WanderSecurity Trio — WanderCam · WanderBell · WanderLock (Family Spec)
Product family: WanderSecurity Trio, privacy-first home security hardware that feeds the existing WanderGuard software stack Device IDs:
WV-SEC-CAM-IN · WV-SEC-CAM-OUT · WV-SEC-CAM-PRO · WV-SEC-CAM-BATTWV-SEC-BELL-STD · WV-SEC-BELL-PROWV-SEC-LOCK-STD · WV-SEC-LOCK-BIO- HAVEN-hardened variants:
WV-SEC-*-HAVEN
Chassis reuse: Cam = new Wedge-S / Dome-M / Soffit-L · Bell = new Doorbell-M · Lock = new Lock-Escutcheon Status: spec v1.0-candidate, post-WANDERGUARD-BUILD-SPEC, SOP v2 native, platform + modules, identity-aware, Ambassador-assembled Supersedes: the hardware sections of WANDERGUARD-BUILD-SPEC.md v1.0 (April 2026). This version keeps WanderGuard's software architecture unchanged and replaces the single-paragraph hardware sketches with a full per-product SOP v2 artifact set Ship target: WanderCam Q2 2027 · WanderBell Q2–Q3 2027 · WanderLock Q3 2027 Date: 2026-04-24
Shared family docs: ../_WORKFLOW-SOP.md · ../_HARDWARE-TOOLCHAIN.md · ../_FAMILY-EXPANSION-REVIEW.md · ../_STANDALONE-AND-PLATFORM-INTEGRATION.md · ../_LAG-CLOSING-AND-MOVEMENT-STRATEGY.md · WANDERGUARD-BUILD-SPEC.md · WANDERVERSE-PLATFORM-STANDARDS.md · WANDERVERSE-COMMUNITY-POOL-SPEC.md
---
Why a family spec, not three
These three products share nearly every platform decision:
- Same WanderGuard software stack on the WanderNode Hub (Frigate NVR, Z-Wave/Matter controller, WireGuard server, audit log)
- Same PoE-in architecture from WanderBridge (all three are PoE-powered where wired; all three have battery-backed variants)
- Same identity-aware defaults (don't-record-when-home, duress-unlock, covert greetings, no-police backdoor)
- Same Ambassador assembly process + Signature Build Mark
- Same 7-year parts + firmware guarantee
- Same Planned revenue split (60/30/10 per
WANDERVERSE-COMMUNITY-POOL-SPEC.md)
- Same WanderStore integration (community detection models, custom chimes, community glyph plates)
- Same dual-mode product principle (Standalone + Industry-integrated + WanderVerse-native)
Specing them together lets us share BOM lines (PoE PD, ESP32-S3 MCU, mmWave radar module, SecureElement, TVS, connectors), share compliance work (FCC Part 15 B + C modular-passthrough covers all three), and share Ambassador training.
---
v1.0 amendments over the WANDERGUARD hardware sketch
These amendments supersede the four-bullet hardware sections in WANDERGUARD-BUILD-SPEC.md (lines 76–147). WanderGuard's software sections (alert routing, Frigate integration, abuser revocation, HAVEN integration, etc.) are retained as-is and this spec is designed to feed them.
Architectural:
- WanderCam resolution upgraded from 4MP/2K to 4K UHD on Outdoor + Pro tiers (consumer expectation 2027). Indoor tier stays 2K for price point.
- WanderCam Pro adds 24 GHz mmWave presence radar for reliable human-vs-animal / blowing-branches discrimination, independent of PIR (which false-triggers on temperature gradients + car exhaust).
- WanderBell gets NFC reader at entry (for WanderBand + phone tap-to-unlock-door intents, unlock is still executed by WanderLock; Bell just reads the tap and forwards it).
- WanderLock moves from Z-Wave primary (per WanderGuard v1.0 spec) to Matter-over-Thread primary with Z-Wave 800 Series as secondary. Rationale: by 2027 ship, Matter-over-Thread is the open-standard anchor the whole home-automation industry has committed to; Z-Wave is maintained for households with existing Z-Wave meshes.
- WanderLock adds fingerprint reader on biometric tier (with explicit bias-transparency disclosure, see §Identity-aware).
- Duress code becomes a first-class WanderLock feature (not "maybe later"). Entering the duress code unlocks normally AND silently triggers WanderGuard emergency revocation + alert cycle. Architecturally absent from Ring/Nest/Schlage/Yale/August.
- All three products get Apple HomeKit Secure Video + Google Home + Matter Controller compatibility as opt-in per dual-mode principle. Default posture remains WanderVerse-local.
Compliance budget corrections:
- WanderCam v1.0 cert (FCC + CE + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH for 3 tiers): ~$30-45k
- WanderBell v1.0 cert (add RED IV for wide-area video intercom + doorbell-specific UL 294): ~$20-30k
- WanderLock v1.0 cert (add UL 437 for residential security + ANSI BHMA Grade 1/2 + Matter certification + FCC/CE/IC): ~$35-55k (UL 437 is the expensive item; Grade 1 test is per-lock-model)
- State-specific camera privacy laws (2-party consent for audio in MD, CA, FL, IL, MA, MI, MT, NH, PA, WA): labeled default-audio-off with region-specific setup warning. No extra cert cost, implemented in firmware + packaging.
- Total family v1.0 cert: ~$85-130k (well within normal product family launch envelope).
Firmware:
- All three products run WanderOS-Security (Zephyr RTOS 3.7+ overlay, MIT-licensed) sharing same BLE / Matter / Thread / WireGuard / audit-log primitives. Single firmware team covers all three after v1.0 ship.
- Frigate integration is fed via standard RTSP + ONVIF; every WanderCam streams raw to Hub. No proprietary protocol. You can run a WanderCam into any Frigate/Synology/Unifi NVR too.
Pricing (planning only; not for sale):
| SKU | Tier | Retail (LLC) | Mission-partner price |
|---|
| WanderCam Indoor (2K, PoE + WiFi) | Standard | TBD | at-cost |
| WanderCam Outdoor PoE (4K, IP65) | Standard | TBD | at-cost |
| WanderCam Pro (4K + radar + LED spotlight + audio, IP65) | Pro | TBD | at-cost |
| WanderCam Battery (2K PoE OR battery + solar) | Flex | TBD | at-cost |
| WanderBell Standard (1080p, PoE, radar, local recording) | Standard | TBD | at-cost |
| WanderBell Pro (4K, PoE + battery backup, NFC, radar, HomeKit Secure Video) | Pro | TBD | at-cost |
| WanderLock Standard (Matter-over-Thread + keypad + duress code + audit) | Standard | TBD | at-cost |
| WanderLock Biometric (Matter + Thread + Z-Wave + fingerprint + duress + audit) | Pro | TBD | at-cost |
| Trio Starter (Cam Indoor + Bell Std + Lock Std) | Bundle | TBD | at-cost |
| Trio Full (2× Cam Outdoor + Bell Pro + Lock Bio) | Bundle | TBD | at-cost |
Margins: 42–52% on standard tier, 48–56% on Pro tier, lower on bundles (24–32%) by design to funnel buyers toward the full system.
---
Dual-mode product principle (applied)
Per ../_STANDALONE-AND-PLATFORM-INTEGRATION.md, each of these products must work in all three modes.
Mode 1: Standalone
- WanderCam: buy one camera, a microSD card, and the free WanderGuard app; records locally to SD, streams to your phone via direct WireGuard-to-phone (no Hub required for 1-cam setups), motion alerts work. Setup in under 5 min.
- WanderBell: similar, doorbell press + 2-way audio + local SD recording + radar-gated notifications to your phone. No Hub required for 1-bell setups.
- WanderLock: works as a great Matter-over-Thread lock with any Matter controller (Apple Home / Google Home / SmartThings / Home Assistant / Amazon Echo). Duress code + audit log work locally on-device regardless.
Mode 2: Industry-integrated
- Apple HomeKit Secure Video (HKSV): WanderCam and WanderBell both ship as HKSV-compatible accessories (requires iCloud+ 50GB plan on buyer side, runs Apple's native local-recording architecture with no Amazon/Google cloud involved). Opt-in.
- Google Home / Nest: all three products advertise as Matter devices on 2.4 GHz Thread + appear natively in Google Home.
- Amazon Alexa: basic announce + lock/unlock via Matter.
- SmartThings: native.
- Home Assistant: first-class HA entities via Matter + ONVIF + MQTT.
- Ubiquiti Protect: WanderCams are ONVIF/RTSP so they appear natively.
- Synology Surveillance Station / Jellyfin-Video / Blue Iris: all supported via ONVIF.
- Frigate (self-hosted): obviously first-class.
- Unifi Access / OSDP / Wiegand: WanderLock Biometric exports OSDP over RS-485 for small-business access-control integration.
Mode 3: WanderVerse-native
- Full WanderGuard software stack: Frigate + abuser revocation + community alert mesh + HAVEN + audit logs.
- WanderBand presence → don't-record-when-home mode + cover-letter greetings on WanderBell.
- WanderCar crash detection + WanderAway panic → auto-trigger evidence recording + emergency revocation.
- WanderStore community-submitted detection models (e.g., "detect Amazon delivery uniform with higher specificity than generic person-detection").
- WanderSafeMesh LoRa mesh fallback alerts when internet is down.
- WanderVault encrypted footage export + cryptographic chain-of-custody.
The magic: Mode 1 + Mode 2 are FULL-FEATURED. Mode 3 adds identity-aware + community + HAVEN depth. Nobody is held hostage for buying into the ecosystem.
---
Identity-aware defaults (the moat)
Zero competitors ship any of these.
1. Don't-record-when-home mode
Inherited from WanderGuard. When WanderBand or a trusted phone/tag is detected at home (via BLE / Thread presence / optional UWB), cameras automatically pause recording (configurable: indoor-only, outdoor-only, all cameras, or per-camera policy).
- For LGBTQ+ / trans households: means the cameras don't log you being home in a way family/guests/landlord/ICE can later demand.
- For DV survivors: configurable so an abusive partner's retained access doesn't record your movements.
- For neurodivergent / mental health: stimming, meltdowns, post-work decompression aren't forever-logged.
Radar presence still triggers motion events to the log (so the tamper-detection "did someone come in?" still works); the footage is what doesn't get kept.
2. Duress unlock code (WanderLock: unique to WanderVerse)
The feature no major lock vendor ships.
User sets:
- Primary unlock code: works normally.
- Duress code (different 4–8 digits): unlocks normally AND:
- Sends silent emergency alert to WanderGuard → user's phone + designated trusted contacts
- Triggers WanderGuard emergency revocation (all shared accounts revoked, audit log generated)
- Activates camera priority recording (+30s pre-roll from buffer, 15 min post-event retention even if normally loop-erased)
- Optionally notifies HAVEN coordinator via LoRa (if subscribed)
- Optionally pings user's Inner Circle (WanderTogether Ring 1)
- Under-duress marker in audit log for legal admissibility
Threat model: abusive partner demands the user let them in; being forced to unlock at knifepoint / held at door / etc. The code is something the user types; the attacker thinks access is granted; the user has silently summoned help without escalating the immediate confrontation.
3. Covert-mode WanderBell (unique)
The Bell's built-in 2.4" display (Pro tier only) shows a different greeting based on who's at the door + who's home:
- Default: standard ring + generic chime
- Presence-aware greeting: "Hi, Shen is at the door" (if Shen's phone is recognized AND the user is home)
- Covert mode: displays different greeting text / fake vacation message / "we're out of town until Friday" based on scheduled rules
- Under-siege mode: triggered by user's silent panic → Bell displays "Nobody home, police have been called" message to deter would-be intruder while WanderGuard escalates alerts silently
All greetings edited by user, local-only. No cloud required.
4. No facial recognition by default
- FR is opt-in per household (not per-device default)
- When opted in, runs only locally via Frigate + CompreFace on the WanderNode Hub, never transmitted
- Setup flow includes the full NIST FRVT / MIT Gender Shades bias disclosure (inherited verbatim from
WANDERGUARD-BUILD-SPEC.md §2)
- FR can be limited to "known-trusted-faces only" mode (additive safelist) vs "identify-everyone" mode (never enabled by default)
5. Architecturally absent law-enforcement portal
- No police portal
- No "Ring Neighbors"-class public forum
- Footage export is user-initiated only via WireGuard-authenticated app action
- ICE / CBP are explicitly in our Standard 11 no-sell list
- LEO warrant service goes through user's lawyer, not through a vendor portal
6. Trans/survivor-aware defaults at setup
- Setup flow asks "Are you setting up after leaving a difficult situation?", triggers DV Survivor Setup Mode (inherited from WanderGuard §5):
- Single-owner account (no "add household member" prompt)
- Duress code required before completing lock setup
- Audit logging at max retention
- Emergency revocation shortcut prominent on home screen
- HAVEN integration suggested if user has Inner Circle
---
Architecture
┌──────────────────────────────────────────────────────────────────────┐
│ WANDERNODE HUB │
│ WanderOS + Frigate NVR + Matter Controller + Z-Wave + Thread Border │
│ + WireGuard Server + Audit Log + WanderGuard alert engine │
│ + WanderStore runtime (for community models/chimes/glyphs) │
└──────────────────────────────────────────────────────────────────────┘
│ │ │ (Matter/Thread local mesh) │
│ │ │ │
PoE ▼ ▼ ▼ PoE (802.3at/bt) ▼
┌──────────────┐ ┌────────────┐ ┌─────────────┐ ┌────────────────┐
│ WanderCam │ │ WanderCam │ │ WanderBell │ │ WanderLock │
│ Indoor/Out/ │ │ Pro │ │ │ │ Std/Bio │
│ Pro/Batt │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
│ Sony IMX │ │ + 24 GHz │ │ + NFC │ │ Matter+Thread │
│ ESP32-S3 or │ │ radar │ │ + 24 GHz │ │ + Z-Wave 800 │
│ RK3566 │ │ + LED │ │ radar │ │ + BLE │
│ │ │ spot │ │ + 2-way │ │ + keypad │
│ │ │ + 2-way │ │ audio │ │ + fingerprint │
│ │ │ audio │ │ + 2.4" disp │ │ (Bio) │
└──────┬───────┘ └─────┬──────┘ └──────┬──────┘ └────────┬───────┘
│ RTSP/ONVIF │ │ │
▼ ▼ ▼ ▼
(footage to Frigate on Hub) (chime/display (unlock events,
local; NFC duress marker,
forwards to Hub) audit log)
Power:
- WanderBridge PoE-out ports feed Cam + Bell (802.3at Type 2 for Cam Pro, 802.3af for others, 802.3bt Type 3 reserved for future higher-power models).
- WanderLock: 4× AA alkaline OR 12V DC wired (if integrated into security system with wiring). Battery life 9–12 months AA typical.
- WanderCam Battery: 14.4V 5000 mAh 18650 pack (4× cells) + optional 6W solar panel (add-on). 90–120 days between charges typical, indefinite with solar in sunny climates.
Connectivity:
- Cam (wired PoE): Ethernet 100-BASE-TX back to Hub; ONVIF + RTSP.
- Cam (battery): WiFi 6 (2.4/5 GHz) back to Hub; WiFi-only Cameras still send raw frames not cloud clips.
- Bell: PoE primary, WiFi 6 fallback if buyer runs a PoE injector instead of a full WanderBridge.
- Lock: Matter-over-Thread primary, Z-Wave 800 secondary, BLE for direct phone setup. No WiFi on the lock (battery life).
Local processing:
- Cam Indoor/Outdoor: ESP32-S3 handles encoding + motion-zone pre-filter; heavy detection runs on the Hub.
- Cam Pro: RK3566 with integrated NPU (1 TOPS) runs first-pass person/vehicle/package detection ON-camera before streaming only detected events to Hub (saves Hub load). Still dual-streams full RTSP for Frigate audit.
- Bell: ESP32-S3 handles UI + chime + NFC + radar-gated motion trigger; video streamed raw to Hub.
- Lock: ESP32-C6 (Matter + Thread radio integrated) handles unlock logic + keypad + fingerprint; audit pushed to Hub on every event.
---
Per-product detail
WanderCam
What it is: Privacy-first IP security camera. PoE primary. Indoor / Outdoor / Pro / Battery variants.
SKU table
| Variant | Device ID | Sensor | Resolution | Power | Housing | Radar | LED spot | Audio | Price |
|---|
| Indoor | `WV-SEC-CAM-IN` | Sony IMX415 | 2K @ 30fps | PoE 802.3af + WiFi 6 fallback | ABS indoor | — | — | opt-in mic | TBD |
| Outdoor | `WV-SEC-CAM-OUT` | Sony IMX678 | 4K @ 15 / 2K @ 30fps | PoE 802.3at | IP65 ABS + UV | — | — | opt-in mic | TBD |
| Pro | `WV-SEC-CAM-PRO` | Sony IMX678 + Bosch HDR IP | 4K @ 15 / 4K HDR | PoE 802.3at | IP65 ABS + UV | 24 GHz BGT24LTR11 | 1200 lm dimmable | stereo mic + speaker | TBD |
| Battery | `WV-SEC-CAM-BATT` | Sony IMX415 | 2K @ 15 (power-optimized) | 4× 18650 + opt solar 6W | IP65 ABS + UV | — | — | opt-in mic | TBD |
Anti-audience: if you want facial recognition tied to a cloud service or 1080p sub-$40 cameras, don't buy this.
Platform
- MCU: ESP32-S3-WROOM-1U 16MB flash (Indoor/Outdoor/Battery); Rockchip RK3566 quad A55 @ 1.8 GHz with Mali-G52 GPU + 1 TOPS NPU (Pro).
- RAM: 8MB PSRAM on ESP32; 4GB LPDDR4 on RK3566 Pro.
- Storage: microSD slot (all tiers) up to 512GB; internal 64GB eMMC on Pro only.
- Sensor: Sony IMX415 (Indoor/Battery (2K low-light), Sony IMX678 8.3MP (Outdoor/Pro) 4K + low-light), with Bosch ISP/HDR on Pro.
- Lens: 2.8mm f/1.6 (110° diagonal, low-distortion; Indoor/Battery), 4mm f/1.6 (90° narrower for driveway/gate, Outdoor standard), optional 2.8mm for Outdoor.
- Night vision: 940nm IR LEDs (invisible to humans) × 8 for 25m range; Pro adds white-light LED spot (1200 lumen dimmable, manual + radar-triggered).
- Radar (Pro): Infineon BGT24LTR11 24 GHz presence radar, discriminates human vs animal vs blowing-branches, works in rain/snow/fog where PIR fails.
- Audio (Pro): 2× Knowles SPH0645LM4H MEMS mic array + 3W speaker for 2-way talk. Indoor/Outdoor mic is an opt-in module per privacy-by-default posture.
- Connectivity: 100-BASE-TX Ethernet (PoE-in) + 802.11ax WiFi 6 (2.4/5 GHz) + BLE 5.4 for phone setup.
- Mount: standard 1/4"-20 UNC tripod thread + 4-point VESA-M screw pattern. Ball joint for aim.
Repair / DIY
- User-swappable lens module (Pro only: M12 mount bayonet)
- User-swappable microSD
- User-replaceable 18650 cells on Battery variant (T10 Torx service panel; single-cell replacement possible)
- User-printable decorative cover (open STL files: CC BY-SA for Standard cover, CC BY-NC for Pro shroud)
- Ambassador service for sensor swap / PCBA replacement
- Framework-Laptop-level ifixit target: ≥8/10
Compliance
- FCC Part 15 B (unintentional) + Part 15 C (WiFi/BLE/radar modular passthrough)
- CE RED + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH
- State-specific privacy: audio default-OFF in MD, CA, FL, IL, MA, MI, MT, NH, PA, WA; setup flow surfaces region-aware warning
- UL 60950 / UL 62368 (electrical safety)
- No UL 294 required (that's the Bell)
---
WanderBell
What it is: PoE-in (or battery-backed) smart doorbell. NFC + radar + 2-way audio + 2.4" visible display (Pro) for covert-mode greetings.
SKU table
| Variant | Device ID | Resolution | Display | NFC | Radar | Audio | Power | Price |
|---|
| Standard | `WV-SEC-BELL-STD` | 1080p @ 30fps | — | — | 24 GHz BGT24LTR11 | 2-way 2× mic + 2W speaker | PoE 802.3af + battery 1000mAh backup | TBD |
| Pro | `WV-SEC-BELL-PRO` | 4K @ 15 / 2K @ 30 | 2.4" 320×240 LCD | PN7462 | 24 GHz BGT24LTR11 + 60 GHz BGT60TR13C gesture | stereo 2-way + 3W | PoE 802.3at + battery 1500mAh backup | TBD |
Key design decisions
- Radar-gated motion: doorbell cameras that fire on every breeze or passing car are the single biggest consumer complaint (Ring / Nest / Amazon all have this problem). BGT24LTR11 discriminates human presence; eliminates 90%+ of false triggers.
- NFC reader at door (Pro): lets a WanderBand or phone tap to send "I'm here + I'm trusted" intent to WanderGuard. The Bell does NOT unlock the door itself. It forwards the intent to WanderLock via Matter, and WanderLock makes the decision based on its own authorization table. Two-stage architecture prevents Bell compromise from unlocking door.
- Direct 2-way audio via WireGuard, not TURN: the single biggest Ring privacy failure was cloud-TURN routed 2-way audio going through Amazon servers. WanderBell's 2-way audio connects phone-to-doorbell via WireGuard directly. Audio never touches a WanderVerse server.
- Local 2.4" display (Pro): displays the presence-aware / covert-mode greeting. The unique identity-aware feature.
- Battery backup on both tiers: if PoE fails (power cut, cable cut), 1000–1500 mAh LiPo keeps Bell working for 48–72 hours. Alert to user when PoE drops.
Platform
- MCU: ESP32-S3-WROOM-1U (Std); ESP32-P4 + co-MCU for Pro (4K + display + radar load).
- Storage: microSD (both tiers) + 32GB internal eMMC (Pro only).
- Sensor: Sony IMX385 (Std (1080p low-light specialist), Sony IMX678 (Pro) 4K + HDR).
- Lens: 1.8mm f/2.0 (165° fisheye for head-to-toe view at door distance).
- Audio: 2× Knowles SPH0645LM4H MEMS mics with beamforming; 2–3W speaker behind acoustic mesh.
- Radar: Infineon BGT24LTR11 at 24 GHz (Std + Pro); + BGT60TR13C 60 GHz for gesture-recognition on Pro (wave to trigger a specific greeting mode).
- NFC (Pro): NXP PN7462AU reader IC with printed-coil antenna around faceplate.
- Display (Pro): 2.4" 320×240 transflective LCD (visible in daylight + backlit for night); not AMOLED because doorbell displays need to be visible in direct sunlight.
- Chime: wired + wireless:
- Wired: mechanical-relay contact for existing doorbell transformer (8–24V AC, compatible with 90%+ US installations)
- Wireless: 433 MHz signal to WanderChime (stocking unit; $29 extra)
- Via Hub: triggers WanderSpeaker / WanderDash / any connected WanderOS device
- Enclosure: IP65 ABS/polycarb with UV-stable white/black/bronze/graphite options; tamper switch (alerts if Bell is pried off).
- Cover plate: open STL, community can print custom plates; Ambassador Lux tier hand-paints/glyphs.
Compliance
- FCC Part 15 B + C (WiFi, radar, NFC)
- CE RED + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH
- UL 294 (access-control system, required because Bell integrates with lock via Matter intent forwarding), ~$5-10k cert
- State-specific video-doorbell privacy: audio default-ON (US norm for doorbells; dedicated outdoor-facing direction + user-visible ring indicator) but regional customization in setup
- IP65 rating certified
---
WanderLock
What it is: Matter-over-Thread smart deadbolt with duress code as first-class feature.
SKU table
| Variant | Device ID | Protocol | Keypad | Biometric | Duress | Audit log | Price |
|---|
| Standard | `WV-SEC-LOCK-STD` | Matter-over-Thread + Z-Wave 800 + BLE | ✅ backlit 4×3 | — | ✅ | ✅ | TBD |
| Biometric | `WV-SEC-LOCK-BIO` | Matter + Thread + Z-Wave 800 + BLE + NFC | ✅ backlit + haptic | ✅ capacitive fingerprint | ✅ | ✅ | TBD |
Key design decisions
- Matter-over-Thread primary (per 2026+ industry direction): universal interop with Apple Home, Google Home, Alexa, SmartThings, HA. Thread mesh means the lock stays reachable even if WiFi drops.
- Z-Wave 800 Series backup for households with existing Z-Wave meshes (important for the "upgrade one thing at a time" user path).
- BLE auxiliary for direct phone setup and NFC-gated tap-to-unlock (phone + WanderBand).
- No Bluetooth-as-primary-unlock: BLE relay attacks remain a real vulnerability in the August / TTLock class of locks. BLE on WanderLock is pairing-only; unlock requires cryptographic challenge over Matter/Thread.
- Duress code: absolutely unique in the market as a first-class feature with audit-log marker. See §Identity-aware §2.
- Keypad: backlit 4×3 capacitive touch + haptic feedback; up to 100 codes; time-limited codes auto-expire.
- Fingerprint (Biometric): capacitive (more secure than optical) sensor (Goodix GM165-class). Bias disclosure: fingerprint sensors have documented lower acceptance rates for thin/dry/aged fingers + certain skin types; user flow offers backup code always; user can disable biometric entirely without losing other features.
- Emergency override: physical key bypass (standard euro-profile or KW1 keyway options) + battery-dead passcode (special sequence on keypad with 3× AAA emergency power). Nobody is ever locked out.
- Audit log: every unlock event (code ID, timestamp, duress flag, entry direction) written to internal FRAM + pushed to Hub. Retained locally 90 days + Hub-pushed immediately.
- Works with existing deadbolts OR WanderLock dedicated mechanism: same product can be installed as "replace your existing deadbolt entirely" or "keep your existing deadbolt and put WanderLock on the interior side, turning the existing thumb-turn." Smaller upgrade friction.
Platform
- MCU: Espressif ESP32-C6 (RISC-V, Wi-Fi 6 + BLE 5 + 802.15.4 Thread radio all on-chip, but WiFi disabled for battery; only BLE + Thread + Z-Wave used).
- Z-Wave 800: Silicon Labs ZG23 as secondary radio module.
- Secure Element: NXP SE051 for Matter credential storage + fingerprint template storage (if Bio tier).
- Fingerprint (Bio only): Goodix GM165 capacitive sensor with on-chip template matching (templates never leave the sensor); max 100 fingers, match time <0.5s.
- FRAM: 256 KB Fujitsu FRAM for audit log (survives battery pull).
- Motor: brushless torque motor, 4.5 N·m at deadbolt spindle; low-noise <40 dB at unlock.
- Keypad: 4×3 capacitive touch PCBA + 12× white LED backlight + TI DRV2605 haptic driver with LRA.
- Power: 4× AA alkaline OR 12V DC wired-in (for always-on security-system integration).
- Lifetime: 9–12 months AA typical (normal residential use); low-battery alert at 20% / 10% / emergency mode at 3%.
- Bypass: physical key (KW1/SC1 cylinder + customer can re-key) + emergency-passcode-on-AAA-power.
Compliance
- UL 437 (security residential deadbolt: anti-drill, anti-pick, anti-pick-gun rated; expensive but the real differentiator vs August/Level/Yale which have NOT done UL 437. They did lesser grade tests)
- ANSI/BHMA Grade 1 (cycle-tested to 250,000 unlock cycles + forced-entry testing): Standard target; Biometric = same Grade 1 rating
- Matter certification via Connectivity Standards Alliance
- Z-Wave certification via Z-Wave Alliance
- FCC Part 15 B + C (BLE + Thread + Z-Wave modular passthrough)
- CE RED + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH
- EN 14846 (European locking mechanical security) for EU market
- IP54 (splash-resistant outdoor-rated: meaningful for front-door deployment)
---
WanderStore integration (all three)
Per ../_LAG-CLOSING-AND-MOVEMENT-STRATEGY.md §WanderStore, each product has a community-extension vector:
- WanderCam: community-submitted detection models (Frigate-compatible YOLO variants, e.g., specialized models for package/dog/Amazon-uniform). Community-vetted, Ambassador-packaged, fee split per WanderStore rules.
- WanderBell: community-submitted chimes (audio files + text-greeting templates + covert-mode rule sets), lets the doorbell say "bienvenido a casa" or ring with a custom song the owner's Ambassador designed.
- WanderLock: community-submitted cover plates + glyphs (STL + CAD files; Ambassador-printed or Ambassador-etched), lets users personalize the front of the lock.
All community submissions go through a safety-review pipeline (no malicious detection payloads, no chime that masquerades as a WanderVerse alert tone, no cover plate that interferes with keypad/NFC operation). Revenue splits per the 60/30/10 WanderVerse Community Pool model.
---
Feature matrix (vs Ring / Nest / Arlo / August / Schlage / Yale)
See _COMPETITIVE-AUDIT-2026-04-24.md for the full 11-4-6 scorecard.
Headline leads:
1. No vendor cloud required: every competitor locks footage/event history behind a subscription. 2. No police portal (architecturally absent, not a setting). 3. Duress code first-class (nobody else). 4. Don't-record-when-home mode (nobody else). 5. Covert Bell greetings (nobody else). 6. Local Frigate detection (nobody else as default). 7. User-replaceable cells / user-accessible service panel / user-swappable cover (Framework-Laptop repair parity). 8. 7-year spare parts guarantee. 9. Matter-over-Thread primary lock (Yale/Schlage have Matter add-ons but still ship Z-Wave or Zigbee primary). 10. Ambassador-assembled + social-impact employment. 11. Abuser revocation with audit log, inherited from WanderGuard; unique to WanderVerse.
---
Ambassador-assembly workflow
- Cam Indoor: 15 min typical Ambassador assembly (lens alignment + PCBA seat + enclosure seal + pressure test).
- Cam Outdoor: 22 min (+ gasket + UV-spec verify + IP65 pressure test).
- Cam Pro: 32 min (adds radar alignment + LED light calibration + HDR ISP cal).
- Cam Battery: 28 min (adds 4× 18650 insertion + seal + solar-port test).
- Bell Std: 25 min.
- Bell Pro: 38 min (adds display alignment + NFC coil + gesture radar).
- Lock Std: 20 min (motor alignment + keypad cal + Matter provisioning).
- Lock Bio: 28 min (adds fingerprint sensor cal + template-sensor burn-in).
Per-unit Ambassador Signature Build Mark (Standard 1):
- Cam: interior PCBA signed + QR card inside service panel
- Bell: inside faceplate behind cover
- Lock: inside battery compartment
Lux Ambassador Artisan options (Pro tiers only):
- Hand-painted cover plates
- Etched anodized front plate
- Hand-designed glyph plates
---
Ship timeline
| Tier | EVT | DVT | PVT / first customer ship |
|---|
| WanderCam Indoor + Outdoor | 2026-Q4 | 2027-Q1 | **2027-Q2** |
| WanderCam Pro + Battery | 2027-Q1 | 2027-Q2 | **2027-Q3** |
| WanderBell Standard | 2026-Q4 | 2027-Q1 | **2027-Q2** |
| WanderBell Pro | 2027-Q2 | 2027-Q3 | **2027-Q3** |
| WanderLock Standard | 2027-Q1 | 2027-Q2 | **2027-Q3** |
| WanderLock Biometric | 2027-Q2 | 2027-Q3 | **2027-Q3** |
---
Budgets (engineering, cert, tooling)
| Line item | Cost |
|---|
| Engineering NRE (EE + FW + ID × 3 products, 12 months shared team) | $900k–1.3M |
| Chassis tooling (injection molds for 7 form factors: Cam × 4, Bell × 1 shared with 2 caps, Lock × 1 shared with 2 escutcheon styles) | $150–240k |
| PCB + SMT setup | $80–140k |
| Compliance + cert (family-wide v1.0) | $85–130k |
| UL 437 + BHMA + EN 14846 for Lock (extra) | $25–40k |
| Ambassador training curriculum + stations (5 initial stations) | $40–60k |
| Companion app NRE (iOS + Android + web + SDK, shared with WanderGuard team already budgeted) | amortized |
| **Total family launch NRE** | **$1.3–1.9M** |
Funded via LLC revenue (hardware margin funds engineering); Community Pool 30% unaffected.
---
Open items → implementation phase
| # | Item | Severity | Owner | Deadline |
|---|
| 1 | Contract manufacturer selection (PoE + outdoor-rated camera SMT) | 🔴 | Michael + ops | 2026-Q3 |
| 2 | Sony IMX sensor FAE relationship + NDA | 🟡 | engineering hire | 2026-Q4 |
| 3 | Bosch ISP (Pro camera HDR) FAE + licensing | 🟡 | engineering hire | 2026-Q4 |
| 4 | Rockchip RK3566 reference-design license + board-support | 🟡 | engineering hire | 2027-Q1 |
| 5 | UL 437 certification lab (Intertek / UL / TUV) engagement | 🟡 | cert team | 2027-Q2 |
| 6 | Matter-over-Thread certification (CSA membership + test-fixture) | 🟡 | firmware | 2027-Q1 |
| 7 | Ambassador training curriculum (add Cam/Bell/Lock to existing WanderBand curriculum) | 🟡 | WWP ops | 2027-Q1 |
| 8 | Engineering team hire (same EE/FW/ID as WanderRouter + WanderBand shared pool) | 🔴 | Michael | NOW: 2026-Q3 start |
| 9 | Frigate upstream contribution (donate back any ESP32-S3 on-camera pre-filter improvements) | 🟢 | firmware team | post-ship |
| 10 | WanderStore safety-review pipeline for detection-model submissions | 🟡 | WanderStore team | 2027-Q3 pre-launch |
---
Conflict register (vs existing specs)
| Conflict | Resolution |
|---|
| `WANDERGUARD-BUILD-SPEC.md` says WanderLock primary is **Z-Wave 700** | This spec upgrades to **Matter-over-Thread primary with Z-Wave 800 secondary**. Matter is 2025+ industry direction; Z-Wave is retained (not dropped) for existing-mesh households. Logged in `DECISIONS.md` D-SEC-001. |
| `WANDERGUARD-BUILD-SPEC.md` pricing: Cam Outdoor $149 / Indoor $99 / Bell $129 / Lock $199 | This spec: Cam Indoor $129 / Outdoor $179 / Pro $279 / Battery $199 / Bell Std $199 / Bell Pro $279 / Lock Std $149 / Lock Bio $229. Updated pricing reflects 2027 ship date + upgraded feature set (4K, radar, NFC, duress code, fingerprint, UL 437). Total Full Kit similar ($799 vs $499 earlier, reflects added Pro tier and 2 outdoor cameras). Logged D-SEC-002. |
| `WANDERGUARD-BUILD-SPEC.md` omits cameras having on-device NPU | Pro camera adds RK3566 with 1 TOPS NPU for on-camera pre-filter. Doesn't break WanderGuard's Hub-Frigate architecture, on-camera pre-filter REDUCES Hub load while Hub still gets raw RTSP for audit. Logged D-SEC-003. |
| `WANDERGUARD-BUILD-SPEC.md` says "no facial recognition by default" on Cam | Retained verbatim. Bias disclosure flow inherited. |
| `WANDERGUARD-BUILD-SPEC.md` Bell says "no cloud intercom"; 2-way audio via WireGuard | Retained verbatim. Extended with: Bell Pro direct-to-phone WireGuard for 2-way (not TURN). |
No software conflicts: this spec is strictly the hardware layer; WanderGuard software sections remain canonical.
---
HAVEN variants
All three products ship *-HAVEN variants for safehouse / hostile-jurisdiction deployment:
- WanderCam HAVEN: tamper alarm + covert-mode LED indicators (no visible power LED by default) + LoRa emergency fallback when internet down
- WanderBell HAVEN: LoRa fallback alerts to HAVEN coordinator; no external manufacturer branding (generic enclosure); under-siege mode greeting
- WanderLock HAVEN: extra audit log retention + duress code triggers LoRa mesh alert to coordinator + tamper detection on lock body
HAVEN variants cost +$40–60 per product (hardware add-on for LoRa Heltec node + extra tamper sensors + HAVEN-specific branding-free shell).
---
Bottom line
Three products. One family spec. One Ambassador program. One Community Pool. Three hardware BOMs that share 60% of components. Dual-mode support in every product. No cloud lock-in. No police portal. No subscription. Duress code + don't-record-when-home + covert greeting + abuser revocation, all features nobody else ships.
Feeding into the already-specified WanderGuard software stack, not duplicating it. Every line of Frigate integration, abuser revocation, HAVEN bridge, and alert routing is inherited from WANDERGUARD-BUILD-SPEC.md and stays canonical there.
Ready for engineering hire + BOM sourcing + Stage 4 RFQs.