One-install Confluent Cloud front door over 11 bounded capability packs and 89 non-chat, uncached, read-only workflows. It reconciles all 497 official operations across 293 paths into 489 current callable capabilities, seven exact provider-deprecated exclusions, and one exact binary-upload transport exclusion. Control-plane identity, networking, clusters, quotas, connectors, artifacts, notifications, sharing, billing, Tableflow, RTCE, Kafka, Schema Registry, Data Catalog, Flink SQL, Partner APIs, and STS are covered. The mutable official OpenAPI URL must retain 2,653,460 bytes and SHA-256 0803fa3bd07e311d202b878cda9cb02e5ac9cab414a02cbe22910ab67e492e95 before regeneration. Seven separate connection profiles preserve Confluent's Cloud-key, resource-key, partner-bearer, no-auth STS, and dynamic Kafka, Schema Registry, and Flink endpoint boundaries. Seventy-one opaque-token collections paginate automatically without inventing provider page-size limits; page_size is withheld because Confluent says it is first-request-only and dynamically bounded. Two image downloads become private file_refs. Nine exporter responses that advertise only vendor +json remain explicit text. All 164 JSON bodies are required and sent verbatim; STS form fields are structured with fixed RFC 8693 constants. Parameter arrays use an explicit Recued 256-item safety ceiling without claiming a vendor maximum. Reads are uncached and not approval-gated, every mutation requires approval, unsafe integers remain exact strings, and no task, note, or user-work project Source is invented for infrastructure or streaming resources.