ADR 0001 — Zero-knowledge E2EE for all health data

Status

Accepted

Context

Owner's governing requirement: reduce blast radius on server compromise — the operator must never be able to read or decrypt any user's health data. The predecessor (Bobs-lifebot/README) was server-readable; "customer keys we never store" was auth-secret hygiene, not data encryption.

Decision

All health payloads are encrypted on the client before upload. The server stores ciphertext, per-user salt, an AEAD verifier, and wrapped keys only. Server-side aggregation, search, and AI over health data are forfeited by design; dashboards and coaching run client-side.

Consequences

• A hacked server yields no readable health data; crypto-erasure = destroy the wrapped key.
• All value logic (aggregation, coach context) moved into shared client packages.
• No server password reset — recovery key (user-held) is the only mitigation; UX must state it.
• GraphQL deferred: its server-side aggregation benefit is void when the server can't read data.