onni 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4adac16f882a9d8562e9441200c4e11f1a7c4dc49d0e577a2d0620ce11db1789
+  data.tar.gz: 95e396d99bf6a7f609fd4b6500d8db02ddf80103c07ce1d13b94e74672a71147
+SHA512:
+  metadata.gz: b234b572464676742136aa0b26a006408fdd0907189b3098a1aa794033309a9180b1bb763c7bc86d39c48bde47ff578b5793529ccd2d475906c4f6a2db8e5f03
+  data.tar.gz: '069c548695c4ebeb0a89868ef4351a09a06308199c819f83241a31f03c3e1d1823966b90e5dd4bee418b41489a72ef5f2b0b082a09dfb5562abbcf6154b4f223'

data/CHANGELOG.md

@@ -0,0 +1,30 @@
+# CHANGELOG
+
+## 0.1.0 (2026-11-12)
+
+- Add feature evaluation charts with 24-hour, 7-day, and 30-day history, enabled share, expandable counts, and replaceable views
+- Initial gem: YAML registry, runtime gates, groups, percentage rollout, A/B variants, hit stats
+- Solid core usable in any Ruby app (memory adapter by default)
+- Optional ActiveRecord adapter and Rails engine
+- First-class pluggable ActiveAdmin dashboard support
+- Pluggable migrator (`Onni.migrate!`) for importing gates from another feature-flag library
+- Fail closed on past or unparseable `expires_at` for `enabled?` / `variant`
+- Allow `register_group` from the boot empty registry (no prior `clear!` required)
+- Record ActiveRecord hit stats with a unique-index upsert (avoids first-hit create races)
+- Add `record_stats:` on `enabled?` / `variant` / `disabled?`; ActiveAdmin index inspects without recording hits
+- Import `variants` gates via `Onni.migrate!`
+- Add `Onni.purge_stats!` / `Onni::Stats::Purge` with batched retention cleanup
+- Add `rails g onni:stats_cleanup` (job + `period_start` index) and README growth guidance
+- Default `config.stats_retention = 90.days`
+- Stats sampling: clamp `stats_sample_rate` to 0.0..1.0, skip Random at 1.0, optional `stats_sampler` / `stats_ignore`, scale kept samples by ~1/rate (`stats_scale_sampled_hits`)
+- Add `ActiveSupport::Notifications` (`*.onni`) for stats record/purge and enable/disable
+- Add `Onni.stats_overview` and ActiveAdmin Hit storage panel (retention / cleanup signals)
+- Add configurable `concurrency` (`:mutex` default for threads/fibers, `:none` to skip locks)
+- Document that Onni is for experiments and stats - not authorization
+- Pressure binding and L1 load ceilings for the memory all-features evaluate path (boolean, actor, percentage, group, variant, conditions, stats)
+- Add request preload (`Onni.preload!` / `gates_for_many`) and optional `stats_buffer` with `flush_stats!` / `reset_request!`
+- Lean `Store.variant` reuses one gates fetch (no second adapter read / Flag allocate)
+- Instrument group/percentage/variants mutations; ActiveAdmin show shows hit sample rate; `onni:install` smoke spec; expanded RBS; upsert dialect note
+- First-class SQLite support: shared file DB in dummy, column `unique_by` upsert conflict target, pool/ON CONFLICT specs, host timeout/WAL notes
+- Rails dummy + request specs for ActiveRecord adapter and ActiveAdmin Features page
+- Unit specs for Group, Registry, Actor, Conditions, and Flag

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,26 @@
+# Code of Conduct
+
+## Pledge
+
+Participation is a harassment-free experience. Treat each other with respect. Keep private context private.
+
+## Expected behavior
+
+- Engage with genuine curiosity. Admit uncertainty.
+- Own every line you submit, including generated code.
+- Correct errors politely.
+- Use language that welcomes people and respects identity and privacy.
+
+## Unacceptable behavior
+
+- Harassment, trolling, or insulting comments, public or private.
+- Using jargon or volume, including automated spam, to silence others.
+- Sharing others' data or personal context without permission.
+
+## Automation
+
+You remain responsible for bugs, security holes, and bias in generated artifacts you submit.
+
+## Enforcement
+
+Report abusive or harassing behavior to contact@kiskolabs.com. Reports are reviewed and investigated.

data/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing Guidelines
+
+## Automation authorship
+
+You may use AI and automation tools. You remain the author of every line you submit: review, debug, and understand the change.
+
+Keep pull requests small enough to review. Annotate non-obvious logic.
+
+Never send project secrets or private context to public models.
+
+## How to contribute
+
+### Reporting issues
+
+Verify the facts before filing. Use issue templates for goals, constraints, and reproduction steps.
+
+### Pull requests
+
+Keep one pull request to one goal. Explain why the change is needed. Run smoke tests and regression checks locally before opening the request.
+
+### Review
+
+Reviewers will ask about approach and trade-offs. Treat suggested changes as part of the work.

data/GOVERNANCE.md

@@ -0,0 +1,25 @@
+# Project Governance
+
+## Roles
+
+### Contributors
+
+Anyone who submits code, documentation, or participates in discussions. Contributors take ownership of problems they identify and follow the project's quality standards.
+
+### Maintainers
+
+Maintainers:
+
+1. Set scope and architectural direction.
+2. Review contributions (human or automated) against security and logic standards.
+3. Decide when the community is divided.
+
+## Decision making
+
+### Lazy consensus
+
+For routine changes, a proposal that draws no objection within two weeks is approved.
+
+### Maintainer approval
+
+Major architectural changes, high-risk automation integrations, or changes that affect business logic need explicit maintainer approval. A change must solve a real problem.

data/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 amkisko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,301 @@
+# onni
+
+[![Test Status](https://github.com/amkisko/onni.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/onni.rb/actions/workflows/test.yml)
+
+Feature flags, gradual rollout, A/B variants, audience targeting groups, and hit stats for any Ruby app. Optional ActiveRecord persistence and first-class pluggable ActiveAdmin support.
+
+## What Onni is for
+
+Use Onni to:
+
+- turn product experiments and incomplete surfaces on or off
+- roll a change out to a percentage of actors or a named audience group
+- assign A/B (or multi-arm) variants
+- collect enabled/disabled hit stats for analysis
+
+## What Onni is not for
+
+**Do not use Onni as an authorization or access-control system.**
+
+`Onni.enabled?` answers “is this flag on for this actor for experiment / rollout purposes?”, not “may this principal perform this privileged action?”. Keep authentication and authorization in your policy layer (for example Pundit, CanCanCan, or host middleware). A flag may *gate whether a UI is offered*; it must not be the only check that protects a write, read of private data, or admin capability.
+
+YAML `conditions` and registered groups are targeting helpers for rollouts. They are not a substitute for object-, function-, or tenant-level authorization.
+
+## Requirements
+
+- Ruby 3.4+
+- ActiveSupport 7.2.3.2+
+- Optional: Rails 7.2.3.2+ (engine, ActiveRecord adapter)
+- Optional: ActiveAdmin 4.0.0.beta23+ (admin dashboard)
+
+## Install
+
+From RubyGems after a release:
+
+```ruby
+# Gemfile
+gem "onni"
+```
+
+From git:
+
+```ruby
+# Gemfile
+gem "onni", github: "amkisko/onni.rb"
+```
+
+Rails + ActiveRecord:
+
+```sh
+bin/rails generate onni:install
+bin/rails db:migrate
+```
+
+ActiveAdmin dashboard loads automatically when ActiveAdmin is present. You can also require it explicitly:
+
+```ruby
+require "onni/active_admin"
+```
+
+## YAML registry
+
+Every flag must be listed in `config/features.yml`:
+
+```yaml
+new_checkout:
+  expires_at: "2027-06-01"
+  description: "Checkout redesign experiment"
+  variants:
+    control: 50
+    treatment: 50
+```
+
+Unknown names fail closed: `enabled?` returns false; `enable` / `disable` raise `KeyError`.
+Past or unparseable `expires_at` values fail closed on `enabled?` / `variant`. The ActiveAdmin UI still shows the expiry date.
+
+Optional YAML `conditions` (checked after a gate matches, when an actor is present). These narrow a rollout audience; they are not authorization:
+
+```yaml
+search_v2:
+  expires_at: "2027-06-01"
+  description: "New search UI for beta testers"
+  conditions:
+    - beta_tester?
+    - beta_testers   # registered Onni group name
+```
+
+## Runtime API
+
+```ruby
+Onni.enabled?(:new_checkout, user)
+Onni.enabled?(:new_checkout, record_stats: false) # inspect without recording a hit
+Onni.enable(:new_checkout)
+Onni.enable(:new_checkout, user)
+Onni.disable(:new_checkout)
+Onni.enable_group(:search_v2, :beta_testers)
+Onni.enable_percentage_of_actors(:homepage_banner, 25)
+Onni.set_variants(:new_checkout, {control: 50, treatment: 50})
+Onni.variant(:new_checkout, user) # => :control / :treatment
+Onni.register_group(:beta_testers) { |actor, _| actor.beta_tester? }
+```
+
+Gates: `boolean`, `actors`, `groups`, `percentage_of_actors`, `variants`.
+
+`Onni.exist?(name)` is adapter-backed (gates/feature rows). `Onni::Flag#exist?` is YAML-registry-backed.
+
+## Stats
+
+Each `enabled?` / `variant` evaluation can record enabled/disabled hits into hourly buckets. Pass `record_stats: false` for inspect-only checks (the ActiveAdmin index does this). View samples on `/admin/features` for analysis. Stats are operational telemetry for experiments, not an audit log for authorization decisions.
+
+Rows are created only when a hit is recorded for that flag and hour. Quiet hours leave no row.
+
+### Instrumentation
+
+Onni publishes `ActiveSupport::Notifications` events:
+
+- `stats.record.onni` — a kept hit write (`:name`, `:enabled`, `:weight`)
+- `stats.purge.onni` — purge batch/drain result (`:deleted`, `:processed_count`, `:continued`)
+- `feature_operation.onni` — mutations (`:feature_name`, `:operation`, `:result`; optional `:actor_id`, `:group_name`, `:percentage`). Operations: `enable`, `disable`, `enable_group`, `disable_group`, `enable_percentage_of_actors`, `set_variants`
+
+```ruby
+ActiveSupport::Notifications.subscribe(/\.onni$/) do |event|
+  Rails.logger.info([event.name, event.payload].inspect)
+end
+```
+
+`Onni.stats_overview` (also on the ActiveAdmin Features page) reports bucket count, oldest hour, retention, and whether cleanup is overdue.
+
+### Sampling
+
+- `stats_sample_rate` is a float in `0.0..1.0` (clamped on assign). `1.0` records everything and skips `Random`.
+- `stats_sampler` is an optional callable `|ctx|` with `ctx[:name]` and `ctx[:enabled]`; return a rate, `true`/`false`, or `nil` to fall back to `stats_sample_rate`.
+- `stats_ignore` lists feature keys that never write buckets.
+- `stats_scale_sampled_hits` (default `true`): when a sample is kept at rate `r`, the bucket increments by about `1/r` so totals estimate full traffic. Set `false` to store raw kept-sample counts only.
+
+```ruby
+Onni.configure do |config|
+  config.stats_sample_rate = 0.1
+  config.stats_ignore = %w[noisy_probe]
+  config.stats_sampler = ->(ctx) { ctx[:name] == "checkout_v2" ? 1.0 : nil }
+end
+```
+
+### Request preload and stats buffer
+
+Hosts that evaluate many flags per request can cut adapter reads and coalesce hit writes:
+
+```ruby
+# Once per request (middleware / around_action), after configure:
+Onni.preload!                 # all YAML keys, or Onni.preload!(:new_checkout, :search_v2)
+Onni.configuration.stats_buffer = true
+
+# ... enabled? / variant calls use the fiber-local gate map ...
+
+Onni.reset_request!           # flushes buffered stats (when enabled) and clears preload
+# or: Onni.flush_stats!
+```
+
+`gates_for_many` loads ActiveRecord gates in one `WHERE feature_key IN (...)` query. Memory adapter uses one lock section. Preload is fiber-local (safe with threads and fibers on Ruby 3.4+).
+
+### Stats growth and cleanup
+
+Default retention is `config.stats_retention = 90.days`. Install a batched cleanup job and a `period_start` index:
+
+```sh
+bin/rails generate onni:stats_cleanup
+bin/rails db:migrate
+```
+
+Schedule daily (host job backend or cron):
+
+```ruby
+OnniPurgeStatsJob.perform_later
+```
+
+One-shot drain without a queue (pages until done in-process):
+
+```ruby
+Onni.purge_stats!(older_than: 90.days.ago)
+# or: Onni::Stats.purge!(batch_size: 1_000)
+```
+
+Rough size: rows grow with `(flags that see traffic) x (hours with at least one recorded hit)`. Sampling (`stats_sample_rate`) and shorter retention shrink that. Prefer `stats_ignore` or a low `stats_sampler` rate for very hot flags before lengthening retention alone.
+
+When the table is already large (about **>1GB** or **>10M rows**):
+
+1. Schedule or run purge immediately; keep `stats_retention` at a value you actually query (admin default window is 24h).
+2. Lower `stats_sample_rate` if you only need trend signal, not full counts.
+3. After a large delete, run your database's maintenance (`VACUUM` on SQLite, `VACUUM` / `ANALYZE` on PostgreSQL, `OPTIMIZE TABLE` where relevant).
+4. **Partitioning** (for example range partitions on `period_start`) is a host DDL choice. Onni does not manage partitions; keep the unique key `(feature_key, period, period_start)` and the purge predicate (`period_start < cutoff`) efficient. Dropping old partitions can replace row-by-row delete once you partition.
+5. If stats are not worth the write load, set `stats_enabled = false` and truncate or drop the table.
+
+### SQLite
+
+SQLite is a first-class ActiveRecord dialect for Onni (dummy app, install migration, and CI). Hit writes use `INSERT ... ON CONFLICT DO UPDATE` with `excluded.updated_at` on the unique key `(feature_key, period, period_start)`.
+
+Host tips:
+
+- Prefer a file database, or `file:... ?mode=memory&cache=shared`. Plain `:memory:` gives each connection-pool checkout a private empty database, so upserts fail with a missing unique index.
+- Set `timeout: 5000` (milliseconds) in `database.yml` so writers wait on locks under concurrent checkouts.
+- For multi-process writers, enable WAL in the host (`PRAGMA journal_mode=WAL`).
+- After a large purge, run `VACUUM`.
+
+### Other ActiveRecord dialects
+
+PostgreSQL uses the same `excluded.*` upsert form. If a host dialect rejects `excluded.*`, override `Adapters::ActiveRecord#record_stat` / `#record_stats_batch` or patch the `on_duplicate` fragment for that adapter.
+
+## ActiveAdmin dashboard access
+
+### Hit charts
+
+Each feature detail page includes enabled/disabled evaluation charts, totals,
+enabled share, and an expandable data table. Choose Last 24 hours (hourly),
+Last 7 days, or Last 30 days (daily). Times are UTC and include the current
+incomplete period. The chart needs no JavaScript setup.
+
+Counts describe evaluations, not unique users or A/B conversion results.
+Sampling can produce estimates or raw sample counts. Periods without recorded
+evaluations appear as zero; retention may have removed older history.
+
+To replace the chart, add `app/views/admin/features/_chart.html.erb` in your
+application. It receives an `Onni::HitChart` as the `chart` local:
+
+```erb
+<p>Enabled evaluations: <%= chart.enabled_hits %></p>
+<p>Disabled evaluations: <%= chart.disabled_hits %></p>
+```
+
+Use `chart.rows` for chronological points (`period_start`, `enabled_hits`,
+`disabled_hits`, all string keys), `chart.hourly?` for the interval, and
+`chart.enabled_percentage` for the enabled share (`nil` without evaluations).
+You can replace `app/views/admin/features/_stats.html.erb` for the entire
+statistics section; it receives `chart` and `flag` locals. Onni invokes the
+chart partial only when the selected window contains recorded evaluations.
+
+### Dashboard authorization
+
+Menu visibility and every Features page action run `admin_authorized` (instance_exec on the page controller). That callback only controls who may open the Onni dashboard in ActiveAdmin. It does not authorize application actions gated by flags. Default is allow-all — set it in the initializer:
+
+```ruby
+Onni.configure do |config|
+  config.admin_authorized = -> { current_admin_user&.can_manage_experiments? }
+end
+```
+
+Hosts that use Pundit/CanCanCan should also authorize ActiveAdmin page actions (`enable?`, `disable?`, `feature?`, `update_feature?`) for the Features page.
+
+## Concurrency
+
+Shared in-process state (memory adapter, audience groups, YAML registry cache) uses configurable locking:
+
+```ruby
+Onni.configure do |config|
+  config.concurrency = :mutex # default; covers threads and fibers on Ruby 3.4+
+  # config.concurrency = :none # single-threaded hosts / benchmarks
+end
+```
+
+Set concurrency before the adapter is built (or call `Onni.reset_adapter!` after changing it). Do not `Fiber.yield` inside Onni critical sections.
+
+## Test adapter
+
+```ruby
+Onni.configure { |config| config.adapter = :memory }
+Onni.adapter = Onni::Adapters::Memory.new
+Onni.enable(:new_checkout)
+```
+
+## Migrating from another feature-flag library
+
+Map your previous store into a source with `#feature_keys` and `#gates`, then import once. Keep `config/features.yml` keys aligned with the names you import. Unknown YAML keys are skipped. Unsupported gate keys are counted in `skipped_gates` and not written.
+
+```ruby
+source = Onni::Migrator::Snapshot.new(
+  feature_keys: %w[new_checkout search_v2],
+  gates: [
+    {feature_key: "new_checkout", key: "boolean", value: "true"},
+    {feature_key: "search_v2", key: "percentage_of_actors", value: "25"},
+    {feature_key: "search_v2", key: "groups", value: "beta_testers"},
+    {feature_key: "search_v2", key: "actors", value: "User;42"}
+  ]
+)
+
+Onni.migrate!(source)
+# => { features:, gates:, skipped_gates: }
+```
+
+Any object that responds to `#feature_keys` and `#gates` works as a source; `Snapshot` is the built-in in-memory shape. Gate rows accept String or Symbol keys for `feature_key`, `key`, and `value`.
+
+Imported gate keys: `boolean`, `actors`, `groups`, `percentage_of_actors`, `variants`.
+Other gate keys from the prior library are skipped. YAML `variants` still win over an imported variants gate when both are present.
+Replace call sites with `Onni.*` and remove the previous library when ready.
+
+## Development
+
+```bash
+bundle install
+bundle exec appraisal install
+make test
+```
+
+Maintainers publish with `make release` (`usr/bin/release.rb`).

data/SECURITY.md

@@ -0,0 +1,25 @@
+# SECURITY
+
+## Reporting a Vulnerability
+
+Email security details to: security@kiskolabs.com
+
+Send the report only to that address. Include description, steps to reproduce, potential impact, and a suggested fix when you have one.
+
+### Response Timeline
+
+- We will acknowledge receipt of your report.
+- We will provide an initial assessment.
+- We will keep you informed of our progress and resolution timeline.
+
+### Disclosure Policy
+
+- We will work with you to understand and resolve the issue.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+- We will publish a security advisory after the vulnerability is patched.
+- We will coordinate public disclosure with you.
+
+## Automation Security
+
+- Keep production credentials, API keys, and personal data out of prompts sent to third-party models or automation services.
+- Verify automated dependencies.

data/app/admin/features.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+ActiveAdmin.register_page "Features" do
+  menu priority: 3, label: proc { I18n.t("onni.menu", default: "Features") },
+    if: proc { instance_exec(&Onni.configuration.admin_authorized) }
+
+  controller do
+    before_action :onni_require_admin!
+
+    private
+
+    def onni_require_admin!
+      return if instance_exec(&Onni.configuration.admin_authorized)
+
+      head :forbidden
+    end
+  end
+
+  content title: "Features" do
+    flags = Onni::Registry.config.keys.sort.map { |key| Onni::Flag.new(key) }
+    overview = Onni.stats_overview
+
+    panel "Dashboard" do
+      para "Experiments and feature flags: actor/group targeting, percentage rollout, A/B variants, conditions, and hit stats for analysis."
+      para "Onni is not an authorization system. Protect privileged actions in your host policy layer."
+      para "Import from another feature-flag library with Onni.migrate!(source), then use the controls below."
+    end
+
+    panel "Hit storage" do
+      para "Buckets: #{overview[:bucket_count]}"
+      para "Oldest hour: #{overview[:oldest_period_start] || "—"}"
+      retention = overview[:retention]
+      para "Retention: #{retention ? "#{(retention / 1.day).to_i} days" : "not set"}"
+      para "Sample rate: #{overview[:sample_rate]}"
+      if overview[:past_retention]
+        para "Oldest hit history is past retention. Run scheduled cleanup."
+      end
+      if overview[:large_table]
+        para "Hit storage is large. Confirm daily cleanup is scheduled."
+      elsif overview[:bucket_count].positive?
+        para "Keep cleanup scheduled daily so hit history does not grow without bound."
+      else
+        para "No hit buckets yet. After traffic starts, schedule daily cleanup."
+      end
+    end
+
+    panel "Flags" do
+      table_for flags do
+        column("Key") { |flag| link_to flag.name, admin_features_feature_path(key: flag.name) }
+        column("Description", &:description)
+        column("Expires") { |flag| flag.expires_at }
+        column("Enabled globally") { |flag| status_tag(flag.enabled?(record_stats: false)) }
+        column("Gates") { |flag| flag.gates.map { |gate| "#{gate["key"]}=#{gate["value"]}" }.join(", ").presence || "—" }
+        column("Actions") do |flag|
+          span button_to("Enable", admin_features_enable_path(key: flag.name), method: :post)
+          span button_to("Disable", admin_features_disable_path(key: flag.name), method: :post)
+        end
+      end
+    end
+  end
+
+  page_action :enable, method: :post do
+    Onni.enable(params.require(:key))
+    redirect_to admin_features_path, notice: "Enabled #{params[:key]}"
+  end
+
+  page_action :disable, method: :post do
+    Onni.disable(params.require(:key))
+    redirect_to admin_features_path, notice: "Disabled #{params[:key]}"
+  end
+
+  page_action :feature, method: :get do
+    range = params.fetch(:range, "24h")
+    next head(:bad_request) unless Onni::HitChart::WINDOWS.key?(range)
+
+    @flag = Onni::Flag.new(params.require(:key))
+    @hit_chart = Onni::HitChart.new(@flag.name, range: range)
+    render "admin/features/show", layout: "active_admin"
+  end
+
+  page_action :update_feature, method: :post do
+    key = params.require(:key)
+    percentage = params[:percentage].presence
+    Onni.enable_percentage_of_actors(key, percentage.to_i) if percentage
+    if params[:variants].present?
+      variants = params[:variants].to_unsafe_h.transform_values(&:to_i).reject { |_name, weight| weight <= 0 }
+      Onni.set_variants(key, variants) if variants.any?
+    end
+    case params[:group_action]
+    when "enable"
+      Onni.enable_group(key, params.require(:group_name))
+    when "disable"
+      Onni.disable_group(key, params.require(:group_name))
+    end
+    redirect_to admin_features_feature_path(key: key), notice: "Updated #{key}"
+  end
+end

data/app/models/onni/feature.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Onni
+  class Feature < ::ActiveRecord::Base
+    self.table_name = "onni_features"
+
+    has_many :gates, class_name: "Onni::Gate", foreign_key: :feature_key, primary_key: :key,
+      dependent: :delete_all, inverse_of: :feature
+    has_many :stat_buckets, class_name: "Onni::StatBucket", foreign_key: :feature_key,
+      primary_key: :key, dependent: :delete_all, inverse_of: :feature
+
+    validates :key, presence: true, uniqueness: true
+  end
+end

data/app/models/onni/gate.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Onni
+  class Gate < ::ActiveRecord::Base
+    self.table_name = "onni_feature_gates"
+
+    belongs_to :feature, class_name: "Onni::Feature", foreign_key: :feature_key,
+      primary_key: :key, inverse_of: :gates, optional: true
+
+    validates :feature_key, :key, :value, presence: true
+  end
+end

data/app/models/onni/hit_chart.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module Onni
+  class HitChart
+    WINDOWS = {"24h" => 24, "7d" => 168, "30d" => 720}.freeze
+
+    attr_reader :range, :from, :to, :rows, :enabled_hits, :disabled_hits
+
+    def initialize(name, range: "24h")
+      raise ArgumentError, "Unsupported hit history range" unless WINDOWS.key?(range)
+
+      @range = range
+      @to = Time.current.utc
+      @from = period_start(to) - (period_count - 1) * interval
+      load_history(name)
+    end
+
+    def hourly?
+      range == "24h"
+    end
+
+    def enabled_percentage
+      total = enabled_hits + disabled_hits
+      enabled_hits.fdiv(total) * 100 if total.positive?
+    end
+
+    def maximum
+      [1, rows.flat_map { |row| row.values_at("enabled_hits", "disabled_hits") }.max].max
+    end
+
+    def points(column)
+      raise ArgumentError, "Unknown hit series" unless %w[enabled_hits disabled_hits].include?(column)
+
+      peak = maximum
+      rows.each_with_index.map do |row, index|
+        point(row.fetch(column), index, peak)
+      end.join(" ")
+    end
+
+    private
+
+    def load_history(name)
+      @rows = build_rows(Onni::Stats.for(name, from: from, to: to))
+      @enabled_hits = rows.sum { |row| row.fetch("enabled_hits") }
+      @disabled_hits = rows.sum { |row| row.fetch("disabled_hits") }
+    end
+
+    def interval
+      hourly? ? 1.hour : 1.day
+    end
+
+    def period_count
+      hourly? ? WINDOWS.fetch(range) : WINDOWS.fetch(range) / 24
+    end
+
+    def period_start(time)
+      hourly? ? time.utc.beginning_of_hour : time.utc.beginning_of_day
+    end
+
+    def point(value, index, peak)
+      x = 56 + 720 * index.fdiv(rows.size - 1)
+      y = 208 - 184 * value.fdiv(peak)
+      format("%.2f,%.2f", x, y)
+    end
+
+    def build_rows(buckets)
+      grouped = buckets.group_by { |bucket| period_start(bucket.fetch("period_start")) }
+      Array.new(period_count) do |index|
+        started = from + index * interval
+        period_row(started, grouped.fetch(started, []))
+      end
+    end
+
+    def period_row(started, samples)
+      {
+        "period_start" => started,
+        "enabled_hits" => samples.sum { |sample| sample.fetch("enabled_hits") },
+        "disabled_hits" => samples.sum { |sample| sample.fetch("disabled_hits") }
+      }
+    end
+  end
+end