One-install Northflank front door over 9 bounded domain packs and 13 non-chat, uncached, read-only workflows. It admits all 609 nondeprecated operations across 422 official paths and excludes exactly 76 provider-deprecated operations. Projects, services, jobs, pipelines, workflows, addons, storage, secrets, integrations, networking, cloud and GPU clusters, AI models, templates, previews, teams, roles, tags, and billing are covered. The vendor-hosted OpenAPI is mutable but generation fails closed unless its 5,911,172 bytes retain SHA-256 59fdc2ce6fe8a7652715b2e0a24f762b2e248666393843d019af019159fa1d3b; official Markdown pins repair the schema's placeholder server and empty security declarations with the documented api.northflank.com origin and Bearer authorization. Two team billing paths omit teamId from their reused operation objects, so the exact path placeholder is repaired as a required string; eight collection operations incorrectly carry an ID path parameter absent from their own path, so those phantom inputs are omitted. Twelve optional repeated-value query selectors expose their official scalar alternative because closed operation args cannot serialize duplicate query keys. All repairs and reductions are recorded in the audit fixture. 112 exact cursor loops are automatic; 14 contradictory cursor shapes stay explicitly manual. JSON bodies remain verbatim and unsafe response integers remain exact strings, with compact response schemas accepting both safe numeric and unsafe decimal-string forms. Reads are uncached and not approval-gated; every mutation requires approval. No task, note, or project Source is claimed for infrastructure or runtime records.