diff --git a/docs/task-plane/openapi.yaml b/docs/task-plane/openapi.yaml
index 9f76cc1..341bb54 100644
--- a/docs/task-plane/openapi.yaml
+++ b/docs/task-plane/openapi.yaml
@@ -16,6 +16,7 @@ paths:
         "200":
           description: Task list
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Create task
       parameters:
         - in: header
@@ -34,8 +35,12 @@ paths:
       responses:
         "201": { description: Created }
         "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Forbidden }
         "409": { description: Conflict }
         "413": { description: Payload too large }
+        "423": { description: Execution or resource locked }
+        "503": { description: Authentication or service unavailable }
   /tasks/{task_id}:
     get:
       summary: Get task
@@ -46,6 +51,7 @@ paths:
         "404": { description: Not found }
   /tasks/{task_id}/claim:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Claim a task
       parameters:
         - $ref: "#/components/parameters/TaskId"
@@ -64,53 +70,122 @@ paths:
         "423": { description: Execution disabled }
   /tasks/{task_id}/heartbeat:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Renew task claim lease
       parameters: [ $ref: "#/components/parameters/TaskId" ]
       responses:
         "200": { description: Leased }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Forbidden }
+        "404": { description: Task or claim not found }
+        "409": { description: Claim conflict }
+        "413": { description: Payload too large }
+        "423": { description: Lease or execution locked }
+        "503": { description: Service unavailable }
   /tasks/{task_id}/progress:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Report task progress
       parameters: [ $ref: "#/components/parameters/TaskId" ]
       responses:
         "200": { description: Progress saved }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Forbidden }
+        "404": { description: Task or claim not found }
+        "409": { description: Claim conflict }
+        "413": { description: Payload too large }
+        "423": { description: Lease or execution locked }
+        "503": { description: Service unavailable }
   /tasks/{task_id}/result:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Submit task result
       parameters: [ $ref: "#/components/parameters/TaskId" ]
       responses:
         "200": { description: Result accepted }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Result policy rejected }
+        "404": { description: Task or claim not found }
+        "409": { description: Duplicate or mismatched result }
+        "413": { description: Payload too large }
+        "423": { description: Lease or execution locked }
+        "503": { description: Verification service unavailable }
   /tasks/{task_id}/fail:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Mark task failed
       parameters: [ $ref: "#/components/parameters/TaskId" ]
       responses:
         "200": { description: Failure recorded }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Forbidden }
+        "404": { description: Task or claim not found }
+        "409": { description: Claim conflict }
+        "413": { description: Payload too large }
+        "423": { description: Lease or execution locked }
+        "503": { description: Service unavailable }
   /tasks/{task_id}/cancel:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Cancel task
       parameters: [ $ref: "#/components/parameters/TaskId" ]
       responses:
         "200": { description: Cancelled }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Forbidden }
+        "404": { description: Task not found }
+        "409": { description: Revision or state conflict }
+        "413": { description: Payload too large }
+        "423": { description: Resource locked }
+        "503": { description: Service unavailable }
   /tasks/{task_id}/delegate:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Delegate task
       parameters: [ $ref: "#/components/parameters/TaskId" ]
       responses:
         "200": { description: Delegated }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
         "403": { description: Forbidden }
+        "404": { description: Parent task not found }
         "409": { description: Conflict }
+        "413": { description: Payload too large }
+        "423": { description: Execution locked }
+        "503": { description: Service unavailable }
   /workers/register:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Register worker
       responses:
         "201": { description: Worker registered }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Worker identity mismatch }
+        "409": { description: Registration conflict }
+        "413": { description: Payload too large }
+        "423": { description: Resource locked }
+        "503": { description: Service unavailable }
   /workers/{worker_id}/heartbeat:
     post:
+      security: [ { bearerAuth: [] } ]
       summary: Worker heartbeat
       parameters: [ $ref: "#/components/parameters/WorkerId" ]
       responses:
         "200": { description: Heartbeat accepted }
+        "400": { description: Bad request }
+        "401": { description: Unauthorized }
+        "403": { description: Forbidden }
+        "404": { description: Worker not found }
+        "409": { description: Worker state conflict }
+        "413": { description: Payload too large }
+        "423": { description: Worker locked }
+        "503": { description: Service unavailable }
   /workers:
     get:
       summary: List workers