ADR 0004 — Client-side AI coach on Gemini

Status

Accepted

Context

A cloud LLM coach cannot read E2E-encrypted data server-side, and routing plaintext summaries through our server (a "no-log proxy") would break the zero-knowledge promise in memory, logs, and traces. Owner chose Gemini as the coach model.

Decision

Coaching runs on the client: decrypt locally → build a minimised summary on device → call the Gemini API directly with a short-lived scoped credential minted by the API's coach-cred module (which never sees prompts). Paid tier only (Google does not train on paid-tier data); disclosure is consented and minimised. v0 ships a rule-based stand-in with the same interface so the swap is local to packages/client/src/coach.ts.

Consequences

• The Lifebot server is never in the plaintext path — a server hack exposes no coaching data.
• Residual trust moves to the LLM vendor, bounded by paid-tier terms + DPA; on-device models are the future path to remove even that.
• Spend control is enforced via credential scope/expiry (per-tenant caps land with the control plane).