Why this way.

WanderSecurity Trio — Decision Log

Running log of every keep/swap/drop decision across Cam + Bell + Lock. Citations per entry.

---

Stage 0: Feature-parity sweep (2026-04-24)

• Decision: 3-product family (Cam + Bell + Lock) with 8 SKUs + 3 HAVEN variants + 2 bundles. Shared platform (WanderOS-Security firmware, WanderGuard integration, Ambassador-assembly, 7-year parts, open STLs).
• Source: competitive audit vs Ring/Nest/Arlo/Eufy/Unifi/Amcrest/Reolink/Wyze (cameras); Ring/Nest/Arlo/Eufy/Aqara/Reolink/Unifi (doorbells); August/Schlage/Yale/Level/Lockly/Ultraloq/Kwikset/Aqara (locks).
• Outcome: 11 LEADS / 4 MATCHES / 6 LAGS (per _COMPETITIVE-AUDIT-2026-04-24.md). 4 of 6 LAGS are business-model positioning choices (price, retail channel, pro-install network, face-rec-on-lock), not capability gaps.

---

Stage 1: Intake + freeze (2026-04-24)

• Device IDs assigned across 8 base SKUs + 3 HAVEN + 2 bundles (see _MANIFEST.md).
• Revision frozen at v1.0-candidate.
• Ship target (estimate): Cam Indoor/Outdoor + Bell Std 2027-Q2; Cam Pro/Battery + Bell Pro + Lock both 2027-Q3; HAVEN 2027-Q4.
• Entity: the WanderVerse company (hardware margin); feeds 60/30/10 Community Pool per canonical split.

---

D-SEC-001: Lock protocol: Matter-over-Thread primary, Z-Wave 800 secondary (supersedes Z-Wave 700 primary in `WANDERGUARD-BUILD-SPEC.md`)

• Context: WanderGuard v1.0 (April 2026) specified Z-Wave 700 primary for WanderLock.
• Decision 2026-04-24: Matter-over-Thread is now the industry direction (CSA + Apple + Google + Samsung + SmartThings + Home Assistant committed); by our 2027-Q3 ship, Matter is mature. Z-Wave 800 Series (Silicon Labs ZG23) retained as secondary radio for backward compatibility with existing Z-Wave mesh households.
• Rationale: Matter-over-Thread = universal protocol + mesh resilience + no WiFi-dependence + open standard; retains Z-Wave 800 for the "I already have 23 Z-Wave sensors" user.
• Cost impact: add ~$4 BOM (ZG23 module) but eliminates USB Z-Wave stick dependency on Hub side.
• Conflict resolution: WanderGuard software still works unchanged, software just sees the lock via Matter events instead of Z-Wave events.

---

D-SEC-002: Pricing reset (supersedes WANDERGUARD v1.0 pricing)

• Context: WANDERGUARD-BUILD-SPEC.md priced Cam Outdoor $149, Cam Indoor $99, Bell $129, Lock $199, Starter Kit $299, Full Kit $499.
• Decision 2026-04-24: Updated pricing plan (prices TBD) reflects the 2027 ship target + full feature set:
• Cam Indoor (2K instead of sketch's 4MP/2K, upgraded to Sony IMX415 w/ ESP32-S3)
• Cam Outdoor (4K upgrade vs sketch's 2K)
• Cam Pro (adds 24 GHz radar + LED spot + audio + RK3566 NPU)
• Cam Battery (adds solar-panel option + 18650 pack)
• Bell Std (radar + PoE + battery backup)
• Bell Pro (4K + NFC + 2.4" display + gesture radar)
• Lock Std (Matter-over-Thread + duress + audit)
• Lock Bio (+ fingerprint + NFC)
• Trio Starter / Trio Full
• Rationale: added features justify price; target margins (planning estimate) 42–56% (Pro tier healthier to fund R&D + 60/30/10 split).
• Mission-partner pricing: all SKUs available at-cost to WWP partner organizations + DV shelters per WANDERGUARD-BUILD-SPEC.md precedent.

---

D-SEC-003: Cam Pro adds on-device NPU (RK3566)

• Context: WANDERGUARD-BUILD-SPEC.md assumed all detection on Hub Frigate + optional Coral USB TPU.
• Decision: Pro camera upgrades MCU from ESP32-S3 to Rockchip RK3566 with integrated 1 TOPS NPU.
• Rationale:
• On-camera pre-filter (quick "is this a human?" check) reduces Hub bandwidth + compute load ~70% for a 4-camera deployment.
• Hub Frigate still gets raw RTSP for audit and deeper detection (doesn't break WanderGuard software contract).
• RK3566 costs +$8 BOM but is the industry norm for 4K+HDR+NPU cameras (Reolink / Unifi G5 Pro use similar silicon).
• Alternative considered: ESP32-P4 (under-powered for 4K HDR); Ambarella CV5 (expensive + proprietary toolchain + under-supported by Frigate).

---

Stage 2: Component selection (2026-04-24)

Camera silicon

• Indoor / Outdoor / Battery MCU: ESP32-S3-WROOM-1U 16MB (commodity, well-supported by Frigate via RTSP; $4.50 BOM)
• Pro SoC: Rockchip RK3566 quad A55 + 1 TOPS NPU + Mali-G52 (Linux BSP mature; $12 BOM; 4K HDR capable)
• Image sensor Indoor/Battery: Sony IMX415 (2K low-light specialist; $6 BOM)
• Image sensor Outdoor/Pro: Sony IMX678 (4K 8.3MP low-light; $18 BOM)
• ISP for Pro HDR: Bosch integrated ISP pipeline (licensing + tuning dep); alt = RK3566 built-in ISP (no license, weaker HDR)

Bell silicon

• Standard MCU: ESP32-S3-WROOM-1U
• Pro MCU: ESP32-P4 (new ESP platform, 4K H.265 encode at < 5W) + co-MCU ESP32-C6 for Thread/NFC
• Image sensor Standard: Sony IMX385 (1080p low-light)
• Image sensor Pro: Sony IMX678 (4K)
• Radar (both tiers): Infineon BGT24LTR11 (24 GHz, $8 BOM)
• Gesture radar Pro only: Infineon BGT60TR13C (60 GHz, $18 BOM, shared part with WanderBand Ultra)
• NFC (Pro only): NXP PN7462 + printed coil

Lock silicon

• MCU: Espressif ESP32-C6 (RISC-V + WiFi6 + BLE5 + 802.15.4 Thread all on-chip; WiFi disabled for battery; $3 BOM)
• Z-Wave 800 secondary: Silicon Labs ZG23 (module-level, ~$4 BOM, catalog-available)
• Secure Element: NXP SE051 (shared with WanderBand, reuse FAE relationship)
• Fingerprint (Bio only): Goodix GM165 capacitive with on-chip template matching ($7 BOM)
• FRAM for audit log: Fujitsu MB85RS256B 256 KB ($2 BOM; survives battery pull)
• Motor: brushless DC torque motor 4.5 N·m; custom-spec from multiple Chinese motor suppliers

Shared components (Standard 6a: cross-product BOM sharing)

• ESP32-S3-WROOM-1U shared across Cam Indoor/Outdoor/Battery + Bell Standard → single SKU, single distribution channel, single FAE line
• BGT24LTR11 24 GHz radar shared across Cam Pro + Bell Standard + Bell Pro → single FAE line
• NXP SE051 Secure Element shared with WanderBand Standard+ → already-established relationship
• BGT60TR13C 60 GHz radar shared with WanderBand Ultra → already-established FAE line
• TI BQ25180 battery charger shared with WanderBand + Cam Battery + Bell Pro → already-established
• TVS diodes (TPD3E001, TPD6S300) family-wide shared

---

Stage 2b: Configurator axes (2026-04-24)

Each product has a discrete configurator axis set. See CONFIGURATOR.md:

• Cam: housing variant · sensor (2K / 4K) · mount (VESA / tripod / pole) · power (PoE / battery) · radar add (Pro) · LED spotlight (Pro) · audio module opt-in · HAVEN variant · color · Ambassador signature · WanderAssist subscription
• Bell: tier (Std / Pro) · chime style · faceplate color/finish · display greeting templates (Pro) · HAVEN variant · Ambassador signature
• Lock: tier (Std / Bio) · keyway (KW1 / SC1 / no-key / euro) · finish (satin-nickel / matte-black / bronze / brass / stainless) · escutcheon style · lock body style (dedicated deadbolt / existing-deadbolt-adapter) · fingerprint capacity (Bio: 5 / 20 / 100 fingers)

---

Stage 3: Compatibility review (2026-04-24)

Resolved:

• ESP32-S3 + Sony IMX over MIPI-CSI → standard; Espressif ref designs exist for IMX415
• RK3566 + IMX678 + Bosch ISP → verified by Rockchip ref + Reolink's production use (similar silicon stack)
• Matter-over-Thread + Z-Wave coexistence on lock: 2.4 GHz Thread + 908.42 MHz Z-Wave are in different bands, no contention
• BLE 5.4 coexistence on lock (on same ESP32-C6 radio): Thread and BLE time-share on 802.15.4 PHY; firmware handles
• PoE 802.3at (25.5W budget) adequate for all Cam tiers including Pro (4K + radar + LED = 12W worst-case)
• Mechanical fit: Cam Indoor < Wedge-S interior (generous); Cam Pro uses Soffit-L for LED spot + radar mount
• Lock: standard deadbolt retrofit (US 2-3/8" or 2-3/4" backset) with modular front escutcheon + rear motor assembly

Deferred to Stage 5/6:

• PCB impedance-controlled lanes for RK3566 DDR + MIPI-CSI
• Antenna placement (Matter Thread 2.4 GHz + Z-Wave 908 MHz + BLE 2.4 GHz coexist on lock)
• SAR (not applicable: none of these have cellular)
• Fingerprint sensor EMI from motor activation (Bio lock)

---

Stage 4: Sourcing (2026-04-24, framework only; RFQs pending engineering hire)

Same pattern as WanderBand:

• Sony IMX sensors through DigiKey/Mouser + Sony FAE direct for volume pricing
• Bosch ISP through Bosch direct (license required)
• Rockchip RK3566 through distributors (Shenzhen supply chain) + FAE
• Infineon radars: DigiKey/Mouser + FAE
• Goodix GM165 fingerprint: direct only (Chinese specialty, NDA required)
• Silicon Labs ZG23: DigiKey/Mouser
• Heltec LoRa32 v3 (HAVEN variants): Heltec direct
• All other commodity parts: DigiKey/Mouser/Arrow/Newark

See SOURCING.csv for per-part detail.

---

Stage 5: DFM/DFA/DFT (2026-04-24)

• 7 unique PCBAs across the family (Cam Indoor/Outdoor share; Cam Pro + Cam Battery separate; Bell Std + Bell Pro separate; Lock Std + Lock Bio share with module differences)
• Ambassador assembly times range 15–38 min per unit (see spec §Ambassador-assembly workflow)
• 19 production tests per unit (Cam), 16 per Bell, 14 per Lock
• Per-unit provisioning: serial etch + NVMEM (MAC, Matter cert, Thread cred, Z-Wave ID)
• DFT fixture cost: $15k Cam + $10k Bell + $8k Lock = $33k family-wide

---

Stage 6: Thermal/EMC (2026-04-24)

• Cam Pro: 8W worst case (RK3566 + LED spot + radar + encoding), aluminum back plate heatsink; thermal envelope OK
• Cam Indoor: 3.5W max; passive
• Cam Battery: 2W active; passive
• Bell Pro: 5W active (display + 4K encode); passive
• Bell Std: 2W; passive
• Lock: 1W peak (motor activation 5s burst at 8W); easily handled by AA pack
• EMC: radio coexistence carefully planned (Matter 2.4 GHz + Z-Wave 908 MHz + BLE 2.4 GHz on lock; WiFi 6 + BLE on cameras)
• ESD: Level 4 on all external (keypad, fingerprint, buttons, charging jacks, NFC reader, Ethernet)

---

Stage 7: Compliance (2026-04-24)

• Cam: FCC Part 15 B + C (WiFi + BLE + radar passthrough) + CE + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH + UL 62368; state-specific audio default-OFF in 10 states
• Bell: same + UL 294 (access-control integration; +$5-10k)
• Lock: same + UL 437 (residential deadbolt anti-pick/drill/bump; +$15-25k) + ANSI BHMA Grade 1 (250k cycle test + forced-entry; +$8-15k) + EN 14846 EU market (+$5-10k) + Matter certification via CSA + Z-Wave Alliance cert
• Total family v1.0 cert: $85–130k

---

Stage 8: Canonical BOM + GUIDE + STLs (2026-04-24)

• Platform + modules + full GUIDE per product
• 22 STL files (cam covers × 4, bell faceplates × 3, lock cover plates × 4, mounting hardware × 6, accessory prints × 5)
• CC BY-SA 4.0 for Standard parts; CC BY-NC 4.0 for Pro cover references; Lux parts NOT published (Ambassador-made)
• See BOM-platform.csv, BOM-modules.csv, GUIDE.md, STL-OPEN-FILES/README.md

---

Stage 9: HW↔FW binding (2026-04-24)

• All three products run WanderOS-Security on Zephyr RTOS 3.7+ (MIT-licensed overlay)
• Single shared firmware codebase for Matter/Thread/BLE/WireGuard/audit-log primitives
• Per-product modules for sensor-specific drivers (IMX415/IMX678/Bosch ISP; BGT24/60; Goodix fingerprint; ZG23 Z-Wave)
• OTA update infrastructure shared with WanderBand (single update server + signed releases)
• See HW-FW.md

---

Stage 10: Gate review + service flow (2026-04-24)

• EVT: 25 units per SKU minimum, 90% production-test yield required
• DVT: 200-250 units per SKU, full cert runs, 95% yield
• PVT: 500-1000 units per SKU (Pro-tier smaller runs), 98% yield
• First-customer-ship timeline locked (see GATE.md)

---

Critical open items (revalidated)

Item	Severity	Action owner	Deadline
Engineering team hire (EE + FW + ID) shared pool with WanderRouter + WanderBand	🔴	Michael	**NOW: 2026-Q3 start**
Contract manufacturer for outdoor-rated camera SMT + lock mechanical + doorbell sheet-metal/plastic	🔴	Michael + ops	2026-Q3
Sony IMX FAE / NDA (IMX415 + IMX678 volume pricing)	🟡	engineering hire	2026-Q4
Bosch ISP license (Cam Pro HDR)	🟡	engineering hire	2026-Q4
Rockchip RK3566 BSP + NPU toolchain	🟡	engineering hire	2027-Q1
UL 437 cert lab engagement	🟡	cert team	2027-Q2
BHMA Grade 1 test fixture (250k unlock cycles)	🟡	Lock engineering	2027-Q1
Matter CSA membership + test-fixture access	🟡	firmware	2027-Q1
Goodix GM165 fingerprint FAE + NDA	🟡	engineering hire	2027-Q2
WanderStore safety-review pipeline (detection models)	🟡	WanderStore team	2027-Q3
Ambassador training curriculum extension	🟡	WWP ops	2027-Q1
Live KiCad + Flux.ai schematics for 7 unique PCBAs	🔴	engineering team	2027-Q1
State-specific privacy labeling + setup flow	🟢	firmware + packaging	2027-Q1

---

Non-goals (explicitly NOT shipping)

• Face recognition on lock: not by design; face-rec-on-lock (Lockly Visage-style) creates bias risks we won't ship. User supplements with WanderBand NFC tap for additional factor if desired.
• Cloud storage tier: never. All footage stays on Hub + user's chosen local NAS.
• Neighbors-style public feed: never. WanderTogether Ring 2 community alerts are text-only + mutual-consent per WanderGuard spec.
• Law-enforcement portal / API: architecturally absent. Standard 11.
• Ring-compatibility: not a "works with Ring" claim. Ring is a specific architecture that we consider broken; we don't bridge to it.
• Subscription for core features: never. Optional WanderAssist (monthly price TBD) is AI-management layer only; all security features work without subscription.