WanderSecurity Trio — WanderCam · WanderBell · WanderLock (Family Spec)
Product family: WanderSecurity Trio — privacy-first home security hardware that feeds the existing WanderGuard software stack Device IDs:
WV-SEC-CAM-IN · WV-SEC-CAM-OUT · WV-SEC-CAM-PRO · WV-SEC-CAM-BATTWV-SEC-BELL-STD · WV-SEC-BELL-PROWV-SEC-LOCK-STD · WV-SEC-LOCK-BIO- HAVEN-hardened variants:
WV-SEC-*-HAVEN
Chassis reuse: Cam = new Wedge-S / Dome-M / Soffit-L · Bell = new Doorbell-M · Lock = new Lock-Escutcheon Status: spec v1.0-candidate — post-WANDERGUARD-BUILD-SPEC, SOP v2 native, platform + modules, identity-aware, Ambassador-assembled Supersedes: the hardware sections of ~/Downloads/Claude/wandersafe/specs/WANDERGUARD-BUILD-SPEC.md v1.0 (April 2026) — this version keeps WanderGuard's software architecture unchanged and replaces the single-paragraph hardware sketches with a full per-product SOP v2 artifact set Ship target: WanderCam Q2 2027 · WanderBell Q2–Q3 2027 · WanderLock Q3 2027 Date: 2026-04-24
Shared family docs: ../_WORKFLOW-SOP.md · ../_HARDWARE-TOOLCHAIN.md · ../_FAMILY-EXPANSION-REVIEW.md · ../_STANDALONE-AND-PLATFORM-INTEGRATION.md · ../_LAG-CLOSING-AND-MOVEMENT-STRATEGY.md · ~/Downloads/Claude/wandersafe/specs/WANDERGUARD-BUILD-SPEC.md · ~/Downloads/Claude/wandersafe/specs/WANDERVERSE-PLATFORM-STANDARDS.md · ~/Downloads/Claude/wandersafe/specs/WANDERVERSE-COMMUNITY-POOL-SPEC.md
---
Why a family spec, not three
These three products share nearly every platform decision:
- Same WanderGuard software stack on the WanderNode Hub (Frigate NVR, Z-Wave/Matter controller, WireGuard server, audit log)
- Same PoE-in architecture from WanderBridge (all three are PoE-powered where wired; all three have battery-backed variants)
- Same identity-aware defaults (don't-record-when-home, duress-unlock, covert greetings, no-police backdoor)
- Same Ambassador assembly process + Signature Build Mark
- Same 7-year parts + firmware guarantee
- Same Community Pool revenue split (60/30/10 per
WANDERVERSE-COMMUNITY-POOL-SPEC.md)
- Same WanderStore integration (community detection models, custom chimes, community glyph plates)
- Same dual-mode product principle (Standalone + Industry-integrated + WanderVerse-native)
Specing them together lets us share BOM lines (PoE PD, ESP32-S3 MCU, mmWave radar module, SecureElement, TVS, connectors), share compliance work (FCC Part 15 B + C modular-passthrough covers all three), and share Ambassador training.
---
v1.0 amendments over the WANDERGUARD hardware sketch
These amendments supersede the four-bullet hardware sections in WANDERGUARD-BUILD-SPEC.md (lines 76–147). WanderGuard's software sections (alert routing, Frigate integration, abuser revocation, HAVEN integration, etc.) are retained as-is and this spec is designed to feed them.
Architectural:
- WanderCam resolution upgraded from 4MP/2K to 4K UHD on Outdoor + Pro tiers (consumer expectation 2027). Indoor tier stays 2K for price point.
- WanderCam Pro adds 24 GHz mmWave presence radar for reliable human-vs-animal / blowing-branches discrimination — independent of PIR (which false-triggers on temperature gradients + car exhaust).
- WanderBell gets NFC reader at entry (for WanderBand + phone tap-to-unlock-door intents — unlock is still executed by WanderLock; Bell just reads the tap and forwards it).
- WanderLock moves from Z-Wave primary (per WanderGuard v1.0 spec) to Matter-over-Thread primary with Z-Wave 800 Series as secondary. Rationale: by 2027 ship, Matter-over-Thread is the open-standard anchor the whole home-automation industry has committed to; Z-Wave is maintained for households with existing Z-Wave meshes.
- WanderLock adds fingerprint reader on biometric tier (with explicit bias-transparency disclosure — see §Identity-aware).
- Duress code becomes a first-class WanderLock feature (not "maybe later"). Entering the duress code unlocks normally AND silently triggers WanderGuard emergency revocation + alert cycle. Architecturally absent from Ring/Nest/Schlage/Yale/August.
- All three products get Apple HomeKit Secure Video + Google Home + Matter Controller compatibility as opt-in per dual-mode principle. Default posture remains WanderVerse-local.
Compliance budget corrections:
- WanderCam v1.0 cert (FCC + CE + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH for 3 tiers): ~$30-45k
- WanderBell v1.0 cert (add RED IV for wide-area video intercom + doorbell-specific UL 294): ~$20-30k
- WanderLock v1.0 cert (add UL 437 for residential security + ANSI BHMA Grade 1/2 + Matter certification + FCC/CE/IC): ~$35-55k (UL 437 is the expensive item; Grade 1 test is per-lock-model)
- State-specific camera privacy laws (2-party consent for audio in MD, CA, FL, IL, MA, MI, MT, NH, PA, WA): labeled default-audio-off with region-specific setup warning. No extra cert cost — implemented in firmware + packaging.
- Total family v1.0 cert: ~$85-130k (well within normal product family launch envelope).
Firmware:
- All three products run WanderOS-Security (Zephyr RTOS 3.7+ overlay, MIT-licensed) sharing same BLE / Matter / Thread / WireGuard / audit-log primitives. Single firmware team covers all three after v1.0 ship.
- Frigate integration is fed via standard RTSP + ONVIF; every WanderCam streams raw to Hub. No proprietary protocol — you can run a WanderCam into any Frigate/Synology/Unifi NVR too.
Pricing locked:
| SKU | Tier | Retail (LLC) | Mission-partner price |
|---|
| WanderCam Indoor (2K, PoE + WiFi) | Standard | **$129** | at-cost |
| WanderCam Outdoor PoE (4K, IP65) | Standard | **$179** | at-cost |
| WanderCam Pro (4K + radar + LED spotlight + audio, IP65) | Pro | **$279** | at-cost |
| WanderCam Battery (2K PoE OR battery + solar) | Flex | **$199** | at-cost |
| WanderBell Standard (1080p, PoE, radar, local recording) | Standard | **$199** | at-cost |
| WanderBell Pro (4K, PoE + battery backup, NFC, radar, HomeKit Secure Video) | Pro | **$279** | at-cost |
| WanderLock Standard (Matter-over-Thread + keypad + duress code + audit) | Standard | **$149** | at-cost |
| WanderLock Biometric (Matter + Thread + Z-Wave + fingerprint + duress + audit) | Pro | **$229** | at-cost |
| Trio Starter (Cam Indoor + Bell Std + Lock Std) | Bundle | **$449** | at-cost |
| Trio Full (2× Cam Outdoor + Bell Pro + Lock Bio) | Bundle | **$799** | at-cost |
Margins: 42–52% on standard tier, 48–56% on Pro tier, lower on bundles (24–32%) by design to funnel buyers toward the full system.
---
Dual-mode product principle (applied)
Per ../_STANDALONE-AND-PLATFORM-INTEGRATION.md, each of these products must work in all three modes.
Mode 1 — Standalone
- WanderCam: buy one camera, a microSD card, and the free WanderGuard app; records locally to SD, streams to your phone via direct WireGuard-to-phone (no Hub required for 1-cam setups), motion alerts work. Setup in under 5 min.
- WanderBell: similar — doorbell press + 2-way audio + local SD recording + radar-gated notifications to your phone. No Hub required for 1-bell setups.
- WanderLock: works as a great Matter-over-Thread lock with any Matter controller (Apple Home / Google Home / SmartThings / Home Assistant / Amazon Echo). Duress code + audit log work locally on-device regardless.
Mode 2 — Industry-integrated
- Apple HomeKit Secure Video (HKSV): WanderCam and WanderBell both ship as HKSV-compatible accessories (requires iCloud+ 50GB plan on buyer side, runs Apple's native local-recording architecture with no Amazon/Google cloud involved). Opt-in.
- Google Home / Nest: all three products advertise as Matter devices on 2.4 GHz Thread + appear natively in Google Home.
- Amazon Alexa: basic announce + lock/unlock via Matter.
- SmartThings: native.
- Home Assistant: first-class HA entities via Matter + ONVIF + MQTT.
- Ubiquiti Protect: WanderCams are ONVIF/RTSP so they appear natively.
- Synology Surveillance Station / Jellyfin-Video / Blue Iris: all supported via ONVIF.
- Frigate (self-hosted): obviously first-class.
- Unifi Access / OSDP / Wiegand: WanderLock Biometric exports OSDP over RS-485 for small-business access-control integration.
Mode 3 — WanderVerse-native
- Full WanderGuard software stack — Frigate + abuser revocation + community alert mesh + HAVEN + audit logs.
- WanderBand presence → don't-record-when-home mode + cover-letter greetings on WanderBell.
- WanderCar crash detection + WanderAway panic → auto-trigger evidence recording + emergency revocation.
- WanderStore community-submitted detection models (e.g., "detect Amazon delivery uniform with higher specificity than generic person-detection").
- WanderStation LoRa mesh fallback alerts when internet is down.
- WanderVault encrypted footage export + cryptographic chain-of-custody.
The magic: Mode 1 + Mode 2 are FULL-FEATURED. Mode 3 adds identity-aware + community + HAVEN depth. Nobody is held hostage for buying into the ecosystem.
---
Identity-aware defaults (the moat)
Zero competitors ship any of these.
1. Don't-record-when-home mode
Inherited from WanderGuard. When WanderBand or a trusted phone/tag is detected at home (via BLE / Thread presence / optional UWB), cameras automatically pause recording (configurable: indoor-only, outdoor-only, all cameras, or per-camera policy).
- For LGBTQ+ / trans households: means the cameras don't log you being home in a way family/guests/landlord/ICE can later demand.
- For DV survivors: configurable so an abusive partner's retained access doesn't record your movements.
- For neurodivergent / mental health: stimming, meltdowns, post-work decompression aren't forever-logged.
Radar presence still triggers motion events to the log (so the tamper-detection "did someone come in?" still works); the footage is what doesn't get kept.
2. Duress unlock code (WanderLock — unique to WanderVerse)
The feature no major lock vendor ships.
User sets:
- Primary unlock code — works normally.
- Duress code (different 4–8 digits) — unlocks normally AND:
- Sends silent emergency alert to WanderGuard → user's phone + designated trusted contacts
- Triggers WanderGuard emergency revocation (all shared accounts revoked, audit log generated)
- Activates camera priority recording (+30s pre-roll from buffer, 15 min post-event retention even if normally loop-erased)
- Optionally notifies HAVEN coordinator via LoRa (if subscribed)
- Optionally pings user's Inner Circle (WanderTogether Ring 1)
- Under-duress marker in audit log for legal admissibility
Threat model: abusive partner demands the user let them in; being forced to unlock at knifepoint / held at door / etc. The code is something the user types; the attacker thinks access is granted; the user has silently summoned help without escalating the immediate confrontation.
3. Covert-mode WanderBell (unique)
The Bell's built-in 2.4" display (Pro tier only) shows a different greeting based on who's at the door + who's home:
- Default: standard ring + generic chime
- Presence-aware greeting: "Hi, Shen is at the door" (if Shen's phone is recognized AND the user is home)
- Covert mode: displays different greeting text / fake vacation message / "we're out of town until Friday" based on scheduled rules
- Under-siege mode: triggered by user's silent panic → Bell displays "Nobody home, police have been called" message to deter would-be intruder while WanderGuard escalates alerts silently
All greetings edited by user, local-only. No cloud required.
4. No facial recognition by default
- FR is opt-in per household (not per-device default)
- When opted in, runs only locally via Frigate + CompreFace on the WanderNode Hub — never transmitted
- Setup flow includes the full NIST FRVT / MIT Gender Shades bias disclosure (inherited verbatim from
WANDERGUARD-BUILD-SPEC.md §2)
- FR can be limited to "known-trusted-faces only" mode (additive safelist) vs "identify-everyone" mode (never enabled by default)
5. Architecturally absent law-enforcement portal
- No police portal
- No "Ring Neighbors"-class public forum
- Footage export is user-initiated only via WireGuard-authenticated app action
- ICE / CBP are explicitly in our Standard 11 no-sell list
- LEO warrant service goes through user's lawyer, not through a vendor portal
6. Trans/survivor-aware defaults at setup
- Setup flow asks "Are you setting up after leaving a difficult situation?" — triggers DV Survivor Setup Mode (inherited from WanderGuard §5):
- Single-owner account (no "add household member" prompt)
- Duress code required before completing lock setup
- Audit logging at max retention
- Emergency revocation shortcut prominent on home screen
- HAVEN integration suggested if user has Inner Circle
---
Architecture
┌──────────────────────────────────────────────────────────────────────┐
│ WANDERNODE HUB │
│ WanderOS + Frigate NVR + Matter Controller + Z-Wave + Thread Border │
│ + WireGuard Server + Audit Log + WanderGuard alert engine │
│ + WanderStore runtime (for community models/chimes/glyphs) │
└──────────────────────────────────────────────────────────────────────┘
│ │ │ (Matter/Thread local mesh) │
│ │ │ │
PoE ▼ ▼ ▼ PoE (802.3at/bt) ▼
┌──────────────┐ ┌────────────┐ ┌─────────────┐ ┌────────────────┐
│ WanderCam │ │ WanderCam │ │ WanderBell │ │ WanderLock │
│ Indoor/Out/ │ │ Pro │ │ │ │ Std/Bio │
│ Pro/Batt │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
│ Sony IMX │ │ + 24 GHz │ │ + NFC │ │ Matter+Thread │
│ ESP32-S3 or │ │ radar │ │ + 24 GHz │ │ + Z-Wave 800 │
│ RK3566 │ │ + LED │ │ radar │ │ + BLE │
│ │ │ spot │ │ + 2-way │ │ + keypad │
│ │ │ + 2-way │ │ audio │ │ + fingerprint │
│ │ │ audio │ │ + 2.4" disp │ │ (Bio) │
└──────┬───────┘ └─────┬──────┘ └──────┬──────┘ └────────┬───────┘
│ RTSP/ONVIF │ │ │
▼ ▼ ▼ ▼
(footage to Frigate on Hub) (chime/display (unlock events,
local; NFC duress marker,
forwards to Hub) audit log)
Power:
- WanderBridge PoE-out ports feed Cam + Bell (802.3at Type 2 for Cam Pro, 802.3af for others, 802.3bt Type 3 reserved for future higher-power models).
- WanderLock: 4× AA alkaline OR 12V DC wired (if integrated into security system with wiring). Battery life 9–12 months AA typical.
- WanderCam Battery: 14.4V 5000 mAh 18650 pack (4× cells) + optional 6W solar panel (add-on). 90–120 days between charges typical, indefinite with solar in sunny climates.
Connectivity:
- Cam (wired PoE): Ethernet 100-BASE-TX back to Hub; ONVIF + RTSP.
- Cam (battery): WiFi 6 (2.4/5 GHz) back to Hub; WiFi-only Cameras still send raw frames not cloud clips.
- Bell: PoE primary, WiFi 6 fallback if buyer runs a PoE injector instead of a full WanderBridge.
- Lock: Matter-over-Thread primary, Z-Wave 800 secondary, BLE for direct phone setup. No WiFi on the lock (battery life).
Local processing:
- Cam Indoor/Outdoor: ESP32-S3 handles encoding + motion-zone pre-filter; heavy detection runs on the Hub.
- Cam Pro: RK3566 with integrated NPU (1 TOPS) runs first-pass person/vehicle/package detection ON-camera before streaming only detected events to Hub (saves Hub load). Still dual-streams full RTSP for Frigate audit.
- Bell: ESP32-S3 handles UI + chime + NFC + radar-gated motion trigger; video streamed raw to Hub.
- Lock: ESP32-C6 (Matter + Thread radio integrated) handles unlock logic + keypad + fingerprint; audit pushed to Hub on every event.
---
Per-product detail
WanderCam
What it is: Privacy-first IP security camera. PoE primary. Indoor / Outdoor / Pro / Battery variants.
SKU table
| Variant | Device ID | Sensor | Resolution | Power | Housing | Radar | LED spot | Audio | Price |
|---|
| Indoor | `WV-SEC-CAM-IN` | Sony IMX415 | 2K @ 30fps | PoE 802.3af + WiFi 6 fallback | ABS indoor | — | — | opt-in mic | $129 |
| Outdoor | `WV-SEC-CAM-OUT` | Sony IMX678 | 4K @ 15 / 2K @ 30fps | PoE 802.3at | IP65 ABS + UV | — | — | opt-in mic | $179 |
| Pro | `WV-SEC-CAM-PRO` | Sony IMX678 + Bosch HDR IP | 4K @ 15 / 4K HDR | PoE 802.3at | IP65 ABS + UV | 24 GHz BGT24LTR11 | 1200 lm dimmable | stereo mic + speaker | $279 |
| Battery | `WV-SEC-CAM-BATT` | Sony IMX415 | 2K @ 15 (power-optimized) | 4× 18650 + opt solar 6W | IP65 ABS + UV | — | — | opt-in mic | $199 |
Anti-audience: if you want facial recognition tied to a cloud service or 1080p sub-$40 cameras, don't buy this.
Platform
- MCU: ESP32-S3-WROOM-1U 16MB flash (Indoor/Outdoor/Battery); Rockchip RK3566 quad A55 @ 1.8 GHz with Mali-G52 GPU + 1 TOPS NPU (Pro).
- RAM: 8MB PSRAM on ESP32; 4GB LPDDR4 on RK3566 Pro.
- Storage: microSD slot (all tiers) up to 512GB; internal 64GB eMMC on Pro only.
- Sensor: Sony IMX415 (Indoor/Battery — 2K low-light), Sony IMX678 8.3MP (Outdoor/Pro — 4K + low-light), with Bosch ISP/HDR on Pro.
- Lens: 2.8mm f/1.6 (110° diagonal, low-distortion; Indoor/Battery), 4mm f/1.6 (90° narrower for driveway/gate — Outdoor standard), optional 2.8mm for Outdoor.
- Night vision: 940nm IR LEDs (invisible to humans) × 8 for 25m range; Pro adds white-light LED spot (1200 lumen dimmable, manual + radar-triggered).
- Radar (Pro): Infineon BGT24LTR11 24 GHz presence radar — discriminates human vs animal vs blowing-branches, works in rain/snow/fog where PIR fails.
- Audio (Pro): 2× Knowles SPH0645LM4H MEMS mic array + 3W speaker for 2-way talk. Indoor/Outdoor mic is an opt-in module per privacy-by-default posture.
- Connectivity: 100-BASE-TX Ethernet (PoE-in) + 802.11ax WiFi 6 (2.4/5 GHz) + BLE 5.4 for phone setup.
- Mount: standard 1/4"-20 UNC tripod thread + 4-point VESA-M screw pattern. Ball joint for aim.
Repair / DIY
- User-swappable lens module (Pro only — M12 mount bayonet)
- User-swappable microSD
- User-replaceable 18650 cells on Battery variant (T10 Torx service panel; single-cell replacement possible)
- User-printable decorative cover (open STL files — CC BY-SA for Standard cover, CC BY-NC for Pro shroud)
- Ambassador service for sensor swap / PCBA replacement
- Framework-Laptop-level ifixit target: ≥8/10
Compliance
- FCC Part 15 B (unintentional) + Part 15 C (WiFi/BLE/radar modular passthrough)
- CE RED + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH
- State-specific privacy: audio default-OFF in MD, CA, FL, IL, MA, MI, MT, NH, PA, WA; setup flow surfaces region-aware warning
- UL 60950 / UL 62368 (electrical safety)
- No UL 294 required (that's the Bell)
---
WanderBell
What it is: PoE-in (or battery-backed) smart doorbell. NFC + radar + 2-way audio + 2.4" visible display (Pro) for covert-mode greetings.
SKU table
| Variant | Device ID | Resolution | Display | NFC | Radar | Audio | Power | Price |
|---|
| Standard | `WV-SEC-BELL-STD` | 1080p @ 30fps | — | — | 24 GHz BGT24LTR11 | 2-way 2× mic + 2W speaker | PoE 802.3af + battery 1000mAh backup | $199 |
| Pro | `WV-SEC-BELL-PRO` | 4K @ 15 / 2K @ 30 | 2.4" 320×240 LCD | PN7462 | 24 GHz BGT24LTR11 + 60 GHz BGT60TR13C gesture | stereo 2-way + 3W | PoE 802.3at + battery 1500mAh backup | $279 |
Key design decisions
- Radar-gated motion: doorbell cameras that fire on every breeze or passing car are the single biggest consumer complaint (Ring / Nest / Amazon all have this problem). BGT24LTR11 discriminates human presence; eliminates 90%+ of false triggers.
- NFC reader at door (Pro): lets a WanderBand or phone tap to send "I'm here + I'm trusted" intent to WanderGuard. The Bell does NOT unlock the door itself — it forwards the intent to WanderLock via Matter, and WanderLock makes the decision based on its own authorization table. Two-stage architecture prevents Bell compromise from unlocking door.
- Direct 2-way audio via WireGuard, not TURN: the single biggest Ring privacy failure was cloud-TURN routed 2-way audio going through Amazon servers. WanderBell's 2-way audio connects phone-to-doorbell via WireGuard directly. Audio never touches a WanderVerse server.
- Local 2.4" display (Pro): displays the presence-aware / covert-mode greeting. The unique identity-aware feature.
- Battery backup on both tiers: if PoE fails (power cut, cable cut), 1000–1500 mAh LiPo keeps Bell working for 48–72 hours. Alert to user when PoE drops.
Platform
- MCU: ESP32-S3-WROOM-1U (Std); ESP32-P4 + co-MCU for Pro (4K + display + radar load).
- Storage: microSD (both tiers) + 32GB internal eMMC (Pro only).
- Sensor: Sony IMX385 (Std — 1080p low-light specialist), Sony IMX678 (Pro — 4K + HDR).
- Lens: 1.8mm f/2.0 (165° fisheye for head-to-toe view at door distance).
- Audio: 2× Knowles SPH0645LM4H MEMS mics with beamforming; 2–3W speaker behind acoustic mesh.
- Radar: Infineon BGT24LTR11 at 24 GHz (Std + Pro); + BGT60TR13C 60 GHz for gesture-recognition on Pro (wave to trigger a specific greeting mode).
- NFC (Pro): NXP PN7462AU reader IC with printed-coil antenna around faceplate.
- Display (Pro): 2.4" 320×240 transflective LCD (visible in daylight + backlit for night); not AMOLED because doorbell displays need to be visible in direct sunlight.
- Chime: wired + wireless:
- Wired: mechanical-relay contact for existing doorbell transformer (8–24V AC, compatible with 90%+ US installations)
- Wireless: 433 MHz signal to WanderChime (stocking unit; $29 extra)
- Via Hub: triggers WanderSpeaker / WanderDash / any connected WanderOS device
- Enclosure: IP65 ABS/polycarb with UV-stable white/black/bronze/graphite options; tamper switch (alerts if Bell is pried off).
- Cover plate: open STL — community can print custom plates; Ambassador Lux tier hand-paints/glyphs.
Compliance
- FCC Part 15 B + C (WiFi, radar, NFC)
- CE RED + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH
- UL 294 (access-control system — required because Bell integrates with lock via Matter intent forwarding) — ~$5-10k cert
- State-specific video-doorbell privacy: audio default-ON (US norm for doorbells; dedicated outdoor-facing direction + user-visible ring indicator) but regional customization in setup
- IP65 rating certified
---
WanderLock
What it is: Matter-over-Thread smart deadbolt with duress code as first-class feature.
SKU table
| Variant | Device ID | Protocol | Keypad | Biometric | Duress | Audit log | Price |
|---|
| Standard | `WV-SEC-LOCK-STD` | Matter-over-Thread + Z-Wave 800 + BLE | ✅ backlit 4×3 | — | ✅ | ✅ | $149 |
| Biometric | `WV-SEC-LOCK-BIO` | Matter + Thread + Z-Wave 800 + BLE + NFC | ✅ backlit + haptic | ✅ capacitive fingerprint | ✅ | ✅ | $229 |
Key design decisions
- Matter-over-Thread primary (per 2026+ industry direction): universal interop with Apple Home, Google Home, Alexa, SmartThings, HA. Thread mesh means the lock stays reachable even if WiFi drops.
- Z-Wave 800 Series backup for households with existing Z-Wave meshes (important for the "upgrade one thing at a time" user path).
- BLE auxiliary for direct phone setup and NFC-gated tap-to-unlock (phone + WanderBand).
- No Bluetooth-as-primary-unlock: BLE relay attacks remain a real vulnerability in the August / TTLock class of locks. BLE on WanderLock is pairing-only; unlock requires cryptographic challenge over Matter/Thread.
- Duress code: absolutely unique in the market as a first-class feature with audit-log marker. See §Identity-aware §2.
- Keypad: backlit 4×3 capacitive touch + haptic feedback; up to 100 codes; time-limited codes auto-expire.
- Fingerprint (Biometric): capacitive (more secure than optical) sensor (Goodix GM165-class). Bias disclosure: fingerprint sensors have documented lower acceptance rates for thin/dry/aged fingers + certain skin types; user flow offers backup code always; user can disable biometric entirely without losing other features.
- Emergency override: physical key bypass (standard euro-profile or KW1 keyway options) + battery-dead passcode (special sequence on keypad with 3× AAA emergency power) — nobody is ever locked out.
- Audit log: every unlock event — code ID, timestamp, duress flag, entry direction — written to internal FRAM + pushed to Hub. Retained locally 90 days + Hub-pushed immediately.
- Works with existing deadbolts OR WanderLock dedicated mechanism: same product can be installed as "replace your existing deadbolt entirely" or "keep your existing deadbolt and put WanderLock on the interior side, turning the existing thumb-turn." Smaller upgrade friction.
Platform
- MCU: Espressif ESP32-C6 (RISC-V, Wi-Fi 6 + BLE 5 + 802.15.4 Thread radio all on-chip — but WiFi disabled for battery; only BLE + Thread + Z-Wave used).
- Z-Wave 800: Silicon Labs ZG23 as secondary radio module.
- Secure Element: NXP SE051 for Matter credential storage + fingerprint template storage (if Bio tier).
- Fingerprint (Bio only): Goodix GM165 capacitive sensor with on-chip template matching (templates never leave the sensor); max 100 fingers, match time <0.5s.
- FRAM: 256 KB Fujitsu FRAM for audit log (survives battery pull).
- Motor: brushless torque motor — 4.5 N·m at deadbolt spindle; low-noise <40 dB at unlock.
- Keypad: 4×3 capacitive touch PCBA + 12× white LED backlight + TI DRV2605 haptic driver with LRA.
- Power: 4× AA alkaline OR 12V DC wired-in (for always-on security-system integration).
- Lifetime: 9–12 months AA typical (normal residential use); low-battery alert at 20% / 10% / emergency mode at 3%.
- Bypass: physical key (KW1/SC1 cylinder + customer can re-key) + emergency-passcode-on-AAA-power.
Compliance
- UL 437 (security residential deadbolt — anti-drill, anti-pick, anti-pick-gun rated; expensive but the real differentiator vs August/Level/Yale which have NOT done UL 437 — they did lesser grade tests)
- ANSI/BHMA Grade 1 (cycle-tested to 250,000 unlock cycles + forced-entry testing) — Standard target; Biometric = same Grade 1 rating
- Matter certification via Connectivity Standards Alliance
- Z-Wave certification via Z-Wave Alliance
- FCC Part 15 B + C (BLE + Thread + Z-Wave modular passthrough)
- CE RED + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH
- EN 14846 (European locking mechanical security) for EU market
- IP54 (splash-resistant outdoor-rated — meaningful for front-door deployment)
---
WanderStore integration (all three)
Per ../_LAG-CLOSING-AND-MOVEMENT-STRATEGY.md §WanderStore, each product has a community-extension vector:
- WanderCam: community-submitted detection models (Frigate-compatible YOLO variants — e.g., specialized models for package/dog/Amazon-uniform). Community-vetted, Ambassador-packaged, fee split per WanderStore rules.
- WanderBell: community-submitted chimes (audio files + text-greeting templates + covert-mode rule sets) — lets the doorbell say "bienvenido a casa" or ring with a custom song the owner's Ambassador designed.
- WanderLock: community-submitted cover plates + glyphs (STL + CAD files; Ambassador-printed or Ambassador-etched) — lets users personalize the front of the lock.
All community submissions go through a safety-review pipeline (no malicious detection payloads, no chime that masquerades as a WanderVerse alert tone, no cover plate that interferes with keypad/NFC operation). Revenue splits per the 60/30/10 WanderVerse Community Pool model.
---
Feature matrix (vs Ring / Nest / Arlo / August / Schlage / Yale)
See _COMPETITIVE-AUDIT-2026-04-24.md for the full 11-4-6 scorecard.
Headline leads:
1. No vendor cloud required — every competitor locks footage/event history behind a subscription. 2. No police portal (architecturally absent, not a setting). 3. Duress code first-class (nobody else). 4. Don't-record-when-home mode (nobody else). 5. Covert Bell greetings (nobody else). 6. Local Frigate detection (nobody else as default). 7. User-replaceable cells / user-accessible service panel / user-swappable cover (Framework-Laptop repair parity). 8. 7-year spare parts guarantee. 9. Matter-over-Thread primary lock (Yale/Schlage have Matter add-ons but still ship Z-Wave or Zigbee primary). 10. Ambassador-assembled + social-impact employment. 11. Abuser revocation with audit log — inherited from WanderGuard; unique to WanderVerse.
---
Ambassador-assembly workflow
- Cam Indoor: 15 min typical Ambassador assembly (lens alignment + PCBA seat + enclosure seal + pressure test).
- Cam Outdoor: 22 min (+ gasket + UV-spec verify + IP65 pressure test).
- Cam Pro: 32 min (adds radar alignment + LED light calibration + HDR ISP cal).
- Cam Battery: 28 min (adds 4× 18650 insertion + seal + solar-port test).
- Bell Std: 25 min.
- Bell Pro: 38 min (adds display alignment + NFC coil + gesture radar).
- Lock Std: 20 min (motor alignment + keypad cal + Matter provisioning).
- Lock Bio: 28 min (adds fingerprint sensor cal + template-sensor burn-in).
Per-unit Ambassador Signature Build Mark (Standard 1):
- Cam: interior PCBA signed + QR card inside service panel
- Bell: inside faceplate behind cover
- Lock: inside battery compartment
Lux Ambassador Artisan options (Pro tiers only):
- Hand-painted cover plates
- Etched anodized front plate
- Hand-designed glyph plates
---
Ship timeline
| Tier | EVT | DVT | PVT / first customer ship |
|---|
| WanderCam Indoor + Outdoor | 2026-Q4 | 2027-Q1 | **2027-Q2** |
| WanderCam Pro + Battery | 2027-Q1 | 2027-Q2 | **2027-Q3** |
| WanderBell Standard | 2026-Q4 | 2027-Q1 | **2027-Q2** |
| WanderBell Pro | 2027-Q2 | 2027-Q3 | **2027-Q3** |
| WanderLock Standard | 2027-Q1 | 2027-Q2 | **2027-Q3** |
| WanderLock Biometric | 2027-Q2 | 2027-Q3 | **2027-Q3** |
---
Budgets (engineering, cert, tooling)
| Line item | Cost |
|---|
| Engineering NRE (EE + FW + ID × 3 products, 12 months shared team) | $900k–1.3M |
| Chassis tooling (injection molds for 7 form factors — Cam × 4, Bell × 1 shared with 2 caps, Lock × 1 shared with 2 escutcheon styles) | $150–240k |
| PCB + SMT setup | $80–140k |
| Compliance + cert (family-wide v1.0) | $85–130k |
| UL 437 + BHMA + EN 14846 for Lock (extra) | $25–40k |
| Ambassador training curriculum + stations (5 initial stations) | $40–60k |
| Companion app NRE (iOS + Android + web + SDK — shared with WanderGuard team already budgeted) | amortized |
| **Total family launch NRE** | **$1.3–1.9M** |
Funded via LLC revenue (hardware margin funds engineering); Community Pool 30% unaffected.
---
Open items → implementation phase
| # | Item | Severity | Owner | Deadline |
|---|
| 1 | Contract manufacturer selection (PoE + outdoor-rated camera SMT) | 🔴 | Michael + ops | 2026-Q3 |
| 2 | Sony IMX sensor FAE relationship + NDA | 🟡 | engineering hire | 2026-Q4 |
| 3 | Bosch ISP (Pro camera HDR) FAE + licensing | 🟡 | engineering hire | 2026-Q4 |
| 4 | Rockchip RK3566 reference-design license + board-support | 🟡 | engineering hire | 2027-Q1 |
| 5 | UL 437 certification lab (Intertek / UL / TUV) engagement | 🟡 | cert team | 2027-Q2 |
| 6 | Matter-over-Thread certification (CSA membership + test-fixture) | 🟡 | firmware | 2027-Q1 |
| 7 | Ambassador training curriculum (add Cam/Bell/Lock to existing WanderBand curriculum) | 🟡 | WWP ops | 2027-Q1 |
| 8 | Engineering team hire (same EE/FW/ID as WanderRouter + WanderBand shared pool) | 🔴 | Michael | NOW — 2026-Q3 start |
| 9 | Frigate upstream contribution (donate back any ESP32-S3 on-camera pre-filter improvements) | 🟢 | firmware team | post-ship |
| 10 | WanderStore safety-review pipeline for detection-model submissions | 🟡 | WanderStore team | 2027-Q3 pre-launch |
---
Conflict register (vs existing specs)
| Conflict | Resolution |
|---|
| `WANDERGUARD-BUILD-SPEC.md` says WanderLock primary is **Z-Wave 700** | This spec upgrades to **Matter-over-Thread primary with Z-Wave 800 secondary**. Matter is 2025+ industry direction; Z-Wave is retained (not dropped) for existing-mesh households. Logged in `DECISIONS.md` D-SEC-001. |
| `WANDERGUARD-BUILD-SPEC.md` pricing: Cam Outdoor $149 / Indoor $99 / Bell $129 / Lock $199 | This spec: Cam Indoor $129 / Outdoor $179 / Pro $279 / Battery $199 / Bell Std $199 / Bell Pro $279 / Lock Std $149 / Lock Bio $229. Updated pricing reflects 2027 ship date + upgraded feature set (4K, radar, NFC, duress code, fingerprint, UL 437). Total Full Kit similar ($799 vs $499 earlier — reflects added Pro tier and 2 outdoor cameras). Logged D-SEC-002. |
| `WANDERGUARD-BUILD-SPEC.md` omits cameras having on-device NPU | Pro camera adds RK3566 with 1 TOPS NPU for on-camera pre-filter. Doesn't break WanderGuard's Hub-Frigate architecture — on-camera pre-filter REDUCES Hub load while Hub still gets raw RTSP for audit. Logged D-SEC-003. |
| `WANDERGUARD-BUILD-SPEC.md` says "no facial recognition by default" on Cam | Retained verbatim. Bias disclosure flow inherited. |
| `WANDERGUARD-BUILD-SPEC.md` Bell says "no cloud intercom"; 2-way audio via WireGuard | Retained verbatim. Extended with: Bell Pro direct-to-phone WireGuard for 2-way (not TURN). |
No software conflicts — this spec is strictly the hardware layer; WanderGuard software sections remain canonical.
---
HAVEN variants
All three products ship *-HAVEN variants for safehouse / hostile-jurisdiction deployment:
- WanderCam HAVEN — tamper alarm + covert-mode LED indicators (no visible power LED by default) + LoRa emergency fallback when internet down
- WanderBell HAVEN — LoRa fallback alerts to HAVEN coordinator; no external manufacturer branding (generic enclosure); under-siege mode greeting
- WanderLock HAVEN — extra audit log retention + duress code triggers LoRa mesh alert to coordinator + tamper detection on lock body
HAVEN variants cost +$40–60 per product (hardware add-on for LoRa Heltec node + extra tamper sensors + HAVEN-specific branding-free shell).
---
Bottom line
Three products. One family spec. One Ambassador program. One Community Pool. Three hardware BOMs that share 60% of components. Dual-mode support in every product. No cloud lock-in. No police portal. No subscription. Duress code + don't-record-when-home + covert greeting + abuser revocation — all features nobody else ships.
Feeding into the already-specified WanderGuard software stack, not duplicating it. Every line of Frigate integration, abuser revocation, HAVEN bridge, and alert routing is inherited from WANDERGUARD-BUILD-SPEC.md and stays canonical there.
Ready for engineering hire + BOM sourcing + Stage 4 RFQs.