docs: check org membership for public API exemption, point agents to sdk-specs

[turnipdabeets]

Problem

Port of PostHog/posthog-js#5079.

#5044 exempted maintainers from the issue-first public API rule by checking whether the git email ends in @posthog.com. That check misfires: not every PostHog employee has that email configured, so a maintainer's agent reviewing a PR paused and asked for an agreed issue (Slack thread). Review bots hit the same rule from the other side and blocked a PR over a missing issue, which was never what the rule was for.

Changes

• AGENTS.md: replace the email check with GitHub org membership. For an existing PR, author_association is MEMBER or OWNER. Before a PR exists, gh api orgs/PostHog/members/<login> succeeds. Outsiders can't see private membership, so a contributor's check fails and they're treated as an external contributor, which is the safe default.
• AGENTS.md: when reviewing or fixing someone else's PR, agents don't ask for or open an issue, but note in the review when an external contributor's PR changes public API without one.
• AGENTS.md: a published spec in PostHog/sdk-specs counts as the agreement, so no issue is needed.
• AGENTS.md: agents check sdk-specs for a spec that covers the behavior they're changing and use it as the contract for that behavior. They don't fix or flag spec discrepancies in code the PR doesn't touch. No spec, nothing to do.
• CONTRIBUTING.md: the exemption now covers PostHog org members, not only Client Libraries, and a published spec means no issue.

Testing

Docs only. Same wording as posthog-js#5079, which was reviewed and approved.

🤖 Generated with Claude Code

[greptile-apps]

The documentation changes appear safe to merge, with no concrete conflicting or incomplete workflow identified.

_{Reviews (1) · Last reviewed commit: "docs: check org membership for public AP..."}

[github-actions]

posthog-ruby-async Compliance Report

Date: 2026-09-23T19:26:46.869286+00:00
Duration: 98679ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

---

Capture Tests

✅ 30/30 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	109ms
Format Validation.Event Has Uuid	✅	106ms
Format Validation.Event Has Lib Properties	✅	109ms
Format Validation.Distinct Id Is String	✅	107ms
Format Validation.Token Is Present	✅	107ms
Format Validation.Custom Properties Preserved	✅	107ms
Format Validation.Event Has Timestamp	✅	107ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	9ms
Retry Behavior.Retries On 503	✅	5411ms
Retry Behavior.Does Not Retry On 400	✅	2111ms
Retry Behavior.Does Not Retry On 401	✅	2109ms
Retry Behavior.Respects Retry After Header	✅	8115ms
Retry Behavior.Implements Backoff	✅	15723ms
Retry Behavior.Retries On 500	✅	5209ms
Retry Behavior.Retries On 502	✅	5213ms
Retry Behavior.Retries On 504	✅	5207ms
Retry Behavior.Max Retries Respected	✅	15622ms
Deduplication.Generates Unique Uuids	✅	112ms
Deduplication.Preserves Uuid On Retry	✅	5212ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10417ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5214ms
Deduplication.No Duplicate Events In Batch	✅	112ms
Deduplication.Different Events Have Different Uuids	✅	108ms
Compression.Sends Gzip When Enabled	✅	107ms
Batch Format.Uses Proper Batch Structure	✅	107ms
Batch Format.Flush With No Events Sends Nothing	✅	4ms
Batch Format.Multiple Events Batched Together	✅	110ms
Error Handling.Does Not Retry On 403	✅	2108ms
Error Handling.Does Not Retry On 413	✅	2109ms
Error Handling.Retries On 408	✅	5208ms

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	108ms
Request Payload.Flags Request Uses V2 Query Param	✅	107ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	108ms
Request Payload.Flags Request Omits Authorization Header	✅	107ms
Request Payload.Token In Flags Body Matches Init	✅	107ms
Request Payload.Groups Round Trip	✅	107ms
Request Payload.Groups Default To Empty Object	✅	107ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	107ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	107ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	108ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	105ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	112ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	108ms
Retry Behavior.Retries Flags On 502	✅	211ms
Retry Behavior.Retries Flags On 504	✅	239ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	109ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']

[github-actions]

posthog-ruby-sync Compliance Report

Date: 2026-09-23T19:27:18.305445+00:00
Duration: 94225ms

⚠️ Some Tests Failed

45/47 tests passed, 2 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	10ms
Format Validation.Event Has Uuid	✅	7ms
Format Validation.Event Has Lib Properties	✅	6ms
Format Validation.Distinct Id Is String	✅	9ms
Format Validation.Token Is Present	✅	6ms
Format Validation.Custom Properties Preserved	✅	7ms
Format Validation.Event Has Timestamp	✅	6ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	6ms
Retry Behavior.Retries On 503	✅	5306ms
Retry Behavior.Does Not Retry On 400	✅	2011ms
Retry Behavior.Does Not Retry On 401	✅	2012ms
Retry Behavior.Respects Retry After Header	✅	8018ms
Retry Behavior.Implements Backoff	✅	15292ms
Retry Behavior.Retries On 500	✅	5149ms
Retry Behavior.Retries On 502	✅	5115ms
Retry Behavior.Retries On 504	✅	5144ms
Retry Behavior.Max Retries Respected	✅	15520ms
Deduplication.Generates Unique Uuids	✅	19ms
Deduplication.Preserves Uuid On Retry	✅	5149ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10350ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5158ms
Deduplication.No Duplicate Events In Batch	✅	23ms
Deduplication.Different Events Have Different Uuids	✅	9ms
Compression.Sends Gzip When Enabled	✅	6ms
Batch Format.Uses Proper Batch Structure	✅	6ms
Batch Format.Flush With No Events Sends Nothing	✅	4ms
Batch Format.Multiple Events Batched Together	❌	18ms
Error Handling.Does Not Retry On 403	✅	2007ms
Error Handling.Does Not Retry On 413	✅	2012ms
Error Handling.Retries On 408	✅	5155ms

Failures

batch_format.multiple_events_batched_together

Expected 1 requests, got 5

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	10ms
Request Payload.Flags Request Uses V2 Query Param	✅	8ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	7ms
Request Payload.Flags Request Omits Authorization Header	✅	6ms
Request Payload.Token In Flags Body Matches Init	✅	7ms
Request Payload.Groups Round Trip	✅	7ms
Request Payload.Groups Default To Empty Object	✅	7ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	7ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	6ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	8ms
Request Lifecycle.No Flags Request On Init Alone	✅	2ms
Request Lifecycle.No Flags Request On Normal Capture	✅	6ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	10ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	7ms
Retry Behavior.Retries Flags On 502	✅	146ms
Retry Behavior.Retries Flags On 504	✅	110ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	8ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']

[dustinbyrne]

Human-driven, agent-assisted review. Reviewed through static inspection and existing CI; no new tests executed.