[CI] (4c70a79) flask/flask3-social-media

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: flask/flask3-social-media
App directory: apps/flask/flask3-social-media
Workbench branch: wizard-ci-4c70a79-flask-flask3-social-media
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:13:16.513Z
Duration: 416.7s

YARA Scanner

✓ 160 tool calls scanned, 0 violations detected

No violations: ✓ 160 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Flask 3 social media application. It adds the Python SDK, initializes a Posthog client instance in create_app(), implements request-scoped context middleware via before_request/teardown_request hooks, captures user actions across auth, API, main routes, and error handlers, and sets person properties on login/registration.

Files changed	Lines added	Lines removed
11	+303	-7

Confidence score: 4/5 👍

• Committed .venv files: Two virtualenv files (.venv/pyvenv.cfg and .venv/include/.../greenlet.h) are committed to the repo — these should be in .gitignore. [MEDIUM]
• Events lack contextual properties: All capture() calls are bare with no properties dict, missing opportunities for enriched analytics (e.g., post length, followed username, message recipient). [MEDIUM]
• PII in set() calls: Email and username are set via posthog_client.set() as person properties, which is the correct approach — no PII in event properties. ✅

---

File changes

Filename	Score	Description
app/__init__.py	4/5	Core PostHog initialization with Posthog() constructor, atexit.register(shutdown), and request context middleware via before_request/teardown_request
app/auth/routes.py	4/5	Captures login, logout, registration, password reset events with proper user identification
app/api/auth.py	4/5	Binds PostHog identity for API auth (basic & token), sets person properties
app/api/tokens.py	4/5	Captures api_token_issued and api_token_revoked events
app/errors/handlers.py	4/5	Manual capture_exception() for 500 errors
app/main/routes.py	3/5	Captures social actions (post, follow, message, etc.) but all events lack properties
config.py	5/5	Adds POSTHOG_PROJECT_TOKEN and POSTHOG_HOST from env vars
requirements.txt	5/5	Adds posthog==7.48.0
.env.example	5/5	Documents both required env vars
.venv/pyvenv.cfg	1/5	Virtualenv config file should not be committed
.venv/.../greenlet.h	1/5	Virtualenv header file should not be committed

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	All imports are valid, posthog SDK pinned at 7.48.0 in requirements.txt
Preserves existing env vars & configs	Yes	Only adds PostHog config; all existing settings preserved
No syntax or type errors	Yes	All Python syntax is correct
Correct imports/exports	Yes	Posthog, identify_context, new_context, set_context_session imported correctly from posthog
Minimal, focused changes	No	Two .venv files committed unnecessarily
Pre-existing issues	None	No pre-existing issues observed

Issues

• Committed .venv files: greenlet.h (164 lines) and pyvenv.cfg are virtualenv artifacts committed to the repo. These should be excluded via .gitignore. [MEDIUM]

Other completed criteria

• Environment variables properly loaded from os.environ via Config class
• atexit.register(posthog_client.shutdown) ensures graceful shutdown
• Existing functionality (auth, posts, messaging) preserved unchanged

---

PostHog implementation ✅

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog==7.48.0 added to requirements.txt
PostHog client initialized	Yes	Posthog() constructor used in create_app() with project token and host from env vars, plus enable_exception_autocapture=True
capture()	Yes	12 meaningful capture calls across auth routes, main routes, API endpoints, and error handlers
identify()	N/A	Server-only app
Error tracking	Yes	enable_exception_autocapture=True on init + manual capture_exception(error) in the 500 error handler
Reverse proxy	N/A	Server-only app

Issues

No critical or medium PostHog implementation issues.

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable via Flask config
• Host configured from POSTHOG_HOST environment variable
• Request context middleware correctly wraps each request with new_context(fresh=True), identifies authenticated users, and reads X-POSTHOG-DISTINCT-ID / X-POSTHOG-SESSION-ID headers
• atexit.register(posthog_client.shutdown) ensures events are flushed on exit
• Graceful handling when PostHog is not configured (all calls guarded with if posthog_client)
• Person properties set via posthog_client.set() with distinct_id, email, and username on login and registration

---

PostHog insights and events ✅

Filename	PostHog events	Description
app/auth/routes.py	user_logged_in, user_logged_out, user_registered, password_reset_requested, password_reset_completed	Full auth lifecycle tracking with user identification on login/register
app/main/routes.py	post_created, profile_updated, user_followed, user_unfollowed, message_sent, post_export_requested	Core social media actions tracked
app/api/tokens.py	api_token_issued, api_token_revoked	API token lifecycle events
app/errors/handlers.py	capturedException	500 errors captured via capture_exception()

Issues

• Events lack contextual properties: All capture() calls are bare — e.g., post_created could include post_language, user_followed could include followed_username, message_sent could include recipient_id. This limits the ability to build meaningful breakdowns and funnels. [MEDIUM]

Other completed criteria

• Events represent real user actions mapping to actual product flows (auth, content creation, social interactions)
• Event set enables multiple funnels: registration → login → post_created, user_followed → message_sent
• Event naming is consistent snake_case with descriptive [noun]_[verb] pattern
• No PII in event properties — email/username properly set via posthog_client.set() on person profiles

---

Reviewed by wizard workbench PR evaluator