One-install E2B front door over 8 bounded official domain packs and 8 non-chat, uncached, read-only workflows. It admits 72 of 86 methods from three official OpenAPI contracts and two official envd protobuf services at e2b@2.33.1 (7474d904a2f6056f9528e73baf697368e03bf6ab). Fourteen exact methods are excluded: seven deprecated duplicates with current replacements, two unsupported binary uploads, one privileged internal envd bootstrap, and four streaming Connect RPCs. The admitted surface spans sandboxes, snapshots, templates, builds, tags, persistent volumes and content, team and credential lifecycle, cluster administration, sandbox metrics and environment discovery, file downloads, finite filesystem RPC, and finite process control. Control-plane API key, account bearer, admin token, volume bearer, and sandbox-scoped envd credentials remain isolated. JSON bodies and Connect JSON messages are sent verbatim; decimal-string selectors and exact-integer response parsing preserve wire values. Reads are uncached; private reads are marked sensitive-read and every mutation requires approval. No task, note, or project Source is claimed for infrastructure resources.