[Silthus]

Merge gate: node-store (#77) and django-facade (#78) live in both regions, the allowlist at * in both regions, and a real send through this SDK version with a real project key, delivered and confirmed by Michael. Then the repo's normal release.

Ticket: PostHog/michaelr-context#81

💡 Motivation and Context

Problem: an app moving its email from Resend to PostHog can't send a receipt with a PDF, or copy finance on an invoice. posthog.emails.send takes rendered html/text only, and files sent inline in the send request would cap a message far below what senders need.

Change: the code form takes cc, bcc and attachments. The SDK hashes each file, asks PostHog where to upload the files it lacks, uploads them straight to file storage, then sends the email with each file's hash in place of its bytes.

• cc/bcc: one address or a list. A string becomes a one-item list on the wire. An empty list is left out, as reply_to is.
• attachments: {filename, content, content_type?, content_id?}. Content is bytes, any bytes-like, or a Base64 string. The SDK hashes it with hashlib.sha256.
• Before any request, the SDK refuses more than 10 files (too_many_attachments) and a message over 40 MB after Base64 encoding, about 29 MB of files (message_too_large). There is no per-file cap. It counts and sizes the files before it copies or hashes any, so an oversized email costs no memory. A Base64 string is sized by its data, and more than two trailing = is refused as invalid_attachment before the string is copied, so padding can neither slip a file past the limit nor cost memory. The estimate matches the server's byte for byte: each file and each of html and text (as UTF-8 bytes) count as Base64 with line breaks, the subject adds 75 bytes per 42 UTF-8 bytes, plus 64 KiB. Without text, the HTML counts twice, because PostHog derives the text from it and the derived text is never longer. Missing or unknown keys and empty content raise invalid_attachment with a field such as attachments__0__content, and the error never repeats the content.
• Upload: POST /messaging/attachments/uploads/ with each distinct file's hash and size, so the same bytes in two attachments upload once. A file PostHog already has comes back present and is skipped. For the rest, the SDK sends a plain PUT to the returned URL with exactly the returned headers: no bearer token, none of the client's default params or headers, and no redirect followed: a 3xx answer raises attachment_upload_failed on that attachment, naming no URL, and sends nothing, since following a 307 or 308 would send the file again to the new address, even over plain HTTP. It uploads only to an https URL: a plain-HTTP upload URL raises api_error naming the attachment before any upload, unless the client's own host is plain HTTP, as in local development. The environment's CA bundle and proxy settings still apply. A refusal from the upload route names attachments, or the first attachment holding the file it names, never the wire field files.
• A refused PUT raises attachment_upload_failed with the HTTP status and the bucket's own error code and message, and no email is sent. A storage that is unreachable or answers 429, 500, 502, 503 or 504 is retried like a send. Out of retries, an unreachable storage raises network_error with field naming the attachment, and the signed URL never reaches a traceback.
• A send retry repeats only the send, with the same idempotency key. A daily upload quota (429 upload_quota_exceeded) is not retried.
• An upload-route 404 raises not_found on field attachments with PostHog's own reason, and sends nothing. A 404 means a PostHog without the route or sending email from code off for the project, so the SDK names neither and never turns it into field_not_accepted.
• With template_id, all three fields are refused before any request.
• They combine with tracking and sensitive from #1216 in one send.

It mirrors posthog-node in PostHog/posthog-js#5514. Server side: PostHog/posthog#131833 (upload route), #131944 (send by reference).

Spec divergence: the emails spec doesn't cover cc, bcc or attachments yet, and its open draft parks them. Follow-up: spec them from this contract.

Impact: Grow Workflows. Attachments are part of Resend parity. The server's send event gains attachment counts and sizes, refusals included, which show whether size refusals fall once teams move over.

Merge Danger

Caution

🔴 Merge risk: high · one-way door once released: cc, bcc and attachments on emails.send become a public SDK contract

• Apps that upgrade and send with cc, bcc or attachments go from a local TypeError to a real send with copies and files, in both regions. These rows are new, so no base-versus-HEAD proof covers them: a missed bug there could send a copy or a file to the wrong recipient, or expose a bcc, with no error. The tests, the live run and the merge gate's real send exercise them, and the production diff is over 400 lines.
• Apps that upgrade and send without those fields, and status reads, are unchanged: the shadow diff shows the same requests and outcomes on main and this head.
• Switch-off: the server's attachments allowlist refuses attachments with field_not_accepted before any upload. cc and bcc have none: a fault there is fixed forward with a new SDK version.

Rollout

• Stages: merge only after the merge gate above, then the repo's release approval in Slack. Apps get it as they upgrade.
• Decided: Michael accepted the cross-version gap until the merge gate's real send, and merges once that gate passes.
• Watch: the server's send event, whose attachment counts, sizes and refusals show sends with files. No alert pages on a misdelivered copy or file.

💚 How did you test it?

• Lane gate on 174a60b, after merging main: ruff format and check, mypy, import posthog with warnings as errors, the strict type smoke, the public API snapshot, and the full test suite (7013 passed) pass locally. CI: see the checks on the head.
• Tests: 175 email tests pass, three measuring that an oversized email or a Base64 string with extra padding is refused without copying its files or the string. Attachment tests run against an in-memory PostHog and S3-like storage. Storage refuses an added query parameter, an extra Authorization header, an expired URL, mismatched bytes and a wrong method, as S3 does. The tests assert the delivered email, the stored files and the error, never request shapes. The CA trust, redirect and cut-off-answer tests run over real sockets, the CA test with a real TLS handshake. Each fix was red first. Mutations each fail at least one test: keep the session's or the client's Authorization on the PUT, upload a file marked present, ignore the bodies in the estimate, allow an eleventh file, treat a 4xx PUT as success, upload shared bytes twice, stop retrying a storage 500, give storage refusals PostHog's names, drop the attachment from an unreachable-storage error, count files after reading them, check the size after copying, size Base64 including extra padding, allow more than two = of Base64 padding (a 70 MB peak for 40 MB of =), count body characters instead of UTF-8 bytes, count html and text as one body, count raw body bytes, ignore text, ignore the subject or count its characters, count 43 bytes per encoded word, size padded Base64 by copying it, follow a storage redirect in the async client, follow a storage 307 to a plain-HTTP server (sync and async; without the fix the file reaches that server), misname a storage 429 or 503, count the HTML once without text, skip or always skip the https check, name the wire field of an upload refusal, read a storage answer after the upload on a streaming session, drop cc or bcc, leave the upload route's 404 bare, drop PostHog's 404 answer, and turn the 404 into field_not_accepted.
• Test seams: what a caller or recipient can observe through emails.send, sync and async, with PostHog and its storage faked behind the transport: the error and its field, the bytes storage holds, and the email PostHog delivers (its attachments, cc and bcc, and whether it was sent at all). That covers the skip on present, shared bytes stored once, no email after a refused or redirected PUT, retried storage faults, a lost reply replayed by its idempotency key, the limits at the edge (the largest file that fits and one byte more; a 57-byte body counted as 78 bytes and 57 two-byte characters as 156; a 42-byte subject counted as 75 and 43 bytes as 150), and injected clients that carry their own params, headers and redirect settings.
• Storage retries, live over real sockets on 174a60b (a local app server and storage server): a storage 500, 429 or async 503 is retried and the email sent; a 403 raises attachment_upload_failed with no send; an unreachable storage raises network_error naming the attachment, with no signed URL in the traceback.
• Shadow diff on 174a60b: the same 24 calls (template and code sends, sends with main's tracking and sensitive, retries, refusals, quota, status reads; sync and async) through main and this head make the same 32 requests and end the same way.
• Live run on 1828040, reused at 174a60b because no upload request in it changes since (the switch-off refusal now names attachments instead of the server's files, with the same single request, and since main's #1216 a send leaves capture_engagement out unless set, PostHog's default): the server PRs' heads merged as fetched, with no server patch, plus SeaweedFS and maildev. New files upload with only the signed headers and deliver byte-identical, with bcc only in the envelope. A file with an explicit content_type and an inline image with content_id deliver as sent. The same files again answer present and upload nothing. The same bytes in two attachments upload once and arrive as two files. A tampered upload raises the storage refusal (then named upload_failed, now attachment_upload_failed) and sends nothing. A project off the allowlist gets field_not_accepted. Line-wrapped Base64 raises invalid_attachment before any request. The async client delivers.
• Cross-version on 1828040; at 174a60b the gap for cc, bcc and attachments against a live backend is accepted by Michael until the real-send merge gate passes: against master, a send with a file makes one request, the upload ask, and raises not_found on attachments with PostHog's own reason ("Endpoint not found."). A plain send still delivers, and a send with cc and bcc delivers with the bcc only in the envelope. Against the server PRs with sending email from code off, a send with a file raises not_found on attachments with Django's reason ("Not found."), and nothing uploads or sends.
• Reviews: design pass and two GPT-6.1 Sol rounds; six full panels of seven lenses plus two code-owner perspectives (Opus 5.5 fresh eyes, GPT-6.1 Sol for the rest), the last on the final code, each followed by a final read of its fixes. ReviewHog can't access this repo.

Earlier evidence: inline Base64 attachments (ac102e0)

• Proof gate passed at ac102e0: CI green, review clean, and both owed proofs captured.
• Live run: a send with to, two cc, one bcc, a binary PDF and an inline PNG went through a local PostHog with the then server stack to maildev. The files arrived byte-identical, the PNG inline, and the bcc only in the envelope.
• Cross-version: against the server then on master, a send with these fields got a 400 naming attachments and nothing was sent. A plain send still delivered.

📝 Checklist

• All commits are signed (see Commit signing)
• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran sampo add to generate a changeset file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Written by Claude Opus 5.5 (claude-opus-5-5) in Claude Code, for Michael.

Question	Answer	Who	Where
How do attachments reach PostHog?	Hash, upload to storage, then send references; replaces inline Base64	👤 Human	ticket
Which code-form fields ship in the attachments slice?	Attachments, cc and bcc. Headers and tags wait for a later slice	👍 Accepted default	comment
Does StampHog review this PR?	Yes: ready for review with StampHog once the full QA swarm passes on the final head; the merge still waits for the merge gate	👤 Human	ticket
What does the storage PUT carry?	Only the signed URL and headers, built apart from the client's defaults; not the client's session request	🤖 Agent	ticket comment
Is the daily upload quota retried?	No, it raises daily_quota_exceeded at once; a rate limit is still retried	🤖 Agent	ticket comment
Do shared bytes upload twice?	No, once per hash; the send keeps one reference per attachment	🤖 Agent	ticket comment
Which storage answers are retried?	429 and 5xx faults, with their own error names; not just 503	🤖 Agent	ticket comment
What code does a failed upload raise?	attachment_upload_failed, the name Go, JS, Ruby and PHP use, for a refused or redirected upload; renamed from attachment_upload_failed, which no release carried	👤 Human (conductor)	ticket
What does a PostHog without the upload route raise?	not_found with field attachments; not a bare 404	🤖 Agent	ticket comment

Involvement: reviews: design pass, nine rounds (six of them full nine-lens panels), final reads, and fixes for PostHog Review's findings; ReviewHog unavailable. Proof captured: tests, mutation checks, shadow diff, live run and cross-version.

🤖 Generated with Claude Code

[Silthus]

Note

🤖 Claude Opus 5.5 writing on behalf of Michael

Decisions for the attachments slice:

• 👍 Which code-form fields ship in the attachments slice? Attachments, cc and bcc. Headers and tags wait for a later slice.
• 👍 How does StampHog approve an SDK draft? StampHog doesn't review drafts, so this PR goes ready only for the stamp, then back to draft.

[github-actions]

posthog-python Compliance Report

Date: 2026-11-12T17:14:17.426807+00:00
Duration: 254382ms

✅ All Tests Passed!

270/270 tests passed

---

Capture_V1 Tests

✅ 95/95 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	517ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	510ms
Required Headers.Has Authorization Bearer Header	✅	511ms
Required Headers.Has Content Type Json	✅	510ms
Required Headers.Has Posthog Sdk Info Format	✅	510ms
Required Headers.Has Posthog Attempt Header	✅	510ms
Required Headers.Has Posthog Request Id	✅	510ms
Required Headers.Has Posthog Request Timestamp	✅	510ms
Required Headers.Has User Agent	✅	511ms
Body Format.Body Has Created At And Batch	✅	511ms
Body Format.No Api Key In Body	✅	514ms
Body Format.No Sent At In Body	✅	511ms
Event Format.Event Has Required Root Fields	✅	510ms
Event Format.Event Uuid Is Valid	✅	510ms
Event Format.Event Timestamp Is Rfc3339	✅	510ms
Event Format.Non Utc Event Timestamp Is Converted To Utc	✅	526ms
Event Format.Distinct Id Is String	✅	510ms
Event Format.Distinct Id At Root Not Properties	✅	510ms
Event Format.Custom Properties Preserved	✅	511ms
Event Format.Set Properties Preserved	✅	510ms
Event Format.Set Once Properties Preserved	✅	509ms
Event Format.Groups Properties Preserved	✅	510ms
Event Format.Sdk Generates Uuid If Not Provided	✅	510ms
Event Format.Event Has Required Root Fields Batch	✅	513ms
Event Format.Event Uuid Is Valid Batch	✅	514ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	513ms
Event Format.Distinct Id Is String Batch	✅	515ms
Event Format.Distinct Id At Root Not Properties Batch	✅	514ms
Event Format.Custom Properties Preserved Batch	✅	513ms
Event Format.Set Properties Preserved Batch	✅	514ms
Event Format.Set Once Properties Preserved Batch	✅	513ms
Event Format.Groups Properties Preserved Batch	✅	514ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	513ms
Batch Behavior.Multiple Events In Single Batch	✅	518ms
Batch Behavior.Batch Envelope Smoke	✅	515ms
Batch Behavior.Flush With No Events Sends Nothing	✅	506ms
Batch Behavior.Flush At Triggers Batch	✅	1012ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	511ms
Deduplication.Generates Unique Uuids	✅	518ms
Deduplication.Different Events Same Content Different Uuids	✅	512ms
Deduplication.Preserves Uuid On Retry	✅	6514ms
Deduplication.Preserves Timestamp On Retry	✅	6515ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	6520ms
Deduplication.No Duplicate Events In Batch	✅	517ms
Header Behavior On Retry.Attempt Header Starts At One	✅	511ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	13527ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	6515ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3019ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	6519ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	510ms
Response Format Validation.Success Response Has Ok For Each Event	✅	515ms
Response Format Validation.Success No Retry After When All Ok	✅	512ms
Response Format Validation.Success Retry After Present When Retry Events	✅	1516ms
Response Format Validation.Success No Retry After When Drop Only	✅	512ms
Response Format Validation.Response Echoes Request Id	✅	510ms
Retry Behavior.Retries On 408	✅	6516ms
Retry Behavior.Retries On 500	✅	6519ms
Retry Behavior.Retries On 503	✅	8522ms
Retry Behavior.Retries On 504	✅	6515ms
Retry Behavior.Retries On 404	✅	6519ms
Retry Behavior.Retries On 429	✅	6520ms
Retry Behavior.Retries On 502	✅	6519ms
Retry Behavior.Retryable Errors Have Retry After	✅	3514ms
Retry Behavior.Respects Retry After On Retryable Error	✅	11522ms
Retry Behavior.Does Not Retry On 400	✅	2513ms
Retry Behavior.Does Not Retry On 401	✅	2513ms
Retry Behavior.Does Not Retry On 402	✅	2513ms
Retry Behavior.Does Not Retry On 413	✅	2513ms
Retry Behavior.Does Not Retry On 415	✅	2513ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2513ms
Retry Behavior.Implements Backoff	✅	19533ms
Partial Batch Handling.Handles 200 Full Success	✅	2511ms
Partial Batch Handling.Handles 200 With All Ok	✅	3518ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3515ms
Partial Batch Handling.Does Not Retry Warning Events	✅	3513ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	6521ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	6521ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	6523ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	6523ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	6519ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	6522ms
Partial Batch Handling.Respects Retry After On Partial	✅	8517ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3515ms
Partial Batch Handling.Mixed Ok Drop Warning No Retry	✅	3520ms
Compression.Sends Gzip Content Encoding	✅	510ms
Compression.No Content Encoding When Disabled	✅	511ms
Compression.Compressed Body Is Decompressible	✅	510ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2513ms
Event Options.Cookieless Mode Override	✅	510ms
Event Options.Disable Skew Correction Override	✅	511ms
Event Options.Process Person Profile Override	✅	510ms
Event Options.Product Tour Id Override	✅	510ms
Event Options.Unset Options Omitted	✅	510ms
Event Options.Options Override In Batch	✅	513ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	509ms

Capture_Ai Tests

✅ 5/5 tests passed

View Details

Test	Status	Duration
Routing.Capture Ai Posts To Ai Endpoint	✅	511ms
Routing.Capture Does Not Reroute Ai Named Events	✅	510ms
Identity.Capture Ai Event Has Uuid	✅	510ms
Identity.Capture Ai Keeps Supplied Uuid	✅	510ms
Timestamp Format.Non Utc Event Timestamp Is Converted To Utc	✅	510ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	11ms
Request Payload.Flags Request Uses V4 Query Param	✅	9ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	9ms
Request Payload.Flags Request Omits Authorization Header	✅	12ms
Request Payload.Token In Flags Body Matches Init	✅	10ms
Request Payload.Groups Round Trip	✅	11ms
Request Payload.Groups Default To Empty Object	✅	10ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	10ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	11ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	10ms
Request Lifecycle.No Flags Request On Init Alone	✅	4ms
Request Lifecycle.No Flags Request On Normal Capture	✅	510ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	14ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	10ms
Retry Behavior.Retries Flags On 502	✅	312ms
Retry Behavior.Retries Flags On 504	✅	314ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	511ms

Feature_Flags_V4 Tests

✅ 149/149 tests passed

View Details

Test	Status	Duration
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Complete Split]	✅	11ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Partial Split Missing Config Version]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Partial Split Missing Rule Type]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Partial Split Missing Rule Id]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Partial Split Missing Variant Key]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Split Wrong Type Config Version]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Split Wrong Type Rule Type]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Split Wrong Type Rule Id]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Split Wrong Type Experiment Id]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Split Extra Experiment Id]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Split Wrong Type Variant Key]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Wrong Rule Type Literal]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Unknown Fields]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Old Server Variant]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Old Server Boolean]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Old Server Null Variant]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Old Server False]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.V4 Value Takes Precedence]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Missing Flag]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Targeting Match Targeted Release]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Targeting Match Percentage Rollout]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Rollout Miss Percentage Rollout]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Rollout Miss Experiment]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Experiment Paused]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Holdout]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Holdout Variant Key]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.No Rule Match]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Missing Group Key]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Dependency Error]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Error]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Error With Value]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Malformed Sibling Isolation]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Partial Split String Value]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.V1 At V4]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.V1 Failed]	✅	10ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Integral Json Number Context]	✅	9ms
Legacy Getters.Legacy Getter Reads Reader Fixture[Readers.Flag Key Seed]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Target]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Rollout Hit]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Miss Return Default]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Miss Return Default Null]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Miss Continue]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.No Match Default]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.No Match Null]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Order First Match]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Order Targeting Miss]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Target]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Rollout Hit]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Miss Return Default]	✅	11ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Miss Return Default Null]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Miss Continue]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.No Match Default]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.No Match Null]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Order First Match]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Order Targeting Miss]	✅	21ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Target]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Rollout Hit]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Miss Return Default]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Miss Return Default Null]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Miss Continue]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.No Match Default]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.No Match Null]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Order First Match]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Order Targeting Miss]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Unicode]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.String.Looks Boolean]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Zero]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Negative Decimal]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Short Decimal]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Exponent]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Max Safe Integer]	✅	10ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Number.Min Safe Integer]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Empty]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Nested]	✅	9ms
Legacy Getters.Legacy Getter Reads Typed Value[V2 Value.Object.Max Depth]	✅	10ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Complete Split]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Partial Split Missing Config Version]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Partial Split Missing Rule Type]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Partial Split Missing Rule Id]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Partial Split Missing Variant Key]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Split Wrong Type Config Version]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Split Wrong Type Rule Type]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Split Wrong Type Rule Id]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Split Wrong Type Experiment Id]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Split Extra Experiment Id]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Split Wrong Type Variant Key]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Wrong Rule Type Literal]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Unknown Fields]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Old Server Variant]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Old Server Boolean]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Old Server Null Variant]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Old Server False]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.V4 Value Takes Precedence]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Missing Flag]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Targeting Match Targeted Release]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Targeting Match Percentage Rollout]	✅	8ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Rollout Miss Percentage Rollout]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Rollout Miss Experiment]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Experiment Paused]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Holdout]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Holdout Variant Key]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.No Rule Match]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Missing Group Key]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Dependency Error]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Error]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Error With Value]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Malformed Sibling Isolation]	✅	6ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Partial Split String Value]	✅	8ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.V1 At V4]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Integral Json Number Context]	✅	7ms
Legacy Payloads.Legacy Payload Reads Reader Fixture[Readers.Flag Key Seed]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Target]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Rollout Hit]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Miss Return Default]	✅	6ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Miss Return Default Null]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Miss Continue]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.No Match Default]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.No Match Null]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Order First Match]	✅	6ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Order Targeting Miss]	✅	8ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Target]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Rollout Hit]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Miss Return Default]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Miss Return Default Null]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Miss Continue]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.No Match Default]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.No Match Null]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Order First Match]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Order Targeting Miss]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Target]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Rollout Hit]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Miss Return Default]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Miss Return Default Null]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Miss Continue]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.No Match Default]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.No Match Null]	✅	6ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Order First Match]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Order Targeting Miss]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Unicode]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.String.Looks Boolean]	✅	6ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Zero]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Negative Decimal]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Short Decimal]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Exponent]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Max Safe Integer]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Number.Min Safe Integer]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Empty]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Nested]	✅	7ms
Legacy Payloads.Legacy Payload Is The Typed Value[V2 Value.Object.Max Depth]	✅	7ms

Feature_Flags_Local_Evaluation Tests

✅ 4/4 tests passed

View Details

Test	Status	Duration
Versioned Boolean Matching.Matching Version Missing	✅	68ms
Versioned Boolean Matching.Matching Version 1	✅	69ms
Versioned Boolean Matching.Matching Version 2	✅	67ms
Versioned Boolean Matching.Version Only Reload 1 2 1 2 Missing	✅	33ms

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

StampHog can't approve this pull request automatically. Two gates refused it. The deny-list gate flagged a public API change: posthog/emails.py adds the EmailAttachment type and new cc, bcc and attachments fields on CodeEmailArgs, and references/public_api_snapshot.txt records them. The tier gate classified the change as T2-never (336 lines across 5 files, cross-cutting, a feature), a tier that is never auto-approved.

The size gate passed, so splitting the pull request won't change the outcome. Ask a human maintainer to review it, since a public API addition needs that sign-off.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: public_api
size	✓	124L, 2F substantive, 336L/5F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (336L, 5F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head a080862

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Fixed/addressed: 2 · PR risk: 0/10

Reviews

• 174a60b — No new issues
• acaa523 — No new issues
• 7de6993 — No new issues

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog won't auto-review this pull request, and a human will need to look at it. Two gates refused it. The deny-list gate matched public_api, because the change adds new public API surface (the cc, bcc and attachments fields and EmailAttachment) to posthog/emails.py and references/public_api_snapshot.txt. The tier gate classified it as T2-never: a cross-cutting feature of 2366 lines across 6 files, including tests and docs.

The size gate passed, so splitting is optional. Ask a human reviewer to take it, or break out the pieces (for example cc/bcc separately from the attachment upload flow) so each is easier to review.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: public_api
size	✓	686L, 3F substantive, 2366L/6F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (2366L, 6F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 3db6c98

[posthog]

PostHog Review · Standard · reviewed 3db6c98: 1 Should fix.

See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog won't review this pull request, because two policy gates refused it. The deny-list gate flagged it for public_api: it adds cc, bcc and attachments to the public posthog.emails types, which shows up in references/public_api_snapshot.txt. The tier gate classified it as T2-never, since it is a cross-cutting feature touching 6 files and 2438 lines.

A human reviewer needs to look at this one. You can ask a maintainer to review it. You could also make it easier to review by splitting it up, for example separating the cc/bcc support from the attachment upload flow.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: public_api
size	✓	687L, 3F substantive, 2438L/6F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (2438L, 6F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head f3f5fa3

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog can't auto-approve this pull request because two gates refused it. The deny-list gate flagged it for public_api, since references/public_api_snapshot.txt changes and new public attributes are added to posthog.emails (cc, bcc, attachments, EmailAttachment). The tier gate classified it as T2-never: a cross-cutting feature of about 2,461 lines across 6 files, including a large rewrite of posthog/emails.py.

A human reviewer needs to look at this one, so please ask a maintainer to review it. Splitting it into smaller pieces, such as the cc/bcc fields separately from the attachment upload flow, may make that review easier, though the public API changes will still need a human.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: public_api
size	✓	693L, 3F substantive, 2461L/6F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (2461L, 6F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head b32cc2d

[stamphog]

No review started. stamphog started a review of this pull request less than 10 minutes ago, and a label can request at most one review per 10 minutes. The stamphog label has been removed. Add it again at 11:14 UTC (in about 6 minutes) to request a fresh review.

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog can't approve this pull request, because two gates refused it. The deny-list gate matched public_api: references/public_api_snapshot.txt and posthog/emails.py add new public attributes (cc, bcc, attachments on CodeEmailArgs, and the new EmailAttachment type). The tier gate classified the change as T2-never, since it is a cross-cutting feature touching 2461 lines across 6 files. The size gate passed, so size was not the reason.

A human reviewer will need to look at this one. Ask a maintainer for review. You could also split the work into smaller pull requests, but the public API additions will still need a human reviewer.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: public_api
size	✓	693L, 3F substantive, 2461L/6F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (2461L, 6F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head b32cc2d

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog can't auto-review this pull request because two policy gates refused it. The deny-list gate flagged it for touching the public API: references/public_api_snapshot.txt gains new CodeEmailArgs fields (cc, bcc, attachments) and a new EmailAttachment type. The tier gate classified it as T2-never, meaning a cross-cutting feature of about 2,461 lines across 6 files, which is never eligible for automatic approval.

Please ask a human reviewer to take this one. If it's practical, you could also split it, for example by landing the cc/bcc support separately from the attachment upload flow, so each piece is smaller and easier to review.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: public_api
size	✓	693L, 3F substantive, 2461L/6F incl. docs/generated/snapshots — within ceiling
tier	✗	classified as T2-never: T2-never (2461L, 6F, cross-cutting, feat)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 7de6993

[marandaneto]

The code looks good; no qualifying findings. Verdict: correct.