Author	SHA1	Message	Date
George Lambert	369f9210bd	fix(auth): clear public write errors and Grok client path ... Public DEC-654 still requires a caller bearer; anonymous session now returns that guidance as a tool error instead of silent valid:false. Error text names JWT and API key, Grok bearer_token_file, and local stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key. Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.	2026-10-12 14:09:22 -04:00
Cursor Agent	deb0e251de	Send global stamps as a verae-meta-git/1 history. ... Optional metadata or restamp builds the same commit history as node-red. A call that omits both stays digest-only with restamp false. Local and shared stamps reject metadata.	2026-10-11 05:37:24 +00:00
Grok Bot	ec899f5e11	Public server: anonymous verify/hash_report never rate limited (DEC-660); stamp_batch tool charged per item with the caller's key (DEC-659); 402 balance message passed through (DEC-658)	2026-10-10 15:26:37 -04:00
George Lambert	10c8634a53	D write-only lockdown (DEC-654): public HTTP server needs the caller's own Verae key/OAuth bearer for stamp (any scope), signup, create_user, session; login refused; no host-login fallback for writes; anonymous verify/hash_report kept, rate limited 30/min per client (burst 15), 600/min overall	2026-10-10 13:06:57 -04:00
George Lambert	d379931bd1	feat: MCP Streamable HTTP server with full tool set ... Wire go-sdk Streamable HTTP at /mcp with stamp, verify, hash_report, signup, login, session, create_user. Route global/CID to VeraeTime and local|shared to FileLedger; resolve Authorization bearer via authctx. Flags/env for transport, host, port, require-bearer, URLs, ledger path.	2026-09-29 12:07:44 -04:00