Properties
title: Risks, Decisions, and Open Questions aliases: [Risk Register, ADRs] tags: [3netra/wiki, risks, adr] product: 3netra Meta Android App source_repository: 3Netra-ai/3n_meta_android source_ref: origin/prod source_revision: b48aada8fd5427b5db0c02945569963c4ae543c8 last_verified: 2026-08-06 up: "[[Home]]"
Risks, Decisions, and Open Questions
Risk register
| Severity | Risk | Impact | Recommended action |
|---|---|---|---|
| Critical | Random embeddings when FaceNet model load fails | False identification and unsafe trust | Fail closed; surface model error; add model integrity test |
| Critical | Active AI client replaces every successful Edge Function reply with fixed text | Core narration/chat/summary is non-functional or misleading | Decode and validate the response; add contract/UI tests before release |
| Critical | Cloud biometric storage conflicts with local/encrypted claims | Student privacy, legal, trust | Define one consented architecture; enforce encryption, RLS, deletion |
| Critical | Committed/app-compiled credential material and an unsafe provider boundary | Credential compromise and unauthorized provider use | Rotate/revoke; purge history where required; use managed server secrets only |
| Critical | SOS flow is represented but incomplete | Safety harm | Remove claim/entry point until end-to-end verified |
| High | Compose and Expo apps share package/build ownership | Wrong artifact, config/signing drift | Record ADR selecting canonical app and retire/rename the other |
| High | Glasses connection methods are partly simulated | Core product appears connected when it is not | Implement DAT connection state as single source of truth |
| High | No proven Supabase RLS/policy tests | Cross-user or cross-school disclosure | Add versioned schema/policies and adversarial tests |
| High | Student age/consent is fabricated or defaulted | FERPA/DPDPA failure | Build verified eligibility workflow |
| High | Sensitive debug logging | Biometric/device data leakage | Structured redacted logging and release log policy |
| High | Very small test suite and lint disabled | Regression and release risk | Restore quality gates incrementally |
| High | AWS workflow cannot demonstrate a deployable active backend | Release drift and false operations claims | Select Edge Function or SAM as canonical; fix required parameters and add deployment/contract validation |
| Medium | Orphaned services/routes | Misleading feature status and maintenance cost | Wire with acceptance tests or remove |
| Medium | In-memory chat/story | Loss on process death; unclear retention | Decide explicit ephemeral vs durable design |
| Medium | Legacy PDF export API | Export failures on modern Android | Use MediaStore or Storage Access Framework |
| Medium | Product-age conflict | Wrong copy, consent, UX and validation | Product decision with one canonical PRD |
| Medium | Vendor/model hidden behind backend without telemetry | Cost/quality incidents hard to diagnose | Add backend model-routing and quota observability |
Architecture decisions needed
| ID | Decision | Options |
|---|---|---|
| ADR-001 | Canonical Android app | Compose src/frontend; Expo root app; intentionally separate products/packages |
| ADR-002 | Biometric storage | Encrypted device-local only; encrypted cloud sync; remove recognition |
| ADR-003 | Primary audience | Higher Education (high school & college); separate editions |
| ADR-004 | Voice activation | Always-on wake word; push-to-talk; glasses gesture; phased combination |
| ADR-005 | AI provider boundary | Backend-selected model; user/tenant policy; deterministic fallback chain |
| ADR-006 | Session history | Explicitly ephemeral; encrypted local; cloud with consent and retention |
| ADR-007 | Hardware abstraction | Meta-only near term; formal HAL before second vendor |
| ADR-008 | Emergency feature | Production safety workflow; informational assistance only; remove |
| ADR-009 | AI execution path | Repair/retain Supabase chat-vision; activate/fix AWS SAM; one tested canonical boundary |
Open product questions
- Is the app a student tool, caregiver companion, school platform, or all three with separate role surfaces?
- Which features are safe to advertise today on the active build?
- Does a struck-through roadmap item mean delivered, cancelled, or deferred?
- Who is authorized to enroll another person's face, and how is their consent recorded?
- What is the age threshold and guardian verification mechanism by market?
- Are images, video frames, prompts, responses, and transcripts retained by the backend or downstream model vendor?
- What happens when the AI is uncertain, especially for identity, emotion, obstacles, and emergency contexts?
- Is seven-language output required at launch, and which vendor is authoritative for each speech function?
Recommended execution order
flowchart TD
A[Resolve product audience and canonical app] --> X[Repair fixed AI-response client path]
X --> B[Fix face-model fail-closed behavior]
B --> C[Define consent, RLS, retention, and vendor data flow]
C --> D[Make glasses connection/capture production-real]
D --> E[Turn core flows into tested release gates]
E --> F[Complete AI chat latency and wake-word scope]
F --> G[Wire or remove orphaned features]
G --> H[Add offline, navigation, dashboards, and new hardware]
Tip
Navigation ⬅️ 11-Security-Privacy-Compliance · 🏠 Home · ➡️ 13-Source-Map-Glossary