[CI] (6fb03e7) rails/fizzy

[wizard-ci-bot]

Automated wizard CI run

Source: scheduled
Trigger ID: 6fb03e7
App: rails/fizzy
App directory: apps/rails/fizzy
Workbench branch: wizard-ci-6fb03e7-rails-fizzy
Wizard branch: main
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-05-13T17:37:03.569Z
Duration: 511.2s

[wizard-ci-bot]

The CSP initializer wasn't modified in this PR. The snippet uses a nonce which is good. Now I have enough context to write the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Ruby on Rails kanban app ("Fizzy") by adding posthog-ruby and posthog-rails gems, creating a server-side initializer with error tracking, adding a client-side posthog-js snippet to the layout, and instrumenting 12 meaningful business events across 11 controllers. A posthog_distinct_id method is added to the User model, though it problematically uses raw email addresses as the primary identifier.

Files changed	Lines added	Lines removed
19	+196	-1

Confidence score: 4/5 👍

• Email used as distinct_id: posthog_distinct_id returns identity&.email_address as the primary distinct ID. Using raw email addresses as distinct IDs is a PostHog anti-pattern — emails can change, they're PII, and they cause fragmented user profiles. Should use id.to_s or a stable identifier instead. [CRITICAL]
• Inconsistent distinct_id across controllers: Some controllers use Current.user.posthog_distinct_id while others (sessions_controller, magic_links_controller, join_codes_controller) use Current.identity.email_address or @identity.email_address directly, creating identity fragmentation where the same user may have events split across different distinct IDs. [MEDIUM]
• No .env.example committed: Environment variables POSTHOG_PROJECT_TOKEN and POSTHOG_HOST are not documented in any committed file. The .env is gitignored and there's no .env.example. [MEDIUM]
• No reverse proxy for client-side posthog-js: The PR adds a posthog-js snippet to the layout but doesn't configure a reverse proxy, leaving client-side tracking vulnerable to ad blockers. [MEDIUM]

---

File changes

Filename	Score	Description
Gemfile	5/5	Correctly adds posthog-ruby and posthog-rails gems in a logical section
config/initializers/posthog.rb	5/5	Proper PostHog.init + PostHog::Rails.configure with all recommended options
app/models/user.rb	3/5	Adds posthog_distinct_id and posthog_properties but uses email as primary ID
app/controllers/application_controller.rb	5/5	Adds current_user helper needed by posthog-rails for user context
app/views/layouts/shared/_head.html.erb	4/5	posthog-js snippet with CSP nonce and conditional identify — good pattern
app/controllers/sessions/magic_links_controller.rb	3/5	Identify + capture on sign-in, but uses raw email as distinct_id
app/controllers/sessions_controller.rb	3/5	Uses Current.identity.email_address directly instead of posthog_distinct_id
app/controllers/join_codes_controller.rb	3/5	Uses @identity.email_address directly as distinct_id
app/controllers/signups/completions_controller.rb	4/5	Good identify + capture pattern on signup
app/controllers/boards_controller.rb	5/5	Clean capture with relevant properties
app/controllers/cards/*.rb	5/5	Consistent capture patterns across card actions
posthog-setup-report.md	3/5	Informative but unnecessary artifact

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Gem additions and Ruby code are syntactically correct
Preserves existing env vars & configs	Yes	Only additions, no existing code removed (except minor refactor in assignments_controller)
No syntax or type errors	Yes	All Ruby and ERB syntax is valid
Correct imports/exports	Yes	Uses PostHog.capture / PostHog.identify class-level methods correctly per posthog-rails
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	No pre-existing issues observed

Issues

• No .env.example file: POSTHOG_PROJECT_TOKEN and POSTHOG_HOST are required by the initializer and JS snippet but not documented in any committed file. A .env.example should be added so new developers know which variables to set. [MEDIUM]

Other completed criteria

• App builds without errors — gem additions and code are syntactically valid
• Existing app functionality preserved — only additive changes
• Changes are minimal and focused on PostHog integration
• Build configuration (Gemfile) is valid

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-ruby and posthog-rails in Gemfile; posthog-js via <script> tag in layout
PostHog client initialized	Yes	PostHog.init with env-based config + PostHog::Rails.configure with error tracking, ActiveJob instrumentation, and user context
capture()	Yes	12 meaningful events captured across 11 controllers using PostHog.capture() class method
identify()	No	Uses raw email addresses as distinct_id (identity&.email_address). Multiple controllers bypass posthog_distinct_id and use email directly, causing fragmented data
Error tracking	Yes	auto_capture_exceptions: true, report_rescued_exceptions: true, auto_instrument_active_job: true — comprehensive error tracking
Reverse proxy	No	posthog-js snippet loaded directly from PostHog CDN with no reverse proxy configured

Issues

• Raw email as distinct_id: The posthog_distinct_id method returns identity&.email_address || id.to_s, making email the primary distinct ID. This is a PostHog anti-pattern — emails are PII, can change, and should not be used as the canonical identifier. The method should return id.to_s as primary and set email via person properties. [CRITICAL]
• Inconsistent distinct_id usage: sessions_controller.rb uses Current.identity.email_address, magic_links_controller.rb uses magic_link.identity.email_address, and join_codes_controller.rb uses @identity.email_address — all bypassing the posthog_distinct_id method. Events from the same user will be split across different identifiers. [MEDIUM]
• No reverse proxy: Client-side posthog-js connects directly to PostHog, making it susceptible to ad blockers. A reverse proxy through the Rails app would improve data collection reliability. [MEDIUM]

Other completed criteria

• PostHog SDK correctly added to Gemfile
• Initializer follows documented posthog-rails pattern with PostHog.init block
• API key loaded from ENV.fetch("POSTHOG_PROJECT_TOKEN", nil) — not hardcoded
• Host loaded from ENV.fetch("POSTHOG_HOST", nil) — correctly configured
• current_user helper method properly added to ApplicationController for posthog-rails user context
• user_id_method: :posthog_distinct_id correctly configured in Rails config
• posthog-js snippet uses CSP nonce for security
• Client-side identify conditionally called only when user is authenticated

---

PostHog insights and events ✅

Filename	PostHog events	Description
signups/completions_controller.rb	signed_up	Captures new account creation with account_id; also calls identify with person properties
sessions/magic_links_controller.rb	signed_in	Captures magic link authentication with login_method property; also calls identify
sessions_controller.rb	signed_out	Captures session termination
account/cancellations_controller.rb	account_cancelled	Captures account deletion (churn event) with account_id
boards_controller.rb	board_created	Captures board creation with board_id and board_name
boards/publications_controller.rb	board_published	Captures board publication with board_id and board_name
cards_controller.rb	card_created	Captures card creation with board_id and card_id
cards/closures_controller.rb	card_closed	Captures card completion with card_id and board_id
cards/triages_controller.rb	card_triaged	Captures card triage with card_id, board_id, and column_id
cards/comments_controller.rb	card_commented	Captures comment creation with card_id and board_id
cards/assignments_controller.rb	card_assigned	Captures card assignment with card_id, board_id, and assignee_id
join_codes_controller.rb	joined_via_invite	Captures invite code redemption with account_id
config/initializers/posthog.rb	capturedException	Auto-captures controller exceptions, rescued exceptions, and ActiveJob failures

Issues

No event quality issues — events are well-named, represent real user actions, and include relevant contextual properties.

Other completed criteria

• Events represent real user actions across the full product lifecycle (signup → usage → churn)
• Events enable product insights: signup-to-first-card funnel, DAU trends, churn tracking, card completion rates
• All events include relevant contextual properties (board_id, card_id, account_id, etc.)
• No PII in event properties — emails only appear as distinct_id (separate concern) and in person properties via identify
• Event names are descriptive, consistent snake_case, and follow [object]_[verb] convention

---

Reviewed by wizard workbench PR evaluator