feat(cohorts): apply cohort membership to Postgres identities

[gagantrivedi]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Cohorts only worked on edge projects. Now they work when identities are in Postgres too, which covers self-hosted.

• Added Identity.system_traits, same shape as the system_traits map on edge identity documents.
• New environments/identities/system_traits.py sets and clears a system trait and picks DynamoDB or Postgres itself.
• Segment evaluation reads system_traits alongside the user's traits, so the IS_SET condition on the cohort's segment works as before. It's a column on a row we already load, so get_segments doesn't do any more queries.
• Postgres writes use the jsonb operators, so two cohorts writing to the same identity can't wipe each other's keys.

How did you test this code?

Unit tests run the same cases against both stores. On top of that: membership turns a segment-gated flag on, removal turns it off, retries don't break anything, and one identity can be in two cohorts.

I also broke the code on purpose to check the tests catch it. Making the Postgres write do nothing fails 8 tests. Skipping the trait merge in evaluation fails 2.

Migration 0007 on a 3M row table takes under 2ms because Postgres only writes metadata for a constant default (the same thing with a volatile default takes ~1.5s). Taking the lock on the production identities table was near instant.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	Aug 19, 2026 7:34am
flagsmith-frontend-preview	Ignored	Preview	Aug 19, 2026 7:34am
flagsmith-frontend-staging	Ignored	Preview	Aug 19, 2026 7:34am

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 09fdbe62-fd85-4a09-8b40-1724ba5cb18f

📥 Commits

Reviewing files that changed from the base of the PR and between ffc2bae and 4478bff.

📒 Files selected for processing (1)

• api/tests/unit/environments/identities/test_system_traits.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds Identity.system_traits and gives these values precedence over user traits. Cohort membership application now uses system-trait helpers for PostgreSQL and DynamoDB identities. Non-edge membership tasks and cohort creation no longer require edge synchronisation. Tests cover storage, synchronisation, evaluation, task processing, and cohort creation. Event documentation reflects updated source locations.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 4478b

Cohort-gated flags may be enabled or remain enabled based on user-controlled traits rather than actual cohort membership, creating incorrect flag exposure. This concrete correctness and security risk should be resolved or explicitly accepted before merging.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.78%. Comparing base (b3b2b31) to head (4478bff).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #8315    +/-   ##
========================================
  Coverage   98.78%   98.78%            
========================================
  Files        1604     1609     +5     
  Lines       64426    64575   +149     
========================================
+ Hits        63642    63791   +149     
  Misses        784      784            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ private-cloud · depot-ubuntu-latest-16 — run #19530 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 47.9 seconds
 4478bff
 🔄 Run: #19530 (attempt 1)

🗂️ Previous results

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19530 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 38.5 seconds
 4478bff
 🔄 Run: #19530 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19530 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 49.2 seconds
 4478bff
 🔄 Run: #19530 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19530 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 40.3 seconds
 4478bff
 🔄 Run: #19530 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #19529 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 55.2 seconds
 ffc2bae
 🔄 Run: #19529 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19529 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 37.7 seconds
 ffc2bae
 🔄 Run: #19529 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19529 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 44.1 seconds
 ffc2bae
 🔄 Run: #19529 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19529 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 41.4 seconds
 ffc2bae
 🔄 Run: #19529 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19528 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 38.1 seconds
 9096808
 🔄 Run: #19528 (attempt 1)

✅ private-cloud · depot-ubuntu-latest-16 — run #19528 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 33.1 seconds
 9096808
 🔄 Run: #19528 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #19528 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 48.2 seconds
 9096808
 🔄 Run: #19528 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #19528 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 41.5 seconds
 9096808
 🔄 Run: #19528 (attempt 1)

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 65178f22-fee3-41dc-8c9f-298c38385826

📥 Commits

Reviewing files that changed from the base of the PR and between a35dcd1 and 817182a.

📒 Files selected for processing (11)

• api/cohorts/services.py
• api/cohorts/tasks.py
• api/cohorts/views.py
• api/environments/identities/migrations/0007_identity_system_traits.py
• api/environments/identities/models.py
• api/tests/unit/cohorts/test_evaluation.py
• api/tests/unit/cohorts/test_services.py
• api/tests/unit/cohorts/test_tasks.py
• api/tests/unit/cohorts/test_views.py
• api/util/mappers/engine.py
• docs/docs/deployment-self-hosting/observability/_events-catalogue.md

💤 Files with no reviewable changes (2)

• api/cohorts/tasks.py
• api/cohorts/views.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b1d8df87-bc8f-404b-8f34-e6b595f287e9

📥 Commits

Reviewing files that changed from the base of the PR and between 817182a and a2c6b5a.

📒 Files selected for processing (6)

• api/cohorts/services.py
• api/environments/identities/system_traits.py
• api/tests/unit/cohorts/test_services.py
• api/tests/unit/cohorts/test_tasks.py
• api/tests/unit/environments/identities/test_system_traits.py
• docs/docs/deployment-self-hosting/observability/_events-catalogue.md

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

api/tests/unit/environments/identities/test_system_traits.py (1)

96-115: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Assert against the selected identity backend.

These parametrised tests run for PostgreSQL and DynamoDB, but both assertions only inspect Identity.objects. For edge_environment, an incorrect DynamoDB write would still pass because the DynamoDB document is not checked. Assert that _stored_system_traits(target_environment, "sentinel") is None in both tests, or inspect the DynamoDB wrapper for the edge case.

Proposed fix

 def test_set_system_trait__no_identifiers__creates_no_identity(
     target_environment: Environment,
 ) -> None:
+    identifier = "sentinel"
     set_system_trait(target_environment, _TRAIT_KEY, [])
 
-    assert not Identity.objects.filter(environment=target_environment).exists()
+    assert _stored_system_traits(target_environment, identifier) is None

 def test_unset_system_trait__no_identifiers__creates_no_identity(
     target_environment: Environment,
 ) -> None:
+    identifier = "sentinel"
     unset_system_trait(target_environment, _TRAIT_KEY, [])
 
-    assert not Identity.objects.filter(environment=target_environment).exists()
+    assert _stored_system_traits(target_environment, identifier) is None

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 13bbd081-5a57-4b92-bbfc-be7531ce9958

📥 Commits

Reviewing files that changed from the base of the PR and between 9096808 and ffc2bae.

📒 Files selected for processing (3)

• api/tests/unit/cohorts/test_evaluation.py
• api/tests/unit/cohorts/test_services.py
• api/tests/unit/environments/identities/test_system_traits.py

💤 Files with no reviewable changes (1)

• api/tests/unit/cohorts/test_evaluation.py

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

[khvn26]

LGTM