[dustinbyrne]

💡 Motivation and Context

Like PostHog/posthog-python#1039, a worker consuming shared feature flag definitions should not need a privileged secret key. Existing initialization gates prevent that supported cache-consumer configuration from evaluating flags locally.

Changes

• Permit the configured definition cache provider to supply definitions without a secret/personal API key.
• Keyless consumers read the shared cache directly, without invoking the fetch-decision callback or publishing definitions. They cannot claim fetch leadership they are unable to use.
• With privileged credentials, retain the existing decision flow: false reads the cache; true fetches definitions and publishes them. Direct definition requests remain authenticated.
• Add public-entry regressions, update active credential/provider docs, and include scoped patch release metadata.

Cache-only readers bypass the shared loader specification's decision-first provider step; credentialed consumers retain that step.

Existing public local-only evaluation and reload paths work through the existing definition poller; no provider-specific evaluator bypass is needed.

💚 How did you test it?

• Full root-module tests and race suite: passed, including 541 top-level tests and their subtests.
• go test -json -race -count=10 -timeout=5m -run 'TestFlagDefinitionCache' ./...: passed.
• go build ./..., go vet ./..., make api-diff and gofmt checks: passed.
• Public-entry and shared-lease regressions fail against the prior loader and pass with the fix; readers never claim leadership, while keyed publishers refresh definitions.
• Root-module validation only; nested modules are unchanged.

Release scope

Patch release for posthog-go. Existing signatures, capture defaults and wire formats are unchanged.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Implemented with Pi worker agents and reviewed by separate fresh-context Pi reviewers. A simplify pass covered the scoped source/tests/docs before final local validation. Human review remains required.

[github-actions]

posthog-go Compliance Report

Date: 2026-10-10 04:17:29 UTC
Duration: 168786ms

✅ All Tests Passed!

111/111 tests passed

---

Capture_V1 Tests

✅ 94/94 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	19ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	14ms
Required Headers.Has Authorization Bearer Header	✅	4ms
Required Headers.Has Content Type Json	✅	4ms
Required Headers.Has Posthog Sdk Info Format	✅	3ms
Required Headers.Has Posthog Attempt Header	✅	4ms
Required Headers.Has Posthog Request Id	✅	4ms
Required Headers.Has Posthog Request Timestamp	✅	3ms
Required Headers.Has User Agent	✅	4ms
Body Format.Body Has Created At And Batch	✅	4ms
Body Format.No Api Key In Body	✅	3ms
Body Format.No Sent At In Body	✅	4ms
Event Format.Event Has Required Root Fields	✅	3ms
Event Format.Event Uuid Is Valid	✅	4ms
Event Format.Event Timestamp Is Rfc3339	✅	3ms
Event Format.Distinct Id Is String	✅	4ms
Event Format.Distinct Id At Root Not Properties	✅	3ms
Event Format.Custom Properties Preserved	✅	4ms
Event Format.Set Properties Preserved	✅	3ms
Event Format.Set Once Properties Preserved	✅	4ms
Event Format.Groups Properties Preserved	✅	3ms
Event Format.Sdk Generates Uuid If Not Provided	✅	4ms
Event Format.Event Has Required Root Fields Batch	✅	5ms
Event Format.Event Uuid Is Valid Batch	✅	5ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	5ms
Event Format.Distinct Id Is String Batch	✅	5ms
Event Format.Distinct Id At Root Not Properties Batch	✅	15ms
Event Format.Custom Properties Preserved Batch	✅	5ms
Event Format.Set Properties Preserved Batch	✅	5ms
Event Format.Set Once Properties Preserved Batch	✅	5ms
Event Format.Groups Properties Preserved Batch	✅	5ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	5ms
Batch Behavior.Multiple Events In Single Batch	✅	27ms
Batch Behavior.Batch Envelope Smoke	✅	6ms
Batch Behavior.Flush With No Events Sends Nothing	✅	2ms
Batch Behavior.Flush At Triggers Batch	✅	1005ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	5ms
Deduplication.Generates Unique Uuids	✅	10ms
Deduplication.Different Events Same Content Different Uuids	✅	6ms
Deduplication.Preserves Uuid On Retry	✅	5131ms
Deduplication.Preserves Timestamp On Retry	✅	5133ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5135ms
Deduplication.No Duplicate Events In Batch	✅	28ms
Header Behavior On Retry.Attempt Header Starts At One	✅	4ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	10134ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	5133ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	2011ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	5133ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	5ms
Response Format Validation.Success Response Has Ok For Each Event	✅	25ms
Response Format Validation.Success No Retry After When All Ok	✅	25ms
Response Format Validation.Success Retry After Present When Retry Events	✅	127ms
Response Format Validation.Success No Retry After When Drop Only	✅	26ms
Response Format Validation.Response Echoes Request Id	✅	4ms
Retry Behavior.Retries On 408	✅	5132ms
Retry Behavior.Retries On 500	✅	5133ms
Retry Behavior.Retries On 503	✅	5134ms
Retry Behavior.Retries On 504	✅	5133ms
Retry Behavior.Retryable Errors Have Retry After	✅	2130ms
Retry Behavior.Respects Retry After On Retryable Error	✅	8133ms
Retry Behavior.Does Not Retry On 400	✅	2131ms
Retry Behavior.Does Not Retry On 401	✅	2130ms
Retry Behavior.Does Not Retry On 402	✅	2131ms
Retry Behavior.Does Not Retry On 413	✅	2131ms
Retry Behavior.Does Not Retry On 415	✅	2129ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2131ms
Retry Behavior.Implements Backoff	✅	15133ms
Retry Behavior.Max Retries Respected	✅	15133ms
Partial Batch Handling.Handles 200 Full Success	✅	2008ms
Partial Batch Handling.Handles 200 With All Ok	✅	3029ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3029ms
Partial Batch Handling.Does Not Retry Limited Events	✅	3029ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	5134ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	5133ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	5133ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	5133ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	5133ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	5133ms
Partial Batch Handling.Respects Retry After On Partial	✅	5134ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3029ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	3031ms
Compression.Sends Gzip Content Encoding	✅	14ms
Compression.No Content Encoding When Disabled	✅	5ms
Compression.Compressed Body Is Decompressible	✅	4ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2129ms
Event Options.Cookieless Mode Override	✅	5ms
Event Options.Disable Skew Correction Override	✅	4ms
Event Options.Process Person Profile Override	✅	4ms
Event Options.Product Tour Id Override	✅	4ms
Event Options.Unset Options Omitted	✅	4ms
Event Options.Options Override In Batch	✅	5ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	4ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	4ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	4ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	14ms
Request Payload.Flags Request Uses V2 Query Param	✅	15ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	15ms
Request Payload.Flags Request Omits Authorization Header	✅	15ms
Request Payload.Token In Flags Body Matches Init	✅	15ms
Request Payload.Groups Round Trip	✅	14ms
Request Payload.Groups Default To Empty Object	✅	15ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	14ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	15ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	14ms
Request Lifecycle.No Flags Request On Init Alone	✅	2ms
Request Lifecycle.No Flags Request On Normal Capture	✅	4ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	26ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	14ms
Retry Behavior.Retries Flags On 502	✅	16ms
Retry Behavior.Retries Flags On 504	✅	16ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	16ms

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog can't auto-review this pull request because two gates refused it. The deny-list gate flagged it for matching crypto_secrets, which fits a change to how config.go, featureflags.go, and posthog.go handle the secret key and credential requirements. The tier gate classified it as T2-never (233 lines, 5 files, single-area fix), which is a category that is never auto-reviewed. The size gate passed, so splitting the PR wouldn't resolve either refusal.

The author should ask a human reviewer to take this one. The PR description already notes that human review is required.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: crypto_secrets
size	✓	39L, 3F substantive, 233L/5F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (233L, 5F, single-area, fix)
stamphog 2.4.1		.stamphog/policy.yml @ unknown · reviewed head 6236720