One-install Temporal Cloud Ops API front door over four bounded capability packs and 11 non-chat, uncached, read-only workflows. It admits all 87 official v0.18.0 operations across 55 paths: namespaces, capacity, regions, high availability, connectivity, Nexus, exports, users, service accounts, API keys, groups, custom roles, projects, account settings, audit, billing, and asynchronous operations. The relative OpenAPI server resolves against its official source to the origin-pinned https://saas-api.tmprl.cloud host; a selected encrypted Bearer API key remains inside the trusted adapter and Temporal RBAC continues to govern every call. All 37 request bodies are required bounded body_raw JSON objects. All responses preserve unsafe integers, 20 documented page-token collections paginate automatically at 100 records per request; 19 carry the documented provider maximum of 1000 while Connectivity Rules retains provider-owned maximum semantics. The regions list is extracted from its single documented response. API-key creation remains callable but its one-time secret response is labeled sensitive and excluded from workflows. Billing-report reads return metadata without following expiring download URLs; those capability URLs are also labeled sensitive and excluded from workflows. Reads are uncached, every mutation requires approval, and no provider failure is silently retried. Temporal control-plane projects are not claimed as user-work project Sources.