ADR 0004 — Anthropic client-side coach

Status

Accepted

Context

Bobs-lifebot uses Bedrock Haiku server-side. Admin-blind E2EE means the server has no plaintext stats to build coach context. Sending plaintext through a server BFF re-exposes data to the host on that hop.

Decision

Prefer client-side Anthropic calls: browser unlocks vault → builds aggregated summary → calls Anthropic. Server must not persist coach context as plaintext. Optional BFF only if it does not log/store bodies (still weaker).

Consequences

• Better privacy vs host.
• Friends may need an API key strategy (shared host key via careful BFF, or user key) — document in Settings.
• No Bedrock/AWS required on ThinkCentre for coach.