Move work between Discord and the trackers

[woksin]

Summary

Prompter now moves work between Discord and the Cratis issue trackers, in both directions.

Added

• /issue turns a Discord conversation into a GitHub issue on the owning repository — bugs, missing APIs, feature requests, ideas, documentation gaps — drafted by Prompter and filed only after you confirm an ephemeral preview (P-45).
• Newly-opened issues get a grounded answer with citations on repositories that opt in, and silence when the documentation cannot answer them (P-44).
• New issues are announced in a maintainer channel with whether the documentation already answers them (P-46).

[woksin]

Reviewer context — none of this belongs in the release notes.

Scope correction. These were planned here as a documentation feature growing out of the docs-gap flywheel. That was too narrow: the intent covers bugs, missing APIs, feature requests and ideas as much as docs. D-16 records the corrected scope — Prompter moves work between the community and the trackers, and answering is only half its job.

Guardrails, since this is the first thing Prompter does that is visible outside Discord.

• Filing is always a deliberate act: a slash command, a drafted preview, a button. Never inferred from message content. The preview is ephemeral, so an abandoned draft leaves nothing in the channel either.
• Nothing is persisted. Drafts live in memory for 15 minutes and are taken on click (a double-click cannot file twice). D-13's "no message content, nothing identifying" is untouched, and no Discord username is written into a public tracker — the thread link is the follow-up mechanism.
• Answering is opt-in per repository and silent on refusal. An ungrounded comment on someone's bug report costs more attention than it saves; the maintainer channel is told instead, and "nothing in the docs covers this" is the more useful signal anyway.
• Webhook deliveries are verified by HMAC over the raw body, constant-time, with an unset secret refusing everything — the same posture /reindex takes.
• Every capability is off until its credential exists, so deployments that set nothing are unaffected.

Anyone may file, per D-16: at this community's size an approval step costs more in missed reports than it saves in noise. Duplicate hints, the shared rate limit and the from-discord label carry that load; maintainer-approval is a config flag if that ever changes.

Q-7 is answered — issues go to the owning product repository. That makes the product classifier (P-30) a dependency rather than a nice-to-have; today the model names the product and the preview says so explicitly when it could not tell, rather than filing into the fallback quietly.

Not built, deliberately. P-47 (handing mechanical issues to a coding agent) — Prompter files issues, GitHub's own agents act on them, behind a human-applied label, draft PRs only, opt-in repositories. It needs its own decision record first. The message context-menu entry point ("File as issue" on an existing message) also waits: NetCord's message-command context was not compile-verifiable against beta.12 in this pass.

PAT or GitHub App? The playbook starts with a fine-grained PAT because it is one secret and no setup. Worth knowing what it costs: issues show the token owner's name as author, it expires, and it shares that person's rate limit. An App gives Prompter its own identity and no expiry for about an hour of setup. The code sends either as a bearer token, so switching is changing one secret.

Verification. dotnet build -c Release 0 warnings, dotnet test -c Release 389 specs green (up from 278; 111 new covering routing, composition, draft parsing, webhook signatures, event decisions, buttons, preview, notification and draft expiry). Documentation lints clean; all links and anchors resolve. Live verification needs the deployed bot and a repository webhook — playbook Stage C.

One spec caught a real bug while writing it: draft eviction ordered by timestamp ties when several drafts are held in the same clock tick, so "drop the oldest" dropped an arbitrary one. It orders by insertion sequence now.