Authenticated GitHub Issue Creation

Initial Debt

Codex review found that public /api/reports submissions could use the server GITHUB_TOKEN to create GitHub labels and issues after local relevance checks passed.

Why It Matters

Relevance and profanity checks reduce noise, but they are not an abuse boundary. A public deployment could otherwise become an issue-spam proxy for wearedevpunks/harness-intelligence.

Resolution

Report submission originally separated internal persistence from credential-backed actions so public submissions were validated and stored internally. That made dp report return success without a GitHub issue, which broke the maintainer triage contract. The current path validates public submissions, uses deterministic public metadata, creates or dedupes GitHub issues with the API GitHub token, and reserves AI SDK + OpenRouter metadata generation for authenticated backoffice operator sessions.

Validation

• bun run --cwd apps/api test -- reports.test.ts index.test.ts

Closeout

Resolved in PR #24 follow-up after Codex review.