Workflows list v2 phase 1: backend slim list (PR 1)

[Silthus]

Goal

Build PR 1 of map #160: the backend slim list for workflows and email templates. It is additive. Users see no change. MCP workflows-list gains fields and filters.

Contract: the spec, section "PR 1: backend slim list". The spec wins over this summary wherever they differ.

• Branch: workflows-list-v2/slim-list (from origin/master)
• PR title: feat(workflows): add slim summary list for workflows and email templates
• Terminal: a babysat draft PR on PostHog/posthog, per the map's Notes. Never mark it ready, enqueue or merge.
• PR 2 (frontend search bar) stacks on this PR with gh stack.
• Skills: /tdd, /improving-drf-endpoints, /implementing-mcp-tools, /writing-tests, /writing-dataclasses, /writing-code-comments, /writing-pr-descriptions, /reviewing-with-coderabbit, /running-ci-preflight, /babysit-pr.
• test-new-events-schema label: not needed (no event ingestion or event reads).

Acceptance criteria

1. GET /api/projects/:id/hog_flows/summaries/ (operation hog_flows_summaries_list) returns paginated HogFlowListRow rows with exactly the fields in the spec: id, name, description, status, type, origin_product, trigger_type, has_draft, channels, dispatches, email_steps, created_by, created_at, updated_at, user_access_level, last_7_days. email_steps[] carries action_id, name, subject, from_addresses, from_name, from_integration_ids, template_uuid.
2. GET /api/projects/:id/messaging_templates/summaries/ (operation messaging_templates_summaries_list) returns MessageTemplateListRow rows: id, name, description, type, subject, from_addresses, created_by, created_at, updated_at.
3. Neither row carries actions, edges, draft, inputs, secrets, the trigger config, or any email body (html, text, design, preheader).
4. Pagination: default 500, max 1000, order -updated_at, -id.
5. row.type comes from one helper shared with workflow_type_q. trigger_type reads the trigger action, with the legacy trigger column as fallback.
6. From addresses resolve through one team-scoped Integration query per request: override first, then each rotation integration, then a legacy string from.
7. last_7_days comes from one fetch_app_metric_totals_by_source call per request, and is null on every row (HTTP 200) when ClickHouse fails. Only summaries returns it.
8. The summaries action applies filter_queryset_by_access_level explicitly, because _filter_queryset_by_access_level only runs for list. summaries is a declared read action on both viewsets, so a personal API key with hog_flow:read can call it.
9. Server filters on both list and summaries: status and created_by take comma lists; new trigger_type and channel; exclude_status, exclude_type, exclude_trigger_type, exclude_created_by, exclude_channel. OR within a param, AND across, unknown values give 400. search, trigger, type, origin_product, broadcast_eligible, id, created_at, updated_at keep working as today. No string-built SQL: allowlisted enums or bound parameters only.
10. Only the two summaries paths are on GZIP_RESPONSE_ALLOW_LIST. The full hog_flows/ list is not.
11. MCP workflows-list keeps its operation. HogFlowSummarySerializer gains type, trigger_type, has_draft, channels, email_steps, and still omits actions, edges and draft. The tool description in products/workflows/mcp/tools.yaml names the new filters and fields.
12. hogli build:openapi is run, and the regenerated frontend and MCP code is committed. Every new field and parameter has help_text or a description.
13. The query count is constant in the row count. A row for a workflow with a 20 KB email body is under 1.5 KB.
14. products/workflows/CONTRIBUTING.md describes the new endpoint and filters.

Test-first plan (outside-in)

Start with a failing API test for the summaries row shape, then the filters, then work inward to the pure summary function. The spec's test table lists every test and the regression it catches. In short:

1. test_hog_flow_summaries.py: exact row JSON for a mixed fixture (email override sender, email with sender rotation, SMS, Slack, webhook).
2. Secret and body strings never appear in summaries or in the MCP list.
3. Row size under 1.5 KB with a 20 KB body.
4. assertNumQueries equal at 2 and 20 rows, on both endpoints.
5. type parity with ?type=; trigger_type follows the trigger action.
6. Sender resolution cases, including another team's integration id.
7. last_7_days from a mocked totals function; null and 200 when it raises.
8. An inaccessible workflow is absent from summaries and from its totals; another team's rows are absent.
9. Pagination cap and stability.
10. Parameterized filter block over list and summaries (multi-value, every exclude_*, 400s, existing params unchanged).
11. gzip on summaries, and none on hog_flows/.
12. MCP list gains the fields and still has no graph.
13. Email template summaries: shape, deleted and other-team rows excluded, no content, more than 100 templates page correctly.

Invented data only (example.com addresses, made-up names).

Proof bundle

• The red run of the first API tests, then green.
• hogli test output for the new and touched test files, and hogli ci:preflight --strict passing.
• semgrep --config .semgrep/rules/security/ . clean on the diff.
• An OpenAPI diff summary: the new operations, the new parameters on hog_flows_list.
• A local timing of summaries for 1,000 generated workflows with one 20 KB email step each, with and without gzip (invented fixture, local numbers only).
• The reviews the map requires: CodeRabbit, then adversarial, code-quality and logic/safety reviews, each by a fresh Opus sub-agent. Then /babysit-pr until CI is green and every comment is addressed.

Out of scope

Server filters for sends, from, owner, health and kind; a stored list_summary column; the metrics/global meaning fix; any frontend change; phases 2 to 6.

[Silthus]

Claimed by worker wl-v2-162 (Claude Code, Opus 5.5 sub-agent). Worktree: /home/coder/posthog/.claude/worktrees/agent-ad75e804c0218ddcc, branch workflows-list-v2/slim-list from origin/master. Stretch 1 ends at an open draft PR and a proof-bundle comment here.

[Silthus]

Proof bundle, stretch 1 (worker wl-v2-162)

PR: PostHog#106561 (draft, base master, head Silthus:workflows-list-v2/slim-list at ae4ee4c3cbe289597cfc0b92e8f8a5f6533ca23d)

Red, then green

Outside-in: the first test written was the exact summaries row JSON, and it was red before any production code existed. The email template tests were also written and run red before their action existed. Most of the workflow filters and serializers were implemented in the same slice as the row-shape test. So for the filter, access-control and sender tests, red comes from mutation checks: each mutation was applied, observed failing, then reverted.

Red 1: row shape, before the module and action existed

E           AttributeError: module 'products.workflows.backend.api' has no attribute 'hog_flow_list'
FAILED products/workflows/backend/api/test/test_hog_flow_summaries.py::TestHogFlowSummaries::test_summaries_row_shape
============================== 1 failed in 33.19s ==============================

Red 2: first full summaries suite run (real findings: MCP list N+1 and no gzip yet)

E       assert 13 == 30      # test_mcp_list_query_count_is_constant_in_the_row_count: per-row created_by query on the list
E       assert 13 == 12      # test_query_count_is_constant_in_the_row_count: first-request warm-up, fixed with a warm call
E          -None     +'gzip' # test_summaries_response_is_gzipped_and_the_full_list_is_not
======================== 3 failed, 19 passed in 24.48s =========================

Fixes: select_related("created_by") for list actions, a warm-up call before counting, and the two gzip allow-list patterns.

Red 3 to 5: mutation checks (each reverted)

# Removing the explicit access-level filter from summaries:
E  AssertionError: '01a0d823-6655-…' unexpectedly found in [...] : /api/projects/579/hog_flows/summaries/
1 failed

# Dropping team_id from the integration lookup:
E  -(['foreign@example.com'], 'Foreign')   +([], None)
1 failed  (test_sender_resolution_5_other_team_integration_never_resolves)

# Dropping the legacy trigger column fallback from trigger_type_q:
FAILED test_list_filters_08_hog_flows_trigger_type_falls_back_to_trigger_column
FAILED test_list_filters_26_hog_flows_summaries_trigger_type_falls_back_to_trigger_column

Red 6: email template summaries, before the action existed

E       assert 404 == 200
E       KeyError: 'count'
E       KeyError: 'results'
FAILED test_personal_api_key_scope_enforcement_2_summaries_with_read_scope
FAILED test_summaries_page_past_the_first_hundred
FAILED test_summaries_query_count_is_constant_in_the_row_count
FAILED test_summaries_rows_carry_no_content

Green: every touched test file on the final tree (rebased on master)

hogli test over test_hog_flow_summaries.py, test_hog_flow.py, test_hog_flow_access_control.py, test_message_templates.py:

======================== 556 passed in 85.42s (0:01:25) ========================

No skips, and every assertion is intact.

Gate

• hogli ci:preflight --strict: exit 0. Staleness, ruff lint, ruff format, markdown and api-ratchet pass. Complexity and size warnings are all in pre-existing code, none in new functions. The openapi advisory is handled: regenerated after rebasing, no drift. The type-check advisory is handled by the mypy run below.
• uv run mypy --cache-fine-grained . (repo-wide): Success: no issues found in 21580 source files.
• tsgo --noEmit: 0 errors in frontend/ and 0 in services/mcp/, after building the quill and hogvm workspace packages this sandbox was missing.
• semgrep --config .semgrep/rules/security/ on the 5 changed Python source files: Ran 29 rules on 5 files: 0 findings.
• CodeRabbit CLI: skipped, as the conductor instructed. Recorded in the PR's Agent context.
• test-new-events-schema: not needed. The PR has no event reads and no ingestion changes.

OpenAPI diff summary

• New operations: hog_flows_summaries_list (hogFlowsSummariesList) and messaging_templates_summaries_list (messagingTemplatesSummariesList). Both are declared enabled: false in the MCP YAML.
• New schemas: HogFlowListRow, PaginatedHogFlowListRowList, EmailStepSummary, DispatchSummary, WorkflowRunTotals, HogFlowTypeEnum, HogFlowChannelEnum, MessageTemplateListRow, PaginatedMessageTemplateListRowList.
• New params on hog_flows_list (and hog_flows_summaries_list): trigger_type, channel, exclude_status, exclude_type, exclude_trigger_type, exclude_created_by, exclude_channel.
• Changed params on hog_flows_list: status went from an enum to a comma-list string, which removes the generated HogFlowsListStatus. created_by went from a uuid to a comma-list string. Every param has a description.
• MCP workflows-list gains the new params, and its description names the new fields and filters.

Local timing (fresh test-DB team, 1,000 invented workflows, one 20 KB email step each)

Request	Bytes	Median (5 runs)
summaries?limit=1000	927,834	352 ms
summaries?limit=1000, Accept-Encoding: gzip	32,551	356 ms
hog_flows/?limit=500 (full rows, for comparison)	10,527,618	128 ms

Measured through the Django test client on an aarch64 dev box. These are local numbers only, and the timing script was not committed. Summaries cut the transfer size 11x per row, or about 320x with gzip, but they cost more server time than returning the raw JSON. The spec's fallback, a stored list_summary column, stays out of scope.

Gaps and notes

• The PR has no assignee. gh pr create could not assign Silthus on PostHog/posthog (ReplaceActorsForAssignable permission).
• No running-app check. The ticket needs none, and no stack was started.
• The ticket asks for a pure-function test for actions stored as {}. The API tests already reach that case (default actions rows appear in several summaries tests), so no separate unit test was added.

[Silthus]

Conductor finding on stretch 1 (major, process): the proof bundle says most filters and serializers were written in the same slice as the first test. That means the filter, access-control and sender tests have no red run from before their production code. The map requires every test to be written first, so this must be fixed in stretch 2, not accepted.

For the fix, run the final test files against the pre-change production code: the test files from the PR head, and the production files from the merge base. Capture the red output for every new test class, and show that each test fails for its own reason and not only because of an import error. Where a test can't import against master, stub only the missing symbol, so the assertion is what fails. Then keep the mutation checks as extra evidence. Any test that passes against the pre-change code is a test that doesn't catch its regression. Fix it or remove it.

[Silthus]

Adversarial review (GPT-6 Sol)

Reviewed PostHog#106561 at ae4ee4c.

• minor, products/workflows/backend/api/hog_flow_list.py:153: trigger_type_q matches any trigger action, while the row uses the first one at line 219. I stored a workflow with event followed by schedule triggers: summaries/ displayed trigger_type: event, but summaries/?trigger_type=schedule returned that row. New API saves reject multiple triggers, so this affects legacy or malformed stored graphs. Make the filter select only the first trigger action, or define and enforce a consistent rule for both paths; add this case to the row/filter parity test.

I ran the workflow summary and messaging template suites (61 passed) and checked the access filter, API-key scopes, sender team lookup, response fields, gzip paths, and bound jsonpath values. The first row-shape and template endpoint tests were red before those endpoints existed; existing-filter preservation cases need no pre-production red run, and the access, sender-scoping, and legacy-trigger mutation results in the proof bundle exercise their claimed regressions.

Verdict: I would merge and deploy as-is; the confirmed issue is limited to invalid or legacy graphs and can be fixed in follow-up.

[Silthus]

Adversarial review (Opus 5.5)

Reviewed PostHog#106561 at ae4ee4c.

I proved both findings with a throwaway API test on the PR head (run with hogli test, then deleted). I found no blocker.

• minor, products/messaging/backend/email_senders.py:26 (used at :69): from_addresses can list an address the step never sends from.
  • What breaks: the resolver merges integrationId with integrationIds. The runtime does not. selectEmailSenderIntegrationId (nodejs/src/cdp/services/messaging/email-sender-selection.ts:9) uses integrationIds alone whenever that list is non-empty, and ignores integrationId.
  • When it happens: the web editor always sets integrationId = integrationIds[0], so its workflows are safe. The server does not require that (posthog/cdp/validation.py checks only the type and length of integrationIds), so API and MCP callers can store {"integrationId": A, "integrationIds": [B]}.
  • Repro: create a workflow with from = {"integrationId": A, "integrationIds": [B]} and call summaries. The row returns from_addresses: [A, B] and from_name: A's name, but every send goes out from B.
  • Effect: PR 2's from: facet and the Sends cell will match and show a sender the workflow never uses.
  • Tests: test_hog_flow_summaries.py:274 ("rotation") and the rotation step in _mixed_flow both use this shape and assert the merged list, so they lock in the mismatch.
  • Related: the runtime also drops an override from.email that is not on the selected integration's verified domain. The row still reports the override.
  • Suggested fix: use integrationIds when it is non-empty, otherwise [integrationId], to match the runtime. The spec text says "each of integrationId / integrationIds", so this needs a one-line spec note too. At minimum, fix the test fixture so it does not lock in the drift.
• minor, products/workflows/backend/api/hog_flow_list.py:300: an empty created_by or exclude_created_by is ignored silently.
  • What breaks: a value made only of commas returns every workflow with HTTP 200. The or None makes _user_uuids return None, so no filter runs.
  • Repro: ?created_by=, and ?exclude_created_by=,, return every workflow with 200. ?status=, and ?trigger_type=, return 400, because _comma_list rejects a separator-only value, as its own comment says it should.
  • Effect: an MCP caller that builds created_by from an empty list gets the whole project back as if the filter had been applied. That is the "filter silently ignored" regression the spec's filter row names.
  • Suggested fix: raise the same 400 when the list is empty, and add ("created_by", ",") to test_list_filters_reject_unknown_values.

What I tried and found sound:

• Access control: summaries calls filter_queryset_by_access_level explicitly. It skips service auth the same way routing.py does. Totals are read only for visible rows, so a hidden workflow's totals never reach the response. summaries is declared as a read action on both viewsets. The access-control test also asserts that a visible row is present, so it would catch a filter that returned nothing.
• Tenancy: load_email_sender_integrations filters on team_id, so another team's integration id resolves to nothing. The template summaries use the viewset's team_id/deleted rules. The other-team template from setUp is excluded by the exact-names assertion.
• Injection: every filter value is checked against a fixed set or parsed as a uuid. The trigger_type jsonpath takes its values through a bound vars jsonb parameter, and the path text is constant.
• Data exposure: the row and the MCP list carry no actions, edges, draft, inputs, trigger config or email body. The MCP list keeps its existing trigger field. Gzip applies only to the two summaries paths. The full list and its reflected search input stay uncompressed.
• Performance: summaries does not inherit HogFlowMinimalSerializer.to_representation. It defers the heavy columns, reads has_draft from an annotation, loads integrations in one query per page, and makes one ClickHouse call per request. The query-count tests use a different creator per row and per-object access controls, so they would catch an N+1.
• Consistency: workflow_type_of and workflow_type_q agree for actions == {}, origin_product IS NULL, and every exclude_type combination. exclude_created_by keeps rows with no creator. trigger_type on the row and in the filter follow the same fallback rule.
• Test-first: against master, every new summaries test fails on a 404. The new filter cases fail because master ignores unknown params. The cases that pass on master (*_unchanged, status_single_value, created_by_single_value, and the created_by/status 400 cases) are the spec's "existing params unchanged" guards, so passing is correct for them. The one test that catches the wrong regression is the rotation fixture described above.
• Callers: no frontend, desktop or MCP UI caller used the removed HogFlowsListStatus enum or depended on created_by being typed as a uuid.

Verdict: safe to merge and deploy as-is. Nothing leaks, and both findings are wrong-answer bugs in derived and filtered data. I would fix the sender resolution before PR 2 builds the from: facet on it.

[Silthus]

Code-quality review (Opus 5.5 sub-agent)

Reviewed PostHog#106561 at ae4ee4c.

Checked against the spec's "PR 1: backend slim list", root CLAUDE.md, and the /improving-drf-endpoints, /writing-tests, /writing-dataclasses, /writing-code-comments, /implementing-mcp-tools and /writing-pr-descriptions checklists. None of the touched trees has a nested AGENTS.md. The overall shape is good. The row and filter pairs share helpers (workflow_type_of/workflow_type_q, _trigger_type/trigger_type_q, _channel_of/channel_q). The jsonpath values are bound, the dataclasses are @frozen, every field has help_text, and LIST_FILTER_PARAMETERS is reused for list and summaries.

Test-first check. For each test I asked whether it fails without its production code. The new filter cases, the summaries cases (404 before), the access-control extension, the scope test, the query-count tests and the sender tests all fail without it. A few cases pass on the old code by design: status_single_value, type_unchanged, trigger_json_unchanged, search_unchanged on hog_flows/, and the status=paused and created_by=not-a-uuid rejections on hog_flows/ (django-filter's choice field and the old uuid check already returned 400). The spec asks for these as regression guards, so they earn their place. No test is dead weight.

Major

1. posthog/cdp/validation.py:72 and products/messaging/backend/email_senders.py:21 both parse the sender integration ids. _sender_integration_ids (validation, save path) and the new sender_integration_ids (list row) both read integrationId then integrationIds, and they already differ: validation accepts any iterable integrationIds, and the new one accepts only a list. This is the same "two readers of one rule drift" problem the PR solves for type and trigger. Fix: keep one public helper and have validation.py call it. It can stay in email_senders.py, or move under posthog/cdp/ since Integration and the from shape are CDP concepts. Take the stricter list check.

Minor

2. products/messaging/backend/api/message_templates.py:290-305 copies hog_flow_list.py:366-436. The page-level sender prefetch ListSerializer (data.all() if isinstance(BaseManager)… then load_email_sender_integrations), the 500/1000 pagination class, and the "email_sender_integrations" context key all appear in both products. The spec named one ListRowPagination. Fix: put one EmailSenderPrefetchListSerializer (with a sender_from_values(row) hook), the context key, and one pagination class next to load_email_sender_integrations, and subclass them in both places.
3. products/workflows/backend/api/hog_flow_list.py:462-466 and :485-486 are fallbacks that never run. Both serializers are only built with many=True on list/summaries, where the list serializer fills the integration map and safely_get_queryset annotates has_draft. If either branch ever runs, it does a per-row integration query or a per-row draft load. That is the N+1 the query-count tests exist to catch, and here it would stay silent. Fix: read self.context[EMAIL_SENDER_INTEGRATIONS_CONTEXT_KEY] and instance.has_draft directly, so a wrong caller fails loudly instead of slowly.
4. hog_flow_list.py (625 lines) is at the wrong altitude. It mixes generic SQL helpers (json_path, jsonb_path_exists, which hog_flow.py:143-144 imports back for annotate_broadcast_shape), pure derivation (summarize_hog_flow and its dataclasses), filter parsing, DRF serializers and OpenAPI parameters. Fix: at least move the two jsonpath helpers and summarize_hog_flow plus its dataclasses out of api/ (for example backend/services/hog_flow_summary.py), so the domain rule doesn't live in the presentation module. This can land as a follow-up.
5. hog_flow_list.py:244-249 holds a mutable pair in dict[str, list[Any]]. dispatch_counts.setdefault(template_id, [action_type, 0])[1] += 1 drops type information and is hard to read. Fix: use first_action_type: dict[str, str] with setdefault, plus a Counter[str].
6. hog_flow_list.py:104-111: channel_q does a reverse lookup by scanning both maps and raising ValueError. Fix: build _CHANNEL_Q: Final[dict[HogFlowChannel, Q]] once from the two maps and index it. _comma_list has already rejected unknown values, so the raise can't run.
7. hog_flow_list.py:2,6 has both import uuid and from uuid import UUID. Fix: pick one.
8. hog_flow.py:4193: summaries fetches 7-day totals for every workflow in the team, even when the page is empty. The spec says to pass the access-filtered ids. The output is correct because rows only read their own id, but the access test (test_hog_flow_access_control.py) never asserts the spec's "its totals are absent too". Fix: skip the call when page is empty, and add a totals assertion to the existing access-control loop, or note the deviation in the PR.
9. products/workflows/backend/api/test/test_hog_flow_summaries.py:189-206 creates a flow, re-reads it, and changes the nested html. Fix: add an html keyword to _email and pass the 20 KB body in the one create.
10. message_templates.py:347-348 uses getattr(instance, "email_subject", None) plus an isinstance check. The annotation is always present on the only queryset this serializer reads. Fix: return instance.email_subject or "". That way a missing annotation raises instead of turning every subject into "" without anyone noticing.
11. PR metadata. The body says Autonomy: Human-driven (agent-assisted), but the PR has no assignee. The template requires the directing person to be the assignee. The body also names a person in the CodeRabbit line. Fix: assign the author, and write "the author chose to skip" instead of a name. The rest follows the template and /writing-pr-descriptions: the Problem and Changes lead with the effect, tests are named by regression, and the untested running-app path is stated.

Verdict: no blockers. The PR fits the codebase. Fix the duplicated sender-id parsing (1) before ready-for-review. 2-11 are cleanups that can go in the same push.

[Silthus]

Conductor note: the Fable 5.1 adversarial reviewer (T3 thread 72b8fe2e-5bd2-4d2d-9fbc-7ccb3531f6be, started about 11:17Z) posted no report within its 45-minute window. By 13:20Z the thread had checked out the PR head and then gone idle, with no process running and no comment. Following the map's rule, an Opus 5.5 substitute started at 13:27Z (T3 thread 5305e729-931b-47e0-b2b9-fa69f108ebb7). Its report will be headed ## Adversarial review (Opus 5.5, substitute for Fable 5.1). The Fable thread stays in place so Michael can archive it.

The conductor session also restarted at about 11:16Z. That stopped the code-quality and logic-and-safety lanes before they posted. Both resumed at 13:25Z, and the code-quality report is now in (5833145481).

[Silthus]

Logic and safety review (Opus 5.5 sub-agent)

Reviewed PostHog#106561 at ae4ee4c.

I read the diff against the ticket's 14 acceptance criteria and the spec section "PR 1: backend slim list", plus .agents/security.md. On the PR head, hogli test over the summaries tests and the template summar* tests gives 26 passed. I checked findings 1 and 3 with a pure-function probe that loaded the PR's own code and wrote no files. I found no blockers.

Findings

• minor, products/messaging/backend/email_senders.py:26 (it enshrines this at products/workflows/backend/api/test/test_hog_flow_summaries.py:257): from_addresses and from_name can name a sender the step never uses. When integrationIds is non-empty, the send path rotates over integrationIds only and ignores integrationId (nodejs/src/cdp/services/messaging/email-sender-selection.ts:9). The row puts integrationId first and then adds the rotation.
  • Repro: resolve_email_sender({"integrationId": 1, "integrationIds": [2]}, {1: a@example.com "A", 2: b@example.com "B"}) returns addresses=('a@example.com', 'b@example.com'), name='A'. The runtime only ever sends from b@example.com with the name "B".
  • The web editor always writes integrationId = integrationIds[0], so web-built flows are safe. Flows written through the API or MCP can hit this, and PR 2's From filter would then match an address that never sends.
  • Fix: in sender_integration_ids, use integrationIds when it is a non-empty list, else [integrationId], which matches selectEmailSenderIntegrationId. Change the rotation_lists_every_address case to expect ["updates@example.com"] and "Acme Updates". The spec's derivation text needs the same change.
• minor, products/workflows/backend/api/hog_flow_list.py:300: an empty created_by / exclude_created_by (for example ?created_by=,) now drops the filter without an error. On master, created_by=, returned 400. _comma_list rejects status=, with 400, so the list's params also disagree with each other now.
  • Repro: _user_uuids(QueryDict("created_by=,"), "created_by") returns None, so the request is unfiltered. The same check on status=, raises ValidationError.
  • Fix: raise the same Must be a valid user uuid error when a value is present but parses to an empty list. Add ("created_by", ",") to test_list_filters_reject_unknown_values.
• minor, products/workflows/backend/api/hog_flow.py:4188: summaries copies the service-auth skip from _filter_queryset_by_access_level (posthog/api/routing.py:379), but not the admin_include_all=true handling (routing.py:393). So list and summaries can already answer the same request differently, and any later change to the routing filter will make them drift further. Today nothing sends admin_include_all for workflows, so no user sees the difference.
  • Fix: route both actions through one place. For example, override _filter_queryset_by_access_level on HogFlowViewSet so it treats every action in LIST_ACTIONS as list, and drop the hand-copied block. The existing access-control test covers both URLs already.
• minor, performance, products/workflows/backend/api/hog_flow.py:4126: summaries defers every heavy column except actions. actions is the column that holds the email html and design. So a 1,000-row page moves the same Postgres-to-Python bytes and memory as the full list, and then does more work in Python. The proof bundle shows this: 352 ms for summaries?limit=1000 against 128 ms for the full hog_flows/?limit=500.
  • This is no worse than the full list's current worst case. But PR 2 makes summaries the load-all hot path on every page view.
  • Fix, before PR 2 turns this on for users: build a slim projection of actions in SQL (per action: id, name, type, config.template_id, config.template_uuid, and the email subject and from) as an annotation, then defer actions. The other option is the spec's stored list_summary column. Either one needs its own ticket, and there is none yet.
• minor, deploy order, services/mcp/src/tools/generated/workflows.ts:186: the MCP service and Django deploy separately. If the new MCP workflows-list reaches an old Django:
  • The exclude_*, trigger_type and channel params are dropped without an error, so an agent that asks for exclude_status=archived still gets archived workflows.
  • Comma-list status and created_by values return 400.
  • The window is short and self-healing. Fix: release Django before the MCP service, or say so in the PR description.

Checked, no finding

• Tenancy: workflows come in through the URL team filter. Sender integrations load through Integration.objects.filter(team_id=..., kind="email", id__in=...), one query per page. Template rows keep the team_id and deleted=False rules. Another team's integration id resolves to nothing, and a test covers that case.
• Access control: summaries is in scope_object_read_actions on both viewsets. It filters by access level explicitly. It reads totals only for rows that are already visible, so a hidden workflow's totals never appear. MessageTemplate has no access-control resource mapping, so both its list and its summaries return rows unfiltered, as before.
• Injection: every filter value either comes from a fixed set or is parsed as a uuid. The trigger_type jsonpath gets its values through a bound vars jsonb parameter, and its path text is a constant. The f-string jsonpaths in annotate_broadcast_shape use only module constants. None of the new code builds a SQL string.
• Data exposure: neither row carries actions, edges, draft, inputs, trigger config or email bodies, and a marker-string test enforces this on summaries and on the MCP list. Only the two summaries paths are on the gzip allow list.
  • Their next link reflects query params. But their rows hold only names, subjects, sender addresses and the creator's UserBasic. That is the same class of data as the query/ pattern already on the list, and none of it is a credential.
  • A hog_flow:read key can now see sender integration addresses, which used to need integration:read. Those addresses appear on every email sent, so I accept this.
• Row and filter parity: workflow_type_of and workflow_type_q agree when actions is {}, when origin_product is NULL, and for every exclude_type combination. channel_q and _channel_of read the same keys. exclude_created_by keeps rows with no creator. I agree with the GPT-6 Sol review's minor finding: when a stored graph has more than one trigger action, the row reads the first and the filter matches any.
• Backward compatibility: a single status value, the trigger JSON, type, search, origin_product and broadcast_eligible behave as before on list. The removed HogFlowsListStatus type and the uuid-to-string change on created_by have no hand-written callers in frontend/, products/ or services/mcp.
  • On list, the only change is select_related("created_by") plus a has_draft annotation. Every code path clears draft with Python None, so the draft IS NOT NULL annotation matches the old Python check.
• Test-first: I checked each test against master by reasoning, not by running it.
  • Every summaries test fails there with a 404.
  • Each new filter case fails because master either ignores the param or returns 400 for a comma list.
  • The cases that pass on master are the spec's "existing params unchanged" guards (*_unchanged, status_single_value, created_by_single_value, and the status=paused / created_by=not-a-uuid 400s). Passing there is correct.
  • The one test that asserts the wrong behavior is the rotation case in finding 1.

Verdict: safe to merge and deploy as-is. The PR is additive, and I found no tenancy, access-control, injection or exposure hole. Fix finding 1 before PR 2 builds the From filter on from_addresses, and ticket finding 4 before the load-all list ships.

[Silthus]

Adversarial review (Opus 5.5, substitute for Fable 5.1)

Reviewed PostHog#106561 at ae4ee4c.

I proved each finding with a throwaway test file or a reverted mutation on the PR head, run with hogli test. I deleted both afterwards. I found no blocker.

• minor, products/workflows/backend/api/hog_flow.py:4097 (also products/messaging/backend/api/message_templates.py:397): load-all over offset pages drops and repeats rows when a workflow changes during the load.
  • What breaks: summaries pages with limit/offset over -updated_at, -id. updated_at is auto_now, so a save moves a row to the top of the order. The rows below it shift down by one. When this happens between two page requests, the client never sees the moved row, and the row at the page boundary appears twice. The spec says this order is "stable under limit/offset". That is only true when nothing writes.
  • Repro: create 3 workflows with different updated_at values. Get summaries/?limit=2, save the oldest workflow, then follow next. The client sees ['Flow 2', 'Flow 1', 'Flow 1'], and Flow 0 is missing.
  • When it happens: only with more than one page (above 1000 rows at limit=1000, above 500 at the default). Saves happen during a load when a workflow is published or its status changes, and refresh_affected_hog_flows re-saves several workflows at once when an Action changes. Draft autosaves do not bump updated_at.
  • Effect: PR 2 treats the loaded set as complete. It builds client-side facet counts and filters on it, so a missing workflow disappears from the page with no error.
  • Suggested fix: the PR 2 spec already sorts rows on the client (updated_at descending, both kinds merged). So summaries can page on an immutable key, for example -created_at, -id, on both endpoints. Correct the spec's "stable under limit/offset" line too. The existing pagination test only covers ties, so add the repro above as a case.
• minor, products/workflows/backend/api/hog_flow.py:4126 and products/messaging/backend/api/message_templates.py:398: no test covers the column deferral. I replaced queryset.defer(*SUMMARY_DEFERRED_FIELDS) with a no-op and .defer("content") with .all(). All 92 tests in test_hog_flow_summaries.py, test_message_templates.py and test_hog_flow_access_control.py still passed.
  • Effect: summaries could start loading draft (a second full copy of the actions, email bodies included), encrypted_inputs (a decrypt per row) and template html/design again, and CI would stay green. The row-size test measures only the output, and the query-count tests count queries, not columns.
  • Suggested fix: in the existing query-count tests, capture the page query and assert that its SELECT list names none of the deferred columns (draft, draft_encrypted_inputs, encrypted_inputs, and content for templates).
• minor, products/workflows/backend/api/hog_flow.py:4193 with products/workflows/backend/api/hog_flow_list.py:351: every page runs the team-wide 7-day ClickHouse aggregate again, and a slow ClickHouse delays every page.
  • What breaks: fetch_last_7_days_totals groups app_metrics2 over every workflow in the team. It runs once per request, so a load-all of N pages runs the same aggregate N times, and each result is used only for that page's rows. It catches exceptions only. When ClickHouse is slow but not failing, each page waits for the full query, and the query sets no max_execution_time. The spec's rule "a metrics outage must not take down the list" covers only a call that raises.
  • Suggested fix: restrict the query to the page's workflow ids (app_source_id IN ...). The spec already says to pass the access-filtered ids. Give this call a short max_execution_time and treat a timeout like the existing failure path, with last_7_days: null.
• minor, products/workflows/backend/api/hog_flow_list.py:300: created_by=, returns every workflow with HTTP 200, but status=, returns 400. I reproduced this independently: one workflow exists, and summaries/?created_by=, returns 200 with that workflow. The Opus 5.5 lane reported it first, and its fix still applies.

Test-first check. I ran mutations for the claims the proof bundle doesn't cover:

• When I remove summaries from scope_object_read_actions on either viewset, its personal-API-key test fails with 403.
• The deferral mutation above passes every test.
• The access-control, sender-team and legacy-trigger mutations from the proof bundle match the regressions their tests claim.

What I tried and found sound:

• Access control:
  • summaries applies filter_queryset_by_access_level before the search tier's .exists(), so a name search can't probe hidden workflows.
  • AccessControlPermission.has_permission treats summaries the same as list, including the fallback for users with object-level grants only.
  • Service auth is skipped the same way routing.py skips it.
• Tenancy: the integration lookup filters on team_id. The template queryset keeps team_id and deleted=False.
• Injection:
  • Every jsonpath text is a constant, and trigger_type values reach SQL through one bound vars jsonb value after the allowlist check.
  • annotate_broadcast_shape builds its paths only from module constants.
• Null handling:
  • trigger and actions are NOT NULL, so ~trigger_type_q never meets a NULL jsonb_path_exists. exclude_trigger_type=event keeps workflows whose actions is [] or {} (checked).
  • ~Q(... __in) on nullable origin_product and created_by keeps NULL rows.
• Data exposure: the rows carry no action config, inputs, bodies or draft. The MCP list keeps its masked trigger. Secret function inputs never enter summarize_hog_flow's outputs.
• Type and trigger vocabularies:
  • TRIGGER_TYPES matches HogFlowTriggerSchema in nodejs/src/cdp/schema/hogflow.ts.
  • The row and filter pairs agree for {} actions, non-dict elements and missing config.
  • template-slack/template-webhook match the ids the editor writes.
• Callers:
  • No importer of the moved workflow_type_q/WORKFLOW_TYPES/_json_path remains.
  • No TypeScript caller uses the removed HogFlowsListStatus.
  • broadcastsLogic still sends created_by as one uuid string.
• Gzip: only the two summaries paths are compressed. The full list stays uncompressed.

Verdict: I would merge and deploy this as-is. Nothing leaks, and every finding is a correctness or robustness issue, not a security issue. Fix the pagination order before PR 2 depends on load-all being complete.

[Silthus]

Conductor: review dispositions for PR PostHog#106561 (stretch 2 brief)

Five review lanes reported on the head ae4ee4c3cbe:

• GPT-6 Sol
• Opus 5.5
• Opus 5.5, substitute for Fable 5.1. Fable 5.1 posted no report; see 5833163312.
• Code quality
• Logic and safety

No lane found a blocker, and every lane would merge and deploy the PR as it is. The fixes below bring it to the bar before Michael's review.

Fix (test-first: write or adjust the test, capture it red, then fix)

0. Test-first process gap (conductor finding 5831418018). The CQ, L&S and Opus 5.5 lanes checked every new test against master by reasoning. Each new summaries and filter test fails there. The ones that pass are the "existing params unchanged" guards the spec asks for. Turn that reasoning into proof:
   • Take the final test files and run them against the pre-change production code: check out origin/master for the production files only, keeping the new tests.
   • Save the output as proof/red-s2-0-final-tests-vs-master.txt.
   • In the stretch-2 proof comment, list the tests that pass on master and give the reason for each. Each must be one of the spec's regression guards.
   • Fix or drop any other test that passes on master.
1. The row names a sender that never sends. Found by Opus 5.5 and logic/safety; flagged minor, handled here as major because PR 2's from: facet builds on it.
   • Where: products/messaging/backend/email_senders.py:26.
   • What breaks: the resolver merges integrationId with integrationIds. The runtime (nodejs/src/cdp/services/messaging/email-sender-selection.ts:9) uses integrationIds alone when it is non-empty, and [integrationId] otherwise.
   • Fix: match the runtime for from_addresses, from_name and from_integration_ids.
   • Tests: correct the "rotation" case at test_hog_flow_summaries.py:274 and the rotation step in _mixed_flow. They currently lock in the wrong answer. Add the case {"integrationId": A, "integrationIds": [B]}, which must give [B].
   • Spec deviation: the spec text says "each of integrationId / integrationIds", but its column meaning is "every address the step can send from". Say in the PR body that the runtime rule is followed. The conductor records the spec note on the map.
2. One parser for sender integration ids (code quality major).
   • posthog/cdp/validation.py:72 and email_senders.py:21 both parse the ids, and they already differ.
   • Keep one public helper with the list check, and make the validator call it.
   • Before tightening the save path, confirm that no stored or web-editor shape sends a non-list iterable. If one does, keep the validator's current acceptance and have only the row reader share the helper. Say which in the proof comment.
3. An empty created_by / exclude_created_by is ignored. Found by Opus 5.5, logic/safety and the Opus substitute.
   • Where: hog_flow_list.py:300.
   • What breaks: ?created_by=, returns every row with a 200. It must return 400, the same as status=,.
   • Tests: add ("created_by", ",") and ("exclude_created_by", ",,") to test_list_filters_reject_unknown_values.
4. The trigger_type filter disagrees with the row on multi-trigger graphs (GPT-6 Sol).
   • Where: hog_flow_list.py:153 vs :219.
   • What breaks: the filter matches any trigger action, but the row uses the first one.
   • Fix: make the filter match only the trigger the row reports, or change both to one rule.
   • Test: add the event then schedule case to the row/filter parity test.
5. Fallbacks that never run hide an N+1 (code quality 3).
   • Where: hog_flow_list.py:462-466 and :485-486.
   • Fix: read the context map and instance.has_draft directly, so a wrong caller fails loudly.
   • Apply the same idea to message_templates.py:347 (email_subject, code quality 10).
6. Share the sender prefetch list serializer, context key and 500/1000 pagination between message_templates.py:290-305 and hog_flow_list.py:366-436 (code quality 2). The spec names one ListRowPagination.
7. Small cleanups (code quality 5, 6, 7, 9):
   • dispatch_counts becomes a typed dict plus Counter.
   • channel_q indexes a Final map built once.
   • One uuid import.
   • Give _email an html keyword instead of the create, re-read and edit dance.
8. The totals call covers every workflow in the team, runs on every page, and has no time limit. Found by code quality (8) and the Opus substitute (3).
   • Restrict fetch_last_7_days_totals to the ids on the page (app_source_id IN ...), and skip the call when the page is empty.
   • Give the call a short max_execution_time, and treat a timeout like the existing failure path (last_7_days: null). Test the timeout the same way the existing failure path is tested.
   • Add the spec's "its totals are absent too" assertion to the existing access-control loop.
9. Load-all drops and repeats rows when a workflow is saved mid-load (Opus substitute 1).

• Where: hog_flow.py:4097, message_templates.py:397.
• Cause: summaries pages over -updated_at, -id, and updated_at is auto_now.
• Fix: page both summaries endpoints on an immutable key (-created_at, -id). The PR 2 spec already sorts on the client.
• Test: add the repro as a case: 3 rows, limit=2, save the oldest, follow next. Every row must appear once.
• Spec: the conductor corrects the spec's "stable under limit/offset" line on the map.

12. No test covers the column deferral (Opus substitute 2). When SUMMARY_DEFERRED_FIELDS or .defer("content") is removed, all tests stay green.

• Fix: in the existing query-count tests, capture the page query and assert that its SELECT list names none of draft, draft_encrypted_inputs, encrypted_inputs (workflows) or content (templates).
• Proof: show it red with the deferral removed.

9. Access filter copy (logic/safety 3, hog_flow.py:4188). Reuse the routing helper if it can be called without the admin_include_all drift. Otherwise add a one-line comment that names the source it mirrors and why the param is left out.
10. PR body:
    • Replace the person's name in the CodeRabbit line with "the author chose to skip".
    • Set the PR assignee to the author if the account allows it. Otherwise say so.
    • Add a deploy note: release Django before the MCP server, because an older Django silently drops the new exclude_*, trigger_type and channel params (logic/safety 5).
    • Describe the sender rule from fix 1.
    • Record every disposition under Agent context.

Accepted, no change (reason recorded here)

• summaries still reads the full actions JSON to derive the row (logic/safety 4). The spec's win is transfer size, not server time. The measured server time is fine for a load-all list. Deriving the row in SQL is a separate performance change and would need its own spec section. The conductor records it on the map as a phase-2 candidate.
• An unverified-domain from.email override is still reported (Opus 5.5, related note). Domain verification is runtime state that can change after a save. The row shows what the step is configured to send.
• hog_flow_list.py altitude (code quality 4). Moving the domain derivation out of api/ is right, but it touches files PR 2 edits at the same time. It is a follow-up, recorded on the map.

Then

Re-run the full proof (red and green for each fix), run hogli ci:preflight --strict, push to silthus, update the PR body, and post the stretch-2 proof comment. Then babysit with /babysit-pr: keep going until CI is green and every bot comment is fixed or has a reply draft for Michael.

[Silthus]

Proof bundle, stretch 2 (worker wl-v2-162)

PR: PostHog#106561. It is still a draft. The head is 19bbf57e2b95e71fe5ba605cab427c5ed233ac6d, a fast-forward from ae4ee4c3cbe with no force-push.

Commits since stretch 1:

• ceb6d983fda: fixes 1 to 12.
• 593515b961c: typing the annotations, and the CONTRIBUTING rules.
• 137116e3a38: merge of origin/master. The branch was 73 commits behind, and the merge had no conflicts.
• 19bbf57e2b9: the workflows-list MCP tool-schema snapshot that master added. Updating it was needed for the new params.

Every fix below was written test-first. Each red run is from the tree before the fix, and each green run is from the fixed tree. The files are in proof/ as red-s2-<n>-*.txt and green-s2-<n>-*.txt.

Item 0: final tests against master's production code

Method:

1. Commit ceb6d983fda.
2. Check out the six production files from the merge base 3b4dfa83e2c, and delete the two new modules. The final tests stay.
3. Run the tests, then restore the tree from HEAD.

For this run only, test_hog_flow_summaries.py imports the new serializer inside its one contract test, so the other tests could run instead of failing at collection. test_list_filters skips the new module's totals patch for the hog_flows/ variant, for the same reason.

Results:

• test_hog_flow_summaries.py: 29 of 29 fail.
• Template tests: all 5 new tests fail, and the new summaries scope case fails.
• The changed access-control test fails.
• ParseEmailSenderIds fails at import.
• Filter block: 31 of 36 fail.

Tests that pass on master, each a guard the spec asks for:

Test	Why it passes on master	Spec guard
test_list_filters hog_flows_status_single_value	single status already worked	existing params unchanged
test_list_filters hog_flows_created_by_single_value	single created_by uuid already worked	existing params unchanged
test_list_filters hog_flows_type_unchanged, …trigger_json_unchanged, …search_unchanged	existing params	existing params unchanged
reject_unknown_values hog_flows_status (paused)	master's FilterSet choice field gives 400	unknown value → 400
reject_unknown_values hog_flows_created_by (not-a-uuid) and (",")	master's single-uuid check gives 400	invalid uuid → 400
reject_unknown_values hog_flows_summaries_status	on master, summaries/ routes to retrieve, and the FilterSet still rejects paused with attr=status	unknown value → 400. It is the same case as the hog_flows/ row, so it stays.

Every other new or changed test fails on master. No test needed dropping. The created_by=, case shows that stretch 1 regressed master's 400 into a 200, and fix 3 restores the 400.

Master-run totals (full output in red-s2-0-final-tests-vs-master.txt and red-s2-0-list-filters-vs-master.txt)

summaries + templates + access control : 35 failed, 65 passed   (all 65 passes are pre-existing, unchanged tests)
test_hog_flow.py list_filters/rejects  : 56 failed, 4 passed
list_filters, hog_flows/ without patch : 31 failed, 5 passed    (the 5 "unchanged" guards)
test_validation ParseEmailSenderIds    : ImportError at collection

Fixes 1 to 12

#	Fix	Red (before the fix)	Green
1	Senders follow selectEmailSenderIntegrationId: the integrationIds rotation when it is non-empty, otherwise [integrationId]. The rule applies to from_addresses, from_name and from_integration_ids.	rotation_replaces_primary gave ['news@…','updates@…'], expected ['updates@…']	9 sender cases pass
2	One parser, parse_email_sender_ids, in posthog/cdp/validation.py. .named feeds validation with every id the author named, as before. .selectable feeds the row.	ImportError	8 parser cases pass
3	created_by=, and exclude_created_by=,, return 400	4 cases returned 200	22 reject cases pass on both endpoints
4	annotate_trigger_type reads the first trigger step with jsonb_path_query_first. The legacy column counts only when there is no trigger step.	?trigger_type=schedule returned "Two triggers", whose row says event	the parity test passes, with include and exclude
5	Rows read the page sender map and has_draft directly, and the template row reads email_subject the same way	KeyError not raised, AttributeError not raised	both contract cases pass
6	One EmailSenderPrefetchListSerializer, one context key and one ListRowPagination (500/1000), in email_senders.py, shared by both endpoints	refactor, no behavior change, so there is no red	all touched tests pass
7	Counter for dispatch counts; _CHANNEL_Q built once; one uuid import; _email(html=…)	refactor, so there is no red	same
8	Totals only for the page's ids, a max_execution_time of 5 seconds, a timeout gives null, no call for an empty page, and the hidden workflow's totals are never requested	call_count 2 == 1 (the empty page called ClickHouse); KeyError: 'app_source_ids'; ClickHouse test TypeError on the new argument	3 tests pass; the ClickHouse test sees only the requested id
9	A comment names TeamAndOrgViewSetMixin._filter_queryset_by_access_level, and says why admin_include_all is left out. The helper returns early for anything but list, so it cannot be reused.	comment only	none needed
10	The PR body was updated: the CodeRabbit line, the missing assignee, a deploy-order warning, the sender rule, and the dispositions	none	none
11	Both summaries endpoints page on -created_at, -id	save mid-load: a row was missing and another repeated, on both endpoints	both mid-load tests pass; the tie test now ties on created_at
12	The query-count tests assert that the page query selects no draft, encrypted inputs or edges (workflows), and no content (templates)	mutation that removes both deferrals: match='"posthog_hogflow"."draft",', match='"posthog_messagetemplate"."content",'	3 query-count tests pass

On item 2, the save path was checked before it was tightened:

• integrationIds and its list check arrived in the same commit, feat(workflows): rotate email sends across multiple senders PostHog/posthog#83356.
• So every stored rotation passed a list check at save time.
• The web editor writes number[].
• The parser therefore ignores a non-list rotation. Validation keeps its behavior of checking every named id.

Red excerpts

# 1  test_sender_resolution_3_rotation_replaces_primary
E  -  ['news@example.com', 'updates@example.com'], 'Acme News', [news, updates]
E  +  ['updates@example.com'], 'Acme Updates', [updates]
# 3  FAILED test_list_filters_reject_unknown_values_{09,10,20,21}_…created_by   (200, expected 400)
# 4  E AssertionError: schedule   -set(['Legacy','Two triggers'])  +set(['Legacy'])
# 5  E AssertionError: KeyError not raised / AttributeError not raised
# 8  E assert 2 == 1  (fetch_app_metric_totals_by_source.call_count)   E KeyError: 'app_source_ids'
# 11 E  seen ids: one row missing, another repeated after the save
# 12 E assert not <re.Match … match='"posthog_hogflow"."draft",'>
#    E assert not <re.Match … match='"posthog_messagetemplate"."content",'>

Gate on the pushed head

• The touched backend test files pass on the merged tree: 755 tests, with no skips. The files are test_hog_flow_summaries, test_hog_flow, test_hog_flow_access_control, test_message_templates, posthog/cdp/test/test_validation and test_email_reputation. The last one is the other caller of the changed totals function.
• The MCP unit suite passes: 157 files, 4,229 tests. The workflows-list schema snapshot was red before its update, as expected.
• Repo-wide mypy --cache-fine-grained .: no issues, in 21,580 files. This ran on 593515b961c, before the merge. The merge had no conflicts and touched no file in this diff.
• hogli ci:preflight --strict: exit 0. The staleness check passes after the merge. The openapi advisory is handled: regenerated after the merge, with no drift.
• Semgrep security rules on the 7 changed Python files: 0 findings.
• hogli build:openapi: help text only, for the sender fields.

Accepted without a change (listed in the PR's Agent context)

• Rows still derive from the full actions JSON.
• An unverified-domain from.email override is still reported.
• hog_flow_list.py stays under api/.

Notes

• The PR still has no assignee. ReplaceActorsForAssignable is denied for the account, and the PR body says so.
• The only bot comment on the upstream PR is CodeRabbit's summary: "No actionable comments were generated". Babysitting follows.