WanderSecurity Trio — Decision Log

Running log of every keep/swap/drop decision across Cam + Bell + Lock. Citations per entry.

---

Stage 0 — Feature-parity sweep (2026-04-24)

Decision: 3-product family (Cam + Bell + Lock) with 8 SKUs + 3 HAVEN variants + 2 bundles. Shared platform (WanderOS-Security firmware, WanderGuard integration, Ambassador-assembly, 7-year parts, open STLs).
Source: competitive audit vs Ring/Nest/Arlo/Eufy/Unifi/Amcrest/Reolink/Wyze (cameras); Ring/Nest/Arlo/Eufy/Aqara/Reolink/Unifi (doorbells); August/Schlage/Yale/Level/Lockly/Ultraloq/Kwikset/Aqara (locks).
Outcome: 11 LEADS / 4 MATCHES / 6 LAGS (per _COMPETITIVE-AUDIT-2026-04-24.md). 4 of 6 LAGS are business-model positioning choices (price, retail channel, pro-install network, face-rec-on-lock), not capability gaps.

---

Stage 1 — Intake + freeze (2026-04-24)

Device IDs assigned across 8 base SKUs + 3 HAVEN + 2 bundles (see _MANIFEST.md).
Revision frozen at v1.0-candidate.
Ship target locked: Cam Indoor/Outdoor + Bell Std 2027-Q2; Cam Pro/Battery + Bell Pro + Lock both 2027-Q3; HAVEN 2027-Q4.
Entity: Eisinger Holdings LLC (hardware margin); feeds 60/30/10 Community Pool per canonical split.

---

D-SEC-001 — Lock protocol: Matter-over-Thread primary, Z-Wave 800 secondary (supersedes Z-Wave 700 primary in `WANDERGUARD-BUILD-SPEC.md`)

Context: WanderGuard v1.0 (April 2026) specified Z-Wave 700 primary for WanderLock.
Decision 2026-04-24: Matter-over-Thread is now the industry direction (CSA + Apple + Google + Samsung + SmartThings + Home Assistant committed); by our 2027-Q3 ship, Matter is mature. Z-Wave 800 Series (Silicon Labs ZG23) retained as secondary radio for backward compatibility with existing Z-Wave mesh households.
Rationale: Matter-over-Thread = universal protocol + mesh resilience + no WiFi-dependence + open standard; retains Z-Wave 800 for the "I already have 23 Z-Wave sensors" user.
Cost impact: add ~$4 BOM (ZG23 module) but eliminates USB Z-Wave stick dependency on Hub side.
Conflict resolution: WanderGuard software still works unchanged — software just sees the lock via Matter events instead of Z-Wave events.

---

D-SEC-002 — Pricing reset (supersedes WANDERGUARD v1.0 pricing)

Context: WANDERGUARD-BUILD-SPEC.md priced Cam Outdoor $149, Cam Indoor $99, Bell $129, Lock $199, Starter Kit $299, Full Kit $499.
Decision 2026-04-24: Updated pricing reflects 2027 ship date + full feature set:
Cam Indoor $129 (2K instead of sketch's 4MP/2K, upgraded to Sony IMX415 w/ ESP32-S3)
Cam Outdoor $179 (4K upgrade vs sketch's 2K)
Cam Pro $279 (adds 24 GHz radar + LED spot + audio + RK3566 NPU)
Cam Battery $199 (adds solar-panel option + 18650 pack)
Bell Std $199 (radar + PoE + battery backup)
Bell Pro $279 (4K + NFC + 2.4" display + gesture radar)
Lock Std $149 (Matter-over-Thread + duress + audit)
Lock Bio $229 (+ fingerprint + NFC)
Trio Starter $449 / Trio Full $799
Rationale: added features justify price; margins hold at 42–56% (Pro tier healthier to fund R&D + 60/30/10 split).
Mission-partner pricing: all SKUs available at-cost to WWP partner organizations + DV shelters per WANDERGUARD-BUILD-SPEC.md precedent.

---

D-SEC-003 — Cam Pro adds on-device NPU (RK3566)

Context: WANDERGUARD-BUILD-SPEC.md assumed all detection on Hub Frigate + optional Coral USB TPU.
Decision: Pro camera upgrades MCU from ESP32-S3 to Rockchip RK3566 with integrated 1 TOPS NPU.
Rationale:
On-camera pre-filter (quick "is this a human?" check) reduces Hub bandwidth + compute load ~70% for a 4-camera deployment.
Hub Frigate still gets raw RTSP for audit and deeper detection (doesn't break WanderGuard software contract).
RK3566 costs +$8 BOM but is the industry norm for 4K+HDR+NPU cameras (Reolink / Unifi G5 Pro use similar silicon).
Alternative considered: ESP32-P4 (under-powered for 4K HDR); Ambarella CV5 (expensive + proprietary toolchain + under-supported by Frigate).

---

Stage 2 — Component selection (2026-04-24)

Camera silicon

Indoor / Outdoor / Battery MCU: ESP32-S3-WROOM-1U 16MB (commodity, well-supported by Frigate via RTSP; $4.50 BOM)
Pro SoC: Rockchip RK3566 quad A55 + 1 TOPS NPU + Mali-G52 (Linux BSP mature; $12 BOM; 4K HDR capable)
Image sensor Indoor/Battery: Sony IMX415 (2K low-light specialist; $6 BOM)
Image sensor Outdoor/Pro: Sony IMX678 (4K 8.3MP low-light; $18 BOM)
ISP for Pro HDR: Bosch integrated ISP pipeline (licensing + tuning dep); alt = RK3566 built-in ISP (no license, weaker HDR)

Bell silicon

Standard MCU: ESP32-S3-WROOM-1U
Pro MCU: ESP32-P4 (new ESP platform, 4K H.265 encode at < 5W) + co-MCU ESP32-C6 for Thread/NFC
Image sensor Standard: Sony IMX385 (1080p low-light)
Image sensor Pro: Sony IMX678 (4K)
Radar (both tiers): Infineon BGT24LTR11 (24 GHz, $8 BOM)
Gesture radar Pro only: Infineon BGT60TR13C (60 GHz, $18 BOM — shared part with WanderBand Ultra)
NFC (Pro only): NXP PN7462 + printed coil

Lock silicon

MCU: Espressif ESP32-C6 (RISC-V + WiFi6 + BLE5 + 802.15.4 Thread all on-chip; WiFi disabled for battery; $3 BOM)
Z-Wave 800 secondary: Silicon Labs ZG23 (module-level, ~$4 BOM, catalog-available)
Secure Element: NXP SE051 (shared with WanderBand — reuse FAE relationship)
Fingerprint (Bio only): Goodix GM165 capacitive with on-chip template matching ($7 BOM)
FRAM for audit log: Fujitsu MB85RS256B 256 KB ($2 BOM; survives battery pull)
Motor: brushless DC torque motor 4.5 N·m; custom-spec from multiple Chinese motor suppliers

Shared components (Standard 6a — cross-product BOM sharing)

ESP32-S3-WROOM-1U shared across Cam Indoor/Outdoor/Battery + Bell Standard → single SKU, single distribution channel, single FAE line
BGT24LTR11 24 GHz radar shared across Cam Pro + Bell Standard + Bell Pro → single FAE line
NXP SE051 Secure Element shared with WanderBand Standard+ → already-established relationship
BGT60TR13C 60 GHz radar shared with WanderBand Ultra → already-established FAE line
TI BQ25180 battery charger shared with WanderBand + Cam Battery + Bell Pro → already-established
TVS diodes (TPD3E001, TPD6S300) family-wide shared

---

Stage 2b — Configurator axes (2026-04-24)

Each product has a discrete configurator axis set. See CONFIGURATOR.md:

Cam: housing variant · sensor (2K / 4K) · mount (VESA / tripod / pole) · power (PoE / battery) · radar add (Pro) · LED spotlight (Pro) · audio module opt-in · HAVEN variant · color · Ambassador signature · WanderAssist subscription
Bell: tier (Std / Pro) · chime style · faceplate color/finish · display greeting templates (Pro) · HAVEN variant · Ambassador signature
Lock: tier (Std / Bio) · keyway (KW1 / SC1 / no-key / euro) · finish (satin-nickel / matte-black / bronze / brass / stainless) · escutcheon style · lock body style (dedicated deadbolt / existing-deadbolt-adapter) · fingerprint capacity (Bio: 5 / 20 / 100 fingers)

---

Stage 3 — Compatibility review (2026-04-24)

Resolved:

ESP32-S3 + Sony IMX over MIPI-CSI → standard; Espressif ref designs exist for IMX415
RK3566 + IMX678 + Bosch ISP → verified by Rockchip ref + Reolink's production use (similar silicon stack)
Matter-over-Thread + Z-Wave coexistence on lock: 2.4 GHz Thread + 908.42 MHz Z-Wave are in different bands, no contention
BLE 5.4 coexistence on lock (on same ESP32-C6 radio): Thread and BLE time-share on 802.15.4 PHY; firmware handles
PoE 802.3at (25.5W budget) adequate for all Cam tiers including Pro (4K + radar + LED = 12W worst-case)
Mechanical fit: Cam Indoor < Wedge-S interior (generous); Cam Pro uses Soffit-L for LED spot + radar mount
Lock: standard deadbolt retrofit (US 2-3/8" or 2-3/4" backset) with modular front escutcheon + rear motor assembly

Deferred to Stage 5/6:

PCB impedance-controlled lanes for RK3566 DDR + MIPI-CSI
Antenna placement (Matter Thread 2.4 GHz + Z-Wave 908 MHz + BLE 2.4 GHz coexist on lock)
SAR (not applicable — none of these have cellular)
Fingerprint sensor EMI from motor activation (Bio lock)

---

Stage 4 — Sourcing (2026-04-24, framework only; RFQs pending engineering hire)

Same pattern as WanderBand:

Sony IMX sensors through DigiKey/Mouser + Sony FAE direct for volume pricing
Bosch ISP through Bosch direct (license required)
Rockchip RK3566 through distributors (Shenzhen supply chain) + FAE
Infineon radars — DigiKey/Mouser + FAE
Goodix GM165 fingerprint — direct only (Chinese specialty, NDA required)
Silicon Labs ZG23 — DigiKey/Mouser
Heltec LoRa32 v3 (HAVEN variants) — Heltec direct
All other commodity parts — DigiKey/Mouser/Arrow/Newark

See SOURCING.csv for per-part detail.

---

Stage 5 — DFM/DFA/DFT (2026-04-24)

7 unique PCBAs across the family (Cam Indoor/Outdoor share; Cam Pro + Cam Battery separate; Bell Std + Bell Pro separate; Lock Std + Lock Bio share with module differences)
Ambassador assembly times range 15–38 min per unit (see spec §Ambassador-assembly workflow)
19 production tests per unit (Cam), 16 per Bell, 14 per Lock
Per-unit provisioning: serial etch + NVMEM (MAC, Matter cert, Thread cred, Z-Wave ID)
DFT fixture cost: $15k Cam + $10k Bell + $8k Lock = $33k family-wide

---

Stage 6 — Thermal/EMC (2026-04-24)

Cam Pro: 8W worst case (RK3566 + LED spot + radar + encoding) — aluminum back plate heatsink; thermal envelope OK
Cam Indoor: 3.5W max; passive
Cam Battery: 2W active; passive
Bell Pro: 5W active (display + 4K encode); passive
Bell Std: 2W; passive
Lock: 1W peak (motor activation 5s burst at 8W); easily handled by AA pack
EMC: radio coexistence carefully planned (Matter 2.4 GHz + Z-Wave 908 MHz + BLE 2.4 GHz on lock; WiFi 6 + BLE on cameras)
ESD: Level 4 on all external (keypad, fingerprint, buttons, charging jacks, NFC reader, Ethernet)

---

Stage 7 — Compliance (2026-04-24)

Cam: FCC Part 15 B + C (WiFi + BLE + radar passthrough) + CE + UKCA + ISED + ACMA + Prop 65 + RoHS/REACH + UL 62368; state-specific audio default-OFF in 10 states
Bell: same + UL 294 (access-control integration; +$5-10k)
Lock: same + UL 437 (residential deadbolt anti-pick/drill/bump; +$15-25k) + ANSI BHMA Grade 1 (250k cycle test + forced-entry; +$8-15k) + EN 14846 EU market (+$5-10k) + Matter certification via CSA + Z-Wave Alliance cert
Total family v1.0 cert: $85–130k

---

Stage 8 — Canonical BOM + GUIDE + STLs (2026-04-24)

Platform + modules + full GUIDE per product
22 STL files (cam covers × 4, bell faceplates × 3, lock cover plates × 4, mounting hardware × 6, accessory prints × 5)
CC BY-SA 4.0 for Standard parts; CC BY-NC 4.0 for Pro cover references; Lux parts NOT published (Ambassador-made)
See BOM-platform.csv, BOM-modules.csv, GUIDE.md, STL-OPEN-FILES/README.md

---

Stage 9 — HW↔FW binding (2026-04-24)

All three products run WanderOS-Security on Zephyr RTOS 3.7+ (MIT-licensed overlay)
Single shared firmware codebase for Matter/Thread/BLE/WireGuard/audit-log primitives
Per-product modules for sensor-specific drivers (IMX415/IMX678/Bosch ISP; BGT24/60; Goodix fingerprint; ZG23 Z-Wave)
OTA update infrastructure shared with WanderBand (single update server + signed releases)
See HW-FW.md

---

Stage 10 — Gate review + service flow (2026-04-24)

EVT: 25 units per SKU minimum, 90% production-test yield required
DVT: 200-250 units per SKU, full cert runs, 95% yield
PVT: 500-1000 units per SKU (Pro-tier smaller runs), 98% yield
First-customer-ship timeline locked (see GATE.md)

---

Critical open items (revalidated)

Item	Severity	Action owner	Deadline
Engineering team hire (EE + FW + ID) shared pool with WanderRouter + WanderBand	🔴	Michael	NOW — 2026-Q3 start
Contract manufacturer for outdoor-rated camera SMT + lock mechanical + doorbell sheet-metal/plastic	🔴	Michael + ops	2026-Q3
Sony IMX FAE / NDA (IMX415 + IMX678 volume pricing)	🟡	engineering hire	2026-Q4
Bosch ISP license (Cam Pro HDR)	🟡	engineering hire	2026-Q4
Rockchip RK3566 BSP + NPU toolchain	🟡	engineering hire	2027-Q1
UL 437 cert lab engagement	🟡	cert team	2027-Q2
BHMA Grade 1 test fixture (250k unlock cycles)	🟡	Lock engineering	2027-Q1
Matter CSA membership + test-fixture access	🟡	firmware	2027-Q1
Goodix GM165 fingerprint FAE + NDA	🟡	engineering hire	2027-Q2
WanderStore safety-review pipeline (detection models)	🟡	WanderStore team	2027-Q3
Ambassador training curriculum extension	🟡	WWP ops	2027-Q1
Live KiCad + Flux.ai schematics for 7 unique PCBAs	🔴	engineering team	2027-Q1
State-specific privacy labeling + setup flow	🟢	firmware + packaging	2027-Q1

---

Non-goals (explicitly NOT shipping)

Face recognition on lock — not by design; face-rec-on-lock (Lockly Visage-style) creates bias risks we won't ship. User supplements with WanderBand NFC tap for additional factor if desired.
Cloud storage tier — never. All footage stays on Hub + user's chosen local NAS.
Neighbors-style public feed — never. WanderTogether Ring 2 community alerts are text-only + mutual-consent per WanderGuard spec.
Law-enforcement portal / API — architecturally absent. Standard 11.
Ring-compatibility — not a "works with Ring" claim. Ring is a specific architecture that we consider broken; we don't bridge to it.
Subscription for core features — never. Optional WanderAssist ($9/mo) is AI-management layer only; all security features work without subscription.

Why this way.