diff --git a/NOTICE b/NOTICE
index 56014be..4a83d64 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,7 +1,7 @@
 @pontx/pinhere is generated from the Pinhere PontxSpec.
 
 Pinhere source: https://github.com/jasonHzq/pinhere
-Source revision: 576e6f7160b5bb04d5856620def23c6bd3b25082
-Canonical PontxSpec SHA-256: 2a5f9d5796eefc683428b72d676dedc75f85e02b7b97f8de8c7942e66256ab5f
+Source revision: 4df51d12e3a707454ffdcef310de5d1e41bbbdfe
+Canonical PontxSpec SHA-256: 132d1988e36f4ecc186822b3c8a567ad30e270322d8772208675ab466a5ebe26
 Pinhere is licensed under the MIT License. See its repository for the source
 license and attribution.
diff --git a/README.md b/README.md
index d4ce520..2fd9149 100644
--- a/README.md
+++ b/README.md
@@ -4,10 +4,11 @@ Type-safe Pinhere SDK and preview-first CLI generated only from Pinhere's
 canonical PontxSpec.
 
 This repository is generated from the MIT-licensed, product-owned contract in
-[`jasonHzq/pinhere`](https://github.com/jasonHzq/pinhere). The source and
-package are ready for public review, but npm publication remains fail-closed
-until the canonical `https://pinhere.dev/.well-known/pontx.json` response is
-DNS-reachable and byte-for-byte matches the pinned canonical JSON contract.
+[`jasonHzq/pinhere`](https://github.com/jasonHzq/pinhere). Its canonical
+production origin is
+[`pinhere-jasonhzqs-projects.vercel.app`](https://pinhere-jasonhzqs-projects.vercel.app)
+and it publishes the reviewed contract at
+`/.well-known/pontx.json`.
 
 ## Safety boundary
 
diff --git a/pontx-spec.json b/pontx-spec.json
index fd93036..4499e3e 100644
--- a/pontx-spec.json
+++ b/pontx-spec.json
@@ -10,8 +10,8 @@
   "servers": [
     {
       "id": "production",
-      "url": "https://pinhere.dev/api/v1",
-      "description": "Pinhere 生产 API。"
+      "url": "https://pinhere-jasonhzqs-projects.vercel.app/api/v1",
+      "description": "Pinhere 生产 API（Vercel）。"
     }
   ],
   "tags": [
@@ -4246,8 +4246,8 @@
         "description": "Chrome 扩展 OAuth 2.0 Authorization Code + PKCE。",
         "flows": {
           "authorizationCode": {
-            "authorizationUrl": "https://pinhere.dev/extension-authorize",
-            "tokenUrl": "https://pinhere.dev/api/v1/oauth/token",
+            "authorizationUrl": "https://pinhere-jasonhzqs-projects.vercel.app/extension-authorize",
+            "tokenUrl": "https://pinhere-jasonhzqs-projects.vercel.app/api/v1/oauth/token",
             "scopes": {
               "projects:read": "读取项目并按页面 URL 解析项目。",
               "issues:create": "创建缺陷。",
diff --git a/scripts/verify-contract.mjs b/scripts/verify-contract.mjs
index 7a98ae1..5b73b51 100644
--- a/scripts/verify-contract.mjs
+++ b/scripts/verify-contract.mjs
@@ -15,8 +15,8 @@ assert.equal(spec.name, "pinhere");
 assert.equal(spec.style, "RESTFul");
 assert.deepEqual(spec.servers, [{
   id: "production",
-  url: "https://pinhere.dev/api/v1",
-  description: "Pinhere 生产 API。",
+  url: "https://pinhere-jasonhzqs-projects.vercel.app/api/v1",
+  description: "Pinhere 生产 API（Vercel）。",
 }]);
 assert.equal(entries.length, 34);
 assert.equal(schemas.length, 36);
@@ -54,7 +54,7 @@ assert.equal(spec.components.securitySchemes.pinherePat.bearerFormat, "ph_pat_*"
 
 const actualHash = createHash("sha256").update(bytes).digest("hex");
 assert.equal(actualHash, provenance.source.sha256);
-assert.equal(provenance.source.commit, "576e6f7160b5bb04d5856620def23c6bd3b25082");
+assert.equal(provenance.source.commit, "4df51d12e3a707454ffdcef310de5d1e41bbbdfe");
 assert.equal(provenance.output.operations, 34);
 assert.equal(provenance.output.schemas, 36);
 assert.equal(provenance.output.proxyDisabledOperations, 34);
diff --git a/source.provenance.json b/source.provenance.json
index 3341e8d..87d13eb 100644
--- a/source.provenance.json
+++ b/source.provenance.json
@@ -4,15 +4,15 @@
     "kind": "product-owned-pontx-spec",
     "repository": "https://github.com/jasonHzq/pinhere",
     "path": "apps/web/specs/spec.pontx.json",
-    "commit": "576e6f7160b5bb04d5856620def23c6bd3b25082",
-    "url": "https://raw.githubusercontent.com/jasonHzq/pinhere/576e6f7160b5bb04d5856620def23c6bd3b25082/apps/web/specs/spec.pontx.json",
-    "sha256": "2a5f9d5796eefc683428b72d676dedc75f85e02b7b97f8de8c7942e66256ab5f",
+    "commit": "4df51d12e3a707454ffdcef310de5d1e41bbbdfe",
+    "url": "https://raw.githubusercontent.com/jasonHzq/pinhere/4df51d12e3a707454ffdcef310de5d1e41bbbdfe/apps/web/specs/spec.pontx.json",
+    "sha256": "132d1988e36f4ecc186822b3c8a567ad30e270322d8772208675ab466a5ebe26",
     "license": "MIT"
   },
   "discovery": {
-    "url": "https://pinhere.dev/.well-known/pontx.json",
-    "status": "pending-dns-verification",
-    "canonicalJsonSha256": "7a98a17ca28eca19325b0aaa5b02fd54a119c1e36adcf99ea40bf1896c777d3c",
+    "url": "https://pinhere-jasonhzqs-projects.vercel.app/.well-known/pontx.json",
+    "status": "verified",
+    "canonicalJsonSha256": "4eb71ff51a64b1ba26a71754ccb1a00eccca33f6ab817d9828c196a007bf5b78",
     "verifiedAt": "2026-08-15"
   },
   "output": {
@@ -20,7 +20,5 @@
     "schemas": 36,
     "proxyDisabledOperations": 34
   },
-  "releaseBlockedBy": [
-    "pinhere.dev is attached to the production deployment but its DNS and canonical discovery bytes are not yet verified"
-  ]
+  "releaseBlockedBy": []
 }
diff --git a/src/apis/pinhere/api-lock.json b/src/apis/pinhere/api-lock.json
index 9449c23..a477b30 100644
--- a/src/apis/pinhere/api-lock.json
+++ b/src/apis/pinhere/api-lock.json
@@ -10,8 +10,8 @@
   "servers": [
     {
       "id": "production",
-      "url": "https://pinhere.dev/api/v1",
-      "description": "Pinhere 生产 API。"
+      "url": "https://pinhere-jasonhzqs-projects.vercel.app/api/v1",
+      "description": "Pinhere 生产 API（Vercel）。"
     }
   ],
   "tags": [
@@ -4246,8 +4246,8 @@
         "description": "Chrome 扩展 OAuth 2.0 Authorization Code + PKCE。",
         "flows": {
           "authorizationCode": {
-            "authorizationUrl": "https://pinhere.dev/extension-authorize",
-            "tokenUrl": "https://pinhere.dev/api/v1/oauth/token",
+            "authorizationUrl": "https://pinhere-jasonhzqs-projects.vercel.app/extension-authorize",
+            "tokenUrl": "https://pinhere-jasonhzqs-projects.vercel.app/api/v1/oauth/token",
             "scopes": {
               "projects:read": "读取项目并按页面 URL 解析项目。",
               "issues:create": "创建缺陷。",
diff --git a/src/apis/pinhere/apiMeta.ts b/src/apis/pinhere/apiMeta.ts
index 494d6e0..3c939de 100644
--- a/src/apis/pinhere/apiMeta.ts
+++ b/src/apis/pinhere/apiMeta.ts
@@ -3,7 +3,7 @@ export const specMeta = {
   hasTags: true,
   url: [
     {
-      url: "https://pinhere.dev/api/v1"
+      url: "https://pinhere-jasonhzqs-projects.vercel.app/api/v1"
     }
   ],
   apis: {
diff --git a/src/runtime.ts b/src/runtime.ts
index 4b06445..23738f9 100644
--- a/src/runtime.ts
+++ b/src/runtime.ts
@@ -1,4 +1,4 @@
-export const DEFAULT_BASE_URL = "https://pinhere.dev/api/v1";
+export const DEFAULT_BASE_URL = "https://pinhere-jasonhzqs-projects.vercel.app/api/v1";
 export const ACCESS_TOKEN_ENV = "PINHERE_ACCESS_TOKEN";
 export const SESSION_COOKIE_ENV = "PINHERE_SESSION_COOKIE";
 export const BASE_URL_ENV = "PINHERE_BASE_URL";
diff --git a/test/unit/canonical-discovery.test.ts b/test/unit/canonical-discovery.test.ts
index 6c4c4d2..9e6f723 100644
--- a/test/unit/canonical-discovery.test.ts
+++ b/test/unit/canonical-discovery.test.ts
@@ -13,7 +13,7 @@ const canonicalHash = createHash("sha256").update(canonicalBytes).digest("hex");
 
 test("verifies a canonical discovery response against the pinned source contract", async () => {
   await expect(verifyCanonicalDiscovery({
-    url: "https://pinhere.dev/.well-known/pontx.json",
+    url: "https://pinhere-jasonhzqs-projects.vercel.app/.well-known/pontx.json",
     sourceBytes,
     expectedCanonicalJsonSha256: canonicalHash,
     fetchImpl: async () => new Response(canonicalBytes, {
@@ -25,7 +25,7 @@ test("verifies a canonical discovery response against the pinned source contract
 
 test("rejects a discovery response with noncanonical bytes", async () => {
   await expect(verifyCanonicalDiscovery({
-    url: "https://pinhere.dev/.well-known/pontx.json",
+    url: "https://pinhere-jasonhzqs-projects.vercel.app/.well-known/pontx.json",
     sourceBytes,
     expectedCanonicalJsonSha256: canonicalHash,
     fetchImpl: async () => new Response("{}", {
diff --git a/test/unit/client.test.ts b/test/unit/client.test.ts
index 8a0ddff..686a0e9 100644
--- a/test/unit/client.test.ts
+++ b/test/unit/client.test.ts
@@ -58,7 +58,7 @@ describe("@pontx/pinhere", () => {
     await expect(client.issues.listIssues({ limit: 10, status: "open" }))
       .resolves.toEqual(payload);
     const [url, init] = fetchMock.mock.calls[0] as [URL, RequestInit];
-    expect(url.toString()).toBe("https://pinhere.dev/api/v1/issues?limit=10&status=open");
+    expect(url.toString()).toBe("https://pinhere-jasonhzqs-projects.vercel.app/api/v1/issues?limit=10&status=open");
     expect(init.method).toBe("GET");
     expect(init.body).toBeUndefined();
     expect(new Headers(init.headers).get("Authorization")).toBe("Bearer fixture-access-token");
@@ -94,7 +94,7 @@ describe("@pontx/pinhere", () => {
       codeVerifier: "fixture-verifier",
     });
     const [url, init] = fetchMock.mock.calls[0] as [URL, RequestInit];
-    expect(url.toString()).toBe("https://pinhere.dev/api/v1/oauth/token");
+    expect(url.toString()).toBe("https://pinhere-jasonhzqs-projects.vercel.app/api/v1/oauth/token");
     expect(new Headers(init.headers).has("Authorization")).toBe(false);
     expect(new Headers(init.headers).has("Cookie")).toBe(false);
     expect(JSON.parse(String(init.body))).toMatchObject({ grantType: "authorization_code" });