title: Risks, Decisions, and Open Questions

aliases: [Risk Register, ADRs]

tags: [3netra/wiki, risks, adr]

product: 3netra Meta Android App

source_repository: 3Netra-ai/3n_meta_android

source_ref: origin/prod

source_revision: b48aada8fd5427b5db0c02945569963c4ae543c8

last_verified: 2026-08-06

| Severity | Risk | Impact | Recommended action |

|---|---|---|---|

| Critical | Random embeddings when FaceNet model load fails | False identification and unsafe trust | Fail closed; surface model error; add model integrity test |

| Critical | Active AI client replaces every successful Edge Function reply with fixed text | Core narration/chat/summary is non-functional or misleading | Decode and validate the response; add contract/UI tests before release |

| Critical | Cloud biometric storage conflicts with local/encrypted claims | Student privacy, legal, trust | Define one consented architecture; enforce encryption, RLS, deletion |

| Critical | Committed/app-compiled credential material and an unsafe provider boundary | Credential compromise and unauthorized provider use | Rotate/revoke; purge history where required; use managed server secrets only |

| Critical | SOS flow is represented but incomplete | Safety harm | Remove claim/entry point until end-to-end verified |

| High | Compose and Expo apps share package/build ownership | Wrong artifact, config/signing drift | Record ADR selecting canonical app and retire/rename the other |

| High | Glasses connection methods are partly simulated | Core product appears connected when it is not | Implement DAT connection state as single source of truth |

| High | No proven Supabase RLS/policy tests | Cross-user or cross-school disclosure | Add versioned schema/policies and adversarial tests |

| High | Student age/consent is fabricated or defaulted | FERPA/DPDPA failure | Build verified eligibility workflow |

| High | Sensitive debug logging | Biometric/device data leakage | Structured redacted logging and release log policy |

| High | Very small test suite and lint disabled | Regression and release risk | Restore quality gates incrementally |

| High | AWS workflow cannot demonstrate a deployable active backend | Release drift and false operations claims | Select Edge Function or SAM as canonical; fix required parameters and add deployment/contract validation |

| Medium | Orphaned services/routes | Misleading feature status and maintenance cost | Wire with acceptance tests or remove |

| Medium | In-memory chat/story | Loss on process death; unclear retention | Decide explicit ephemeral vs durable design |

| Medium | Legacy PDF export API | Export failures on modern Android | Use MediaStore or Storage Access Framework |

| Medium | Product-age conflict | Wrong copy, consent, UX and validation | Product decision with one canonical PRD |

| Medium | Vendor/model hidden behind backend without telemetry | Cost/quality incidents hard to diagnose | Add backend model-routing and quota observability |

| ID | Decision | Options |

|---|---|---|

| ADR-001 | Canonical Android app | Compose `src/frontend`; Expo root app; intentionally separate products/packages |

| ADR-002 | Biometric storage | Encrypted device-local only; encrypted cloud sync; remove recognition |

| ADR-003 | Primary audience | Higher Education (high school & college); separate editions |

| ADR-004 | Voice activation | Always-on wake word; push-to-talk; glasses gesture; phased combination |

| ADR-005 | AI provider boundary | Backend-selected model; user/tenant policy; deterministic fallback chain |

| ADR-006 | Session history | Explicitly ephemeral; encrypted local; cloud with consent and retention |

| ADR-007 | Hardware abstraction | Meta-only near term; formal HAL before second vendor |

| ADR-008 | Emergency feature | Production safety workflow; informational assistance only; remove |

| ADR-009 | AI execution path | Repair/retain Supabase `chat-vision`; activate/fix AWS SAM; one tested canonical boundary |

- Is the app a student tool, caregiver companion, school platform, or all three with separate role surfaces?

- Which features are safe to advertise today on the active build?

- Does a struck-through roadmap item mean delivered, cancelled, or deferred?

- Who is authorized to enroll another person's face, and how is their consent recorded?

- What is the age threshold and guardian verification mechanism by market?

- Are images, video frames, prompts, responses, and transcripts retained by the backend or downstream model vendor?

- What happens when the AI is uncertain, especially for identity, emotion, obstacles, and emergency contexts?

- Is seven-language output required at launch, and which vendor is authoritative for each speech function?

---