The ClawBot→Maestro cutover is done — sales generation, review and send all run on AWS now — so the old VPS-era risks (SPOF, duplicate rows, secret sprawl) are mitigated. These are the live ones for the post-cutover estate. Severity is the user-visible impact if the risk fires; likelihood is current, not post-mitigation.
| ID | Risk | Severity | Likelihood | Status |
|---|---|---|---|---|
| R-01 | Dual send-worker — legacy n8n “AWS Send Worker (Maestro)” still active alongside the (now-inert) maestro_sender Lambda — both poll the same approved queue, while the live sender is actually the message-dispatcher Lambda | Critical | Medium | Live (gated) |
| R-02 | Real email now reaches real clients — email went live 2026-07-30 (Governor sendDevelopmentMode=false); the send gates are live Governor config with no deploy, so the barrier is a flag anyone with governor:update can flip | Critical | Medium | Live |
| R-03 | Legacy n8n send-worker is not in the SSOT — the Status kill-switch can’t reach it | High | Confirmed | Open |
| R-04 | BO-25 sequencing hazard — deleting SSOT Enabled before the consumer is Status-only = total silent outage | Critical | Low | Mitigated |
| R-05 | Governor fail-closed — a Hub outage now silently stops all outbound drafting | Medium | Low | Accepted |
| R-06 | Dual send leaves a deceptive failed status — the n8n worker marks tasks failed while the Lambda delivers | Medium | Confirmed | Open |
| R-07 | daniel@ service account has no domain-wide delegation — sends as daniel@ 401 | Low | Confirmed | Known |
| R-08 | Held-task resurfacer is inert — the EventBridge rule is DISABLED + RESURFACER_DRY_RUN=true, so deferred tasks never re-surface until the human flip | Medium | Low | Phase-2 |
What breaks: more than one worker can consume the same approved task. The live sender is now the SQS-based message-dispatcher (the Unified Sender). If the legacy n8n AWS Send Worker (Maestro) is still polling /queue/approved, the same approved task can be delivered twice to the client — and it can also leave a deceptive failed status, the n8n worker marking a task failed after the dispatcher already delivered it.
Why it’s live: the plan was to retire the legacy n8n worker once an AWS sender became the sole sender — that retirement hasn’t been confirmed. The inert maestro_sender Lambda (dry-run + EventBridge rule DISABLED) is a third, dormant poll worker on the same /approved queue.
Mitigation: consolidate to ONE sender. Confirm the n8n worker’s current state in n8n and deactivate it — the SQS dispatcher is the intended sole sender. Its exact live state is n8n config, not in these docs.
What breaks: the message-dispatcher Lambda (the live Unified Sender) delivers to real prospects. The master gate is armed (globalSendEnabled ON, the no-deploy Governor equivalent of SEND_DRY_RUN=false) and, since 2026-07-30, the email sandbox is OFF: sendDevelopmentMode=false means email is no longer redirected to developmentTestEmails — it goes to the real recipient.
Why it’s live: the send gates moved into the Governor config (PR #533), so they are edited from /admin/governor with no deploy. Anyone with governor:update can arm or disarm real sends instantly — there is no PR/deploy checkpoint. Slack is live too (sendSlackEnabled ON); WhatsApp stays off (sendWhatsappEnabled OFF).
Mitigation: treat /admin/governor as production. (allowedInboxes is a routing allowlist — the 5 DWD-verified reps who can send as the rep — it limits the sender, not the recipient, so it is not a client-safety gate.) Rollback = set sendDevelopmentMode=true (email back to test inboxes) or globalSendEnabled OFF (all channels dry-run). These values drift with no deploy — always read the live config, never a doc.
What breaks: the SSOT Enabled checkbox is slated for deletion (BO-25). If it’s deleted while the consumer still reads it, every playbook reads enabled=falsy and the consumer skips all generation — a total, silent outbound outage.
Why it’s live: the consumer kill-switch historically gated on BOTH Status and the Enabled checkbox.
Mitigation: #268 decoupled the kill-switch to Status-only (deployed PR #275) — Enabled is now safe to delete. Use Status (Deprecated / Paused / Back to Drawing Board / etc.) to stop a playbook; un-checking Enabled no longer halts it. Verify the field is no longer read before deleting.