Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
T16 · Approval and role revocation races remain authorised
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software |
| Layer / kind | API · database · race injection |
| Priority | P0 |
| Gates | A04, A06 |
| Build step | Step-03-Policy-Pipeline-and-Isolation-Harness |
| Decisions | Q07 |
Given
An approver has an active session and a prepared publish/accept transaction.
When
Revoke/downgrade membership before command authorisation; separately test a command already committed before revocation.
Then / oracle
Commands authorised after effective revocation fail without changes. Previously committed actions remain historical facts; future access is denied. Locking/version strategy supplies a documented authorisation/commit boundary, not a promise to recall completed work.
Evidence required
Controlled interleavings; membership version and commit audit; no post-boundary access.
Decision dependency (verbatim)
Q07: define in-flight transaction boundary and session invalidation semantics.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.