[wizard-ci-bot]

Automated wizard CI run

Source: scheduled
Trigger ID: cc5471b
App: swift/hackers-ios
App directory: apps/swift/hackers-ios
Workbench branch: wizard-ci-cc5471b-swift-hackers-ios
Wizard branch: main
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-10-28T17:09:37.185Z
Duration: 523.0s

YARA Scanner

✓ 166 tool calls scanned, 0 violations detected

No violations: ✓ 166 clean scans

[wizard-ci-bot]

No identify() or reset() calls anywhere in the app. Now let me produce the review.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Swift iOS Hacker News reader app. It adds the PostHog iOS SDK via SPM, initializes it in AppDelegate, captures four custom events (login, logout, bookmark changes, onboarding dismissed), configures error tracking with auto-capture, and sets up structured logging. However, it completely omits identify() and reset() calls, meaning all events remain anonymous and unlinked to users.

Files changed	Lines added	Lines removed
6	+107	-22

Confidence score: 5/5 🧙

• Missing identify() call after login: The authenticate function successfully logs the user in but never calls PostHogSDK.shared.identify() with the user's distinct ID. All events remain anonymous, defeating the purpose of user-level analytics. [CRITICAL]
• Missing reset() call on logout: The logout function never calls PostHogSDK.shared.reset(), so if another user logs in on the same device, their events will be attributed to the previous user's anonymous session. [CRITICAL]
• Events lack properties: All capture() calls are bare with no properties — e.g., login_succeeded has no login method, bookmark_added has no story ID. This limits the analytical value of the events. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	4/5	Documents POSTHOG_PROJECT_TOKEN and POSTHOG_HOST env vars
AppDelegate.swift	4/5	PostHog initialization with error tracking auto-capture and structured logging; good guard checks for missing config
ContentView.swift	2/5	Captures 4 events but missing identify/reset; events lack properties; good refactor of duplicated closures
Hackers-Info.plist	4/5	Correctly adds build-setting-backed keys for PostHog config
project.pbxproj	4/5	Proper SPM dependency with all three required objects (PBXBuildFile, XCSwiftPackageProductDependency, XCRemoteSwiftPackageReference)
Package.resolved	5/5	Lock file correctly updated to posthog-ios 3.92.7

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Valid Swift, correct SPM setup, imports resolve
Preserves existing env vars & configs	Yes	Existing code preserved; duplicated closures refactored cleanly
No syntax or type errors	Yes	All Swift syntax is valid
Correct imports/exports	Yes	import PostHog in the correct files
Minimal, focused changes	Yes	Refactoring of duplicate closures into named functions is justified by the need to add PostHog calls in those paths
Pre-existing issues	None	—

Issues

• No issues detected in app sanity.

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid with proper SPM package reference
• Info.plist correctly wires build settings to Bundle keys

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-ios 3.92.7 added via SPM
PostHog client initialized	Yes	PostHogConfig(projectToken:host:) + PostHogSDK.shared.setup(config) in AppDelegate.didFinishLaunchingWithOptions — correct pattern
capture()	Yes	4 custom events: login_succeeded, logout_requested, bookmark_added/bookmark_removed, onboarding_dismissed
identify()	No	No PostHogSDK.shared.identify() call anywhere — the authenticate function captures an event but never identifies the user
Error tracking	Yes	config.errorTrackingConfig.autoCapture = true — correct SDK pattern
Reverse proxy	N/A	Native iOS app, not browser-based posthog-js

Issues

• Missing identify() after login: The authenticate function calls sessionService.authenticate() and captures login_succeeded, but never calls PostHogSDK.shared.identify() with the user's distinct ID. Per the docs, identify should be called "as soon as you're able to" — typically right after login. Without it, all events remain anonymous and cannot be linked to specific users. Fix: Add PostHogSDK.shared.identify(username, userProperties: ["name": username]) after successful authentication. [CRITICAL]
• Missing reset() on logout: The logout function calls sessionService.unauthenticate() but never calls PostHogSDK.shared.reset(). Per the docs, "We strongly recommend you call reset on logout even if you don't expect users to share a device." Fix: Add PostHogSDK.shared.reset() in the logout() function. [CRITICAL]

Other completed criteria

• API key loaded from Info.plist backed by build settings — valid iOS pattern (project token is a public client-side key safe to ship in binary)
• Host correctly configured to https://us.i.posthog.com
• Structured logging configured with service name and environment
• Guard checks gracefully handle missing configuration in release builds
• Screen views captured by default (captureScreenViews defaults to true)

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
AppDelegate.swift	Error auto-capture, structured logs	Error tracking with auto-capture enabled; logs configured with service name and environment
ContentView.swift	login_succeeded, logout_requested, bookmark_added, bookmark_removed, onboarding_dismissed	Core user flow events but all lack properties; bookmark events could include story metadata

Issues

• Events lack enriched properties: All 5 capture() calls are bare with no properties dict. login_succeeded should include login method, bookmark_added/bookmark_removed should include story ID or title, onboarding_dismissed could include step reached. Without properties, funnels and breakdowns are limited. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, logout, bookmark, onboarding)
• Events enable basic product insights (login/logout funnel, bookmark usage trends)
• No PII placed in event properties
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator