Migrate 'PostHog SDK defaults' agent guidance from wizard commandment to shared skill doc

[sarahxsanders]

Why

The wizard currently carries an agent commandment in src/lib/agent/commandments.ts telling the agent not to disable PostHog data-capture defaults (autocapture, session_recording, opt_out_capturing in init config). That's product-specific guidance baked into wizard infrastructure — the wizard's design rule says product knowledge lives in skills.

This is distinct from #173 (which tracks the L2 scanner rules). This issue is about the L0 agent guidance — the textual rule the agent reads before it writes anything.

What needs to happen

1. Add a shared doc (working name: libraries/js/defaults.md or similar) covering:
   • autocapture: false — only legitimate with explicit user opt-in
   • disable_session_recording: true / disableSessionRecording: true — same
   • opt_out_capturing: true / opted_out: true in init config — disallowed
   • Legitimate runtime form posthog.opt_out_capturing() for GDPR consent — clearly OK
2. Have the skills that touch init config (posthog-integration, pii-bouncer, possibly others) pull it via shared_docs
3. Once the skill-side guidance is live, remove the commandment from the wizard's commandments.ts

Related

• wizard PR (the warlock migration) restored this commandment as a transitional L0 fix
• Add skill for PostHog config defaults (autocapture / session recording / opt-out) #173 — L2 scanner skill
• Add wizard-owned L2 ruleset for PostHog config defaults (autocapture / session recording / opt-out) wizard#592 — wizard-owned L2 ruleset

🤖 Generated with Claude Code

[ryanwaits]

so i had a look at this while working on the wizard side and have a few things im trying to line up with the code:

shared_docs can't host a local doc. i pulled every shared_docs value out of the skill configs and they're all remote posthog.com urls; processDoc just does await fetch(url) (skill-generator.js:660). so a libraries/js/defaults.md living here wouldn't resolve. local references/ dirs do get copied in (skill-generator.js:601), they're just per-skill-group.

pii-bouncer doesn't exist here. grepped the whole repo, no match. was this renamed or on a branch somewhere?

commandments.yaml already does half of this. commandments.yaml:47 already says autocapture is on by default and not to disable it unless asked. and its missing session recording, opt_out_capturing / opted_out in init, and the runtime carve-out.

the potential issue is step 3, removing the wizard commandment. that one is global, these are tag-scoped, and no tag is universal. i counted: javascript is on 52 of 159 tag declarations. so pulling it would quietly drop this rule for python, go, swift, ruby and the rest.

i think the cleanest fix looks like a global: key plus a few lines in collectCommandments.

skip-patterns.yaml already uses exactly that shape, a global: block merged with per-item overrides. happy to PR that with tests if that feels aligned.

either way i'd keep the wizard-side removal as a separate follow up, since the repos ship independently and doing both at once leaves a window with no rule at all.