Author	SHA1	Message	Date
George Lambert	d49c51c349	feat: single-billing edge path for MCP + open public signup ... - Public signup no longer requires a caller bearer (POST /auth/signup) - create_user remains admin-only (POST /auth/users) - Optional VERAE_MCP_EDGE_URL bills global stamps via zap.verae.ai - Clearer public auth errors and instructions for Grok/clients	2026-10-12 14:59:31 -04:00
George Lambert	10c8634a53	D write-only lockdown (DEC-654): public HTTP server needs the caller's own Verae key/OAuth bearer for stamp (any scope), signup, create_user, session; login refused; no host-login fallback for writes; anonymous verify/hash_report kept, rate limited 30/min per client (burst 15), 600/min overall	2026-10-10 13:06:57 -04:00
George Lambert	a2495649ba	fix: use stateful MCP sessions for public clients ... Stateless mode omitted Mcp-Session-Id and broke initialize→tools/call flows used by public mcp.verae.ai clients.	2026-09-29 12:19:02 -04:00
George Lambert	e04fe6e2c4	feat: embedded NATS with VeraeTime handlers and stdio MCP ... Start in-process nats-server on VERAE_NATS_LISTEN (default 127.0.0.1:4223; empty disables). Queue-subscribe verae.ts.request|verify|hash.report with ledger/veraetime routing and authctx.Resolve from authorization/access_token. Publish verae.ts.completed on core NATS only (no JetStream). Wire embed into main alongside Streamable HTTP; stdio MCP via go-sdk StdioTransport.	2026-09-29 12:11:47 -04:00
George Lambert	d379931bd1	feat: MCP Streamable HTTP server with full tool set ... Wire go-sdk Streamable HTTP at /mcp with stamp, verify, hash_report, signup, login, session, create_user. Route global/CID to VeraeTime and local|shared to FileLedger; resolve Authorization bearer via authctx. Flags/env for transport, host, port, require-bearer, URLs, ledger path.	2026-09-29 12:07:44 -04:00