---
name: finance-agent-planned-2026-06-21
description: Financial tracking agent (US Bank via Plaid) planned but DEFERRED until VPS migration completes. Keyless-display architecture; bank creds never touch a server.
metadata: 
  node_type: memory
  type: project
  originSessionId: cd07777c-8add-4afc-9cb9-9113caa0331f
---

Cameron asked on 2026-06-21 to plan a finance-tracking agent that monitors his US Bank account. Full design in `vault/fleet/agents/finance/overview.md`. **Not built; deferred to post-migration.**

**Why deferred:** bank credentials cannot live on the shared lab box (daily scrollback → git → GitHub vector that already burned PATs and sudo passwords this session). VPS migration is the prerequisite.

**Recommended architecture (Option A in the design doc): keyless display.**
- Mac is the ONLY host with Plaid credentials. Stored in `~/.config/finance_fetcher/.env` chmod 600.
- launchd job on Mac fetches every 4h, POSTs JSON snapshot to omidhub `/api/finance/ingest` with bearer auth.
- omidhub renders dashboard + answers voice queries from the snapshot JSON. Has zero bank credentials.
- Claude never sees raw bank credentials. Period.

**What I rejected (Option C — "let Claude handle Plaid keys"):** Claude writes code that can `cat` any path it knows about. A future tool-call printing the key to chat = scrollback leak. The mechanical failure mode is well-established.

**Open questions for Cameron (after migration done):**
- Just US Bank, or also Schwab / Coinbase / etc.?
- Plaid's category taxonomy good enough, or custom rules?
- Net-worth scope: just liquid, or property/crypto/etc.?
- Privacy: IP-allowlist `/finance` to Cameron's Tailscale only, or password-gate?

**How to apply:**
- Do NOT start building this on the lab box. Wait for cutover.
- When Cameron says "let's start the finance agent" post-migration, send him the open-questions list first, then proceed with Option A.
- If asked to scope on a different bank, note: most US banks have NO public consumer API; Plaid is the universal intermediary. Some banks may not be supported (check Plaid's institution list).

**Costs:** Plaid Development tier ~$0.30/account/month. Trivial.