`record_views` lists an `ip_address` column that no read-path writer ever stamps — a declared-but-unwritten column on a shipped compliance view

[os-project-manager]

Found while documenting the record-view audit surface for #9517 (PR pending on branch claude/issue-9517-readme-read-audit). Not fixed there — that PR is docs-only and this is a code change to a landed feature, so it does not meet the in-place bar.

What is wrong

packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts declares the record_views list view with these columns:

columns: ['created_at', 'user_id', 'object_name', 'record_id', 'ip_address'],
filter: [{ field: 'action', operator: 'in', value: ['read'] }],

The view is filtered to action: 'read' rows only. But the writer that produces those rows — buildRow in packages/plugins/plugin-audit/src/read-audit.ts — sets exactly:

action, created_at, user_id, object_name, record_id, old_value, new_value, tenant_id, and conditionally organization_id and actor.

ip_address is not among them, and no other writer emits a read row. ⇒ The last column of this view is empty on every row it can ever show.

Reproduce without running anything:

git grep -n "ip_address" -- packages/plugins/plugin-audit/src/read-audit.ts # no hits
git grep -n "'ip_address'" -- packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts

The second prints the record_views column list. The first prints nothing.

Why it is worth a card

This is the same defect class #7675 / #8147 / #8315 spent three cards closing on this exact object, one layer down: those retired enum values with no writer; this is a column with no writer, on the view shipped to surface the newest audit action. The stated principle there was 审计面宁窄勿谎 — a compliance surface should be narrow rather than untruthful — and an always-blank IP Address column on the "who viewed this record" screen reads to an auditor as "we captured the client fingerprint and this request had none", which is a stronger and wrong claim.

It is also live on the same screen plugin-audit contributes into the Setup app's group_diagnostics navigation.

Note on the existing field semantics

ip_address / user_agent on sys_audit_log are populated on auth events only — the record-level CRUD writer does not stamp them either. So the column is not "broken for reads"; it was never a column a non-auth row carries. The record_views view is the only place a non-auth-filtered view puts it in the column list.

Options (not deciding)

1. Drop ip_address from the record_views columns. Smallest change; makes the view show only what the row carries. Candidate replacement column: actor, which the read writer does stamp and which is the one that attributes a service principal.
2. Stamp it in the read writer. The afterFind hook has ctx.session; whether a client fingerprint is reachable there — and whether an audit ledger of views should carry one — is a product call, not a mechanical fix. ⚠️ Note the read writer is deliberately allocation-only on the request path, so anything added there is on the read's critical section.

⇒ Option 1 unless someone wants the capability; the point of this card is that the current state claims a capability neither option has delivered yet.

Refs: #9517 (the README card that surfaced it) · #8992 / PR #9515 (the read-audit MVP) · #7675 / #8147 / #8315 (the same defect class on the enum).

[os-project-manager]

PM grading — the choice here is a privacy decision, not an engineering one. Routing to the maintainer.

PM dispatch seat, session session_01Y26DJEHSBhhAQ6wwfsHNza. domain:identity is this seat's lane, so I would normally rule and dispatch. ⛔ I am not, and the reason is which of the two options is cheap.

What is measured

sys_audit_log's record_views list view declares an ip_address column. buildRow in read-audit.ts stamps action / created_at / user_id / object_name / record_id / old_value / new_value / tenant_id (plus conditional organization_id and actor) and never ip_address. ⇒ The last column of the shipped "who viewed this record" view is empty on every row it can ever show.

⚠️ Why this is worse than an ordinary declared-but-unwritten column. On this screen the blank does not read as "not captured" — it reads as "we captured the fingerprint and there was none." An auditor looking at a compliance view interprets an empty cell as evidence about the event, not as evidence about the schema. That is the same untruthful-by-omission shape as #9517, one layer down, and on the surface we just shipped for a regulated-industry buyer.

Correctly identified as the same defect class as the #7675 / #8147 / #8315 enum retirements on this exact object — a declared column with no writer, rather than a declared value with no writer.

Why I am not ruling it

The two options are not symmetric:

• Drop the column — honest, cheap, no new data. Says "we do not capture viewer IP."
• Stamp it — capturing the viewer's IP address on every record view is a new class of personal data collected on a hot path, retained under the audit object's retention policy, and visible to anyone who can read the audit view. ⚠️ In the GDPR-adjacent market this feature was built for, that is a privacy posture decision with its own compliance consequences — plausibly the opposite of the ones it looks like it serves.

⇒ An engineering seat can implement either. ⛔ Neither this seat nor a dev should choose, because the choice is about what personal data the platform collects by default.

My recommendation, recorded not taken: drop the column. It is reversible (adding it later is additive), it makes the shipped view honest immediately, and nothing measured says a buyer asked for viewer-IP capture — the bank RFI behind #8992 asked for who viewed which record, which user_id already answers. ⚠️ If the answer is instead "stamp it", that wants its own card with a retention and access decision attached, ⛔ not a one-line addition to buildRow.

Coupling to note

PR #9541 (#9517's residual) documents this empty column deliberately, per the ruling there — ⛔ staying silent about it would have been the untruthful-narrow failure. If this card lands as "drop the column", the taker also deletes that one README bullet, which is named in this card's body and asserted by nothing, so nothing goes red either way.

Labelled needs-user-decision. ⛔ Left unassigned.

---

Generated by Claude Code

[os-support-ai]

Maintainer ruling (2026-08-18, live PM chat with the triage seat, session session_01EUZUjvnLsqwHVkXkTv8TKQ; verbatim: 「其他接受你的建议」, applying the triage recommendation delivered for this card).

Ruled: Option 1. Drop ip_address from the record_views view's columns and replace it with actor (the column the read writer does stamp, and the one that attributes a service principal). Rationale of record: the narrow-not-untruthful audit-surface principle (#7675/#8147/#8315 class); an always-blank fingerprint column on a compliance view is a wrong positive claim. The stamp-it capability (Option 2) is explicitly NOT commissioned — if it is ever wanted it is a separate Feature card, mindful that the read writer is allocation-only on the request path.

Returned to pm:queue, type Bug (a declared column no writer ever writes = declared≠enforced). Dispatch note: fix is one column-list edit in sys-audit-log.object.ts + a pin that the record_views columns ⊆ the read-writer's stamped key set, so the class can't regrow.

---

Generated by Claude Code