Deployed version

README.md

@@ -111,6 +111,93 @@ node dist/mcplets/media-pool/sns/index.js
 
 ---
 
+## Production Deployment (a2a-demo.mcplet.ai)
+
+Demo is deployed on a VPS (153.126.215.188) with nginx + Let's Encrypt SSL.
+
+### Architecture
+
+```
+External Users
+    ↓ HTTPS
+nginx (443, Let's Encrypt auto-renew)
+    ├── /           → Dashboard :4000
+    ├── /a2a/*      → A2A External Endpoint :4001
+    └── /passkey-api/* → Passkey API :8443
+MCPletA2A (systemd service)
+    ├── Mock Service :5100 (internal only)
+    └── Platform Host → 8 MCPlet servers (stdio)
+```
+
+### Access
+
+- URL: https://a2a-demo.mcplet.ai
+- Basic Auth: `admin` / `m2a69988`
+- A2A API endpoint (`/a2a/*`) does not require Basic Auth (uses Bearer token)
+
+### Service Management
+
+```bash
+# Status / logs
+sudo systemctl status mcplet-a2a
+journalctl -u mcplet-a2a -f
+
+# Restart / stop
+sudo systemctl restart mcplet-a2a
+sudo systemctl stop mcplet-a2a
+```
+
+### Key Files on VPS
+
+| Path | Description |
+|------|-------------|
+| `/home/ubuntu/MCPletA2A/` | Project root |
+| `/home/ubuntu/MCPletA2A/deploy/.env` | API keys (OPENROUTER_API_KEY) |
+| `/home/ubuntu/MCPletA2A/deploy/start-vps.sh` | Startup script (used by systemd) |
+| `/etc/systemd/system/mcplet-a2a.service` | systemd unit file |
+| `/etc/nginx/sites-available/a2a-demo.conf` | nginx reverse proxy config |
+| `/etc/letsencrypt/live/a2a-demo.mcplet.ai/` | SSL certificate (auto-renews) |
+
+### Updating
+
+```bash
+# On local machine: push changes, then on VPS:
+cd /home/ubuntu/MCPletA2A
+git pull
+cd platform_impl && npm run build
+cd ../reference_impl && npm run build
+sudo systemctl restart mcplet-a2a
+```
+
+Or from local machine via rsync:
+
+```bash
+rsync -avz --exclude='node_modules' --exclude='dist' --exclude='.logs' --exclude='.pids' --exclude='.env' \
+  -e ssh . ubuntu@153.126.215.188:/home/ubuntu/MCPletA2A/
+ssh ubuntu@153.126.215.188 "cd /home/ubuntu/MCPletA2A/platform_impl && npm run build && cd ../reference_impl && npm run build && sudo systemctl restart mcplet-a2a"
+```
+
+### Passkey Modes
+
+| Mode | Config | Behavior |
+|------|--------|----------|
+| `https` | Local dev | Opens browser on server machine |
+| `remote` | Production | Approval via Dashboard web UI notification |
+| `demo` | Testing | Auto-approves all passkey ceremonies |
+
+Current production config: `reference_impl/config/reference.yaml` → `passkey.mode: remote`
+
+### SSL Certificate
+
+Managed by certbot. Auto-renews before expiry. To manually check:
+
+```bash
+sudo certbot certificates
+sudo certbot renew --dry-run
+```
+
+---
+
 ## Spec Compliance
 
 | Requirement | Implementation |