annoNet

Arrowstack production deployment for the uploaded annonet-arrowstack-ready.zip source of truth.

The Docker image preserves the supplied production layout and applies one minimal machine-auth override before building:

Keycloak token signature, issuer and expiry are verified by the supplied OIDC verifier.
The token's actual authorized party/client identity must be annonet-mcp; audience alone is not enough.
The required machine role remains annonet-mcp.
annoNet org/team/agent authority comes only from ANNONET_MCP_ORG_ID, ANNONET_MCP_TEAM_IDS and ANNONET_MCP_AGENT_NAME.
ANNONET_MCP_TOKEN remains optional for local/bootstrap compatibility and is empty in production.

Runtime port: 8787

Readiness: /api/health/ready