# `Sigra.Install.Features.Core`
[🔗](https://github.com/sztheory/sigra/blob/v1.20.0/lib/sigra/install/features/core.ex#L1)

`Sigra.Install.Feature` implementation for v1.0's core authentication
scaffold: users, sessions, tokens, MFA, sudo, reset password, confirmation,
audit events, and (optionally) API token, JWT, and LiveView UI.

Owns every template under `priv/templates/sigra.install/core/` and every
router/config/runtime.exs injection needed to wire the v1.0 auth surface
into a fresh Phoenix app. This module is the single mandatory feature in
the `mix sigra.install` walker's canonical feature list.

`enabled?/1` always returns `true` — Core is mandatory (Phase 11 Success
Criterion #4). The `--api` / `--jwt` / `--live` flags are Core-owned
sub-options that gate file groups, not whole features; they live here
rather than as separate features because they are historical v1.0 options
with deeply intertwined shared state (the API token schema references the
same users table, the login page is always emitted regardless of `--live`,
etc.).

## Binding contract

Features.Core expects a binding keyword list shaped like the one built
by `Mix.Tasks.Sigra.Install` before it invokes the walker:

  * `:otp_app` — atom or string (the host app's otp_app, e.g. `:my_app`)
  * `:context_alias` — string (the context's module suffix, e.g. `"Accounts"`)
  * `:context_module` — string (the full context module as an inspected
    string, e.g. `"MyApp.Accounts"`)
  * `:schema_alias` — string (the schema suffix, e.g. `"User"`)
  * `:web_module` — string (e.g. `"MyAppWeb"`)
  * `:opts` — keyword sublist gating `:live` / `:api` / `:jwt`

Migration targets and injection bodies are derived from these fields at
callback invocation time; Features.Core does not read the filesystem
directly (`post_instructions/2` is the lone exception — it reads
`config/config.exs`, `config/runtime.exs`, and `config/dev.exs` to detect
host-app Oban and Swoosh integration, matching the v1.0 monolith's
`inject_oban_queue/1` and `inject_swoosh_config/2` helpers).

## Isolation invariant (Pitfall X-1)

This module contains ZERO references to `Features.Organizations`,
`Features.Passkeys`, or `Features.Admin`. That boundary is what makes
`mix sigra.install --no-organizations` produce a compiling app even with
no Organizations code present in a future phase. The isolation is enforced
mechanically by `Sigra.Install.Features.CoreTest`'s isolation test.

---

*Consult [api-reference.md](api-reference.md) for complete listing*