feat: reduce warlock false positives

context/commandments.yaml

@@ -44,15 +44,15 @@ commandments:
     - posthog-js is the JavaScript SDK package name
     - posthog.init() MUST be called before any other PostHog methods (capture, identify, etc.)
     - posthog-js is browser-only — do NOT import it in Node.js or server-side contexts (use posthog-node instead)
-    - Autocapture is ON by default with posthog-js (tracks clicks, form submissions, pageviews). Do NOT disable autocapture unless the user explicitly requests it.
+    - Autocapture is ON by default with posthog-js (tracks clicks, form submissions, pageviews). Keep autocapture enabled unless the user explicitly asks to turn it off.
     - NEVER send PII in posthog.capture() event properties — no emails, full names, phone numbers, physical addresses, IP addresses, or user-generated content
     - PII belongs in posthog.identify() person properties (email, name, role), NOT in capture() event properties
     - Call posthog.identify(userId, { email, name, role }) on login AND on page refresh if the user is already logged in
     - Call posthog.reset() on logout to unlink future events from the current user
     - For SPAs without a framework router, capture pageviews with posthog.capture($pageview) or use the capture_pageview history_change option in init for History API routing
 
   javascript_node:
-    - posthog-node is the Node.js server-side SDK package name – do NOT use posthog-js on the server
+    - posthog-node is the Node.js server-side SDK package name; posthog-js is browser-only, so use posthog-node on the server instead
     - 'Include enableExceptionAutocapture: true in the PostHog constructor options'
     - Add posthog.capture() calls in route handlers for meaningful user actions – every route that creates, updates, or deletes data should track an event with contextual properties
     - Add posthog.captureException(err, distinctId) in the application's error handler (e.g., Express error middleware, Fastify setErrorHandler, Koa app.on('error'))
@@ -143,7 +143,7 @@ commandments:
 
   tanstack-start:
     - Use PostHogProvider in the root route (__root.tsx) for client-side tracking
-    - Use posthog-node for server-side event capture in API routes (src/routes/api/) - do NOT use posthog-js on the server
+    - Use posthog-node for server-side event capture in API routes (src/routes/api/) – posthog-js is browser-only
     - Create a singleton PostHog server client to avoid re-initialization on every request
 
   laravel:

context/skills/audit-attribution/description.md

@@ -63,7 +63,7 @@ Every finding produced by this skill must meet the standards in [posthog-best-pr
 ## Abort statuses
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
-- No PostHog SDK initialization found
+- PostHog SDK initialization not found
 
 ## Framework guidelines
 

context/skills/audit-attribution/references/1-presence.md

@@ -32,7 +32,7 @@ Run **two `Grep` calls in parallel**, both with `output_mode: "files_with_matche
 
 ### b. Abort or continue
 
-- **Init grep returns zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run. Do NOT seed the ledger in this case.
+- **Init grep returns zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run. Do NOT seed the ledger in this case.
 - **Init found:** continue to (c). Even projects with no explicit click-id capture rely on PostHog's built-in UTM auto-capture; each step's individual rules decide whether to skip or warn based on the kind of evidence present.
 
 ### c. Seed the audit ledger

context/skills/audit-autocapture/description.md

@@ -65,7 +65,7 @@ After the final step writes the report, delete `.posthog-audit-checks.json`.
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
 
-- No PostHog SDK initialization found (no `posthog.init` anywhere in the codebase)
+- PostHog SDK initialization not found (no `posthog.init` anywhere in the codebase)
 
 ## Framework guidelines
 

context/skills/audit-autocapture/references/1-presence.md

@@ -29,7 +29,7 @@ If init sites are found, `Read` each file once and inspect the init options for
 
 ## Decision
 
-- **Grep returns zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run.
+- **Grep returns zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run.
 - **Init found, `autocapture: false` is explicitly set on every init site:** autocapture is fully off. Resolve all three Step 2 fix checks (`autocapture-intentional`, `autocapture-mask-config`, `autocapture-allowlists`) in a single `audit_resolve_checks` call with `status: "pass"` and `details: "skip: autocapture explicitly disabled in init config"`. Then continue to Step 3 — optimize-side checks still have work to do for the dead-clicks and ratio checks.
 - **Init found, autocapture not fully disabled:** continue normally.
 

context/skills/audit-events/description.md

@@ -65,7 +65,7 @@ After the final step writes the report, delete `.posthog-audit-checks.json`.
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
 
-- No PostHog SDK initialization found (no `posthog.init` and no `posthog.capture` anywhere in the codebase)
+- PostHog SDK initialization not found (no `posthog.init` and no `posthog.capture` anywhere in the codebase)
 
 ## Framework guidelines
 

context/skills/audit-events/references/1-presence.md

@@ -23,7 +23,7 @@ Run **two `Grep` calls in parallel**, both with `output_mode: "files_with_matche
 
 ## Decision
 
-- **Both greps return zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run.
+- **Both greps return zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run.
 - **Init found, capture not found:** continue. Step 2 (fix) will detect this and resolve its four ledger checks with skip details. Step 3 (optimize) still has work to do because pageview defaults and downstream usage may still matter.
 - **Both found:** continue normally.
 

context/skills/audit-identify/description.md

@@ -66,7 +66,7 @@ After the final step writes the report, delete `.posthog-audit-checks.json`.
 
 Report abort states with `[ABORT]` prefixed messages. The wizard catches these and terminates the run — do not halt yourself.
 
-- No PostHog SDK initialization found (no `posthog.init` and no `posthog.identify` anywhere in the codebase)
+- PostHog SDK initialization not found (no `posthog.init` and no `posthog.identify` anywhere in the codebase)
 
 ## Framework guidelines
 

context/skills/audit-identify/references/1-presence.md

@@ -23,7 +23,7 @@ Run **two `Grep` calls in parallel**, both with `output_mode: "files_with_matche
 
 ## Decision
 
-- **Both greps return zero hits anywhere in the project:** emit `[ABORT] No PostHog SDK initialization found` and stop. The wizard catches `[ABORT]` and terminates the run.
+- **Both greps return zero hits anywhere in the project:** emit `[ABORT] PostHog SDK initialization not found` and stop. The wizard catches `[ABORT]` and terminates the run.
 - **Init found, identify not found:** continue. Step 2 (fix) will detect this and resolve its four ledger checks with skip details. Step 3 (optimize) still has work to do because `person_profiles` config still matters even without identify calls.
 - **Both found:** continue normally.
 

context/skills/audit-session-replay/references/2-session-replay-fix.md

@@ -81,7 +81,7 @@ Emit one `mcp__wizard-tools__audit_resolve_checks` call with a single update for
 ```
 You are an audit subagent. Resolve exactly one rule and return: replay-disabled-in-test-envs.
 
-Read this skill's bundled `how-to-control-which-sessions-you-record.md` reference once (typically `.claude/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`; otherwise discover with `Glob` `**/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`). Test and CI runs that don't disable session replay flood the recording pipeline with synthetic, useless sessions that consume your replay quota.
+Read this skill's bundled `how-to-control-which-sessions-you-record.md` reference once (typically `.claude/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`; otherwise discover with `Glob` `**/skills/audit-session-replay/references/how-to-control-which-sessions-you-record.md`). Test and CI runs that leave session replay enabled flood the recording pipeline with synthetic, useless sessions that consume your replay quota.
 
 Run **three** Greps in parallel:
 - `posthog\.init\(|new PostHog\(|posthog\.Posthog\(|Posthog\(` — every PostHog initialization.

context/skills/creating-product-tours/description.md

@@ -27,7 +27,7 @@ Use the PostHog MCP tool or the PostHog UI (Flags → New feature flag):
 
 - **Key**: `tour-<name>` (lowercase, hyphens)
 - **Rollout**: set to the target audience using person/group properties or a percentage rollout
-- **Enabled state**: Do not enable the feature flag. Leave that to the user.
+- **Enabled state**: Leave the feature flag disabled – the user enables it when ready.
 - **Payload** (optional): store the step config as JSON so tours can be updated without deploys:
 
 ```json

context/skills/web-analytics/description.md

@@ -152,7 +152,7 @@ Report progress with `[STATUS]` prefixed messages:
 Report abort states with `[ABORT]` prefixed messages — wording must match exactly so the wizard renders the right error UI:
 
 - `[ABORT] No web analytics events` — pre-flight finds no `$pageview` events in the last 30 days, but a PostHog SDK is present.
-- `[ABORT] PostHog SDK not installed` — pre-flight finds no `$pageview` events and no PostHog SDK in the project.
+- `[ABORT] PostHog SDK not installed` — pre-flight finds no `$pageview` events and the PostHog SDK is not present in the project.
 - `[ABORT] Insufficient permissions` — `query-run` returns a permissions error on the pre-flight query.
 
 Stop all further work after emitting `[ABORT]`.

example-apps/angular/src/app/pages/home/home.component.ts

@@ -15,7 +15,7 @@ import { AuthService } from '../../services/auth.service';
       @if (auth.user(); as user) {
         <div class="container">
           <h1>Welcome back, {{ user.username }}!</h1>
-          <p>You are now logged in. Feel free to explore:</p>
+          <p>You are logged in. Feel free to explore:</p>
           <ul>
             <li>Consider the potential of burritos</li>
             <li>View your profile and statistics</li>

example-apps/astro-hybrid/src/pages/index.astro

@@ -8,7 +8,7 @@ import PostHogLayout from '../layouts/PostHogLayout.astro';
   <div class="container">
     <div id="logged-in-view" style="display: none;">
       <h1>Welcome back, <span id="welcome-username"></span>!</h1>
-      <p>You are now logged in. Feel free to explore:</p>
+      <p>You are logged in. Feel free to explore:</p>
       <ul>
         <li>Consider the potential of burritos</li>
         <li>View your profile and statistics</li>

example-apps/astro-ssr/src/pages/index.astro

@@ -5,7 +5,7 @@ import PostHogLayout from '../layouts/PostHogLayout.astro';
   <div class="container">
     <div id="logged-in-view" style="display: none;">
       <h1>Welcome back, <span id="welcome-username"></span>!</h1>
-      <p>You are now logged in. Feel free to explore:</p>
+      <p>You are logged in. Feel free to explore:</p>
       <ul>
         <li>Consider the potential of burritos</li>
         <li>View your profile and statistics</li>

example-apps/astro-static/src/pages/index.astro

@@ -5,7 +5,7 @@ import PostHogLayout from '../layouts/PostHogLayout.astro';
   <div class="container">
     <div id="logged-in-view" style="display: none;">
       <h1>Welcome back, <span id="welcome-username"></span>!</h1>
-      <p>You are now logged in. Feel free to explore:</p>
+      <p>You are logged in. Feel free to explore:</p>
       <ul>
         <li>Consider the potential of burritos</li>
         <li>View your profile and statistics</li>

example-apps/astro-view-transitions/src/pages/index.astro

@@ -5,7 +5,7 @@ import PostHogLayout from '../layouts/PostHogLayout.astro';
   <div class="container">
     <div id="logged-in-view" style="display: none;">
       <h1>Welcome back, <span id="welcome-username"></span>!</h1>
-      <p>You are now logged in. Feel free to explore:</p>
+      <p>You are logged in. Feel free to explore:</p>
       <ul>
         <li>Consider the potential of burritos</li>
         <li>View your profile and statistics</li>

example-apps/django/core/apps.py

@@ -28,7 +28,7 @@ def ready(self):
         posthog.api_key = settings.POSTHOG_PROJECT_TOKEN
         posthog.host = settings.POSTHOG_HOST
 
-        # Disable PostHog if configured (useful for testing)
+        # Honor the POSTHOG_DISABLED setting (useful for testing)
         if settings.POSTHOG_DISABLED:
             posthog.disabled = True
 

example-apps/expo/app/index.tsx

@@ -51,7 +51,7 @@ export default function HomeScreen() {
       <ScrollView style={styles.scrollView} contentContainerStyle={styles.scrollContent}>
         <View style={styles.card}>
           <Text style={styles.title}>Welcome back, {user.username}!</Text>
-          <Text style={styles.text}>You are now logged in. Feel free to explore:</Text>
+          <Text style={styles.text}>You are logged in. Feel free to explore:</Text>
 
           <View style={styles.buttonGroup}>
             <TouchableOpacity

example-apps/expo/src/config/posthog.ts

@@ -38,7 +38,7 @@ export const posthog = new PostHog(apiKey || 'placeholder_key', {
   // PostHog API host
   host,
 
-  // Disable PostHog if project token is not configured
+  // Enable PostHog only when a project token is configured
   disabled: !isPostHogConfigured,
 
   // Capture app lifecycle events:

example-apps/laravel/resources/views/livewire/dashboard.blade.php

@@ -25,7 +25,7 @@
                 Capture Error in PostHog
             </button>
             <button wire:click="testErrorWithoutCapture" class="btn" style="background: #c82333; color: white;">
-                Skip PostHog Capture
+                Skip Capture in PostHog
             </button>
         </div>
 

example-apps/laravel/resources/views/livewire/profile.blade.php

@@ -40,7 +40,7 @@
                 Capture Error in PostHog
             </button>
             <button wire:click="testErrorWithoutCapture" class="btn" style="background: #c82333; color: white;">
-                Skip PostHog Capture
+                Skip Capture in PostHog
             </button>
         </div>
 

example-apps/next-app-router/src/app/page.tsx

@@ -31,7 +31,7 @@ export default function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/next-pages-router/src/pages/index.tsx

@@ -40,7 +40,7 @@ export default function Home() {
         {user ? (
           <div className="container">
             <h1>Welcome back, {user.username}!</h1>
-            <p>You are now logged in. Feel free to explore:</p>
+            <p>You are logged in. Feel free to explore:</p>
             <ul>
               <li>Consider the potential of burritos</li>
               <li>View your profile and statistics</li>

example-apps/nuxt-3-6/pages/index.vue

@@ -2,7 +2,7 @@
   <div class="container">
     <template v-if="user">
       <h1>Welcome back, {{ user.username }}!</h1>
-      <p>You are now logged in. Feel free to explore:</p>
+      <p>You are logged in. Feel free to explore:</p>
       <ul>
         <li>Consider the potential of burritos</li>
         <li>View your profile and statistics</li>

example-apps/nuxt-4/app/pages/index.vue

@@ -4,7 +4,7 @@
     <h1 v-else>Welcome to Burrito Consideration App</h1>
 
     <div v-if="user">
-      <p>You are now logged in. Feel free to explore:</p>
+      <p>You are logged in. Feel free to explore:</p>
       <ul>
         <li>Consider the potential of burritos</li>
         <li>View your profile and statistics</li>

example-apps/react-native/src/config/posthog.ts

@@ -27,7 +27,7 @@ export const posthog = new PostHog(apiKey || 'placeholder_key', {
   // PostHog API host (usually 'https://us.i.posthog.com' or 'https://eu.i.posthog.com')
   host,
 
-  // Disable PostHog if project token is not configured
+  // Enable PostHog only when a project token is configured
   disabled: !isPostHogConfigured,
 
   // Capture app lifecycle events:

example-apps/react-native/src/screens/HomeScreen.tsx

@@ -68,7 +68,7 @@ export default function HomeScreen() {
         <View style={styles.card}>
           <Text style={styles.title}>Welcome back, {user.username}!</Text>
           <Text style={styles.text}>
-            You are now logged in. Feel free to explore:
+            You are logged in. Feel free to explore:
           </Text>
 
           <View style={styles.buttonGroup}>

example-apps/react-react-router-6/src/routes/Home.jsx

@@ -30,7 +30,7 @@ export default function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/react-react-router-7-data/app/routes/home.tsx

@@ -24,7 +24,7 @@ export default function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/react-react-router-7-declarative/src/routes/Home.tsx

@@ -24,7 +24,7 @@ export default function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/react-react-router-7-framework/app/routes/home.tsx

@@ -45,7 +45,7 @@ export default function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/react-tanstack-router-code-based/src/main.tsx

@@ -133,7 +133,7 @@ function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/react-tanstack-router-file-based/src/routes/index.tsx

@@ -34,7 +34,7 @@ function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/react-vite/src/pages/Home.jsx

@@ -28,7 +28,7 @@ export default function Home() {
     return (
       <div className="container">
         <h1>Welcome back, {user.username}!</h1>
-        <p>You are now logged in. Feel free to explore:</p>
+        <p>You are logged in. Feel free to explore:</p>
         <ul>
           <li>Consider the potential of burritos</li>
           <li>View your profile and statistics</li>

example-apps/sveltekit/src/routes/+page.svelte

@@ -29,7 +29,7 @@
 <div class="container">
 	{#if auth.user}
 		<h1>Welcome back, {auth.user.username}!</h1>
-		<p>You are now logged in. Check out the navigation to explore features.</p>
+		<p>You are logged in. Check out the navigation to explore features.</p>
 		<ul>
 			<li><a href="/burrito">Consider a burrito</a></li>
 			<li><a href="/profile">View your profile</a></li>

example-apps/swift/BurritoConsiderationClient/DashboardView.swift

@@ -15,7 +15,7 @@ struct DashboardView: View {
                 .font(.largeTitle)
                 .padding(.top, 40)
 
-            Text("You are now logged in. Feel free to explore:")
+            Text("You are logged in. Feel free to explore:")
                 .foregroundStyle(.secondary)
 
             VStack(alignment: .leading, spacing: 12) {

example-apps/tanstack-start/src/routes/index.tsx

@@ -46,7 +46,7 @@ function Home() {
       {user ? (
         <div className="container">
           <h1>Welcome back, {user.username}!</h1>
-          <p>You are now logged in. Feel free to explore:</p>
+          <p>You are logged in. Feel free to explore:</p>
           <ul>
             <li>Consider the potential of burritos</li>
             <li>View your profile and statistics</li>