ENGINEERING INDEX / ENTRY 17
CASE 17 / CARE ACCESS / REVOCATION
Leaving the circle must actually stop access.
Removing someone from a shared care space cannot be a cosmetic roster change. Old access and pending nudges need to stop.
When an adult is removed from a child's care circle, what prevents stale access and reminders?
Where the handoffs happen.
A soft-revoked row remains as a tombstone. Tests show the former member loses the child's view, cannot rejoin through a fresh code or erase the tombstone, and no longer has live reminders; completed history remains.
- 01Guardian revokes member
- 02Persist revoked status
- 03Deny reads and re-invite
- 04Cancel live reminders
What the record earns.
Revoked access, re-invite refusal, and live-reminder cancellation tested.
- Observed receipt
- On September 25, 2026, APTSU soft-revoke integration tests passed within a 33-test integration/security batch.
- Source and scope
- APTSU connection API/repository and tests/integration/test_soft_revoke.py; dirty checkout HEAD 930369a at inspection.
What this does not prove.
The tests use local API fixtures. They do not prove push-provider cancellation after a notification has already left the service, nor a deployed family outcome.
Where the work goes next.
Trace revoke through the dispatcher and device state, including an already queued notification and a recoverable user-facing explanation.