[turnipdabeets]

Important

Don't merge until posthog-android 4.0.0 is released. This scores code on the 4.0 integration branch, not a shipped version. Before merging:

• Point the aaa23d39 commit link and the line numbers in compliance/posthog-android.md at the android-v4.0.0 tag, and re-check the cited line ranges.
• Re-check against the final text of docs(capture): specify capture v1 delivery for every v1 SDK #146. docs(capture-ai): specify the capture v1 AI lane and wrapper routing #147 merged into docs(capture): specify capture v1 delivery for every v1 SDK #146's branch (6a9ed0f), so both land together.

Summary

posthog-android 4.0 (PostHog/posthog-android#871) moves analytics to capture v1 (/i/v1/analytics/events), adds captureAi on its own /i/v1/ai/events lane, and changes consent handling, remote config, the flag API, session replay and surveys. This PR re-audits 30 android rows at aaa23d39 against main 752f899 plus #146 at d387ab79 (which includes #147's text), treated as merged. The 30 are the five capture v1 rows and the 25 rows that 4.0 code or spec text merged since 2026-10-19 changes. The other 34 rows carry forward from 2026-10-19 (c5e788bd).

Row	Before	After	Why
Application Lifecycle	✅	✅	Installed, Updated, Opened and Backgrounded conform; un-prefixed version/build break only a SHOULD NOT (n31)
Before Send Hook	✅	✅	Chain and fail-closed unchanged; options and the uuid survive a hook as capture allows (n3)
Capture	✅	✅	Capture v1 wire, headers, per-event results, options hoisting, the $lib/$lib_version fill (posthog-android#956), "" left out of $active_feature_flags (#193) and null array elements kept (posthog-android#955) conform; the post-hook uuid and null-options restore are #146's two allowances (n24)
Capture AI	➖	✅	#147 adds android 4.0 to Applicability; lane, routing, config, compression, size cap and 5 MiB batching conform (n25)
Capture Exception	✅	✅	One coercer for handled and uncaught JVM exceptions; the native crash serializer keeps frames (#124) (n40)
Consent Gating	🟡	✅	optOut() stops replay and integrations; deferred native crashes follow consent at crash time (n5)
Event Batcher	🟡	🟡	Byte-aware 5 MiB batching passes; the periodic flush still runs on java.util.Timer, not the injectable clock (n6)
Exception Event Metadata	🟡	🟡	Nested handled, no mechanism.source, no single-entry exception_id: 0, no $exception_source, caller override of reserved keys, missing empty value. synthetic: false is correct (n7)
Feature Flag Cache	✅	✅	A malformed cached payload reads as null (#170) (n33)
Feature Flag Called Tracker	🟡	🟡	Minimal-event allowlist drops $os_name/$os_version and registered attribution keys; config version 2 (#162, #203) doesn't apply on /flags?v=2 (n8)
Get Feature Flag	✅	✅	Matches the 4.0 android variant (n39)
Get Feature Flag Payload	✅	✅	The getter is gone, as #170 allows (n38)
Get Feature Flag Result	✅	✅	"" reads as disabled (#193); a malformed payload is null (n36)
Get Feature Flags	❌	🟡	getAllFeatureFlags() is now the spec's android form, but returns null after a restart until the disk cache is loaded (n9)
Get Feature Flags And Payloads	❌	🟡	Same form and same cold-start gap (n10)
HTTP Client	✅	✅	Capture v1 transport conforms; separate compression/captureAiCompression and the redirect rule on a caller's httpClient are what #146 allows (n26)
Identify	✅	🟡	Runs while opted out (#167), but updates the dedup hash for a $set it dropped, which the spec says it MUST NOT (n28)
Is Feature Enabled	✅	✅	Caller default, known value wins, "" reads as false (n37)
Logs	✅	✅	compression = NONE sends raw JSON (#81) (n35)
On Feature Flags	🟡	✅	Runtime onFeatureFlags() with unsubscribe, late replay and stale-load suppression (#161) (n13)
Opt In	🟡	🟡	Replay restart and crash-time consent (#138, #199) conform; optOut() can't clear local data (@client scenario) (n14)
Reload Feature Flags	✅	✅	Callback gets PostHogFeatureFlagsLoaded (n34)
Remote Config	✅	✅	Replies after close() or from an earlier setup are dropped (posthog-android#953, #961) (n32)
Retry Queue	✅	✅	Capture v1 status set, 1 s→30 s jittered backoff, Retry-After floor, retry-only resends, no OkHttp retries (n27)
Session Replay Debug Properties	🟡	✅	Required/optional tiering, $-event gate and 30 s bundle window (n17)
Session Replay Privacy	🟡	✅	Wireframe mode removed (#197); View and Compose unmask agree; FLAG_SECURE windows record black (#160) (n19)
Setup	✅	✅	projectToken only; a blank or phx_ token disables the SDK with a warning (n29)
Shutdown	✅	✅	close() flushes, stops queues and integrations, safe twice (n30)
Start Session Recording	❌	✅	Replay isn't installed while opted out, so a start stays inactive (n20)
Surveys	🟡	🟡	Web-only exclusion and popup delay conform; submit and dismiss move the last-seen date (#102), and an unknown question type blocks later surveys (n22)

android moves from 37/16/5/6 to 42/15/2/5 (58%→66%), with 17 open gaps.

Not scored as gaps: unmet SHOULDs are noted in each row's note. For a durable client queue, #146 lets 404'd events stay queued with no attempt limit; the page records this with the other client allowances.

Out of scope but stale: Stop Session Recording (n21) carries forward from 2026-10-19. Its opt-out point predates 4.0's optOut() uninstalling replay, so the next full audit must re-verify it.

README: updated the android roll-up row, the out-of-cycle refresh paragraph, the non-Pass count (17), the android gap-inventory rows, and the Session Replay Debug Properties pattern paragraph.

Validation

• Read the code for each row at aaa23d39 (git show, no checkout) against the spec and acceptance text at 752f899, checking each requirement's Applicability. Only unmet MUST/SHALL requirements or failing @client scenarios lower a score.
• Re-tallied the matrix: 42/15/2/5/0 = 64. The 4.0 table's statuses match the matrix. Every #nX link in both files has an anchor.
• The Surveys unknown-question-type finding comes from reading the code. It wasn't run.
• I didn't run any SDK tests or compliance harness. This is a docs-only change.
• compliance/README.md conflicts with chore(compliance): audit posthog-ios 4.0 #187, chore(compliance): audit posthog-flutter 6.0 #200, docs(compliance): re-audit posthog-react-native rows for react-native-plugin 3.0 #201 and docs(compliance): weekly SDK compliance matrix #148; whichever lands later needs a manual merge.

🤖 Generated with Claude Code

[eli-r-ph]

On the post-hook rule: yes, let's carve both out. Re-imposing the pre-hook uuid matches the fleet rule that a hook can't resend an SDK-generated uuid, and treating absent options as unchanged is fine as long as an empty map still clears them. I'll update #146.

On the redirect rule: yes. The same-origin 307/308 rule is a capture rule, not a transport preference, so applying it to a caller-supplied client is right. I'll say so in #146.

[dustinbyrne]

The five-row re-audit and revised totals are consistent with the cited Android 4.0 implementation and pinned capture-v1 contract. The documented release-tag repinning and final-spec recheck remain prerequisites before merging.

AI-assisted review.

[eli-r-ph]

Alias is carried forward as ❌ for a missing distinct_id, but alias() on the 4.0 branch now sets props["distinct_id"] (posthog-android#819). Alias code changed after 2026-10-19, so by this page's own scope rule it should be re-scored, likely to ✅.

[turnipdabeets]

Fixed in 06bd1ad — Alias ✅ at aaa23d39 (#819 is in it) and joins the 4.0 re-audit.

[eli-r-ph]

#146 now requires migration guides to show a call option process_person_profile: true as the way to keep identifying under a registered false. The SDK behaves that way, but MIGRATION.md here has no such example until posthog-android#966 merges. Capture is 🟡 at this commit, or say it's met once #966 lands.

[turnipdabeets]

Fixed in cfc72e1 — Capture 🟡 against 15501ca; clears when posthog-android#966 lands.

[turnipdabeets]

Changed in 1b64af2 — this audit tracks 4.0 and #966 targets it, so Capture stays ✅ with a note; we'll recheck when #966 merges.

[eli-r-ph]

This page stays at 64 rows while main lists 69 and the iOS 4.0 page adds Experiment Exposure, AI Datasets, AI Scorers, Offline Evaluations and Emails. Could it add the same five rows (all ➖)?

[turnipdabeets]

Fixed in 30a6492 — added the five rows as ➖; now 43/15/1/10 on 69 after 1b64af2.