Document the human webhook-secret setup boundary

Record actual agent-key and JWT handoff evidence, human rotation compatibility, and retained CI failures.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/plans/2026-10-13-connection-api-parity.md

@@ -35,6 +35,8 @@ Agent setup responses retain their browser fields and add `requiredUserAction` w
 
 Generic app OAuth returns the saved setup destination without creating agent-bound provider state; the human browser starts the existing session-bound authorization flow. Its `expiresAt` is null until that human step creates an expiring provider session. Slack/GitHub provider callbacks preserve human subject and state checks. Agent-created GitHub setup binds its browser session when the addressed human opens it. Identity callbacks validate the current human and session before consuming state, and revalidate authority before saving identity. Wrong-user callbacks leave the rightful user's flow intact. Continuation rechecks task state and current authority after a yielding run; cancelled tasks and revoked access cannot be revived by a late provider result.
 
+GitHub webhook signing-secret rotation is a human credential step. Agents receive the saved endpoint handoff without rotating or reading the secret; direct delegated service generation is rejected. Human sessions retain the existing rotation and vault persistence path.
+
 Agent-issued durable gateway clients store `responsible_user_id` alongside `created_by_agent_id`. Token use reevaluates issuer/user authority, gateway/profile scope, target constraints, credential access and action restrictions. The responsible-user marker remains after deletion clears the issuer foreign key, so an orphaned delegated token fails closed instead of becoming a system client. It does not inherit the lifetime of the setup run. Heartbeat tokens remain bound to their authenticated run. Legacy agent-issued clients without a responsible user fail closed; existing board-issued clients retain their behavior. Migration `0378_slim_nehzno.sql` is additive and does not infer legacy identity or modify agent grants.
 
 ## Discovery and guidance
@@ -145,3 +147,6 @@ The implementation was rebased onto `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`.
 - A subsequent profile review found that saved application/catalog selectors did not resolve their underlying connections. Authorization now covers every supported selector, the application scope used by new-tool review, empty managed installation profiles, proposed broad entries, and effective-profile tools/installations. The new actual-key/JWT regression failed before the fix and also exposed the empty managed-profile label; the corrected shared evaluator protects both. All **40 assembled-server scenarios passed** afterward in a fresh database, and server typecheck/module boundaries passed. Host-template map entries now explicitly name their board-user and `tools:admin` requirements; MCP import preview retains its separate board/company boundary.
 
 - Effective-profile projection now authorizes each distinct returned connection once across tools and installations. The new 200-tool regression measured **201 checks before the fix and one afterward**, preserving all returned tools and privacy denials. The complete assembled-server suite then passed **41 scenarios** in a fresh database. AI pool writes explicitly document both management grants; AI setup and profile mutation entries document their conditional grants.
+
+- A security regression confirmed that delegated setup-secret requests returned the GitHub webhook signing key. Agents now receive a saved human handoff, and the provider service rejects delegated secret generation. Actual key/JWT requests preserve credential refs, while a human session can still rotate them. The regression failed before the fix; all **41 scenarios passed** afterward in a fresh database, and server typecheck passed.
+- CI on implementation `271740cc19` failed a browser shard when run cancellation hit a database lock timeout. Companion `4ad17e94d2` failed the Runner static suite when its real Claude descriptor fixture reported an unverified surviving process group; that exact test passed in an isolated local run. Both failures remain recorded; fresh current-head CI is required after the security fix.

maps/agent-access-map/chat-channels.md

@@ -274,11 +274,11 @@ Gaps: Provider fixtures do not qualify live provider setup or availability.
 ### `post-chat-endpoints-setup-secret`
 
 API: `present` — `POST /api/chat-endpoints/{endpointId}/setup-secret`; JSON REST.
-Agent access: `available` — agent REST and default native `search_api` / `call_api`.
-Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
-Evidence: `source-only` — [route](../../server/src/routes/chat-channels.ts); reviewed in the working tree based on the source commit above.
-Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
-Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
+Agent access: `available` — agent REST and default native `search_api` / `call_api` return the saved endpoint's `requiredUserAction` handoff. Only a human session can rotate and receive the signing secret.
+Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Agents cannot generate or export the GitHub webhook signing secret; the service also rejects delegated generation.
+Evidence: `verified` — [route](../../server/src/routes/chat-channels.ts), [provider service](../../server/src/services/chat-channels/github/setup-secret.ts), and [authenticated regression](../../server/src/__tests__/connection-management.integration.test.ts). Actual key/JWT requests return a handoff without changing credential refs; a human session can rotate and persist new refs.
+Verification: `passed` — deterministic provider fixtures / local assembled server. The regression failed before the fix; all 41 assembled-server scenarios passed afterward.
+Gaps: No live GitHub rotation qualification; plaintext signing-secret setup intentionally remains a human step.
 
 ### `get-chat-endpoints-resources`