One-install Hetzner Cloud front door over four bounded domain packs and 17 non-chat, uncached, approval-free read workflows. It inventories all 189 official operations across 151 paths, admits all 177 active operations, and records exactly 12 provider-deprecated exclusions. The official OpenAPI pins https://api.hetzner.cloud/v1 and explicit APIToken Bearer security on every operation. Runtime calls use the origin-only https://api.hetzner.cloud base plus explicit /v1 paths, with path_alias.wire_prefix preserving documentary proof. The selected encrypted token is project-scoped and credentials never enter pack arguments. All 76 request bodies are required bounded body_raw JSON objects. All 167 JSON responses preserve unsafe integers; ten 204 responses claim no body. All 37 exact page/per_page collections walk at the documented maximum of 50 records. Five one-time server and console credential responses remain directly callable but are labeled secret and excluded from workflows. Reads are uncached and require no approval, all mutations are destructive and require approval, and no provider failure is silently retried. Storage Boxes at api.hetzner.com, generic S3 Object Storage, and link-local server metadata are separate origin or transport families rather than silently widened capabilities. Infrastructure resources are not claimed as work-entity Sources.