Risk Register
| ID | Sev | Risk | Prob | Impact | Mitigation | Status |
|---|---|---|---|---|---|---|
| RISK-001 | S0 | NAT throughput NFR of 10-15 Mbps is not achievable alongside the other workloads PRD NFR 7.1 demands 10-15 Mbps NAT throughput under good LTE signal. The A7670E is a Cat-1 bis LTE-FDD modem; its practical theoretical ceiling is roughly 10 Mbps down and it is rarely sustained in real networks. Adding | Almost certain | Critical | Measure early with a dedicated throughput harness before committing to the figure. Set a realistic target and renegotiate the NFR with the stakeholder. Do not build the whole product against an unvalidated number. | OPEN |
| RISK-002 | S0 | PPP data path over UART was unproven on this board PPP had never produced an IP on this device. The earlier attempt failed on a Jio SIM with +CGREG: 0,3, which is a registration symptom rather than a PPP one. TASK-020 retested on the Airtel SIM and has now closed the gap | Likely | If LCP/IPCP fails, REQ-004 NAT routing is not achievable and the product descopes or changes modem. Until it is demonstrated, treat NAT routing as unproven rather than assumed. | All three questions are now answered and the risk is closed as verified. RETIRED: 'PPP is unreachable because esp_modem's A7670 PPP path is USB-only' - the module accepts a PPP dial over UART and completes the handshake. | RETIRED |
| RISK-003 | S0 | Audio hardware presence and wiring are unconfirmed, blocking telephony and voice The PRD requires I2S MEMS microphone (INMP441), I2S DAC (MAX98357A) and full-duplex audio through the A7670E PCM channel. The Waveshare ESP32-S3-A7670E-4G board we actually have has not been shown to have these parts fit | Likely | Critical | Physically inspect the board and confirm whether an I2S mic and amp are populated. Run a loopback test (record from mic, play to DAC) before committing any voice tasks. Update the PRD's hardware table to match the real B | OPEN |
| RISK-004 | S2 | ESP-SR sub-800ms latency target is unvalidated and may be unreachable PRD NFR 7.2 requires wake-word and command recognition under 800 ms using ESP-SR WakeNet + MultiNet. This has never been measured on this board. ESP-SR on ESP32-S3 is plausible but the figure was asserted without a bench | Possible | Major | Benchmark ESP-SR latency as an isolated spike before building the contacts UI. Measure wake-word detection latency separately from command classification latency. | OPEN |
| RISK-005 | S1 | TLS on the cellular path is unverified, blocking the security NFR PRD NFR 4.4 mandates TLS 1.2/1.3 for all cloud connectivity. The working socket path today is plaintext AT+CIPOPEN to port 1883. AT+CSSLCFG, SNI and certificate installation have not been tested on firmware A011B04A7670M | Possible | Critical | Test AT+CSSLCFG with SNI against port 8883 as an early isolated experiment. A full MQTT-over-TLS handshake over a CIPSEND socket is more complex than the plaintext path and may justify using the TinyGSM A7672x client lib | OPEN |
| RISK-006 | S2 | SD card works under Arduino but is blocked under ESP-IDF The Arduino path writes, reads and deletes on a 3.98 GB FAT32 card with SD_MMC.setPins(5,4,6). nomad-sentinel/TASKS.md 1.7 records every card command failing with err=0x107 under ESP-IDF. GPIO46 is documented as not a us | Likely | Major | Diagnose the 0x107 difference. It may be a clock or pin-drive configuration issue, or the Arduino core may be masking a marginal socket. Logged as BUG-001. | OPEN |
| RISK-007 | S2 | Device runs seven FreeRTOS tasks plus NAT, video and DSP on two cores The PRD allocates 7 tasks across 2 cores with NAT forwarding, MJPEG encoding and speech DSP. Free heap on this class of device is 2.46 MB internal plus PSRAM, and NAT tables plus frame buffers plus ESP-SR models are all | Likely | Major | Enforce task stack sizing discipline, place NAT and modem on core 0, keep video and audio on core 1, and monitor free heap and minimum-ever-free-heap in the dashboard. Define a memory budget per subsystem before implemen | OPEN |
| RISK-008 | S1 | GitHub personal access token was shared in plaintext and remains valid A live ghp_ token with repo scope was pasted in plaintext in the session. The user elected to keep it valid. It has repo scope over the whole account, so a leak allows full repository write and read. It is not written to | Unlikely | Critical | Revoke and regenerate the token at https://github.com/settings/tokens. Prefer gh auth keyring or a fine-grained token scoped to this repository only. Never place it in .env committed to the repo. 2026-09-29 update: the t | ACCEPTED_BY_USER |
| RISK-009 | S3 | Cellular LBS accuracy is coarse and operator-dependent LBS returned 18.481703, 73.897415 with a 550 m accuracy radius. This is a fallback, not a tracking solution. It also depends on the carrier providing the location service and on the 4G patch antenna being physically atta | Possible | Minor | Always report accuracy and source. Warn in the dashboard when CSQ is low. Make antenna state an explicit documented precondition. | MITIGATED |
| RISK-010 | S3 | Public repository exposes hardware design and product roadmap The repository was made public on 2026-09-29 to enable GitHub Pages on the free plan. It now publishes the board pinout, the modem AT command bring-up notes, and the unbuilt product roadmap. | MEDIUM | A third party could learn the hardware design, the SIM/operator details and the feature plan before launch. | Real IMEI, phone numbers and broker credentials are redacted and enforced by secrets_scan.py. Board pinouts are public on the vendor's own documentation anyway. If the roadmap must stay confidential before launch, move d | ACCEPTED_BY_USER |
| RISK-011 | S2 | Vendored esp32_nat_router base has no declared upstream licence The product firmware base is vendored upstream source from martin-ger/esp32_nat_router 2.4.17 (commit 2fe7a4c). That repository ships no LICENSE file and the GitHub API reports license=null. Only the bundled WireGuard su | MEDIUM | Redistributing or selling firmware derived from an unlicensed source has no grant of rights. Every NomadLink feature added on top of this base is downstream of that ambiguity, and the web installer publishes the binary to the public internet. | Contact the upstream author and obtain an explicit licence in writing before any release (Rule 37 forbids calling anything a production release until this is settled). Treat the currently served binary as internal/review | OPEN |