Spec a GitHub repo connection in reviewable steps

Your Go web app is a code review dashboard with its own login. Users want to connect their GitHub account, so the dashboard can list their repositories and read their pull requests, private ones included. An agent will build the connection in stages.

Write the build spec you would hand the agent: the steps in order, the acceptance checks, and which steps stop for your close review.

What you know:

• Go 1.22, net/http, golang.org/x/oauth2 and Postgres
• the dashboard only reads from GitHub and never writes
• your company's key management service can encrypt and decrypt small secrets
• the dashboard runs on 6 instances behind a load balancer

Then, in a few sentences: what does "let users connect their GitHub account" usually get wrong?