One-install RunPod front door over 4 bounded official domain packs and 7 non-chat, uncached, read-only workflows. It admits 42 of 45 exact operations: every contract-complete resource operation from RunPod's immutable official management OpenAPI plus all eight queue-job routes in the immutable official operation reference, with v2 origin, bearer authorization, and common job transport corroborated by the current Python SDK. Three operations are excluded exactly: the OpenAPI document endpoint, the HTML documentation endpoint, and Pod restart because its official contract declares no 2xx success response. Pods, network volumes, Serverless endpoints, templates, registry credential references, billing, and queue-job lifecycle are otherwise covered; the optional status ttl selector is deliberately omitted because that nominal GET changes job retention. Management and Serverless execution origins remain separate even though both use RunPod API-key authorization. JSON bodies remain verbatim, bounded query integers retain their safe numeric constraints, and unsafe response integers remain exact strings. Reads are uncached and not approval-gated; every private mutation requires approval. No task, note, or project Source is claimed for infrastructure or runtime records.