docs(m164): sign-in events record the caller's address, not the proxy's

[indykish]

What

Changelog entry for the client-IP attribution fix landing in agentsfleet#601.

X-Forwarded-For and Fly-Client-IP were read under capitalised names. httpz lowercases header names in place while parsing and req.header is an exact lookup with no case folding, so both reads returned nothing on every request and the derivation fell through to the raw connection peer.

Why it needs an entry

Four user-visible consequences, all on the auth surface:

• The XFF-spoofing detector could never fire — client_ip_divergent was false on every event emitted.
• The session replay fingerprint (sha256(address || user-agent || session id)) had a constant address component, so a session presented from elsewhere behind the same proxy fingerprinted identically and was served the cached payload instead of being refused.
• The seven session audit events recorded the load balancer, with client_ip_source reading tcp_peer regardless of what the request carried.
• created_from_address on core.cli_credentials recorded the proxy, not the operator.

Verified wired into production at session_helpers.zig:45, not test-only.

Checks

• make lint — exit 0, no broken links
• Voice: one headline, **Bold lead-noun** bullets, no marketing words, load-bearing facts kept verbatim, history append-only

🤖 Generated with Claude Code

Greptile Summary

Adds an Aug 15, 2026 changelog entry explaining the corrected attribution of sign-in activity to the caller’s address rather than the proxy.

• Documents restored forwarded-header divergence detection and session replay protection.
• Describes corrected client-IP metadata across session audit events.
• Notes that credential creation now records the operator’s originating address.

Confidence Score: 5/5

The documentation-only change appears safe to merge.

The new entry follows established changelog syntax, ordering, tags, and terminology, with no concrete build, rendering, or content-consistency failure identified.

Important Files Changed

Filename	Overview
changelog.mdx	Adds a structurally consistent security and bug-fix entry with no identified documentation, rendering, or repository-convention issues.

_{Reviews (1): Last reviewed commit: "docs(m164): sign-in events record the ca..." | Re-trigger Greptile}