# annoNet

Arrowstack production deployment for the uploaded `annonet-arrowstack-ready.zip` source of truth.

The Docker image preserves the supplied production layout and applies one minimal
machine-auth override before building:

- Keycloak token signature, issuer and expiry are verified by the supplied OIDC verifier.
- The token's actual authorized party/client identity must be `annonet-mcp`; audience alone is not enough.
- The required machine role remains `annonet-mcp`.
- annoNet org/team/agent authority comes only from `ANNONET_MCP_ORG_ID`,
  `ANNONET_MCP_TEAM_IDS` and `ANNONET_MCP_AGENT_NAME`.
- `ANNONET_MCP_TOKEN` remains optional for local/bootstrap compatibility and is empty in production.

Runtime port: `8787`

Readiness: `/api/health/ready`