[turnipdabeets]

Problem

compliance/posthog-ios.md scores 3.x (f5cbe87c, 2026-10-08, with #924–#934 counted as pending PRs). posthog-ios 4.0 changes several rows, and the README table has five contracts the file doesn't list yet.

Important

Merge after posthog-ios 4.0.0 is published (PostHog/posthog-ios#873). The capture v1 rows are scored against #146 at d387ab79 as if merged; re-check them against #146's final text.

Changes

Audited all 64 rows on the 4.0 release branch chore/v4-remove-deprecated at posthog-ios e27cbe4cb against sdk-specs main 752f899 plus #146 at d387ab79 (capture v1, including #147's AI lane), treated as merged. Every line reference on the page is at e27cbe4cb. #924–#934 are merged there, so nothing is counted as pending. Summary: 38/16/4/6 on 64 rows → 44 ✅ · 14 🟡 · 1 ❌ · 10 ➖ on 69 rows.

Rows that changed:

• Get Feature Flag Payload 🟡→✅: getFeatureFlagPayload(_:) is removed. The read is getFeatureFlagResult(_:sendFeatureFlagEvent: false)?.payload, which "Payload reads through the flag result getter" (docs(flags): record the mobile majors' getFeatureFlagPayload removal #170) permits. A malformed payload → nil, and bootstrap payloads are decoded once.
• Get Feature Flag Result 🟡→✅, Feature Flag Cache 🟡→✅: a malformed, empty or whitespace-only payload → nil; an empty variant reads as disabled (docs(flags): read an empty variant as disabled in get-feature-flag-result #193).
• Is Feature Enabled 🟡→✅: isFeatureEnabled(_:defaultValue:).
• Capture 🟡→✅: empty event names are dropped; NSNull properties are omitted on the queue and the wire, with $set/$set_once/$group_set nulls kept (PostHog/posthog-ios#1047); the SDK fills its own $lib/$lib_version pair after the caller's properties and before beforeSend, as docs(capture): specify capture v1 delivery for every v1 SDK #146's "Events name their own library" now asks of client SDKs (PostHog/posthog-ios#1050); an empty variant is left out of $active_feature_flags.
• Capture Exception 🟡→✅: same NSNull fix.
• Session Replay Privacy ❌→🟡: 4.0 records masked screenshots only, so the wireframe path that leaked ph-no-capture children is gone. SwiftUI's explicit mask still wins over an enclosing postHogNoMask(), the reverse of the spec's precedence.
• Get Feature Flags, Get Feature Flags And Payloads ❌→🟡: the specs now record getAllFeatureFlags()'s result list as the iOS 4.0 surface. It is still not the canonical map shape.
• Capture AI ➖→✅: docs(capture): specify capture v1 delivery for every v1 SDK #146 adds iOS 4.0 to Applicability, and the AI lane conforms (own queue started at launch, lane-scoped options including its own compression, 8 MiB + 64 KiB cap with clamping, 5 MiB batches, NSNull cleanup).
• Exception Steps ✅→🟡: steps are byte-counted, buffered and persisted with NSNull members that the queue and the capture v1 wire strip after #1047, so the representations "Normalize to the wire form once, before processing" requires to be identical differ.
• New ➖ rows: Experiment Exposure (iOS requests /flags?v=2), AI Datasets, AI Scorers, Offline Evaluations, Emails (server only).

Note-only:

• Capture v1: Capture, Before Send Hook, Event Batcher, HTTP Client and Retry Queue are scored against docs(capture): specify capture v1 delivery for every v1 SDK #146 and conform. The wire and headers, per-event results, options hoisting, $lib/$lib_version kept in properties (PostHog/posthog-ios#1036), retry status set, jittered backoff, Retry-After, no attempt limit, retries that exclude new events (docs(capture): keep new events out of a capture v1 retry #180), byte-aware batching and same-origin redirects all conform. After beforeSend the SDK only re-imposes the uuid, which docs(capture): specify capture v1 delivery for every v1 SDK #146 allows.
• Surveys stays ✅: the popup-delay (docs(surveys): specify the survey popup delay #121) SHALLs and docs(surveys): start the wait period when a survey is shown #102's wait period are met (PostHog/posthog-ios#1049). The SHOULD to re-check eligibility when the delay elapses isn't met; the page records it but doesn't score it.
• HTTP Client ✅: compression = .none turns off compression for every request except captureAi, which has its own captureAiCompression. docs(capture): specify capture v1 delivery for every v1 SDK #146's http-client now leaves such a lane out of the whole-client opt-out.
• On Feature Flags ✅: meets the new requirements. A /flags load in flight across reset() is dropped (PostHog/posthog-ios#1048), and an empty variant is left out of listener flags (docs(flags): read an empty variant as disabled in get-feature-flag-result #193).
• Opt In stays 🟡 on its old gap. It meets docs(opt-in): restart session replay in a new session on opt-in #138's two replay-restart requirements and docs(opt-in): deferred crash reports honour consent at crash time #199's "Deferred crash reports honour consent at crash time".
• docs(flags): rename $feature_flag_variant to $feature_flag_variant_key #203 ($feature_flag_variant_key), docs(exceptions): clarify handled state for job retries #205 (job-retry handled state) and the other server-only changes on main change no iOS row.
• New requirements met with no status change: jittered backoff (Retry Queue), identify while opted out (Identify, Consent Gating), $group_set (Group Identify), caller precedence (Capture, Register, Debug Properties), quotaLimited with unknown values ignored (Remote Config).

compliance/README.md: the iOS roll-up row, the out-of-cycle refresh paragraph, the iOS gap entries and the iOS non-Pass count (15).

How did you test this code?

• Each row re-read against the current spec and acceptance files and the posthog-ios code on the 4.0 branch at e27cbe4cb.
• Rebased onto main 752f899. Re-tallied: 44/14/1/10 = 69; every note anchor has a heading. git diff --check clean. Docs only, no spec changes.
• The opt-in and crash-consent findings come from reading code; the acceptance scenarios weren't run.
• compliance/README.md conflicts with docs(compliance): weekly SDK compliance matrix #148, docs(compliance): re-audit posthog-android capture rows for 4.0 #186, chore(compliance): audit posthog-flutter 6.0 #200 and docs(compliance): re-audit posthog-react-native rows for react-native-plugin 3.0 #201; whichever lands later needs a manual merge.

🤖 Generated with Claude Code

[dustinbyrne]

Please correct the HTTP Client compliance score: compression = .none leaves the AI lane compressed, contrary to the current whole-client requirement. The optional inline notes clarify the draft retry policy and SwiftUI masking precedence. Retain the documented merge-after-iOS-4.0-publication prerequisite.

AI-assisted review.

[dustinbyrne]

The implementation evidence and conditional baseline are clear, but HTTP Client is counted as fully compliant while the pinned specifications retain an unresolved whole-client compression requirement. Consider retaining Partial or Unknown until that scope is resolved. Preserve the iOS 4.0 publication and final-#146 recheck prerequisites.

AI-assisted review.

[dustinbyrne]

The refreshed audit addresses the previous feedback and clearly identifies its release-branch and proposed-specification baselines. The inline exception-step classification suggestion is a nonblocking audit follow-up. Retain the documented release-tag repinning, iOS 4.0 publication and final-#146 recheck prerequisites.

AI-assisted review.

[eli-r-ph]

#146 now requires migration guides to show a call option process_person_profile: true as the way to keep identifying under a registered false. The SDK behaves that way, but MIGRATION.md here has no such example until posthog-ios#1053 merges. Capture is 🟡 at this commit, or say it's met once #1053 lands.

[turnipdabeets]

Fixed in 85d4acd — Capture 🟡 until posthog-ios#1053 merges; requirement checked at 15501ca.

[turnipdabeets]

Changed in 2fd35bd — this audit tracks 4.0 and #1053 targets it, so Capture stays ✅ with a note; we'll recheck when #1053 merges.

[eli-r-ph]

The README still says 64 contracts per SDK, but the iOS row is now out of 69, so its percentage doesn't compare with the other rows.

[turnipdabeets]

Fixed in a50f0e3 — README notes 69 contracts and gives iOS as 43/64 for comparison.

[turnipdabeets]

Reworded in 720117c — the 69-contract note is now SDK-neutral; each 69-row line also gives its /64 score.