docs: HTML and PDF set plus optional CORS

WhatToChange: recommended-changes/2026-09-21-docs-and-cors/
  What-to-Change.md
  What-to-Change-To.md
  How-to-implement-the-changes.md

What was actually done:
- Markdown, HTML, and PDF for standards, architecture, API, and the operator guide.
- README points at scripts/build-docs.sh.
- VERAE_MCP_CORS=1 enables CORS and JSON responses on the Streamable HTTP app.

What was not done:
- (none)

recommended-changes/2026-09-21-docs-and-cors/Done-and-not-done.md

@@ -0,0 +1,11 @@
+# Done and not done
+
+WhatToChange: recommended-changes/2026-09-21-docs-and-cors/
+
+What was actually done:
+- Markdown, HTML, and PDF for standards, architecture, API, and the operator guide.
+- README points at scripts/build-docs.sh.
+- VERAE_MCP_CORS=1 enables CORS on the Streamable HTTP app.
+
+What was not done:
+- (none)

recommended-changes/2026-09-21-docs-and-cors/How-to-implement-the-changes.md

@@ -0,0 +1,8 @@
+# How to implement the changes:
+
+Against the pin in git-versions.md (dirty tree).
+
+1. Add `docs/standards.md`, `docs/architecture.md`, `docs/api.md`, `docs/operator-guide.md`.
+2. Add `scripts/build-docs.sh` (pandoc HTML and PDF).
+3. Link the build from `README.md`.
+4. When `VERAE_MCP_CORS=1`, run uvicorn on `streamable_http_app()` with `CORSMiddleware`.

recommended-changes/2026-09-21-docs-and-cors/README.md

@@ -0,0 +1,25 @@
+# Recommended changes: docs and CORS
+
+Second review, 2026-09-21. Pins are in git-versions.md.
+
+## Install
+
+```sh
+cd /Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server
+uv sync --group dev
+```
+
+## Usage
+
+```sh
+less recommended-changes/2026-09-21-docs-and-cors/What-to-Change.md
+bash scripts/build-docs.sh
+```
+
+## Contributing
+
+Questions: this research workspace. PRs welcome.
+
+## License
+
+UNLICENSED © George Lambert

recommended-changes/2026-09-21-docs-and-cors/What-to-Change-To.md

@@ -0,0 +1,6 @@
+# What to Change To:
+
+| Component | Target behavior | Acceptance criteria | Constraints |
+| --- | --- | --- | --- |
+| `docs/*.md` plus HTML and PDF | Operator guide, architecture, tool API, and standards | `bash scripts/build-docs.sh` writes four HTML files and four PDFs, each PDF larger than 10 KB | Facts match the code. Do not document JetStream for job-complete |
+| `VERAE_MCP_CORS=1` | Starlette CORS allows the sample page to see the session header | Default `mcp.run` path unchanged when the variable is unset | Bind stays `127.0.0.1` unless the operator sets `VERAE_MCP_HOST` |

recommended-changes/2026-09-21-docs-and-cors/What-to-Change.md

@@ -0,0 +1,13 @@
+# What to Change:
+
+Reviewed after `60bcefb`. Pytest 14 passed. The server behavior from the first pack is in place. Operators still had only a short README.
+
+## What is working
+
+- Hash-only tools, file ledger mode 0600, global HTTP off the event loop.
+- `debug-trace/` remains the live stamp record and stays in git.
+
+| Component | Problem | Evidence | Severity | Type |
+| --- | --- | --- | --- | --- |
+| README only | No architecture, tool reference, or standards a reader can print | `docs/` did not exist before this pack | high | doc drift |
+| Streamable HTTP | Browser sample on another origin cannot read `mcp-session-id` | `server.py` called `mcp.run` with no CORS middleware | medium | missing gate |

recommended-changes/2026-09-21-docs-and-cors/git-versions.json

@@ -0,0 +1,12 @@
+[
+  {
+    "path": "/Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server",
+    "remote": "",
+    "branch": "main",
+    "head": "60bcefbca2dc2c3e776bf54a8d0690a0e3d86e8f",
+    "short": "60bcefb",
+    "dirty": true,
+    "describe": "60bcefb-dirty",
+    "porcelain": "M README.md\n M src/verae_mcp_timestamping_server/server.py\n?? docs/\n?? scripts/build-docs.sh"
+  }
+]

recommended-changes/2026-09-21-docs-and-cors/git-versions.md

@@ -0,0 +1,6 @@
+# git-versions
+
+Pins at pack creation. Dirty means uncommitted files existed.
+
+- `/Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server` `main` `60bcefb` (dirty) `60bcefb-dirty`
+  - HEAD: `60bcefbca2dc2c3e776bf54a8d0690a0e3d86e8f`