signup calls POST /auth/signup and leaves the stored JWT in place.
login writes the VeraeTime token to the auth properties file and
does not return it. A stored username and password refresh that
token when expires_at is missing or within five minutes.
create_user still requires an admin session.
Harden stamp/verify/hash_report so unknown and content-shaped args fail
instead of being ignored; publish additionalProperties=false and cover
with schema/runtime tests. Also keep streamable-http host allowlist.
WhatToChange: recommended-changes/2026-09-21-sample-page/
What-to-Change.md
What-to-Change-To.md
How-to-implement-the-changes.md
What was actually done:
- site/index.html calls stamp, verify, or hash_report over Streamable HTTP.
- README points at the sample page and https://mcp.georgelambert.org/.
What was not done:
- The public host does not reverse-proxy the MCP listener. A page on the internet cannot call 127.0.0.1, and the VeraeTime bearer token stays off an open listener.
WhatToChange: recommended-changes/2026-09-21-docs-and-cors/
What-to-Change.md
What-to-Change-To.md
How-to-implement-the-changes.md
What was actually done:
- Markdown, HTML, and PDF for standards, architecture, API, and the operator guide.
- README points at scripts/build-docs.sh.
- VERAE_MCP_CORS=1 enables CORS and JSON responses on the Streamable HTTP app.
What was not done:
- (none)
WhatToChange: recommended-changes/2026-09-21-event-loop-and-ledger-perms/
What-to-Change.md
What-to-Change-To.md
How-to-implement-the-changes.md
What was actually done:
- Global HTTP stamp and verify run via asyncio.to_thread.
- File ledger saves chmod 0600.
- .gitignore covers coverage, mypy, logs, and editor directories.
What was not done:
- (none)
WhatToChange: /Users/marchon/research/recommended-changes/2026-09-20-forgejo-ci-138
How-to-implement-the-changes.md
What was actually done:
- Add debug-trace/20260920T174456Z-perf-load HTML/JSON
What was not done:
- (none)
WhatToChange: /Users/marchon/research/recommended-changes/2026-09-20-forgejo-ci-138
How-to-implement-the-changes.md
What was actually done:
- perf_stamp_load.py and HTML for 20–10000 unique wait:true stamps
- Standing no-JetStream rule for job-complete (separate ~/.grok/rules)
What was not done:
- 100000-run still in progress at commit time
WhatToChange: /Users/marchon/research/recommended-changes/2026-09-20-forgejo-ci-138
What-to-Change.md
What was actually done:
- GlobalClient POST includes wait:true
What was not done:
- MCP NATS subscriber (HTTP wait is enough for the client)
WhatToChange: /Users/marchon/research/recommended-changes/2026-09-20-forgejo-ci-138
What-to-Change.md
What was actually done:
- Add debug-trace/2026-09-20T165922Z-verae-debug-test (unique CID count 1)
What was not done:
- (none)
