08 — Risk Register
Reviewed at every phase gate. Likelihood and impact use Low / Medium / High. “Trigger” is the observable signal that the risk is materializing.
| ID | Risk | L | I | Mitigation | Trigger |
|---|---|---|---|---|---|
| R-01 | Word layout cannot be matched closely enough. Word’s algorithm is unpublished; some behaviors may resist black-box discovery. | H | H | Fidelity Lab with probe-driven studies and Word Behavior Notes; prioritize by corpus frequency; publish honest scores; Fidelity Inspector warns users. Tier A/B guarantees do not depend on this. | Line-break agreement plateaus below target for two consecutive studies. |
| R-02 | No open metric-compatible font for key Microsoft fonts, above all Aptos (Word’s default), Cambria Math, and common East Asian defaults. | H | H | Font gap programme (ADR-0010): commission OFL metric-compatible fonts (legal review first), honor fonts the user legitimately has installed, organization font library, embedded fonts. | CORE-008 audit confirms gaps; corpus share of Aptos documents rises. |
| R-03 | Scope explosion. Word has thousands of features; the plan could stall on the long tail. | H | H | Phase gates, coverage matrix prioritized by measured corpus frequency, rolling-wave planning, explicit non-goals. | A phase overruns its estimate by 50%. |
| R-04 | Desktop and web interfaces drift apart, doubling work and confusing users. | M | H | All logic in core; shared UI manifest drives ribbon, menus, shortcuts and declarative dialogs; parity test per release. | A feature ships in one shell without the other. |
| R-05 | CRDT model complexity: concurrent edits produce structures that are invalid or surprising to users. | M | H | CORE-004 spike with property-based convergence testing; deterministic normalization; Word-shaped model so merges match user intuition; Loro behind an adapter so it can be replaced. | Convergence or normalization failures in randomized tests. |
| R-06 | End-to-end encryption design flaw (key distribution, device addition, revocation, metadata leakage). | M | H | Use the MLS standard and a maintained library; no custom cryptography; cross-signed device keys; threat model; external audit before collaboration GA. | Audit findings; protocol review questions agents cannot answer. |
| R-07 | Browser-delivered code undermines E2EE (a malicious server can serve malicious JavaScript). | M | H | Desktop app as the highest-assurance client; reproducible web builds with published hashes; follow web-app integrity/transparency standards as they mature; self-hosting removes third-party trust. | Standards mature; or a hosting partner appears. |
| R-08 | WebAssembly limits (memory ceiling, single thread, download size) hurt large documents in the browser. | M | M | Worker architecture; lazy fonts and images; tile caching; budgets in CI; adopt 64-bit memory and threads when broadly available. | Budget failures on the 1,000-page reference document. |
| R-09 | Canvas-based web editing is hard for input methods and screen readers. | H | H | EditContext where supported with a hidden-input fallback; accessibility DOM mirror; IME and screen-reader test matrices from Phase 0; testing with real assistive-technology users. | IME or screen-reader failures in WEB-002 or later. |
| R-10 | Legal exposure: trademarks (“Word”), Office UI trade dress, font metric cloning, use of Word for testing, corpus copyright and privacy. | M | H | Clean-room rule; nominative trademark use only; distinct visual identity; legal review before releasing metric-compatible fonts; private corpus never redistributed; Word used only on a licensed machine. | Any legal notice; before first public release. |
| R-11 | Owner bandwidth: one non-expert owner reviewing agent output becomes the bottleneck or misses defects. | H | H | Strong CI gates; separate reviewer sessions; small WPs; architecture reviews every 10–15 WPs; plain-language hand-offs; recruit human experts for cryptography, accessibility and typography. | PR review backlog > 2 weeks; repeated post-merge defects. |
| R-12 | Agent-generated code quality: plausible but subtly wrong code, especially in layout and cryptography. | H | H | Tests with evidence, property-based tests, fidelity metrics, mandatory security reviews for sensitive paths, spikes before commitments. | Regressions caught late; reviewer rejects repeatedly. |
| R-13 | Supply-chain attack through crates, npm packages, CI actions or toolchains. | M | H | ADR-0017: minimal dependencies, exact pins, 24-hour minimum age, scripts disabled, audits, SHA-pinned actions, provenance, alerts. | Advisory affecting a dependency; suspicious publish. |
| R-14 | Dependence on Microsoft Word for ground truth (licensing terms, automation changes, version drift). | M | M | Pin the reference build; archive ground truth with build numbers; re-baseline deliberately; use Word’s own lastRenderedPageBreak hints as a secondary signal. | Word update changes outputs; licensing changes. |
| R-15 | Performance on huge documents (1,000+ pages, many tables) breaks latency budgets. | M | H | Incremental layout from the first layout WP; background pagination; benchmarks with budgets in CI. | Benchmark failures. |
| R-16 | VBA expectations: users expect macros to “just work”. | H | M | Set expectations clearly (staged plan in ADR-0023); preservation guarantees; measured translation coverage. | User feedback after Phase 2 beta. |
| R-17 | Key dependency abandoned (CRDT, shaping, PDF, MLS library). | M | M | Prefer actively maintained, multi-maintainer projects; adapters at boundaries; willingness to contribute upstream or fork. | No releases for 12 months; maintainer announcements. |
| R-18 | Funding for unavoidable costs (code signing, Apple developer account, Microsoft 365 for the lab, audits, font commissioning, CI for macOS/Windows if private). | M | M | Owner checklist cost list; open-source grant programmes; free OSS offerings (code signing, CI for public repos). | Costs exceed budget. |
| R-19 | Default branch confusion: the first branch pushed to an empty repository becomes its default. | H | L | Owner renames or creates main and sets it as default (owner checklist item 1). | Repos show a claude/… branch as default. |
| R-20 | Accessibility left too late, forcing redesign of the canvas architecture. | M | H | Accessibility tree in core and both bridges in Phase 0–1 spikes; screen-reader reading is a Phase-1 exit criterion. | Spike reports gaps. |
| R-21 | Server metadata leakage undermines the sovereignty promise even with encrypted content. | M | M | Encrypt titles and folder structure; minimize stored metadata; document residual leakage honestly; padding and batching options later. | Threat-model review. |
| R-22 | Layout changes between releases break user expectations (“my 40-page contract is now 41 pages”). | M | M | Layout epochs; regression gate on corpus; release notes list fidelity changes; collaboration sessions enforce one epoch. | Fidelity gate flags changes on user-reported documents. |
| R-23 | Post-quantum MLS code points are not assigned before collaboration launches. ADR-0016 (amendment 2026-10-04) requires the hybrid post-quantum suite from the first release, and provisional code points are forbidden for persistent groups. | L | H | Collaboration is planned for Phase 3 and the IETF draft entered Working Group Last Call on 2026-10-01; SRV-002 measures the hybrid suite early; the Phase-3 gate decides between delaying the beta and a classical launch with a warning and migration. | IANA has not assigned the code point at the Phase-2 gate. |
| R-24 | A vulnerability in AWS-LC, the C library under the server’s TLS (ADR-0028), affects the server. | L | M | rustls parses all TLS messages and certificates in Rust and the server uses AWS-LC only for cryptographic operations; Dependabot security alerts start the ADR-0017 security-alert session; end-to-end encryption limits the exposure to metadata, credentials and tokens; the provider can be swapped in one place. | An advisory affecting AWS-LC code that rustls uses. |