Merge pull request #680 from Ibrahim2595/fix/rossocortex-to-cortex

Refactor: Rename rossocortex → cortex (fix module paths)

Author: mrsabath

.claude/skills/demo.md

@@ -4,8 +4,8 @@ This skill captures knowledge from building, debugging, and running AuthBridge d
 
 ## Repository Context
 
-- **Repo:** `rossoctl/rossocortex` (monorepo)
-- **Container registry:** `ghcr.io/rossoctl/rossocortex/<image-name>`
+- **Repo:** `rossoctl/cortex` (monorepo)
+- **Container registry:** `ghcr.io/rossoctl/cortex/<image-name>`
 - **Agent examples repo:** `rossoctl/examples` (separate repo, images NOT published to GHCR)
 - **Demo guides:** `authbridge/demos/<demo-name>/demo-manual.md` (manual kubectl) and `demo-ui.md` (UI-driven)
 
@@ -35,9 +35,9 @@ docker build -t ghcr.io/rossoctl/examples/<agent>:latest ./a2a/<agent>/
 docker build -t ghcr.io/rossoctl/examples/<tool>:latest ./mcp/<tool>/
 
 # Build AuthBridge sidecar images
-cd rossocortex/authbridge/authproxy
-docker build -f Dockerfile.init -t ghcr.io/rossoctl/rossocortex/proxy-init:latest .
-docker build -f Dockerfile.envoy -t ghcr.io/rossoctl/rossocortex/envoy-with-processor:latest .
+cd cortex/authbridge/authproxy
+docker build -f Dockerfile.init -t ghcr.io/rossoctl/cortex/proxy-init:latest .
+docker build -f Dockerfile.envoy -t ghcr.io/rossoctl/cortex/envoy-with-processor:latest .
 
 # Load into Kind
 kind load docker-image <image> --name rossoctl

.github/codeql/codeql-config.yml

@@ -1,4 +1,4 @@
-name: rossocortex CodeQL config
+name: cortex CodeQL config
 
 queries:
   - uses: security-extended

CLAUDE.md

@@ -1,25 +1,25 @@
 # CLAUDE.md - Rossoctl Extensions
 
-This file provides context for Claude (AI assistant) when working with the `rossocortex` monorepo.
+This file provides context for Claude (AI assistant) when working with the `cortex` monorepo.
 
 ## AI Assistant Instructions
 
 - **Use `Assisted-By` for attribution** — never add `Co-Authored-By`, `Generated with Claude Code`, or similar trailers. See [Commit Attribution Policy](#commit-attribution-policy) below.
 
 ## Repository Overview
 
-**rossocortex** contains Kubernetes security extensions for the [Rossoctl](https://github.com/rossoctl/rossoctl) ecosystem. It provides **zero-trust authentication** for Kubernetes workloads through transparent token exchange and dynamic Keycloak client registration using SPIFFE/SPIRE identities.
+**cortex** contains Kubernetes security extensions for the [Rossoctl](https://github.com/rossoctl/rossoctl) ecosystem. It provides **zero-trust authentication** for Kubernetes workloads through transparent token exchange and dynamic Keycloak client registration using SPIFFE/SPIRE identities.
 
 The sidecar injection webhook lives in a separate repo: [rossoctl/operator](https://github.com/rossoctl/operator).
 
-**GitHub:** `github.com/rossoctl/rossocortex`
-**Container registry:** `ghcr.io/rossoctl/rossocortex/<image-name>`
+**GitHub:** `github.com/rossoctl/cortex`
+**Container registry:** `ghcr.io/rossoctl/cortex/<image-name>`
 **License:** Apache 2.0
 
 ## Top-Level Directory Structure
 
 ```
-rossocortex/
+cortex/
 ├── authbridge/               # Authentication bridge components
 │   ├── authlib/              #   Shared auth building blocks (Go module)
 │   │   ├── validation/       #     JWKS-backed JWT verifier
@@ -163,7 +163,7 @@ lowercase prefixes. Use `Fix:` / `Feat:` / `Docs:` in PR titles.
 
 ## Container Images
 
-All images are pushed to `ghcr.io/rossoctl/rossocortex/` from
+All images are pushed to `ghcr.io/rossoctl/cortex/` from
 `.github/workflows/build.yaml`:
 
 | Image | Source | Description |
@@ -271,7 +271,7 @@ cd authbridge && podman build -f cmd/authbridge-proxy/Dockerfile \
 
 1. Add entry to `.github/workflows/build.yaml` matrix (`image_config` array)
 2. Provide `name`, `context`, and `dockerfile` fields
-3. Image will be pushed to `ghcr.io/rossoctl/rossocortex/<name>`
+3. Image will be pushed to `ghcr.io/rossoctl/cortex/<name>`
 
 ## Code Style and Conventions
 

CONTRIBUTING.md

@@ -25,8 +25,8 @@ Comment `/claim` on an issue to have it automatically assigned to you. Issues la
 
 ```bash
 # Clone the repository
-git clone https://github.com/rossoctl/rossocortex.git
-cd rossocortex
+git clone https://github.com/rossoctl/cortex.git
+cd cortex
 
 # Install pre-commit hooks
 pre-commit install

LOCAL_TESTING_GUIDE.md

@@ -1,6 +1,6 @@
 # Local Testing Guide for JWT-SVID Authentication
 
-> **⚠️ This guide is stale after rossocortex#411.** It was written
+> **⚠️ This guide is stale after cortex#411.** It was written
 > for the pre-#411 multi-sidecar shape (separate `client-registration`,
 > `envoy-with-processor`, and standalone `spiffe-helper` containers) and
 > several of its YAML examples reference images that no longer publish.
@@ -26,7 +26,7 @@ This guide walks you through testing JWT-SVID authentication using local images
 **CRITICAL**: You MUST run the `./local-build-and-test.sh` script to build all required images. Do NOT build images individually with `docker build` or `podman build` commands, as this will miss critical images like `spiffe-idp-setup:local` (located in the rossoctl repo).
 
 The script:
-- Builds images from **both** rossoctl and rossocortex repositories
+- Builds images from **both** rossoctl and cortex repositories
 - Automatically detects Docker vs Podman
 - Loads all images into your Kind cluster
 - Ensures consistent image tags and pull policies
@@ -35,7 +35,7 @@ The script:
 
 - Docker or Podman running
 - Kind CLI installed
-- Both `rossoctl` and `rossocortex` repositories cloned
+- Both `rossoctl` and `cortex` repositories cloned
 
 ## Step 0: Create Kind Cluster
 
@@ -68,7 +68,7 @@ kubectl cluster-info --context kind-rossoctl-dev
 The `local-build-and-test.sh` script is the **only supported way** to build local images for testing. It builds images from both repositories and ensures everything is loaded correctly.
 
 ```bash
-cd rossocortex
+cd cortex
 
 # Make the script executable (first time only)
 chmod +x local-build-and-test.sh
@@ -87,10 +87,10 @@ export KIND_EXPERIMENTAL_PROVIDER=podman  # Only needed for Podman
 **From rossoctl repo** (critical - often missed!):
 - `ghcr.io/rossoctl/rossoctl/spiffe-idp-setup:local` - Configures SPIFFE Identity Provider in Keycloak
 
-**From rossocortex repo**:
-- `ghcr.io/rossoctl/rossocortex/client-registration:local` - Registers agents as Keycloak clients
-- `ghcr.io/rossoctl/rossocortex/envoy-with-processor:local` - Envoy proxy with token exchange
-- `ghcr.io/rossoctl/rossocortex/proxy-init:local` - iptables initialization
+**From cortex repo**:
+- `ghcr.io/rossoctl/cortex/client-registration:local` - Registers agents as Keycloak clients
+- `ghcr.io/rossoctl/cortex/envoy-with-processor:local` - Envoy proxy with token exchange
+- `ghcr.io/rossoctl/cortex/proxy-init:local` - iptables initialization
 
 ### Common Mistakes to Avoid:
 
@@ -105,7 +105,7 @@ export KIND_EXPERIMENTAL_PROVIDER=podman  # Only needed for Podman
 
 ## Step 2: Install Rossoctl with Ansible
 
-**IMPORTANT:** For federated-JWT testing with local images, use the unified `federated-jwt-values.yaml` overlay file from rossocortex.
+**IMPORTANT:** For federated-JWT testing with local images, use the unified `federated-jwt-values.yaml` overlay file from cortex.
 
 The ansible installer will detect the existing `rossoctl-dev` cluster and install into it:
 
@@ -116,7 +116,7 @@ cd rossoctl
 # Install with dev base values + TWO overlays (deps local images + extensions federated-jwt)
 # --env dev                                → Loads dev_values.yaml (base Kind development config)
 # --env-file deployments/envs/...         → Local images for rossoctl-deps (SPIRE, Keycloak, etc.)
-# --env-file ../rossocortex/...    → Federated-jwt + local images for rossocortex
+# --env-file ../cortex/...    → Federated-jwt + local images for cortex
 deployments/ansible/run-install.sh --env dev \
   --env-file deployments/envs/dev_values_local_images.yaml \
   --env-file deployments/envs/dev_values_federated-jwt.yaml
@@ -158,7 +158,7 @@ This installation will:
 ## Step 3: Verify SPIRE and Keycloak
 
 ```bash
-cd rossocortex
+cd cortex
 
 chmod +x verify-spire-keycloak.sh
 ./verify-spire-keycloak.sh
@@ -246,7 +246,7 @@ spec:
         - name: certs
           mountPath: /opt
       - name: client-registration
-        image: ghcr.io/rossoctl/rossocortex/client-registration:local
+        image: ghcr.io/rossoctl/cortex/client-registration:local
         imagePullPolicy: Never
         command:
           - /bin/sh

Makefile

@@ -1,4 +1,4 @@
-# Root Makefile for rossocortex monorepo
+# Root Makefile for cortex monorepo
 # Orchestrates linting and formatting across all sub-projects
 
 .PHONY: lint fmt pre-commit build-proxy-init help

README.md

@@ -20,8 +20,8 @@ See the [AuthBridge README](./authbridge/README.md) for architecture details and
 
 ## Container Images
 
-All images are published to `ghcr.io/rossoctl/rossocortex/`. After
-rossocortex#411 the unified binary was split into three
+All images are published to `ghcr.io/rossoctl/cortex/`. After
+cortex#411 the unified binary was split into three
 mode-specific combined images, and the per-component sidecars
 (`client-registration`, standalone `spiffe-helper`) were retired:
 

aiac/docs/specs/demo/github-agent.md

@@ -42,7 +42,7 @@ RFC-8693 token exchange, and the `github-tool` MitM swaps the exchanged token fo
 - Existing (issue-only) agent card: [`../../analysis/github-agent-card.json`](../../analysis/github-agent-card.json)
 - `github-tool` MCP tool catalog (44 tools): [`../../analysis/github-mcp-tools-summary.json`](../../analysis/github-mcp-tools-summary.json)
 - Reference agent: `agent-examples/a2a/git_issue_agent/`
-- Reference deployment: `rossocortex/authbridge/demos/github-issue/k8s/`
+- Reference deployment: `cortex/authbridge/demos/github-issue/k8s/`
 - **Sibling tool spec (UC-1 onboarding fixture):** [`github-tool.md`](github-tool.md) — a simplified
   4-tool stub (`source-read`, `source-write`, `issues-read`, `issues-write`) deployed as Service
   `github-tool`. **This is not the tool this agent connects to.** The agent connects to the production

aiac/docs/specs/demo/github-tool.md

@@ -68,7 +68,7 @@ Phase 1 only discovers and evaluates them.
 - Scenario fixture (`TOOL_SCOPES`): [`../../../test/integration/scenario.py`](../../../test/integration/scenario.py)
 - Scenario spec: [`../integration-test/policy-pipeline.md`](../integration-test/policy-pipeline.md)
 - Sibling agent spec: [`github-agent.md`](github-agent.md)
-- Reference deployment: `rossocortex/authbridge/demos/github-issue/k8s/`
+- Reference deployment: `cortex/authbridge/demos/github-issue/k8s/`
 
 ---
 

authbridge/README.md

@@ -26,7 +26,7 @@ The shared auth library at [`authlib/`](./authlib/) contains the building blocks
 
 ## Architecture (Operator-Injected)
 
-The following describes the operator-injected sidecar deployment. After rossocortex#411 each mode is served by its own combined image (one container per pod, with `spiffe-helper` bundled inside and gated by `SPIRE_ENABLED`). The legacy `authbridge-unified`, `authbridge-light`, `envoy-with-processor`, and standalone `client-registration` / `spiffe-helper` sidecars are gone.
+The following describes the operator-injected sidecar deployment. After cortex#411 each mode is served by its own combined image (one container per pod, with `spiffe-helper` bundled inside and gated by `SPIRE_ENABLED`). The legacy `authbridge-unified`, `authbridge-light`, `envoy-with-processor`, and standalone `client-registration` / `spiffe-helper` sidecars are gone.
 
 ### What AuthBridge Does
 
@@ -149,7 +149,7 @@ flowchart TB
 
 ### Workload Pod
 
-After rossocortex#411 a workload pod has the application
+After cortex#411 a workload pod has the application
 container plus a single combined AuthBridge sidecar. In
 envoy-sidecar mode it also has a one-shot `proxy-init` init
 container; in proxy-sidecar mode (the cluster default) it does
@@ -432,7 +432,7 @@ To make a plugin excludable:
 
 package main
 
-import _ "github.com/rossoctl/rossocortex/authbridge/authlib/plugins/<name>"
+import _ "github.com/rossoctl/cortex/authbridge/authlib/plugins/<name>"
 ```
 
 2. Remove the corresponding `_ "...plugins/<name>"` import from that binary's `main.go`.