docs(specs): move GitHub token exchange into the browser

[Wondertan]

Summary

Make GitHub a public-client PKCE profile: the browser Prover performs both notarizations, and the token attestation reveals the complete request, including the intentionally public application credential.

• Remove the confidential GitHub Token Service and its server request/response boundary.
• Require complete canonical five-field form validation by Prover and Platform Verifier; reject hidden request suffixes, extra/duplicate fields, and non-authorization-code grant fields.
• Remove the secret-confidentiality and hidden-body exceptions. GitHub no longer relies on platform-side duplicate-field rejection; X's existing assumption stays intact.
• Preserve both attestations, bearer commitments/openings, ledger notary verification, and the bearer-link circuit/public inputs. No browser signature-verification step is added.
• Permit the browser token/identity work to overlap while requiring complete correlated evidence before proof delivery. Update conformance cases and remove obsolete server-only requirements.

Rationale

GitHub explicitly documents public clients shipping their client secret and recommends PKCE. Hiding that public value in the attestation adds no confidentiality benefit. Full disclosure plus complete form validation removes the opaque request suffix without changing the link-proof statement.

The security discussion records the accepted, unquantified credential-abuse/availability risk; it does not claim that public credentials authenticate the caller or that GitHub guarantees abuse isolation.

Review boundaries

Based on #31 to retain its latest HTTP/JSON framing rules; this PR changes only the GitHub profile, shared assumptions, and their tests. Companion #13 owns the public configuration/CCDP credential plumbing, Bridge endpoint removal, and event/CSP cleanup. Implementation #28 and other implementation repositories follow separately; this is documentation only, with no rollout machinery or draft-version bump.

Rendered documents: GitHub profile, common ceremony rules, protocol overview.

Checks

• Complete three-document spec lint: zero errors; seven pre-existing warnings.
• Local Markdown links and anchors pass; diff whitespace checks pass.
• Remaining IDs are not renumbered. docs(specs): the token request reveals its headers, and the verifier checks them #31's framing rules and the bearer-link public-input rules are unchanged.
• Real browser GitHub Proxy notarization is a qualification requirement, not claimed as tested by this docs-only PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	libid	86de77a	Sep 18 2026, 04:28 PM

[xgreenx]

One clause of REQ-PLAT-61 is trimmed in #43 (stacked here), decided with Green today: the Platform Verifier holds the body's shape and the serializer's alphabet and reads no value it does not use, so the UTF-8 rule on code/redirect_uri and the printable-ASCII rule on client_secret move off the verifier (their comparisons stay with the Prover), and the TEST-PLAT-12 vector for invalid UTF-8 goes. Reason: a value in the alphabet cannot become another field, and no contract reads those three, so the check on chain protected nothing and cost a decoder. libid-contracts#47 is being trimmed to match.