docs planning RISKS

Risk register

Qualitative planning assessment, 2026-09-28; probabilities are hypotheses, not incident statistics. Reassess during pilot. Each record identifies probability, impact, detection, mitigation and recovery.

• R01 False community prices/Sybil: probability HIGH, impact HIGH. Detect conflicting support, shared media, velocity and upheld cases. Mitigate single-vote limits, conservative trust, conditions, photo/proximity quality and review. Recover by audited invalidation/blocking and versioned recomputation; show UNKNOWN/DISPUTED while unresolved. Owner: Community/Trust; gates G06/G07.
• R02 Contributor location disclosure: probability MEDIUM, impact CRITICAL. Detect response/log schema and retention tests plus access review. Mitigate private short-lived payloads, no public coordinates/IDs, no nearby-query logs/shared cache. Recover by closing access, purging exposed data, incident/rights response and regression tests. Owner: Security; G07/G08.
• R03 Malicious or abusive photos: probability HIGH, impact HIGH. Detect quotas, decode failures, hash repeats and spend anomalies. Mitigate private quarantine, limits, verified frozen sanitized snapshot, short TTL and cleanup. Recover by disabling presign/decoder, deleting harmful/orphaned objects and revalidating affected facts. Owner: Evidence; G05.
• R04 ANP layout drift: probability HIGH, impact HIGH. Detect header/signature mismatch, row/quarantine deltas and import age. Mitigate source samples, robust parsing, controlled publication. Recover with new parser/fixtures and replay while retaining last published revision. Owner: Official; G02.
• R05 Kotlin/Go semantic divergence: probability HIGH, impact HIGH. Detect golden fixture differences, units/precision/CNPJ and API incompatibility. Mitigate explicit legacy profiles and P10 adapters; no blind code port. Recover by reverting adapter/flag or compatible API change, preserving cached source data. Owner: Contracts; G02/G09/G10.
• R06 Destructive migration/data loss: probability MEDIUM, impact CRITICAL. Detect schema/role/checksum/upgrade tests and backup integrity alarms. Mitigate append-only migrations, restricted DDL, expand/contract and tested off-host backups. Recover via isolated restore, deletion replay and compatible binary. Owner: Database/Operations; G08.
• R07 Incompatible API for published app: probability MEDIUM, impact HIGH. Detect OpenAPI breaking diff and old-client fixtures. Mitigate stable v1, tolerant response readers and versioned enum semantics. Recover by restoring compatible endpoint/version and feature rollback. Owner: Contracts; G09/G10.
• R08 Registration/write spam: probability HIGH, impact HIGH. Detect request/contributor/queue/quota anomalies. Mitigate edge+DB quotas, bounded challenges/uploads, no in-memory-only authority. Recover with audited limits/admission pause and dead-job triage; avoid broad NAT bans. Owner: Identity/Operations; G03/G08.
• R09 Unexpected storage/processing cost: probability MEDIUM, impact HIGH. Detect bytes/day, PUT/GET count, orphan age, decoder CPU and budget alerts. Mitigate size/issuance caps, retention, direct upload and bounded workers. Recover by pausing photo admission, cleaning only provably expired objects and adjusting capacity/limits. Owner: Evidence/Operations; G05/G08.
• R10 VPS/provider outage: probability MEDIUM, impact HIGH. Detect independent health/job/backup metrics. Mitigate offline clients, source-specific degradation, secured origin path, persistent volumes and runbooks. Recover on clean host using tested backups/digests/config; never bypass auth/TLS. Owner: Operations; G08.
• R11 Unrestorable backup: probability MEDIUM, impact CRITICAL. Detect full restore drill, not dump exit code alone. Mitigate independent keys/off-host copies/checksums/schema manifest. Recover by fixing backup pipeline and repeating restoration before accepting writes; if unrecoverable, honestly disclose measured RPO loss. Owner: Operations; G08/G09.
• R12 Agent-generated regression/architecture drift: probability HIGH, impact HIGH. Detect narrow diff review, import-boundary checks, domain/contract tests and undocumented rule changes. Mitigate AGENTS, task inputs, DOD-1, no test weakening or unrelated refactor. Recover with bounded rollback and regression test; do not rewrite modules to hide the failure. Owner: Maintainer; every gate.
• R13 License/brand mistake: probability MEDIUM, impact HIGH. Detect notices/dependency inventory/contributor rights review. Mitigate preserve MIT, explicit future licensing decision, provisional brand and attribution. Recover by removing unauthorized new material/claims and correcting notices after appropriate review; cannot retract old MIT rights. Owner: Maintainer; before distribution/change.
• R14 Geocoding false match/provider restriction: probability HIGH, impact HIGH. Detect address-quality checks, manually labelled pilot fixtures and provider quota errors. Mitigate verified location revisions, cache/global quota and permitted provider. Recover by invalidating bad coordinate revision/recomputing nearby/validation and retaining textual lookup. Owner: Directory; G02/G06.
• R15 Auth signature/proxy mismatch: probability MEDIUM, impact CRITICAL. Detect independent protocol vectors and staging proxy tests, atomic nonce races. Mitigate standard algorithms/profile, strict coverage, no fallback bypass. Recover by pausing signed writes, correcting verifier/profile compatibly and rotating compromised credentials. Owner: Identity/Security; G03/G08.

Release risk acceptance must name an owner and rationale. Critical privacy/security/restore failures cannot be hidden behind a generic “known issue” while marking G09 complete.