[CI] (0ae2102) rails/fizzy

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 0ae2102
App: rails/fizzy
App directory: apps/rails/fizzy
Workbench branch: wizard-ci-0ae2102-rails-fizzy
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-04-15T19:30:54.067Z
Duration: 499.7s

[wizard-ci-bot]

Now I have all the context I need. Let me produce the evaluation report.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Ruby on Rails kanban app ("Fizzy") using posthog-ruby + posthog-rails gems for server-side tracking and a posthog-js browser snippet for frontend tracking. It adds a PostHog initializer, a posthog_distinct_id method on the User model, a current_user helper, 10 custom event captures across controllers, and client-side identification in the layout. The setup report is also included.

Files changed	Lines added	Lines removed
16	+153	-0

Confidence score: 4/5 👍

• Email used as distinct_id: The posthog_distinct_id method returns identity.email_address, and all backend PostHog.capture / PostHog.identify calls use raw email addresses as distinct_id. This is a PII concern and causes fragmented data if a user changes their email. Should use a stable, non-PII identifier like the user's database ID. [CRITICAL]
• PII in identify properties: PostHog.identify calls set { email: ... } in properties: — the correct key for person properties in the Rails SDK is properties:, which maps to ``. The email in person properties is acceptable, but the email being the distinct_id itself is the main issue. [MEDIUM]
• No .env.example file: The .env file (containing actual values) is gitignored but committed to the diff description. There is no .env.example or .env.sample documenting the required environment variables for other developers. [MEDIUM]
• Frontend snippet exposes email in HTML source: The posthog.identify call in the ERB template outputs the user's email directly into the HTML page source, which is a minor PII exposure concern. [LOW]

---

File changes

Filename	Score	Description
Gemfile	5/5	Correctly adds posthog-ruby and posthog-rails gems
config/initializers/posthog.rb	5/5	Proper PostHog.init + PostHog::Rails.configure with all recommended options
app/models/user.rb	3/5	Adds posthog_distinct_id but returns email address instead of stable ID
app/controllers/application_controller.rb	5/5	Adds current_user helper for posthog-rails user context detection
app/views/layouts/shared/_head.html.erb	4/5	posthog-js snippet with CSP nonce, env var usage, and identify — but uses email as distinct_id
app/controllers/sessions/magic_links_controller.rb	3/5	Identify + capture on sign-in, but uses email as distinct_id
app/controllers/signups/completions_controller.rb	3/5	Identify + capture on signup, but uses email as distinct_id
app/controllers/boards_controller.rb	4/5	Clean capture of board_created with properties
app/controllers/cards_controller.rb	4/5	Clean capture of card_created with properties
app/controllers/cards/closures_controller.rb	4/5	Captures card_closed and card_reopened with properties
app/controllers/cards/comments_controller.rb	4/5	Captures comment_added with properties
app/controllers/cards/not_nows_controller.rb	4/5	Captures card_postponed with properties
app/controllers/cards/triages_controller.rb	4/5	Captures card_triaged with column context
app/controllers/account/cancellations_controller.rb	4/5	Captures account_cancelled with account context
.gitignore	5/5	Correctly adds .env to gitignore
posthog-setup-report.md	N/A	Setup documentation

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors, gems are correctly referenced, initializer pattern is valid
Preserves existing env vars & configs	Yes	Only adds new code, no existing code modified destructively
No syntax or type errors	Yes	All Ruby syntax is valid, ERB template is well-formed
Correct imports/exports	Yes	Uses PostHog.capture / PostHog.identify class-level methods as required by posthog-rails
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	Base app appears well-structured

Issues

• No .env.example file: The .env file is gitignored (good) but there's no .env.example or .env.sample to document required POSTHOG_PROJECT_TOKEN and POSTHOG_HOST variables. Other developers cloning the repo won't know what env vars to set. The setup report mentions them but a proper env example file is standard practice. [MEDIUM]

Other completed criteria

• Build configuration is valid — gems added correctly to Gemfile
• Code follows existing codebase patterns (Rails 2-space indentation, controller structure)
• No unnecessary modifications — all changes are PostHog-related

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-ruby and posthog-rails gems in Gemfile, plus posthog-js browser snippet in layout
PostHog client initialized	Yes	PostHog.init with env vars in config/initializers/posthog.rb, posthog-js snippet with posthog.init() in _head.html.erb
capture()	Yes	10 meaningful capture calls across controllers covering core user flows
identify()	N/A	Server-only app (posthog-rails handles user context via capture_user_context). Frontend identify is a bonus.
Error tracking	Yes	auto_capture_exceptions: true, report_rescued_exceptions: true, auto_instrument_active_job: true — comprehensive automatic error tracking
Reverse proxy	N/A	Server-only app; frontend snippet is a bonus addition

Issues

• Email address used as distinct_id everywhere: posthog_distinct_id returns identity&.email_address. All PostHog.capture and PostHog.identify calls use the email as the distinct ID. The PostHog docs explicitly warn against using raw email addresses as distinct IDs — they are PII and if the user changes their email, their identity fragments. Should use a stable identifier like identity&.id or "user_#{id}". [CRITICAL]
• Inconsistent distinct_id sources: In magic_links_controller.rb and completions_controller.rb, the distinct_id is magic_link.identity.email_address / Current.identity.email_address respectively, while other controllers use Current.user.posthog_distinct_id (which also resolves to email). While consistent in value, the code paths differ — if posthog_distinct_id were fixed to return a proper ID, these two controllers would still send the email. [MEDIUM]

Other completed criteria

• API key loaded from environment variable (ENV.fetch("POSTHOG_PROJECT_TOKEN", nil))
• Host correctly configured from environment variable (ENV.fetch("POSTHOG_HOST", nil))
• Uses correct PostHog.capture / PostHog.identify class-level methods (not instance methods)
• posthog-rails initializer follows the documented pattern exactly
• posthog_distinct_id defined on User model for automatic user association in error reports
• current_user helper added to ApplicationController for posthog-rails user context
• Frontend snippet uses CSP nonce for security compliance

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
sessions/magic_links_controller.rb	user_signed_in	Tracks magic link sign-in with login_method property
signups/completions_controller.rb	account_created	Tracks new account creation after signup completion
boards_controller.rb	board_created	Tracks board creation with board_id and all_access flag
cards_controller.rb	card_created	Tracks card creation with card_id and board_id
cards/closures_controller.rb	card_closed, card_reopened	Tracks card lifecycle with card_id and board_id
cards/comments_controller.rb	comment_added	Tracks comment activity with card and board context
cards/not_nows_controller.rb	card_postponed	Tracks card postponement with card and board context
cards/triages_controller.rb	card_triaged	Tracks card triage with column_id for workflow position
account/cancellations_controller.rb	account_cancelled	Tracks account churn with account_id
config/initializers/posthog.rb	capturedException (automatic)	Auto-captures unhandled and rescued exceptions, ActiveJob failures

Issues

• Email as distinct_id is PII leaking into events: Every capture() call uses the email address as distinct_id, which means the email is embedded in every event record. While distinct_id is technically a person-level field, using email directly means PII is spread across all event data rather than being confined to person properties. [CRITICAL]
• account_created event lacks properties: The account_created capture has no properties at all — no account ID, plan type, or referral source. Other events consistently include contextual properties. [LOW]

Other completed criteria

• Events represent real user actions — all 10 events map to actual product flows (auth, board management, card lifecycle, collaboration, churn)
• Events enable product insights — can build signup funnel (account_created → board_created → card_created), engagement trends, and churn monitoring
• Most events include relevant contextual properties (board_id, card_id, column_id, etc.)
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator