Skip to main content

L1 — System Context

Who uses Rewhaven, and what it talks to.

Co-parent = full admin (MVP-1). A MemberKind.coParent is a full isParental admin — it unions the same _adminCaps as a parent via the admin role. There is no delegated / limited-scope co-parent for MVP-1; scoped delegation (a co-parent with a reduced capability subset) is a possible post-MVP option, not a current actor.

Child self-signup (SHIPPED). A child can now initiate their own onboarding path; the child-auth Edge Function issues the account and the expire-pending-children Edge Function prunes stale pending-consent records. Both are first-class server-side actors in Supabase Edge Functions. The pendingConsent RLS freeze holds the account in a restricted state until a parent presents a consent token.

Why / changed from the POC: Rewhaven is offline-first — the device store is a first-class system, not a cache of last resort — with the cloud (Supabase) optional per product tier. Household-scoped RLS isolates each family. The AI recommender is scoped but not yet built (dashed). See the POC domain gap analysis and the rebuild spec.

Planned external actors (dashed — per 2026-07-18 sovereign engine and relationship track review):

  • Therapist / Sovereign Clearance recipient (planned) — a scope-limited, time-boxed RLS share token grants a therapist read access to a child's relevant data. No persistent external account; token expires on schedule.
  • E2EE user-owned backup (planned) — encrypted exports owned by the household; the backup target (e.g. iCloud / Google Drive) is a planned external actor outside Supabase.