Author	SHA1	Message	Date
George Lambert	369f9210bd	fix(auth): clear public write errors and Grok client path ... Public DEC-654 still requires a caller bearer; anonymous session now returns that guidance as a tool error instead of silent valid:false. Error text names JWT and API key, Grok bearer_token_file, and local stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key. Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.	2026-10-12 14:09:22 -04:00
Grok Bot	ec899f5e11	Public server: anonymous verify/hash_report never rate limited (DEC-660); stamp_batch tool charged per item with the caller's key (DEC-659); 402 balance message passed through (DEC-658)	2026-10-10 15:26:37 -04:00
George Lambert	10c8634a53	D write-only lockdown (DEC-654): public HTTP server needs the caller's own Verae key/OAuth bearer for stamp (any scope), signup, create_user, session; login refused; no host-login fallback for writes; anonymous verify/hash_report kept, rate limited 30/min per client (burst 15), 600/min overall	2026-10-10 13:06:57 -04:00