Workday OAuth2 (HTTP Basic client auth, non-rotating refresh) + REST (staffing/ recruiting/absence) + RaaS custom reports, AI actions (summarize worker/team/org, draft requisition); read-only proxy (405 on writes). 113 tests. On published @hanzo/ai@0.2.0. CI step added.