setup registers or logs in and writes ~/.verae/auth.properties
without printing the JWT. A caller bearer is used for stamp and
verify instead of the host login. VERAE_MCP_OAUTH=1 serves the
browser account page. site/index.html is the public install guide.
A global stamp now polls status processing the same way as pending
and returns only the completed result. The debug trace for
Verae-Debug-Test records one receipt id.
signup calls POST /auth/signup and leaves the stored JWT in place.
login writes the VeraeTime token to the auth properties file and
does not return it. A stored username and password refresh that
token when expires_at is missing or within five minutes.
create_user still requires an admin session.
Harden stamp/verify/hash_report so unknown and content-shaped args fail
instead of being ignored; publish additionalProperties=false and cover
with schema/runtime tests. Also keep streamable-http host allowlist.
WhatToChange: /Users/marchon/research/recommended-changes/2026-09-20-forgejo-ci-138
What-to-Change.md
What was actually done:
- GlobalClient POST includes wait:true
What was not done:
- MCP NATS subscriber (HTTP wait is enough for the client)
