fix(flags): malformed flag-dependency conditions no-match locally

[patricio-posthog]

Problem

PR #734 (released as 7.22.1) added upfront validation to evaluate_flag_dependency that raises InconclusiveMatchError when a flag-dependency condition is malformed (wrong operator, missing key, or value: null).

InconclusiveMatchError is the signal that local evaluation cannot decide, so the client falls back to a network call to the billable /flags endpoint — on every evaluation of the affected flag. Customers whose flag definitions contain a single malformed dependency condition (typically legacy value: null data) went from near-zero /flags traffic to millions of requests per day.

Fix

Mirror the server-side Rust evaluator (match_flag_value_to_flag_filter), which never errors on malformed conditions — it treats them as no match:

• operator is not flag_evaluates_to → return False
• key is missing/empty → return False
• value is None/missing → return False

These are now local, definitive results: no InconclusiveMatchError, no /flags fallback. A non-matching condition just means the flag falls through to its other conditions (or evaluates to false if none match) — exactly what the server computes.

Genuinely inconclusive cases still raise and fall back to the server: referenced flag not present locally, an inconclusive dependency in the chain, circular dependencies, and missing evaluation context.

Tests

• Updated the PR fix(flags): local eval dependency fail to match #734 null-value test: it now asserts the flag resolves locally (no-match → False) with zero /flags calls.
• Added coverage for value: None, empty/missing key, and wrong operator, each asserting zero /flags calls.
• Added a control test: a flag whose only condition is the malformed dependency resolves to False locally, while a flag with a second matching condition group still resolves via that group.
• Preserved the PR fix(flags): local eval dependency fail to match #734 value: false tests.

Full feature-flags suite passes (158 passed).

Changeset

Added .sampo/changesets/malformed-flag-dependency-no-match.md (pypi/posthog: patch).

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(flags): malformed flag-dependency co..." | Re-trigger Greptile}

[github-actions]

posthog-python Compliance Report

Date: 2026-07-14 18:37:43 UTC
Duration: 338854ms

✅ All Tests Passed!

111/111 tests passed

---

Capture_V1 Tests

✅ 94/94 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	518ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	1010ms
Required Headers.Has Authorization Bearer Header	✅	1009ms
Required Headers.Has Content Type Json	✅	1009ms
Required Headers.Has Posthog Sdk Info Format	✅	1009ms
Required Headers.Has Posthog Attempt Header	✅	1009ms
Required Headers.Has Posthog Request Id	✅	1009ms
Required Headers.Has Posthog Request Timestamp	✅	1009ms
Required Headers.Has User Agent	✅	1009ms
Body Format.Body Has Created At And Batch	✅	1009ms
Body Format.No Api Key In Body	✅	1009ms
Body Format.No Sent At In Body	✅	1009ms
Event Format.Event Has Required Root Fields	✅	1008ms
Event Format.Event Uuid Is Valid	✅	1009ms
Event Format.Event Timestamp Is Rfc3339	✅	1010ms
Event Format.Distinct Id Is String	✅	1008ms
Event Format.Distinct Id At Root Not Properties	✅	1011ms
Event Format.Custom Properties Preserved	✅	1009ms
Event Format.Set Properties Preserved	✅	1008ms
Event Format.Set Once Properties Preserved	✅	1009ms
Event Format.Groups Properties Preserved	✅	1008ms
Event Format.Sdk Generates Uuid If Not Provided	✅	1009ms
Event Format.Event Has Required Root Fields Batch	✅	1013ms
Event Format.Event Uuid Is Valid Batch	✅	1013ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	1012ms
Event Format.Distinct Id Is String Batch	✅	1012ms
Event Format.Distinct Id At Root Not Properties Batch	✅	1012ms
Event Format.Custom Properties Preserved Batch	✅	1012ms
Event Format.Set Properties Preserved Batch	✅	1012ms
Event Format.Set Once Properties Preserved Batch	✅	1013ms
Event Format.Groups Properties Preserved Batch	✅	1012ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	1012ms
Batch Behavior.Multiple Events In Single Batch	✅	1508ms
Batch Behavior.Batch Envelope Smoke	✅	1013ms
Batch Behavior.Flush With No Events Sends Nothing	✅	1005ms
Batch Behavior.Flush At Triggers Batch	✅	1508ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	1011ms
Deduplication.Generates Unique Uuids	✅	1508ms
Deduplication.Different Events Same Content Different Uuids	✅	1507ms
Deduplication.Preserves Uuid On Retry	✅	7515ms
Deduplication.Preserves Timestamp On Retry	✅	7513ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	7509ms
Deduplication.No Duplicate Events In Batch	✅	1508ms
Header Behavior On Retry.Attempt Header Starts At One	✅	1009ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	14525ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	7505ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3519ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	7515ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	1006ms
Response Format Validation.Success Response Has Ok For Each Event	✅	1507ms
Response Format Validation.Success No Retry After When All Ok	✅	1508ms
Response Format Validation.Success Retry After Present When Retry Events	✅	2511ms
Response Format Validation.Success No Retry After When Drop Only	✅	1507ms
Response Format Validation.Response Echoes Request Id	✅	1009ms
Retry Behavior.Retries On 408	✅	7515ms
Retry Behavior.Retries On 500	✅	7513ms
Retry Behavior.Retries On 503	✅	9515ms
Retry Behavior.Retries On 504	✅	7513ms
Retry Behavior.Retryable Errors Have Retry After	✅	4509ms
Retry Behavior.Respects Retry After On Retryable Error	✅	12517ms
Retry Behavior.Does Not Retry On 400	✅	3505ms
Retry Behavior.Does Not Retry On 401	✅	3508ms
Retry Behavior.Does Not Retry On 402	✅	3507ms
Retry Behavior.Does Not Retry On 413	✅	3510ms
Retry Behavior.Does Not Retry On 415	✅	3507ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	3509ms
Retry Behavior.Implements Backoff	✅	23528ms
Retry Behavior.Max Retries Respected	✅	23525ms
Partial Batch Handling.Handles 200 Full Success	✅	3001ms
Partial Batch Handling.Handles 200 With All Ok	✅	4508ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	4508ms
Partial Batch Handling.Does Not Retry Limited Events	✅	4508ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	7510ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	7516ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	7512ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	7513ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	7509ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	7512ms
Partial Batch Handling.Respects Retry After On Partial	✅	9513ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	4510ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	4507ms
Compression.Sends Gzip Content Encoding	✅	1008ms
Compression.No Content Encoding When Disabled	✅	1009ms
Compression.Compressed Body Is Decompressible	✅	1009ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	3509ms
Event Options.Cookieless Mode Override	✅	1008ms
Event Options.Disable Skew Correction Override	✅	1008ms
Event Options.Process Person Profile Override	✅	1009ms
Event Options.Product Tour Id Override	✅	1008ms
Event Options.Unset Options Omitted	✅	1009ms
Event Options.Options Override In Batch	✅	1011ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	1009ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	1008ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	1009ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	1006ms
Request Payload.Flags Request Uses V2 Query Param	✅	1007ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	1007ms
Request Payload.Flags Request Omits Authorization Header	✅	1007ms
Request Payload.Token In Flags Body Matches Init	✅	1006ms
Request Payload.Groups Round Trip	✅	1007ms
Request Payload.Groups Default To Empty Object	✅	1007ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	1006ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	1007ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	1006ms
Request Lifecycle.No Flags Request On Init Alone	✅	503ms
Request Lifecycle.No Flags Request On Normal Capture	✅	1507ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	1011ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	1003ms
Retry Behavior.Retries Flags On 502	✅	1006ms
Retry Behavior.Retries Flags On 504	✅	1007ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	1509ms

[turnipdabeets]

LGMT, but two questions before merging:

1. Should we log when we skip a malformed condition? The Rust side doesn't return false silently — it does tracing::error!("Flag filter operator for property type Flag must be flag_evaluates_to, skipping...") before returning. With the raise removed and no log added, a customer with a malformed condition now gets False forever with zero breadcrumbs. A log.warning (maybe once per flag key to avoid hot-path spam) would let them discover their broken flag definitions locally.

2. Why does missing dependency_chain stay inconclusive? It's equally "malformed server data", and it would cause the exact same billable-fallback-on-every-evaluation storm this PR fixes — just triggered by a different shape. Is there a case where the server genuinely resolves it better, or should it also be a definitive no-match? Fine as a follow-up, just want the reasoning recorded.

[ioannisj]

LG left a minor comment spotted by my agent

[ioannisj]

if the server's cohort evaluator treats a malformed flag-dep condition as "never contributes to a match, negated or not," then the SDK now diverges?

[patricio-posthog]

I checked the Rust side, and the server's cohort evaluator doesn't skip these, so no new
divergence. evaluate_cohort_filter routes any non-cohort filter (including flag-type)
through evaluate_property_with_negation
(rust/feature-flags/src/cohorts/cohort_operations.rs), where match_property returns an
error for FlagEvaluatesTo (rust/feature-flags/src/properties/property_matching.rs:532)
and .unwrap_or(false) turns that into false, and then negation is applied. So the
server's behavior for a malformed flag-dep inside a cohort is exactly false-then-negate,
which is what this code now does too.

[patricio-posthog]

LGMT, but two questions before merging:

1. Should we log when we skip a malformed condition? The Rust side doesn't return false silently — it does tracing::error!("Flag filter operator for property type Flag must be flag_evaluates_to, skipping...") before returning. With the raise removed and no log added, a customer with a malformed condition now gets False forever with zero breadcrumbs. A log.warning (maybe once per flag key to avoid hot-path spam) would let them discover their broken flag definitions locally.
2. Why does missing dependency_chain stay inconclusive? It's equally "malformed server data", and it would cause the exact same billable-fallback-on-every-evaluation storm this PR fixes — just triggered by a different shape. Is there a case where the server genuinely resolves it better, or should it also be a definitive no-match? Fine as a follow-up, just want the reasoning recorded.

Good questions @turnipdabeets

1. About logging: I agree, I pushed a commit adding a log.warning at the early return, mirroring the Rust side's tracing::error!.

2. About the missing dependency_chain and why it stays inconclusive: the distinction is server parity. The three malformed shapes return False because the server's evaluator (match_flag_value_to_flag_filter in rust/feature-flags/src/flags/flag_matching_utils.rs) computes the same false for them, and answering locally can't diverge. But a missing dependency_chain is different, bcause the condition itself may be perfectly well-formed, and returning False there could silently flip a flag the server would say is true.

I agreed it's worth a follow-up though.