Marketplace

Aiven Kafka topics, ACLs, quotas, connectors, Schema Registry, tiered storage, messages, and MirrorMaker replication flows. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 53 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

Aiven organizations, application users, identity providers, domains, groups, invitations, governance access, and permissions. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 51 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

Aiven projects, service plans, clouds, custom clouds, VPCs, PrivateLink, static IPs, key management, secrets, and upgrade pipelines. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 69 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

Aiven service provisioning, configuration, backups, databases, users, tasks, PrivateLink, migrations, and service integrations. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 68 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

API capability pack for bounded Anthropic Claude REST API operations against https://api.anthropic.com only. Enroll an Anthropic API connection named anthropic that injects the x-api-key header, or an equivalent short-lived bearer credential; no credential is embedded in this manifest. The pack reads model metadata, creates non-streaming Messages API responses, counts message tokens, reads and cancels existing message batches, and reads beta file metadata for model, prompt, evaluation, and AI operations workflows. It bundles a Claude message brief, a token readiness brief, a scheduled model/batch/file operations digest, and an approval-gated workflow for canceling one message batch. Writes are limited to canceling one existing message batch. The pack intentionally excludes streaming, tool definitions, tool-choice controls, server web/search/fetch tools, code execution, MCP connector/tool routing, container/session/managed-agent APIs, message batch creation and deletion, batch result JSONL download, file upload/content download/delete, skills, admin APIs, user-profile headers, arbitrary Anthropic API passthrough, and dynamic outbound callback routing.

One-install Apollo REST API suite with all 76 current official method/path operations from the hash-locked OpenAPI 3.1 contract. The 22-operation compatibility surface and eight shipped workflows remain addressable; all workflows move to version 2 for current API-key or partner-OAuth enrollment guidance, and five also repair request transport because Apollo now declares sequence and task search fields in the query while email-account listing accepts no parameters. Accounts, contacts, people and organization intelligence, deals, sequences, tasks, outreach email, calls, lists, fields, notes, analytics, conversations, usage, and enrichment are admitted. Reads are approval-free at the read floor, and every newly admitted mutation requires approval every run. The two enrichment routes remain synchronous-only: arbitrary webhook callback delivery and the switches that require it fail closed. Page walks are bounded, unsafe JSON integers remain exact strings, and credentials are supplied only by the enrolled connection.

One-install Asana front door over three bounded domain packs and the existing daily-work workflows. It admits 247 of 249 current first-party operations: every fixed JSON REST route except the multipart attachment upload and the Batch API arbitrary method/path passthrough. The compatibility root preserves all 29 prior operation IDs and routes, representing 25 unique official operations, while dependencies add the other 222 official routes. Sixty-four unique collection routes follow documented next_page.offset pagination; schema-only unpaged collections remain explicitly bounded. Recipe mutations now send the documented JSON data wrapper as one object, while Source internals retain their proven nested composer keys. Reads are uncached outside the compatibility root, sensitive reads are marked sensitive-read, every mutation is approval-gated, and no credential is embedded.

Asana access requests, agents, AI Studio usage, custom types, exports, teams, users, workspaces, memberships, webhooks, audit logs, events, jobs, and typeahead. Generated from the hash-pinned first-party Asana OpenAPI document. Every call is fixed to the enrolled Asana origin and /api/1.0 route; reads are uncached, sensitive reads are marked sensitive-read, and every mutation is approval-gated. JSON mutations accept the documented data wrapper through one body.data object.

Asana goals, portfolios, memberships, allocations, budgets, rates, roles, time tracking, timesheets, time periods, and out-of-office planning. Generated from the hash-pinned first-party Asana OpenAPI document. Every call is fixed to the enrolled Asana origin and /api/1.0 route; reads are uncached, sensitive reads are marked sensitive-read, and every mutation is approval-gated. JSON mutations accept the documented data wrapper through one body.data object.

Workflow pack for Recued-created Asana tasks. It composes the Asana capability pack with a closure ledger: create one owner-approved task in an existing workspace, optionally place it in one project from that workspace, persist only the connection/workspace/project/task linkage in data.shared, and let a scheduled watcher re-read that exact task until Asana reports completion. This pack does not replace Asana My Tasks, project dashboards, sections, dependencies, tags, followers, custom fields, attachments, webhooks, deletion, project placement tooling, or native task completion controls; it adds Recued-visible closure state for Asana tasks Recued created.

Workflow pack for Recued-created Asana task comments. It composes the Asana capability pack with a closure ledger: add one owner-approved comment story to an existing Asana task, persist only the connection/task/story linkage in data.shared, and let a scheduled watcher re-read that exact task until Asana reports it completed. This pack does not replace Asana tasks, native notifications, task completion controls, project dashboards, reminders, webhooks, or general work reporting; it adds Recued-visible closure state for task comments Recued created.

Asana tasks, projects, sections, stories, tags, custom fields, project briefs and statuses, templates, reactions, rules, and attachment metadata. Generated from the hash-pinned first-party Asana OpenAPI document. Every call is fixed to the enrolled Asana origin and /api/1.0 route; reads are uncached, sensitive reads are marked sensitive-read, and every mutation is approval-gated. JSON mutations accept the documented data wrapper through one body.data object.

Ashby API-key details, audit events, recruiting metadata, custom fields, upload handles, sources, and webhook settings. Generated from Ashby's complete current outbound API surface in the official machine-readable reference index: every focus page is reconciled to an emitted operation or a concrete directional/deprecation exclusion, with raw Markdown and embedded OpenAPI hashes retained in the audit fixture. A single openapi_source is intentionally omitted because Ashby publishes Markdown-wrapped per-reference contracts rather than one directly fetchable OpenAPI document. Reads are uncached and permission-scoped; reads over sensitive recruiting data are marked sensitive-read. Every mutation is grant-off and approval-gated. Ashby can report application errors as HTTP 200 with success:false, so operations preserve the full response envelope and workflows disclose provider success/error state. No work-entity Source is declared because Ashby's actual Project contract does not prove a mandatory version field.

Ashby applications and stage history, feedback, approvals, referrals, assessments, forms, and sequences. Generated from Ashby's complete current outbound API surface in the official machine-readable reference index: every focus page is reconciled to an emitted operation or a concrete directional/deprecation exclusion, with raw Markdown and embedded OpenAPI hashes retained in the audit fixture. A single openapi_source is intentionally omitted because Ashby publishes Markdown-wrapped per-reference contracts rather than one directly fetchable OpenAPI document. Reads are uncached and permission-scoped; reads over sensitive recruiting data are marked sensitive-read. Every mutation is grant-off and approval-gated. Ashby can report application errors as HTTP 200 with success:false, so operations preserve the full response envelope and workflows disclose provider success/error state. No work-entity Source is declared because Ashby's actual Project contract does not prove a mandatory version field.

Ashby candidate profiles, search, notes, tags, files, fraud review, talent projects, and candidate actions. Generated from Ashby's complete current outbound API surface in the official machine-readable reference index: every focus page is reconciled to an emitted operation or a concrete directional/deprecation exclusion, with raw Markdown and embedded OpenAPI hashes retained in the audit fixture. A single openapi_source is intentionally omitted because Ashby publishes Markdown-wrapped per-reference contracts rather than one directly fetchable OpenAPI document. Reads are uncached and permission-scoped; reads over sensitive recruiting data are marked sensitive-read. Every mutation is grant-off and approval-gated. Ashby can report application errors as HTTP 200 with success:false, so operations preserve the full response envelope and workflows disclose provider success/error state. No work-entity Source is declared because Ashby's actual Project contract does not prove a mandatory version field.

Ashby interviews, schedules and events, stages and plans, interviewer pools, briefings, transcripts, and take-home assignments. Generated from Ashby's complete current outbound API surface in the official machine-readable reference index: every focus page is reconciled to an emitted operation or a concrete directional/deprecation exclusion, with raw Markdown and embedded OpenAPI hashes retained in the audit fixture. A single openapi_source is intentionally omitted because Ashby publishes Markdown-wrapped per-reference contracts rather than one directly fetchable OpenAPI document. Reads are uncached and permission-scoped; reads over sensitive recruiting data are marked sensitive-read. Every mutation is grant-off and approval-gated. Ashby can report application errors as HTTP 200 with success:false, so operations preserve the full response envelope and workflows disclose provider success/error state. No work-entity Source is declared because Ashby's actual Project contract does not prove a mandatory version field.

V3 QuickBooks Online capability pack for the SMB-finance wedge. Declares canonical accounting operations over QuickBooks invoices, bills, expenses (Purchase), customer payments, refunds, customers, vendors, chart of accounts (Account), daily bookkeeping views, and financial reports. Reads flow after connection grant; invoice/bill/expense/customer/vendor writes ask + diff; customer-payment, refund, and invoice-void are destructive/always-ask so money movement never rides a session grant. Mirrors the shipped Stripe billing-pack entity_platform pattern. The READ surface is LIVE-VERIFIED against the QuickBooks Online sandbox (2026-06-13): OAuth token exchange, the /query endpoint (base https://quickbooks.api.intuit.com, /v3/company/<realmId>/query?query=<SQL>&minorversion=75 -> QueryResponse.<Entity>[]), single read-by-id (/<entity>/<id> -> {<Entity>}), realmId-in-path + sandbox base, and every read field_path all confirmed against live sandbox data. WRITE ops (create/update/void/payment/refund) are authored to the same documented v3 shapes but were NOT exercised live (non-mutating verification only). This is the QuickBooks catalog + money-write surface ONLY — the two vendor-agnostic accounting workflows (overdue-invoice-chase, accounting-daily-back-office) ship in the vendor-neutral `acct` pack (install it alongside this one for the workflows); their canonical `core.acct.*` read op-steps resolve against THIS vendor's catalog at run (dispatch-time), projecting QuickBooks' raw records to the canonical accounting fields. Canonical accounting op-steps are read-only; money writes ride the gated ingredient binding. See docs/unified-pack-exploration/smb-finance-wedge.spec.md.

V3 Xero capability pack for the SMB-finance wedge — the second conformant accounting vendor alongside accounting-quickbooks. Declares the same canonical accounting operations (invoice, bill, expense, payment, refund, customer, vendor, ledger_account) over the Xero Accounting API 2.0 so smb-invoice-finance recipes read AR / AP / cash-in the same way they do on QuickBooks. Adds daily bookkeeping views for open receivables/payables, recent payments/spend, active contacts, catalog/settings lookups, and financial reports without exposing arbitrary where/filter passthrough. Reads flow after connection grant; invoice/bill/expense/customer/vendor writes ask + diff; customer-payment, refund (credit note), and invoice-void are destructive/always-ask so money movement never rides a session grant. Mirrors the shipped Stripe + QuickBooks entity_platform by-value composition pattern. AUTHORED-TO-DOCS, RUNTIME-UNVERIFIED (F4): no live Xero org was available this build. Xero specifics encoded here: base https://api.xero.com/api.xro/2.0, OAuth via login.xero.com + identity.xero.com with offline_access + accounting.transactions/contacts/settings scopes, list responses wrapped under a PascalCase plural key (result_path Invoices/Contacts/Payments/BankTransactions/Accounts), AR vs AP split by Invoice.Type (ACCREC/ACCPAY) and customer vs vendor split by Contact IsCustomer/IsSupplier (Xero unifies both, unlike QuickBooks' separate entities), filtering via the where query param. KNOWN runtime wrinkles to close on a live org (documented, not blockers): (1) every call needs a per-connection Xero-tenant-id header resolved post-OAuth from GET https://api.xero.com/connections — the tenant-header substrate is the slice-5a wiring follow-up (Xero carries the org in a header, not the URL path like QuickBooks' realm); (2) Xero defaults to XML, so calls need Accept: application/json; (3) Xero JSON dates come back in the /Date(ms)/ form, so a date-bearing canonical field needs a parse transform before is_past. This is the Xero catalog + money-write surface ONLY — the two vendor-agnostic accounting workflows (overdue-invoice-chase, accounting-daily-back-office) ship in the vendor-neutral `acct` pack (install it alongside this one for the workflows); their canonical `core.acct.*` read op-steps resolve against THIS vendor's catalog at run (dispatch-time), projecting Xero's raw records to the canonical accounting fields. Canonical accounting op-steps are read-only; money writes ride the gated ingredient binding. See docs/unified-pack-exploration/smb-finance-wedge.spec.md.

The vendor-neutral accounting pack — two cross-vendor money-ops recipes that run against whatever accounting platform you enroll (QuickBooks Online or Xero, or any registered accounting vendor). Every read uses a `core.acct.<entity>.search` kernel op (invoice / payment / customer), so the pack carries no bundled catalog: each op resolves at run against the catalog the bound connection's vendor declares, and projects the canonical accounting fields (balance / due_date / customer_id / email) — never raw vendor records. This is the showcase for the `core.acct.*` canonical convention; the catalog + the money-write surface (invoice/payment/refund creates, always approval-gated) live in the per-vendor capability packs (`accounting-quickbooks` / `accounting-xero`), which you also install to bind a connection. Canonical accounting op-steps are read-only — `overdue-invoice-chase` only sends a reminder email through the gated mail-send kernel ingredient, never moving money. Installs dormant until you pick an enrolled accounting connection for each recipe's `acct` variable (Settings -> the recipe), then runs against the D-165 gateway (operation-level risk / grant / approval + per-call audit).

One-person-company billing workflow pack over the Stripe capability pack. It installs operating views for daily billing review, invoice recovery exceptions, payment exceptions, and customer cleanup, plus owner-approved recovery-exception email actions that seed the shared reply watcher so customer responses re-enter the daily work loop. Stripe native reminders, failed-payment emails, Smart Retries, and Billing Automations own routine recovery; Stripe invoice sends, refunds, voids, cancellations, and payouts stay in the Stripe capability pack's approval-gated operations.

Local malware-scan capability pack. By-value cli connector composition (service_kind=cli): the ClamAV daemon client `clamdscan` scanning a data.file.received record's bytes, via the file.scan catalog operation. The file_ref's bytes are materialized to an engine-managed throwaway temp file, scanned by the local clamd, and the temp file removed in a finally (input_materialize) — no bytes ever flow through op-step values, and no content leaves the machine. The op returns the scanner EXIT CODE only (0 = clean, 1 = infected, 2+ = scan error → the executor rejects and the verdict is left unwritten); the verdict is read from the exit code, never stdout. read-tier / approval=never so a reactive scan runs unattended; the op is cli-kind so it is NEVER an MCP/door tool — only a recipe can invoke it, and only over warehouse file_refs (never an arbitrary host path). PREREQUISITE: install ClamAV and run the clamd daemon — macOS: `brew install clamav` then `freshclam` + run `clamd`; Debian/Ubuntu: `apt install clamav-daemon clamav-freshclam` then `systemctl start clamav-daemon`; Windows: install ClamAV and run the ClamD service. `--fdpass` passes the file descriptor to clamd so it can read the engine temp file even when clamd runs as a different user (Unix socket); a TCP clamd needs read access to the temp dir instead. Drives the ClamAV Scan workflow pack (clamav-scan), which auto-scans every inbound reception drop. A zero-install Windows-Defender variant (`MpCmdRun.exe -Scan -ScanType 3 -File {target} -DisableRemediation`) can be authored the same way (a cli ingredient + a file.scan op with success_codes [0,2]).

Auto-scan every inbound file for malware. Installs one reactive recipe that fires on data.file.received.*.created — an inbound reception drop, messenger media, or mail attachment — runs the ClamAV pack's file.scan over the bytes, and writes the verdict (clean / flagged) back to the record's scan_status. This sharpens the reception attachment scan-gate (D-173 P5): a flagged upload surfaces a stronger warning when the reviewer approves the held request, while a clean one clears the advisory. Depends on the ClamAV capability pack (clamav-pack), which carries the cli scan op and the clamd setup docs; install both and run a local clamd. A scan error (clamd down) leaves the file unscanned and the advisory gate still warns — nothing is silently approved. After install, the default dish runs on every inbound file; no per-file configuration.

V3 workflow-pack example for a one-person company running Codex over GitHub issues. This pack is deliberately not the golden capability-pack standard: GitHub Pack and Codex Pack are the v3 gold examples. The pipeline depends on those capability packs, then installs four workflow recipes over warehouse state. Stage 1 reads open issues through the GitHub pack's issue.search catalog operation and launches one detached Codex run per new issue through the Codex pack's codex.review CLI operation (write-tier, approval-gated). Stage 2 sweeps marker-file evidence (<key>.exit.<code>) into queue outcomes. Stages 3 and 4 notify and finalize success/failure rows. Install once; create one stage-1 dish per repository, one sweeper dish, and one success/failure handler dish. Setup: install github-pack and codex-pack, bind a GitHub api connection, bind notification email, register the result directory as a file slug, and grant the Codex 'Run Codex on local repositories' operation group.

V3 single-file Codex pack standard. The callable surface is a by-value connector composition with service_kind=cli, not a single service ingredient. The direct Codex CLI argv stays visible, and long-running runs declare Recued-managed detachment with marker-file evidence; recipes call the catalog operation and the gateway gates the write-tier run.

The vendor-neutral CRM pack — seven canonical reporting recipes that run against whatever CRM you enroll (HubSpot deals, Salesforce opportunities, or any registered CRM vendor). Every step uses a `core.crm.<entity>.<verb>` kernel op (deals / contacts / accounts), so it carries no bundled catalog: each op resolves at run against the catalog the bound connection's vendor declares, and projects the canonical fields (name / stage / amount / key_dates / close_state) — never raw vendor properties. This is the showcase for the `core.crm.*` canonical convention; vendor-specific recipes that need raw platform fields live in the per-vendor packs (`recued-core.hubspot` / `recued-core.salesforce`) instead. Installs dormant until you pick an enrolled CRM connection for each recipe's `crm` variable (Settings -> the recipe), then runs against the D-165 gateway (operation-level risk / grant / approval + per-call audit).

Cross-vendor companion to the per-vendor augmentation recipes folded into the `recued-core.hubspot` + `recued-core.salesforce` vendor packs (the standalone `sales-augmentation-*` packs were retired in D-182 Slice 4). Ships *alerts only* — no producers. Producers stay vendor-specific in each per-vendor pack and write rows under `connection.api.<vendor>.<entity>.<id>.<topic>` paths; this pack reads them through the `core.data.enrichment.list` op, vendor-agnostic by construction (the dynamic `scope` arg resolves to `{{context.event.payload.platform}}` at read time). The three CRM-entity alerts subscribe via the canonical `on: <crm_alias>.changed` sugar (`deal.changed` / `contact.changed`), which fans one subscription per installed vendor carrying that alias — HubSpot + Salesforce today, any future CRM automatically; the new-inquiry alert subscribes to inbound mail (`data.mail.**.created`) instead. Install AT LEAST one vendor-specific pack alongside this one to get producers populating the topics. Variants share `variant_group` with the per-vendor recipes and carry `variant_kind: 'cross_vendor'` discriminator so the marketplace UI can collapse the card with vendor switch. Per spec § A.8.2 the install dialog SHOULD warn about overlap when both this pack and a vendor-specific pack covering the same alerts are installed (non-blocking — multi-CRM tuners may want both for vendor-specific tuning + cross-vendor catch-all).

Post-substrate canary pack for the D-139 engagement evidence substrate per spec § P6.B. Privacy-tier separated from the deterministic `crm-engagement-augmentation` pack (P6.A): this pack reads mail bodies + calendar descriptions + memory entries + per-type CRM engagement bodies to extract commitments people made ("you said you'd send X by Friday") and tracks follow-through. Installs one Layer-1 silent producer (`commitment-tracker-producer`) wrapping the AI-surface `commitment_tracker` topic + one Layer-2 visible alert (`notify-commitment-due-soon`) that fires when a pending commitment's `due_at` falls within the next 24h. Authorship-filtered (extracts ONLY from `'user'` / `'crm_user'` / `'unknown'` rows — automation/system_process rows can't make commitments). Body-state acceptance is tighter than P5 AI-surface canaries: requires `'inline_body'` (full-context required for accurate extraction; truncated previews skipped). Dedupe acceptance `'exact_only'` so probable-twin emails extract as TWO separate commitments rather than collapsing into one. Manual trust default per D-132 — user must promote at MANUAL_RUN_THRESHOLD before the substrate fires. Free-pool first per spec — commitment text generation is bounded, low-token; routing through the user's free-tier pool keeps the pack cost-neutral by default. Pack install carries an implicit MCP body-content permission grant for `data.contact.engagements.body_content` per spec § A.9.5 — without it the AI would have nothing to extract from. The grant is pack-scoped: installing the deterministic `crm-engagement-augmentation` pack does NOT carry a body-content grant. Status: post-substrate canary — graduated from launch-flag gating; marketplace listing surfaces unconditionally. Independent install gate from the deterministic pack — installs without `crm-engagement-augmentation`, vice versa, no implicit pack dependency.

Primary deterministic pack for the D-139 engagement evidence substrate. Installs four Layer-1 silent producer recipes (`engagement-velocity-producer` / `engagement-silence-producer` / `inbound-outbound-ratio-producer` / `last-meaningful-touch-producer`) wrapping the deterministic deal-level topics (`engagement_velocity_signal` + `engagement_silence_duration` + `inbound_outbound_ratio` + `last_meaningful_touch`) plus four Layer-2 visible alerts that surface decaying-velocity deals, silence-exceeded deals, out-of-band engagement (rep mail not landing in CRM), and overdue meeting follow-ups. Producers and alerts are vendor-agnostic — both subscribe to the cross-vendor deal/opportunity update bus and dispatch via the dynamic `{{context.event.payload.platform}}` scope that resolves to either `connection.api.hubspot.deal` or `connection.api.salesforce.opportunity` per event. The substrate-side housekeeping engagement-aggregates code (D-139 P3 + P4) is the canonical compute path; producer recipes here re-emit the row through the recipe-cycle audit so the user sees the topic ticking on each deal touch (Layer-1 pattern). Cost-preview previews zero token cost (deterministic only). Independent install gate from the post-substrate canary `crm-commitment-tracker` pack (P6.B) — installing the deterministic pack does NOT carry a body-content MCP grant.

Workflow pack for one-person-company customer replies. It turns Email / Outbox plus contact timeline context into a support desk: triage likely customer questions, draft a grounded reply from a selected mail thread, send only through the mail-send approval boundary, and watch the thread for the customer's next actionable response. The pack owns the support workflow, not any new mail primitive.

Local malware-scan capability pack for a Windows-hosted recued server — the zero-install sibling of clamav-pack. By-value cli connector composition (service_kind=cli): Microsoft Defender's MpCmdRun.exe scanning a data.file.received record's bytes, via the file.scan catalog operation. The file_ref's bytes are materialized to an engine-managed throwaway temp file, scanned by the built-in Defender engine, and the temp file removed in a finally (input_materialize) — no bytes flow through op-step values and nothing leaves the machine. VERDICT FROM THE EXIT CODE: the op runs `MpCmdRun.exe -Scan -ScanType 3 -File {target} -DisableRemediation`; per Microsoft's docs the return code is 0 (no malware found) or 2 (malware found and NOT remediated, OR a scan error). `-DisableRemediation` is load-bearing — it suppresses remediation so a detected threat stays 'found and not remediated' (exit 2) instead of collapsing to 'found and remediated' (exit 0); WITH it, exit 0 means no malware found in the custom -File scan path. This is INFERRED from Microsoft's docs (it holds for file-based malware in the custom scan; it is NOT independently verified across every threat category — PUA / behavioral / network detections may not be covered by a custom file scan at all). exit_code_handling success_codes [0,2] → 0 maps to clean, 2 maps to flagged. The exit-2 ambiguity (threat vs scan error, e.g. a non-elevated run) is FAIL-SAFE: a scan error surfaces as 'flagged' (extra review), never as a false 'clean' — no malware passes. read-tier / approval=never so a reactive scan runs unattended; cli-kind so it is never a raw MCP/door tool. PREREQUISITES (Windows only): (1) the recued SERVER must run ON WINDOWS — MpCmdRun.exe is Windows-only; (2) run the server ELEVATED (as Administrator) — MpCmdRun -Scan needs elevation, else it returns exit 2 (every file false-flags); (3) MpCmdRun.exe is NOT on PATH — this pack uses the stable absolute path `C:\Program Files\Windows Defender\MpCmdRun.exe`; if Defender lives elsewhere (a versioned `C:\ProgramData\Microsoft\Windows Defender\Platform\<version>` install), edit the op's argv_template + the ingredient entry_point/probe; (4) Defender must be ENABLED and its security intelligence CURRENT — stale definitions miss new malware and return exit 0 (a false clean, with no exit-code signal, exactly as a stale freshclam DB would for ClamAV), so keep auto-updates on or run `MpCmdRun.exe -SignatureUpdate` on a schedule. A scan is only as good as the definition date. Drives the Windows Defender Scan workflow pack (defender-scan), which auto-scans every inbound reception drop. ALTERNATIVE (cleaner threat/error split, not shipped): a PowerShell wrapper over `Start-MpScan -ScanPath {target} -ScanType CustomScan` + `Get-MpThreatDetection` can distinguish a real detection from a scan error and exit 0/1 — at the cost of a fiddly detection-filter; switch to it here if the exit-2 false-flag noise bites.

Auto-scan every inbound file for malware with Windows Defender — the Defender sibling of clamav-scan, for a Windows-hosted recued server. Installs one reactive recipe that fires on data.file.received.*.created (an inbound reception drop, messenger media, or mail attachment), runs the Defender pack's file.scan over the bytes, and writes the verdict (clean / flagged) back to the record's scan_status. This sharpens the reception attachment scan-gate (D-173 P5): a flagged upload surfaces a stronger warning when the reviewer approves the held request, while a clean one clears the advisory. Depends on the Windows Defender capability pack (defender-pack), which carries the cli scan op and the MpCmdRun / elevation / Windows-only setup docs; install both on a Windows server running elevated. An MpCmdRun exit-2 result (a threat, or a scan error such as a non-elevated run) is conservatively flagged for review (fail-safe — no malware passes); a launch failure, timeout, or any other exit code leaves scan_status untouched (unscanned, the advisory gate still warns) rather than flagged. After install, the default dish runs on every inbound file; no per-file configuration. Install EITHER this or clamav-scan for your platform — not both.

Deterministic document-parse capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local docling CLI parses a source document (PDF / DOCX / PPTX / HTML / image / spreadsheet / email / audio) into Markdown the model can read, via the document.to_markdown catalog operation. Fixed-function and reproducible — conversion happens locally before any model sees the content. V2 accepts the ordinary bare file ref and the runtime's closed content-pinned CAS carrier; for the latter, input materialization hashes the exact buffer written to the CLI input path and refuses drift before spawning Docling. Write-tier but approval=never: output_capture surfaces the produced Markdown as a run-scoped temp result.file_ref, reclaimed at run end. A downstream ai-* step can read that ref through the Gateway-aware { file_ref } carrier so the content never flows through ordinary op-step values; a recipe that needs durable retention must add an explicit core.storage.file.persist step. Large/heavy PDFs (docling runs ML layout/OCR) can exceed the 90s foreground cap; those ride a detached execution path when it lands. Part of the Lane-1 deterministic document toolkit alongside pandoc-pack (render). Supersedes the legacy document-normalization ingredient pack.

Workflow pack over Email / Outbox. It turns a sent/outbound mail folder into a practical follow-up lane for one-person companies: scan likely silent threads, draft concise replies, preview the batch, and route sends through the existing mail-send approval gate. The pack depends on email-outbox-pack for all mail read/send primitives and does not redefine any provider-specific Gmail, Outlook, or IMAP surface.

V3 suite/warehouse capability pack for email and outbox work. Gmail, Outlook, and IMAP are provider connections feeding the same warehouse; this pack bundles the kernel mail read/search/thread/body/send operations so workflow packs can depend on one governed email capability. Email-list v2 adds an opt-in metadata-only projection that removes inline bodies and blob pointers before recipe state. Sending is still the irreversible write-class operation owned by the mail-send kernel gate.

The entity-less tool pack (§5 tool-op pack seam, v3 §7 'cli / tool pack'). Bundles the `exa-catalog` ingredient and one connection-agnostic recipe — `search-web-exa` runs a `recued-core.exa.web.search` Tier-P pack op-step that binds to the bundled Exa catalog and dispatches pass-through through the D-165 gateway (read-tier, audited). Installs dormant until you enroll an Exa connection (Settings → Connections) and pick it for the recipe's `exa` variable; web egress is reachable only as this pack-bound op, never as a direct ingredient.

V3 deterministic media-bridge capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local ffmpeg CLI ingredient exposes readiness, audio extraction, ASR-friendly WAV normalization, audio waveform rendering, video thumbnail extraction, short GIF preview generation, and compact MP4 transcoding. The parse-in enabler of the media toolkit: pulling audio out of video / screen-recording / podcast containers yields a smaller audio file an ASR step (whisper audio.transcribe) or an audio-capable model can read; thumbnail, waveform, and GIF preview outputs produce compact visual previews for media triage. Fixed-function and reproducible: transformations happen locally before any model sees the content. Write-tier operations write only to an engine-managed throwaway temp dir, ingest the produced artifact into data.file.received (CAS), and surface result.file_ref; downstream steps consume bytes through Gateway-gated file refs rather than op-step values. The source can be a data.file ref or trusted local path. Large/long media can exceed the 90s foreground cap; those ride a detached execution path when it lands. Requires the ffmpeg binary on PATH. Local operations are pinned to the file/pipe protocol whitelist so URL inputs cannot trigger remote fetches. Part of the Lane-1 media toolkit alongside whisper (transcribe), mediainfo (inspect), and imagemagick/vips (image transforms).

Google Drive storage capability pack for the SMB-finance wedge (and any folder-watch lane). By-value entity_platform composition over the Drive REST v3 API: list a folder's files, read a file's metadata, download file bytes straight into the warehouse CAS, export Google Workspace documents as PDFs, list comments, and inspect revision history. It also supports approval-gated daily file organization: rename a file, move a file between folders, copy a file, create folders, and add one file comment. The download/export -> file_ref handoff feeds docling (document.to_markdown materializes the file_ref to a temp file), so a receipts/invoices folder in Drive becomes a parse-ready intake lane. Reads flow after connection grant; writes ask. Bind a Google connection once (OAuth 2.0 via your own Google Cloud app, drive.readonly + drive.file scopes) and assign a dish. Media-bytes upload, trash/delete, permission sharing, label mutation, arbitrary comment edit/delete, revision mutation, and Google Docs content editing remain excluded.

One-install GitHub developer-platform front door for issue lookup/update/comments, an approval-gated issue creation workflow, two read workflows, 17 REST dependencies, and the assigned-issue GraphQL Source. The 1,159-call suite admits 1,157 of 1,167 stable nondeprecated operations in GitHub's immutable 2026-03-10 first-party REST schema plus two independently pinned GraphQL operations. Its 10 explicit transport exclusions are one alternate-host binary upload and nine cross-origin redirect downloads rejected by the origin-pinned transport. The compatibility root preserves all 31 prior operation IDs and routes; five legacy mutations now use body.* keys the runtime serializes, while dependencies add 1,128 REST operations. Every REST call pins the 2026-03-10 header, JSON responses preserve unsafe integers, and 203 provider Link contracts auto-paginate within engine caps; sensitive reads are marked sensitive-read, and every mutation remains grant-off and approval-gated.

The HubSpot vendor pack — bundles the `hubspot-catalog` D-165 catalog ingredient so every HubSpot Tier-P op (`recued-core.hubspot.deal.read`, `contact.search`, `company.read`, `deal.create`, …) resolves against one installed binding. Vendor-specific recipes declare `depends_on: ["recued-core.hubspot"]` and read HubSpot records RAW (`{{step.deal.result.properties.hs_*}}`) — the catalog op owns only how a recipe-named property folds into the request query (D-182 §3 Tier-P, decision-b). It also bundles the HubSpot augmentation producers/alerts (deal health + velocity signals, closing-soon + low-engagement + new-inquiry notifications) and the contact-maintenance write recipes — each binds its op-steps against this pack's own catalog at install (D-182 §3 first-party self-reference). Installs the catalog dormant until each recipe's HubSpot connection variable is bound to an enrolled connection (Settings → Connections); every call then runs through the D-165 gateway (operation-level risk/grant/approval + per-call audit). Cross-vendor canonical recipes live in `recued-core.crm` instead.

V3 deterministic image-bridge capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local ImageMagick CLI (magick) ingredient exposes bounded operations for readiness, supported-format discovery, first-frame image identification, PNG conversion, auto-orientation, aspect-preserving resize, thumbnail generation, metadata stripping, and grayscale PNG derivation. The image parse-in bridge of the media toolkit turns formats the model cannot read (HEIC / TIFF / BMP / camera-raw) into PNG and can inspect dimensions/format before conversion. Fixed-function and reproducible: conversion and identification happen locally before any model sees the content; no shell wrapper, no arbitrary ImageMagick flags, no display/import/capture commands, no MSL/conjure, no profile editing, no remote URL fetch options, and no caller-controlled output path. File-ref operations write only into an engine-managed throwaway temp dir, capture result.file_ref, and remove the temp dir after capture. Requires the ImageMagick v7 binary (magick) on PATH. Part of the Lane-1 media toolkit alongside whisper (transcribe) and ffmpeg (extract audio).

Turn recorded audio and video into staged notes and action items - the workflow over the media toolkit. transcribe-audio-to-notes runs a recorded audio file through the local whisper tool (audio -> transcript file ref) and summarizes it; transcribe-video-to-notes runs the full chain, extracting the audio track with the local ffmpeg tool first (video -> audio file ref) then transcribing and summarizing; transcribe-audio-to-actions extracts concrete action items from the transcript and optionally writes them as Recued tasks; transcribe-audio-to-commitments extracts explicit commitments (who promised what to whom) from the transcript and optionally writes them to Recued's commitment tracker; transcribe-media-watch is the Drive-folder source lane - it polls a Google Drive folder for new audio or video recordings, downloads each straight into the warehouse CAS, runs the full extract-audio -> transcribe -> summarize chain, and stages a transcript + summary note (the manual single-file lanes are the transcribe-audio/video-to-notes recipes). All are preview-first - they stage a note or show the action items and write nothing until asked. Every handoff is a Gateway-gated data.file ref, so the media bytes and the transcript text never flow through op-step values - the model reads the transcript by ref as a document content part (so it needs a document-capable model). The audio/video analog of the smb-invoice-finance intake pack (docling parse -> extract -> stage). Depends on the whisper and ffmpeg tool packs, plus the personal-organizer-foundation pack for the work-entity task/commitment substrate the action-items and commitments recipes write to. Long recordings can exceed the 90s foreground cap per tool call (they ride a detached execution path when it lands).

One-person-company workflow pack that turns normalized meeting notes into visible action candidates, with optional writes to Recued tasks and commitments. It depends on the docling pack for local document parsing and the organizer foundation for the work-entity substrate.

V3 deterministic local-inference capability pack. By-value connector composition (service_kind=cli, no separate service ingredient): the local ollama CLI runs a prompt against a locally-installed model and returns the model's reply as captured text, via the model.run catalog operation. Nothing leaves the machine — the prompt and the reply are processed by a model running on the paired recued-server, so this is the no-egress path for summarizing / rewriting / classifying private content that must never reach a hosted provider. Read-tier and approval=never: a local inference has no durable side effect (it writes nothing, sends nothing) — the reply is captured to the op result's `stdout` field (a string the next step consumes directly). Requires the ollama binary on PATH and the target model already pulled (ollama pull <model>); a missing model fails the run rather than triggering a network download mid-recipe. Distinct from the BYOK / free-pool AI substrate (ai-* functions): this is a raw local subprocess, deliberately chosen when the value proposition is "the bytes stay on this machine," not structured-JSON contracts. Part of the local developer / privacy toolkit.

End-to-end outbound follow-up workflow pack for one-person companies. It turns Email / Outbox into a repeatable loop: surface outbound threads that may need closure, draft concise follow-ups, send selected drafts through the mail-send approval boundary, and write outbound follow-up pressure into Recued-native work-queue topics.

V4 bounded document-render capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local pandoc CLI ingredient exposes readiness, supported-format discovery, a generic DOCX/HTML/EPUB renderer, and one fixed Markdown-to-PDF operation. PDF generation is explicit and buildable: document.markdown_to_pdf selects Pandoc's HTML writer plus the declared WeasyPrint pack dependency instead of pretending PDF is a native Pandoc output format or relying on an undeclared TeX runtime. The fixed PDF result is captured into durable CAS only after the executor verifies a PDF envelope, and returns its exact SHA-256, size, MIME, filename, and file ref. No operation exposes a shell wrapper, arbitrary flags, filters/defaults/templates/reference-doc paths, PDF-engine choice, or caller-controlled output path. The PDF op is not an untrusted-Markdown sanitizer: external PDF-engine I/O is outside Pandoc's reader/writer sandbox, so D-200 feeds it only strict renderer output and other callers must use trusted, self-contained Markdown. Part of the Lane-1 deterministic document toolkit alongside docling (parse) and xlsx-pack (export).

Time-anchored alerts before each upcoming meeting, grounded in behavioral patterns derived from your inbox + calendar. Installs one user-facing alert recipe (time-alert-before-event) plus three silent producer recipes that quietly maintain the rollup enrichments the alert reads. The substrate is provided by the unified data.enrichment namespace; this pack is the consumer.

Day-1 personal-organizer pack per D-145 § A.6. Pre-installs on first server init and composes built-in work entities (`task` / `note` / `commitment` / `project`) with PA9 enrichment producers (`open_loop_pressure` / `project_stall_signal` / `project_next_action_gap` / `commitment_reliability_band` / `note_relevance_decay`) into ten recipes: 4 Layer-2 visible views (today / open-commitments / stalled-projects / recent-notes-by-topic), 2 Layer-1 silent producers reactive on inbound mail (extract-commitments-from-mail / extract-tasks-from-mail), 1 Layer-2 visible alert reactive on inbound mail (triage-inbox), D-193 reminders (chat capture plus hidden due notifier), and the schedule-recipe control for installed recipes. Ships three canonical Standing Instructions as conservative safety defaults: an approval gate on composing email to contacts the substrate has only ever seen mentioned (never sent / received-from); a `min_tier: mid` floor for `schedule_meeting` so timezone-sensitive proposals don't ride the cheapest tier; and a `ban_omission_class: permission_scope` clause for `recipe_invoke` so foundation-pack views surface permission gaps instead of silently truncating. The substrate is provided by D-145 PA1-PA9 + the existing kernel ingredients; this pack is the consumer that turns the substrate into Day-1 value.

The Salesforce vendor pack — bundles the `salesforce-catalog` D-165 catalog ingredient so every Salesforce Tier-P op (`recued-core.salesforce.opportunity.read`, `contact.read`, `account.search`, `opportunity.create`, …) resolves against one installed binding. Vendor-specific recipes declare `depends_on: ["recued-core.salesforce"]` and read Salesforce sObject fields RAW (`{{step.opportunity.result.StageName}}`, no `properties` nesting) — the catalog op owns only how a recipe-named field folds into the SOQL/REST query (D-182 §3 Tier-P, decision-b). It bundles the Salesforce augmentation producers/alerts (deal health + velocity signals, closing-soon + low-engagement + new-inquiry notifications) and the contact-maintenance write recipes — each binds its op-steps against this pack's own catalog at install (D-182 §3 first-party self-reference), mirroring the HubSpot vendor pack. Installs the catalog dormant until each recipe's Salesforce connection variable is bound to an enrolled connection (Settings → Connections); every call then runs through the D-165 gateway (operation-level risk/grant/approval + per-call audit). Cross-vendor canonical recipes live in `recued-core.crm` instead — install whichever vendor pack matches your CRM and `recued-core.crm` binds the same connection-agnostic recipes to it at dispatch.