- Public signup no longer requires a caller bearer (POST /auth/signup)
- create_user remains admin-only (POST /auth/users)
- Optional VERAE_MCP_EDGE_URL bills global stamps via zap.verae.ai
- Clearer public auth errors and instructions for Grok/clients
Public DEC-654 still requires a caller bearer; anonymous session now
returns that guidance as a tool error instead of silent valid:false.
Error text names JWT and API key, Grok bearer_token_file, and local
stdio. BearerFromRequest also accepts X-Api-Key / X-Verae-Key.
Document Grok stdio vs public URL; add scripts/sync-mcp-bearer.sh.
scripts/deploy-138.sh tests with Go 1.26.9, swaps the live binary, and rolls back if port 8000 stops answering. Port 0 in the embedded NATS listener now picks an ephemeral port so the test can run while 4222 is already taken.
Optional metadata or restamp builds the same commit history as node-red. A call that omits both stays digest-only with restamp false. Local and shared stamps reject metadata.
15 cases: 13 pass, 2 fail (laptop VeraeTime auth only). Includes unit,
public MCP, 20x global idempotent stamp, ApplicationClient, tsnats,
site pages, and sibling hostnames.
Add deploy/verae-mcp-timestamping-go.service (PORT=8001, NATS :4223,
REQUIRE_BEARER=0). Add scripts/parity_smoke.sh for tools/list against
:8000 and :8001. Does not install on ns1.
Start in-process nats-server on VERAE_NATS_LISTEN (default 127.0.0.1:4223;
empty disables). Queue-subscribe verae.ts.request|verify|hash.report with
ledger/veraetime routing and authctx.Resolve from authorization/access_token.
Publish verae.ts.completed on core NATS only (no JetStream). Wire embed into
main alongside Streamable HTTP; stdio MCP via go-sdk StdioTransport.
HTTPS GlobalClient (Stamp/Verify/HashReport/Signup/Login/Session/CreateUser)
with Fake RoundTripper tests; auth.properties read/write; Keeper refresh ~60s
before expiry or VERAE_GLOBAL_TOKEN; authctx.Resolve for require-bearer vs host fallback.
MCP remains the AI tool surface. Importable pkg/tsnats covers Stamp,
Verify, HashReport over core NATS plus SubscribeCompleted; MCP optional
upstream reuses the same package. No JetStream for job-complete.
Sibling to the Python verae-mcp-timestamping-server. Full tool parity,
FileLedger, optional NATS (no JetStream for job-complete), official
go-sdk Streamable HTTP, shadow on :8001 then cutover checklist.
