Implementation review: PB-065, PR 721

Field	Value
Backlog item	PB-065 Separation of duties by signed-in identity (feature FEAT-GOV-04)
Pull request	#721, merged as 394c9711
Package	None (PB-065 has no pr-ready package; #721 was built as HD-030 / EP-5 of the hardening backlog)
Reviewer	Engineering quality review thread. It didn't write #721.
Date	2026-10-26
Environment	Linux container, main b5ca9711, Python venv for the engine. No tenant, no Windows, no second PC.

Outcome#

Accepted with Documented Limitations (recommended).

The one acceptance criterion is met with tests that fail on the code before #721. The check still isn't a security boundary, its switch is still in environments.toml (the rest of HD-030), and it hasn't been tried with two real PCs and one Entra account.

Recommended by: Engineering quality review. Decided by (product owner): Chris, "I accept all 4" on 2026-10-26 (project message cmsg_018T4o2pQdpbLBNhHpgVNNGpREfN9JPWyocAdUEQR2tzj9), which took this outcome.

Acceptance criteria#

#	Criterion (copied from the backlog item)	Result	Evidence
1	The same Entra user on two PCs is recognized as one person	Met	`test_the_release_record_names_the_promoters_entra_id` (sidecar/tests/test_duties.py): pat promotes to Test signed in, then on another PC login ("patricia") with the same Entra object id the Prod check says someone else has to promote it. `test_separation_matches_on_the_entra_id_or_the_login` covers the rule (ids compared without case). Swapping in the pre-#721 `duties.py`, `meta/promote.py`, `meta/release.py` and `meta_service.py`: both tests fail, the 6 older ones pass.

Checks#

Check	Result	Evidence or note
Scope matches the item	Met	The release record (`release.record`, and `rollback_record`) adds `identity.object_id` when signed in; `_duties_gate` compares it with the signed-in id and keeps the login-name match, so a second account on the same login doesn't pass either. A note says when only login names could be compared.
New tests fail without the change, pass with it	Met	As criterion 1.
Full suites pass (pytest, UI, cargo)	Partly	`pytest tests/test_duties.py tests/test_release.py tests/test_rollback.py tests/test_silent_except.py`: 45 passed on main. No UI or Rust change; cargo isn't buildable in this container.
Reachable where docs say; Preview behavior right; packaged into the engine	Met	Metadata > Promote to Prod with `separate_promoter = true` (docs/metadata-guide.md). Engine-only change.
OneLake data safety	Met	The only new write is the `object_id` in the release receipt that promote and rollback already write to `meta.deployments`. Rows written before #721 read as "no id" (`recorded_object_id` returns None), and the check falls back to login names with a note.
Authentication and distribution	Met	No new scope or sign-in: `_signed_in_object_id` reads MSAL's cached account (`auth.signed_in_object_id`, the object id part of `home_account_id`) and never starts a sign-in.
No unproven claim; docs honest about limits	Met	metadata-guide.md says it's a team process check, not a security boundary, that a shared login counts as one person, and that whoever edits `environments.toml` can turn it off.
Docs match the code; linked; strict docs build passes	Met	metadata-guide.md (release record `by` and the separate promoter section) matches `separation_problem` and `separation_note`. zensical build --strict clean.
Accessibility of new controls	n/a	No new controls; the note shows in the existing promote card.
Inventory and backlog updated; `product_data.py` consistent	Partly	#721 changed FEAT-GOV-04's limitation in the Markdown only; #772 and #773 put it in the JSON. FEAT-GOV-04's next action still says to compare signed-in identities. PRODUCT_BACKLOG.md still lists PB-065 as Proposed (line 1331).

Findings#

#	Severity (blocking / should fix / note)	Finding	Where	Status
1	should fix	FEAT-GOV-04's next action ("Keep; compare signed-in identities rather than PC login names") is done; the remaining step is taking the switch from platform policy or versioned files (HD-030).	docs/product/FEATURE_INVENTORY.json	Open: product data owner
2	note	`signed_in_object_id` uses the first cached MSAL account. With several accounts cached, it could name one that isn't the one signed in to Fabric. The login-name match still applies.	sidecar/fabric_desktop/auth.py `signed_in_object_id`	Open: low risk, a team check
3	note	The id is MSAL's home object id. A guest (B2B) user is the same person on every PC, so the rule holds, but the id isn't the one the resource tenant shows for them.	auth.py	No change needed
4	note	PB-065's backlog state is still Proposed although #721 implemented it.	docs/product/PRODUCT_BACKLOG.md line 1331	Open: set it with the product owner's decision

Documented limitations (only for Accepted with Documented Limitations)#

Limitation	Where users are told	Backlog item that tracks it
A team process check, not a security boundary; whoever edits `environments.toml` can turn it off.	docs/metadata-guide.md (separate promoter section); FEAT-GOV-04 known limitations	HD-030 (switch from platform policy or versioned files), PB-101
Not tried with two real PCs and one Entra account.	FEAT-GOV-04 verification is Partially Verified	The tenant smoke test (FD-101, readiness gate G1)

Inventory and backlog changes#

Features changed: FEAT-GOV-04: limitation and #721 in the JSON (#772, #773); next action to update (finding 1).
Backlog item state: PB-065 Proposed → Accepted, on the product owner's decision.