Annotation overlay gallery

Slim HTTP + SPA for per-volume AnnotationCrops PNG + 1-bit mask review. The gallery image does not install Nornir (no nornir-buildmanager, imageregistration, CuPy, or torch). Export, SAM2 scoring, and weekly refresh run on nornir:prod / cursor-dev against the same registry.

Start:

.\nornir-docker\start-annotation-gallery.ps1
docker compose -f nornir-docker/compose.annotation-gallery.yaml up -d --build

Then open http://127.0.0.1:8090

Run env template: nornir-docker/example.annotation-gallery.run.env → <NORNIR_DOCKER_USER_ROOT>\Run\nornir-annotation-gallery\annotation-gallery.run.env.

Registry

GALLERY_VOLUME_DIR (in-container /gallery-volumes) is a folder of volume-root links. The child name is the Identity volume name; the child target is the volume root (/storage4/RC2), not AnnotationCrops. The gallery reads {name}/AnnotationCrops/. Identity never stores filesystem paths.

ln -s /storage4/RC2 /gallery-volumes/RC2

Bind the registry and the storage root so those links resolve. GALLERY_VOLUME_DIR_HOST and GALLERY_STORAGE_HOST are compose bind sources.

Permissions

GALLERY_IDENTITY_MODE=stub (default) uses GALLERY_STUB_ROLE=read|review. oidc talks to https://identity.codepharm.net:5001 (auth) and https://identity.codepharm.net:6001 (API). App mapping is Read vs Review per volume; names are probed from Identity (GALLERY_READ_PERMISSION / GALLERY_REVIEW_PERMISSION).

Weekly export

Do not spawn nornir-build from a gallery HTTP request. Use nornir-docker/annotation-gallery/refresh-export.sh on nornir:prod cron with the same registry.