Feature flags, experiments and the events an App records about its own use. Preview keys work and may change in any release (status); the rest are stable. All parts.
flag.boolean, flag.string, flag.number and flag.object take a default
and options. owner is required, and variants must include the default.
Boolean kill switches use false; other types need a safeValue to be
killed. tenantManaged: true permits a tenant override, and an App-wide kill
still wins. A provider failure falls back to the declared default, so choose
it deliberately.
A role’s flags lists capabilities, each with explicit actions,
environments, owners and optional ids. view, manage and
killswitch are independent, and admin adds no flag powers. A command’s
enabledBy: { flag: 'newReview', is: true } gates new attempts; components
read flags with useFlags.
An audience says who, once, and flag rules and experiments name it:
Every condition given must hold: roles, tenants, a proven email’s
attributes.emailDomain, and rollout, a stable share salted by the
audience’s name, so every flag and experiment naming it reaches the same
people. allow and deny list account ids and decide first. A Console rule
or an experiment’s eligibility.audiences matches a member of any one named;
neither lists roles or tenants itself.
Experiments and
behavior analytics build on the same declarations.
Behavior analytics, off unless declared: the built-in kinds collected, the custom events components may emit, and funnels read over them. Where events are stored is configuration (analytics.store), not the App’s.
What the App’s commands keep unless one says otherwise: none, receipts (a retried request is answered once) or audit (the receipt and every change). A door that retries (the App API, MCP, a job) keeps at least receipts. One of audit, none, receipts.