setup registers or logs in and writes ~/.verae/auth.properties
without printing the JWT. A caller bearer is used for stamp and
verify instead of the host login. VERAE_MCP_OAUTH=1 serves the
browser account page. site/index.html is the public install guide.
signup calls POST /auth/signup and leaves the stored JWT in place.
login writes the VeraeTime token to the auth properties file and
does not return it. A stored username and password refresh that
token when expires_at is missing or within five minutes.
create_user still requires an admin session.
WhatToChange: recommended-changes/2026-09-21-sample-page/
What-to-Change.md
What-to-Change-To.md
How-to-implement-the-changes.md
What was actually done:
- site/index.html calls stamp, verify, or hash_report over Streamable HTTP.
- README points at the sample page and https://mcp.georgelambert.org/.
What was not done:
- The public host does not reverse-proxy the MCP listener. A page on the internet cannot call 127.0.0.1, and the VeraeTime bearer token stays off an open listener.
WhatToChange: recommended-changes/2026-09-21-docs-and-cors/
What-to-Change.md
What-to-Change-To.md
How-to-implement-the-changes.md
What was actually done:
- Markdown, HTML, and PDF for standards, architecture, API, and the operator guide.
- README points at scripts/build-docs.sh.
- VERAE_MCP_CORS=1 enables CORS and JSON responses on the Streamable HTTP app.
What was not done:
- (none)
