trunk-merge/pr-87812/dfc21132-c178-4244-a763-9ef4223c6c8e

.depot/workflows/ci-backend.yml

@@ -60,6 +60,11 @@
 #   shards fall back to the union .test_durations
 # - actions/cache reads/writes route to Depot Cache, not GitHub Actions Cache,
 #   so shared keys with canonical (schema, uv, pnpm) do not collide
+# - hypothesis constants cache: the restore and save steps mirror canonical verbatim, but the
+#   save only fires on master test-matrix runs and the shadow skips those, so the Depot Cache
+#   entry only exists after a master workflow_dispatch. Sampled PR shards run cold (they rebuild
+#   the pool, as canonical did before this cache existed) until then: bounded, documented, and
+#   harmless because the shadow never gates merges.
 # - GITHUB_TOKEN / OTEL_SERVICE_NAME neutralized (ambient on Depot, not on GHA)
 # - Three data-modeling tests deselected (Depot-only MinIO 403 quarantine)
 # - COMPOSE_PROJECT_NAME pinned to posthog because bin/wait-for-docker filters by that
@@ -135,6 +140,10 @@ env:
     # and HEAD (push) key computations below can't drift.
     # ci-e2e-playwright.yml, ci-dagster.yml, ci-mcp.yml and ci-rust-flags-integration.yml restore by the same key; keep their copies in sync when bumping.
     SCHEMA_CACHE_EPOCH: v2
+    # Hypothesis constants cache epoch. Bump to abandon every shared entry at once
+    # (key is posthog-hypothesis-constants-<version>-<epoch>-<isoyear>-<isoweek>); used by
+    # the Django test shards below.
+    HYPOTHESIS_CONSTANTS_EPOCH: v1
     SECRET_KEY: '6b01eee4f945ca25045b5aab440b953461faf08693a9abbf1166dc7c6b9772da' # unsafe - for testing only
     COMPOSE_PROJECT_NAME: posthog
     DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/posthog'
@@ -2005,6 +2014,37 @@ jobs:
                   key: posthog-segment-durations-${{ github.run_id }}
                   restore-keys: |
                       posthog-segment-durations-
+            - name: Compute hypothesis constants cache key
+              # hypothesis builds its constants pool of property-test inputs by
+              # AST-parsing every local module in sys.modules. It caches the result
+              # in .hypothesis/constants under a hash of each source file, so the
+              # pool is content-addressed: restoring a stale copy is safe, because a
+              # changed file reads as a miss and rebuilds. CI otherwise pays the full
+              # parse on every shard's pytest collection (about 10 s per shard).
+              id: hyp-constants-key
+              shell: bash
+              run: |
+                  # The key includes the installed hypothesis version because the
+                  # entry format is an implementation detail, and rotates weekly so
+                  # entries for deleted or rewritten files expire. The restore prefix
+                  # covers the gap until the first master run of a new week saves.
+                  hyp_version=$(python -c "import hypothesis; print(hypothesis.__version__)")
+                  prefix="posthog-hypothesis-constants-${hyp_version}-${HYPOTHESIS_CONSTANTS_EPOCH}-"
+                  {
+                      echo "key=${prefix}$(date -u +%G-%V)"
+                      echo "restore_prefix=${prefix}"
+                  } >> "$GITHUB_OUTPUT"
+            - name: Restore hypothesis constants cache
+              id: hyp-constants
+              uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              with:
+                  # Constants only. Do NOT add .hypothesis/examples: the example
+                  # database decides which inputs property tests replay, so reusing
+                  # one across runs changes what the tests check.
+                  path: .hypothesis/constants
+                  key: ${{ steps.hyp-constants-key.outputs.key }}
+                  restore-keys: |
+                      ${{ steps.hyp-constants-key.outputs.restore_prefix }}
             # Tests
             - name: Set snapshot update flags
               if: ${{ needs.changes.outputs.backend == 'true' && (needs.detect-snapshot-mode.outputs.mode == 'update' || matrix.person-on-events) }}
@@ -2261,6 +2301,27 @@ jobs:
                   else
                       exit $exit_code
                   fi
+            - name: Save hypothesis constants cache
+              # One Core shard per master run writes the weekly entry: a save from
+              # every shard would race on the same key and churn the shared cache
+              # budget. cache-hit != 'true' skips the save once this week's entry
+              # exists, which keeps later master runs cheap.
+              # continue-on-error: overlapping master runs at week rollover fail its
+              # reservation check when an earlier run has saved the same key, and a
+              # cache miss must never red a green run.
+              continue-on-error: true
+              if: |
+                  github.ref == 'refs/heads/master' &&
+                  matrix.segment == 'Core' &&
+                  matrix.group == 1 &&
+                  !matrix.person-on-events &&
+                  !matrix.new-events-schema &&
+                  !matrix.compat &&
+                  steps.hyp-constants.outputs.cache-hit != 'true'
+              uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              with:
+                  path: .hypothesis/constants
+                  key: ${{ steps.hyp-constants-key.outputs.key }}
             # Post tests
             - name: Show docker compose logs on failure
               if: failure() && (needs.changes.outputs.backend == 'true' && steps.run-core-tests.outcome != 'failure' && steps.run-temporal-tests.outcome != 'failure')

.github/workflows/ci-backend.yml

@@ -46,6 +46,10 @@ env:
     # between the merge-base (PR) and HEAD (push) key computations below.
     # ci-e2e-playwright.yml, ci-dagster.yml, ci-mcp.yml and ci-rust-flags-integration.yml restore by the same key; keep their copies in sync when bumping.
     SCHEMA_CACHE_EPOCH: v2
+    # Hypothesis constants cache epoch. Bump to abandon every shared entry at once
+    # (key is posthog-hypothesis-constants-<version>-<epoch>-<isoyear>-<isoweek>); used by
+    # the Django test shards below.
+    HYPOTHESIS_CONSTANTS_EPOCH: v1
     SECRET_KEY: '6b01eee4f945ca25045b5aab440b953461faf08693a9abbf1166dc7c6b9772da' # unsafe - for testing only
     DATABASE_URL: 'postgres://posthog:posthog@localhost:5432/posthog'
     REDIS_URL: 'redis://localhost'
@@ -2970,6 +2974,39 @@ jobs:
                   restore-keys: |
                       posthog-segment-durations-
 
+            - name: Compute hypothesis constants cache key
+              # hypothesis builds its constants pool of property-test inputs by
+              # AST-parsing every local module in sys.modules. It caches the result
+              # in .hypothesis/constants under a hash of each source file, so the
+              # pool is content-addressed: restoring a stale copy is safe, because a
+              # changed file reads as a miss and rebuilds. CI otherwise pays the full
+              # parse on every shard's pytest collection (about 10 s per shard).
+              id: hyp-constants-key
+              shell: bash
+              run: |
+                  # The key includes the installed hypothesis version because the
+                  # entry format is an implementation detail, and rotates weekly so
+                  # entries for deleted or rewritten files expire. The restore prefix
+                  # covers the gap until the first master run of a new week saves.
+                  hyp_version=$(python -c "import hypothesis; print(hypothesis.__version__)")
+                  prefix="posthog-hypothesis-constants-${hyp_version}-${HYPOTHESIS_CONSTANTS_EPOCH}-"
+                  {
+                      echo "key=${prefix}$(date -u +%G-%V)"
+                      echo "restore_prefix=${prefix}"
+                  } >> "$GITHUB_OUTPUT"
+
+            - name: Restore hypothesis constants cache
+              id: hyp-constants
+              uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              with:
+                  # Constants only. Do NOT add .hypothesis/examples: the example
+                  # database decides which inputs property tests replay, so reusing
+                  # one across runs changes what the tests check.
+                  path: .hypothesis/constants
+                  key: ${{ steps.hyp-constants-key.outputs.key }}
+                  restore-keys: |
+                      ${{ steps.hyp-constants-key.outputs.restore_prefix }}
+
             - name: Download the run's sharding plan snapshot
               # Pin every attempt to the plan turbo-discover snapshotted (rationale on
               # that step); a missing snapshot falls back to the floating caches above.
@@ -3326,6 +3363,28 @@ jobs:
                       exit $exit_code
                   fi
 
+            - name: Save hypothesis constants cache
+              # One Core shard per master run writes the weekly entry: a save from
+              # every shard would race on the same key and churn the shared cache
+              # budget. cache-hit != 'true' skips the save once this week's entry
+              # exists, which keeps later master runs cheap.
+              # continue-on-error: overlapping master runs at week rollover fail its
+              # reservation check when an earlier run has saved the same key, and a
+              # cache miss must never red a green run.
+              continue-on-error: true
+              if: |
+                  github.ref == 'refs/heads/master' &&
+                  matrix.segment == 'Core' &&
+                  matrix.group == 1 &&
+                  !matrix.person-on-events &&
+                  !matrix.new-events-schema &&
+                  !matrix.compat &&
+                  steps.hyp-constants.outputs.cache-hit != 'true'
+              uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              with:
+                  path: .hypothesis/constants
+                  key: ${{ steps.hyp-constants-key.outputs.key }}
+
             # Post tests
             - name: Show docker compose logs on failure
               if: failure() && (needs.changes.outputs.backend == 'true' && steps.run-core-tests.outcome != 'failure' && steps.run-temporal-tests.outcome != 'failure')

ee/hogai/context/entity_search/context.py

@@ -395,8 +395,8 @@ async def list_feature_flags(
     def _list_feature_flags_sync(
         self, limit: int = 100, offset: int = 0, active_filter: str | None = None
     ) -> tuple[list[dict[str, Any]], int]:
-        # Resource-level gate: filter_queryset_by_access_level only prunes object-level denials, so a
-        # role without feature flag access would still see flags here (also reachable via list_data).
+        # Stricter than filter_queryset_by_access_level's fail-closed baseline: a caller without
+        # feature flag access gets nothing, not even flags they created (also reachable via list_data).
         if not self.user_access_control.check_access_level_for_resource("feature_flag", "viewer"):
             return [], 0
 

frontend/src/lib/api.ts

@@ -2401,10 +2401,7 @@ const api = {
         ): Promise<CountedPaginatedResponse<ScheduledChangeType>> {
             return await new ApiRequest().featureFlagScheduledChanges(teamId, featureFlagId).get()
         },
-        async createScheduledChange(
-            teamId: TeamType['id'],
-            data: any
-        ): Promise<{ scheduled_change: ScheduledChangeType }> {
+        async createScheduledChange(teamId: TeamType['id'], data: any): Promise<ScheduledChangeType> {
             return await new ApiRequest().featureFlagCreateScheduledChange(teamId).create({ data })
         },
         async deleteScheduledChange(

frontend/src/scenes/feature-flags/FeatureFlagSchedule.test.tsx

@@ -1,13 +1,22 @@
+import { MOCK_DEFAULT_BASIC_USER, MOCK_DEFAULT_PROJECT } from 'lib/api.mock'
+
 import '@testing-library/jest-dom'
 
-import { act, cleanup, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { BindLogic, Provider } from 'kea'
 
 import { dayjs } from 'lib/dayjs'
 
 import { useMocks } from '~/mocks/jest'
 import { initKeaTests } from '~/test/init'
-import { FeatureFlagType, ScheduledChangeOperationType } from '~/types'
+import {
+    FeatureFlagType,
+    RecurrenceInterval,
+    ScheduledChangeModels,
+    ScheduledChangeOperationType,
+    ScheduledChangeRequestState,
+    ScheduledChangeType,
+} from '~/types'
 
 import { NEW_FLAG, featureFlagLogic } from './featureFlagLogic'
 import FeatureFlagSchedule from './FeatureFlagSchedule'
@@ -150,6 +159,109 @@ describe('FeatureFlagSchedule', () => {
         expect(screen.getByText(new RegExp(expectedText))).toBeInTheDocument()
     })
 
+    describe('approval visibility', () => {
+        const makeScheduledChange = (overrides: Partial<ScheduledChangeType>): ScheduledChangeType => ({
+            id: 1,
+            team_id: MOCK_DEFAULT_PROJECT.id,
+            record_id: 1,
+            model_name: ScheduledChangeModels.FeatureFlag,
+            payload: { operation: ScheduledChangeOperationType.UpdateStatus, value: true },
+            scheduled_at: '2030-01-01T00:00:00Z',
+            executed_at: null,
+            failure_reason: null,
+            created_at: '2026-01-01T00:00:00Z',
+            created_by: MOCK_DEFAULT_BASIC_USER,
+            is_recurring: false,
+            recurrence_interval: null,
+            cron_expression: null,
+            last_executed_at: null,
+            end_date: null,
+            change_request: null,
+            ...overrides,
+        })
+
+        // useMocks trips the hooks naming lint inside named helpers, so each test registers
+        // its own mock before calling this.
+        const renderWithSchedules = (): void => {
+            renderSchedule(
+                buildFeatureFlag({ active: false, rolloutPercentage: 100 }),
+                ScheduledChangeOperationType.UpdateStatus
+            )
+            act(() => {
+                featureFlagLogic(logicProps).actions.loadScheduledChanges()
+            })
+        }
+
+        const schedulesMock = (
+            schedules: ScheduledChangeType[]
+        ): Record<string, () => [number, { results: ScheduledChangeType[] }]> => ({
+            [`/api/projects/${MOCK_DEFAULT_PROJECT.id}/scheduled_changes`]: () => [200, { results: schedules }],
+        })
+
+        it('shows the Needs approval tag and an approval link for a pending gated schedule', async () => {
+            useMocks({
+                get: schedulesMock([
+                    makeScheduledChange({
+                        change_request: { id: 'cr-pending', state: ScheduledChangeRequestState.Pending },
+                    }),
+                ]),
+            })
+            renderWithSchedules()
+
+            expect(await screen.findByText('Needs approval')).toBeInTheDocument()
+            const link = screen.getByText('View approval request').closest('a')
+            // The router prefixes links with the current project path, so match the suffix only.
+            expect(link?.getAttribute('href')).toMatch(/\/approvals\/cr-pending$/)
+        })
+
+        it.each([
+            { state: ScheduledChangeRequestState.Rejected, expectedTag: 'Rejected' },
+            { state: ScheduledChangeRequestState.Expired, expectedTag: 'Approval expired' },
+        ])('lists a $state one-time schedule in history with a $expectedTag tag', async ({ state, expectedTag }) => {
+            useMocks({ get: schedulesMock([makeScheduledChange({ change_request: { id: 'cr-denied', state } })]) })
+            renderWithSchedules()
+
+            fireEvent.click(await screen.findByText('History (1)'))
+
+            expect(await screen.findByText(expectedTag)).toBeInTheDocument()
+            expect(screen.queryByText('Active & upcoming')).not.toBeInTheDocument()
+        })
+
+        it.each([
+            { state: ScheduledChangeRequestState.Rejected, expectedTag: 'Rejected' },
+            { state: ScheduledChangeRequestState.Expired, expectedTag: 'Approval expired' },
+        ])(
+            'keeps a recurring schedule with a $state approval active but tags it $expectedTag',
+            async ({ state, expectedTag }) => {
+                useMocks({
+                    get: schedulesMock([
+                        makeScheduledChange({
+                            is_recurring: true,
+                            recurrence_interval: RecurrenceInterval.Daily,
+                            change_request: { id: 'cr-recurring', state },
+                        }),
+                    ]),
+                })
+                renderWithSchedules()
+
+                expect(await screen.findByText(expectedTag)).toBeInTheDocument()
+                expect(screen.getByText('Active & upcoming')).toBeInTheDocument()
+                expect(screen.queryByText(/^History \(/)).not.toBeInTheDocument()
+                // The link is the way to unblock a stalled recurring schedule.
+                expect(screen.getByText('View approval request')).toBeInTheDocument()
+            }
+        )
+
+        it('shows the failure reason as visible text on an errored schedule', async () => {
+            const failureReason = 'Feature flag not found (will retry automatically, 2 attempts remaining)'
+            useMocks({ get: schedulesMock([makeScheduledChange({ failure_reason: failureReason })]) })
+            renderWithSchedules()
+
+            expect(await screen.findByText('Error')).toBeInTheDocument()
+            expect(screen.getByText(failureReason)).toBeVisible()
+        })
+    })
+
     it.each([
         {
             name: 'another operation',