One-install Vercel front door over five bounded domain packs and six release workflows. It admits 336 of 357 current official method/path operations. Twenty-one fail-closed exclusions are two HEAD probes, three binary uploads, one POST binary file read, two JSONL billing responses the adapter would misparse, two real-time log streams the adapter cannot buffer safely, and eleven routes added upstream in July 2026 whose admission is deferred pending policy curation. The compatibility root keeps all 25 prior operation IDs and routes while dependencies add 311 operations. Project environment metadata reads pin decrypt=false; an explicitly selected decrypted variable read remains separately marked sensitive-read. Reads are uncached, sensitive reads are marked sensitive-read, and every mutation is grant-off and approval-gated. Binary artifact downloads become isolated file_ref values. Enroll a Vercel bearer-token connection at https://api.vercel.com.