One-install Hightouch front door over five bounded capability packs and 13 non-chat, uncached, read-only workflows. It inventories all 39 official operations across 27 paths and admits 38: destinations, sources, models, syncs and sync sequences, identity resolution, campaigns, Decision Engine flows and messages, and event contracts. The one explicitly deprecated identity-graph trigger alias is excluded in favor of its documented current /idr replacement, so no capability is lost. Every call uses the selected encrypted Admin-created API-key connection at the fixed https://api.hightouch.com/api/v1 origin. All 17 admitted JSON bodies use bounded body_raw payloads, preserving the official 14 required versus 3 optional split. Nine documented limit/offset collections paginate automatically using their official default page sizes. Destination and source connection configuration plus model SQL remain callable but all six sensitive GETs are excluded from bundled rendering workflows. Documented 200 success/error unions are preserved, exact identifiers and unsafe response integers cannot be silently rounded, reads are uncached and not approval-gated, and every mutation requires approval. Trigger actions are destructive and receive no hidden retries. Hightouch's reverse-ETL control-plane objects are not claimed as task, note, or user-work project Sources.