Separate issues we fix from issues we file elsewhere

[leggetter]

The task

Triage every open issue on hookdeck/evals into work that belongs here and work
that belongs in another repository. That analysis is done; this PR is the part of
it that touches the repo.

What changed

One block in AGENTS.md, under What to work on next, defining the two labels
that say who fixes a thing, the Owned by: line a product issue carries, and
the two shapes that carry product without one.

What changed outside this PR

The label and issue edits leave no diff, so they are listed here rather than
being invisible:

• finding renamed to product (gh label edit, so it stayed applied to all
  eleven issues). Of those eleven, six had a fix in another repository, three were
  measurements of our own instrument and two are product-subject with the next step
  here.
• Both label descriptions rewritten. product now reads "A fact about
  Hookdeck, its docs or its skills; the fix lands in another repository", and
  harness gained "— work that can be done in this repo". That string is what
  GitHub shows in the label picker, so it is the definition sitting next to this
  one.
• Documentation access differs by agent and by arm, and the search path mostly returns nothing #61, A merged snapshot does not say it is merged, and the page renders one date for it #60 and Confirm the docs-suppression mechanism rather than inferring it #10 moved to harness. Documentation access differing by arm, a
  merged snapshot not saying it is merged, and confirming the docs-suppression
  mechanism are all measurements of our own instrument.
• product added to Hookdeck's webhook notification config cannot be read back, and the natural way to set it returns 200 while doing nothing #43, which had only documentation and scenario.
• An Owned by: line added to Agents wire a placeholder verification secret into a live source, and nothing surfaces it #75, The Outpost skill never says you need a key for an Outpost project #40, The Outpost API answers "Not Found" when your key belongs to a non-Outpost project #39, Outpost docs give the wrong env var name for every operator events setting #32, No signal for when a configuration change is in force #25, The operator events API is undocumented: absent from both OpenAPI definitions and from the docs #34 and Hookdeck's webhook notification config cannot be read back, and the natural way to set it returns 200 while doing nothing #43, naming the
  repository and the title the issue would take there.

Nothing was filed, closed or commented on, here or on any other repository.

Two ownership questions that needed settling

The triage could not name the owner for #39 and #34 from the issues alone. Both
were checked against hookdeck/outpost at origin/main (6d0c391d, fetched
21 September):

• The Outpost API answers "Not Found" when your key belongs to a non-Outpost project #39 is hookdeck/core, not hookdeck/outpost. The observed body is
  {"code":"NOT_FOUND","status":404,"message":"Not Found","data":{"team_id":"tm_..."}}.
  Outpost's ErrorResponse serialises as {"status","message","data"} — Code is
  an int tagged json:"-", so no string code reaches the wire — its not-found
  messages are lowercase and resource-named, and team_id appears nowhere in that
  repository. The 404 is emitted above Outpost, by the layer that resolves a project
  API key.
• The operator events API is undocumented: absent from both OpenAPI definitions and from the docs #34 splits. internal/apirouter/router.go registers no /operator-events/*
  route and internal/opevents/ is emit-only, so the implementation is managed-layer
  and item 3 belongs to hookdeck/core. The definition is still Outpost's:
  docs/apis/openapi.yaml lists https://api.outpost.hookdeck.com/2025-07-01 as its
  first server and already documents the managed-only /config endpoints.

While there: #32 understates itself. Three files on outpost@main carry
OPERATION_EVENTS_* — features/operator-events.mdoc (16),
self-hosting/changelog/upgrade-v0.16.mdoc (9) and upgrade-v1.1.mdoc (2) — and the
upgrade page has moved under changelog/ since the issue was written. Its Owned by:
line records this.

Review findings, and what each one got (d159412)

• Two of the nine product issues carry no Owned by: line (major). Confirmed:
  --label product returned nine, and Why do our skills make the weak model worse? #2 and Does documenting hookdeck ci stop agents giving up on CLI authentication? #27 had no line and no fix elsewhere.
  Fixed in the file rather than on the issues — a new paragraph names both shapes.
  A mapping issue links the change it is waiting to measure, which is what the
  Owned by: line becomes once the issue exists (Does documenting hookdeck ci stop agents giving up on CLI authentication? #27 links the merged
  hookdeck/agent-skills pull request in its first line); an open question about
  our own skills or docs cannot name a repository until it has an answer. Anything
  else with product and no line is drift, and the paragraph says so.
• Hookdeck's webhook notification config cannot be read back, and the natural way to set it returns 200 while doing nothing #43 carries product while its own body says no run produced it (minor).
  Confirmed. "the issue here is the record that the benchmark found it" is gone.
  A new sentence says the label is about where the fix goes, not where the finding
  came from, and uses Hookdeck's webhook notification config cannot be read back, and the natural way to set it returns 200 while doing nothing #43 as the case.
• "three of its eleven" records the action, not the finding (minor). Now: five
  of the eleven were measurements of our own instrument, three moved to harness,
  and the other two are the exception. Also takes the review's wording for Confirm the docs-suppression mechanism rather than inferring it #10 —
  "measurements of our own instrument" rather than "defects".
• The PR body missed the label descriptions (minor). Added above.
• "appear on either side" is not true of the board today (nit). Confirmed —
  only scenario appears on both; all three documentation issues are product
  and both publishing issues are harness-side. Reworded as a statement about what
  the labels mean, not about the current board.

Since the review (4eee3fe)

#2 was closed, which took out one of the two worked examples. It was the open
question about our own skills, and its premise — that skills make the weak model
worse — is not supported by any run since 13 August: recomputed on the three
September runs where both arms ran the same day, the weak model is +4 with
skills, all of it on Outpost. The live half of that question is now #61 and #83.

So the paragraph keeps #27 and describes the other shape without citing an issue,
and the history sentence no longer forward-references it. --label product now
returns eight, and #27 is the only one without a line.

Not changed: the block cites #43 and #34 by number and those sentences dangle
when the issues close. Worked examples are worth the risk here — the Owned by:
rule is hard to follow from an abstract description, and the alternative is the
per-scenario status table this file already warns against. The label description
for product still reads "the fix lands in another repository" with no exception;
a one-line picker string cannot carry the exception, and the file it points at now
does.

Verified

Re-run after 4eee3fe:

pnpm format:check   biome: checked 148 files, no fixes applied; prettier: all matched files
pnpm typecheck      framework + web, clean
pnpm check          20 test files, 227 tests, all passed
pnpm -r build       done

Nothing was already failing. pnpm install needed /opt/homebrew/bin ahead of the
asdf shims on PATH, because the repo has no .tool-versions and the shim has no
pnpm version set — unrelated to this change, and worth knowing before running the
checks locally.

Not done, deliberately

• No new label for mapping issues. Does documenting hookdeck ci stop agents giving up on CLI authentication? #27 is the only one of its kind, and the
  block now describes the shape in prose. Worth revisiting when there is a second.
• No tests. The change is prose in AGENTS.md; nothing here is executable.
• No further issue edits. The review's first finding could have been answered by
  adding Owned by: lines to Why do our skills make the weak model worse? #2 and Does documenting hookdeck ci stop agents giving up on CLI authentication? #27 instead. Neither has an owner elsewhere to
  name, so the line would have been invented; the exception belongs in the file.
• No issues filed on hookdeck/outpost, hookdeck/core or hookdeck/agent-skills.
  Each Owned by: line says what to file and where, and the filing is a human decision.

Could not check

Whether the managed operator-events endpoints live in hookdeck/core or in a private
managed service. The public repo settles that they are not in open-source Outpost; it
cannot say which private repo has them, so #34's second line names hookdeck/core as
the best available answer rather than a verified one.