audit-log (C): retire `export` / `import` / `permission_change` from the `sys_audit_log` action enum and its in-repo consumer surfaces (ADR-0087 registration)

[hotlong]

Sub-issue C of #7675, split by the triage seat (session session_01GiG1DfMysjbbFLZErAo93G, 2026-08-12) carrying the maintainer ruling of 2026-08-12 (comment 5261744983 on #7675). This is the retirement half, and it is the upstream of the ordering chain — the two consumer-shrink cards are Blocked-by: this one.

Ruling carried (verbatim, binding — not re-adjudicable)

退役(3 个):export / import(无此 feature)与 permission_change(权限对象的写入已以 create/update 行入账,语义重复行不再造)从 enum、两个 list view、两个 dashboard widget、console ACTION_OPTIONS 中一并摘除;按 ADR-0087 登记退役。
原则记录:空 widget + 永远查不到东西的过滤器是可见产品缺陷;审计面宁窄勿谎。

Routing correction, verified against origin/main (this supersedes the seat table on #7675)

The identity seat's split-request table placed the enum in packages/spec. Measured false: the action enum lives at packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts:101, and spec's own CHANGELOG records "the sys_audit_log object definition in plugin-audit is the row-shape source of truth". git grep over packages/spec finds no audit action enum. There is no domain:spec member in this split; this card routes domain:identity because plugin-audit is an identity-lane package.

Scope (this repo, this card)

• Remove export, import, permission_change from the action enum (sys-audit-log.object.ts:101).
• Narrow the auth_events list view filter (sys-audit-log.object.ts:65) from ['login','logout','permission_change'] to ['login','logout']. The config_changes view stays (it becomes truthful via sub-issue B).
• Regenerate plugin-audit's generated translation artifacts (os-regen discipline — do not hand-edit).
• ADR-0087 retirement registration for the three values.

Consumer-fixture flag (named, per the fixture-triage rule)

packages/services/service-analytics/src/__tests__/raw-sql-object-routing.test.ts:149,210 seeds rows with action: 'permission_change'. Run the service-analytics tests and update those fixtures in this PR — a seeded value the enum no longer accepts must not linger as a green-looking lie.

Downstream (⛔ not this card)

• Widgets in packages/platform-objects → sub-issue D (domain:metadata), Blocked-by this card.
• Console ACTION_OPTIONS + HistoryTimeline badge maps → objectui sub-issue, Blocked-by this card.
• Note: sub-issue A may also touch plugin-audit — same-lane serialization; do not run A and C in flight together.

Size/model suggestion: M, opus.

[os-zhuang]

Claim: domain:identity execution seat #6022 — session session_01PEVB6w7D7uCszR9Mw1BL73, branch claude/issue-8147-audit-action-enum-retire. Dispatching now (mode:subagent, M / opus per the card's own suggestion).

File surface declared: packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts (enum :101, auth_events view filter :65), plugin-audit's generated translation artifacts (os-regen — regenerated, never hand-edited), the ADR-0087 retirement registry, and packages/services/service-analytics/src/__tests__/raw-sql-object-routing.test.ts (the named consumer fixture at :149,210).

Serial constraints honoured:

• ⛔ Sub-issue A (audit-log (A): add login/logout writers on the auth session hooks, and attribute the unattributed last_login_at update row #8144) is not in flight and will not be dispatched until this lands — the card's own same-lane plugin-audit serialization. A is additionally chained behind PR fix(plugin-auth): run the D5.1 /oauth2/authorize env-access gate for a signed bearer (#8102) #8175 (auth-manager.ts).
• Downstream D (domain:metadata, platform-objects widgets) and the objectui console card are Blocked-by this one and are not this seat's to dispatch.
• Zero overlap with this lane's four in-flight surfaces (plugin-auth/auth-manager.ts, plugin-sharing, platform-objects read-only probe, examples/app-crm).

The routing correction in the card body (enum lives in plugin-audit, not packages/spec) is carried into the dispatch as measured fact, and the dev is told to re-verify it against origin/main before editing rather than trusting either the card or this comment.

---

Generated by Claude Code

[os-zhuang]

⚠️ 升级给 maintainer —— 裁定中 import 一项的前提被实测证伪。PR #8200 只落了三个里的两个,Part of 而非 Fixes,合并它不得关闭本卡。 domain:identity 执行席位 #6022,session session_01PEVB6w7D7uCszR9Mw1BL73。

⛔ 本席位不改裁定,也不替裁定挑一边。 呈上测量,请裁。

裁定的前提

退役(3 个):export / import(无此 feature)与 permission_change……

export 与 permission_change 两项前提成立,已在 #8200 落地。import 那半句 无此 feature 与代码不符。

证伪的证据(实测,非推断)

仓库里 sys_audit_log 只有两个写入者:

写入者	词汇表
plugin-audit/src/audit-writers.ts	actionFor() 只映射出 create / update / delete
plugin-auth/src/admin-import-users.ts	action: 'import',run 级,record_id: null

且 packages/qa/dogfood/test/admin-identity-audit-trail.dogfood.test.ts 的 W4 用例断言这一行存在(record_id: null、metadata.event === 'user.import_run')。所以 import 不是"没有 feature 的死值",而是平台今天确实在写的值。

为什么这件事必须停下来问,而不是顺手照办

退掉 import 会让 enum 拒绝一个平台正在写入的值 —— 而且是静默地拒绝:validateRecord 在 insert 时跳过 readonly 字段,而这个对象每个字段都是 readonly,所以没有任何东西会拒绝这次写入,也没有任何东西会变红。

结果是 written-but-not-declared(行存在、契约否认它)。对审计面而言,这比本卡要修的 declared-but-never-written 更糟 —— 后者是"查不到东西的空过滤器",前者是"审计契约对已发生的事实撒谎"。⚠️ 而且 config_changes 是唯一列出这些行的已发布视图。

dev 的 ablation 顺带暴露了一件更值得记的事:ADR-0087 的登记不被任何门与现实交叉核验(check:spec-changes / check:upgrade-guide / check:authorable-surface 在恢复被退役值后全部保持绿色),service-analytics 的 fixture 也不是这次退役的探测器。唯二的机械探测器是新加的 pin test 与 i18n bundle 棘轮。也就是说:如果没有人去读 admin-import-users.ts,把 import 退掉会一路全绿地落地。

请裁的问题

import 是否保留在 sys_audit_log.action enum 中?

• 保留(dev 与本席位读到的事实所指向的):裁定的其余两项已落地;本卡改为"退役两个";config_changes 视图保持列出 import 与 config_change。
• 仍退役:则需要同批处理 admin-import-users.ts 的写入者与 W4 用例,否则平台会写入一个契约不承认的值。这是一件更大的事,且与"审计面宁窄勿谎"的原则记录方向相反 —— 但这是裁定者的判断,不是我的。

⚠️ 下游两张卡的口径依赖这个裁定

#8148(packages/platform-objects widget)与 objectui#4476(console ACTION_OPTIONS / HistoryTimeline)目前都按**"三个退役值"立的口径。若维持 dev 的发现,两张都要改成两个** —— 把 import 从 console 的徽章映射里删掉,会让真实存在的行渲染成没有标签。裁定前不要让那两张按三个口径落地。

---

Generated by Claude Code