# Dev pack review, 5 November 2026

Review of development pack version 1. Fix the blockers before the pack goes to the build team.

## Blockers

1. **Two-way SMS needs a short code.** The SMS mock sends from `MAPEMA`, an alphanumeric sender ID that cannot receive replies in Kenya. DONE, HELP and STOP (FC-1, FC-3), the dosage view (EC-4) and indicator S5 all depend on replies. Specify a two-way short code.
2. **Non-functional requirements are missing from the backlog.** `05-backlog/requirements-backlog.csv` holds only the 34 functional items. The PRD's non-functional requirements are absent: ODPC registration, DPIA (60 days before processing), retention, data residency, cost to families, WCAG 2.2 AA, 24/7 HELP and escalation, and design ethics. So are the NACOSTI licence and ethics approval, breach handling and Childline referral capacity.
3. **KoboToolbox hosting conflicts with "hosted in Kenya".** The hosted Kobo servers are Global (reported US) and EU. Self-host with `kobo-install` on Kenyan infrastructure. RapidPro has the same issue: hosted TextIt is not in Kenya.
4. **Lagoon fails contrast on the brand's own grounds.** It is 4.81:1 on white but 4.45 on chalk, 4.27 on lagoon mist and 4.21 on jacaranda mist. Darken it, or restrict lagoon to large display text on those grounds.
5. **The templates break the pack's rules.** The lesson card and Safety Book page are English only (Rule 6). Lesson step 1 needs a screen, but the classroom layer is meant to work without devices.

## Smaller issues

- The Kiswahili SMS lacks the "Digital Mapema:" prefix. Neither message says how to opt out with STOP. Confirm Kenyan opt-out wording with the gateway.
- Decide whether Kiswahili reply keywords are accepted.
- USSD sessions cost the user unless zero-rated. Turn "cost to families" into a backlog item.
- C2 (disclosures per 1,000 pupils) may reflect better detection in programme schools rather than more telling. The evaluator should rule on comparing it across trial arms.
- The Rocket LMS version is unverified. Buyer threads cite 2.1, and an update is dated 13 May 2026. Some source files are encrypted, so add that to the security review.
- The README's "Live versions" links are private to the owner.
- `03-templates/applications-reference.html` is identical to `02-brand/boards/5-applications.html`.
- The pack is dated 6 November 2026.
- Font loading is inconsistent across the boards.
- Confirm the KiVa licence alongside the Be Internet Awesome licence.

## Open decision

Rocket LMS against open-source alternatives, with payments (M-Pesa) as a criterion. The assessment is in progress.