Risks

As of: end of M0 (planning). This page lists the product risks: what endangers the build, the operations or the commitments of the product, how likely that is, what damage it does and how the plan counters it. Individual threats with attacker, STRIDE category and tests are in the threat model; here is only what remains of them as a risk for the product. Risks of a single instance (own hosts, own accounts, own operations) are in the private operations repository of that instance.

Origin. The risks of the team reports, of the core contract and of the follow-up on terminal and visualization, merged: risks with the same cause share one row. Risks that a later decision eliminated are under Done.

Rating. Likelihood and impact are each low, medium or high, as in the threat model (section 6.1). If two reports rated the same risk differently, the higher rating applies, unless a later decision reduced the cause; then the row names that decision.

Maintenance. At the end of every milestone the closing gate updates this page (Plan, section 4 item 6): check the risks of the milestone, rate them again, move the done ones, add new ones. The column "Check" names the milestone in which the risk is first confirmed or refuted with the named test or ticket. IDs are never reassigned.

The five biggest risks

Rank	ID	Risk	Likelihood	Impact
1	RK-01	Prompt injection steers agents with tools	high	high
2	RK-77	With the first push the history becomes visible, including old sample values and internal identifiers	high	high
3	RK-13	Wrong evidence of the reported mode in the reference adapter routes organization traffic through a personal subscription	medium	high
4	RK-23	The host service on other people's hosts gives more than the permitted shell	medium	high
5	RK-07	The memory of a runtime carries knowledge between audience groups	medium	high

Rationale for the order. The order follows three criteria, in this order of precedence:

1. Rating: likelihood times impact from the register (low 1, medium 2, high 3).
2. Kind of consequence: The consequence leaves the instance or cannot be undone, that is, a later fix does not take it back: lockout by the provider, publication, data leak, content, knowledge or a shell in the hands of someone without permission for it, legal violation. A later fix remedies outages, breaks at interfaces, effort and restrictions; they do not meet the criterion.
3. Remainder after the mitigation: what no test in the repository can fully cover. If the threat model lists the threat, its "Residual risk" level applies (with several, the highest). If it does not list it, the rationale below names a level on the same scale with a reason; it counts like a level of the threat model. At the same level, what counts is how far the remainder reaches.

make docs checks the first criterion with tools/docs/risk_ranking.py (D-W-78, D-W-79): the table names the rating of the register, the rating never rises down the table, no risk outside the table is rated higher than its last rank, and the list "Behind rank 5" names exactly the risks outside the table with the same rating as rank 5. Criteria 2 and 3 are judgment calls; the maintenance at the end of every milestone checks them.

1. RK-01 and RK-77 are the only risks with high and high. For both, the consequence leaves the instance and cannot be undone: a tool acts outside the instance, a published history cannot be taken back. RK-01 comes first because more remains: no model reliably detects injected instructions (T-AI-01 to T-AI-03, residual risk medium). The product therefore relies on boundaries instead of detection, and every new agent and every new tool widens the surface.
2. RK-77 has a finite cause, the existing history. Two history scans (make denylist-history, gitleaks over all refs) find the places, only a commit without parents is published (D-W-93), and a red team checks the result. What remains are only identifiers that neither the deny list with its rules nor gitleaks detects. RK-77 has no entry in the threat model; by criterion 3 this remainder is low: scans and red team check a cause that no longer grows, because after the switch denylist-main.yml checks every push to main.
3. RK-13 leads the risks of the next rating (medium and high or high and medium). The consequence leaves the instance: the provider can lock out the whole organization, and that cannot be undone. An unknown reported mode aborts the run (fail closed). What remains is the case that the adapter reports a wrong mode as safe, because it depends on a non-public surface of Hermes Agent. No test in the repository fully covers that (T-AI-08, residual risk medium in the adapter), and this remainder hits the whole organization. Until D-W-57, RK-22 stood before RK-13 with the same consequence. Since ruling T12 every person on a host has their own session user, and since ruling T13 (D-W-62) no configured location connects the accounts again: working directories and CLAUDE_CONFIG_DIR each belong to one session user (with personal it lies in the home, D-W-82), and HD11 checks every configured path on all three platforms (D-W-80). A subscription login then reaches no session of another person, even if doctor does not find it. The rationale of D-W-57 alone did not carry that: shared working directories were a second path (now RK-88). What remains depends on a local privilege escalation, on mistakes of the instance operator (a previously assigned name, a shared folder outside the configuration) or on a person's own action in such a folder. Therefore RK-22 is now at low.
4. RK-23: No fix takes back a shell or root-level privileges in the hands of someone without permission for it. After the mitigation, vulnerabilities in the operating system of the host remain (T-TM-04, residual risk medium); in addition there is a hard block: without proof for a platform there is no terminal there (M2-42). The remainder stays on one host; therefore RK-23 stands behind RK-13. There, however, it reaches beyond every granted permission, up to sessions and logins of other people.
5. RK-07: No fix takes back knowledge that has reached another audience group. The server does not see the memory of the runtime; the mitigation is a recommendation and hint H1, and no test in the repository reaches the remainder (T-AI-01, residual risk medium). It reaches across the boundary between audience groups, but only as knowledge. Therefore RK-07 stands behind RK-23, whose remainder allows acting.

Behind rank 5 are all other risks with the rating medium and high or high and medium:

• RK-27 (open terminal sessions in the console) meets criteria 2 and 3 like RK-07 (T-TM-07, residual risk medium), but its remainder reaches less far. It requires an already compromised browser of a person who may open the terminal, and stays within that person's permissions; that is the same remainder as with malware on any device (T-TK-01). The remainder of RK-07, by contrast, goes across the boundary between audience groups.
• RK-02, RK-04, RK-33, RK-49 and RK-50 meet criterion 2: content with people without read permission, requests into internal networks, deleted data that comes back (legal violation), content in the telemetry, data loss after a faulty backup. By criterion 3 less remains: their cause lies in code and configuration of the repository, and tests cover it. RK-02 is checked by the differential test AZ-P8 and the case tables per action (T-AZ-03), RK-04 by the egress client with address check after resolution and SSRF lint (T-NW-01), RK-33 by the deletion journal, the startup check and the tests SEC-T15 and DP-T07 (T-BK-02), RK-49 by the allow-list in the gate, the linter for log messages and the canary test (T-LG-01), RK-50 by the integration test of archiving, backup and restore (ADR 0058). The named threats are listed in the threat model with the residual risk low. RK-50 has no entry there; by criterion 3 its remainder is low for the same reason.
• RK-11, RK-12, RK-14, RK-15, RK-31, RK-39, RK-44, RK-56 and RK-85 do not meet criterion 2. Their consequence is a restriction (RK-11, RK-39, RK-44), a break at an interface (RK-12, RK-14, RK-15), a limit of throughput (RK-31), effort (RK-56) or a skipped check step (RK-85); a later fix remedies them.

Register

Agents, security and permissions

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-01	Prompt injection through content from unauthorized authors, other agents, files or imports leads an agent with tools to unintended effects.	high	high	Boundaries instead of detection: origin and trust marker per context message, tool classes (SR2), acting-for binding (SR9), approval cards with a header from server fields, agents never trigger agents; red team in every milestone.	09, 07, ADR 0054, T-AI-01 to T-AI-03, AG-20, M2-13, M2-14	M2
RK-02	Permissions show too much: the permission snapshot becomes stale after a structure change or the expiry of a grant, or a permission change does not name all affected principals for access.changed. Events then reach people without read permission, or content stays on their devices.	medium	high	authorize per event with resource path; catch-up filter over visible spaces; job authz.expiry_sweep; authz determines the affected principals itself from the target; cache tied to the permission version; differential test AZ-P8 and case table test per action.	07, 04, M1-28, M1-29, M1-30, M1-53	M1
RK-03	A client does not apply the deletion rule correctly after access removal or revocation; content stays on the device.	medium	medium	Conformance test in the client test kit; access removal in the sync engine with an integration test.	04, 15, M4-14	M4
RK-04	SSRF or DNS rebinding through outgoing webhooks and addresses for interactions.	medium	high	HTTPS only, host allow-list webhook.allowed_hosts, IP block list after resolution, connection bound to the checked address, no redirects; one egress client with SSRF lint for every outgoing call.	19, ADR 0016, M1-22, M2-26, M2-25	M1
RK-05	Whoever controls the database and the target of the checkpoints can forge the audit log.	low	high	Checkpoints in a separate account with a retention lock; the console warns as long as no target is set.	ADR 0021, M7-22	M7
RK-06	Disabling a person in the identity provider takes effect only after auth.idp_recheck_interval.	medium	medium	user.disable takes effect immediately; disabling via SCIM or Shared Signals as a later extension.	08, M1-45, V3-08	M1
RK-07	The memory of a runtime carries knowledge between audience groups; the server does not see it (hint H1).	medium	high	Recommendation "one agent per audience"; H1 visible in the preview of a grant and in "Who has access?".	07, threat model T-AI-01	M2
RK-08	Windows Hello may not deliver the key as ES256; Windows devices without TPM 2.0 or without P-256 in the TPM.	medium	medium	Measurement in the Windows ticket; runtime check; fallback to a software key marked "not hardware-bound", visible in the device approval; further algorithms only by ADR.	08, 03 device_keys, M4-11	M4
RK-09	DPoP, invocation tokens and acting-for binding increase the effort in adapters and SDKs; a faulty implementation weakens the check.	medium	medium	The SDKs encapsulate DPoP and acting-for binding; conformance test AZ-P6 and conformance suite with a fake agent for every adapter.	ADR 0026, M2-29, M2-31	M2
RK-10	Timing side channel in search: the duration also depends on hits in other people's channels.	low	low	Candidate limit, statement_timeout, rate limit rl.search; the probe phase of the search load test perf/search measures the time difference between a term only in unreadable channels and a term that occurs nowhere.	14, M3-14, M3-16	M3

Providers, adapters and API

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-11	Strict I1 prevents a second owner as long as personal agents exist.	high	medium	Guided flow resolve_i1 also for owner.add; owner question OQ-01.	10, ADR 0024, M2-21	M2
RK-12	Internals of Hermes Agent (call pattern of the progress hooks, steer, detection of the login type) are not a committed plugin API and change.	high	medium	Pin the version range; recording before the build; compatibility test against the pinned and the newest version; compatibility layer. Recording against the pinned version (plugins/hermes-adapter/tests/hermes_pin.toml) in every test run; it found: no call of format_tool_event, busy_input_mode only global, session ID through the hook pre_llm_call. Since M2-33 the stub contract test test_hermes_stubs_match_pinned_version compares every Hermes signature the adapter uses with the pinned version, and the Fake-Hermes scenarios run the adapter in the pinned gateway.	09, M2-32, M2-33	M2
RK-13	The evidence of the reported mode in Hermes Agent depends on a non-public surface. Wrong evidence routes organization traffic through a personal subscription (there, OAuth takes precedence over the API key).	medium	high	Check before every run; unknown aborts (billing_mode_mismatch, fail closed); the installer clears the OAuth variables in mode organization and checks the configuration; recording in M2-32 before the build. Recording in every test run; no public surface, Hermes' internal resolution is right in all profiles; the login file of Claude Code is used, switched off with auth.adopt_external_logins: false. Since M2-33 the credential test test_actual_mode_matches_used_credential proves against the pin (tests/hermes_pin.toml) that the mode the adapter reports equals the credential the model endpoint receives, and the stub contract test holds the resolver's signature.	10, ADR 0023, threat model T-AI-08, M2-32, M2-33	M2
RK-14	The Claude Code CLI changes stream messages, error texts, flags or the output of claude auth status.	high	medium	Pin the CLI version; fixtures from real recordings; test against the installed CLI; features from the init event; fake claude for doctor that stays fail closed on anything unknown.	09, 24, M2-34, M2-35, M2-42	M2
RK-15	The generated Python client throws on unknown enum values and event types; additive changes break SDK and adapter.	high	medium	Hand-written layer or own templates; tolerance fixture G5 in the gate.	ADR 0026, ADR 0014, M2-23, M2-29	M2
RK-16	The cost estimate differs from the provider's invoice (cache durations, regions, modes, price tiers).	high	low	Label "Estimate"; own unit for cache writes with a long duration; optional reconciliation as its own app.	10, ADR 0055, M2-22, M2-28	M2
RK-17	Misuse of an admin key of the provider in a break-in.	low	high	The key never lies in the server process, only in the reconciliation app; the reconciliation is off by default.	ADR 0055, M2-28	M2
RK-18	An agent invocation runs twice after a restart or a duplicate delivery.	low	high	Run start as compare-and-swap with jti; the runtime starts only after the commit; no automatic retry; tests AG-09 and AG-10.	04, ADR 0023, M2-09	M2
RK-19	High event load for agents, because every agent receives all visible channel events.	medium	low	Context via run.context.read instead of from the stream; performance targets of the agent path; an event filter at connect remains possible as an addition.	09, M2-36	M2
RK-20	Webhooks: the token of an incoming webhook in the URL ends up in proxy logs; receivers cannot verify Ed25519 (v1a) for lack of a library; the RateLimit headers change until the RFC.	medium	medium	Redaction rule for the path in server and proxy docs, rotation by creating a new webhook, rate limit rl.webhook_in; HMAC v1 can be switched on per subscription, with test vectors; send new headers in addition.	06, Webhooks, M2-26, M2-27	M2
RK-21	OpenAPI 3.1 is new or beta in the generators; the breaking-change check is missing until M7-11, because oasdiff cannot reliably handle 3.1; the large hand-maintained spec and generated tables drift apart.	medium	medium	Versions pinned; the gate generates and compiles all clients; markers for generated blocks with a comparison in the gate; breaking-change check with mutation fixtures in M7-11, until then review against 06 section 13.	06, ADR 0013, M1-17, M2-23, M7-11	M1
RK-83	GitHub or Jira change the format or signature of their webhooks (Jira announces this for the signature method); the reference apps then reject valid events.	medium	low	Apps read the method from the header and reject anything unknown instead of guessing; fixtures with source and retrieval date; own version and changelog per app, outside the server.	11 10, M2-49, M2-50	M2

Terminal

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-22	I6 rests on a declaration by the owner. The product cannot check the LLM login on a host; a subscription login in an unknown location, or one that someone creates during a session, stays undetected. Other people use it only if the separation of the session users falls (local privilege escalation), if a location connects the accounts again (a folder outside the configured paths that two session users can write, RK-88) or if the instance operator gives a previously assigned session user to another person after retiring and re-pairing the host or after losing the state directory; neither server nor host service checks that then (24 section 2.2).	low	high	One session user per person and host, never shared, no terminal without an assignment (Ruling T12, SR12); no shared locations, working directories and CLAUDE_CONFIG_DIR per session user, HD11 for every configured path (Ruling T13); declaration with step-up and audit; as an additional check, doctor (HD6) queries claude auth status and known login locations at start, before every PTY and periodically; on a contradiction no start and the end of all sessions; profile claude with a controlled environment; non-owners only on their own hosts (SR10); with organization a separate key per host with a spending limit, new after an access removal. Residual risk T-TM-08.	24 sections 2.2 and 7, ADR 0068, T-TM-08, T-TM-13, TM-T29, M2-40, M2-42, D-W-62	M2
RK-23	The host service runs on other people's hosts. A vulnerability in the host service, the pairing or the permission check gives a shell or root-level privileges. Starting the PTY as a second user without administrator privileges and without setuid is not proven for every platform (services under macOS and Windows), and ConPTY behaves differently from a Unix PTY.	medium	high	doctor refuses to start with administrator privileges or root-level groups; session users without read permission on the keys; outbound connection only; fresh step-up per opening; one-time token; no terminal on a platform without proof for it; own tests on Windows; conformance and chaos suite; red team for the terminal in M2, M4, M5 and M6; since M2-45 the PTY starts only in the helper of the session user, and every end of a session kills its whole tree at once (Linux cgroup, macOS run file and snapshots, Windows Job Object; D-M2-45-13).	24 section 2, threat model T-TM-03, T-TM-04, TM-T22, M2-42, M2-45, M2-48	M2
RK-24	A malicious instance operator of the server distributes their own host key and permits sessions; the end-to-end stream does not protect against them.	low	high	Pinning of the host key per device with a hard warning; audit and notification to all owners on re-pairing; option host_service.require_local_confirm. Residual risk T-TM-01.	24 section 5.1, ADR 0068	M2
RK-25	Stolen keys of the host service go unnoticed as long as the real host is off.	low	high	Block on a second live control connection; local confirmation for attended hosts; re-pairing.	24 section 3.4, T-TM-05	M2
RK-26	Long-running processes of a person (background processes, schedules, services) survive the person's access removal and keep running in their session user; through a local privilege escalation they could reach sessions of other session users, including those of an owner on another person's host.	low	medium	One session user per person, never reassigned (T12), console notice to take it out after the access removal and to delete it together with its long-running processes (locking alone does not end them, 16 section 4.4); non-owners only on their own hosts (SR10); process group, cgroup or Job Object per session; helper not replaceable (HD10); kernel.yama.ptrace_scope at least 1 under Linux; warning before the step-up for owners on another person's host; console notice after the access removal; disposable environments from V2.	24 sections 2.2, 6.5 and 8.4, T-TM-11, T-TM-12	M2
RK-27	The console is an attack surface for open sessions: browser extension, XSS or cross-site WebSocket hijacking of the stream path.	medium	high	Passkey with user verification per opening; CSP with Trusted Types; no HTML from output; origin check on upgrade, SameSite=Strict; no PTY without terminal session token and Noise key; recommendation of a separate browser profile. Residual risk T-TM-07.	ADR 0070, threat model section 5.16, M6-18	M6
RK-28	Little-maintained libraries: the Go library for Noise and the terminal renderer xterm; its semantics for screen readers and its behavior under Flutter Web are not proven.	medium	medium	Official test vectors; escape blocks before the renderer with own tests (TM-T14); license gate; fork possible; own semantics; M4-35 checks status and security advisories, M6-18 measures the web.	24 section 12, M2-38, M4-35, M6-18	M2
RK-29	A proxy without hash routing makes terminal sessions fail with several api nodes.	medium	medium	Operational requirement in 16; visible error and metric for unpaired relays; test TM-T15.	24 section 9, 16, M2-47	M2
RK-30	The holder's own long-lived subscription login in the account of the session user (token from claude setup-token) is not explicitly confirmed for interactive sessions and could contradict the provider's terms. The product itself does not touch the token (D-W-17).	medium	medium	M2-45 checked the provider docs before the build (2026-10-20, D-M2-45-1): both login routes are documented and none is restricted to non-interactive use; owner question OQ-03; fallback /login in a session or organization.	24 section 7.4, M2-45	M2
RK-84	The protection of the PTY helper against processes of the same user (memory protection, check of the peer via the process ID of the service manager) is proven only for Linux; under macOS and Windows a session user could tap or replace its helper and thereby read along in sessions of the same person. The same user ID can also change the data that the coding agent reads for HD6 (login only between two checks), and without host_service.claude_bin the keychain under macOS stays unchecked; since Ruling T12 this weakens only the additional check HD6, not the boundary between people, because every person has their own session user.	medium	medium	Requirements in 24 section 2.2 and HD10; one session user per person, never shared (SR12); HD6 only via host_service.claude_bin with a fixed search list, never via the PATH of the session user, HD10 also for folder chain and interpreter (24 section 7.4); TM-T26, TM-T27 and TM-T28 per platform in M2-42 and M2-45.	24 sections 2.2 and 7.4, T-TM-08, T-TM-12, M2-42, M2-45, D-W-57	M2
RK-88	A location that two session users reach connects their accounts again: settings, hooks or apiKeyHelper of the coding agent, CLAUDE.md or a program that one person writes and the session of another reads or runs. The code of the one then runs in the account of the other and reaches that person's files and login. HD11 checks only configured paths and the home including folder chain and chain files, not every folder of the host; an entry from a time when a location was open is found only at the next start of the service or call of doctor, an existing file changed back then not at all; a file that a later version of the coding agent additionally loads from the folder chain only after the list of chain files is extended.	low	high	Ruling T13: working directories and CLAUDE_CONFIG_DIR per session user (with personal only in the home), index of the working directory only in the own reported list, programs including folder chain owned by a trusted owner (under Windows SYSTEM, Administrators or TrustedInstaller), the profile claude with organization only with host_service.claude_bin; HD11 as one rule for every configured path after full resolution including folder chain and chain files before every PTY and periodically, "writable" including the creation of entries, under Windows with the drive root after bothy-host install; HD7 removes a working directory with two session users from both lists; installation without shared folders, exchange via git; instance operator step after a hit (16 section 4.4); M2-42 compares the list of chain files with the docs of the coding agent.	24 section 2.2, T-TM-13, TM-T29, M2-42, M2-45, D-W-62, D-W-68, D-W-80 to D-W-83	M2
RK-89	A person with terminal access brings a host with none or organization to a standstill for everyone by logging in with a subscription in their own account (HD6 ends all sessions, Ruling T2); without a pointer to the account, the instance operator searches for a long time. Second path: a chain file of this person in a folder on the path to the locations of others (for example C:\.git from the time before bothy-host install) makes HD11 fail for all others there. Third path: a long-running process of the person reopens the home of their former session user after bothy-host session-user remove, and HD9 refuses the start of the whole host.	medium	medium	The message of HD6 names every affected session user with its own entry, the console names the person of its assignment, also on a hit at start (the host service reports before ending, bothy-host doctor names the names on the host); a home that a person with terminal access opens blocks only that person (HD11), not the host; instance operator step in 16 section 4.4: remove the login in the named account, or end the assignment and take the session user out of the host service with bothy-host session-user remove (locking alone is not enough, because HD6 runs in every name from host_service.session_users); non-owners only on their own hosts (SR10); against the second path: folders on the path writable by no session user (HD11), under Windows bothy-host install closes the drive root, the message of HD11 names every blocked session user, the instance operator removes the entry (16 section 4.4); against the third path: the message of HD9 names every former session user with a readable home, and the instance operator deletes the user right after remove together with its long-running processes (16 section 4.4 item 1); an attempt to replace the PTY helper brings the host to a standstill through HD10, and the message names the session user of this channel (rule for names in 24 section 2.2). Honestly open: the standstill itself remains until the instance operator acts, the third path between remove and the deletion.	24 sections 2.2 and 7.4, T-TM-14, TM-T21, TM-T24, TM-T26, TM-T29 (i), M2-42, M2-45, D-W-64, D-W-67, D-W-80, D-W-88, D-W-91, D-W-109	M2
RK-90	The check of the entries by HD11 goes through the whole home of a session user. With a large home it takes longer than host_service.entry_scan_timeout; then this person gets no sessions after every start of the host service until the instance operator raises the value or makes the home smaller themselves with administrator privileges; without a session the person cannot reach their home. The default value is estimated, not measured.	medium	low	The check runs per session user, and only that user waits for it; the message names the user with the code entry_scan_timeout, and 16 section 4.4 names the instance operator step; M2-42 measures the duration on a large home per platform and adjusts the default value. Honestly open: until then the value can be too small for individual people.	24 sections 2.2 and 17, TM-T29 (e), M2-42, D-W-89	M2
RK-91	Compose pulls the server images by the tag BOTHY_VERSION from the bundle, not by digest. A tag in the registry can be moved: a second run of the release chain for the same server tag builds again and moves the tag to the new image, or someone with write access to the packages moves it. Portability test, staging and prod would then see different images.	medium	medium	The portability test pulls the server images itself before install.sh, checks the signature of each of their digests before anything starts, compares the images of the containers with the checked ones after the installation and names the digests in the result; staging records the digests, prod compares them and does not start on a difference; an image that the release chain did not sign does not pass cosign verify [derived: the signature applies per digest, 18 section 6]; in the workflows only the job build with environment release has write access to the packages. Honestly open: a newly built and signed image under the same tag is caught only by the comparison of the digests. Option for later: digests of the images in the bundle.	16 6.1, 16 11.1, 18 2.1, M7-10, M7-14, D-W-96, D-W-99	M7

Data, sync and performance

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-31	All writes with events queue up at the counter event_seq; WAL flush and NOTIFY limit the throughput of the whole instance. Capacity figures are still missing.	medium	high	Counter step last in the transaction; no external calls in transactions; run patches without the event log; performance gate perf.event_commit_min_per_s; metric for lock wait time; a new ADR if needed.	ADR 0009, ADR 0063, M1-16, M1-72, M7-18	M1
RK-32	Further serialization points: the audit hash chain serializes actions that require an audit entry; many viewers of a live box create load.	low	low	Only actions that require an audit entry write one, identical denials combined; patches only to focused threads and throttled.	05, 04, M1-24, M2-10	M1
RK-33	A restore brings back deleted data; GDPR deletions after the target point in time would be undone if the deletion journal and the backup retention period do not match.	medium	high	Deletion journal; bothy restore finalize re-runs completed deletion requests; startup check of privacy.deletion_journal_retention against the backup retention period; joint tests SEC-T15 and DP-T07.	20, 16, M7-04, M7-07	M7
RK-34	After a restore the new timeline overtakes old cursors, and clients silently skip events. Reduced by the sync epoch.	low	high	sync_epoch with resync_required; test in the restore test and in the portability test.	ADR 0059, 04, M7-04	M7
RK-35	In-transaction events make the control flow implicit; subscribers lengthen transactions or create backward edges.	medium	medium	Registration in one place only; phase guard with a static test; direction check; own span per subscriber.	02, M1-13	M1
RK-36	River is 0.x (breaking changes possible) and creates its own tables.	medium	medium	Only platform/jobs imports River; version pinned; own schema; updates via Renovate with an integration test.	02, M1-14	M1
RK-37	Several api nodes: rate limits apply per node, the presence state for notifications lives per node, ephemeral events must reach all nodes. Consequences are higher load, duplicate pushes or missing live indicators.	medium	medium	Divide the values by the node count or use affinity at the proxy (16 4.5). As built in M7-17: the shared presence state gateway_presence, written by every api node and read by the worker's push decision, with rows of a stopped node ignored after cluster.presence_ttl; NOTIFY ephemeral with IDs only for typing, live box, agent presence, device replacement (4017), consumer takeover and hints; fencing of the agent consumer via holder_session_id with 4015 at once on the takeover signal; one key store of the signing keys for all nodes. Not proven: behaviour behind a real load balancer and with more than two api nodes; command.autocomplete_requested reaches only an agent connection on the node of the request (02 11.6).	02 section 16, 13, M7-17	M7
RK-38	A change to the expressions of the search vectors rewrites the table messages, with downtime for large instances.	medium	medium	Maintenance window in the upgrade guide with a duration from the search load test, which measures the rewrite and the index build per million messages (make bench-search).	14, Upgrade, M3-16	M3

Platform services and clients

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-39	Extensions of the apps (Notification Service Extension, Android push) do not reach a server in a private network; notifications then show only the placeholder.	high	medium	Placeholder with the channel name from local knowledge; confirmation rate per platform as a signal; docs for instance operators; end-to-end encrypted push content as a later option.	13, ADR 0031, ADR 0056, M5-04, M5-05	M5
RK-40	App and extensions renew tokens at the same time, or a crash falls between rotation and storing; the reuse detection then logs the session out. Reduced by child sessions and a grace period.	low	medium	Child sessions for extensions; grace period auth.refresh_reuse_grace only with the same key; test ID-T16.	08, M1-34, M5-04	M1
RK-41	Re-encoding the previews loses quality or color fidelity (color profile, orientation, CMYK, large GIFs).	medium	medium	The original stays, with metadata removed losslessly; color profile and orientation mandatory, with tests; file.image.max_pixels and a time limit.	12, ADR 0047, M3-06	M3
RK-42	Presigned upload URLs may not bind the length of a part; a client stores more than announced.	medium	medium	Mode direct is the default; the presigned mode only after an integration test per S3 service; size and checksum always at the end.	12, M3-02, M3-03	M3
RK-43	A long outage of the virus scanner holds back attachments and agent invocations with attachments.	medium	medium	Status component degraded; alert after file.scan.pending_alert_after; after file.invocation_hold_max the invocation goes ahead with the attachment state, without content.	12, ADR 0033, M3-04, M3-07	M3
RK-44	The accessibility of Flutter on macOS is not sufficient (preliminary study, not checked by us).	medium	high	VoiceOver check before the first release for macOS; semantics tests per component.	01, M4-32	M4
RK-45	License and full-text search (FTS5) of the encryption library of the local database are not checked.	low	medium	Check in the ticket of the local database; license gate; fallback to another source.	ADR 0029, M4-12	M4
RK-46	End-to-end tests under Windows do not cover system dialogs (notifications, sharing).	high	low	Integration tests plus a manual checklist per release.	15, M4-34	M4
RK-47	The wide font styles truncate long German words in dense lists.	medium	low	Golden tests in German with large text scaling; truncation with tooltip; the compact density keeps the font size.	Typography, M4-07	M4
RK-48	The generated Dart file of the tokens is checked only against stand-ins for the Flutter types; accent variants per instance are not generated yet.	high	low	M4-03 generates and checks the variants, M4-04 compiles the file with the real SDK; until then only the default accent applies.	ADR 0030, M4-03, M4-04	M4

Operations, release and tools

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-49	New attributes or log texts bring content into the telemetry.	medium	high	Allow-list in the collector, checked in the gate against the signal catalogue; constant log messages enforced by a linter; canary test over all outputs.	17, ADR 0034, M1-04, M1-69	M1
RK-50	pgBackRest with TLS between database and backup service and with its own image is complex and error-prone.	medium	high	Integration test (archiving, backup, restore, check) on amd64 and arm64; fallback: repository on a shared volume plus a mirror to the off-site target.	ADR 0058, M7-01, M7-02, M7-03	M7
RK-51	One host carries everything: if it fails, the instance is down until the restore; the duration depends on the speed of the off-site target.	low	high	The restore test measures against dr.rto_target; local repository for a fast point-in-time restore; emergency runbook.	Disaster recovery, T-DS-01, M7-03	M7
RK-52	The container VM on a Mac has too little memory for the virus scanner or no /dev/net/tun for the Tailscale sidecar; Docker or Compose are too old for the features used.	medium	medium	Minimum values and version check in the installation step (docker compose config); profile scan can be switched off; portability test; fallback reverse proxy with OIDC.	Installation, M7-14	M7
RK-53	WebSocket over tailscale serve is not documented.	low	high	The portability test with profile tailscale explicitly checks the gateway.	Tailscale, M7-14	M7
RK-54	Names and translation rules change between versions of the Collector and Prometheus; alert thresholds drift away from the configuration values.	medium	medium	Versions pinned; otelcol validate, promtool and a name test in the gate; check "threshold equals configuration value".	Alerts, M1-04	M1
RK-55	Azure Monitor: whether the native OTLP ingestion is generally available and how it represents explicit histograms is open.	medium	low	Overlay marked as optional; check against a real environment only with approval of the costs.	Backends	M7
RK-56	Publisher model: every organization needs accounts, signing and a build chain for the apps; SmartScreen warns at first.	high	medium	Template distribution.yaml; release runbook; owner question OQ-08.	ADR 0037, 18, M7-12, M7-13	M7
RK-57	The release chain (build, signing, attestation, multi-arch) is untested as long as there are no components and no remote; the form of the version tags for the Go module under services/server differs from the rationale in 18.	medium	medium	The trial release (make release-trial, M7-10) runs the whole chain on the build host against a local registry with a throwaway key pair; the component contract turns missing parts into errors; M7-10 settled the tag form and corrected the rationale (18 section 2 rule 2).	18, ADR 0060, M7-10	M7
RK-58	Additions to the core contract are missing or are built differently; briefs that check chapters byte for byte shift with further follow-ups. Reduced: all requests of the teams are decided.	low	medium	If something is missing, the ticket ends with BLOCKED (P-11); M1-02 freezes the action catalogue only at the base commit; alignment according to P-24.	Plan section 19, M1-02, M1-03	M1
RK-59	The pre-push with a full make check takes a long time; developers bypass it with --no-verify.	medium	medium	CI checks identically; bypassing is a documented process error; component gates skip without code.	Push discipline, ADR 0038	M1
RK-60	Docs tools: Material for MkDocs is in maintenance mode, the security commitment ends on 2026-11-11 at the earliest, and Zensical is still before 1.0; Mermaid loads from a CDN in the site; the ELK layout may not render there.	medium	low	Versions pinned in the lock; rendered SVGs with the design theme in the repository (make diagrams); switch according to the three triggers from ADR 0045 (D-W-42).	ADR 0045, V3-14	M1
RK-61	Accepted findings of the OSV scanner for the Node tools expire on a fixed date (tools/node/osv-scanner.toml) and turn make osv red.	high	low	Intended: the expiry forces a reassessment; Renovate proposes fixes.	Gates	M1
RK-62	The built-in profile names of SonarQube change; the alignment of the profile aborts.	medium	low	Parent profile configurable; the alignment reports the missing name instead of choosing silently; check after every update.	ADR 0040, M0-07	M1
RK-64	go-arch-lint is no longer maintained.	low	low	The configuration is generated from the module register; the generator can generate depguard rules instead.	ADR 0050	M1
RK-65	If the visibility of the repository is missing in an event payload, the public jobs (CodeQL, Scorecard, Pages) do not run.	low	low	Fail-safe: no run; trial run in the publishing checklist.	Publishing, ADR 0039	V1
RK-82	The setup wizard is loaded with curl and piped directly into the shell; a manipulated script or bundle would run with the privileges of the instance operator.	low	high	HTTPS only, version and SHA-256 of the bundle built into the script, script signed and in SHA256SUMS like every artifact; verification path before execution documented; no sudo, no package installation; manual path equivalent.	16 3.1, M7-29	M7
RK-85	The review proof before the push is a local file; a build session can write it itself instead of starting an independent reviewer.	medium	high	The hook checks file and verdict, not independence; the pull request names the reviewed commit and the verdict (section "Review"; the raw report stays local, LG/1) and the overall review of the milestone checks it; the plan requires a fresh session without build context (PLAN 3.9). Honestly open: independence cannot be proven by machine.	red-team-gate.md, R-QA-13	M1

Statistics, visualization and showcase

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-66	Inference about individual people through runs in channels with only one person (performance monitoring).	medium	medium	No triggering people and no per-person counters in statistics and live stream; switch stats.live_enabled; entry in the co-determination table.	25 section 4, 20, T-VZ-03	M6
RK-67	The minute aggregates of the own measurement grow strongly with many channels and agents.	medium	medium	Only rows with values; no tool names; daily partitions, detached after retention.stats_minutes; load test measures rows per day and flush duration.	25 section 3.5, 03, M6-05	M6
RK-68	Own measurement and Prometheus show different SLO values (errors at the proxy are missing in the process, lost counters on a crash); viewers distrust the traffic light.	medium	low	Label "Own measurement"; the same thresholds from the Sloth files via generator and check (VZ-T03); losses counted; alerts stay in Prometheus.	25 section 3, M6-11	M6
RK-69	The optional Grafana embedding in the console fails in the browser or opens clickjacking if the instance operator configures the proxy wrongly.	medium	medium	Off by default; bothy config check warns on a different site; test SEC-T19 with a test proxy; docs of the headers; apps never embed.	25 section 9, ADR 0069, T-VZ-01	M6
RK-70	Two implementations of the same views (Dart in the apps, TypeScript in the plugin) drift apart visually and in content; own primitives cost more than a library.	medium	low	Tokens for both generated from one source; plugin deliberately limited to metric views; review list of the components; R-VZ-10.	25 section 8, Components, M6-12, M7-25	M6
RK-71	The unsigned Grafana plugin produces warnings and does not run in Grafana Cloud; the kiosk mode of Grafana is not confirmed against the docs.	high	low	Provisioned locally, allowed only with this plugin ID; owner question OQ-20; M7-25 checks the kiosk mode against the Grafana version in use.	25 section 8, M7-25, M7-26, V3-17	M7
RK-72	Screenshots and video of the apps for macOS and iOS can only be made on a Mac; without a reachable Mac the showcase is delayed.	medium	low	The recordings are scripted against the demo instance and reproducible with a manifest; never against real data.	Plan section 13, M7-27, M7-28	M7

Migration, publication and dev environment

ID	Risk	Likelihood	Impact	Mitigation	Reference	Check
RK-73	If the import bot lacks the permission for message content, the result is an import full of empty messages.	medium	medium	The preflight check aborts in this case.	22, M8-04	M8
RK-74	Half-finished agent outputs are copied during parallel operation.	medium	low	Settle rule with lookback; spot checks.	22, M8-05	M8
RK-75	Costs of taken-over sessions are booked twice, because the runtime reports cumulative totals.	high	low	Cost baseline per session (cost_baseline_micros); in personal mode amounts are information only.	22, 03, M8-06	M8
RK-76	Many error responses from the source lead to a block of the address, which also hits other bots on the same host.	low	high	No retry on 401 and 403; avoid the channel after 403; waiting times on rate limits capped; separate import bot.	22, ADR 0043, M8-01	M8
RK-77	With the first push the history becomes visible: old sample values that gitleaks reports, and internal identifiers in old commits.	high	high	History scans make denylist-history and make gitleaks GITLEAKS_LOG_OPTS=--all; only a commit without parents is published, the planning history stays private (step 2 of the checklist, D-W-93), and the scans run in a fresh clone of this commit (step 3); git filter-repo (M0-08, D-W-48) only if a history is published after all; red team before the switch; after the switch denylist-main.yml checks every push to main. The commit identity is decided (Decided).	Going public, ADR 0042, M0-08, V1-04	M0
RK-78	The working name collides with a trademark after publication.	low	high	Name only in the places from ADR 0044, listed by a test; professional search before publication (OQ-16).	ADR 0044, V1-06	V1
RK-79	Placeholders OWNER remain in files after the switch.	medium	low	V1-03 replaces them; a test finds every remaining hit.	Plan section 15, V1-03	V1
RK-80	The dev isolation is cut down to a separate user in the same operating system; a shared kernel and a shared HOME share permissions and LLM logins.	low	high	Isolation only with a hypervisor boundary (Ruling L20); guard rule SR3; red team P3 per kind of environment.	21, ADR 0046, V2-05	V2
RK-81	Apple limits the number of running macOS VMs per Mac; isolated macOS environments on a Mac host suffice for only a few people.	high	low	Linux VM per person as the default, macOS VM only when needed, cloud VM equivalent (R-DV-02).	21	V2
RK-87	Rendered diagram SVGs no longer match their source, because someone changes an .mmd and does not render again; a byte comparison is not possible because of the browser version.	low	low	render_diagrams.py --write stamps every SVG with the SHA-256 of .mmd and theme; make diagrams reports every SVG without a matching stamp as stale (D-W-56), plus theme, aspect ratio and ERDs against 03. Remainder: a hand-edited SVG with an old stamp; review.	quality/gates.md, D-W-39, D-W-56	M0

Done

Risks from the reports that a later decision eliminated.

Risk	Done through
The Notification Service Extension needs the DPoP key without biometrics.	Two device keys: DPoP without confirmation per signature, step-up with confirmation (08, Ruling L10).
The owner finds the palette too dark or too monochrome.	Design accepted by the owner (Open questions).
Configuration names overlap between chapters.	One source per name; the configuration reference is generated and rejects duplicate names.
Sample secrets in openapi.yaml and an outdated ADR index make the gates fail.	Sample values in token format without secret-like values; ADR index regenerated and checked in the gate.
The deny list blocks every commit because of the commit identity.	The chosen identity is allowed only in the author and committer fields (owner decision, see Decided).
New diagrams are not in the repository and are not covered by make diagrams.	Committed; make diagrams renders them.
Requested additions to the core contract (tool class, dev environments, acting-for binding, permission preview) are not adopted.	Adopted; for the rest see RK-58.
RK-63 and RK-86: risks from operating own runners and from runs in the private state.	Only GitHub-hosted runners, the repository is public from the first push (ADR 0039, D-W-92).