V3 deterministic file-digest capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local OpenSSL CLI ingredient exposes readiness plus fixed SHA-256, SHA-384, and SHA-512 digest operations. Fixed-function and reproducible: the executor materializes the source file and owns the throwaway output directory, while openssl writes fixed digest text files that are captured as result.file_ref. Write-tier but approval=never: openssl writes only to an engine-managed output dir, and source bytes never flow through op-step values. Recipes cannot call arbitrary OpenSSL subcommands, sign or verify files, compute HMAC/MAC values, pass provider/engine/password options, encrypt/decrypt content, or use shell redirection. Requires the openssl binary on PATH (Debian/Ubuntu: apt install openssl; macOS: openssl or LibreSSL is commonly installed with system tools). Local and no-egress.