diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md
index 430c0b6..68b0de1 100644
--- a/workplans/ADHOC-2026-10-11.md
+++ b/workplans/ADHOC-2026-10-11.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: netkingdom
 created: "2026-10-11"
 updated: "2026-10-11"
+state_hub_workstream_id: "80dff215-079d-5779-9ac0-d20f9d81eb4f"
 ---
 
 ## Review exact provider obligations after native one-app registration
@@ -17,6 +18,7 @@ updated: "2026-10-11"
 id: FLEX-WP-ADHOC-2026-10-11-T01
 status: done
 priority: high
+state_hub_task_id: "df835b25-e470-5d7f-990f-f56530f391a4"
 ```
 
 Read Access/User INTENT, accepted security-layer model v0.8, IAM profile,
@@ -30,3 +32,36 @@ review closes; User Engine retains USER-WP-0026-T03/USER-WP-0028-T02,
 including real human projection and broader journey acceptance.
 `docs/coordination/2026-10-11-user-catalogue-continuation.json` prepares the
 response case with explicit local-only custody; it enables no worker wake.
+
+
+## Characterize exact task-execution PDP and approval binding
+
+```task
+id: FLEX-WP-ADHOC-2026-10-11-T02
+status: done
+priority: high
+```
+
+Read Access AGENTS.md, INTENT.md (Responsibility Boundary: the sole PDP;
+protected systems own enforcement), current open-workplan brief, canonical
+request/enrichment/approval-binding contracts and served secrets-engine v2
+policy/caller-auth source. Read Custodian environment and delegated-owner-review
+canon plus the exact Secrets/Platform execution designs recorded in the stage
+manifest. Prepared a source consumer integration contract and actual Go
+characterization tests against an isolated copy of Access source at
+`c829e530309d4a885a7dbe34ddc316e0c25d205f`.
+
+Validation: `go test ./pkg/api ./internal/policy -run ExecutionContract -count=1`
+passed. Ten semantic mutations change both full and approval-free binding;
+claim removal and registry-enriched/submitted digest joins match the published
+API. The real shipped v2 policy denies execute-ccr/human principals while
+ignoring fake execution context on apply, establishing the required exact action,
+policy-package and verified initiating-principal integration gaps.
+
+This task completes bounded source characterization and review preparation.
+The three prepared source files remain pending application/publication; this
+record does not establish owner assent, a native entitlement, an authenticated
+initiator representation, a mediator/ledger, exact native CCR/grant, or lifecycle
+adoption. No native call, credential request, DB write, commit or source-policy
+activation ran. Existing Secrets T06 and Platform RPF35-T02 remain open.
+Formal own-role review can follow persistence of this completed work record.