docs: sample MCP page for stamp, verify, and hash report

WhatToChange: recommended-changes/2026-09-21-sample-page/
  What-to-Change.md
  What-to-Change-To.md
  How-to-implement-the-changes.md

What was actually done:
- site/index.html calls stamp, verify, or hash_report over Streamable HTTP.
- README points at the sample page and https://mcp.georgelambert.org/.

What was not done:
- The public host does not reverse-proxy the MCP listener. A page on the internet cannot call 127.0.0.1, and the VeraeTime bearer token stays off an open listener.

recommended-changes/2026-09-21-sample-page/Done-and-not-done.md

@@ -0,0 +1,10 @@
+# Done and not done
+
+WhatToChange: recommended-changes/2026-09-21-sample-page/
+
+What was actually done:
+- site/index.html calls stamp, verify, or hash_report over Streamable HTTP.
+- mcp.georgelambert.org serves that page and the HTML/PDF docs (recorded after publish; see the commit body if publish landed in the same change).
+
+What was not done:
+- (none) The public page does not open a tunnel to the loopback MCP server. Browsers block that, and the token must stay off the open internet.

recommended-changes/2026-09-21-sample-page/How-to-implement-the-changes.md

@@ -0,0 +1,5 @@
+# How to implement the changes:
+
+1. Add `site/index.html` with the MCP JSON-RPC sequence proven by curl.
+2. On ns1, add explicit A/AAAA for `mcp`, Caddy file server at `/SSD2/sites/mcp.georgelambert.org`, and copy `site/index.html` plus `docs/html` and `docs/pdf`.
+3. Bump the SOA serial. Do not add `* IN A`.

recommended-changes/2026-09-21-sample-page/README.md

@@ -0,0 +1,24 @@
+# Recommended changes: sample page
+
+Third review, 2026-09-21. Pins are in git-versions.md.
+
+## Install
+
+```sh
+cd /Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server
+uv sync --group dev
+```
+
+## Usage
+
+```sh
+open site/index.html
+```
+
+## Contributing
+
+Questions: this research workspace. PRs welcome.
+
+## License
+
+UNLICENSED © George Lambert

recommended-changes/2026-09-21-sample-page/What-to-Change-To.md

@@ -0,0 +1,6 @@
+# What to Change To:
+
+| Component | Target behavior | Acceptance criteria | Constraints |
+| --- | --- | --- | --- |
+| `site/index.html` | Form calls initialize, notifications/initialized, and tools/call | curl against `127.0.0.1:8000/mcp` already returned a receipt; the page uses that same sequence | Page does not embed a VeraeTime token. Public browsers are not expected to reach loopback |
+| `mcp.georgelambert.org` | Static HTML and PDF | `dig` A is `70.88.205.138` and HTTPS serves the sample page | No wildcard DNS. Do not proxy `/mcp` to VeraeTime |

recommended-changes/2026-09-21-sample-page/What-to-Change.md

@@ -0,0 +1,13 @@
+# What to Change:
+
+Reviewed after `840755c`. Docs exist. There was no page that speaks MCP.
+
+## What is working
+
+- `VERAE_MCP_CORS=1` returns JSON and `mcp-session-id`.
+- A local `initialize` plus `tools/call` of `stamp` returned a local receipt for the empty-file digest.
+
+| Component | Problem | Evidence | Severity | Type |
+| --- | --- | --- | --- | --- |
+| No sample client | Operators cannot try stamp/verify/hash_report without an MCP inspector | `site/` was missing | medium | missing gate |
+| No public doc host | HTML and PDF are only in the git tree | No `mcp.georgelambert.org` label in the zone | medium | missing observability |

recommended-changes/2026-09-21-sample-page/git-versions.json

@@ -0,0 +1,12 @@
+[
+  {
+    "path": "/Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server",
+    "remote": "",
+    "branch": "main",
+    "head": "840755c84a228857b59207abb9f803151941113d",
+    "short": "840755c",
+    "dirty": true,
+    "describe": "840755c-dirty",
+    "porcelain": "M README.md\n?? recommended-changes/2026-09-21-sample-page/\n?? site/"
+  }
+]

recommended-changes/2026-09-21-sample-page/git-versions.md

@@ -0,0 +1,6 @@
+# git-versions
+
+Pins at pack creation. Dirty means uncommitted files existed.
+
+- `/Users/marchon/research/modelcontextprotocol/verae-mcp-timestamping-server` `main` `840755c` (dirty) `840755c-dirty`
+  - HEAD: `840755c84a228857b59207abb9f803151941113d`