Project Status & Gaps

Last Updated: February 2026 | This page is the single source of truth for what's built, what's partial, what's planned, and what's missing.

Executive Summary

DoCurious has a comprehensive frontend prototype with 189 page components, 28 Zustand stores, 25 API modules (mock + real), and a full backend Express server with 130+ endpoints. The platform covers all 23 V2 spec documents with varying levels of completeness.

Status	Feature Sections	Description
Built	~95	Fully implemented with UI, store, and API integration
Partial	~150	Core functionality exists, some spec requirements missing
Planned	~35	Specified in V2 docs, no implementation yet
Not Started	~15	Critical gaps requiring work before launch

---

What's Working Well

These systems are spec-compliant and fully functional against mock data:

• Auth system — Login, register, OAuth stubs, JWT tokens, session management, role-based selectors, workspace switching
• Route guards — AuthGuard, AgeGuard, ConsentGuard, TierGuard, AdminRoleGuard, ContextGuard, ParentGuard
• Challenge lifecycle — Browse, start, track progress, document with Track Records, submit for verification, complete
• Track Record system — Full CRUD, 4 media types, milestone tracking, finalization flow with reflection prompts
• Community system — 6 types, 3 feed types, membership management, moderation tools, batch sharing
• Gamification — 15 levels, 7+ badge categories, weekly streaks, XP events, Journey Map, leaderboards
• School assignments — Teacher assigns → student completes → Track Record → teacher reviews
• Account management — Profile, password, 30-day deletion, data export, data access requests
• Notification preferences — Per-category/per-channel toggles, quiet hours, email digest frequency
• Admin panel — 85+ admin pages, 7 admin roles, audit log, flagged content queue, analytics dashboards
• Compliance pages — Cookie consent, Terms of Service, Privacy Policy, AUP, DMCA, School DPA, Vendor Terms, Accessibility Statement
• Type system — 32 type definition files covering every domain entity
• Mock API layer — 25 modules with localStorage persistence and 3,000+ lines of seed data
• Backend server — Express + Prisma + PostgreSQL with 130+ endpoints across 18 domain services

---

Compliance Status

MUST FIX BEFORE LAUNCH

These are legal/regulatory gaps:

Item	Status	Risk	Details
COPPA $1.00 credit card verification	Not started	High	Spec requires $1.00 charge per parent-child link as FTC-accepted consent verification. No payment UI built.
Consent revocation UI	Not started	High	No way for parents to withdraw previously granted consent from within the app.
MFA for admin users	Not started	Medium	Spec requires mandatory TOTP for admins. No MFA implementation exists.
Annual COPPA re-consent	Not started	Medium	Spec recommends annual re-verification prompt. Not built.
FERPA data isolation enforcement	Not started	Medium	Backend needs school-scoped data access. Currently no enforcement.
Encryption at rest	Not started	Medium	Backend database not encrypted. Spec requires AES-256 for PII.
Breach notification workflow	Not started	Low	Spec defines 72-hour notification process. No implementation.

COMPLIANCE ITEMS RESOLVED (Feb 2026)

These were previously critical gaps and are now fixed:

Item	Resolution
Under-13 deletion enforcement	AccountDeletion page blocks self-deletion for minors; parent-only with 48-hour COPPA timeline
Under-13 data restrictions	Optional PII fields hidden for minors; stripped on registration
COPPA notification routing	Age-based filtering; under-13 blocks social/vendor emails
Re-authentication before deletion	3-step flow with password verification
Cookie policy	Full cookie policy page with 4 types + children's provisions
School DPA	FERPA-compliant data processing agreement page
DMCA/Copyright	Takedown procedures page
CCPA/State privacy	Privacy Policy includes all 6 consumer rights

---

Gap List by Feature Area

Challenges & Track Records (Doc 2)

Gap	Priority	Notes
Full XP calculation formula	Medium	Spec defines 6 multiplier factors (base + difficulty + duration + venue + cost × fudge). Codebase uses simplified base values (50/100/200).
Challenge creation form fields	Medium	Missing: fulfillment type, cost, location, solo/group, cover image upload, verification requirements, teacher tips, resource links in the vendor creation UI.
Interesting List / Bucket List separation	Medium	Currently merged into a single "Saved List." Spec defines two distinct lists with different purposes.
User-to-provider registration flow	Low	Users cannot self-register as vendors through the UI. Spec describes a "Become a Challenge Provider" flow.
Category management admin UI	Low	Categories require code changes to modify. Planned admin interface for staff to add/rename/reorder has not been built.
Locked field enforcement	Low	No runtime check preventing structural edits (milestones, difficulty, materials) on challenges with active users.
TR entry reordering	Low	No drag-and-drop for Track Record entries.
TR storage usage indicator	Low	No display showing 100MB per-TR limit or 80% warning.
Portfolio export formats	Low	Only 2 of 5 portfolio templates built. No PDF/print output.

Explore & Discovery (Doc 4)

Gap	Priority	Notes
View Library	Medium	Only 5 curated views built. Spec calls for ~30 across 6 families with user-pinnable views.
Best Fit recommendation algorithm	Medium	Multi-signal scoring (interests, history, community behavior) is specified but not implemented.
Dealer's Choice depth	Medium	Current: 3 cards, no penalties, no practice mode for under-13. Spec: 4 cards, XP penalties, practice DC.
Bucket List / Interesting List split	Medium	Same as challenges gap — currently merged.
Map provider integration	Low	MapView uses SVG mock. No real map provider (Google Maps / Mapbox).
Calendar view depth	Low	No week/day views or external calendar sync.
Sort controls in search results	Low	Missing sort dropdown in search results view.

Communities & Social (Doc 5)

Gap	Priority	Notes
Community type defaults	Medium	Creation form has 6-type selector but doesn't auto-apply per-type defaults (visibility, join model, gifting).
Grouped 24-hour feed updates	Medium	Each shared item appears individually. Spec defines grouped cards for batch shares within 24h.
Community deletion	Medium	Store and API don't expose delete operation. Spec allows creator to delete.
Community invitations (email)	Low	In-platform invitations work. Email invitations to non-platform users not built.
Partner-finding overlap highlights	Low	Bucket List overlap detection in community feeds not implemented.
Premium partner-finding	Low	Structured introduction requests with radius search — deferred.
Profile visibility per-field controls	Low	No granular per-field privacy settings on profile.
Community name length	Low	UI enforces 50 chars. Spec says 100.

School Administration (Doc 6)

Gap	Priority	Notes
CSV student roster import	Medium	Types referenced. No upload UI or parsing logic built.
School onboarding self-service wizard	Medium	Partially built. Full application flow with admin review incomplete.
School settings page	Medium	Academic calendar, COPPA settings, billing config not built.
Student roster columns	Low	Missing: last login, challenges assigned/completed, CSV export.
Class archiving	Low	No archive/alumni status for classes.
Billing UI	Low	No billing interface for schools (per-active-user model).

Gamification (Doc 8)

Gap	Priority	Notes
Journey Map richness	Medium	Current: flat grid with emoji icons. Spec: interactive territory map with fog/reveal, zoom levels, individual challenge markers.
Anti-gaming enforcement	Medium	Daily XP caps and duplicate detection specified but not enforced.
Cooperative gamification depth	Low	Group challenges and community goals are built, but cooperative badge award logic is simplified.
Learning Path prerequisites & branching	Low	Linear paths only. No prerequisite checking or branching paths.
Leaderboard monthly reset	Low	Simplified implementation. Spec defines 5 scoped types with automated monthly reset.

Notifications (Doc 11)

Gap	Priority	Notes
Toast notification system	Medium	No real-time toast notifications for events (XP gain, badge earned, etc. display in-app only on page components).
Push notifications	Medium	No Service Worker. Spec calls for opt-in push with COPPA-aware routing.
Contextual badge counts	Low	My Challenges tab, Communities tab don't show unread/pending counts in navigation.

Gifting & Invitations (Doc 3)

Gap	Priority	Notes
Multiple gift recipients	Medium	Currently single-recipient only. Spec allows batch gifting.
Fulfillment confirmation after accept	Medium	No "Have you received your kit?" prompt after gift acceptance.
School bulk gifting workflow	Medium	SA bulk gift page built but not fully wired to the gift flow.
Gift/invitation reminder system	Low	No reminders for unclaimed gifts.
Vendor redirect for purchase	Low	Gift flow doesn't redirect to vendor's purchase page.

Vendor Portal (Doc 20)

Gap	Priority	Notes
Stripe Connect integration	Medium	Endpoint stubs exist. No live connection to Stripe.
Vendor onboarding completion	Medium	4-step flow is built but some steps use mock data.
Vendor analytics depth	Low	Basic charts built. Spec defines deeper audience insights and conversion tracking.

Internationalization (Doc 16)

Gap	Priority	Notes
String coverage	High	Only ~6% of strings translated (~120 of 2,000+). Most components use hardcoded English.
ICU MessageFormat	Medium	No pluralization support in translations.
RTL support	Low	No logical CSS properties for right-to-left languages.
URL path prefix strategy	Low	No /es/, /fr/ URL strategy for SEO.

Accessibility (Doc 18)

Gap	Priority	Notes
aria-live regions	Medium	No live regions for dynamic content updates.
Keyboard accessibility	Medium	Some interactive elements use <div onClick> without tabIndex/onKeyDown.
Automated a11y testing	Medium	No eslint-plugin-jsx-a11y or axe-core integration.
High-contrast mode	Low	No dedicated high-contrast theme.
Error pages	Low	No dedicated 404, 403, 503 pages.

Privacy & Compliance (Doc 10, 14)

Gap	Priority	Notes
Key management	Medium	No encryption key rotation or HSM integration.
Audit log enforcement	Medium	Backend audit logging exists but not all actions are captured.
DPA signature workflow	Low	School DPA page exists but no digital signature or countersigning flow.
Data retention automation	Low	No background jobs for automated cleanup (dormant accounts, expired exports, etc.).

---

Backend Integration Status

The frontend has 25 .real.api.ts files ready for backend integration. Current connection status:

API Module	Backend Status	Notes
Auth	Connected	Login, register, token refresh, Google/Apple stubs
Challenge	Connected	Browse, detail, categories. Stats/status-map endpoints pending.
Track Record	Connected	CRUD, entries, submission. Media upload pending.
Gamification	Connected	XP, badges, streaks, levels. Leaderboard endpoint pending.
User	Partial	Profile fetch works. Settings update pending.
Community	Stub	Endpoints defined, not connected.
Gift	Stub	Endpoints defined, not connected.
School	Stub	Endpoints defined, not connected.
Notification	Stub	Endpoints defined, not connected.
Vendor	Partial	Onboarding wired. Dashboard data pending.
All others	Stub	Endpoint signatures exist, no live data.

---

Infrastructure Gaps

Item	Priority	Notes
Background job system	High	No cron jobs for: COPPA deadlines, dormant accounts, data export generation, scheduled deletions, annual re-consent.
File storage (S3/equivalent)	High	No object storage for Track Record media. Currently mock only.
Email delivery service	High	No transactional email (verification, password reset, notifications, digests).
Real-time updates	Medium	No WebSocket or SSE. Polling only.
Search infrastructure	Medium	No full-text search backend (Elasticsearch/Typesense). Mock search only.
CDN	Medium	No static asset CDN.
Rate limiting	Medium	Specified in types but not enforced in backend middleware.
CI/CD pipeline	Low	GitHub Actions for docs only. No build/test/deploy pipeline for the app.
Monitoring/alerting	Low	No APM, error tracking, or alerting system.

---

Codebase Metrics

Metric	Value
TypeScript/TSX source files	489
Page components	189
Reusable components	~148 across 26 directories
Zustand stores	30
Type definition files	32
Custom hooks	3 (useFeatureFlag, useLocation, useAddressSearch)
Utility modules	2 (cn class merge, contextHelpers)
API modules (mock + real)	26 pairs + 1 real-only
Routes	195
Route guards	7 types
User roles	9
Admin roles	7
Backend endpoints	130+
Backend services	18
Backend test files	25
Storybook stories	55 (22 UI + 33 domain)
i18n languages	3 (en/es/fr)
V2 spec documents	23
Documentation pages	586 (docs site)
Screenshots	73

---

Priority Recommendations

Before Launch (Critical Path)

1. COPPA payment verification — Build the $1.00 credit card consent flow
2. Consent revocation UI — Let parents withdraw consent
3. Email delivery — Transactional email for verification, password reset, consent requests
4. File storage — S3 or equivalent for Track Record media uploads
5. Background jobs — COPPA deadline enforcement, account cleanup, export generation
6. i18n coverage — Expand from 6% to at least 80% of user-facing strings
7. Admin MFA — Mandatory TOTP for platform admin accounts

During Beta

8. CSV roster import — Schools need bulk student enrollment
9. Full XP formula — Replace simplified values with spec's 6-factor calculation
10. Dealer's Choice depth — 4 cards, penalties, practice mode for under-13
11. Grouped feed updates — 24-hour batch grouping for community feeds
12. Push notifications — Service Worker integration with COPPA-aware routing
13. Interesting/Bucket List split — Separate the two saved lists per spec
14. Challenge creation form — Complete all missing fields in vendor creation UI

Post-Launch Improvements

15. Journey Map richness — Interactive territory map with fog/reveal and zoom
16. Premium partner-finding — Radius-based structured introductions
17. Learning Path branching — Prerequisites and non-linear paths
18. Real map provider — Google Maps or Mapbox for geographic discovery
19. Portfolio export — PDF/print output with all 5 templates
20. Accessibility audit — Full aria-live, keyboard nav, automated testing

---

Where to Find More Detail

Topic	Location
Feature-by-feature business rules	Knowledge Base (15 feature pages)
Spec-to-code mapping	Spec Traceability
Full route map	Route Map (189 routes)
Store reference	Store Reference (28 stores)
Permission matrix	Permissions Matrix
Role guides	Role Guides (7 roles)
Backend endpoints	Backend Endpoints
Infrastructure costs	Infrastructure Costs
Product roadmap	Product Roadmap