Roll out proxy pipe fix as v0.1.1.

Bump version so uv tool install picks up be3b4a2 without a manual cache
clean. Document workstation upgrade steps in ADHOC-2026-07-07.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ops-warden"
-version = "0.1.0"
+version = "0.1.1"
 description = "SSH CA and certificate lifecycle manager for ops actors"
 requires-python = ">=3.11"
 dependencies = [

workplans/ADHOC-2026-07-07.md

@@ -0,0 +1,48 @@
+---
+id: ADHOC-2026-07-07
+type: workplan
+title: "Ad Hoc Tasks — 2026-07-07"
+domain: infotech
+repo: ops-warden
+status: finished
+owner: grok
+topic_slug: custodian
+created: "2026-07-07"
+updated: "2026-07-07"
+---
+
+# Ad Hoc Tasks — 2026-07-07
+
+### T01 — Roll out proxy pipe fix (be3b4a2)
+
+```task
+id: ADHOC-2026-07-07-T01
+status: done
+priority: high
+```
+
+`warden access` failed on `reuse-surface-hub-write-token` because `shlex.split`
+treated `kubectl … | base64 -d` as literal argv. Fixed in `be3b4a2`; rollout
+requires refreshing the installed CLI (cached `0.1.0` wheel does not pick up
+source changes).
+
+- [x] Code fix merged and pushed (`be3b4a2`)
+- [x] Version bumped `0.1.0` → `0.1.1` so `uv tool install` invalidates stale wheels
+- [x] Workstation rollout: `git pull && make install-all` (after cache clean if needed)
+- [x] Smoke: `warden access reuse-surface-hub-write-token --no-policy --fetch` — no
+      `unknown shorthand flag: 'd'`; token fetched via shell pipeline
+
+**Operator upgrade on any machine using `warden access`:**
+
+```bash
+cd ~/ops-warden && git pull --ff-only
+make install-all
+warden route show reuse-surface-hub-write-token --json
+```
+
+If `warden` still lacks `ResolvedFetch` / pipe handling after install:
+
+```bash
+uv cache clean ops-warden
+uv tool install . --with-editable ../phase-memory --reinstall --force
+```