diff --git a/doc/plans/2026-10-13-connection-api-parity.md b/doc/plans/2026-10-13-connection-api-parity.md
index 5a85a1cd98a..5c81cda0b93 100644
--- a/doc/plans/2026-10-13-connection-api-parity.md
+++ b/doc/plans/2026-10-13-connection-api-parity.md
@@ -150,3 +150,5 @@ The implementation was rebased onto `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`.
 
 - A security regression confirmed that delegated setup-secret requests returned the GitHub webhook signing key. Agents now receive a saved human handoff, and the provider service rejects delegated secret generation. Actual key/JWT requests preserve credential refs, while a human session can still rotate them. The regression failed before the fix; all **41 scenarios passed** afterward in a fresh database, and server typecheck passed.
 - CI on implementation `271740cc19` failed a browser shard when run cancellation hit a database lock timeout. Companion `4ad17e94d2` failed the Runner static suite when its real Claude descriptor fixture reported an unverified surviving process group; that exact test passed in an isolated local run. Both failures remain recorded; fresh current-head CI is required after the security fix.
+
+- The OpenAPI setup-secret response now distinguishes the agent credential-entry handoff (200) from human-only secret generation (201). All **27 OpenAPI contract tests passed**, the focused actual-auth GitHub flow passed, and server typecheck passed after this contract update.