ENGINEERING INDEX / ENTRY 07
CASE 07 / HUMAN SYSTEMS / PRIVACY BY QUERY
Care is not a leaderboard.
When several adults care for the same child, a shared screen can easily turn help into attribution and comparison. APTSU separates shared child state from personal history at the data-access layer.
How can a shared care view show what a child needs without ranking the adults around them?
Where the handoffs happen.
Shared reads use an allowlist and reject attribution columns. The security suite parses client-facing SQL, checks that forbidden person handles do not reach the output, and fuzzes allowed and forbidden column combinations. Personal views are deliberately separate and user-scoped.
- 01Shared view request
- 02Allowed-column projection
- 03Forbidden identity check
- 04Attribution-free state
What the record earns.
10 no-scoreboard query-layer tests passed in the latest focused run.
- Observed receipt
- On September 25, 2026, all 10 focused no-scoreboard tests passed in the current APTSU working tree, including structural SQL checks, discovery of known shared reads, and property-based column tests.
- Source and scope
- APTSU SharedKidView, related client-facing repositories, and the no-scoreboard security suite. The inspected APTSU tree has other uncommitted changes; the test result is for that working state, not a pinned release.
What this does not prove.
The tests cover the known query emitters and specified policy. They do not prove every future endpoint or UI is safe, nor establish production privacy compliance or a deployed family outcome.
Where the work goes next.
Add a redacted shared-versus-personal response trace and re-run the guard against a pinned release before public promotion.