Task 10: Gap Analysis — v3.0 Full Requirements vs Current Implementation¶
Overview¶
This document maps every requirement from the REC Verifiable Credentialing Platform High-level Requirements v3.0 against the current implementation, identifies gaps, and classifies them by delivery phase.
Source document: REC Verifiable Credentialing Platform High-level Requirements v3.0.pdf
Delivery model: Three phases — POC, Drop 1 Beta, Drop 2
IMPORTANT: Most gaps listed here are NOT in POC scope. The POC only needs Task 09 (real Agent API integration) and GAP-01 (QR code on claim page). Everything else is for Drop 1 Beta or Drop 2. This document serves as a post-POC roadmap.
POC vs Post-POC Scope¶
POC Scope (Prove the core flow works)¶
| Item | Status | What's Needed |
|---|---|---|
| Task 09: Real Agent API integration | BLOCKED (auth) | Replace mocks with real stagingagent API calls |
| GAP-01: QR code on claim page | Missing | Generate QR from VNF deep link URL |
NOT in POC (Drop 1 Beta + Drop 2 roadmap)¶
Everything below GAP-01 in this document is post-POC work, documented here for planning purposes only.
Role Mapping — v3.0 Terminology vs Curo REC¶
| v3.0 Term | Curo REC Term | Entity/Role |
|---|---|---|
| Platform Admin | SuperAdmin | UserRole.PLATFORM_ADMIN |
| Staffing Company | Organization | Organization entity |
| Staffing Company Admin | Org Admin / Company Admin | UserRole.ORG_ADMIN |
| Staffing Company User | Org User / Issuer | UserRole.ORG_USER / UserRole.ISSUER |
| Worker / Candidate | Employee / Candidate | Employee + Candidate entities |
| Credential Agent | VNF Agent (staging) | stagingagent.velocitycareerlabs.io |
| Relying Party | Staffing Company (verifier role) | Same org, different service ID |
Section 1: Creating an Offer & Issuing a Credential (Drop 1)¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 1.1 | Staffing Company is Issuer | DONE | None | Org has issuer role |
| 1.2 | Only past employment credential for MVP | DONE | None | EmploymentPastV1.1 is primary type |
| 1.3 | Web-based form for manual entry | DONE | None | ManualCredentialForm.tsx |
| 1.4 | CSV batch upload (fixed structure) | DONE | None | Employee CSV import exists |
| 1.5 | Integration with Velocity Credential Agent | PARTIAL | Mock only, no real Agent API calls | Task 09 (blocked on auth) |
| 1.6 | Email with claim link to candidate | DONE | None | Email templates + claim tokens |
| 1.7 | Configurable landing page (link + QR code) | PARTIAL | Landing page exists, QR code not implemented, branding limited | GAP-01 |
| 1.8 | Configurable email templates (branding) | PARTIAL | Templates exist, org-level branding customization UI incomplete | GAP-02 |
| 1.9 | CSV export of credentials offered + status | MISSING | No CSV/Excel export functionality | GAP-03 |
| 1.10 | Search candidates by name + view offers | PARTIAL | Employee search exists, candidate-centric search/view missing | GAP-04 |
| 1.11 | Delivered in first beta drop | Target | — | — |
Section 2: Disclosure of Credentials (Drop 2)¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 2.1 | Staffing Company as Relying Party | MISSING | No relying party flow | GAP-05 |
| 2.2 | Set up disclosure (presentation) request | MISSING | No disclosure request creation | GAP-05 |
| 2.3 | Configure policies for credential types | MISSING | No policy configuration | GAP-05 |
| 2.4 | Email disclosure request with link + QR | MISSING | No disclosure email flow | GAP-05 |
| 2.5 | Configurable disclosure landing page | MISSING | No disclosure landing page | GAP-05 |
| 2.6 | Follow-up/nudge emails | MISSING | No reminder system | GAP-06 |
| 2.7 | CSV export of disclosures + status | MISSING | No disclosure export | GAP-05 |
| 2.8 | Search candidates by name + view disclosures | MISSING | No disclosure search | GAP-05 |
| 2.9 | Delivered in second beta drop | Future | — | — |
Section 3: Verification of Credentials (Drop 2)¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 3.1 | Run verification on disclosed credentials | MISSING | Entity exists (PresentationRequest), no VNF integration |
GAP-07 |
| 3.2 | Uses Velocity-enabled verification (VerifyMyCreds) | MISSING | No VerifyMyCreds integration | GAP-07 |
| 3.3 | Display 5 verification checks | MISSING | No verification result display | GAP-07 |
| 3.4 | Download PDF report of verification | MISSING | No PDF generation | GAP-08 |
| 3.5 | Delivered in second beta drop | Future | — | — |
Section 4: Web Application Organisation Onboarding¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 4.1 | Staffing Company = Issuer + Relying Party | PARTIAL | Issuer done, RP missing | GAP-05 |
| 4.2 | Onboarding via VNF Registrar interfaces initially | DONE | Registered via stagingregistrarapp |
— |
| 4.3 | KYB info mirrored on VNF Registrar | DONE | KYB workflow + registrar payload | — |
| 4.4 | Create org via Registrar API (later via platform) | PARTIAL | Platform form exists, Registrar API call not wired | GAP-09 |
| 4.5 | Company Admin page with customization | PARTIAL | Settings page exists, customization UI incomplete | GAP-02 |
| 4.6 | Customization: T&Cs, Privacy, landing pages, emails | PARTIAL | Email templates done, T&Cs/Privacy pages missing | GAP-02 |
Section 5: Web Application User Management¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 5.1 | Admin CRUD for Staffing Company users | DONE | company-admin-user.service.ts |
— |
| 5.2 | Update personal details, reset password | PARTIAL | Auth0 handles password, profile edit UI minimal | GAP-10 |
| 5.3 | User documentation/guides via system | MISSING | No help system or docs | GAP-11 |
Section 6: Authentication & Authorisation¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 6.1 | MFA for all admin accounts | DONE | Auth0 MFA configured | — |
| 6.2 | Passkey support | PARTIAL | Passkey entity exists, UI not implemented |
GAP-12 |
| 6.3 | Role-based access (Platform Admin, SC Admin, SC User) | DONE | Roles guard + user roles | — |
| 6.4 | Account expiration and reactivation | MISSING | No expiration policy system | GAP-13 |
| 6.5 | GDPR data retention and disposal | MISSING | No data retention policies | GAP-14 |
| 6.6 | Password reset from dashboard | PARTIAL | Auth0 flow exists, no in-app reset UI | GAP-10 |
Section 7: Reporting & Analytics¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 7.1 | Admin dashboard with stats | PARTIAL | SuperAdmin dashboard exists, limited stats | GAP-15 |
| 7.2 | Compliance/audit reports on demand | PARTIAL | audit_logs table exists, no report generation UI |
GAP-16 |
Section 8: Non-Functional Requirements¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 8.1 | Zero trust architecture | PARTIAL | JWT auth, RBAC, but not full zero trust | Low priority for POC |
| 8.2 | AES-256 encryption at rest, TLS 1.3 | PARTIAL | Tenant keys encrypted, DB not fully encrypted | Post-POC |
| 8.3 | Immutable audit logs | DONE | audit_logs table |
— |
| 8.4 | Multi-tenant with data segregation | DONE | org_id scoping on all entities |
— |
| 8.5 | Mobile responsive | PARTIAL | MUI responsive, not thoroughly tested | Post-POC |
| 8.6 | 1000-2000 transactions/hour | Not tested | Performance testing needed | Post-POC |
| 8.7 | <2 second response time | Not tested | Performance testing needed | Post-POC |
| 8.8 | CI/CD pipeline | MISSING | No deployment pipeline | GAP-17 |
| 8.9 | WCAG 2.1 compliance | MISSING | Not tested | Post-POC |
Section 9: Other Requirements¶
| # | v3.0 Requirement | POC Status | Gap | Task |
|---|---|---|---|---|
| 9.1 | SaaS Credential Agent co-located | IN PROGRESS | Using VCL staging agent, not self-hosted | Managed by VCL |
| 9.2 | Credential Wallet | OUT OF SCOPE | Candidates use existing wallets | — |
| 9.3 | Payments / credits | MISSING | No payment system | GAP-18 |
| 9.4 | Futureproofing for other credential types | DONE | Architecture supports multiple types | — |
GAP Task Definitions¶
GAP-01: QR Code Generation for Claim/Disclosure Pages¶
Priority: HIGH (Drop 1)
Effort: Small (1-2 days)
Files:
- app/frontend/src/pages/claim/[token].tsx — Add QR code display
- app/backend/src/issuer/services/claim.service.ts — Generate QR code data
Requirements:
- [ ] Generate QR code from VNF deep link URL (velocity-network-testnet://issue?request_uri=...)
- [ ] Display QR code on credential claim landing page
- [ ] QR code links to mobile wallet app for credential acceptance
- [ ] Fallback link for desktop users
- [ ] Use qrcode npm package or similar
GAP-02: Organisation Branding & Customization UI¶
Priority: MEDIUM (Drop 1 basic, Drop 2 full)
Effort: Medium (3-5 days)
Files:
- app/frontend/src/pages/admin/settings.tsx — Extend with branding UI
- app/frontend/src/components/ — New branding components
- app/backend/src/admin/entities/branding.entity.ts — Already exists
Requirements:
- [ ] Org admin can upload logo (stored in S3 via branding.entity)
- [ ] Org admin can set primary colors for landing pages
- [ ] Org admin can edit email template wording
- [ ] Org admin can configure Terms & Conditions URL
- [ ] Org admin can configure Privacy Policy URL
- [ ] Preview of branded landing page and email
- [ ] Settings stored in organization.settings JSONB column
GAP-03: CSV/Excel Export of Credentials¶
Priority: HIGH (Drop 1)
Effort: Small (1-2 days)
Files:
- app/backend/src/issuer/controllers/credential.controller.ts — Add export endpoint
- app/backend/src/issuer/services/credential.service.ts — Add export logic
- app/frontend/src/pages/credentials/index.tsx — Add export button
Requirements:
- [ ] GET /api/v1/issuer/credentials/export?format=csv endpoint
- [ ] Export fields: employee name, email, credential type, status, sent date, claimed date
- [ ] Support CSV format (Excel can open CSV)
- [ ] Filter by date range, status, credential type
- [ ] Download triggered from credentials dashboard
- [ ] Use csv-stringify or exceljs package
GAP-04: Candidate-Centric Search & View¶
Priority: MEDIUM (Drop 1)
Effort: Small (2-3 days)
Files:
- app/frontend/src/pages/candidates/ — New pages
- app/backend/src/issuer/controllers/ — Extend or add candidate controller
Requirements: - [ ] Search candidates by first/last name - [ ] View candidate record showing ALL credential offers sent to them - [ ] Show acceptance state per credential (created, sent, claimed, expired) - [ ] Link from candidate view to individual credential detail - [ ] Candidate list with pagination and filters
GAP-05: Disclosure (Presentation) Request System — FULL DROP 2 FEATURE¶
Priority: HIGH (Drop 2) Effort: Large (15-20 days) New files needed:
Backend:
- app/backend/src/issuer/services/disclosure.service.ts — Disclosure CRUD
- app/backend/src/issuer/services/presentation.service.ts — Presentation flow
- app/backend/src/issuer/controllers/disclosure.controller.ts — API endpoints
- app/backend/src/issuer/dto/disclosure.dto.ts — DTOs
- app/backend/src/issuer/entities/disclosure-request.entity.ts — Entity (or use existing PresentationRequest)
Frontend:
- app/frontend/src/pages/disclosures/ — Disclosure management pages
- app/frontend/src/components/disclosures/ — Disclosure components
- app/frontend/src/pages/disclosure-claim/[token].tsx — Public disclosure landing page
- app/frontend/src/services/disclosure.service.ts — API service
Requirements:
- [ ] Create disclosure request definition (maps to POST /tenants/{tenantId}/disclosures)
- [ ] Configure required credential types per disclosure
- [ ] Send disclosure request email with link + QR code to candidate
- [ ] Public landing page for candidate to accept disclosure
- [ ] Wallet integration — candidate selects credentials to share
- [ ] Receive and store presented credentials
- [ ] Search/list disclosures with status (sent, responded, verified, expired)
- [ ] CSV export of disclosures and status
- [ ] Follow-up/nudge email capability
- [ ] Configurable branding on disclosure landing page and email
Agent Operator API endpoints used:
POST /tenants/{tenantId}/disclosures — Create disclosure
GET /tenants/{tenantId}/disclosures — List disclosures
POST /tenants/{tenantId}/exchanges — Start exchange (type: DISCLOSURE)
GET /tenants/{tenantId}/exchanges/{id} — Get exchange status
GET /tenants/{tenantId}/disclosures/{id}/deep-link — Get disclosure deep link
GET /tenants/{tenantId}/disclosures/{id}/qrcode.png — Get QR code
Database — presentation_requests table already exists with correct columns.
GAP-06: Reminder/Nudge Email System¶
Priority: LOW (Post-MVP per v3.0)
Effort: Small (2-3 days)
Files:
- app/backend/src/shared/services/email.service.ts — Add reminder scheduling
- app/backend/src/issuer/services/credential.service.ts — Identify unclaimed offers
Requirements:
- [ ] Identify credential offers in sent status that haven't been claimed
- [ ] Send configurable reminder email after X days
- [ ] Manual "send reminder" button on credential detail page
- [ ] Track reminder count per offer (prevent spam)
- [ ] Configurable reminder frequency and max count per org
GAP-07: Credential Verification System — DROP 2 FEATURE¶
Priority: HIGH (Drop 2)
Effort: Large (10-15 days)
Files:
- app/backend/src/verification/services/verification.service.ts — Core verification logic
- app/backend/src/verification/controllers/verification.controller.ts — API endpoints
- app/frontend/src/pages/verifications/ — Verification pages
- app/frontend/src/components/verification/ — Verification components
Requirements:
- [ ] Run verification on disclosed credentials via Agent API (POST /tenants/{tenantId}/check-credentials)
- [ ] Display 5 verification checks:
1. Credential was issued to the holder
2. Credential was issued by the issuer indicated
3. Credential has not expired
4. Credential has not been tampered with
5. Credential has not been revoked
- [ ] Store verification results in verification_reports table
- [ ] Verification status per presentation request
- [ ] VerifyMyCreds integration (open-source from VCL)
GAP-08: PDF Report Generation¶
Priority: MEDIUM (Drop 2)
Effort: Medium (3-5 days)
Files:
- app/backend/src/verification/services/pdf-report.service.ts — New
- app/frontend/src/pages/verifications/[id].tsx — Add download button
Requirements:
- [ ] Generate PDF of verification report
- [ ] Include all 5 verification checks with pass/fail
- [ ] Include credential details and issuer information
- [ ] Store PDF in S3 (use pdfS3Key in verification_reports)
- [ ] Download via signed URL
- [ ] Use puppeteer or pdfkit for PDF generation
- [ ] Note: VCL provides a PDF Generator service — investigate reuse
GAP-09: Registrar API Integration for Org Creation¶
Priority: HIGH (Drop 1, later stage)
Effort: Medium (3-5 days)
Files:
- app/backend/src/admin/services/velocity-registrar.service.ts — Already exists
- app/backend/src/admin/services/superadmin-organization.service.ts — Wire to registrar
Requirements:
- [ ] When org is created on platform, call POST /organizations/full on Registrar API
- [ ] Receive DID, keys, and auth client back from Registrar
- [ ] Store DID in organization.organizationDid
- [ ] Store keys in organization.velocityTenantKeys (encrypted)
- [ ] Create invitation on Registrar for Staffing Company Admin
- [ ] Call POST /organizations/{did}/activate-services to activate
- [ ] Currently doing this manually via Registrar UI — automate it
Registrar API endpoints:
Base: https://stagingregistrar.velocitynetwork.foundation/api/v0.6
POST /organizations/full — Create org (returns DID + keys)
POST /organizations/{did}/services — Add service (issuer/verifier)
POST /organizations/{did}/activate-services — Activate services
POST /organizations/{did}/invitations — Create admin invitation
GAP-10: User Profile Management UI¶
Priority: LOW
Effort: Small (1-2 days)
Files:
- app/frontend/src/pages/profile.tsx — New or enhance existing
Requirements: - [ ] Edit first name, last name, phone - [ ] Change password (via Auth0) - [ ] View linked accounts - [ ] Profile picture upload
GAP-11: User Documentation / Help System¶
Priority: LOW (Post-MVP) Effort: Medium (content is by MH&A, implementation only)
Requirements: - [ ] In-app help system placeholder - [ ] Integration point for Zendesk (v3.0 mentions Zendesk) - [ ] On-screen tooltips and guidance
GAP-12: Passkey UI Implementation¶
Priority: LOW Effort: Small (2-3 days)
Requirements: - [ ] Passkey registration UI (entity already exists) - [ ] Passkey authentication flow - [ ] Manage registered passkeys
GAP-13: Account Expiration & Reactivation¶
Priority: LOW Effort: Small (2-3 days)
Requirements: - [ ] Configurable inactivity period per org - [ ] Auto-disable after inactivity - [ ] Notification before expiration - [ ] Admin reactivation flow
GAP-14: GDPR Data Retention & Disposal¶
Priority: MEDIUM (legal requirement) Effort: Medium (5-7 days)
Requirements: - [ ] Data retention policy configuration per org - [ ] Automated data disposal after retention period - [ ] Subject access request (SAR) endpoint - [ ] Right to erasure implementation - [ ] Consent management - [ ] Data processing records
GAP-15: Enhanced Admin Dashboard Stats¶
Priority: MEDIUM Effort: Small (2-3 days)
Requirements: - [ ] Total credentials issued/claimed/expired per org - [ ] Authentication success/fail rates - [ ] Integration health status (VNF connectivity) - [ ] User activity metrics - [ ] Time-series charts
GAP-16: Compliance & Audit Report UI¶
Priority: MEDIUM Effort: Medium (3-5 days)
Requirements:
- [ ] UI to query audit logs (currently backend only per v3.0)
- [ ] Filter by date range, user, action, resource
- [ ] Export audit logs as CSV/PDF
- [ ] Scheduled compliance reports (use compliance_jobs entity)
GAP-17: CI/CD Pipeline¶
Priority: HIGH Effort: Medium (3-5 days)
Requirements: - [ ] GitHub Actions or equivalent - [ ] Build, test, lint on PR - [ ] Automated deployment to staging - [ ] Environment variable management - [ ] Docker containerization
GAP-18: Payments / Credits System¶
Priority: LOW (manual invoicing OK for MVP per v3.0) Effort: Large (post-MVP)
Requirements: - [ ] v3.0 says manual invoicing is acceptable for MVP - [ ] Future: Stripe integration for subscriptions - [ ] Credit system for verification (platform pool of credits) - [ ] Voucher system for Velocity Network treasury
Implementation Priority Matrix¶
POC (Current Focus — only these 2 items)¶
| GAP | Task | Effort | Depends On |
|---|---|---|---|
| Task 09 | Staging API integration (real Agent calls) | Large | CTO auth response |
| GAP-01 | QR code on claim page | Small | Task 09 deep links |
Everything below is post-POC — documented for roadmap planning only.
Drop 1 Beta (After POC proven)¶
| GAP | Task | Effort | Depends On |
|---|---|---|---|
| GAP-03 | CSV export of credentials | Small | None |
| GAP-02 | Branding customization UI | Medium | None |
| GAP-04 | Candidate-centric search | Small | None |
| GAP-09 | Registrar API for org creation | Medium | Task 09 auth |
| GAP-15 | Dashboard stats | Small | None |
| GAP-17 | CI/CD pipeline | Medium | None |
Drop 2 (Disclosure & Verification)¶
| GAP | Task | Effort | Depends On |
|---|---|---|---|
| GAP-05 | Full disclosure/presentation system | Large | Task 09 + Agent API auth |
| GAP-07 | Credential verification | Large | GAP-05 |
| GAP-08 | PDF report generation | Medium | GAP-07 |
| GAP-06 | Reminder email system | Small | None |
| GAP-16 | Audit report UI | Medium | None |
Post-MVP¶
| GAP | Task | Effort | Depends On |
|---|---|---|---|
| GAP-10 | Profile management UI | Small | None |
| GAP-11 | Help system / Zendesk | Medium | Content from MH&A |
| GAP-12 | Passkey UI | Small | None |
| GAP-13 | Account expiration | Small | None |
| GAP-14 | GDPR data retention | Medium | Legal requirements |
| GAP-18 | Payments / Stripe | Large | Business decision |
Summary¶
| Category | Total Items | Done | Partial | Missing |
|---|---|---|---|---|
| Drop 1 — Issuance | 11 | 6 | 4 | 1 |
| Drop 2 — Disclosure | 9 | 0 | 0 | 9 |
| Drop 2 — Verification | 5 | 0 | 1 | 4 |
| Org Onboarding | 6 | 3 | 3 | 0 |
| User Management | 3 | 1 | 1 | 1 |
| Auth & Security | 6 | 2 | 2 | 2 |
| Reporting | 2 | 0 | 2 | 0 |
| Non-Functional | 9 | 2 | 3 | 4 |
| Other | 4 | 1 | 1 | 2 |
| TOTAL | 55 | 15 (27%) | 17 (31%) | 23 (42%) |
For POC/Drop 1: ~27% done, ~31% partial = ~58% of Drop 1 requirements addressed. Critical blocker: Agent Operator API authentication (Task 09) — everything else builds on this.
References¶
- Task 09: Staging Integration — Real API integration
- Agent Operator API Spec — OpenAPI v0.8
- Registrar API Spec — OpenAPI v0.6
- Phase 1: Organization Foundation
- Phase 2: Batch Issuance Pipeline
- Phase 3: Claim Page & Tracking