diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md
new file mode 100644
index 0000000..eb3fbba
--- /dev/null
+++ b/workplans/ADHOC-2026-10-11.md
@@ -0,0 +1,64 @@
+---
+id: APPROVAL-WP-ADHOC-2026-10-11
+type: workplan
+title: "Strict execution consume-confirmation client source preparation"
+domain: infotech
+repo: approval-engine
+status: finished
+owner: codex
+created: "2026-10-11"
+updated: "2026-10-11"
+flavor: implementation
+---
+
+# Strict execution consume-confirmation client source preparation
+
+Explicit new demand: review the Secrets/Platform metadata execute-ccr consumer
+contract and prepare the smallest provider client refinement using existing
+approval-engine authenticated consumption/read routes. This bounded reversible
+source preparation creates no new runtime surface or native operation. It does
+not promote or implement APPROVAL-WP-0002's residual adoption obligations.
+
+## Prepare and validate strict direct evidence and independent read confirmation
+
+```task
+id: APPROVAL-WP-ADHOC-2026-10-11-T01
+status: done
+priority: medium
+```
+
+Completed source preparation: approval_engine/execution_confirmation.py adds
+consume_exact and confirm_consumption through existing POST consume and GET
+approval routes. Exact original approval/request/decision/time, native act,
+approval-free PDP digest and explicit declarations are checked; output is filtered
+to non-secret consumption metadata. No server API, identity scope, grant service,
+standing permission, protected callback or journal implementation was added.
+
+INTENT basis: Purpose, What approval-engine Owns, The Claim Shape and Consumption
+Ordering. This remains Engine/PIP factual evidence: the caller independently
+validates the Access decision and retains one-shot execution admission.
+The source-only contract documents terminal consumption, expiry/idempotency
+limits, context/act digest separation and unproved identity/read reachability.
+It is author-qualified technical preparation, not formal delegated owner assent.
+
+Validation: 24 new focused tests and 219 staged full tests passed. Tests prove
+authenticated existing-route read with no extra mutation/outbox event, refusal
+of changed act/digest/decision and malformed declarations/receipts, filtered
+output, denied read, original-decision idempotency after expiry, and terminal
+revoke/supersede behavior. Existing JWT short-test-key warning retained. Patch
+apply-check passed. Source client and test SHA256s are immutable in the staged
+SHA256SUMS. No production HTTP, production DB, OpenBao, credentials or native
+state were accessed.
+
+The actual Platform mediator's approval:read identity, custody and ingress/
+transport admission remain unproved. Production action/package/initiating
+principal admission remains with Access/Identity; Platform owns the execution
+journal and native metadata pilot; Secrets owns dispatch and strict handoff.
+These are existing owner obligations, outside this completed source-preparation
+task. No new residual adoption record is created and none is marked complete.
+Existing APPROVAL-WP-0002-T01/T05, SECRETS-WP-0013, SECRETS-WP-0008-T06 and
+RPF-WP-0035-T02 retain their original statuses and authority boundaries.
+
+Formal review, if requested, must follow persistence of this work record in the
+actual owner checkout. This staged file is the proposed workrecord-before-review
+anchor; it does not establish a persisted anchor or approval by its presence.