Implementation review: PB-054, PR 694

Field	Value
Backlog item	PB-054 Screens for platform revoke and source list (feature FEAT-MESH-01)
Pull request	#694, merged as 8abae160
Package	None (PB-054 has no pr-ready package)
Reviewer	Engineering quality review thread. It didn't write #694.
Date	2026-10-26
Environment	Linux container, main b5ca9711, Python venv for the engine, Playwright Chromium for the browser tests. No tenant.

Outcome#

Accepted with Documented Limitations (recommended).

The one acceptance criterion (revoke with a confirm, audited) is met. The other half of the proposed capability, a sources list, isn't built: platform_sources still has no caller in the app. Revoke is on the product's page, not Platform > Access as proposed. It hasn't run against a tenant's UDF_Platform.

Recommended by: Engineering quality review. Decided by (product owner): Chris, "I accept all 4" on 2026-10-26 (project message cmsg_018T4o2pQdpbLBNhHpgVNNGpREfN9JPWyocAdUEQR2tzj9), which took this outcome.

Acceptance criteria#

#	Criterion (copied from the backlog item)	Result	Evidence
1	An admin revokes a grant with confirmation and it is audited	Met	app/tests/browser/product-access.test.cjs (3 tests): the owner takes access away after a danger confirm that says an existing link stays; Cancel takes nothing away; someone who isn't the owner or an admin sees the list with no button. With the pre-#694 `app/ui/platform.js` all 3 fail; with main's, they pass. Audit: `core.revoke_grant` writes a `revoke access` row to `catalog.audit`. My probe, run as a platform admin who isn't the owner, revoked the grant and read back `('chris@example.com', 'crm/c360', '{"project": "ledger"}')`. A non-owner was refused. `platform_revoke` isn't in `audit.READ_ONLY`, so the engine's own audit log records the call too.

Checks#

Check	Result	Evidence or note
Scope matches the item	Partly	Revoke: done, on OneLake > Data products > the product > Access given. Sources list: not built (`platform_sources` stays in `NO_UI_CALLER`, sidecar/tests/test_rpc_surface.py).
New tests fail without the change, pass with it	Met	As criterion 1.
Full suites pass (pytest, UI, cargo)	Partly	product-access.test.cjs 3/3; `pytest tests/test_rpc_surface.py tests/test_platform.py`: 42 passed. The rest of the UI and engine suites weren't rerun for this record; #694 changes no Rust.
Reachable where docs say; Preview behavior right	Met	docs/platform.md names the path and the Preview tag; the card shows `previewTag()`.
OneLake data safety	Met	Revoke deletes one `catalog.grant` row. Nothing changes in OneLake, and the confirm and the "How this works" panel say so. Both also say that existing links keep reading, and platform.md says how to stop reads (remove the OneLake data access role).
Authentication and distribution	Met	No new scope. The page hides the button from anyone but the owner or an admin, and the catalog checks again (`revoke_grant` raises "Only the product's owner or a platform admin can take access away").
Destructive confirm (UI rules)	Met	`confirmDialog(..., { danger: true })`, naming the project, the product and what stays.
Docs match the code; linked; strict docs build passes	Met	docs/platform.md and docs/data-mesh.md match `productAccessCard`. zensical build --strict clean.
Accessibility of new controls	Met	Real `<button>` and `<table>` with header cells; the confirm is the shared dialog.
Inventory and backlog updated; `product_data.py` consistent	Not met	FEAT-MESH-01 still lists "platform_revoke has no UI" as a known limitation, and #694 isn't in its pull requests. PRODUCT_BACKLOG.md still lists PB-054 as Proposed (line 699).

Findings#

#	Severity (blocking / should fix / note)	Finding	Where	Status
1	should fix	FEAT-MESH-01's limitation "platform_revoke has no UI" is out of date; it should name the missing sources list instead, and list #694.	docs/product/FEATURE_INVENTORY.json	Open: product data owner (edit the JSON, then render)
2	note	No automated test checks the `revoke access` audit row; the probe above shows it's written. One assert in test_platform.py's request test would keep it.	sidecar/tests/test_platform.py	Open: optional
3	note	The button shows by comparing the owner field with the user `platform_whoami` returns. When the two don't match, an owner sees the list without the button, and the server still decides.	app/ui/platform.js `productAccessCard`	No change needed
4	note	PB-054's backlog state is still Proposed.	docs/product/PRODUCT_BACKLOG.md line 699	Open: set it with the product owner's decision

Documented limitations (only for Accepted with Documented Limitations)#

Limitation	Where users are told	Backlog item that tracks it
No sources list in the app yet.	FEAT-MESH-01 known limitations, after finding 1	A follow-up for the sources list (PB-054's second half), to be raised by the product owner
A revoked project's existing links keep reading until its OneLake data access role is removed.	docs/platform.md, the confirm, "How this works"	None: by design
Not run against a tenant's `UDF_Platform`.	FEAT-MESH-01 next action (verify on a tenant)	The tenant smoke test (FD-101, readiness gate G1)

Inventory and backlog changes#

Features changed: FEAT-MESH-01: replace "platform_revoke has no UI" with "No sources list in the app"; add #694 (finding 1).
Backlog item state: PB-054 Proposed → Accepted, on the product owner's decision, or kept open for the sources list.