Refactor: Rename rossocortex → cortex (fix module paths)

.claude/skills/demo.md

@@ -4,8 +4,8 @@ This skill captures knowledge from building, debugging, and running AuthBridge d
 
 ## Repository Context
 
-- **Repo:** `rossoctl/rossocortex` (monorepo)
-- **Container registry:** `ghcr.io/rossoctl/rossocortex/<image-name>`
+- **Repo:** `rossoctl/cortex` (monorepo)
+- **Container registry:** `ghcr.io/rossoctl/cortex/<image-name>`
 - **Agent examples repo:** `rossoctl/examples` (separate repo, images NOT published to GHCR)
 - **Demo guides:** `authbridge/demos/<demo-name>/demo-manual.md` (manual kubectl) and `demo-ui.md` (UI-driven)
 
@@ -35,9 +35,9 @@ docker build -t ghcr.io/rossoctl/examples/<agent>:latest ./a2a/<agent>/
 docker build -t ghcr.io/rossoctl/examples/<tool>:latest ./mcp/<tool>/
 
 # Build AuthBridge sidecar images
-cd rossocortex/authbridge/authproxy
-docker build -f Dockerfile.init -t ghcr.io/rossoctl/rossocortex/proxy-init:latest .
-docker build -f Dockerfile.envoy -t ghcr.io/rossoctl/rossocortex/envoy-with-processor:latest .
+cd cortex/authbridge/authproxy
+docker build -f Dockerfile.init -t ghcr.io/rossoctl/cortex/proxy-init:latest .
+docker build -f Dockerfile.envoy -t ghcr.io/rossoctl/cortex/envoy-with-processor:latest .
 
 # Load into Kind
 kind load docker-image <image> --name rossoctl

.github/codeql/codeql-config.yml

@@ -1,4 +1,4 @@
-name: rossocortex CodeQL config
+name: cortex CodeQL config
 
 queries:
   - uses: security-extended

CLAUDE.md

@@ -1,25 +1,25 @@
 # CLAUDE.md - Rossoctl Extensions
 
-This file provides context for Claude (AI assistant) when working with the `rossocortex` monorepo.
+This file provides context for Claude (AI assistant) when working with the `cortex` monorepo.
 
 ## AI Assistant Instructions
 
 - **Use `Assisted-By` for attribution** — never add `Co-Authored-By`, `Generated with Claude Code`, or similar trailers. See [Commit Attribution Policy](#commit-attribution-policy) below.
 
 ## Repository Overview
 
-**rossocortex** contains Kubernetes security extensions for the [Rossoctl](https://github.com/rossoctl/rossoctl) ecosystem. It provides **zero-trust authentication** for Kubernetes workloads through transparent token exchange and dynamic Keycloak client registration using SPIFFE/SPIRE identities.
+**cortex** contains Kubernetes security extensions for the [Rossoctl](https://github.com/rossoctl/rossoctl) ecosystem. It provides **zero-trust authentication** for Kubernetes workloads through transparent token exchange and dynamic Keycloak client registration using SPIFFE/SPIRE identities.
 
 The sidecar injection webhook lives in a separate repo: [rossoctl/operator](https://github.com/rossoctl/operator).
 
-**GitHub:** `github.com/rossoctl/rossocortex`
-**Container registry:** `ghcr.io/rossoctl/rossocortex/<image-name>`
+**GitHub:** `github.com/rossoctl/cortex`
+**Container registry:** `ghcr.io/rossoctl/cortex/<image-name>`
 **License:** Apache 2.0
 
 ## Top-Level Directory Structure
 
 ```
-rossocortex/
+cortex/
 ├── authbridge/               # Authentication bridge components
 │   ├── authlib/              #   Shared auth building blocks (Go module)
 │   │   ├── validation/       #     JWKS-backed JWT verifier
@@ -163,7 +163,7 @@ lowercase prefixes. Use `Fix:` / `Feat:` / `Docs:` in PR titles.
 
 ## Container Images
 
-All images are pushed to `ghcr.io/rossoctl/rossocortex/` from
+All images are pushed to `ghcr.io/rossoctl/cortex/` from
 `.github/workflows/build.yaml`:
 
 | Image | Source | Description |
@@ -271,7 +271,7 @@ cd authbridge && podman build -f cmd/authbridge-proxy/Dockerfile \
 
 1. Add entry to `.github/workflows/build.yaml` matrix (`image_config` array)
 2. Provide `name`, `context`, and `dockerfile` fields
-3. Image will be pushed to `ghcr.io/rossoctl/rossocortex/<name>`
+3. Image will be pushed to `ghcr.io/rossoctl/cortex/<name>`
 
 ## Code Style and Conventions
 

CONTRIBUTING.md

@@ -25,8 +25,8 @@ Comment `/claim` on an issue to have it automatically assigned to you. Issues la
 
 ```bash
 # Clone the repository
-git clone https://github.com/rossoctl/rossocortex.git
-cd rossocortex
+git clone https://github.com/rossoctl/cortex.git
+cd cortex
 
 # Install pre-commit hooks
 pre-commit install

LOCAL_TESTING_GUIDE.md

@@ -1,6 +1,6 @@
 # Local Testing Guide for JWT-SVID Authentication
 
-> **⚠️ This guide is stale after rossocortex#411.** It was written
+> **⚠️ This guide is stale after cortex#411.** It was written
 > for the pre-#411 multi-sidecar shape (separate `client-registration`,
 > `envoy-with-processor`, and standalone `spiffe-helper` containers) and
 > several of its YAML examples reference images that no longer publish.
@@ -26,7 +26,7 @@ This guide walks you through testing JWT-SVID authentication using local images
 **CRITICAL**: You MUST run the `./local-build-and-test.sh` script to build all required images. Do NOT build images individually with `docker build` or `podman build` commands, as this will miss critical images like `spiffe-idp-setup:local` (located in the rossoctl repo).
 
 The script:
-- Builds images from **both** rossoctl and rossocortex repositories
+- Builds images from **both** rossoctl and cortex repositories
 - Automatically detects Docker vs Podman
 - Loads all images into your Kind cluster
 - Ensures consistent image tags and pull policies
@@ -35,7 +35,7 @@ The script:
 
 - Docker or Podman running
 - Kind CLI installed
-- Both `rossoctl` and `rossocortex` repositories cloned
+- Both `rossoctl` and `cortex` repositories cloned
 
 ## Step 0: Create Kind Cluster
 
@@ -68,7 +68,7 @@ kubectl cluster-info --context kind-rossoctl-dev
 The `local-build-and-test.sh` script is the **only supported way** to build local images for testing. It builds images from both repositories and ensures everything is loaded correctly.
 
 ```bash
-cd rossocortex
+cd cortex
 
 # Make the script executable (first time only)
 chmod +x local-build-and-test.sh
@@ -87,10 +87,10 @@ export KIND_EXPERIMENTAL_PROVIDER=podman  # Only needed for Podman
 **From rossoctl repo** (critical - often missed!):
 - `ghcr.io/rossoctl/rossoctl/spiffe-idp-setup:local` - Configures SPIFFE Identity Provider in Keycloak
 
-**From rossocortex repo**:
-- `ghcr.io/rossoctl/rossocortex/client-registration:local` - Registers agents as Keycloak clients
-- `ghcr.io/rossoctl/rossocortex/envoy-with-processor:local` - Envoy proxy with token exchange
-- `ghcr.io/rossoctl/rossocortex/proxy-init:local` - iptables initialization
+**From cortex repo**:
+- `ghcr.io/rossoctl/cortex/client-registration:local` - Registers agents as Keycloak clients
+- `ghcr.io/rossoctl/cortex/envoy-with-processor:local` - Envoy proxy with token exchange
+- `ghcr.io/rossoctl/cortex/proxy-init:local` - iptables initialization
 
 ### Common Mistakes to Avoid:
 
@@ -105,7 +105,7 @@ export KIND_EXPERIMENTAL_PROVIDER=podman  # Only needed for Podman
 
 ## Step 2: Install Rossoctl with Ansible
 
-**IMPORTANT:** For federated-JWT testing with local images, use the unified `federated-jwt-values.yaml` overlay file from rossocortex.
+**IMPORTANT:** For federated-JWT testing with local images, use the unified `federated-jwt-values.yaml` overlay file from cortex.
 
 The ansible installer will detect the existing `rossoctl-dev` cluster and install into it:
 
@@ -116,7 +116,7 @@ cd rossoctl
 # Install with dev base values + TWO overlays (deps local images + extensions federated-jwt)
 # --env dev                                → Loads dev_values.yaml (base Kind development config)
 # --env-file deployments/envs/...         → Local images for rossoctl-deps (SPIRE, Keycloak, etc.)
-# --env-file ../rossocortex/...    → Federated-jwt + local images for rossocortex
+# --env-file ../cortex/...    → Federated-jwt + local images for cortex
 deployments/ansible/run-install.sh --env dev \
   --env-file deployments/envs/dev_values_local_images.yaml \
   --env-file deployments/envs/dev_values_federated-jwt.yaml
@@ -158,7 +158,7 @@ This installation will:
 ## Step 3: Verify SPIRE and Keycloak
 
 ```bash
-cd rossocortex
+cd cortex
 
 chmod +x verify-spire-keycloak.sh
 ./verify-spire-keycloak.sh
@@ -246,7 +246,7 @@ spec:
         - name: certs
           mountPath: /opt
       - name: client-registration
-        image: ghcr.io/rossoctl/rossocortex/client-registration:local
+        image: ghcr.io/rossoctl/cortex/client-registration:local
         imagePullPolicy: Never
         command:
           - /bin/sh

Makefile

@@ -1,4 +1,4 @@
-# Root Makefile for rossocortex monorepo
+# Root Makefile for cortex monorepo
 # Orchestrates linting and formatting across all sub-projects
 
 .PHONY: lint fmt pre-commit build-proxy-init help

README.md

@@ -20,8 +20,8 @@ See the [AuthBridge README](./authbridge/README.md) for architecture details and
 
 ## Container Images
 
-All images are published to `ghcr.io/rossoctl/rossocortex/`. After
-rossocortex#411 the unified binary was split into three
+All images are published to `ghcr.io/rossoctl/cortex/`. After
+cortex#411 the unified binary was split into three
 mode-specific combined images, and the per-component sidecars
 (`client-registration`, standalone `spiffe-helper`) were retired:
 

aiac/docs/specs/demo/github-agent.md

@@ -42,7 +42,7 @@ RFC-8693 token exchange, and the `github-tool` MitM swaps the exchanged token fo
 - Existing (issue-only) agent card: [`../../analysis/github-agent-card.json`](../../analysis/github-agent-card.json)
 - `github-tool` MCP tool catalog (44 tools): [`../../analysis/github-mcp-tools-summary.json`](../../analysis/github-mcp-tools-summary.json)
 - Reference agent: `agent-examples/a2a/git_issue_agent/`
-- Reference deployment: `rossocortex/authbridge/demos/github-issue/k8s/`
+- Reference deployment: `cortex/authbridge/demos/github-issue/k8s/`
 - **Sibling tool spec (UC-1 onboarding fixture):** [`github-tool.md`](github-tool.md) — a simplified
   4-tool stub (`source-read`, `source-write`, `issues-read`, `issues-write`) deployed as Service
   `github-tool`. **This is not the tool this agent connects to.** The agent connects to the production

aiac/docs/specs/demo/github-tool.md

@@ -68,7 +68,7 @@ Phase 1 only discovers and evaluates them.
 - Scenario fixture (`TOOL_SCOPES`): [`../../../test/integration/scenario.py`](../../../test/integration/scenario.py)
 - Scenario spec: [`../integration-test/policy-pipeline.md`](../integration-test/policy-pipeline.md)
 - Sibling agent spec: [`github-agent.md`](github-agent.md)
-- Reference deployment: `rossocortex/authbridge/demos/github-issue/k8s/`
+- Reference deployment: `cortex/authbridge/demos/github-issue/k8s/`
 
 ---
 

authbridge/README.md

@@ -26,7 +26,7 @@ The shared auth library at [`authlib/`](./authlib/) contains the building blocks
 
 ## Architecture (Operator-Injected)
 
-The following describes the operator-injected sidecar deployment. After rossocortex#411 each mode is served by its own combined image (one container per pod, with `spiffe-helper` bundled inside and gated by `SPIRE_ENABLED`). The legacy `authbridge-unified`, `authbridge-light`, `envoy-with-processor`, and standalone `client-registration` / `spiffe-helper` sidecars are gone.
+The following describes the operator-injected sidecar deployment. After cortex#411 each mode is served by its own combined image (one container per pod, with `spiffe-helper` bundled inside and gated by `SPIRE_ENABLED`). The legacy `authbridge-unified`, `authbridge-light`, `envoy-with-processor`, and standalone `client-registration` / `spiffe-helper` sidecars are gone.
 
 ### What AuthBridge Does
 
@@ -149,7 +149,7 @@ flowchart TB
 
 ### Workload Pod
 
-After rossocortex#411 a workload pod has the application
+After cortex#411 a workload pod has the application
 container plus a single combined AuthBridge sidecar. In
 envoy-sidecar mode it also has a one-shot `proxy-init` init
 container; in proxy-sidecar mode (the cluster default) it does
@@ -432,7 +432,7 @@ To make a plugin excludable:
 
 package main
 
-import _ "github.com/rossoctl/rossocortex/authbridge/authlib/plugins/<name>"
+import _ "github.com/rossoctl/cortex/authbridge/authlib/plugins/<name>"
 ```
 
 2. Remove the corresponding `_ "...plugins/<name>"` import from that binary's `main.go`.

authbridge/authlib/README.md

@@ -36,8 +36,8 @@ Plugins own their own configuration and construct any `auth.Auth` they need inte
 
 ```go
 import (
-    "github.com/rossoctl/rossocortex/authbridge/authlib/config"
-    "github.com/rossoctl/rossocortex/authbridge/authlib/plugins"
+    "github.com/rossoctl/cortex/authbridge/authlib/config"
+    "github.com/rossoctl/cortex/authbridge/authlib/plugins"
 )
 
 cfg, _ := config.Load("config.yaml")
@@ -58,7 +58,7 @@ For direct use of the `auth/` composition layer (outside of plugins), see `auth/
 ## Go Module
 
 ```
-module github.com/rossoctl/rossocortex/authbridge/authlib
+module github.com/rossoctl/cortex/authbridge/authlib
 ```
 
 Direct dependencies: `lestrrat-go/jwx/v2`, `gobwas/glob`, `gopkg.in/yaml.v3`. No gRPC or Envoy deps.

authbridge/authlib/auth/auth.go

@@ -10,11 +10,11 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/rossoctl/rossocortex/authbridge/authlib/bypass"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation/validation"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange/cache"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange/exchange"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/routing"
+	"github.com/rossoctl/cortex/authbridge/authlib/bypass"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/jwtvalidation/validation"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange/cache"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange/exchange"
+	"github.com/rossoctl/cortex/authbridge/authlib/routing"
 )
 
 // IdentityConfig holds the agent's identity for audience validation and token exchange.

authbridge/authlib/auth/auth_test.go

@@ -10,11 +10,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/rossoctl/rossocortex/authbridge/authlib/bypass"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation/validation"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange/cache"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange/exchange"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/routing"
+	"github.com/rossoctl/cortex/authbridge/authlib/bypass"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/jwtvalidation/validation"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange/cache"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange/exchange"
+	"github.com/rossoctl/cortex/authbridge/authlib/routing"
 )
 
 // mockVerifier captures the audiences arg and returns configured claims/error.

authbridge/authlib/auth/result.go

@@ -3,7 +3,7 @@
 package auth
 
 import (
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation/validation"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/jwtvalidation/validation"
 )
 
 // Inbound actions.

authbridge/authlib/config/config.go

@@ -9,7 +9,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/rossoctl/rossocortex/authbridge/authlib/pipeline"
+	"github.com/rossoctl/cortex/authbridge/authlib/pipeline"
 	"gopkg.in/yaml.v3"
 )
 

authbridge/authlib/config/config_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/rossoctl/rossocortex/authbridge/authlib/pipeline"
+	"github.com/rossoctl/cortex/authbridge/authlib/pipeline"
 )
 
 // --- Preset Tests ---

authbridge/authlib/go.mod

@@ -1,4 +1,4 @@
-module github.com/rossoctl/rossocortex/authbridge/authlib
+module github.com/rossoctl/cortex/authbridge/authlib
 
 go 1.26.4
 
@@ -7,10 +7,10 @@ require (
 	github.com/envoyproxy/go-control-plane/envoy v1.37.0
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/gobwas/glob v0.2.3
-	github.com/rossoctl/context-guru v0.0.0-20260713113308-b624f2c3d8c2
 	github.com/lestrrat-go/jwx/v2 v2.1.7
 	github.com/maximhq/bifrost/core v1.7.0
 	github.com/open-policy-agent/opa v1.18.2
+	github.com/rossoctl/context-guru v0.0.0-20260720181432-8fc7c7b36563
 	github.com/spiffe/go-spiffe/v2 v2.8.1
 	golang.org/x/net v0.57.0
 	golang.org/x/sys v0.47.0

authbridge/authlib/go.sum

@@ -191,6 +191,8 @@ github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8A
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
 github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
+github.com/rossoctl/context-guru v0.0.0-20260720181432-8fc7c7b36563 h1:YsOMYgqAxFzy9mxzmSC+1dWfC36riFQrV7vce2AtjUo=
+github.com/rossoctl/context-guru v0.0.0-20260720181432-8fc7c7b36563/go.mod h1:Uycopjjz08nDc2UsrnUxUUjqK0myN9VDnZBTaLnbfLs=
 github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=

authbridge/authlib/listener/e2e/placeholder_e2e_test.go

@@ -20,13 +20,13 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/lestrrat-go/jwx/v2/jwt"
 
-	"github.com/rossoctl/rossocortex/authbridge/authlib/listener/forwardproxy"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/listener/reverseproxy"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/pipeline"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/placeholder"
-	jwtvalidation "github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation"
-	tokenexchange "github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/shared"
+	"github.com/rossoctl/cortex/authbridge/authlib/listener/forwardproxy"
+	"github.com/rossoctl/cortex/authbridge/authlib/listener/reverseproxy"
+	"github.com/rossoctl/cortex/authbridge/authlib/pipeline"
+	"github.com/rossoctl/cortex/authbridge/authlib/placeholder"
+	jwtvalidation "github.com/rossoctl/cortex/authbridge/authlib/plugins/jwtvalidation"
+	tokenexchange "github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange"
+	"github.com/rossoctl/cortex/authbridge/authlib/shared"
 )
 
 // startJWKS mints an RSA keypair, serves its public half as a JWKS, and

authbridge/authlib/listener/extauthz/server.go

@@ -15,8 +15,8 @@ import (
 
 	rpcstatus "google.golang.org/genproto/googleapis/rpc/status"
 
-	"github.com/rossoctl/rossocortex/authbridge/authlib/auth"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/pipeline"
+	"github.com/rossoctl/cortex/authbridge/authlib/auth"
+	"github.com/rossoctl/cortex/authbridge/authlib/pipeline"
 )
 
 // Server implements the Envoy ext_authz Authorization gRPC service.

authbridge/authlib/listener/extauthz/server_test.go

@@ -11,13 +11,13 @@ import (
 	authv3 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
 	"google.golang.org/grpc/codes"
 
-	authpkg "github.com/rossoctl/rossocortex/authbridge/authlib/auth"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/pipeline"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation/validation"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/plugintesting"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange/cache"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/tokenexchange/exchange"
-	"github.com/rossoctl/rossocortex/authbridge/authlib/routing"
+	authpkg "github.com/rossoctl/cortex/authbridge/authlib/auth"
+	"github.com/rossoctl/cortex/authbridge/authlib/pipeline"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/jwtvalidation/validation"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/plugintesting"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange/cache"
+	"github.com/rossoctl/cortex/authbridge/authlib/plugins/tokenexchange/exchange"
+	"github.com/rossoctl/cortex/authbridge/authlib/routing"
 )
 
 type mockVerifier struct {