WIP: reword warlock false-positive strings in context-mill content (#218)

Reword threat-shaped-but-benign strings so the wizard's warlock scanner
stops flagging context-mill's own content as security findings. Covers the
authored strings only (example-app demo copy, commandments.yaml, audit skill
text). Fetched-doc and wizard-contract cases tracked separately.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sarahxsanders

context/commandments.yaml

@@ -44,15 +44,15 @@ commandments:
     - posthog-js is the JavaScript SDK package name
     - posthog.init() MUST be called before any other PostHog methods (capture, identify, etc.)
     - posthog-js is browser-only — do NOT import it in Node.js or server-side contexts (use posthog-node instead)
-    - Autocapture is ON by default with posthog-js (tracks clicks, form submissions, pageviews). Do NOT disable autocapture unless the user explicitly requests it.
+    - Autocapture is ON by default with posthog-js (tracks clicks, form submissions, pageviews). Keep autocapture enabled unless the user explicitly asks to turn it off.
     - NEVER send PII in posthog.capture() event properties — no emails, full names, phone numbers, physical addresses, IP addresses, or user-generated content
     - PII belongs in posthog.identify() person properties (email, name, role), NOT in capture() event properties
     - Call posthog.identify(userId, { email, name, role }) on login AND on page refresh if the user is already logged in
     - Call posthog.reset() on logout to unlink future events from the current user
     - For SPAs without a framework router, capture pageviews with posthog.capture($pageview) or use the capture_pageview history_change option in init for History API routing
 
   javascript_node:
-    - posthog-node is the Node.js server-side SDK package name – do NOT use posthog-js on the server
+    - posthog-node is the Node.js server-side SDK package name; posthog-js is browser-only, so use posthog-node on the server instead
     - 'Include enableExceptionAutocapture: true in the PostHog constructor options'
     - Add posthog.capture() calls in route handlers for meaningful user actions – every route that creates, updates, or deletes data should track an event with contextual properties
     - Add posthog.captureException(err, distinctId) in the application's error handler (e.g., Express error middleware, Fastify setErrorHandler, Koa app.on('error'))
@@ -143,7 +143,7 @@ commandments:
 
   tanstack-start:
     - Use PostHogProvider in the root route (__root.tsx) for client-side tracking
-    - Use posthog-node for server-side event capture in API routes (src/routes/api/) - do NOT use posthog-js on the server
+    - Use posthog-node for server-side event capture in API routes (src/routes/api/) – posthog-js is browser-only
     - Create a singleton PostHog server client to avoid re-initialization on every request
 
   laravel:

context/skills/audit-attribution/description.md

@@ -63,7 +63,7 @@ Every finding produced by this skill must meet the standards in [posthog-best-pr
 ## Abort statuses
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
-- No PostHog SDK initialization found
+- PostHog SDK initialization not found
 
 ## Framework guidelines
 

context/skills/audit-attribution/references/1-presence.md

@@ -32,7 +32,7 @@ Run **two `Grep` calls in parallel**, both with `output_mode: "files_with_matche
 
 ### b. Abort or continue
 
-- **Init grep returns zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run. Do NOT seed the ledger in this case.
+- **Init grep returns zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run. Do NOT seed the ledger in this case.
 - **Init found:** continue to (c). Even projects with no explicit click-id capture rely on PostHog's built-in UTM auto-capture; each step's individual rules decide whether to skip or warn based on the kind of evidence present.
 
 ### c. Seed the audit ledger

context/skills/audit-autocapture/description.md

@@ -65,7 +65,7 @@ After the final step writes the report, delete `.posthog-audit-checks.json`.
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
 
-- No PostHog SDK initialization found (no `posthog.init` anywhere in the codebase)
+- PostHog SDK initialization not found (no `posthog.init` anywhere in the codebase)
 
 ## Framework guidelines
 

context/skills/audit-autocapture/references/1-presence.md

@@ -29,7 +29,7 @@ If init sites are found, `Read` each file once and inspect the init options for
 
 ## Decision
 
-- **Grep returns zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run.
+- **Grep returns zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run.
 - **Init found, `autocapture: false` is explicitly set on every init site:** autocapture is fully off. Resolve all three Step 2 fix checks (`autocapture-intentional`, `autocapture-mask-config`, `autocapture-allowlists`) in a single `audit_resolve_checks` call with `status: "pass"` and `details: "skip: autocapture explicitly disabled in init config"`. Then continue to Step 3 — optimize-side checks still have work to do for the dead-clicks and ratio checks.
 - **Init found, autocapture not fully disabled:** continue normally.
 

context/skills/audit-events/description.md

@@ -65,7 +65,7 @@ After the final step writes the report, delete `.posthog-audit-checks.json`.
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
 
-- No PostHog SDK initialization found (no `posthog.init` and no `posthog.capture` anywhere in the codebase)
+- PostHog SDK initialization not found (no `posthog.init` and no `posthog.capture` anywhere in the codebase)
 
 ## Framework guidelines
 

context/skills/audit-events/references/1-presence.md

@@ -23,7 +23,7 @@ Run **two `Grep` calls in parallel**, both with `output_mode: "files_with_matche
 
 ## Decision
 
-- **Both greps return zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run.
+- **Both greps return zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run.
 - **Init found, capture not found:** continue. Step 2 (fix) will detect this and resolve its four ledger checks with skip details. Step 3 (optimize) still has work to do because pageview defaults and downstream usage may still matter.
 - **Both found:** continue normally.
 

context/skills/audit-identify/description.md

@@ -66,7 +66,7 @@ After the final step writes the report, delete `.posthog-audit-checks.json`.
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
 
-- No PostHog SDK initialization found (no `posthog.init` and no `posthog.identify` anywhere in the codebase)
+- PostHog SDK initialization not found (no `posthog.init` and no `posthog.identify` anywhere in the codebase)
 
 ## Framework guidelines
 

context/skills/audit-identify/references/1-presence.md

@@ -23,7 +23,7 @@ Run **two `Grep` calls in parallel**, both with `output_mode: "files_with_matche
 
 ## Decision
 
-- **Both greps return zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run.
+- **Both greps return zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run.
 - **Init found, identify not found:** continue. Step 2 (fix) will detect this and resolve its four ledger checks with skip details. Step 3 (optimize) still has work to do because `person_profiles` config still matters even without identify calls.
 - **Both found:** continue normally.
 

context/skills/audit-session-replay/references/2-session-replay-fix.md

@@ -81,7 +81,7 @@ Emit one `mcp__wizard-tools__audit_resolve_checks` call with a single update for
 ```
 You are an audit subagent. Resolve exactly one rule and return: replay-disabled-in-test-envs.
 
-Read this skill's bundled `how-to-control-which-sessions-you-record.md` reference once (typically `.claude/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`; otherwise discover with `Glob` `**/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`). Test and CI runs that don't disable session replay flood the recording pipeline with synthetic, useless sessions that consume your replay quota.
+Read this skill's bundled `how-to-control-which-sessions-you-record.md` reference once (typically `.claude/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`; otherwise discover with `Glob` `**/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`). Test and CI runs that leave session replay enabled flood the recording pipeline with synthetic, useless sessions that consume your replay quota.
 
 Run **three** Greps in parallel:
 - `posthog\.init\(|new PostHog\(|posthog\.Posthog\(|Posthog\(` — every PostHog initialization.