[vjfridge]

What and why?

Protect flag evaluation telemetry unless the evaluated configuration explicitly enables observeFullEvaluationData. Implements FFL-3432, following the updated FFL-3427 / FFL-3437 client scope. Existing Swift value representations provide context ownership; no new bounded-context architecture is introduced. Paired provider: #45.

How?

• Parse consent tolerantly, persist it with assignments, and capture context/assignment/consent together for successful, missing-flag and type-error evaluations. Legacy caches default to protected; refresh affects future evaluations.
• Hash protected targeting keys with exact UTF-8 SHA-256, omit evaluation context before aggregation, allowlist stable errors in both modes, and separate consent/default buckets.
• Expose captured consent through internal result/bridge APIs. Native remains the only emitter/hasher. React Native must preserve snapshot consent through its cache and delayed bridge calls; raw malformed UTF-16 validation remains at that boundary.
• Add the consent-aware replay SPI sendFlagEvaluation(key:assignment:context:telemetryTargetingKey:observeFullEvaluationData:flagError:). A nil telemetry key omits targeting_key without dropping the evaluation; an explicit empty string remains empty. The original context still supplies full-mode attributes and preserves the assignment/exposure subject and subject-level telemetry opt-out. Existing replay overloads retain their behavior. Consumer wiring: React Native #1510.
• Preserve assignment request contents, exposures, tracking-disable precedence and existing upload lifecycle. Backend FFL-3428 is complete; no revocation mechanism or backend changes are needed.

Validation

The detailed artifact evidence below is historical and predates the develop merge and nullable replay change. On current head a0effb2d77e94890f1ca6ea5863daebdfdc3f0f4, lint, API-surface verification, SPI documentation and paired artifact validation are green; Apple platform unit suites remain pending. New native tests cover nullable replay, encoded omission versus empty, Unicode keys, preserved counts/attributes/exposures, and subject opt-out; they were added to source but were not compiled or executed in the Linux workspace.

macOS/Xcode 26 artifact job 2167527865 passed against native ed1ca0de3fecf4b07e118f97fc3929092f09d026 and provider a90606193c1fc27fdab43cdd5f466575cf2f7b01:

• 174 native Flags tests passed on the iOS simulator with zero failures.
• 55 provider tests; actual SPM-built direct SDK and real OpenFeature execution.
• 72 evaluations in 35 buckets, 24 unchanged assignment requests, no duplicate emission/double hashing. Covers consent parsing, refresh before flush, offline restoration, stable errors/defaults, DoLog false, disabled tracking and HTTP 500 retry.
• CocoaPods with OpenFeature 0.3.0: the shared probe ran inside both existing UIKit smoke apps on iOS 26.0.1. Static and dynamic linking each independently passed all 72 evaluation assertions and 24 unchanged assignment requests. The hosted tests verify their iOS app bundle/runtime and call the production native SDK plus real OpenFeature API. Separate wire captures, app/framework/test-binary hashes and xcresult bundles are retained.

Source identities, binary SHA-256, lockfiles, build logs and wire bodies are job artifacts. Native lint, API-surface verification and SPI documentation builds passed. The Linux workspace itself has no Apple toolchain; Python verifier/compatibility tests and grammar checks run locally. Details and React Native interface handoff: docs/FLAGS_PII_VALIDATION.md.

Review checklist

• Regression coverage and CHANGELOG added
• Lint, API-surface generation/verification and SPI documentation build
• Actual native/provider artifact wire proof and both CocoaPods linkages
• Focused native Flags XCTest: 174 tests passed
• Native unit suites passed on iOS, macOS, tvOS and visionOS; the watchOS simulator retry passed after the original simulator boot failure
• Remaining platform smoke/UI/SPM checks on the latest revision (pipeline 146847114)
• Fresh Apple platform XCTest for the merged revision and nullable replay SPI
• SDK-owner review, including internal adapter API compatibility
• Confirm protected published SDK version and align downstream dependency bounds/toolchain

Draft remains gated on broader CI and owner/release review. The provider's existing Xcode 16.2 CI cannot build the paired Swift 6.2 package and needs a compatible runner. The app probes use a controlled loopback HTTP service. Physical-device/live-backend dogfooding and React Native malformed-input behavior are not covered.