George Lambert
16609f5259
15 cases: 13 pass, 2 fail (laptop VeraeTime auth only). Includes unit, public MCP, 20x global idempotent stamp, ApplicationClient, tsnats, site pages, and sibling hostnames.
6.3 KiB
Go MCP cutover — full test report
Run ID: 2026-09-29T162528Z-go-mcp-cutover
Finished (UTC): 2026-09-29T16:28:00Z (approx)
Subject under test: Go verae-mcp-timestamping-server on ns1 replacing Python
Binary: /opt/verae/verae-mcp-timestamping-server-go/bin/verae-mcp-timestamping-server
Git (local): a249564 (+ Caddy fix for mcp.georgelambert.org during this run)
Forgejo: https://git.georgelambert.org/marchon/verae-mcp-timestamping-server-go
Executive summary
| Metric | Value |
|---|---|
| Cases run | 15 |
| Passed | 13 |
| Failed | 2 |
| Go MCP live path | Healthy (127.0.0.1:8000, embedded NATS 127.0.0.1:4229) |
Both failures are laptop-side VeraeTime auth (~/.verae/auth.properties token expired / missing), not Go MCP regressions. Equivalent global idempotency was proven through the live Go MCP path (L3, L12).
Deploy snapshot
| Setting | Value |
|---|---|
| systemd unit | verae-mcp-timestamping.service |
| Drop-ins | go-cutover.conf, verae-ai.conf |
VERAE_MCP_PORT |
8000 |
VERAE_NATS_LISTEN |
127.0.0.1:4229 |
VERAE_MCP_REQUIRE_BEARER |
0 (host-token fallback) |
VERAE_AUTH_PROPERTIES |
/var/lib/verae-mcp/auth.properties |
| Public hosts | mcp.verae.ai, mcp.veraetime.net, mcp.georgelambert.org → 127.0.0.1:8000 |
During this run: mcp.georgelambert.org Caddy upstream was corrected from 10.1.10.128:8000 (502) to 127.0.0.1:8000. A .bak file that caused “ambiguous site definition” was moved out of /etc/caddy/sites/.
Results matrix
| ID | Case | Status | Notes |
|---|---|---|---|
| U1 | Go unit tests (go test ./...) |
PASS | authctx, embednats, ledger, server, tools, veraetime, digest, tsnats |
| U2 | Python client unit tests | PASS | 47 passed |
| U3 | Python server unit tests | PASS | 34 passed |
| L1 | Public MCP suite (mcp.verae.ai) |
PASS | tools/list (7 tools), global hash_report, local stamp+verify, session valid admin |
| L2 | MCP global stamp (unique digest) | PASS | host-token fallback |
| L3 | MCP 20× same digest global stamp | PASS | unique=1, same=True, ~3.92s, CID QmXgqQn8… |
| L4 | Python ApplicationClient via MCP |
PASS | local stamp, verify, hash_report |
| L5 | ApplicationClient direct VeraeTime |
FAIL | HTTP 401 — laptop token missing/expired |
| L6 | CLI verae-timestamp hash |
PASS | 64-hex digest |
| L7 | transaction_log_test.py (laptop → API) |
FAIL | 20× HTTP 401 token expired; unique 0 / same False |
| L8 | mcp.veraetime.net tools/list |
PASS | same Go process |
| L9 | mcp.georgelambert.org MCP |
PASS | after Caddy upstream fix; session OK |
| L10 | pkg/tsnats → embedded NATS :4229 |
PASS | local stamp via SSH tunnel |
| L11 | Static site pages on mcp.verae.ai |
PASS | /, developers, ways, openapi, app, explorer |
| L12 | ns1 loopback 5× global idempotent | PASS | unique=1, same CID QmXgqQn8… |
Case details
U1 — Go unit tests
All packages green. No FAIL lines in logs/u1-go-unit.txt.
U2 / U3 — Python suites
Client 47 passed; server 34 passed. Confirms Application Client and Python GlobalClient libraries still build/test while Go owns production MCP.
L1 — Public MCP suite (https://mcp.verae.ai/mcp)
initialize→Mcp-Session-Idpresent (stateful).tools/list→create_user,hash_report,login,session,signup,stamp,verify.hash_reportglobal on Verae-Debug-Test digest → receiptQmXgqQn8eu6bpBmJ1Fm8xKUePfLREJdghsUkYijStGjVMQ.stampscope=local → receipt issued;verifyOK.session→valid: true,username: admin,role: admin(host-token keeper).
L2 / L3 — Global stamp paths
- L2: fresh digest stamped globally without client Bearer (
REQUIRE_BEARER=0). - L3: 20 sequential global stamps of digest
469e6159…all returned the same CID; elapsed ~3.92s.
L4 — ApplicationClient (MCP transport)
Local stamp → verify → hash_report through https://mcp.verae.ai/mcp succeeded.
L5 / L7 — Laptop direct VeraeTime (expected fail)
These call api.veraetime.net with the developer laptop auth file, which returned 401 Unauthorized: token has expired (L7) / auth required (L5). They do not exercise the ns1 Go process.
Coverage substitute: L3 + L12 prove the same digest idempotency and host-token path via Go MCP.
L6 — CLI hash
verae-timestamp hash produced a valid SHA-256.
L8 / L9 — Sibling public hostnames
mcp.veraetime.net: PASS.mcp.georgelambert.org: initially 502 (wrong upstream); after Caddy fix → PASS.
L10 — Embedded NATS client
pkg/tsnats.Connect(nats://127.0.0.1:14229) (tunnel to ns1 :4229) → Stamp scope=local → receipt ID returned.
L11 — Static docs site
HTTP 200 for index, developers, ways, OpenAPI YAML, app, explorer.
L12 — On-host MCP idempotency
From ns1 to 127.0.0.1:8000 with Host: mcp.verae.ai, 5× global stamp of Verae-Debug-Test → one CID.
Failures — root cause and remediation
| ID | Root cause | Remediation |
|---|---|---|
| L5 | No valid laptop ~/.verae/auth.properties / VERAE_GLOBAL_TOKEN for direct API |
Run login / refresh token on the laptop; not a Go cutover blocker |
| L7 | Same expired laptop token (20× 401 in debug-trace JSON) | Refresh token, or run GlobalClient test on ns1 as verae-mcp; L3/L12 already cover MCP-mediated idempotency |
Artifacts
| Path | Contents |
|---|---|
results.csv |
Machine-readable PASS/FAIL |
logs/ |
Per-case stdout/stderr |
logs/deploy-state.txt |
systemd drop-in snapshot |
logs/l3-20stamp.txt |
20× CID list |
logs/l7-txlog.txt |
Laptop transaction_log output (401) |
Laptop transaction_log_test also wrote:
verae-mcp-timestamping-server/debug-trace/2026-09-29T162648Z-verae-debug-test/
Conclusion
The Go MCP service on ns1 is production-viable for AI MCP clients and NATS bulk clients under the tested cases. Public tool parity, local ledger, global VeraeTime via host-token fallback, embedded NATS, and static docs all passed. Remaining fails are local developer credentials for direct API scripts.
Rollback (reference)
sudo rm /etc/systemd/system/verae-mcp-timestamping.service.d/go-cutover.conf
sudo systemctl daemon-reload
sudo systemctl restart verae-mcp-timestamping.service