# ADR 0006 — Health Summary API vs Direct SQLite Bridge

**Status:** Accepted as direction; implementation deferred  
**Date:** 2026-06-13

## Context

HealthManager currently has no identified HTTP API. It is script/report/runtime oriented. The JARVIS Dashboard needs safe Health summary data without exposing raw health records.

Allowed Health contract data:

- runtime present yes/no
- pipeline status
- report freshness
- backup freshness
- review count as number
- Apple Health sync aggregated later

Forbidden:

- lab values
- PDF contents
- Drive links
- local paths
- document names
- doctor report contents
- symptoms/diary/nutrition texts
- raw Apple Health/YAZIO data
- using `verify_system.py` directly as dashboard backend

## Option A — small HealthManager read-only Summary API

HealthManager exposes a tiny read-only API that returns only the approved summary contract.

Pros:

- clean domain ownership
- no direct DB knowledge in Jarvis Gateway
- easier testing inside HealthManager
- safer evolution of Health schema

Cons:

- requires HealthManager implementation work later
- one more local service or script endpoint to operate

## Option B — JARVIS Gateway reads read-only SQLite with strict COUNT/mtime allowlist

The Gateway temporarily reads only explicit count/metadata queries from Health runtime.

Pros:

- faster MVP bridge
- no immediate HealthManager service work

Cons:

- Gateway learns Health schema details
- higher risk of accidental raw-data leakage
- requires very strict query allowlist and tests

## Decision

Option A is the long-term target and preferred architecture.

Option B is allowed only as a temporary MVP bridge if all conditions hold:

1. SQLite read-only URI is used.
2. Only explicit COUNT-/mtime-style queries are allowed.
3. No raw columns are returned.
4. Every query is tested against Forbidden Fields.
5. The frontend never sees SQLite, runtime paths or local filenames.
6. Adapter output is only `ModuleSnapshot` with summary fields.

## Consequences

Phase 2A documents the contract only. No Health DB is opened, no adapter is implemented.