrive WebApp framework © 2019". On `develop` the title is "Silicon Overdrive" and the footer adds " - DEVELOPMENT".

"Forgot password?" is `href="#"`. It does not open a reset flow.

"Create an account" links to `views/register.html`. That file is not in the tree. The theme register page is `views/template/register.html`.

### WF-2 — Use the management shell

`views/dashboard/index.html` is a full page titled "SO.2 | Dashboard". The file header comment says "Silicon Overdrive - Responsive Admin, version 2.8".

The side menu contains:

- Dashboards. "Dashboard Software" links to `../template/index.html`, not to this file. "Dashboard Technical", "Dashboard Support", "Dashboard HR", and "Dashboard Finance" link to `dashboard_2.html`, `dashboard_3.html`, `dashboard_4_1.html`, and `dashboard_5.html` in the same folder.
- Layouts, graphs, mailbox, metrics, widgets, forms, app views, other pages, miscellaneous, UI elements, tables, gallery, e-commerce, and the rest of the INSPINIA catalogue. Most of those links point at `views/template/`.
- Landing Page links to `landing.html` beside the shell. That file is not in `views/dashboard/`. The theme copy is `views/template/landing.html`.
- Package links to `../template/package.html`.

There is no Wiki item in this menu. `wiki/` is not referenced.

The top bar says "Welcome to Silicon Overdrive +2." Its search form `action` is `search_results.html` and the text input is named `top-search`. `views/dashboard/search_results.html` is not in git. The theme copy is `views/template/search_results.html`.

The profile menu shows "Jaco Brits" / "Software Director" and links to `profile.html`, `contacts.html`, and `mailbox.html` in the same directory. Those files are not in `views/dashboard/`. They exist under `views/template/`. Logout in that menu is `href="/index.html"` (site root). Logout in the top bar is `../template/login.html`.

The body is the INSPINIA sample dashboard: a "Welcome Jaco" list, sales figures ($ 406,100 and $ 150,401), charts, and a timeline. The timeline wrapper class on this file is `Silicon Overdrive-timeline`. The template original uses `inspinia-timeline`. Neither class name appears under `assets/` in `.css`, `.scss`, or `.less`.

A toast script calls `toastr.success('Management System', 'Welcome to Silicon Overdrive')`.

The footer copyright line is "Silicon Overdrive © 1996-2019". That is static text. It is not evidence of a company founding year.

Provenance: **Implemented** markup.

### WF-3 — Open a department-labelled dashboard

| File | Submenu label on the shell | Also in git |
|---|---|---|
| `views/template/index.html` | Dashboard Software | Theme home. Welcome text on template pages is the theme line, not "+2" |
| `views/dashboard/dashboard_2.html` | Dashboard Technical | |
| `views/dashboard/dashboard_3.html` | Dashboard Support | |
| `views/dashboard/dashboard_4_1.html` | Dashboard HR | |
| `views/dashboard/dashboard_5.html` | Dashboard Finance | |
| `views/dashboard/dashboard_4.html` | Not linked from the shell | Top-navbar layout. Brand text "Silicon Overdrive" |

These pages show theme charts and sample projects. They do not query a Software, Technical, Support, HR, or Finance system.

Provenance: **Implemented** as labelled links. The department behaviour is **not implemented**.

`views/dashboard/index.html` is identical on `master` and `develop`. The department labels and the "+2" welcome are on both tips. `591b740` and `efd1d18` are `master`-only and cancel each other out on that file (title changed to "SO.2 Jaco | Dashboard", then restored).

### WF-4 — Deploy

On a push that Bitbucket Pipelines builds:

- `master` runs `codedeploy_deploy.py`.
- `develop` runs `codedeploy_deploy_develop.py`.

Each script uploads `/tmp/artifact.zip` to S3 and calls `create_deployment`. The pipeline zips `*` in the repository root, so the zip includes the private key file, the theme, and (on `master`) `wiki/`.

`appspec.yml` copies `/` to `/var/www/html/`. Hooks, all `runas: root`:

- `ApplicationStop`: `scripts/stop_server`
- `BeforeInstall`: `scripts/install_dependencies`, then `scripts/start_server`

There is no `ApplicationStart` hook. `httpd` is started before the new files are copied.

Provenance: **Implemented** as scripts. Whether a live account still has the pipeline variables is **Unknown**.

### WF-5 — Initialise TiddlyHome and create a site (`master` only)

This workflow is the bundled package. It is not branded Silicon Overdrive. Nothing in the shell starts it.

1. A browser requests `wiki/_th/admin/init.php`. If `wiki/_th/admin/.htaccess` already exists, the script prints "TiddlyHome Admin already initialize !" and exits.
2. GET shows a form: admin password (at least five characters), confirm password, admin email.
3. The browser script blocks submit when the password is shorter than 5 characters, the confirmation differs, or the email is shorter than 3 characters. The PHP `processForm` does not repeat those checks.
4. POST writes `.htpasswd` (user `Admin`), `.htgroup` (group `Admin` contains `Admin`), `.htaccess` (`AuthType Basic`, `Require user Admin`), and `wiki/_th/lib/config.php`.
5. Later admin pages such as `wiki/_th/admin/sites.php` `require` `config.php`. Until init has run, that require fails. `config.php` is not in git.
6. Creating a site (`action=new`) checks the owner password against the admin htpasswd file, rejects a site that already exists, then copies a template to a new directory named after the site, writes a public or private `.htaccess`, and records a group that always includes the owner.

Provenance: **Implemented** in third-party PHP. It was added in one commit and not mentioned in the README.

Default new-site flavour is `empty.html` (`Site` class). Templates also include `NewsWiki.html` and `NewsWikiFR.html`.

## Functional requirements recovered from the implementation

### FR-001 — Show the login screen

The system serves `index.html` with the SO2 logo, the welcome heading, username and password fields, Login, Forgot password?, and Create an account.

- Trigger: browser opens the file.
- Validation: browser `required` and `type="email"` only.
- Output: the dashboard HTML file when the browser accepts the fields.
- Error: the browser blocks empty fields. There is no server error page for a bad password.
- Provenance: **Implemented**.

### FR-002 — Do not authenticate the shell login

The system does not read the password, does not set a cookie, and does not look up a user.

Provenance: **Implemented**. A requirement that login must succeed only for real accounts is **not** in the code. If that was the intent, it was not built.

### FR-003 — Open the admin shell after Login

Login navigates to `views/dashboard/index.html`.

Provenance: **Implemented**.

### FR-004 — Present department dashboards as menu labels

The shell labels five dashboard links Software, Technical, Support, HR, and Finance, pointing at the files in WF-3.

Provenance: **Implemented** as labels and links. Data behind the labels is sample HTML.

### FR-005 — Offer the theme catalogue from the shell

The side menu links to the INSPINIA demo pages under `views/template/` for graphs, mailbox, forms, projects, calendar, invoices, e-commerce, and the other sections present in `views/dashboard/index.html`.

Provenance: **Implemented** as static navigation.

### FR-006 — Account creation and password reset

The login screen offers both actions. Create an account points at a missing file. Forgot password points at `#`.

Provenance: **Implemented** as links only. The flows are **not implemented**.

### FR-007 — Search from the shell

The top search form submits `top-search` to `search_results.html` next to the shell. That target file is not in git.

Provenance: **Implemented** as a form. Results are **not implemented** for this path.

### FR-008 — Deploy `master` and `develop` through CodeDeploy

A pipeline on those branches packages the tree and asks CodeDeploy to copy it to `/var/www/html/` and to run the `httpd` scripts.

Provenance: **Implemented** in YAML and Python. Success depends on environment variables and AWS credentials that are **Unknown** from the repo.

### FR-009 — Serve files with httpd

The host hooks install and start `httpd`. They do not install any other runtime.

Provenance: **Implemented**.

### FR-010 — Host TiddlyWiki sites on `master`

After admin init, the TiddlyHome scripts can register a user, create a site directory, set access to `public` or `private`, and store the wiki as files. Public sites still declare Basic auth, and `Require group` applies to files matching `store*` (`wiki/_th/templates/htaccessPublic`). Private sites require the site group for the directory (`htaccessPrivate`).

Provenance: **Implemented** in the bundled package. Not linked from the shell. Absent on `develop`.

### FR-011 — Keep shell identity and wiki identity separate

The shell's "Jaco Brits" profile is HTML. TiddlyHome users live in `.htpasswd` created at runtime. No code copies one into the other.

Provenance: **Implemented** by the absence of any join, and by the two trees.

## Integrations

| System | Direction | Trigger | Data | Auth | Failure |
|---|---|---|---|---|---|
| Browser | In | User opens HTML | Pages and assets | None | Missing targets 404 at the web server. Several shell links point at files that are not in that folder |
| Google Fonts | Out | CSS `@import` | Font CSS | None in repo | If the network blocks fonts, the pages still load with fallback fonts. **Inferred** |
| AWS S3 | Out | Pipeline after zip | `APPLICATION_NAME` or `APPLICATION_NAME_DEV` plus a timestamp key, body `/tmp/artifact.zip` | boto3 default credential chain. Not configured in git | Script prints the client error and `sys.exit(1)` |
| AWS CodeDeploy | Out | After a successful upload | Application name, deployment group, deployment config, S3 revision | Same | Script prints the error and exits 1. It also returns false when status is Failed or Stopped. `ignoreApplicationStopFailures` is true |
| httpd | Local on the host | CodeDeploy hooks | Start or stop the service | root | `stop_server` is a Bash script whose assignment is written `isExistApp = \`pgrep httpd\`` with spaces around `=`. Bash does not treat that as a variable assignment. Whether stop succeeds on a host was not executed here |
| TiddlyHome PHP | Local, `master` only | HTTP request to `wiki/**/*.php` | Forms, wiki files, htpasswd | Apache Basic after init | `config.php` missing until init. PHP not installed by the hooks. `eregi()` in `Htpasswd.php` does not exist on PHP 7+ |

## Constraints

- No database. Wiki state is files under the web root once sites are created.
- CodeDeploy destination is fixed: `/var/www/html/`.
- Pipeline image is pinned to `python:3.5.7`. boto3 is pinned to `1.3.0`.
- The zip is `zip -r /tmp/artifact.zip *`, so every root entry, including `SOawsCodeDeploy.pem`, is in the revision copied to the web root.
- Shell login cannot enforce a password policy because the password is never submitted.
- TiddlyHome client rules (password length, username shape) are not repeated in the PHP that writes the user.
- On a host whose `php_uname()` matches `windows` (case-insensitive `eregi`), `bidix_crypt` returns the password unchanged. The bundled wiki text says the same thing. Provenance: **Implemented** and **Documented** inside the package.

## Behaviour that looks like data and is not

Sample sales totals, "42 messages and 6 notifications", mailbox badge `16/24`, follower names, and the 1996 copyright year are HTML. They are not queried.

## Removed behaviour

| Item | When | Evidence |
|---|---|---|
| Sinatra hello-world on `/` | Removed in `8af29ca` | `git show c948365:app.rb` |
| Pipeline `test` branch and `codedeploy_deploy_test.py` | Removed in `98f1832` | History of those paths |
| Early artifact that zipped only `app.rb`, `appspec.yml`, and `scripts/*` | Replaced by `zip *` | Diff in `c760980` still shows the narrow zip; current YAML zips `*` |

## Discrepancies

- Task-creation listing included `sonar-project.properties` and `sonarqube_scan.bat`. They are not in git. **Unknown** whether they were untracked files on the scan host.
- `develop` footer says DEVELOPMENT. `master` does not. The pipeline treats `master` as production.
- The shell welcome says "Silicon Overdrive +2." The toast says "Welcome to Silicon Overdrive" / "Management System". The template pages say "Silicon Overdrive Management System."
- "Dashboard Software" opens the theme dashboard, not `views/dashboard/index.html`.
- Logout targets disagree: `/index.html` versus `views/template/login.html`.
- A private key is deployed to the web root by the same spec that publishes the site. The Python deployers never open the PEM file.
- `wiki/` is on `master` and is not on `develop`, and the UI never links to it.