# FinanceManager Read-only Adapter for JARVIS Command Dashboard

Use this pattern when exposing FinanceManager status into a higher-level command dashboard without exposing financial details.

## Policy

- Default mode must be `mock`.
- Live mode must be explicit: `FINANCE_ADAPTER_MODE=live_readonly` plus `FINANCE_API_BASE_URL`.
- Disabled mode should return a safe degraded snapshot.
- `ALLOW_EXACT_FINANCE_VALUES=1` remains forbidden for MVP and should fail config validation or be ignored with exact values still blocked.

## Allowed live endpoints for first slice

Use only safe HTTP GET endpoints:

- `/api/health`
- `/api/provider/status`
- `/api/runtime/status`
- `/api/system/status`
- `/api/budget/import-status-audit`

Avoid richer overview endpoints until proven redigierbar. In particular, do not directly surface command-center/overview payloads if they may contain amounts, accounts, transactions, portfolios, budgets, category totals, file paths, or provider secrets.

## Safe visible facts

Only derive status-level information:

- module status
- review item count
- provider connected yes/no/unknown
- runtime reachable yes/no
- import-audit warning/error/ok
- safe timestamp if no path/identifier is embedded
- source health metadata

Everything else is dropped, not renamed.

## Forbidden output

Never expose exact amounts, balances/saldo, account names, IBAN/account numbers, transaction text/rows, revenue/expense, portfolio values, budget/category amounts, CSV/XLSX/PDF paths, SQLite/runtime/local paths, Drive links, tokens, passwords, API keys, OAuth or credentials.

## Testing

Use dirty fake FinanceManager responses containing forbidden fields and assert the final `ModuleSnapshot` and `/api/overview` text do not contain them. Add resilience tests: FinanceManager offline still returns HTTP 200 from Jarvis `/api/overview` with Finance `offline`/`degraded` and redacted error text.

## Smoke

A real live smoke is optional and must be explicit because FinanceManager must be running locally. If `FINANCE_API_BASE_URL` is unset, report that exact reason and do not claim live validation ran.