[Frontier] [GIT15-04] Connect GitHub repositories from the Web UI on a fresh install

Parent

S15 — #316. Canonical spec: docs/specs/S15-conversational-autonomy.md (S15-D15, S15-D16, S15-D17, S15-AC02, S15-AC10, S15-AC15).

Model tier

Frontier: credential custody (write-only token), repository scope binding and the product-default versus personal GitHub publication distinction; owner UI authored by Claude Opus 5.5 at effort high.

Gap found (verified on main 7f06716)

S15RuntimeConfig.github (GithubRuntimeConfig: repositories, credential refs, disclosure recipient) can only be set by editing the config file; the installer writes github: null, and the credential can only be stored with the terminal command bun src/main.ts credential --s15 --key <ref> --secret-stdin. The owner's primary acceptance scenario (GitHub issue readiness → selected issue → babysit to merge) is therefore unreachable on a fresh install without a terminal and a config edit.

Deliverable

In the Web UI the owner pastes a fine-grained GitHub token once (write-only, stored in ConnectionVault, fingerprint-registered, never echoed), Jit verifies it and lists the repositories the token can access, and the owner selects the repositories Jit may work on. The selection is stored in the protected S15 journal (revisioned), becomes resources in the catalog and the default policy proposal (POLICY15-02), and composes the GitHub runtime without a config edit or restart. Product-default publication stays held; the personal GitHub exception remains the existing separate capture/install flow.

Implementation steps

1. Protected GitHub connection store: token in the vault under a stable key; repository selection with revisions; removal stops new work and leaves history.
2. Verification: call GitHub with the token to read its identity and accessible repositories (bounded, no write), and the branch protection facts the existing personal-rule capture needs; show token expiry if GitHub reports it.
3. Runtime composition: build the GitHub runtime from the protected store when the config has no explicit github; keep the explicit config path working. The disclosure recipient for GitHub is registered as a protected recipient ref tied to the connection.
4. UI (Claude Opus 5.5, effort high): Resources → GitHub: connect (token field, permissions checklist matching the owner steps), repository picker, status/expiry, remove; links to the personal-rule page; th and en keys.
5. Docs: GitHub runbook, docs/runbooks/s15-install.md owner steps (replace the terminal credential command).

Acceptance criteria

• With only the Web UI, the owner connects a token, selects chayapats/jit-s15-sandbox, and Jit can report issue readiness for it after the standing policy is installed.
• The token never appears in config, logs, exports, prompts, the guest or HTML; removal revokes future use.
• Repositories outside the selection are refused; publication follows the product default unless the separate personal rule is installed.
• UI authored by Claude Opus 5.5 at effort high; th and en keys.

Tests and evidence

1. HTTP fixtures for GitHub identity/repository listing; token never echoed in HTML/logs (fingerprint check).
2. Selection → catalog resources and composed runtime; unselected repository refused.
3. Removal → new GitHub work refused; history intact.
4. Web rendering tests (th/en).
5. Live (owner step on [Frontier] [EVID15-01] Prove the protected boundaries and the GitHub scenario on the tested build #340/[Frontier] [CUT15-01] Install S15 fresh on jit-vm with owner acceptance and a recoverable install #341): the owner's sandbox token on jit-vm.

Requirements

FR-06/08/09/14/15/18/21/29/35/37; NFR-05/07/10/14. Acceptance: S15-AC02, S15-AC10, S15-AC15.

Blocked by

None for implementation; bundle with POLICY15-02 in one PR after PRs #382 and #383 merge.

Do not

Do not store the token anywhere but the vault; do not request broader GitHub scopes than the owner steps list; do not auto-install a personal GitHub exception; do not run Jit's full suite locally (CI runs it); do not add AI attribution; do not merge the PR yourself.

Definition of done

Locally: typecheck, git diff --check, focused github/web/composition tests. CI runs the full suite. PR body includes Closes #385.