One-install Basecamp front door over four bounded domain packs and ten operating workflows. It admits all 200 JSON or bodyless routes from the 203-operation commit-pinned official contract. The three explicit exclusions are binary account-logo, attachment, and Campfire-upload bodies, which the current static JSON REST composition cannot serialize; their metadata, document, upload-record, and text-chat companions remain available. Basecamp documents int64 identifiers beyond JavaScript's safe-number range, so every JSON response preserves unsafe integer literals as exact decimal strings and int64 request identifiers travel from string-shaped inputs to exact JSON integer literals. A documentary read-only Todo Source walks active Todo recording references through safe RFC Link pagination and hydrates every row with a fresh flat Todo read before projection. Enroll Basecamp OAuth at launchpad.37signals.com, select the bc3 account returned by authorization, and store its numeric id in connection config as account_id for Source sync; workflows request the same account id explicitly. The connection owns bearer credentials and every call sends an identifying Recued User-Agent. Reads are uncached; every read except Source operations and bounded search/category metadata discovery is marked sensitive-read and requires approval unless session-granted. The remaining reads are unheld. Every mutation is grant-off and approval-gated. Two chat workflows use unmarked metadata reads only; project, Campfire, content, and activity reviews plus all writes are non-chat.