Overview
The Mississippi state office of a national civil rights organization built something good and analog: a card game that teaches people which level of government actually decides the things that affect their lives. City, county, state, federal. Fifty-four cards. It worked in a room, at a table, with a facilitator.
It did not work at scale, and it did not work when nobody from the office could be there.
Kanonu Solutions was hired to make the deck a platform — one that any Mississippian could open on a phone, play alone or against a room, and come out of knowing more about their own government than when they started. Along the way it had to check voter registration status, honor consent law on every reminder it sent, and hold up to the kind of scrutiny a civil rights organization attracts.
The challenge
A game is easy to digitize badly. Move fifty-four cards into a web form and you get a quiz, not a game. The printed deck had a facilitator supplying pace, stakes, and social pressure. Replacing that in software meant building a scoring engine, a block tower that visualized a run, a live multiplayer mode for rooms, and a leaderboard worth climbing — none of which existed on paper.
The client is a target. This organization's work makes it a subject of sustained hostile attention. A leaderboard is an invitation to cheat; an anonymous sign-in flow is an invitation to abuse. Anything we built had to assume adversarial users rather than merely careless ones.
Reminders touch voter registration, which touches consent law. Any message carrying voter registration content raises the stakes on who consented to what, when, and under which version of the wording. Getting that wrong is not a bug, it is a legal exposure for the client.
And the client has to own it. A platform the client cannot read, audit, or hand to another developer is a dependency, not an asset.
Our approach
Four decisions shaped everything else.
- No build step, on purpose. Vanilla JavaScript. No bundler, no framework, no transpiler. Scripts load in order from a single HTML file. The client owns code that stays readable without tooling, and there is no build pipeline to rot in two years when priorities have moved on.
- The client computes nothing authoritative. The server deals every run, snapshots the answer key at deal time, and rescores every submission on its own clock. Client-reported timings are discarded outright.
- Consent is a pipeline property, not a checkbox. Versioned consent text, enforced at the interface, at validation, and once more per individual message before anything sends.
- Test the logic, not the framework. All authoritative decisions live in a pure module with no Firebase imports, specifically so they can be tested without credentials and mutation-tested when the change is security relevant.
What we shipped
A production civic education platform at levelstothis.org, live on Firebase Hosting.
- The full deck, digitized. Fifty-four unique cards, a Know Your Levels reference library, and all eighty-two Mississippi counties. Correct answers match the printed deck verbatim; distractors and one-line explanations were authored for multiple-choice play. Where the printed deck duplicated a card, the digital edition resolves it.
- Four ways to play. Quick Play for a solo run, Pass and Play around a table, and Live Host multiplayer with rooms, wild cards, and steals for a facilitator running a crowd. A block tower renders each run as it builds.
- A server-authoritative engine. Thirty-one externally exposed endpoints on Cloud Functions v2 — twenty-nine authenticated callables and two public webhooks. Firestore rules deny by default; public reads are limited to leaderboards and the published deck.
- Abuse resistance sized to the actual threat. Anonymous user IDs are free to mint, so a per-user rate limit bounds nothing on its own — a throttled identity is simply discarded for a fresh one. Sign-in, run start, and room join each carry a per-IP ceiling sized off the worst legitimate case. A minimum time floor per card rejects scripted runs.
- An admin console behind real MFA. A single administrator authenticates with email, password, and a TOTP second factor, verified at the API boundary rather than only in the console interface.
- Consent handled properly. Reminders are restricted to eighteen and older on every channel, because the gate is voting age rather than the children's privacy line. Consent text is versioned, and the send pipeline refuses to deliver against stale wording. Retired wording is preserved verbatim in a Consent Text Register.
- A compliance record the client can hand to a funder or a board. Data processing record, incident response plan, WCAG accessibility conformance, App Check enforcement runbook, load-test runbook, and a penetration test scope prepared for external vendors.
- 507 assertions across four suites, covering the scoring engine, the backend logic, the tower renderer, and the multi-factor flow. All must pass before a deploy.
The outcome
- The game left the room. A civic education tool that previously required a staffer and a table now runs on any phone in the state, with or without anyone from the office present.
- Voter status checks sit inside the experience rather than at the end of a link nobody clicks.
- The security posture matches the client. Deny-by-default data rules, MFA at the API boundary, per-IP ceilings, and a server that trusts nothing the client reports. Built for adversarial use because the client's work attracts it.
- The consent record would survive a review. Every message sent can be traced to a specific consent, captured under a specific version of the wording, against a verified age gate.
- The client owns something readable. No build step, no framework churn, documented operations, and a test suite that fails loudly. Another developer can pick it up from the repository.
A note on what's next
The platform is built to extend past a single deck. The content model is a card bank, not a hard-coded quiz, which means new question sets, new civic subject matter, and new jurisdictions are content work rather than engineering work.
If you're a civil rights organization, a public institution, or a foundation with a program that works in person and needs to work everywhere — start a project.
Levels to This is the client's intellectual property, created by its Mississippi state office team. Digital edition by Kanonu Solutions LLC.