One-install managed Pulumi Cloud front door over 14 bounded domain packs and 15 non-chat, ungated read workflows. It inventories all 618 official operations across 471 paths, admits all 548 nondeprecated operations supported by the current REST runtime, and records exactly 64 provider-deprecated, five HEAD, and one SSE exclusion. The official OpenAPI is byte/hash locked but omits servers and authentication; Pulumi's equally pinned first-party REST guide supplies the fixed https://api.pulumi.com origin, complete "Authorization: token <access-token>" header contract, and application/vnd.pulumi+8 media version. Self-hosted Pulumi Cloud is deliberately not weakened into a caller-controlled origin and should receive a separate exact-host family. All 196 documented bodies are required bounded verbatim JSON or YAML because the generator omits requestBody.required systematically. JSON integers remain lossless, tar output is file_ref-isolated, proven pagination loops are automatic, and every ambiguous loop is named as single-response-only. Four Registry routes with no documented 2xx remain callable without an invented success schema. Reads are uncached and not approval-gated, every mutation requires approval, and provider failures receive no hidden retry. Infrastructure control-plane records are not claimed as user-work Sources.