Initial Situation

dp report created GitHub issues directly from the CLI through local gh auth token, GH_TOKEN, or GITHUB_TOKEN. That meant reporters needed direct write permission to wearedevpunks/harness-intelligence.

Issue

Issue #23 asks for report issue creation to happen server-side so the reporter only needs access to the Harness API. The API also needs room for creator/operator context and duplicate detection.

Plan

1. Stop importing or calling the CLI-side GitHub issue client from dp report.
2. Submit the raw report draft through the existing typed control-plane client to /api/reports.
3. Have the API reject trolling, profanity, non-coding, and non-project reports before creating an issue.
4. Have the API scan open harness-report issues and return the existing URL when a duplicate is found.
5. Create GitHub issues server-side with the API GitHub token after validating public submissions, and preserve the hidden harness-report.v1 marker for backoffice parsing.
6. Preserve operator and observed repository context in the marker and persisted report payload.
7. Update operator docs and runbook language so they no longer require local GitHub auth for dp report.

Result

Resolved. /api/reports now owns report validation, deterministic public metadata, duplicate checks, persistence, and server-side GitHub issue creation. Authenticated backoffice operator requests can additionally use AI metadata generation. The CLI submits typed report context and requires the API response to include a GitHub issue URL.