WanderPlug — Family Architecture Spec (v1.0-candidate)
Product family: WanderPlug — smart outlet (single-receptacle) with per-outlet kWh + cost reporting, Matter-over-Thread native, and a covert remote-disable path for survivor / DV deployments. Revision: v1.0-candidate Date: 2026-04-25 SOP: v2.4
---
1. Why this exists
Smart plugs are the most-shipped smart-home category in the world — and the most universally shipped without a story. TP-Link Kasa and Wyze sell single-receptacle smart plugs at $8–15 retail with closed-cloud apps, no real per-outlet energy reporting (Kasa publishes wattage; very few report cumulative kWh + utility cost), and a relay topology that arcs at end-of-life and bricks the plug. The category is a commodity race-to-the-bottom that produces e-waste at huge scale and locks every consumer into a vendor cloud.
We do something different. WanderPlug ships UL 498 listed (the right standard for North American receptacle outlets — not UL 1097 / "smart plug" framing that Kasa hides behind), with a real Allegro ACS37800 isolated current-power-monitor IC, with Matter-over-Thread native (so it joins any household Matter fabric — Home Assistant, Apple Home, Google Home, SmartThings — without our cloud), and with a per-outlet kWh + utility-cost dashboard that does not require a subscription.
The product thesis is concrete: a smart outlet that reports real kWh / cost / phantom-load per receptacle, ships UL 498 listed, runs Matter-over-Thread without our cloud, and includes an identity-aware covert remote-disable path so that — in DV / coercive-control deployments — a survivor can unplug an adversary's tracker remotely from a safe location, with a panic-wipe of the audit log if the device is seized.
The covert use case is real and scoped: standard plugs are the substrate that adversaries use to power AirTag-class trackers, monitoring routers, and surveillance gear inside a survivor's home. WanderPlug treats remote-disable + audit-log + panic-wipe as a survivor primitive, not a marketing claim.
---
2. Product family overview
| Tier | Device ID | Form factor | Hero feature | Retail | Ship target |
|---|
| **WanderPlug Standard** | `WV-PLUG-STD` | Single-outlet 15 A NEMA 5-15R; 70 × 45 × 38 mm body forward of receptacle face; matte cream finish on Decora-style trim | UL 498 listed; ESP32-S3 + CC2652R7 Thread radio; Matter-over-Thread native; Allegro ACS37800 isolated kWh monitor; saffron status LED | **$39** | 2027-Q2 |
| **WanderPlug Pro** | `WV-PLUG-PRO` | Single-outlet 20 A NEMA 5-20R + dual USB-C PD passthrough (3 A 20 W per port, shared 30 W max); 70 × 45 × 50 mm | Standard + 20 A pass-through + dual USB-C PD + USB-port-level current monitoring (split into 3 channels: AC + USB-C-A + USB-C-B) | **$69** | 2027-Q3 |
Hero image alignment
The hero render shows a single-receptacle smart outlet, Decora-style trim ring with matte cream anodized aluminum face, saffron status LED at the lower-left of the face, with:
- Single NEMA 5-15R receptacle (Standard) or single NEMA 5-20R + dual USB-C PD ports (Pro) on the face
- Saffron LED lower-left position (state-of-device + relay-state visual cue) — same Cree CLM3C-AKA family as WanderAlert + Security Trio + WanderCO
- Saffron pinstripe on the outer trim ring (family-wide visual standard)
- Recessed reset/pair button on the side body — single tactile input — Test on press; relay toggle on hold; pair/factory-reset on long-hold
- No exterior branding — Ambassador signature engraved on the interior backplate per Standard 1
Both tiers share the receptacle-side face geometry (so wall-plate fitting is preserved across upgrades); the Pro tier adds depth (dual USB-C PD module behind the receptacle face).
Visual identity preserved across the family: matte cream anodized aluminum trim ring (matches WanderCO + WanderAlert Base + WanderDash cream-aluminum surface), saffron status LED (family-wide), Decora-style trim that fits any standard double-gang or single-gang Decora cover plate.
---
3. The four use cases (why per-outlet metering + remote-disable + audit-log matters)
3.1 Energy awareness — utility kWh + cost reporting
- Sensor: Allegro ACS37800 isolated AC current/voltage/power monitor IC (NEW for parts library)
- What it measures: real kWh, real RMS voltage, real RMS current, real apparent power, real power factor — all isolated (no neutral-referenced ADC sample-and-hope topology like cheap plugs use)
- Cost calculation: user enters utility rate (kWh price + tier structure if applicable) at setup; WanderPlug computes cumulative cost per outlet over arbitrary time windows (day, week, month, year, lifetime)
- Phantom-load detection: WanderPlug flags outlets with sustained low-watt draw (1–10 W) over multi-day windows that user can mark as "kill phantom load" — automated relay-off schedule
3.2 Per-outlet relay control — local + Matter
- Relay: TE Connectivity T9A series 16 A latching relay (or Omron G5RL-K equivalent; multi-vendor RFQ at engineering hire)
- Topology: double-pole-single-throw latching (zero-crossing-switched to minimize arc-suppression burden + sustain >100 k operations)
- Matter-over-Thread: WanderPlug joins any Matter fabric over Thread (CC2652R7 Thread radio + ESP32-S3 host); no cloud account required; works on Home Assistant + Apple Home + Google Home + SmartThings
- Local API: Matter-native + optional MQTT bridge via WanderNode Hub for households that want Home Assistant integration without Matter
3.3 Identity-aware remote-disable + audit-log + panic-wipe — survivor primitive
- Use case: DV / coercive-control survivor needs to unplug an adversary's surveillance device (router that exfils traffic, AirTag-class tracker, hidden-camera power) without physical access — from a safe location
- Mechanism: every relay state change (commanded by user, by Matter fabric, by mesh, by automation) is logged to local-only audit log with timestamp + commanded-by + RSSI + Matter-fabric-source if applicable; log is encrypted at rest with SE051 device key + can be exfiltrated via paired-phone for legal/forensic use
- Panic-wipe: triple-press the side button OR remote command from companion-app duress-PIN → audit log + commissioning data + Thread credentials erased; relay returns to its UL-default state (closed for AC-passthrough); device returns to factory-fresh commissionable state. Designed so that if the device is seized post-event, no attribution data remains.
- Covert remote-disable: survivor can issue a "disable relay" command from companion app; relay opens; from the adversary's perspective, the powered device just "stops working." LED state can be config'd to NOT visually indicate relay state (covert mode; default-off — must be opted into with dual acknowledgment per D-PLUG-008)
3.4 Energy-monitor-as-research-input — for households who want the data
- Local data export: companion-app exports kWh/cost CSV per outlet per arbitrary window (no cloud upload required)
- WanderNode Hub admin telemetry: household-wide energy dashboard via Hub admin web UI (free; optional)
- Apple Home / Google Home: per-outlet kWh/cost flows into HomeKit + Google Home native energy widgets (Matter standard; v1.0)
---
4. Tier feature matrix
| Feature | Standard `WV-PLUG-STD` | Pro `WV-PLUG-PRO` |
|---|
| **AC receptacle** | NEMA 5-15R (15 A / 1875 W) | NEMA 5-20R (20 A / 2400 W) |
| **USB-C PD passthrough** | — | 2 × USB-C PD 3.0 (3 A / 20 W per port; 30 W shared budget) |
| **AC kWh / cost monitor** | ✅ ACS37800 | ✅ ACS37800 + per-USB-port shunt sensor |
| **Matter-over-Thread** | ✅ | ✅ |
| **Saffron status LED** | ✅ | ✅ |
| **UL 498 listed** | ✅ HARD GATE | ✅ HARD GATE |
| **FCC Part 15 + Matter cert** | ✅ | ✅ |
| **Identity-aware covert-mode + audit-log + panic-wipe** | ✅ | ✅ |
| **Ambassador-assembled** | ✅ | ✅ |
| **Open STLs (CC BY-SA 4.0)** | ✅ wall-plate variants + STLs | ✅ |
| **7-year parts** | ✅ | ✅ |
| **Subscription** | None | None |
Hero feature breakdown
Standard tier mission: the right replacement for a Kasa / Wyze plug for households who want real kWh data without a cloud account, with the survivor primitive baked in for free.
Pro tier mission: households that have lost free wall-outlet space to chargers + want USB-C PD baked in + want full per-port energy reporting (rare in the category — most USB-PD-bundled plugs report total power only, not per-USB-port).
---
5. The 7-year-parts compliance (Stage 0 reconcile — relay end-of-life)
WanderVerse Standard 4 mandates 7-year parts at cost+10% via Ambassador network. The relay (T9A latching, 16 A nominal) is the binding wear-out component — relay arc-suppression contacts oxidize over time, especially at high-draw inductive loads. Industry residential-grade smart plugs ship without an honest end-of-life story; we have one.
5.1 Relay choice + spec
- Primary relay: TE Connectivity T9A series 16 A 30 V latching relay (5-pin); rated >100 k operations at full load
- Alternate: Omron G5RL-K or Panasonic ALD class equivalent — qualified at DVT
- Why latching not monostable: monostable relay holds the contacts open via continuous coil current (~30 mA); on a 24 / 7 / 365 plug that's 260 kWh / yr just to hold the relay open. Latching relay uses a brief (<10 ms) coil pulse to flip state, holds mechanically, and consumes zero idle current. Energy-honest device shouldn't waste energy on its own coil.
- Why 16 A nominal for a 15 A outlet: UL 498 derate factor; 16 A relay sustains 15 A continuous duty + transient inrush
5.2 Arc-suppression + EOL UX
- Snubber network: RC snubber across each contact (0.022 µF + 100 Ω) plus zero-crossing-switching firmware (relay flip commanded only when AC sine is within ±2 V of zero crossing)
- Operations-counter in firmware: every relay flip increments a SE051-stored counter; firmware can self-report relay-life-remaining in companion app
- EOL UX: at 80 k operations, app says "consider Ambassador refresh in next year"; at 95 k, on-device LED slow-pulse + app prompt "Ambassador refresh recommended"; at 100 k, firmware refuses commanded flips that aren't from a manual button-press and logs "EOL — Ambassador refresh required"
- Ambassador refresh: $25 service + new T9A relay → resets operations counter; refresh resets the 7-year-parts clock for the new relay
5.3 Why this matters
Most smart plugs stop being useful at ~50–70 k operations (relay welded contacts; arc-pitted; intermittent). The user has no insight into why; they just throw the plug away. WanderPlug is honest about this, instruments it, and offers a service path that avoids the e-waste outcome.
---
6. Identity-aware operation (D-PLUG-008 — covert remote-disable, audit-log, panic-wipe)
Per Standard 0 (survivor / identity-aware modes):
6.1 Audit log (default-on)
- Every relay state change logs:
timestamp · commanded_by (user|Matter|automation|button) · matter_fabric_source · RSSI · UL-cert-mode register state · audit_log_seq
- Log encrypted at rest with SE051 device key
- Log persists to flash (8 MB Macronix MX25R; 16 MB on Pro for longer history)
- Log exportable via companion app (paired-phone-only) as signed CSV
- Log retention: rolling 90 days by default; configurable to 365 days; never to the cloud
6.2 Covert mode (LED state-suppression on relay change) — opt-in
- Default: saffron LED reflects relay state (steady-on if relay closed; off if relay open) so user sees status at-a-glance
- Covert mode opt-in: dual-acknowledgment in companion app
- LED behavior: stays in steady-on standby pattern regardless of relay state (visually identical whether relay is closed or open)
- From an adversary's perspective: "the device isn't working" — they can't tell at a glance whether you flipped the relay or whether the plug is faulty
- Default off; user must explicitly opt in with risk-acknowledgment ("I understand that LED state-suppression means I cannot visually confirm relay state at-a-glance from across the room. I am enabling this for [DV/safehouse/coercive-control] reasons.")
- Why this matters: in DV / coercive-control deployments, the adversary often inspects power for surveillance gear. A plug whose LED clearly indicates "off" is a plug whose state has been changed by the survivor — escalation risk. Covert mode keeps the plug visually consistent.
6.3 Panic-wipe (triple-press OR duress-PIN)
- Triple-press side button within 3 s: audit log erased; commissioning data erased; Thread credentials erased; SE051 returns to factory-fresh commissionable state; relay returns to UL-default closed (AC passthrough)
- Duress-PIN via companion app: user sets a separate duress-PIN at setup (different from the regular PIN); entering the duress-PIN looks normal in the app but triggers panic-wipe + audit-log-export-to-paired-phone in the background
- Forensic-friendly: before wipe, the audit log + relay-state history is exfiltrated to the paired phone (encrypted). Survivor still has a record for legal/forensic use — the device just doesn't have one if it's seized.
- Independent security audit gate: panic-wipe + audit-log behavior is reviewed pre-PVT by an external security firm + counsel + DV-survivor advisory panel (per D-PLUG-008 enforcement)
6.4 Trust-contact-only routing
- Companion-app push + Matter-fabric notifications route only to the household admin / paired phones
- Never to a public API, social feed, or analytics endpoint
- Hub admin assigns trust contacts at install
6.5 Survivor-pattern flag
- User can flag at order time: "this is a DV-safehouse / undocumented-population / sensitive deployment"
- WWP-side review applies; Ambassador pre-configures device with covert-mode-eligible profile (
co_outlet_survivor_eligible role token in SE051)
- Default WanderPlug ships with covert mode disabled (user must opt-in post-install)
---
7. Architecture
7.1 Family platform (shared across both tiers)
| Block | Part | Notes |
|---|
| Host MCU | Espressif ESP32-S3-WROOM-1-N16R8 | Reused (parts.db: compute-mcu, multi-product); 16 MB flash + 8 MB PSRAM |
| Thread radio | TI CC2652R7 | NEW for parts library; primary Thread/Zigbee networking; FCC modular cert |
| AC current/power monitor | Allegro ACS37800 | NEW for parts library; isolated; ±30 A range; 8 kSPS |
| PMIC | TI TPS65086100 | Reused (parts.db: power-pmic, 13 products); multi-rail |
| Saffron status LED | Cree CLM3C-AKA | Reused (parts.db: indicator-led, multi-product); 605 nm |
| LED driver | TI TPS92518 | Reused; multi-channel PWM (single-LED so single channel used) |
| Secure element | NXP SE051 | Reused (WanderBand + WanderAlert + Security Trio + WanderCO) |
| Flash NOR | Macronix MX25R 8 MB / 16 MB | per-tier sized |
| AC relay | TE Connectivity T9A 16 A latching | NEW for parts library; Omron G5RL-K alternate |
| EMI input filter | Murata BNX002 | NEW for parts library; common-mode + differential-mode |
| AC-DC converter | Mean Well IRM-03 / RECOM RAC02 / on-board flyback (Vipcom IRM-class) | NEW; isolated 5 V / 600 mA |
| AC fuse | Bel Fuse 5ET-2 (slow-blow 2 A) | new mechanical |
| Tamper switch | Omron D2F-01F | Reused (WanderAlert + WanderCO) |
| Reset/pair button | Alps SKRH + recessed cap | Reused |
| Antenna Thread | Texas Inst. CC-Antenna-DK2 / Taoglas FXP70 | NEW for parts library |
| Antenna BLE/WiFi | Raytac chip antenna (ESP32-S3 module integrated) | Reused |
7.2 WanderPlug Pro — additions
| Block | Part | Notes |
|---|
| USB-C PD controller | Cypress CYPD3174 / TI TPS65987DDH | dual-port USB-PD 3.0 controller; 30 W shared |
| USB-C connectors (×2) | GCT USB4135 (vertical mid-mount) | new mechanical |
| USB-C PD per-port shunt | TI INA236 (×2) | NEW for parts library; ±0.1 % current sense |
| USB-C ESD + power switch | Diodes Inc TPD3S014 (×2) | new |
| Flash NOR | Macronix MX25R 16 MB (vs 8 MB Standard) | extra storage for per-port history |
7.3 What WanderPlug does NOT have
- No camera. Categorically out of scope; no use case justifies it; privacy implications + UL 498 doesn't require it.
- No microphone. Same.
- No display. Saffron LED + companion-app status; no on-device screen.
- No NOAA / cellular receiver. WanderPlug is a Matter-over-Thread leaf node + WiFi fallback; no out-of-band radio.
- No Wi-Fi 6E / Wi-Fi 7. ESP32-S3 supports Wi-Fi 6 (2.4 + 5 GHz); 6E/7 is overkill for a smart plug.
- No PoE. Mains-powered; PoE is for low-voltage use cases.
---
8. Coverage architecture (Matter + mesh integration)
| Source | WanderPlug Standard | WanderPlug Pro |
|---|
| Matter-over-Thread (commissioned to household fabric) | full participation | full participation |
| Matter-over-WiFi fallback (if no Thread border router available) | yes | yes |
| Thread mesh re-broadcast (border router role-eligible — disabled by default) | RX only by default | RX only by default |
| WanderAlert mesh leaf node (LoRa SX1262) | NOT INCLUDED v1 | NOT INCLUDED v1 |
| BLE-paired phone (companion app) | yes | yes |
| Local-only API via Hub admin web UI / MQTT bridge | yes | yes |
Coverage gate: WanderPlug is a complete Matter-over-Thread smart outlet in standalone mode (no WanderVerse cloud; works with any Matter fabric). Joining a WanderAlert mesh fleet is not a v1 feature — WanderPlug doesn't carry a LoRa radio. v2 candidate to add LoRa SX1262 if the WanderVerse-mesh-cross-product story demands a participating outlet.
---
9. Compliance summary (per `COMPLIANCE.md`)
| Cert | Status | Notes |
|---|
| **UL 498 (Attachment Plugs and Receptacles)** | red blocker | HARD GATE — required for sale; no waiver. Cert ~$25–35k per tier (bundled lab visit Standard + Pro) |
| **UL 1310 / UL 60950-1 (low-voltage power)** | yellow | Required for USB-PD section of Pro tier; bundled with UL 498 lab visit |
| **CSA C22.2 No. 42 (Canadian receptacles)** | yellow | Bundled with UL 498 lab visit |
| **NEC Article 406 (receptacle requirements)** | green | Inherits from UL 498 |
| **FCC Part 15 B/C** | green | ESP32-S3 + CC2652R7 modular passthrough |
| **CE / UKCA + EN 60669-2-1 (smart switches/receptacles for EU)** | yellow | Required for EU sale |
| **EU CE LVD + EMC bundle** | yellow | Bundled |
| **Matter Certification (CSA-IoT)** | red blocker | HARD GATE for Matter logo + fabric joining |
| **Thread Group Certification** | yellow | Required for Thread logo + interop |
| **Connectivity Standards Alliance (CSA-IoT) Matter cert** | red blocker | bundled with Matter cert; ~$8–12k cert lab + $4k membership/year |
| **EnergyStar (energy-monitoring smart plug category)** | green opt-in | category exists; modest grant-funding plausibility for v1.1+ |
| **California Energy Commission (CEC) Title 24 / Title 20** | green | applies for CA sale — passive-load standby <0.5 W satisfied |
| **RoHS / REACH** | green | declared |
Total cert v1: ~$50–80k (UL 498 + Matter + FCC + CE bundle). Standard tier: ~$35–50k. Pro tier: shared cert lab visits + delta on USB-PD UL 1310 + per-port energy reporting Matter cluster.
---
10. Manufacturing + service summary
Ambassador assembly (Standard 1)
- Tier-2 for both WanderPlug SKUs (UL 498 dielectric test + relay arc-suppression verify + Matter commissioning verify)
- Per-unit Ambassador time:
- Standard: ~10 min/unit (~40 units / 8-hr day)
- Pro: ~14 min/unit (~32 units)
- Ambassador signature: etched aluminum tag inside service panel (per family standard); paired to unit serial in WanderOS
Per-unit production tests
- 16 tests per unit (see
DFM-DFA-DFT.md)
- Includes UL 498 dielectric test (1500 VAC for 1 min between line/neutral and earth; no breakdown)
- Includes UL 498 hi-pot test on the receptacle face contacts
- Includes Allegro ACS37800 calibration (calibrated load test at 5 / 10 / 15 A; ±2 % accuracy verified)
- Includes T9A relay 100-cycle burn-in at full inductive load
- Includes Matter commissioning round-trip with reference Thread border router + Matter fabric
7-year-parts service
- Spare T9A relays stocked through year 7 (relay is the wear component; refresh service available from year 1)
- Spare Allegro ACS37800 (electronics; rare failure)
- Spare Cree CLM3C-AKA saffron LEDs
- Year 8: STL + schematic + firmware-source release CC BY-SA 4.0 (STLs) / CC BY-NC-SA 4.0 (firmware)
Service plan (per `SERVICE-FLOW.md`)
- 2-year standard warranty + 5-year extended option + lifetime-of-property institutional commitment for HAVEN safehouse / LGBTQ-housing kits
- DIY: wall-plate replacement, button cap replacement, Matter re-commissioning
- Ambassador send-back: relay refresh (every ~80 k operations), full UL 498 cert re-verification post-major-repair, mainboard swap
---
11. Revenue + social-impact integration
60/30/10 Community Pool flow (Standard 5)
Per canonical revenue split:
- 60% → Ambassador wages (1099 → W-2 at revenue trigger)
- 10% → PrideFund (Ambassador HYSA)
- 30% → WWP Community Pool (Layer 1 ops ≤65%, Layer 2 Ambassador-voted ≥35%)
Donor-sponsored kits (HAVEN safehouse + LGBTQ-housing)
- Donor channel for DV-safehouse + Title-I-equivalent rural-housing sponsorship
- Match: WWP grant-matches up to 1:1 from Community Pool
- Eligibility: 501(c)(3) DV shelters + LGBTQ-housing nonprofits + Native youth housing + Tribal-enrolled rural housing programs
- WanderPlug sponsorship pattern: a 4-pack covers the typical safehouse coverage (every adversary-suspect outlet — bedroom, common area, network closet, entry point)
Grant-fundable
- HUD Healthy Homes (energy-efficiency intersection — phantom-load reduction maps to Healthy Homes program criteria)
- DOE Building Technologies Office (energy-efficiency grants for low-income households)
- State energy-efficiency rebate programs (NY, MA, CA, OR, WA all have utility-rebate programs for ENERGY STAR-class smart plugs)
- VAWA housing transition (DV-safehouse comms + safety upgrades — covert remote-disable applies)
---
12. Feature inventory (Stage 0 sweep)
Hardware features
- UL 498 listed (HARD GATE — no shipping without it)
- ESP32-S3 host + CC2652R7 Thread radio (Matter-over-Thread native)
- Allegro ACS37800 isolated AC current/voltage/power monitor
- Saffron LED status indicator
- TE T9A latching relay (16 A; arc-suppressed; zero-crossing-switched)
- Murata BNX002 EMI input filter
- IRM-class isolated AC-DC converter (5 V / 600 mA)
- Bel Fuse 5ET-2 slow-blow 2 A AC fuse
- Tamper switch (rear plate seal)
- Reset/pair button (recessed)
- Pro tier: NEMA 5-20R + dual USB-C PD 30 W shared + per-port INA236 shunt
- Decora-style trim ring (matte cream anodized aluminum + saffron pinstripe)
- 7-year parts (with 80–95 k relay-cycle refresh schedule)
- Ambassador-assembled
- CC BY-SA 4.0 STLs
Software features
- Zephyr RTOS on ESP32-S3 (host) + native CC2652R7 Thread/OpenThread stack
- Matter-over-Thread (native; CSA-IoT certified)
- Matter-over-WiFi fallback (if no Thread border router in commissioning fabric)
- Matter Energy Management cluster (per-outlet kWh reporting; Apple Home + Google Home native)
- Allegro ACS37800 driver + UL 498 dielectric isolation discipline
- Per-outlet kWh + cost dashboard (companion app + Hub admin)
- Identity-aware audit log (encrypted at rest; SE051 device key)
- Identity-aware covert mode (LED state-suppression — opt-in dual-acknowledgment)
- Identity-aware panic-wipe (triple-press OR duress-PIN)
- Operations-counter on T9A relay (firmware-tracked)
- Phantom-load detection (sustained low-watt over multi-day window)
- Schedule + automation (local; Matter-fabric-or-Hub-administered)
- OTA via WiFi / Matter-fabric / BLE-fragment fallback
- WanderOS service history per unit (Ambassador + serial + UL cert ref + relay cycle count + service events)
Operational features
- Standalone mode (no WanderVerse cloud; Matter fabric only)
- WanderNode Hub admin telemetry (free; optional)
- HAVEN safehouse + LGBTQ-housing donor-sponsored kits
- Identity-aware survivor-pattern eligibility (WWP-side review at order; default-off)
- DOE / state utility-rebate grant-fundable for low-income deployment
---
13. Risk register
| # | Risk | Severity | Mitigation |
|---|
| 1 | UL 498 cert delays beyond 2027-Q1 | red | Lab booking 2026-Q4; reference unit ready EVT |
| 2 | Matter cert delay — CSA-IoT cert pipeline congestion | red | Matter SDK selected early (Espressif Matter SDK reused from broader Matter-Thread ecosystem); cert lab booked 2026-Q4 |
| 3 | Allegro ACS37800 supply disrupted (NEW for parts library; medium-supply-risk) | yellow | Alternates: TI INA228 (high-side) + Allegro ACS758 (different range) — qualified at DVT |
| 4 | TE T9A relay supply / EOL volatility | yellow | Omron G5RL-K + Panasonic ALD class qualified at DVT |
| 5 | Survivor advisory rejects covert-mode framing | red | DV-advocate + LGBTQ+ DV-survivor + UL human-factors panel veto rights pre-EVT |
| 6 | USB-PD interop (Pro) — host laptop + phone-charger compatibility variance | yellow | USB-IF cert at DVT; field pilot at WanderVerse team for laptop-charger compatibility |
| 7 | Matter Energy Management cluster spec ratification slip (CSA-IoT) | yellow | v1 ships with energy-cluster-extension if Energy Management cluster not ratified at v1 ship; standard PowerSource cluster fallback |
| 8 | UL 498 dielectric isolation between AC and DC (USB-PD) sections fails at DVT | red | 5 mm creepage + 4 mm clearance + transformer + opto isolation verified at EVT pre-scan |
| 9 | T9A relay arc-suppression EOL exceeds 100 k operations target | yellow | RC snubber + zero-crossing-switching firmware; operations-counter + Ambassador refresh path documented |
| 10 | Engineering hire timeline slips | red | Shared engineering pool with WanderAlert + WanderCO + WanderSense; pipeline started 2026-Q3 |
---
14. Conflict register
Resolved per DECISIONS.md D-PLUG-001 through D-PLUG-010. Key conflicts:
- D-PLUG-001: TE T9A relay 100 k operations EOL vs WanderVerse 7-year parts — RECONCILED per §5 (Ambassador-serviceable refresh; operations-counter in firmware; relay stocked through year 7; refresh at 80–95 k cycles)
- D-PLUG-004: Allegro ACS37800 + T9A relay + Murata BNX002 NEW for parts library — added at this spec session
- D-PLUG-008: Identity-aware covert remote-disable + audit-log + panic-wipe — controversial; advisory-panel-gated; default-off
- D-PLUG-010: No LoRa radio in v1 — explicit non-claim; v2 candidate
No software conflicts with existing WanderVerse specs. Matter-over-Thread is the canonical pattern for WanderVerse outlets / switches / lighting per the broader smart-home roadmap.
---
15. Marketing language gate
Words we DO use:
- "UL 498 listed smart outlet with per-receptacle energy monitoring"
- "Matter-over-Thread native — works with Apple Home, Google Home, Home Assistant, SmartThings"
- "Per-outlet kWh + utility cost reporting — local-only by default"
- "Identity-aware operation for survivors who need it"
- "Replaces TP-Link Kasa and Wyze Plug with real energy data + no cloud account"
- "Real Allegro ACS37800 isolated AC monitor (not a sample-and-guess shunt)"
Words we do NOT use:
- "Smart plug" — we are a UL 498 listed smart outlet (different category framing; smart-plug framing is what Kasa hides behind)
- "Smarter than Kasa" / "Kasa-killer" — comparative claims invite reverse claims + survivor-advocate veto on covert-mode framing
- "Silent off" — covert mode is a survivor-mode opt-in, not a marketed feature
- "Detects energy theft" — out-of-scope; we measure consumption, not theft
- "Bills you for utility" — we report cost; we don't bill
- "Cloud-required" — we are explicitly NOT cloud-required (the opposite of the category default)
---
16. Ship discipline
- v1.0 launch: 2027-Q2 Standard → 2027-Q3 Pro — both gated by UL 498 + Matter cert + advisory review
- v1.1 (3 months post-ship): UX polish; companion app feature depth; first survivor-user-feedback integration; phantom-load-killer-schedule auto-generation
- v1.2 (6 months post-ship): USB-PD passthrough Pro variant for global plug formats (UK BS 1363, EU Type F / Schuko, AU Type I); Matter energy-management cluster expansion
- v2 (2028-2029, conditional): Add LoRa SX1262 for WanderAlert mesh participation (cross-product story); 4-outlet power-strip variant; outdoor (NEMA 3R) outdoor-rated variant for ground-level deployments
---
17. Ambassador + Community Pool integration
(verbatim from _TEMPLATES/_community-pool.md + _ambassador-signature.md + _seven-year-parts.md):
How the money flows
Every sale of a WanderPlug SKU is divided three ways:
- 60% pays the Ambassador who assembled the unit
- 10% seeds PrideFund — community-held HYSA
- 30% funds the WWP Community Pool — Layer 1 ops ≤65%; Layer 2 Ambassador-voted ≥35%
Ambassador signature mark
Every WanderPlug unit carries an etched aluminum tag inside the service panel:
- Ambassador ID (pseudo-random alphanumeric)
- Assembly date
- Unit serial number
- UL cert reference (UL 498 listing number; post-cert)
- Matter device certification ID
- T9A relay lot
At Ambassador refresh (relay cycle 80–95 k), a second signature is added beneath the first. Provenance accumulates.
Seven-year parts
Every spare part for WanderPlug is available for 7 years from ship date, via Ambassador network, at cost + 10%. Year 8: every manufacturing file is published (STLs CC BY-SA 4.0; firmware source CC BY-NC-SA 4.0; schematics + assembly instructions).
What "parts" includes:
- Mechanical assemblies (chassis, trim ring, wall-plate adapters, button cap)
- All sub-boards + modules (energy-monitor PCBA, mainboard, relay carrier, USB-PD carrier on Pro)
- T9A relays (refresh kit; primary wear component)
- Allegro ACS37800 electronics (rare failure)
- USB-C PD controllers + connectors (Pro)
What "parts" does NOT include:
- Wall fasteners (#6 trim screws — sourceable from any aftermarket)
- Wall-plate covers (Decora cover plates — industry standard)
---
This spec is the source of truth for the WanderPlug family. Companion docs (DECISIONS.md, BOM-platform.csv, BOM-modules.csv, BOM-normalized.csv, CONFIGURATOR.md, COMPATIBILITY.md, SOURCING.csv, DFM-DFA-DFT.md, THERMAL-EMC.md, COMPLIANCE.md, GUIDE.md, HW-FW.md, SERVICE-FLOW.md, GATE.md, STL-OPEN-FILES/README.md, _VALIDATION-AND-SENSOR-EXPANSION.md, _COMPETITIVE-AUDIT-2026-04-25.md, _MANIFEST.md) elaborate; this spec governs.