Contract-pinned capability pack for bounded ClickUp Public API operations against https://api.clickup.com only. The primary composition proves v2 work-management calls against ClickUp's official v2 OpenAPI document; the required clickup-v3 companion proves Docs, pages, attachment metadata, and task home-List moves independently against the official v3 document. Reads cover the current user, workspaces, spaces, folders, lists, members, tasks, comments, checklists, tags, custom fields, time entries, goals, Docs, pages, attachments, groups, and webhooks. A read-only, paginated task Source includes visible closed tasks and subtasks so completion fields remain live. Bundled workflows provide a scheduled workspace digest, a read-only task review brief, and an approval-gated task intake. Approval-gated mutations are limited to creating or updating one space, folder, list, task, comment, checklist item, tag, time entry, goal, key result, Doc page, or webhook at a time; retries are explicitly classified, and DELETE operations are destructive/always-confirm. Enroll one ClickUp connection that injects the documented Authorization header using a personal token or OAuth access token; no credential is embedded. The pack excludes OAuth exchange, user and guest invites/removals, ACL/privacy controls, audit logs, arbitrary passthrough, admin/feature configuration, multipart upload bodies, legacy time-tracking endpoints, chat/channel management, bulk imports, and destructive bulk actions.