Counterexample: a connector grant is revoked at epoch 8, but an import message created under epoch 7 is delayed. The primary store deletes its copy, then the delayed consumer writes a derived card back into a cache. Every component “worked,” yet the system did not converge on revoked. Revocation needs a protocol, not a broadcast best effort.
The motivating news is OpenAI’s July 23, 2026 Health in ChatGPT announcement. OpenAI says rollout is to eligible logged-in US users age 18+ on web and iOS, with supported medical-record and Apple Health connections; the dashboard can cover labs, medications, activity, sleep, and other health information. OpenAI states connected data and relevant conversations are not used to train foundation models or target ads. These are attributed claims from the primary announcement, not evidence about internal architecture or deletion behavior.
Assumptions and invariant
Assume at-least-once event delivery, independently retrying consumers, temporary partitions, caches, derived views, and no global transaction. Policy defines which objects must be deleted, retained, or detached; the protocol must carry that decision without inventing it.
The central invariant is:
For grant G at revocation epoch E,
no component may make data authorized only by any epoch < E readable,
and every in-scope component eventually acknowledges E or is fenced.
Safety (“no stale reappearance”) and liveness (“eventual acknowledgement”) require separate acceptance checks. Liveness without safety can converge after a leak; safety without liveness can leave the operation permanently ambiguous.
Protocol envelope
{
"operation_id": "rv_82a",
"grant_id": "g_7f2",
"epoch": 8,
"policy_version": "retention-12",
"requested_at": "2026-07-24T10:15:00Z",
"scope": ["imports", "derived_views", "cache"],
"event_id": "evt_c91"
}
Each component stores the highest epoch seen per grant. Events below that epoch are rejected before read materialization or write commit. Equal epochs are idempotent. A deletion tombstone must outlive the maximum credible delay of stale work, or another durable fence must prevent resurrection after tombstone compaction.
Consent service -> log: REVOKE(G,E)
log -> importer/cache/deriver/store: apply E
component -> receipt store: ACK(G,E,result,policy_version)
coordinator: COMPLETE only when required ACK set is satisfied
coordinator: FENCE component when deadline expires
An acknowledgement should report opaque object counts and result class, not health content. “Required ACK set” must be versioned so adding a new materialized view does not silently leave old coordinators unaware of it.
Event-order fixtures
The following table is an unexecuted failure-injection plan:
| Injected order/failure | Required property |
|---|---|
| delayed import arrives after tombstone | stale write rejected |
| duplicate revoke events | same terminal state and no duplicate side effect |
| cache partition during revoke | cache fenced from reads until epoch applied |
| consumer crashes after delete before ACK | retry observes tombstone and safely ACKs |
| new derived-view service omitted from membership | completion rejected by registry-version mismatch |
| retention policy requires one object | retained object detached from revoked grant as specified |
A minimal simulator can model each component as {highest_epoch, readable_objects, acked_epochs} and randomly permute delivery, crash, retry, and partition actions. Check after every transition that no readable object has authorization_epoch < highest_epoch; after healing and bounded delivery, require every registered component to reach epoch 8.
Tradeoffs and acceptance
| Choice | Benefit | Cost |
|---|---|---|
| per-grant epoch | local stale-event rejection | metadata grows with grants |
| durable tombstone | prevents resurrection | compaction becomes policy-sensitive |
| read fencing | preserves safety during partition | temporary unavailability |
| complete ACK registry | observable convergence | membership coordination |
Release only if all enumerated event orders preserve safety and all healed runs converge within the declared operational deadline. The denominator must be all registered components and all in-scope object classes, not only services that responded.
This design is not a claim about ChatGPT’s systems, APIs, retention, compliance, encryption, or revocation semantics. It does not determine which information policy permits retaining and cannot validate medical data. OpenAI describes Health in ChatGPT as support rather than replacement for medical care, and not diagnosis or treatment. The protocol addresses distributed authorization state only.
The counterexample to keep testing is simple: which delayed writer can recreate readability after the coordinator has already said “complete,” and should that writer be rejected, replayed under new authority, or compensated?
AI assistance disclosure: This article was drafted with AI assistance and reviewed against the cited primary source.
Top comments (0)