trunk-merge/pr-110212/b89936c3-1338-4f07-b9ed-11af55c3b79b

[trunk-io]

This pull request was created and is being managed by Trunk Merge.

This pull request is based on the master branch at SHA 3d99563a1be0535d4c0244363d3c8e3fa5aabf79.

See more details about each PR in the batch here:

• PR 110212
• PR 108441
• PR 109589

When CI completes, this pull request will be closed automatically.

Pull Requests Being Tested

This pull request is testing a batch with the changes from pull requests 110212, 108441, and 109589 - batching documentation.

Dependencies

This pull request depends on the changes from pull requests 110129 and 108396.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (15)

.cursor/rules/react-typescript.mdc — auto-discovered
.agents/skills/using-kea-disposables/SKILL.md — configured
.agents/skills/writing-ui-components/SKILL.md — configured
.agents/security.md — configured
.agents/skills/sending-notifications/SKILL.md — configured
docs/published/handbook/engineering/type-system.md — configured
.agents/skills/writing-tests/SKILL.md — configured
docs/internal/person-data-access.md — configured
.agents/skills/adopting-generated-api-types/SKILL.md — configured
.agents/skills/placing-product-frontend-code/SKILL.md — configured
.agents/skills/writing-kea-logics/SKILL.md — configured
.agents/skills/writing-user-facing-copy/SKILL.md — configured
.agents/skills/setting-feature-flags-in-storybook/SKILL.md — configured
.claude/commands/conventions.md — configured
.agents/skills/writing-code-comments/SKILL.md — configured

📝 Walkthrough

Walkthrough

The pull request changes Replay navigation and removes its comments tab and implementation. It adds grid and list views to the Replay Vision watch feed, displays copyable external IDs on customer analytics account pages, moves organization role route registration, and passes run identity to an AI Gateway rollout check.

Priority: ➖ Normal

Merge Risk: 🔵 Low · up to ae095

The changes are mergeable with a bounded component-organization follow-up. Move the grid card into its own file to satisfy repository conventions; no user-facing failure is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to ae095

The role APIs retain explicit authorization and organization scoping, while gateway rollout selection now uses the run's user identity. No introduced security failure was established, but incomplete historical and runtime verification prevents a minimal-risk assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The inspected privileged outcomes are organization role/membership mutations and minting a sandbox gateway credential for a selected product and team. Role mutations require organization-admin authority; the mint request specifies the team, product, spend cap, lifetime, acting identity when supplied, and applicable model pin. Enforcement beyond the mint-request boundary was not fully inspected.

Trust Boundaries and Controls

• observed — Client-supplied nested IDs and user_uuid encounter shared authentication, API-scope, organization-membership, and parent-query filtering controls. Membership creation independently verifies the role's organization and resolves an active user membership within that organization before storing the identity links.
• observed — The gateway environment path obtains team and distinct identity from the run context. Before minting, it checks configured routing, mintable product selection, rollout eligibility, model restrictions, and credit availability. The worker's mint credential authorizes the request; run identity is passed as an attribution and rollout input rather than as that credential.

Resilience and Maintainability Implications

• observed — The run environment path removes token-related values when the gateway-product pin cannot be recorded and clears the environment on routing exceptions. Mint requests use bounded retries and return no token after failure. These inspected transitions constrain credential injection; cleanup of credentials minted before interruption and downstream fallback guarantees remain unverified.

🚥 Pre-merge checks | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description only documents Trunk Merge batching, base commits, dependencies, and automatic closure. It does not explain the user-facing problem or changes, testing and test rationale, release stat…	Replace the batch metadata with a standalone description using the repository template. Add the Problem, Changes, and How did you test this code? sections, including test rationale and evidence or explicit limitations. Select exactly one Re…

Full details: Description check

Explanation

The description only documents Trunk Merge batching, base commits, dependencies, and automatic closure. It does not explain the user-facing problem or changes, testing and test rationale, release status, notifications, docs impact, or required agent context.

Resolution

Replace the batch metadata with a standalone description using the repository template. Add the Problem, Changes, and How did you test this code? sections, including test rationale and evidence or explicit limitations. Select exactly one Release status option. Complete Automatic notifications and Docs update. Add Agent context when applicable, including autonomy, agent/model, duplicate search, coverage, schema, public-artifact, skills, and review details. Include screenshots for the frontend changes.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

products/replay_vision/frontend/replay_scanners/components/WatchFeedCard.tsx (1)

449-449: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Move WatchFeedGridCard to its own file.

This file now exports two card components. Move WatchFeedGridCard to WatchFeedGridCard.tsx and update its consumer. Put shared card helpers in sibling modules so neither layout imports through the other.

As per coding guidelines: “One component per file” and “The moment it's exported, it moves to its own file.”

Source: Coding guidelines

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: PostHog/posthog/.coderabbit.yaml

Review profile: QUIET

Plan: Enterprise

Run ID: 8ba31dc3-cca0-4cfc-9a18-9b7c0a6ab032

📥 Commits

Reviewing files that changed from the base of the PR and between 3d99563 and ae09541.

📒 Files selected for processing (35)

• docs/internal/customer-analytics/account-sidebar.md
• ee/urls.py
• frontend/snapshots.yml
• frontend/src/initKea.ts
• frontend/src/lib/constants.tsx
• frontend/src/scenes/scenes.ts
• frontend/src/scenes/session-recordings/SessionRecordings.tsx
• frontend/src/scenes/session-recordings/filters/RecordingsUniversalFiltersEmbed.stories.tsx
• frontend/src/scenes/session-recordings/filters/RecordingsUniversalFiltersEmbed.tsx
• frontend/src/scenes/session-recordings/playlist/playlistFiltersLogic.ts
• frontend/src/scenes/session-recordings/sessionReplaySceneLogic.ts
• frontend/src/scenes/session-recordings/templates/SessionRecordingTemplates.tsx
• frontend/src/scenes/session-recordings/templates/sessionRecordingTemplatesLogic.tsx
• frontend/src/types.ts
• products/access_control/backend/presentation/role.py
• products/access_control/backend/routes.py
• products/access_control/backend/tests/test_role.py
• products/access_control/backend/tests/test_role_membership.py
• products/customer_analytics/frontend/scenes/CustomerAnalyticsAccountScene/AccountExternalId.tsx
• products/customer_analytics/frontend/scenes/CustomerAnalyticsAccountScene/CustomerAnalyticsAccountScene.stories.tsx
• products/customer_analytics/frontend/scenes/CustomerAnalyticsAccountScene/CustomerAnalyticsAccountScene.tsx
• products/replay/frontend/comments/ReplayComments.stories.tsx
• products/replay/frontend/comments/ReplayComments.tsx
• products/replay/frontend/comments/replayCommentsLogic.test.ts
• products/replay/frontend/comments/replayCommentsLogic.ts
• products/replay_vision/frontend/replay_scanners/ReplayScannersScene.stories.tsx
• products/replay_vision/frontend/replay_scanners/components/WatchFeedCard.tsx
• products/replay_vision/frontend/replay_scanners/components/WatchFeedTab.tsx
• products/replay_vision/frontend/replay_scanners/watchFeedLogic.test.ts
• products/replay_vision/frontend/replay_scanners/watchFeedLogic.ts
• products/ruff.toml
• products/tasks/backend/temporal/process_task/ai_gateway_token.py
• products/tasks/backend/temporal/process_task/tests/test_ai_gateway_token.py
• products/tasks/backend/temporal/process_task/utils.py
• pyproject.toml

💤 Files with no reviewable changes (10)

• frontend/src/initKea.ts
• frontend/src/lib/constants.tsx
• products/replay/frontend/comments/ReplayComments.stories.tsx
• products/replay/frontend/comments/replayCommentsLogic.test.ts
• products/replay/frontend/comments/ReplayComments.tsx
• frontend/src/scenes/session-recordings/filters/RecordingsUniversalFiltersEmbed.stories.tsx
• frontend/src/types.ts
• products/replay/frontend/comments/replayCommentsLogic.ts
• ee/urls.py
• frontend/src/scenes/session-recordings/templates/SessionRecordingTemplates.tsx

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 3 remain after this review.

[trunk-io]

   

Failed Test	Failure Summary	Logs
Scenes/Code review Default play-test	A logic access error occurred because 'actions' on 'scenes.userLogic' was not mounted, likely due to missing logic connection or incorrect componen...	Logs ↗︎

View Full Report ↗︎ ⋅ Docs