diff --git a/pyproject.toml b/pyproject.toml
index 3ca400f..bc62158 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ops-warden"
-version = "0.1.0"
+version = "0.1.1"
 description = "SSH CA and certificate lifecycle manager for ops actors"
 requires-python = ">=3.11"
 dependencies = [
diff --git a/workplans/ADHOC-2026-07-07.md b/workplans/ADHOC-2026-07-07.md
new file mode 100644
index 0000000..0fc007d
--- /dev/null
+++ b/workplans/ADHOC-2026-07-07.md
@@ -0,0 +1,48 @@
+---
+id: ADHOC-2026-07-07
+type: workplan
+title: "Ad Hoc Tasks — 2026-07-07"
+domain: infotech
+repo: ops-warden
+status: finished
+owner: grok
+topic_slug: custodian
+created: "2026-07-07"
+updated: "2026-07-07"
+---
+
+# Ad Hoc Tasks — 2026-07-07
+
+### T01 — Roll out proxy pipe fix (be3b4a2)
+
+```task
+id: ADHOC-2026-07-07-T01
+status: done
+priority: high
+```
+
+`warden access` failed on `reuse-surface-hub-write-token` because `shlex.split`
+treated `kubectl … | base64 -d` as literal argv. Fixed in `be3b4a2`; rollout
+requires refreshing the installed CLI (cached `0.1.0` wheel does not pick up
+source changes).
+
+- [x] Code fix merged and pushed (`be3b4a2`)
+- [x] Version bumped `0.1.0` → `0.1.1` so `uv tool install` invalidates stale wheels
+- [x] Workstation rollout: `git pull && make install-all` (after cache clean if needed)
+- [x] Smoke: `warden access reuse-surface-hub-write-token --no-policy --fetch` — no
+      `unknown shorthand flag: 'd'`; token fetched via shell pipeline
+
+**Operator upgrade on any machine using `warden access`:**
+
+```bash
+cd ~/ops-warden && git pull --ff-only
+make install-all
+warden route show reuse-surface-hub-write-token --json
+```
+
+If `warden` still lacks `ResolvedFetch` / pipe handling after install:
+
+```bash
+uv cache clean ops-warden
+uv tool install . --with-editable ../phase-memory --reinstall --force
+```
\ No newline at end of file