⚠️ Rename Kagenti → Rossoctl across kagenti-extensions (→ rossocortex)

.claude/skills/demo.md

@@ -4,9 +4,9 @@ This skill captures knowledge from building, debugging, and running AuthBridge d
 
 ## Repository Context
 
-- **Repo:** `kagenti/kagenti-extensions` (monorepo)
-- **Container registry:** `ghcr.io/kagenti/kagenti-extensions/<image-name>`
-- **Agent examples repo:** `kagenti/agent-examples` (separate repo, images NOT published to GHCR)
+- **Repo:** `rossoctl/rossocortex` (monorepo)
+- **Container registry:** `ghcr.io/rossoctl/rossocortex/<image-name>`
+- **Agent examples repo:** `rossoctl/examples` (separate repo, images NOT published to GHCR)
 - **Demo guides:** `authbridge/demos/<demo-name>/demo-manual.md` (manual kubectl) and `demo-ui.md` (UI-driven)
 
 ## Demo Directory Convention
@@ -27,20 +27,20 @@ demos/<demo-name>/
 
 ## Building and Loading Images for Kind
 
-Agent/tool images from `kagenti/agent-examples` must be built locally and loaded into Kind:
+Agent/tool images from `rossoctl/examples` must be built locally and loaded into Kind:
 
 ```bash
 # Build from agent-examples repo
-docker build -t ghcr.io/kagenti/agent-examples/<agent>:latest ./a2a/<agent>/
-docker build -t ghcr.io/kagenti/agent-examples/<tool>:latest ./mcp/<tool>/
+docker build -t ghcr.io/rossoctl/examples/<agent>:latest ./a2a/<agent>/
+docker build -t ghcr.io/rossoctl/examples/<tool>:latest ./mcp/<tool>/
 
 # Build AuthBridge sidecar images
-cd kagenti-extensions/authbridge/authproxy
-docker build -f Dockerfile.init -t ghcr.io/kagenti/kagenti-extensions/proxy-init:latest .
-docker build -f Dockerfile.envoy -t ghcr.io/kagenti/kagenti-extensions/envoy-with-processor:latest .
+cd rossocortex/authbridge/authproxy
+docker build -f Dockerfile.init -t ghcr.io/rossoctl/rossocortex/proxy-init:latest .
+docker build -f Dockerfile.envoy -t ghcr.io/rossoctl/rossocortex/envoy-with-processor:latest .
 
 # Load into Kind
-kind load docker-image <image> --name kagenti
+kind load docker-image <image> --name rossoctl
 ```
 
 Use fully qualified image names in Dockerfiles (e.g., `docker.io/library/golang:1.24.9-bookworm`) to avoid Podman/Buildah "short-name resolution enforced" errors in Shipwright builds.
@@ -150,12 +150,12 @@ kubectl logs deployment/<agent> -n <ns> -c envoy-proxy 2>&1 | grep "\[Token Exch
 ### Client Registration
 
 ```bash
-kubectl logs deployment/<agent> -n <ns> -c kagenti-client-registration
+kubectl logs deployment/<agent> -n <ns> -c rossoctl-client-registration
 
 # Query Keycloak (use --data-urlencode for SPIFFE IDs)
 curl -s -H "Authorization: Bearer $ADMIN_TOKEN" \
   --data-urlencode "clientId=spiffe://localtest.me/ns/<ns>/sa/<sa>" \
-  --get "http://keycloak.localtest.me:8080/admin/realms/kagenti/clients" | jq '.[0].clientId'
+  --get "http://keycloak.localtest.me:8080/admin/realms/rossoctl/clients" | jq '.[0].clientId'
 ```
 
 ## Demo Deployment Checklist

.claude/skills/orchestrate/SKILL.md

@@ -63,15 +63,15 @@ What was provided?
 
 ### Route logic
 
-1. **`/orchestrate <repo-path>`** -- If the path points to a git repository, derive the target name from the directory basename. Check `/tmp/kagenti/orchestrate/<target>/` for existing state. If no scan report exists, invoke `orchestrate:scan`. If scan exists but no plan, invoke `orchestrate:plan`. If both exist, determine the next incomplete phase and invoke it.
+1. **`/orchestrate <repo-path>`** -- If the path points to a git repository, derive the target name from the directory basename. Check `/tmp/rossoctl/orchestrate/<target>/` for existing state. If no scan report exists, invoke `orchestrate:scan`. If scan exists but no plan, invoke `orchestrate:plan`. If both exist, determine the next incomplete phase and invoke it.
 
 2. **`/orchestrate <phase>`** -- Validate that `scan-report.md` and `plan.md` exist for the current target. If missing, instruct the user to run `/orchestrate <repo-path>` first. Otherwise invoke the requested phase skill directly (e.g., `orchestrate:precommit`).
 
-3. **`/orchestrate status`** -- List all directories under `/tmp/kagenti/orchestrate/`, read each target's `phase-status.md`, and display a summary table showing target name, current phase, and completion percentage.
+3. **`/orchestrate status`** -- List all directories under `/tmp/rossoctl/orchestrate/`, read each target's `phase-status.md`, and display a summary table showing target name, current phase, and completion percentage.
 
 ## Phase Status Tracking
 
-All orchestration state is persisted under `/tmp/kagenti/orchestrate/<target>/`:
+All orchestration state is persisted under `/tmp/rossoctl/orchestrate/<target>/`:
 
 | File | Purpose |
 |------|---------|
@@ -154,5 +154,5 @@ git clone git@github.com:org/repo.git .repos/repo-name
 
 | Skill | Description |
 |-------|-------------|
-| `onboard:link` | Link a newly-orchestrated repo to Kagenti |
+| `onboard:link` | Link a newly-orchestrated repo to Rossoctl |
 | `onboard:standards` | Apply organizational standards and conventions |

.claude/skills/orchestrate:ci/SKILL.md

@@ -29,7 +29,7 @@ flowchart TD
 # Orchestrate: CI
 
 Add comprehensive CI workflows to a target repository. This is Phase 4 and
-produces PR #3. Encodes the kagenti/kagenti gold standard: lint, test, build,
+produces PR #3. Encodes the rossoctl/rossoctl gold standard: lint, test, build,
 security scanning, dependency management, and supply chain hardening.
 
 ## When to Use
@@ -39,8 +39,8 @@ security scanning, dependency management, and supply chain hardening.
 
 ## Prerequisites
 
-- Plan exists at `/tmp/kagenti/orchestrate/<target>/plan.md`
-- Scan report at `/tmp/kagenti/orchestrate/<target>/scan-report.md`
+- Plan exists at `/tmp/rossoctl/orchestrate/<target>/plan.md`
+- Scan report at `/tmp/rossoctl/orchestrate/<target>/scan-report.md`
 - Target repo in `.repos/<target>/`
 
 ## Read Scan Report First
@@ -283,7 +283,7 @@ Use `docker/build-push-action` with:
 
 **Include when:** Repo is actively maintained (has recent commits).
 
-Use the kagenti org reusable workflow:
+Use the rossoctl org reusable workflow:
 
 ```yaml
 name: Close Stale Issues and PRs
@@ -294,7 +294,7 @@ on:
 
 jobs:
   stale:
-    uses: kagenti/.github/.github/workflows/stale.yaml@main
+    uses: rossoctl/.github/.github/workflows/stale.yaml@main
 ```
 
 ### 2.3 PR Title Verification
@@ -341,7 +341,7 @@ Pair with comment-triggered E2E:
 ## Action Version Reference
 
 When generating workflows, use the latest SHA-pinned versions. Look up current
-SHAs from the kagenti/kagenti main repo's workflows as the reference. All
+SHAs from the rossoctl/rossoctl main repo's workflows as the reference. All
 actions MUST be SHA-pinned with a version comment:
 
 ```yaml
@@ -399,7 +399,7 @@ gh pr create --repo org/repo --title "Add comprehensive CI workflows" --body "Ph
 
 ## Update Phase Status
 
-Set ci to `complete` in `/tmp/kagenti/orchestrate/<target>/phase-status.md`.
+Set ci to `complete` in `/tmp/rossoctl/orchestrate/<target>/phase-status.md`.
 
 ## Related Skills
 

.claude/skills/orchestrate:plan/SKILL.md

@@ -33,7 +33,7 @@ is Phase 1 — interactive brainstorming with the developer, no PRs.
 Scan report must exist:
 
 ```bash
-cat /tmp/kagenti/orchestrate/<target>/scan-report.md
+cat /tmp/rossoctl/orchestrate/<target>/scan-report.md
 ```
 
 ## Planning Process
@@ -78,7 +78,7 @@ Target 600-700 lines per PR. For each phase:
 
 ## Plan Output
 
-Save to `/tmp/kagenti/orchestrate/<target>/plan.md`:
+Save to `/tmp/rossoctl/orchestrate/<target>/plan.md`:
 
 ```markdown
 # Enhancement Plan: <target>
@@ -128,7 +128,7 @@ Save to `/tmp/kagenti/orchestrate/<target>/plan.md`:
 Initialize phase tracking:
 
 ```bash
-cat > /tmp/kagenti/orchestrate/<target>/phase-status.md << 'EOF'
+cat > /tmp/rossoctl/orchestrate/<target>/phase-status.md << 'EOF'
 # Phase Status: <target>
 
 | Phase | Status | PR | Date |

.claude/skills/orchestrate:precommit/SKILL.md

@@ -35,7 +35,7 @@ produces PR #1 — the foundation that validates all subsequent PRs.
 
 ## Prerequisites
 
-- Plan exists at `/tmp/kagenti/orchestrate/<target>/plan.md`
+- Plan exists at `/tmp/rossoctl/orchestrate/<target>/plan.md`
 - Target repo cloned in `.repos/<target>/`
 
 ## Step 1: Detect Language
@@ -212,7 +212,7 @@ gh pr create --repo org/repo --title "Add pre-commit hooks and code quality base
 
 ## Update Phase Status
 
-Update `/tmp/kagenti/orchestrate/<target>/phase-status.md`:
+Update `/tmp/rossoctl/orchestrate/<target>/phase-status.md`:
 - Set precommit to `complete`
 - Record PR number and date
 

.claude/skills/orchestrate:replicate/SKILL.md

@@ -54,7 +54,7 @@ making it fully self-sufficient. This is Phase 6.
 
 After copying, adapt the skills:
 
-1. **Remove source-specific references** — strip kagenti-specific paths or
+1. **Remove source-specific references** — strip rossoctl-specific paths or
    assumptions that don't apply
 2. **Verify frontmatter** — every `name:` field must match its directory name
 3. **Update Related Skills** — only reference skills that exist in the copied set

.claude/skills/orchestrate:review/SKILL.md

@@ -37,7 +37,7 @@ submits reviews after user approval.
 
 ## Prerequisites
 
-- `scan-report.md` and `plan.md` exist in `/tmp/kagenti/orchestrate/<target>/`
+- `scan-report.md` and `plan.md` exist in `/tmp/rossoctl/orchestrate/<target>/`
 - Phases 2-6 are complete (or at least the phases that were planned)
 - PRs are open on the target repo
 
@@ -210,7 +210,7 @@ Update `phase-status.md` when complete:
 
 ```bash
 # Update phase-status.md
-sed -i '' 's/| review .*/| review | complete | -- | YYYY-MM-DD |/' /tmp/kagenti/orchestrate/<target>/phase-status.md
+sed -i '' 's/| review .*/| review | complete | -- | YYYY-MM-DD |/' /tmp/rossoctl/orchestrate/<target>/phase-status.md
 ```
 
 ## Related Skills

.claude/skills/orchestrate:scan/SKILL.md

@@ -277,7 +277,7 @@ Then follow the `cve:scan` skill workflow:
    Advisory Database
 4. **Classify** — confirmed / suspected / false positive
 
-Write CVE findings to `/tmp/kagenti/cve/<target>/scan-report.json` (never to
+Write CVE findings to `/tmp/rossoctl/cve/<target>/scan-report.json` (never to
 git-tracked files). Include a summary in the scan report.
 
 Key areas to focus on:
@@ -326,10 +326,10 @@ git -C .repos/<target> remote -v
 
 ## Output Format
 
-Save scan report to `/tmp/kagenti/orchestrate/<target>/scan-report.md`:
+Save scan report to `/tmp/rossoctl/orchestrate/<target>/scan-report.md`:
 
 ```bash
-mkdir -p /tmp/kagenti/orchestrate/<target>
+mkdir -p /tmp/rossoctl/orchestrate/<target>
 ```
 
 Report template:
@@ -439,7 +439,7 @@ Report template:
 
 ## Dependency Vulnerabilities (cve:scan)
 - Scan method: [Trivy + LLM + WebSearch / LLM + WebSearch / LLM only]
-- Full report: `/tmp/kagenti/cve/<target>/scan-report.json`
+- Full report: `/tmp/rossoctl/cve/<target>/scan-report.json`
 
 | Severity | Count |
 |----------|-------|
@@ -458,7 +458,7 @@ Report template:
 |---------|----------|---------|
 | [e.g., insecure port, no input validation] | HIGH/MEDIUM | [brief description] |
 
-> **Note:** CVE IDs and detailed descriptions are in `/tmp/kagenti/cve/<target>/scan-report.json` only.
+> **Note:** CVE IDs and detailed descriptions are in `/tmp/rossoctl/cve/<target>/scan-report.json` only.
 > Do NOT copy CVE IDs into git-tracked files, PRs, or issues.
 
 ## Gap Summary

.claude/skills/orchestrate:security/SKILL.md

@@ -132,7 +132,7 @@ All commits must be signed off (`git commit -s`).
 ## Step 4: LICENSE
 
 Check if LICENSE exists. If missing:
-- Check the org's standard license (most kagenti repos use Apache 2.0)
+- Check the org's standard license (most rossoctl repos use Apache 2.0)
 - Add the appropriate LICENSE file
 - If unsure, flag in the PR for maintainer decision
 

.claude/skills/skills:validate/SKILL.md

@@ -51,7 +51,7 @@ Skills operate on either **sandbox** (safe) or **management** (requires approval
 | **Management** | Management cluster, AWS resources, git push, destructive ops | NO | Can chain commands (user approves anyway) |
 
 ### Sandbox skills (auto-approved)
-Commands target `localtest.me`, `KUBECONFIG=~/clusters/hcp/kagenti-hypershift-custom-*`, or Kind clusters.
+Commands target `localtest.me`, `KUBECONFIG=~/clusters/hcp/rossoctl-hypershift-custom-*`, or Kind clusters.
 
 **IMPORTANT**: Run each command separately — not chained with `&&`. Chained or multiline commands break Claude Code's auto-approve pattern matching.
 
@@ -60,18 +60,18 @@ Commands target `localtest.me`, `KUBECONFIG=~/clusters/hcp/kagenti-hypershift-cu
 
 Check pod status:
 ```bash
-kubectl get pods -n kagenti-system
+kubectl get pods -n rossoctl-system
 ```
 
 Check logs:
 ```bash
-kubectl logs -n kagenti-system deployment/mlflow
+kubectl logs -n rossoctl-system deployment/mlflow
 ```
 
 ## BAD (chained commands won't match auto-approve patterns)
 
 ```bash
-kubectl get pods -n kagenti-system && kubectl logs -n kagenti-system deployment/mlflow
+kubectl get pods -n rossoctl-system && kubectl logs -n rossoctl-system deployment/mlflow
 ```
 ```
 
@@ -132,7 +132,7 @@ For each command in a sandbox skill, verify it matches a pattern in `.claude/set
 | `kubectl describe` | `Bash(kubectl describe:*)` |
 | `kubectl logs` | `Bash(kubectl logs:*)` |
 | `helm list` | `Bash(helm list:*)` |
-| `KUBECONFIG=~/clusters/hcp/... kubectl` | `Bash(KUBECONFIG=*/clusters/hcp/kagenti-hypershift-custom-*/auth/kubeconfig kubectl:*)` |
+| `KUBECONFIG=~/clusters/hcp/... kubectl` | `Bash(KUBECONFIG=*/clusters/hcp/rossoctl-hypershift-custom-*/auth/kubeconfig kubectl:*)` |
 | `uv run pytest` | `Bash(uv run pytest:*)` |
 
 If a command is NOT covered, add the pattern to `.claude/settings.json` in the `allow` array.
@@ -142,7 +142,7 @@ If a command is NOT covered, add the pattern to `.claude/settings.json` in the `
 When validating multiple skills:
 
 ```
-TaskCreate: "kagenti | skills | <category> | Verify | Validate <skill-name>"
+TaskCreate: "rossoctl | skills | <category> | Verify | Validate <skill-name>"
 ```
 
 ## Related Skills

.claude/skills/skills:write/SKILL.md

@@ -100,12 +100,12 @@ Claude Code auto-approves commands by matching the first token against `.claude/
 ```markdown
 Check pod status:
 ```bash
-kubectl get pods -n kagenti-system
+kubectl get pods -n rossoctl-system
 ```
 
 Check logs:
 ```bash
-kubectl logs -n kagenti-system deployment/mlflow
+kubectl logs -n rossoctl-system deployment/mlflow
 ```
 ```
 
@@ -115,7 +115,7 @@ For HyperShift, prefix each command individually:
 
 ```markdown
 ```bash
-KUBECONFIG=~/clusters/hcp/kagenti-hypershift-custom-$CLUSTER/auth/kubeconfig kubectl get pods -n kagenti-system
+KUBECONFIG=~/clusters/hcp/rossoctl-hypershift-custom-$CLUSTER/auth/kubeconfig kubectl get pods -n rossoctl-system
 ```
 ```
 
@@ -125,10 +125,10 @@ Commands targeting management clusters or AWS need user approval anyway, so mult
 
 ### Temporary Files
 
-Skills that download logs, artifacts, or save analysis output should use `/tmp/kagenti/<skill-category>/` as the working directory:
+Skills that download logs, artifacts, or save analysis output should use `/tmp/rossoctl/<skill-category>/` as the working directory:
 
 ```bash
-mkdir -p /tmp/kagenti/rca
+mkdir -p /tmp/rossoctl/rca
 ```
 
 This path is auto-approved for read/write in `.claude/settings.json`.
@@ -184,7 +184,7 @@ Every workflow skill (tdd, rca, ci, etc.) MUST include a Task Tracking section.
 <worktree> | <PR> | <plan-doc> | <topic> | <phase> | <task description>
 ```
 
-- **worktree**: git worktree name (e.g., `mlflow-ci`) or `kagenti` for main repo
+- **worktree**: git worktree name (e.g., `mlflow-ci`) or `rossoctl` for main repo
 - **PR**: PR reference (e.g., `PR#569`) or `none`
 - **plan-doc**: plan filename (e.g., `calm-toast.md`) or `ad-hoc` if no plan
 - **topic**: area of work (e.g., `Kind CI`, `MLflow init`, `CodeQL`)

.github/CODEOWNERS

@@ -1,12 +1,12 @@
 # Default owners for everything
-* @kagenti/maintainers
+* @rossoctl/maintainers
 
 # AuthBridge components
-authbridge/ @kagenti/maintainers
+authbridge/ @rossoctl/maintainers
 
 # CI/CD and GitHub configuration
-.github/ @kagenti/platform
+.github/ @rossoctl/platform
 
 # Documentation
-*.md @kagenti/maintainers
-docs/ @kagenti/maintainers
+*.md @rossoctl/maintainers
+docs/ @rossoctl/maintainers

.github/codeql/codeql-config.yml

@@ -1,4 +1,4 @@
-name: kagenti-extensions CodeQL config
+name: rossocortex CodeQL config
 
 queries:
   - uses: security-extended

.github/spellcheck/.wordlist.txt

@@ -54,8 +54,8 @@ JWT
 JWT's
 JWTs
 Kagent
-Kagenti
-Kagenti's
+Rossoctl
+Rossoctl's
 Keycloak
 Keycloak's
 Kubebuilder
@@ -276,7 +276,7 @@ jsonnet
 jsonpath
 jwks
 k8s
-kagenti
+rossoctl
 keycloak
 ko
 kube