trunk-merge/pr-100947/b7ce5be5-508d-4dc3-9e1c-7748b76f6a3c

.depot/workflows/ci-backend.yml

@@ -3085,10 +3085,6 @@ jobs:
             # The default ref, which is the PR merge commit. turbo-discover selects the test files
             # from this tree, so a checkout of any other ref can lack a file that the selection lists.
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-              with:
-                  fetch-depth: 1
-                  lfs: true
-                  clean: false
             - name: Install signal-fanout
               shell: bash
               run: sudo install -m 0755 .github/scripts/signal-fanout /usr/local/bin/signal-fanout

Dockerfile

@@ -9,6 +9,7 @@
 # The stages are used to:
 #
 # - node-base: shared Node.js base with pnpm already provisioned
+# - product-manifests: collect the package.json of each products/* workspace package
 # - frontend-build: build the frontend (static assets)
 # - sourcemap-upload: upload sourcemaps to PostHog (isolated, no artifacts)
 # - node-scripts-build: build plugin transpiler and other Node.js build artifacts
@@ -39,6 +40,15 @@
 ENV COREPACK_ENABLE_NETWORK=0
 
 
+#
+# ---------------------------------------------------------
+#
+# Only the package.json files, so a product source change does not rerun the frontend pnpm install.
+FROM node:24.22.1-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205 AS product-manifests
+COPY products/ /tmp/products/
+RUN cd /tmp/products && for manifest in */package.json; do install -D -m 644 "$manifest" "/manifests/products/$manifest"; done
+
+
 #
 # ---------------------------------------------------------
 #
@@ -56,11 +66,12 @@
 COPY packages/quill/ packages/quill/
 COPY packages/llm-normalizer/ packages/llm-normalizer/
 COPY packages/agent/packages/agent-contracts/src/ packages/agent/packages/agent-contracts/src/
-COPY products/ products/
+COPY --from=product-manifests /manifests/products/ products/
 COPY docs/onboarding/ docs/onboarding/
 RUN --mount=type=cache,id=pnpm,target=/tmp/pnpm-store-v24 \
     CI=1 pnpm --filter=@posthog/frontend... install --frozen-lockfile --store-dir /tmp/pnpm-store-v24
 
+COPY products/ products/
 COPY frontend/ frontend/
 RUN bin/turbo --filter=@posthog/frontend build
 
@@ -113,7 +124,7 @@
     GITHUB_REF_NAME=$GITHUB_REF_NAME \
     GITHUB_REPOSITORY=$GITHUB_REPOSITORY \
     GITHUB_SERVER_URL=$GITHUB_SERVER_URL
 RUN --mount=type=secret,id=posthog_upload_sourcemaps_cli_api_key \
     if ( \
         [ -f /run/secrets/posthog_upload_sourcemaps_cli_api_key ] && \
         apt-get update && \
@@ -171,7 +182,7 @@
 # self-contained 24MB package with no deps). Materialize it as real files inside the transpiler's
 # own node_modules, replacing the pnpm symlink that pointed into the root node_modules. The final
 # image then carries just this package instead of the entire ~469MB root /code/node_modules.
 RUN cd /code/common/plugin_transpiler && \
     BABEL_REAL=$(node -e "process.stdout.write(require('path').dirname(require.resolve('@babel/standalone/package.json')))") && \
     rm -rf node_modules/@babel/standalone && \
     mkdir -p node_modules/@babel && \
@@ -195,7 +206,7 @@
 ENV UV_PROJECT_ENVIRONMENT=/python-runtime
 
 # Install build dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "build-essential" \
     "git" \
@@ -253,7 +264,7 @@
 
 # Render the wizard tool catalog from the warehouse source declarations. Web workers serve this file,
 # so they never import every source module, and a source module that fails to import fails the build.
 RUN SKIP_SERVICE_VERSION_REQUIREMENTS=1 STATIC_COLLECTION=1 DATABASE_URL='postgres:///' REDIS_URL='redis:///' python manage.py render_wizard_tool_catalog
 
 # Strip JS sourcemaps (~2.8GB) from the artifacts that ship in the final image — but ONLY when the
 # isolated sourcemap-upload stage confirmed a real upload to error tracking (status "uploaded"). If the
@@ -277,7 +288,7 @@
 SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
 
 # Fetch the GeoLite2-City database that will be used for IP geolocation within Django.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "ca-certificates" \
     "curl" \
@@ -307,7 +318,7 @@
 # Runtime-only shared libs: lxml/xmlsec are compiled --no-binary in the build stage (which keeps
 # its own -dev headers), so the final image needs the runtime .so, not the -dev headers/static libs.
 # libxmlsec1-openssl provides the OpenSSL crypto backend that libxmlsec1-dev used to pull in.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends --allow-downgrades \
     # Upgrades the CA bundle that the pinned base image freezes.
     "ca-certificates" \
@@ -418,8 +429,8 @@
 
 # Validate the Playwright client library (used to drive the remote browserless service over CDP —
 # no browser binary ships in this image).
 RUN /python-runtime/bin/python -c "import playwright; print('Playwright package imported successfully')"
 RUN /python-runtime/bin/python -c "from playwright.sync_api import sync_playwright; print('Playwright sync API available')"
 
 # Setup ENV.
 ENV NODE_ENV=production
@@ -444,5 +455,5 @@
 
 # Root is needed only so bin/docker-server can drop the app to nobody with setpriv.
 # nosemgrep: dockerfile.security.last-user-is-root.last-user-is-root
 USER root
 CMD ["./bin/docker"]

docs/internal/ai-offline-evaluation-reporting.md

@@ -248,6 +248,9 @@ Numeric scores can use the domain of their configured scorer version. The API va
 
 `OfflineEvalSuite.experiment_options` accepts the SDK's `ExperimentOptions` for external dataset identifiers, `prompt_version`, model/application versions, and `run_source`.
 The harness owns the experiment ID, start time, suite key, and expected counts.
+Each case's `output["model"]` becomes the item's `model_version`, so one-shot suites can report the model they actually used and compare different models within one experiment.
+Cases without a model, or with `model=None`, inherit the experiment's model version.
+Invalid model identifiers are omitted and recorded in the item's `omitted_fields`; the case's scores still upload.
 For external datasets, case metadata can supply `dataset_item_identifier` and `dataset_item_version_identifier`.
 The harness publisher does not support hosted datasets. A non-null `dataset_revision_id` stops preparation with a local error before any upload request.
 

docs/internal/conversations-reliability.md

@@ -115,6 +115,7 @@ That is provider acceptance, not customer delivery.
 Timeouts after a possible accept retry with the same `client_msg_id`.
 Honor `Retry-After` on 429s, cap at one hour, and treat 5xx plus Slack timeout codes as transient.
 Permanent Slack application errors (revoked token, missing channel, invalid blocks) fail the part.
+Automated PR replies check the approved channel list and current channel type before posting. A failed channel lookup retries; a known external channel fails the part.
 Keep `post_reply_to_slack` registered for in-flight Celery messages.
 New work uses `process_slack_delivery_part`.
 

docs/internal/workflows-email-sending-tiers.md

@@ -12,6 +12,7 @@ Only workflows that send email are subject to the tiers; SMS, push, and webhook
 - Batch audience cap: `get_hogflow_batch_trigger_limit` in `products/workflows/backend/utils/batch_trigger_limit.py`, applied at batch dispatch and shown in the blast radius preview.
 - Send-time caps: two Valkey token buckets per team in the CDP email worker (`claimTeamSendingBudget` in `nodejs/src/cdp/services/messaging/email.service.ts`).
 - Staff controls: the team's Django admin page (view state, set/pin a tier, recompute now).
+- Audit trail: every tier or pin change writes an `email_sending_tier_changed` row to the team's activity log, with the before and after values and the decision reason (`staff_set` for a tier staff set by hand). Staff rows name the acting user. Sweep and backfill rows carry a trigger with the job type and a per-run id. The rows are staff-only in the activity log (`products/workflows/backend/services/email_sending_tier_audit.py`).
 - Customer surface: the Reputation tab's sending allowance card, shown only while the team is enforced.
 
 ## Configuration