diff --git a/.agentready/assessment-20260512-091921.json b/.agentready/assessment-20260512-091921.json
index 9523d2d6..4fef505a 100644
--- a/.agentready/assessment-20260512-091921.json
+++ b/.agentready/assessment-20260512-091921.json
@@ -7,12 +7,12 @@
     "assessment_timestamp_human": "May 12, 2026 at 9:19 AM",
     "executed_by": "rhuss@rhuss-mac",
     "command": "/Users/rhuss/.cache/uv/archive-v0/-sEsvpNoWBP_t22eeb_V-/bin/agentready -- assess .",
-    "working_directory": "/Users/rhuss/Development/ai/kagenti-operator"
+    "working_directory": "/Users/rhuss/Development/ai/operator"
   },
   "repository": {
-    "path": "/Users/rhuss/Development/ai/kagenti-operator",
-    "name": "kagenti-operator",
-    "url": "git@github.com:rhuss/kagenti-operator.git",
+    "path": "/Users/rhuss/Development/ai/operator",
+    "name": "rossoctl-operator",
+    "url": "git@github.com:rhuss/operator.git",
     "branch": "main",
     "commit_hash": "01f875a573b9cfc13eacc29e4604c71def861880",
     "languages": {
@@ -86,7 +86,7 @@
       "measured_value": "present",
       "threshold": "present",
       "evidence": [
-        "CLAUDE.md found at /Users/rhuss/Development/ai/kagenti-operator/CLAUDE.md"
+        "CLAUDE.md found at /Users/rhuss/Development/ai/operator/CLAUDE.md"
       ],
       "remediation": null,
       "error_message": null
@@ -584,7 +584,7 @@
       "threshold": "<5% files >500 lines, 0 files >1000 lines",
       "evidence": [
         "Found 8 files >1000 lines (8.2% of 97 files)",
-        "Largest: kagenti-operator/internal/controller/agentcard_controller.go (1299 lines)"
+        "Largest: operator/internal/controller/agentcard_controller.go (1299 lines)"
       ],
       "remediation": {
         "summary": "Refactor large files into smaller, focused modules",
diff --git a/.agentready/report-20260512-091921.html b/.agentready/report-20260512-091921.html
index 81053d34..b1e59b46 100644
--- a/.agentready/report-20260512-091921.html
+++ b/.agentready/report-20260512-091921.html
@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline';">
-    <title>AgentReady Assessment - kagenti-operator</title>
+    <title>AgentReady Assessment - rossoctl-operator</title>
     <style>
         /* Reset and Base Styles */
         * {
@@ -582,8 +582,8 @@
             <h1>🤖 AgentReady Assessment Report</h1>
             <div class="report-header">
                 <div class="repo-info">
-                    <h2>kagenti-operator</h2>
-                    <div class="info-line">📁 ~/Development/ai/kagenti-operator</div>
+                    <h2>rossoctl-operator</h2>
+                    <div class="info-line">📁 ~/Development/ai/operator</div>
                     <div class="info-line">🌿 <code>main</code> @ <code>01f875a5</code></div>
                 </div>
                 
@@ -793,7 +793,7 @@ <h3>CLAUDE.md Configuration Files</h3>
                         <h4>Evidence</h4>
                         <ul class="evidence-list">
                             
-                            <li>CLAUDE.md found at /Users/rhuss/Development/ai/kagenti-operator/CLAUDE.md</li>
+                            <li>CLAUDE.md found at /Users/rhuss/Development/ai/operator/CLAUDE.md</li>
                             
                         </ul>
                     </div>
@@ -1796,7 +1796,7 @@ <h4>Evidence</h4>
                             
                             <li>Found 8 files &gt;1000 lines (8.2% of 97 files)</li>
                             
-                            <li>Largest: kagenti-operator/internal/controller/agentcard_controller.go (1299 lines)</li>
+                            <li>Largest: operator/internal/controller/agentcard_controller.go (1299 lines)</li>
                             
                         </ul>
                     </div>
@@ -2916,7 +2916,7 @@ <h4>Evidence</h4>
         <footer>
             
             <p>Generated by <strong>AgentReady v2.35.2</strong> (Research v2.0.0)</p>
-            <p>Repository: ~/Development/ai/kagenti-operator • Branch: main • Commit: 01f875a5</p>
+            <p>Repository: ~/Development/ai/operator • Branch: main • Commit: 01f875a5</p>
             <p style="font-size: 0.85rem; color: #666;">Assessed by rhuss@rhuss-mac on May 12, 2026 at 9:19 AM</p>
             
             <p style="margin-top: 10px; font-size: 0.85rem;">
@@ -2928,7 +2928,7 @@ <h4>Evidence</h4>
     <script>
         // Security: Using Jinja2's tojson filter for proper XSS prevention
         // tojson creates JavaScript objects directly, no JSON.parse() needed
-        const ASSESSMENT = {"attributes_assessed": 20, "attributes_skipped": 13, "attributes_total": 33, "certification_level": "Bronze", "config": {"custom_theme": null, "excluded_attributes": [], "language_overrides": {}, "output_dir": null, "report_theme": "default", "weights": {}}, "discovered_skills": [], "duration_seconds": 0.2, "findings": [{"attribute": {"category": "Testing \u0026 CI/CD", "criteria": "Runnable tests with coverage config", "default_weight": 0.1, "description": "Single-command test runner with adequate coverage configuration", "id": "test_execution", "name": "Test Execution \u0026 Coverage", "tier": 1}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Code Quality", "criteria": "\u003e80% of functions have type annotations", "default_weight": 0.08, "description": "Type hints in function signatures", "id": "type_annotations", "name": "Type Annotations", "tier": 1}, "error_message": null, "evidence": ["Type annotation check not implemented for [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Context Window Optimization", "criteria": "CLAUDE.md or AGENTS.md file exists in repository root", "default_weight": 0.07, "description": "Project-specific configuration for AI coding agents", "id": "claude_md_file", "name": "CLAUDE.md Configuration Files", "tier": 1}, "error_message": null, "evidence": ["CLAUDE.md found at /Users/rhuss/Development/ai/kagenti-operator/CLAUDE.md"], "measured_value": "present", "remediation": null, "score": 100.0, "status": "pass", "threshold": "present"}, {"attribute": {"category": "Testing \u0026 CI/CD", "criteria": "CI gates with lint + type-check + tests", "default_weight": 0.05, "description": "CI runs lint, type-check, and tests on every PR", "id": "ci_quality_gates", "name": "CI Quality Gates", "tier": 1}, "error_message": null, "evidence": ["CI config found: .github/workflows/release.yml, .github/workflows/project.yml, .github/workflows/pr-verifier.yml, .github/workflows/self-assign.yml, .github/workflows/ci.yaml, .github/workflows/stale.yaml, .github/workflows/security-scans.yaml, .github/workflows/scorecard.yaml", "Lint gate detected in CI", "No test gate found in CI", "No type-check gate found in CI", "Descriptive job/step names found", "Parallel job execution detected", "Config includes comments", "Artifacts uploaded"], "measured_value": "missing quality gates", "remediation": {"citations": [{"relevance": "Official GitHub Actions guide", "source": "GitHub", "title": "GitHub Actions Documentation", "url": "https://docs.github.com/en/actions"}, {"relevance": "Industry best practices for CI/CD", "source": "CircleCI", "title": "CI/CD Best Practices", "url": "https://circleci.com/blog/ci-cd-best-practices/"}], "commands": ["# Create GitHub Actions workflow", "mkdir -p .github/workflows", "touch .github/workflows/ci.yml", "", "# Validate workflow", "gh workflow view ci.yml"], "examples": ["# .github/workflows/ci.yml - Good example\n\nname: CI Pipeline\n\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\njobs:\n  lint:\n    name: Lint Code\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Set up Python\n        uses: actions/setup-python@v5\n        with:\n          python-version: \u00273.11\u0027\n          cache: \u0027pip\u0027  # Caching\n\n      - name: Install dependencies\n        run: pip install -r requirements.txt\n\n      - name: Run linters\n        run: |\n          black --check .\n          isort --check .\n          ruff check .\n\n  test:\n    name: Run Tests\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Set up Python\n        uses: actions/setup-python@v5\n        with:\n          python-version: \u00273.11\u0027\n          cache: \u0027pip\u0027\n\n      - name: Install dependencies\n        run: pip install -r requirements.txt\n\n      - name: Run tests with coverage\n        run: pytest --cov --cov-report=xml\n\n      - name: Upload coverage reports\n        uses: codecov/codecov-action@v3\n        with:\n          files: ./coverage.xml\n\n  build:\n    name: Build Package\n    runs-on: ubuntu-latest\n    needs: [lint, test]  # Runs after lint/test pass\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Build package\n        run: python -m build\n\n      - name: Upload build artifacts\n        uses: actions/upload-artifact@v3\n        with:\n          name: dist\n          path: dist/\n"], "steps": ["Create CI config for your platform (GitHub Actions, GitLab CI, etc.)", "Define jobs: lint, test, build", "Use descriptive job and step names", "Configure dependency caching", "Enable parallel job execution", "Upload artifacts: test results, coverage reports", "Add status badge to README"], "summary": "Add or improve CI/CD pipeline configuration", "tools": ["github-actions", "gitlab-ci", "circleci"]}, "score": 75, "status": "fail", "threshold": "CI with lint + test + type-check gates on PRs"}, {"attribute": {"category": "Verification \u0026 Feedback Loops", "criteria": "Documented single-file lint/type-check commands", "default_weight": 0.05, "description": "Single-file lint and type-check commands available for fast feedback", "id": "single_file_verification", "name": "Single-File Verification", "tier": 1}, "error_message": null, "evidence": ["No single-file verification commands found in context files"], "measured_value": "not documented", "remediation": {"citations": [], "commands": ["# Python", "ruff check path/to/file.py", "mypy path/to/file.py", "", "# JavaScript/TypeScript", "npx eslint path/to/file.ts", "npx tsc --noEmit path/to/file.ts"], "examples": [], "steps": ["Add single-file lint command to context file (e.g., \u0027ruff check path/to/file.py\u0027)", "Add single-file type-check command (e.g., \u0027mypy path/to/file.py\u0027)", "Ensure these commands work without a full build step", "Target \u003c5 seconds execution per file"], "summary": "Document single-file lint and type-check commands in CLAUDE.md/AGENTS.md", "tools": ["ruff", "eslint", "mypy", "pyright", "tsc"]}, "score": 0.0, "status": "fail", "threshold": "single-file lint + type-check commands documented"}, {"attribute": {"category": "Documentation Standards", "criteria": "README.md with installation, usage, and development sections", "default_weight": 0.05, "description": "Well-structured README with key sections", "id": "readme_structure", "name": "README Structure", "tier": 1}, "error_message": null, "evidence": ["Found 3/3 essential sections", "Installation: \u2713", "Usage: \u2713", "Development: \u2713"], "measured_value": "3/3 sections", "remediation": null, "score": 100.0, "status": "pass", "threshold": "3/3 sections"}, {"attribute": {"category": "Repository Structure", "criteria": "Standard directories (src/ or project-named, tests/) present", "default_weight": 0.05, "description": "Follows standard project structure for language", "id": "standard_layout", "name": "Standard Project Layouts", "tier": 1}, "error_message": null, "evidence": ["Found 0/2 standard directories", "source directory: \u2717 (no src/ or project-named dir)", "tests/: \u2717"], "measured_value": "0/2 directories", "remediation": {"citations": [{"relevance": "Official guidance on Python project layouts", "source": "Python Packaging Authority", "title": "src layout vs flat layout", "url": "https://packaging.python.org/en/latest/discussions/src-layout-vs-flat-layout/"}], "commands": ["# Option A: src layout", "mkdir -p src/mypackage", "touch src/mypackage/__init__.py", "# ---", "# Option B: flat layout (project-named)", "mkdir -p mypackage", "touch mypackage/__init__.py", "# Create tests directory", "mkdir -p tests", "touch tests/__init__.py", "touch tests/test_example.py"], "examples": ["# src layout (recommended for distributable packages)\nproject/\n\u251c\u2500\u2500 src/\n\u2502   \u2514\u2500\u2500 mypackage/\n\u2502       \u251c\u2500\u2500 __init__.py\n\u2502       \u2514\u2500\u2500 module.py\n\u251c\u2500\u2500 tests/\n\u2502   \u2514\u2500\u2500 test_module.py\n\u2514\u2500\u2500 pyproject.toml\n\n# flat layout (common in major projects like pandas, numpy)\nproject/\n\u251c\u2500\u2500 mypackage/\n\u2502   \u251c\u2500\u2500 __init__.py\n\u2502   \u2514\u2500\u2500 module.py\n\u251c\u2500\u2500 tests/\n\u2502   \u2514\u2500\u2500 test_module.py\n\u2514\u2500\u2500 pyproject.toml\n"], "steps": ["Create a source directory for your code", "Option A: Use src/ layout (recommended for packages)", "Option B: Use project-named directory (e.g., mypackage/)", "Ensure your package has __init__.py", "Create tests/ directory for test files", "Add at least one test file"], "summary": "Organize code into standard directories", "tools": []}, "score": 0.0, "status": "fail", "threshold": "2/2 directories"}, {"attribute": {"category": "Dependency Management", "criteria": "Lock file with pinned versions, updated within 6 months", "default_weight": 0.05, "description": "Dependencies pinned to exact versions in lock files", "id": "lock_files", "name": "Dependency Pinning for Reproducibility", "tier": 1}, "error_message": null, "evidence": ["No dependency lock files found"], "measured_value": "none", "remediation": {"citations": [], "commands": ["npm install  # npm", "pip freeze \u003e requirements.txt  # Python", "poetry lock  # Python with Poetry"], "examples": [], "steps": ["For npm: run \u0027npm install\u0027 (generates package-lock.json)", "For Python: use \u0027pip freeze \u003e requirements.txt\u0027 or poetry", "For Ruby: run \u0027bundle install\u0027 (generates Gemfile.lock)"], "summary": "Add lock file for dependency reproducibility", "tools": ["npm", "pip", "poetry", "bundler"]}, "score": 0.0, "status": "fail", "threshold": "lock file with pinned versions"}, {"attribute": {"category": "Security", "criteria": "Dependabot, Renovate, CodeQL, or SAST tools configured; secret detection enabled", "default_weight": 0.05, "description": "Security scanning tools configured for dependencies and code", "id": "dependency_security", "name": "Dependency Security \u0026 Vulnerability Scanning", "tier": 1}, "error_message": null, "evidence": ["\u2713 SECURITY.md present (vulnerability disclosure policy)"], "measured_value": "No security scanning tools configured", "remediation": {"citations": [{"relevance": "Industry-standard list of critical web application security risks", "source": "OWASP", "title": "OWASP Top 10", "url": "https://owasp.org/www-project-top-ten/"}, {"relevance": "Official GitHub security features and best practices documentation", "source": "GitHub", "title": "Security Best Practices", "url": "https://docs.github.com/en/code-security"}], "commands": ["gh repo edit --enable-security", "pip install pre-commit detect-secrets", "pre-commit install"], "examples": ["# .github/dependabot.yml\nversion: 2\nupdates:\n  - package-ecosystem: pip\n    directory: /\n    schedule:\n      interval: weekly", "# renovate.json\n{\n  \"extends\": [\"config:base\"],\n  \"schedule\": \"after 10pm every weekday\"\n}", "# .pre-commit-config.yaml\nrepos:\n  - repo: https://github.com/Yelp/detect-secrets\n    rev: v1.4.0\n    hooks:\n      - id: detect-secrets"], "steps": ["Enable Dependabot in GitHub repository settings", "Add .github/dependabot.yml configuration file", "Or configure Renovate: add renovate.json to repository root", "Set up CodeQL scanning for SAST", "Add secret detection to pre-commit hooks", "Configure language-specific security scanners"], "summary": "Configure security scanning for dependencies and code", "tools": ["Dependabot", "Renovate", "CodeQL", "detect-secrets", "Bandit", "Semgrep"]}, "score": 5, "status": "fail", "threshold": "\u226560 points (Dependabot/Renovate + SAST or multiple scanners)"}, {"attribute": {"category": "dbt SQL Projects", "criteria": "dbt_project.yml exists with name, config-version, profile", "default_weight": 0.1, "description": "Valid dbt_project.yml with required fields", "id": "dbt_project_config", "name": "dbt Project Configuration", "tier": 1}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "dbt SQL Projects", "criteria": "\u226580% of models have descriptions in schema.yml", "default_weight": 0.1, "description": "Model descriptions in schema YAML files", "id": "dbt_model_documentation", "name": "dbt Model Documentation", "tier": 1}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Testing \u0026 CI/CD", "criteria": "Pre-commit or agent hooks configured", "default_weight": 0.03, "description": "Hooks and lint rules for deterministic quality enforcement", "id": "deterministic_enforcement", "name": "Deterministic Enforcement (Hooks \u0026 Lint Rules)", "tier": 2}, "error_message": null, "evidence": [".pre-commit-config.yaml found (pre-commit hooks)"], "measured_value": "configured", "remediation": null, "score": 60.0, "status": "pass", "threshold": "configured"}, {"attribute": {"category": "Git \u0026 Version Control", "criteria": "\u226580% of recent commits follow convention", "default_weight": 0.03, "description": "Follows conventional commit format", "id": "conventional_commits", "name": "Conventional Commit Messages", "tier": 2}, "error_message": null, "evidence": ["No commitlint configuration found (.commitlintrc.json, package.json, husky, or pre-commit)"], "measured_value": "not configured", "remediation": {"citations": [], "commands": ["# Python (pre-commit):", "pip install pre-commit \u0026\u0026 pre-commit install --hook-type commit-msg", "# JS (commitlint + husky):", "npm install --save-dev @commitlint/cli @commitlint/config-conventional husky"], "examples": [], "steps": ["Option A (Python/pre-commit): Add conventional-pre-commit to .pre-commit-config.yaml", "Option B (JS/commitlint): Install commitlint and configure husky for commit-msg hook"], "summary": "Configure conventional commits with commitlint", "tools": ["pre-commit", "conventional-pre-commit", "commitlint", "husky"]}, "score": 0.0, "status": "fail", "threshold": "configured"}, {"attribute": {"category": "Git \u0026 Version Control", "criteria": ".gitignore exists and includes language-specific patterns from GitHub templates", "default_weight": 0.03, "description": "Comprehensive .gitignore file with language-specific patterns", "id": "gitignore_completeness", "name": ".gitignore Completeness", "tier": 2}, "error_message": null, "evidence": [".gitignore found (863 bytes)", "Pattern coverage: 9/9 (100%)"], "measured_value": "9/9 patterns", "remediation": null, "score": 100.0, "status": "pass", "threshold": "\u226570% of language-specific patterns"}, {"attribute": {"category": "Build \u0026 Development", "criteria": "Single command (make setup, npm install, etc.) documented prominently", "default_weight": 0.03, "description": "Single command to set up development environment from fresh clone", "id": "one_command_setup", "name": "One-Command Build/Setup", "tier": 2}, "error_message": null, "evidence": ["Setup command found in README: \u0027helm install\u0027", "No Makefile or setup script found", "Setup instructions in prominent location"], "measured_value": "helm install", "remediation": {"citations": [{"relevance": "Guide to using Makefiles for one-command setup", "source": "freeCodeCamp", "title": "Using make for project automation", "url": "https://www.freecodecamp.org/news/want-to-know-the-easiest-way-to-save-time-use-make/"}], "commands": ["# Example Makefile", "cat \u003e Makefile \u003c\u003c \u0027EOF\u0027", ".PHONY: setup", "setup:", "\tpython -m venv venv", "\t. venv/bin/activate \u0026\u0026 pip install -r requirements.txt", "\tpre-commit install", "\tcp .env.example .env", "\t@echo \u0027Setup complete! Run make test to verify.\u0027", "EOF"], "examples": ["# Quick Start section in README\n\n## Quick Start\n\n```bash\nmake setup  # One command to set up development environment\nmake test   # Run tests to verify setup\n```\n"], "steps": ["Choose setup automation tool (Makefile, setup script, or package manager)", "Create setup command that handles all dependencies", "Document setup command prominently in README (Quick Start section)", "Ensure setup is idempotent (safe to run multiple times)", "Test setup on fresh clone to verify it works"], "summary": "Create single-command setup for development environment", "tools": ["make", "npm", "pip", "poetry"]}, "score": 70, "status": "fail", "threshold": "single command"}, {"attribute": {"category": "Context Window Optimization", "criteria": "\u003c5% of files \u003e500 lines, no files \u003e1000 lines", "default_weight": 0.03, "description": "Files are reasonably sized for AI context windows", "id": "file_size_limits", "name": "File Size Limits", "tier": 2}, "error_message": null, "evidence": ["Found 8 files \u003e1000 lines (8.2% of 97 files)", "Largest: kagenti-operator/internal/controller/agentcard_controller.go (1299 lines)"], "measured_value": "8 huge, 14 large out of 97", "remediation": {"citations": [], "commands": [], "examples": ["# Split large file:\n# models.py (1500 lines) \u2192 models/user.py, models/product.py, models/order.py"], "steps": ["Identify files \u003e1000 lines", "Split into logical submodules", "Extract classes/functions into separate files", "Maintain single responsibility principle"], "summary": "Refactor large files into smaller, focused modules", "tools": ["refactoring tools", "linters"]}, "score": 0, "status": "fail", "threshold": "\u003c5% files \u003e500 lines, 0 files \u003e1000 lines"}, {"attribute": {"category": "Code Organization", "criteria": "Feature-based organization, cohesive modules, low coupling", "default_weight": 0.03, "description": "Code organized with single responsibility per module", "id": "separation_of_concerns", "name": "Separation of Concerns", "tier": 2}, "error_message": null, "evidence": ["Good directory organization (feature-based or flat)", "File cohesion: 0/0 files \u003e500 lines", "No catch-all modules (utils.py, helpers.py) detected"], "measured_value": "organization:100, cohesion:100, naming:100", "remediation": null, "score": 100.0, "status": "pass", "threshold": "\u226575 overall"}, {"attribute": {"category": "Documentation", "criteria": "README \u003c500 lines with clear structure, bullet points over prose", "default_weight": 0.03, "description": "Documentation maximizes information density while minimizing token consumption", "id": "concise_documentation", "name": "Concise Documentation", "tier": 2}, "error_message": null, "evidence": ["README length: 205 lines (excellent)", "Heading density: 8.3 per 100 lines (target: 3-5)", "13 bullet points, 5 code blocks (concise formatting)"], "measured_value": "205 lines, 17 headings, 13 bullets", "remediation": null, "score": 78.0, "status": "pass", "threshold": "\u003c500 lines, structured format"}, {"attribute": {"category": "Documentation", "criteria": "\u226580% of public functions/classes have docstrings", "default_weight": 0.03, "description": "Function, class, and module-level documentation using language-specific conventions", "id": "inline_documentation", "name": "Inline Documentation", "tier": 2}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Agent Patterns \u0026 Knowledge", "criteria": "3-5 pattern references or skills documented", "default_weight": 0.03, "description": "Reference implementations and skills for common change types", "id": "pattern_references", "name": "Pattern References for Common Changes", "tier": 2}, "error_message": null, "evidence": [".claude/skills/ directory with 13 SKILL.md file(s)"], "measured_value": "1 reference source(s)", "remediation": null, "score": 60.0, "status": "pass", "threshold": "pattern references or skills documented"}, {"attribute": {"category": "dbt SQL Projects", "criteria": "\u226580% of models have unique/not_null tests on primary key", "default_weight": 0.03, "description": "Generic tests on model primary keys", "id": "dbt_data_tests", "name": "dbt Data Tests", "tier": 2}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "dbt SQL Projects", "criteria": "models/ with staging/ and marts/ subdirectories", "default_weight": 0.03, "description": "Organized staging/marts directory structure", "id": "dbt_project_structure", "name": "dbt Project Structure", "tier": 2}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Agent Patterns \u0026 Knowledge", "criteria": "Design docs with architectural intent", "default_weight": 0.02, "description": "Documented preconditions, invariants, and design rationale", "id": "design_intent", "name": "Design Intent Documentation", "tier": 3}, "error_message": null, "evidence": ["Design intent language found in README.md"], "measured_value": "minimal", "remediation": {"citations": [{"relevance": "Agents cannot infer design intent from code alone", "source": "Red Hat", "title": "Repository Scaffolding for AI Coding Agents, Section 2.3", "url": ""}], "commands": ["mkdir -p docs/design"], "examples": ["# docs/design/event-system.md\n## Invariants\n- Event log is append-only; never mutate or delete entries\n- Events are processed exactly-once via idempotency keys\n\n## Preconditions\n- Auth middleware must validate token before event handlers run\n\n## Rationale\n- Polling instead of webhooks: upstream API has 5s delivery SLA, too slow for our use case"], "steps": ["Create docs/design/ directory", "For each critical module, document preconditions, invariants, and rationale", "Use an AI agent to reverse-engineer initial design docs from code, then enrich with intent", "Reference design docs from CLAUDE.md/AGENTS.md"], "summary": "Document design intent: preconditions, invariants, and rationale", "tools": []}, "score": 30.0, "status": "fail", "threshold": "design docs with preconditions/invariants"}, {"attribute": {"category": "AI-Assisted Development Tools", "criteria": "Repomix configured with fresh output (\u003c 7 days old)", "default_weight": 0.02, "description": "Automated repository context generation for AI consumption", "id": "repomix_config", "name": "Repomix AI Context Generation", "tier": 3}, "error_message": null, "evidence": ["Repomix configuration not found", "Missing repomix.config.json"], "measured_value": "not configured", "remediation": {"citations": [{"relevance": "AI-friendly repository context generation tool", "source": "Repomix", "title": "Repomix - AI-Friendly Repository Packager", "url": "https://github.com/yamadashy/repomix"}], "commands": ["agentready repomix-generate --init", "agentready repomix-generate"], "examples": ["# Initialize Repomix configuration\nagentready repomix-generate --init\n\n# Generate repository context\nagentready repomix-generate\n\n# Check freshness\nagentready repomix-generate --check"], "steps": ["Initialize Repomix: agentready repomix-generate --init", "Generate context: agentready repomix-generate", "Add to bootstrap: agentready bootstrap --repomix", "Set up GitHub Action for automatic updates"], "summary": "Configure Repomix for AI-friendly context generation", "tools": ["Repomix", "AgentReady"]}, "score": 0.0, "status": "fail", "threshold": "configured"}, {"attribute": {"category": "Code Quality", "criteria": "Average complexity \u003c10, no functions \u003e15", "default_weight": 0.02, "description": "Cyclomatic complexity thresholds enforced", "id": "cyclomatic_complexity", "name": "Cyclomatic Complexity Thresholds", "tier": 3}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Documentation Standards", "criteria": "ADR directory with documented decisions", "default_weight": 0.03, "description": "Lightweight documents capturing architectural decisions", "id": "architecture_decisions", "name": "Architecture Decision Records (ADRs)", "tier": 3}, "error_message": null, "evidence": ["No ADR directory found (checked docs/adr/, .adr/, adr/, docs/decisions/)"], "measured_value": "no ADR directory", "remediation": {"citations": [{"relevance": "Original ADR format and rationale", "source": "Michael Nygard", "title": "Documenting Architecture Decisions", "url": "https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions"}, {"relevance": "Modern ADR template with examples", "source": "GitHub adr/madr", "title": "Markdown ADR (MADR) Template", "url": "https://github.com/adr/madr"}], "commands": ["# Create ADR directory", "mkdir -p docs/adr", "", "# Create first ADR using template", "cat \u003e docs/adr/0001-use-architecture-decision-records.md \u003c\u003c \u0027EOF\u0027", "# 1. Use Architecture Decision Records", "", "Date: 2025-11-22", "", "## Status", "Accepted", "", "## Context", "We need to record architectural decisions made in this project.", "", "## Decision", "We will use Architecture Decision Records (ADRs) as described by Michael Nygard.", "", "## Consequences", "- Decisions are documented with context", "- Future contributors understand rationale", "- ADRs are lightweight and version-controlled", "EOF"], "examples": ["# Example ADR Structure\n\n```markdown\n# 2. Use PostgreSQL for Database\n\nDate: 2025-11-22\n\n## Status\nAccepted\n\n## Context\nWe need a relational database for complex queries and ACID transactions.\nTeam has PostgreSQL experience. Need full-text search capabilities.\n\n## Decision\nUse PostgreSQL 15+ as primary database.\n\n## Consequences\n- Positive: Robust ACID, full-text search, team familiarity\n- Negative: Higher resource usage than SQLite\n- Neutral: Need to manage migrations, backups\n```\n"], "steps": ["Create docs/adr/ directory in repository root", "Use Michael Nygard ADR template or MADR format", "Document each significant architectural decision", "Number ADRs sequentially (0001-*.md, 0002-*.md)", "Include Status, Context, Decision, and Consequences sections", "Update ADR status when decisions are revised (Superseded, Deprecated)"], "summary": "Create Architecture Decision Records (ADRs) directory and document key decisions", "tools": ["adr-tools", "log4brains"]}, "score": 0.0, "status": "fail", "threshold": "ADR directory with decisions"}, {"attribute": {"category": "Code Quality", "criteria": "Structured logging library configured (structlog, winston, zap)", "default_weight": 0.02, "description": "Logging in structured format (JSON) with consistent fields", "id": "structured_logging", "name": "Structured Logging", "tier": 3}, "error_message": null, "evidence": ["Structured logging check not implemented for [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "API Documentation", "criteria": "OpenAPI 3.x spec with complete endpoint documentation", "default_weight": 0.03, "description": "Machine-readable API documentation in OpenAPI format", "id": "openapi_specs", "name": "OpenAPI/Swagger Specifications", "tier": 3}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Git \u0026 Version Control", "criteria": "Branch protection enabled with status checks and required reviews", "default_weight": 0.005, "description": "Required status checks and review approvals before merging", "id": "branch_protection", "name": "Branch Protection Rules", "tier": 4}, "error_message": null, "evidence": ["Requires GitHub API integration for branch protection checks. Future implementation will verify: required status checks, required reviews, force push prevention, and branch update requirements."], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Code Quality", "criteria": "Language-specific linters configured (pylint, ESLint, RuboCop, etc.)", "default_weight": 0.01, "description": "Linter configuration for detecting code smells and anti-patterns", "id": "code_smells", "name": "Code Smell Elimination", "tier": 4}, "error_message": null, "evidence": ["No linters configured"], "measured_value": "none", "remediation": {"citations": [{"relevance": "Official documentation for Pylint code analysis tool", "source": "Pylint", "title": "Pylint Documentation", "url": "https://pylint.readthedocs.io/"}, {"relevance": "Official documentation for ESLint JavaScript/TypeScript linter", "source": "ESLint", "title": "ESLint Documentation", "url": "https://eslint.org/docs/latest/"}], "commands": ["go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest", "npm install --save-dev markdownlint-cli \u0026\u0026 touch .markdownlint.json"], "examples": ["# .pylintrc example\n[MASTER]\nmax-line-length=100\n\n[MESSAGES CONTROL]\ndisable=C0111", "# .eslintrc.json example\n{\n  \"extends\": \"eslint:recommended\",\n  \"rules\": {\n    \"no-console\": \"warn\"\n  }\n}"], "steps": ["Configure golangci-lint for Go", "Add actionlint for GitHub Actions workflow validation", "Configure markdownlint for documentation quality"], "summary": "Configure 3 missing linter(s)", "tools": ["golangci-lint", "actionlint", "markdownlint"]}, "score": 0.0, "status": "fail", "threshold": "\u226560% of applicable linters configured"}, {"attribute": {"category": "Repository Structure", "criteria": "PR template and issue templates in .github/", "default_weight": 0.01, "description": "Standardized templates for issues and PRs", "id": "issue_pr_templates", "name": "Issue \u0026 Pull Request Templates", "tier": 4}, "error_message": null, "evidence": ["No PR template found", "No issue template directory found"], "measured_value": "PR:False, Issues:0", "remediation": {"citations": [{"relevance": "Official GitHub guide for templates", "source": "GitHub Docs", "title": "About issue and pull request templates", "url": "https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/about-issue-and-pull-request-templates"}], "commands": ["# Create directories", "mkdir -p .github/ISSUE_TEMPLATE", "", "# Create PR template", "cat \u003e .github/PULL_REQUEST_TEMPLATE.md \u003c\u003c \u0027EOF\u0027", "## Summary", "\u003c!-- Describe the changes in this PR --\u003e", "", "## Related Issues", "Fixes #", "", "## Testing", "- [ ] Tests added/updated", "- [ ] All tests pass", "", "## Checklist", "- [ ] Documentation updated", "- [ ] CHANGELOG.md updated", "EOF"], "examples": ["# Bug Report Template (.github/ISSUE_TEMPLATE/bug_report.md)\n\n```markdown\n---\nname: Bug Report\nabout: Create a report to help us improve\ntitle: \u0027[BUG] \u0027\nlabels: bug\nassignees: \u0027\u0027\n---\n\n**Describe the bug**\nA clear description of what the bug is.\n\n**To Reproduce**\nSteps to reproduce:\n1. Go to \u0027...\u0027\n2. Click on \u0027....\u0027\n3. See error\n\n**Expected behavior**\nWhat you expected to happen.\n\n**Environment**\n- OS: [e.g. macOS 13.0]\n- Version: [e.g. 1.0.0]\n```\n"], "steps": ["Create .github/ directory if it doesn\u0027t exist", "Add PULL_REQUEST_TEMPLATE.md for PRs", "Create .github/ISSUE_TEMPLATE/ directory", "Add bug_report.md for bug reports", "Add feature_request.md for feature requests", "Optionally add config.yml to configure template chooser"], "summary": "Create GitHub issue and PR templates in .github/ directory", "tools": ["gh"]}, "score": 0, "status": "fail", "threshold": "PR template + \u22652 issue templates"}, {"attribute": {"category": "Build \u0026 Development", "criteria": "Dockerfile/Containerfile, docker-compose.yml, .dockerignore/.containerignore, multi-stage builds", "default_weight": 0.01, "description": "Container configuration for consistent development environments", "id": "container_setup", "name": "Container/Virtualization Setup", "tier": 4}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Agent Patterns \u0026 Knowledge", "criteria": "Component-level context files for repos \u003e50K lines", "default_weight": 0.01, "description": "Path-scoped rules and skills for large repos", "id": "progressive_disclosure", "name": "Progressive Disclosure", "tier": 4}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}], "metadata": {"agentready_version": "2.35.2", "assessment_timestamp": "2026-05-12T09:19:21.586698", "assessment_timestamp_human": "May 12, 2026 at 9:19 AM", "command": "/Users/rhuss/.cache/uv/archive-v0/-sEsvpNoWBP_t22eeb_V-/bin/agentready -- assess .", "executed_by": "rhuss@rhuss-mac", "research_version": "2.0.0", "working_directory": "/Users/rhuss/Development/ai/kagenti-operator"}, "overall_score": 43.8, "repository": {"branch": "main", "commit_hash": "01f875a573b9cfc13eacc29e4604c71def861880", "languages": {"Go": 97, "Markdown": 37, "Shell": 12, "YAML": 82}, "name": "kagenti-operator", "path": "/Users/rhuss/Development/ai/kagenti-operator", "total_files": 246, "total_lines": 46081, "url": "git@github.com:rhuss/kagenti-operator.git"}, "schema_version": "1.0.0", "timestamp": "2026-05-12T09:19:21.586698"};
+        const ASSESSMENT = {"attributes_assessed": 20, "attributes_skipped": 13, "attributes_total": 33, "certification_level": "Bronze", "config": {"custom_theme": null, "excluded_attributes": [], "language_overrides": {}, "output_dir": null, "report_theme": "default", "weights": {}}, "discovered_skills": [], "duration_seconds": 0.2, "findings": [{"attribute": {"category": "Testing \u0026 CI/CD", "criteria": "Runnable tests with coverage config", "default_weight": 0.1, "description": "Single-command test runner with adequate coverage configuration", "id": "test_execution", "name": "Test Execution \u0026 Coverage", "tier": 1}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Code Quality", "criteria": "\u003e80% of functions have type annotations", "default_weight": 0.08, "description": "Type hints in function signatures", "id": "type_annotations", "name": "Type Annotations", "tier": 1}, "error_message": null, "evidence": ["Type annotation check not implemented for [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Context Window Optimization", "criteria": "CLAUDE.md or AGENTS.md file exists in repository root", "default_weight": 0.07, "description": "Project-specific configuration for AI coding agents", "id": "claude_md_file", "name": "CLAUDE.md Configuration Files", "tier": 1}, "error_message": null, "evidence": ["CLAUDE.md found at /Users/rhuss/Development/ai/operator/CLAUDE.md"], "measured_value": "present", "remediation": null, "score": 100.0, "status": "pass", "threshold": "present"}, {"attribute": {"category": "Testing \u0026 CI/CD", "criteria": "CI gates with lint + type-check + tests", "default_weight": 0.05, "description": "CI runs lint, type-check, and tests on every PR", "id": "ci_quality_gates", "name": "CI Quality Gates", "tier": 1}, "error_message": null, "evidence": ["CI config found: .github/workflows/release.yml, .github/workflows/project.yml, .github/workflows/pr-verifier.yml, .github/workflows/self-assign.yml, .github/workflows/ci.yaml, .github/workflows/stale.yaml, .github/workflows/security-scans.yaml, .github/workflows/scorecard.yaml", "Lint gate detected in CI", "No test gate found in CI", "No type-check gate found in CI", "Descriptive job/step names found", "Parallel job execution detected", "Config includes comments", "Artifacts uploaded"], "measured_value": "missing quality gates", "remediation": {"citations": [{"relevance": "Official GitHub Actions guide", "source": "GitHub", "title": "GitHub Actions Documentation", "url": "https://docs.github.com/en/actions"}, {"relevance": "Industry best practices for CI/CD", "source": "CircleCI", "title": "CI/CD Best Practices", "url": "https://circleci.com/blog/ci-cd-best-practices/"}], "commands": ["# Create GitHub Actions workflow", "mkdir -p .github/workflows", "touch .github/workflows/ci.yml", "", "# Validate workflow", "gh workflow view ci.yml"], "examples": ["# .github/workflows/ci.yml - Good example\n\nname: CI Pipeline\n\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\njobs:\n  lint:\n    name: Lint Code\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Set up Python\n        uses: actions/setup-python@v5\n        with:\n          python-version: \u00273.11\u0027\n          cache: \u0027pip\u0027  # Caching\n\n      - name: Install dependencies\n        run: pip install -r requirements.txt\n\n      - name: Run linters\n        run: |\n          black --check .\n          isort --check .\n          ruff check .\n\n  test:\n    name: Run Tests\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Set up Python\n        uses: actions/setup-python@v5\n        with:\n          python-version: \u00273.11\u0027\n          cache: \u0027pip\u0027\n\n      - name: Install dependencies\n        run: pip install -r requirements.txt\n\n      - name: Run tests with coverage\n        run: pytest --cov --cov-report=xml\n\n      - name: Upload coverage reports\n        uses: codecov/codecov-action@v3\n        with:\n          files: ./coverage.xml\n\n  build:\n    name: Build Package\n    runs-on: ubuntu-latest\n    needs: [lint, test]  # Runs after lint/test pass\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Build package\n        run: python -m build\n\n      - name: Upload build artifacts\n        uses: actions/upload-artifact@v3\n        with:\n          name: dist\n          path: dist/\n"], "steps": ["Create CI config for your platform (GitHub Actions, GitLab CI, etc.)", "Define jobs: lint, test, build", "Use descriptive job and step names", "Configure dependency caching", "Enable parallel job execution", "Upload artifacts: test results, coverage reports", "Add status badge to README"], "summary": "Add or improve CI/CD pipeline configuration", "tools": ["github-actions", "gitlab-ci", "circleci"]}, "score": 75, "status": "fail", "threshold": "CI with lint + test + type-check gates on PRs"}, {"attribute": {"category": "Verification \u0026 Feedback Loops", "criteria": "Documented single-file lint/type-check commands", "default_weight": 0.05, "description": "Single-file lint and type-check commands available for fast feedback", "id": "single_file_verification", "name": "Single-File Verification", "tier": 1}, "error_message": null, "evidence": ["No single-file verification commands found in context files"], "measured_value": "not documented", "remediation": {"citations": [], "commands": ["# Python", "ruff check path/to/file.py", "mypy path/to/file.py", "", "# JavaScript/TypeScript", "npx eslint path/to/file.ts", "npx tsc --noEmit path/to/file.ts"], "examples": [], "steps": ["Add single-file lint command to context file (e.g., \u0027ruff check path/to/file.py\u0027)", "Add single-file type-check command (e.g., \u0027mypy path/to/file.py\u0027)", "Ensure these commands work without a full build step", "Target \u003c5 seconds execution per file"], "summary": "Document single-file lint and type-check commands in CLAUDE.md/AGENTS.md", "tools": ["ruff", "eslint", "mypy", "pyright", "tsc"]}, "score": 0.0, "status": "fail", "threshold": "single-file lint + type-check commands documented"}, {"attribute": {"category": "Documentation Standards", "criteria": "README.md with installation, usage, and development sections", "default_weight": 0.05, "description": "Well-structured README with key sections", "id": "readme_structure", "name": "README Structure", "tier": 1}, "error_message": null, "evidence": ["Found 3/3 essential sections", "Installation: \u2713", "Usage: \u2713", "Development: \u2713"], "measured_value": "3/3 sections", "remediation": null, "score": 100.0, "status": "pass", "threshold": "3/3 sections"}, {"attribute": {"category": "Repository Structure", "criteria": "Standard directories (src/ or project-named, tests/) present", "default_weight": 0.05, "description": "Follows standard project structure for language", "id": "standard_layout", "name": "Standard Project Layouts", "tier": 1}, "error_message": null, "evidence": ["Found 0/2 standard directories", "source directory: \u2717 (no src/ or project-named dir)", "tests/: \u2717"], "measured_value": "0/2 directories", "remediation": {"citations": [{"relevance": "Official guidance on Python project layouts", "source": "Python Packaging Authority", "title": "src layout vs flat layout", "url": "https://packaging.python.org/en/latest/discussions/src-layout-vs-flat-layout/"}], "commands": ["# Option A: src layout", "mkdir -p src/mypackage", "touch src/mypackage/__init__.py", "# ---", "# Option B: flat layout (project-named)", "mkdir -p mypackage", "touch mypackage/__init__.py", "# Create tests directory", "mkdir -p tests", "touch tests/__init__.py", "touch tests/test_example.py"], "examples": ["# src layout (recommended for distributable packages)\nproject/\n\u251c\u2500\u2500 src/\n\u2502   \u2514\u2500\u2500 mypackage/\n\u2502       \u251c\u2500\u2500 __init__.py\n\u2502       \u2514\u2500\u2500 module.py\n\u251c\u2500\u2500 tests/\n\u2502   \u2514\u2500\u2500 test_module.py\n\u2514\u2500\u2500 pyproject.toml\n\n# flat layout (common in major projects like pandas, numpy)\nproject/\n\u251c\u2500\u2500 mypackage/\n\u2502   \u251c\u2500\u2500 __init__.py\n\u2502   \u2514\u2500\u2500 module.py\n\u251c\u2500\u2500 tests/\n\u2502   \u2514\u2500\u2500 test_module.py\n\u2514\u2500\u2500 pyproject.toml\n"], "steps": ["Create a source directory for your code", "Option A: Use src/ layout (recommended for packages)", "Option B: Use project-named directory (e.g., mypackage/)", "Ensure your package has __init__.py", "Create tests/ directory for test files", "Add at least one test file"], "summary": "Organize code into standard directories", "tools": []}, "score": 0.0, "status": "fail", "threshold": "2/2 directories"}, {"attribute": {"category": "Dependency Management", "criteria": "Lock file with pinned versions, updated within 6 months", "default_weight": 0.05, "description": "Dependencies pinned to exact versions in lock files", "id": "lock_files", "name": "Dependency Pinning for Reproducibility", "tier": 1}, "error_message": null, "evidence": ["No dependency lock files found"], "measured_value": "none", "remediation": {"citations": [], "commands": ["npm install  # npm", "pip freeze \u003e requirements.txt  # Python", "poetry lock  # Python with Poetry"], "examples": [], "steps": ["For npm: run \u0027npm install\u0027 (generates package-lock.json)", "For Python: use \u0027pip freeze \u003e requirements.txt\u0027 or poetry", "For Ruby: run \u0027bundle install\u0027 (generates Gemfile.lock)"], "summary": "Add lock file for dependency reproducibility", "tools": ["npm", "pip", "poetry", "bundler"]}, "score": 0.0, "status": "fail", "threshold": "lock file with pinned versions"}, {"attribute": {"category": "Security", "criteria": "Dependabot, Renovate, CodeQL, or SAST tools configured; secret detection enabled", "default_weight": 0.05, "description": "Security scanning tools configured for dependencies and code", "id": "dependency_security", "name": "Dependency Security \u0026 Vulnerability Scanning", "tier": 1}, "error_message": null, "evidence": ["\u2713 SECURITY.md present (vulnerability disclosure policy)"], "measured_value": "No security scanning tools configured", "remediation": {"citations": [{"relevance": "Industry-standard list of critical web application security risks", "source": "OWASP", "title": "OWASP Top 10", "url": "https://owasp.org/www-project-top-ten/"}, {"relevance": "Official GitHub security features and best practices documentation", "source": "GitHub", "title": "Security Best Practices", "url": "https://docs.github.com/en/code-security"}], "commands": ["gh repo edit --enable-security", "pip install pre-commit detect-secrets", "pre-commit install"], "examples": ["# .github/dependabot.yml\nversion: 2\nupdates:\n  - package-ecosystem: pip\n    directory: /\n    schedule:\n      interval: weekly", "# renovate.json\n{\n  \"extends\": [\"config:base\"],\n  \"schedule\": \"after 10pm every weekday\"\n}", "# .pre-commit-config.yaml\nrepos:\n  - repo: https://github.com/Yelp/detect-secrets\n    rev: v1.4.0\n    hooks:\n      - id: detect-secrets"], "steps": ["Enable Dependabot in GitHub repository settings", "Add .github/dependabot.yml configuration file", "Or configure Renovate: add renovate.json to repository root", "Set up CodeQL scanning for SAST", "Add secret detection to pre-commit hooks", "Configure language-specific security scanners"], "summary": "Configure security scanning for dependencies and code", "tools": ["Dependabot", "Renovate", "CodeQL", "detect-secrets", "Bandit", "Semgrep"]}, "score": 5, "status": "fail", "threshold": "\u226560 points (Dependabot/Renovate + SAST or multiple scanners)"}, {"attribute": {"category": "dbt SQL Projects", "criteria": "dbt_project.yml exists with name, config-version, profile", "default_weight": 0.1, "description": "Valid dbt_project.yml with required fields", "id": "dbt_project_config", "name": "dbt Project Configuration", "tier": 1}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "dbt SQL Projects", "criteria": "\u226580% of models have descriptions in schema.yml", "default_weight": 0.1, "description": "Model descriptions in schema YAML files", "id": "dbt_model_documentation", "name": "dbt Model Documentation", "tier": 1}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Testing \u0026 CI/CD", "criteria": "Pre-commit or agent hooks configured", "default_weight": 0.03, "description": "Hooks and lint rules for deterministic quality enforcement", "id": "deterministic_enforcement", "name": "Deterministic Enforcement (Hooks \u0026 Lint Rules)", "tier": 2}, "error_message": null, "evidence": [".pre-commit-config.yaml found (pre-commit hooks)"], "measured_value": "configured", "remediation": null, "score": 60.0, "status": "pass", "threshold": "configured"}, {"attribute": {"category": "Git \u0026 Version Control", "criteria": "\u226580% of recent commits follow convention", "default_weight": 0.03, "description": "Follows conventional commit format", "id": "conventional_commits", "name": "Conventional Commit Messages", "tier": 2}, "error_message": null, "evidence": ["No commitlint configuration found (.commitlintrc.json, package.json, husky, or pre-commit)"], "measured_value": "not configured", "remediation": {"citations": [], "commands": ["# Python (pre-commit):", "pip install pre-commit \u0026\u0026 pre-commit install --hook-type commit-msg", "# JS (commitlint + husky):", "npm install --save-dev @commitlint/cli @commitlint/config-conventional husky"], "examples": [], "steps": ["Option A (Python/pre-commit): Add conventional-pre-commit to .pre-commit-config.yaml", "Option B (JS/commitlint): Install commitlint and configure husky for commit-msg hook"], "summary": "Configure conventional commits with commitlint", "tools": ["pre-commit", "conventional-pre-commit", "commitlint", "husky"]}, "score": 0.0, "status": "fail", "threshold": "configured"}, {"attribute": {"category": "Git \u0026 Version Control", "criteria": ".gitignore exists and includes language-specific patterns from GitHub templates", "default_weight": 0.03, "description": "Comprehensive .gitignore file with language-specific patterns", "id": "gitignore_completeness", "name": ".gitignore Completeness", "tier": 2}, "error_message": null, "evidence": [".gitignore found (863 bytes)", "Pattern coverage: 9/9 (100%)"], "measured_value": "9/9 patterns", "remediation": null, "score": 100.0, "status": "pass", "threshold": "\u226570% of language-specific patterns"}, {"attribute": {"category": "Build \u0026 Development", "criteria": "Single command (make setup, npm install, etc.) documented prominently", "default_weight": 0.03, "description": "Single command to set up development environment from fresh clone", "id": "one_command_setup", "name": "One-Command Build/Setup", "tier": 2}, "error_message": null, "evidence": ["Setup command found in README: \u0027helm install\u0027", "No Makefile or setup script found", "Setup instructions in prominent location"], "measured_value": "helm install", "remediation": {"citations": [{"relevance": "Guide to using Makefiles for one-command setup", "source": "freeCodeCamp", "title": "Using make for project automation", "url": "https://www.freecodecamp.org/news/want-to-know-the-easiest-way-to-save-time-use-make/"}], "commands": ["# Example Makefile", "cat \u003e Makefile \u003c\u003c \u0027EOF\u0027", ".PHONY: setup", "setup:", "\tpython -m venv venv", "\t. venv/bin/activate \u0026\u0026 pip install -r requirements.txt", "\tpre-commit install", "\tcp .env.example .env", "\t@echo \u0027Setup complete! Run make test to verify.\u0027", "EOF"], "examples": ["# Quick Start section in README\n\n## Quick Start\n\n```bash\nmake setup  # One command to set up development environment\nmake test   # Run tests to verify setup\n```\n"], "steps": ["Choose setup automation tool (Makefile, setup script, or package manager)", "Create setup command that handles all dependencies", "Document setup command prominently in README (Quick Start section)", "Ensure setup is idempotent (safe to run multiple times)", "Test setup on fresh clone to verify it works"], "summary": "Create single-command setup for development environment", "tools": ["make", "npm", "pip", "poetry"]}, "score": 70, "status": "fail", "threshold": "single command"}, {"attribute": {"category": "Context Window Optimization", "criteria": "\u003c5% of files \u003e500 lines, no files \u003e1000 lines", "default_weight": 0.03, "description": "Files are reasonably sized for AI context windows", "id": "file_size_limits", "name": "File Size Limits", "tier": 2}, "error_message": null, "evidence": ["Found 8 files \u003e1000 lines (8.2% of 97 files)", "Largest: operator/internal/controller/agentcard_controller.go (1299 lines)"], "measured_value": "8 huge, 14 large out of 97", "remediation": {"citations": [], "commands": [], "examples": ["# Split large file:\n# models.py (1500 lines) \u2192 models/user.py, models/product.py, models/order.py"], "steps": ["Identify files \u003e1000 lines", "Split into logical submodules", "Extract classes/functions into separate files", "Maintain single responsibility principle"], "summary": "Refactor large files into smaller, focused modules", "tools": ["refactoring tools", "linters"]}, "score": 0, "status": "fail", "threshold": "\u003c5% files \u003e500 lines, 0 files \u003e1000 lines"}, {"attribute": {"category": "Code Organization", "criteria": "Feature-based organization, cohesive modules, low coupling", "default_weight": 0.03, "description": "Code organized with single responsibility per module", "id": "separation_of_concerns", "name": "Separation of Concerns", "tier": 2}, "error_message": null, "evidence": ["Good directory organization (feature-based or flat)", "File cohesion: 0/0 files \u003e500 lines", "No catch-all modules (utils.py, helpers.py) detected"], "measured_value": "organization:100, cohesion:100, naming:100", "remediation": null, "score": 100.0, "status": "pass", "threshold": "\u226575 overall"}, {"attribute": {"category": "Documentation", "criteria": "README \u003c500 lines with clear structure, bullet points over prose", "default_weight": 0.03, "description": "Documentation maximizes information density while minimizing token consumption", "id": "concise_documentation", "name": "Concise Documentation", "tier": 2}, "error_message": null, "evidence": ["README length: 205 lines (excellent)", "Heading density: 8.3 per 100 lines (target: 3-5)", "13 bullet points, 5 code blocks (concise formatting)"], "measured_value": "205 lines, 17 headings, 13 bullets", "remediation": null, "score": 78.0, "status": "pass", "threshold": "\u003c500 lines, structured format"}, {"attribute": {"category": "Documentation", "criteria": "\u226580% of public functions/classes have docstrings", "default_weight": 0.03, "description": "Function, class, and module-level documentation using language-specific conventions", "id": "inline_documentation", "name": "Inline Documentation", "tier": 2}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Agent Patterns \u0026 Knowledge", "criteria": "3-5 pattern references or skills documented", "default_weight": 0.03, "description": "Reference implementations and skills for common change types", "id": "pattern_references", "name": "Pattern References for Common Changes", "tier": 2}, "error_message": null, "evidence": [".claude/skills/ directory with 13 SKILL.md file(s)"], "measured_value": "1 reference source(s)", "remediation": null, "score": 60.0, "status": "pass", "threshold": "pattern references or skills documented"}, {"attribute": {"category": "dbt SQL Projects", "criteria": "\u226580% of models have unique/not_null tests on primary key", "default_weight": 0.03, "description": "Generic tests on model primary keys", "id": "dbt_data_tests", "name": "dbt Data Tests", "tier": 2}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "dbt SQL Projects", "criteria": "models/ with staging/ and marts/ subdirectories", "default_weight": 0.03, "description": "Organized staging/marts directory structure", "id": "dbt_project_structure", "name": "dbt Project Structure", "tier": 2}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Agent Patterns \u0026 Knowledge", "criteria": "Design docs with architectural intent", "default_weight": 0.02, "description": "Documented preconditions, invariants, and design rationale", "id": "design_intent", "name": "Design Intent Documentation", "tier": 3}, "error_message": null, "evidence": ["Design intent language found in README.md"], "measured_value": "minimal", "remediation": {"citations": [{"relevance": "Agents cannot infer design intent from code alone", "source": "Red Hat", "title": "Repository Scaffolding for AI Coding Agents, Section 2.3", "url": ""}], "commands": ["mkdir -p docs/design"], "examples": ["# docs/design/event-system.md\n## Invariants\n- Event log is append-only; never mutate or delete entries\n- Events are processed exactly-once via idempotency keys\n\n## Preconditions\n- Auth middleware must validate token before event handlers run\n\n## Rationale\n- Polling instead of webhooks: upstream API has 5s delivery SLA, too slow for our use case"], "steps": ["Create docs/design/ directory", "For each critical module, document preconditions, invariants, and rationale", "Use an AI agent to reverse-engineer initial design docs from code, then enrich with intent", "Reference design docs from CLAUDE.md/AGENTS.md"], "summary": "Document design intent: preconditions, invariants, and rationale", "tools": []}, "score": 30.0, "status": "fail", "threshold": "design docs with preconditions/invariants"}, {"attribute": {"category": "AI-Assisted Development Tools", "criteria": "Repomix configured with fresh output (\u003c 7 days old)", "default_weight": 0.02, "description": "Automated repository context generation for AI consumption", "id": "repomix_config", "name": "Repomix AI Context Generation", "tier": 3}, "error_message": null, "evidence": ["Repomix configuration not found", "Missing repomix.config.json"], "measured_value": "not configured", "remediation": {"citations": [{"relevance": "AI-friendly repository context generation tool", "source": "Repomix", "title": "Repomix - AI-Friendly Repository Packager", "url": "https://github.com/yamadashy/repomix"}], "commands": ["agentready repomix-generate --init", "agentready repomix-generate"], "examples": ["# Initialize Repomix configuration\nagentready repomix-generate --init\n\n# Generate repository context\nagentready repomix-generate\n\n# Check freshness\nagentready repomix-generate --check"], "steps": ["Initialize Repomix: agentready repomix-generate --init", "Generate context: agentready repomix-generate", "Add to bootstrap: agentready bootstrap --repomix", "Set up GitHub Action for automatic updates"], "summary": "Configure Repomix for AI-friendly context generation", "tools": ["Repomix", "AgentReady"]}, "score": 0.0, "status": "fail", "threshold": "configured"}, {"attribute": {"category": "Code Quality", "criteria": "Average complexity \u003c10, no functions \u003e15", "default_weight": 0.02, "description": "Cyclomatic complexity thresholds enforced", "id": "cyclomatic_complexity", "name": "Cyclomatic Complexity Thresholds", "tier": 3}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Documentation Standards", "criteria": "ADR directory with documented decisions", "default_weight": 0.03, "description": "Lightweight documents capturing architectural decisions", "id": "architecture_decisions", "name": "Architecture Decision Records (ADRs)", "tier": 3}, "error_message": null, "evidence": ["No ADR directory found (checked docs/adr/, .adr/, adr/, docs/decisions/)"], "measured_value": "no ADR directory", "remediation": {"citations": [{"relevance": "Original ADR format and rationale", "source": "Michael Nygard", "title": "Documenting Architecture Decisions", "url": "https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions"}, {"relevance": "Modern ADR template with examples", "source": "GitHub adr/madr", "title": "Markdown ADR (MADR) Template", "url": "https://github.com/adr/madr"}], "commands": ["# Create ADR directory", "mkdir -p docs/adr", "", "# Create first ADR using template", "cat \u003e docs/adr/0001-use-architecture-decision-records.md \u003c\u003c \u0027EOF\u0027", "# 1. Use Architecture Decision Records", "", "Date: 2025-11-22", "", "## Status", "Accepted", "", "## Context", "We need to record architectural decisions made in this project.", "", "## Decision", "We will use Architecture Decision Records (ADRs) as described by Michael Nygard.", "", "## Consequences", "- Decisions are documented with context", "- Future contributors understand rationale", "- ADRs are lightweight and version-controlled", "EOF"], "examples": ["# Example ADR Structure\n\n```markdown\n# 2. Use PostgreSQL for Database\n\nDate: 2025-11-22\n\n## Status\nAccepted\n\n## Context\nWe need a relational database for complex queries and ACID transactions.\nTeam has PostgreSQL experience. Need full-text search capabilities.\n\n## Decision\nUse PostgreSQL 15+ as primary database.\n\n## Consequences\n- Positive: Robust ACID, full-text search, team familiarity\n- Negative: Higher resource usage than SQLite\n- Neutral: Need to manage migrations, backups\n```\n"], "steps": ["Create docs/adr/ directory in repository root", "Use Michael Nygard ADR template or MADR format", "Document each significant architectural decision", "Number ADRs sequentially (0001-*.md, 0002-*.md)", "Include Status, Context, Decision, and Consequences sections", "Update ADR status when decisions are revised (Superseded, Deprecated)"], "summary": "Create Architecture Decision Records (ADRs) directory and document key decisions", "tools": ["adr-tools", "log4brains"]}, "score": 0.0, "status": "fail", "threshold": "ADR directory with decisions"}, {"attribute": {"category": "Code Quality", "criteria": "Structured logging library configured (structlog, winston, zap)", "default_weight": 0.02, "description": "Logging in structured format (JSON) with consistent fields", "id": "structured_logging", "name": "Structured Logging", "tier": 3}, "error_message": null, "evidence": ["Structured logging check not implemented for [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "API Documentation", "criteria": "OpenAPI 3.x spec with complete endpoint documentation", "default_weight": 0.03, "description": "Machine-readable API documentation in OpenAPI format", "id": "openapi_specs", "name": "OpenAPI/Swagger Specifications", "tier": 3}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Git \u0026 Version Control", "criteria": "Branch protection enabled with status checks and required reviews", "default_weight": 0.005, "description": "Required status checks and review approvals before merging", "id": "branch_protection", "name": "Branch Protection Rules", "tier": 4}, "error_message": null, "evidence": ["Requires GitHub API integration for branch protection checks. Future implementation will verify: required status checks, required reviews, force push prevention, and branch update requirements."], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Code Quality", "criteria": "Language-specific linters configured (pylint, ESLint, RuboCop, etc.)", "default_weight": 0.01, "description": "Linter configuration for detecting code smells and anti-patterns", "id": "code_smells", "name": "Code Smell Elimination", "tier": 4}, "error_message": null, "evidence": ["No linters configured"], "measured_value": "none", "remediation": {"citations": [{"relevance": "Official documentation for Pylint code analysis tool", "source": "Pylint", "title": "Pylint Documentation", "url": "https://pylint.readthedocs.io/"}, {"relevance": "Official documentation for ESLint JavaScript/TypeScript linter", "source": "ESLint", "title": "ESLint Documentation", "url": "https://eslint.org/docs/latest/"}], "commands": ["go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest", "npm install --save-dev markdownlint-cli \u0026\u0026 touch .markdownlint.json"], "examples": ["# .pylintrc example\n[MASTER]\nmax-line-length=100\n\n[MESSAGES CONTROL]\ndisable=C0111", "# .eslintrc.json example\n{\n  \"extends\": \"eslint:recommended\",\n  \"rules\": {\n    \"no-console\": \"warn\"\n  }\n}"], "steps": ["Configure golangci-lint for Go", "Add actionlint for GitHub Actions workflow validation", "Configure markdownlint for documentation quality"], "summary": "Configure 3 missing linter(s)", "tools": ["golangci-lint", "actionlint", "markdownlint"]}, "score": 0.0, "status": "fail", "threshold": "\u226560% of applicable linters configured"}, {"attribute": {"category": "Repository Structure", "criteria": "PR template and issue templates in .github/", "default_weight": 0.01, "description": "Standardized templates for issues and PRs", "id": "issue_pr_templates", "name": "Issue \u0026 Pull Request Templates", "tier": 4}, "error_message": null, "evidence": ["No PR template found", "No issue template directory found"], "measured_value": "PR:False, Issues:0", "remediation": {"citations": [{"relevance": "Official GitHub guide for templates", "source": "GitHub Docs", "title": "About issue and pull request templates", "url": "https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/about-issue-and-pull-request-templates"}], "commands": ["# Create directories", "mkdir -p .github/ISSUE_TEMPLATE", "", "# Create PR template", "cat \u003e .github/PULL_REQUEST_TEMPLATE.md \u003c\u003c \u0027EOF\u0027", "## Summary", "\u003c!-- Describe the changes in this PR --\u003e", "", "## Related Issues", "Fixes #", "", "## Testing", "- [ ] Tests added/updated", "- [ ] All tests pass", "", "## Checklist", "- [ ] Documentation updated", "- [ ] CHANGELOG.md updated", "EOF"], "examples": ["# Bug Report Template (.github/ISSUE_TEMPLATE/bug_report.md)\n\n```markdown\n---\nname: Bug Report\nabout: Create a report to help us improve\ntitle: \u0027[BUG] \u0027\nlabels: bug\nassignees: \u0027\u0027\n---\n\n**Describe the bug**\nA clear description of what the bug is.\n\n**To Reproduce**\nSteps to reproduce:\n1. Go to \u0027...\u0027\n2. Click on \u0027....\u0027\n3. See error\n\n**Expected behavior**\nWhat you expected to happen.\n\n**Environment**\n- OS: [e.g. macOS 13.0]\n- Version: [e.g. 1.0.0]\n```\n"], "steps": ["Create .github/ directory if it doesn\u0027t exist", "Add PULL_REQUEST_TEMPLATE.md for PRs", "Create .github/ISSUE_TEMPLATE/ directory", "Add bug_report.md for bug reports", "Add feature_request.md for feature requests", "Optionally add config.yml to configure template chooser"], "summary": "Create GitHub issue and PR templates in .github/ directory", "tools": ["gh"]}, "score": 0, "status": "fail", "threshold": "PR template + \u22652 issue templates"}, {"attribute": {"category": "Build \u0026 Development", "criteria": "Dockerfile/Containerfile, docker-compose.yml, .dockerignore/.containerignore, multi-stage builds", "default_weight": 0.01, "description": "Container configuration for consistent development environments", "id": "container_setup", "name": "Container/Virtualization Setup", "tier": 4}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}, {"attribute": {"category": "Agent Patterns \u0026 Knowledge", "criteria": "Component-level context files for repos \u003e50K lines", "default_weight": 0.01, "description": "Path-scoped rules and skills for large repos", "id": "progressive_disclosure", "name": "Progressive Disclosure", "tier": 4}, "error_message": null, "evidence": ["Not applicable to [\u0027Markdown\u0027, \u0027YAML\u0027, \u0027Shell\u0027, \u0027Go\u0027]"], "measured_value": null, "remediation": null, "score": null, "status": "not_applicable", "threshold": null}], "metadata": {"agentready_version": "2.35.2", "assessment_timestamp": "2026-05-12T09:19:21.586698", "assessment_timestamp_human": "May 12, 2026 at 9:19 AM", "command": "/Users/rhuss/.cache/uv/archive-v0/-sEsvpNoWBP_t22eeb_V-/bin/agentready -- assess .", "executed_by": "rhuss@rhuss-mac", "research_version": "2.0.0", "working_directory": "/Users/rhuss/Development/ai/operator"}, "overall_score": 43.8, "repository": {"branch": "main", "commit_hash": "01f875a573b9cfc13eacc29e4604c71def861880", "languages": {"Go": 97, "Markdown": 37, "Shell": 12, "YAML": 82}, "name": "rossoctl-operator", "path": "/Users/rhuss/Development/ai/operator", "total_files": 246, "total_lines": 46081, "url": "git@github.com:rhuss/operator.git"}, "schema_version": "1.0.0", "timestamp": "2026-05-12T09:19:21.586698"};
 
         // Embedded theme data (properly escaped)
         const THEMES = {"dark": {"background": "#0f172a", "border": "#475569", "danger": "#ef4444", "display_name": "Dark", "name": "dark", "neutral": "#64748b", "primary": "#8b5cf6", "primary_dark": "#6d28d9", "primary_light": "#a78bfa", "shadow": "rgba(0, 0, 0, 0.6)", "success": "#10b981", "surface": "#1e293b", "surface_elevated": "#334155", "text_muted": "#94a3b8", "text_primary": "#f1f5f9", "text_secondary": "#cbd5e1", "warning": "#f59e0b"}, "default": {"background": "#0a0e27", "border": "#334155", "danger": "#ef4444", "display_name": "Default (Dark Professional)", "name": "default", "neutral": "#64748b", "primary": "#8b5cf6", "primary_dark": "#6d28d9", "primary_light": "#a78bfa", "shadow": "rgba(0, 0, 0, 0.5)", "success": "#10b981", "surface": "#1a1f3a", "surface_elevated": "#252b4a", "text_muted": "#94a3b8", "text_primary": "#f8fafc", "text_secondary": "#cbd5e1", "warning": "#f59e0b"}, "dracula": {"background": "#282a36", "border": "#6272a4", "danger": "#ff5555", "display_name": "Dracula", "name": "dracula", "neutral": "#8be9fd", "primary": "#bd93f9", "primary_dark": "#9b72d6", "primary_light": "#d4b5ff", "shadow": "rgba(0, 0, 0, 0.5)", "success": "#50fa7b", "surface": "#44475a", "surface_elevated": "#6272a4", "text_muted": "#6272a4", "text_primary": "#f8f8f2", "text_secondary": "#e6e6e6", "warning": "#f1fa8c"}, "high-contrast": {"background": "#000000", "border": "#ffffff", "danger": "#ff0000", "display_name": "High Contrast", "name": "high-contrast", "neutral": "#808080", "primary": "#00ffff", "primary_dark": "#00cccc", "primary_light": "#66ffff", "shadow": "rgba(255, 255, 255, 0.2)", "success": "#00ff00", "surface": "#1a1a1a", "surface_elevated": "#2d2d2d", "text_muted": "#b0b0b0", "text_primary": "#ffffff", "text_secondary": "#e0e0e0", "warning": "#ffff00"}, "light": {"background": "#f8fafc", "border": "#e2e8f0", "danger": "#ef4444", "display_name": "Light", "name": "light", "neutral": "#94a3b8", "primary": "#8b5cf6", "primary_dark": "#6d28d9", "primary_light": "#a78bfa", "shadow": "rgba(0, 0, 0, 0.1)", "success": "#10b981", "surface": "#ffffff", "surface_elevated": "#f1f5f9", "text_muted": "#64748b", "text_primary": "#0f172a", "text_secondary": "#334155", "warning": "#f59e0b"}, "solarized-dark": {"background": "#002b36", "border": "#586e75", "danger": "#dc322f", "display_name": "Solarized Dark", "name": "solarized-dark", "neutral": "#586e75", "primary": "#268bd2", "primary_dark": "#1e6fa9", "primary_light": "#5fa8db", "shadow": "rgba(0, 0, 0, 0.5)", "success": "#859900", "surface": "#073642", "surface_elevated": "#0e4e5c", "text_muted": "#93a1a1", "text_primary": "#fdf6e3", "text_secondary": "#eee8d5", "warning": "#b58900"}};
diff --git a/.agentready/report-20260512-091921.md b/.agentready/report-20260512-091921.md
index 85635cd6..27def580 100644
--- a/.agentready/report-20260512-091921.md
+++ b/.agentready/report-20260512-091921.md
@@ -1,7 +1,7 @@
 # 🤖 AgentReady Assessment Report
 
-**Repository**: kagenti-operator
-**Path**: `/Users/rhuss/Development/ai/kagenti-operator`
+**Repository**: rossoctl-operator
+**Path**: `/Users/rhuss/Development/ai/operator`
 **Branch**: `main` | **Commit**: `01f875a5`
 **Assessed**: May 12, 2026 at 9:19 AM
 **AgentReady Version**: 2.35.2
@@ -372,7 +372,7 @@ npm install --save-dev @commitlint/cli @commitlint/config-conventional husky
 
 **Evidence**:
 - Found 8 files >1000 lines (8.2% of 97 files)
-- Largest: kagenti-operator/internal/controller/agentcard_controller.go (1299 lines)
+- Largest: operator/internal/controller/agentcard_controller.go (1299 lines)
 
 Refactor large files into smaller, focused modules
 
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index f9b8185f..93539589 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,21 +1,21 @@
-# CODEOWNERS for kagenti-operator
+# CODEOWNERS for rossoctl-operator
 # See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
 
 # Default: maintainers team owns everything
-* @kagenti/maintainers
+* @rossoctl/maintainers
 
 # API types and CRDs — require careful review
-kagenti-operator/api/ @kagenti/maintainers
-kagenti-operator/config/crd/ @kagenti/maintainers
+operator/api/ @rossoctl/maintainers
+operator/config/crd/ @rossoctl/maintainers
 
 # Controllers and core logic
-kagenti-operator/internal/ @kagenti/maintainers
+operator/internal/ @rossoctl/maintainers
 
 # Webhooks
-kagenti-operator/internal/webhook/ @kagenti/maintainers
+operator/internal/webhook/ @rossoctl/maintainers
 
 # Helm charts
-charts/ @kagenti/maintainers
+charts/ @rossoctl/maintainers
 
 # CI and automation
-.github/ @kagenti/admins
+.github/ @rossoctl/admins
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 38f2cb45..8046f485 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -13,17 +13,17 @@ updates:
 
 # Go modules
 - package-ecosystem: "gomod"
-  directory: "/kagenti-operator"
+  directory: "/operator"
   schedule:
     interval: "weekly"
 
 # Docker base images
 - package-ecosystem: "docker"
-  directory: "/kagenti-operator"
+  directory: "/operator"
   schedule:
     interval: "weekly"
 
 - package-ecosystem: "docker"
-  directory: "/kagenti-operator/cmd/agentcard-signer"
+  directory: "/operator/cmd/agentcard-signer"
   schedule:
     interval: "weekly"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index db44e4c2..cbaf24ea 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,7 +13,7 @@ updates:
         update-types: [major]
 
   - package-ecosystem: "gomod"
-    directory: "/kagenti-operator"
+    directory: "/operator"
     schedule:
       interval: "weekly"
     labels:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c4fd3504..e4f002e3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,7 +10,7 @@ on:
 
 defaults:
   run:
-    working-directory: kagenti-operator
+    working-directory: operator
 
 jobs:
   lint:
@@ -22,12 +22,12 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
-          go-version-file: kagenti-operator/go.mod
+          go-version-file: operator/go.mod
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a  # v9.3.0
         with:
           version: v2.11.4
-          working-directory: kagenti-operator
+          working-directory: operator
           only-new-issues: true
 
   test:
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
-          go-version-file: kagenti-operator/go.mod
+          go-version-file: operator/go.mod
       - name: Run tests
         run: |
           go mod tidy
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
-          go-version-file: kagenti-operator/go.mod
+          go-version-file: operator/go.mod
       - name: Install Kind
         run: |
           curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64
@@ -76,7 +76,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
-          go-version-file: kagenti-operator/go.mod
+          go-version-file: operator/go.mod
       - name: Install Kind
         run: |
           curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64
@@ -96,6 +96,6 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
-          go-version-file: kagenti-operator/go.mod
+          go-version-file: operator/go.mod
       - name: Build
         run: make build
diff --git a/.github/workflows/pr-verifier.yml b/.github/workflows/pr-verifier.yml
index e45ff6ff..b8fc17ed 100644
--- a/.github/workflows/pr-verifier.yml
+++ b/.github/workflows/pr-verifier.yml
@@ -9,4 +9,4 @@ permissions:
 
 jobs:
   verify-pr-title:
-    uses: kagenti/.github/.github/workflows/pr-verifier-required.yml@4e535f2436d167295d39d488ce5c44b5a2d49792
+    uses: rossoctl/.github/.github/workflows/pr-verifier-required.yml@4e535f2436d167295d39d488ce5c44b5a2d49792
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 4f559fa2..424fe8f0 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -1,4 +1,4 @@
-name: Kagenti Project Automation
+name: Rossoctl Project Automation
 
 on:
   issues:
@@ -11,13 +11,13 @@ permissions:
 
 jobs:
   add:
-    name: Add item to Kagenti Project
+    name: Add item to Rossoctl Project
 
     permissions:
       issues: write
       pull-requests: write
       contents: read
 
-    uses: kagenti/.github/.github/workflows/add-to-project.yml@99700ebe858a1bc566492b1de9aea6e764ee226f  # 2026-05-05
+    uses: rossoctl/.github/.github/workflows/add-to-project.yml@99700ebe858a1bc566492b1de9aea6e764ee226f  # 2026-05-05
     secrets: inherit
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3b85eb13..a3e37e21 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ concurrency:
 
 env:
   REGISTRY: ghcr.io
-  REPO: kagenti/kagenti-operator
+  REPO: rossoctl/operator
   CHARTS_PATH: ./charts
 
 jobs:
@@ -31,12 +31,12 @@ jobs:
       fail-fast: false
       matrix:
         image_config:
-          - name: kagenti-operator
-            context: ./kagenti-operator
-            dockerfile: ./kagenti-operator/Dockerfile
+          - name: rossoctl-operator
+            context: ./operator
+            dockerfile: ./operator/Dockerfile
           - name: agentcard-signer
-            context: ./kagenti-operator
-            dockerfile: ./kagenti-operator/cmd/agentcard-signer/Dockerfile
+            context: ./operator
+            dockerfile: ./operator/cmd/agentcard-signer/Dockerfile
     steps:
     - name: Checkout
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
@@ -106,8 +106,8 @@ jobs:
     - name: Package and push Helm chart
       run: |
         chartVersion=$(echo "${{ github.ref_name }}" | cut -c 2-)
-        chartPackageName="kagenti-operator-chart-${chartVersion}.tgz"
-        cd ${{ env.CHARTS_PATH }}/kagenti-operator
+        chartPackageName="operator-chart-${chartVersion}.tgz"
+        cd ${{ env.CHARTS_PATH }}/operator
         yq -i '.controllerManager.container.image.tag = strenv(chartVersion)' values.yaml
         yq -i '.controllerManager.container.image.pullPolicy = "IfNotPresent"' values.yaml
         helm package . --destination . --version "${chartVersion}" --app-version "${chartVersion}"
@@ -153,12 +153,12 @@ jobs:
       # we override to `:latest` (which the build-and-push job just
       # tagged) so the rendered Deployment can actually pull an image.
       run: |
-        helm install kagenti-operator ./charts/kagenti-operator \
+        helm install rossoctl-operator ./charts/operator \
           --set controllerManager.container.image.tag=latest
 
     - name: Wait for deployment rollout
       run: |
-        kubectl rollout status deployment/kagenti-controller-manager \
+        kubectl rollout status deployment/rossoctl-controller-manager \
           --timeout=120s
 
     - name: Verify operator pod is Running and Ready
diff --git a/.github/workflows/security-scans.yaml b/.github/workflows/security-scans.yaml
index 699799a8..94067605 100644
--- a/.github/workflows/security-scans.yaml
+++ b/.github/workflows/security-scans.yaml
@@ -210,7 +210,7 @@ jobs:
           scan-type: 'config'
           scan-ref: '.'
           severity: 'CRITICAL,HIGH,MEDIUM'
-          skip-dirs: 'kagenti-operator/demos'
+          skip-dirs: 'operator/demos'
           exit-code: '0'
           format: 'table'
 
diff --git a/.github/workflows/self-assign.yml b/.github/workflows/self-assign.yml
index 3716a982..50110396 100644
--- a/.github/workflows/self-assign.yml
+++ b/.github/workflows/self-assign.yml
@@ -1,9 +1,9 @@
 # Issue Self-Assign
 #
 # Thin caller for the org-wide reusable self-assign workflow.
-# Configuration and defaults are managed centrally in kagenti/.github.
+# Configuration and defaults are managed centrally in rossoctl/.github.
 #
-# Reference: https://github.com/kagenti/.github/blob/main/.github/workflows/self-assign-reusable.yml
+# Reference: https://github.com/rossoctl/.github/blob/main/.github/workflows/self-assign-reusable.yml
 #
 name: Issue self-assign
 
@@ -17,6 +17,6 @@ permissions:
 
 jobs:
   self-assign:
-    uses: kagenti/.github/.github/workflows/self-assign-reusable.yml@99700ebe858a1bc566492b1de9aea6e764ee226f  # 2026-05-05
+    uses: rossoctl/.github/.github/workflows/self-assign-reusable.yml@99700ebe858a1bc566492b1de9aea6e764ee226f  # 2026-05-05
     secrets:
       ISSUE_ASSIGN_TOKEN: ${{ secrets.ISSUE_ASSIGN_TOKEN }}
diff --git a/.github/workflows/sign-agent-card.yml b/.github/workflows/sign-agent-card.yml
index 5cd852da..308c92bf 100644
--- a/.github/workflows/sign-agent-card.yml
+++ b/.github/workflows/sign-agent-card.yml
@@ -57,7 +57,7 @@ jobs:
             --commit_sha "${{ github.sha }}" \
             --provenance \
             --identity_token "$(cat oidc-token.txt)" \
-            kagenti-operator/examples/ci-agent-card.json
+            operator/examples/ci-agent-card.json
 
       - name: Verify signature
         run: |
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 13da6d27..32a47807 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -1,9 +1,9 @@
 # Stale Issue and PR Management
 #
 # Thin caller for the org-wide reusable stale workflow.
-# Configuration and defaults are managed centrally in kagenti/.github.
+# Configuration and defaults are managed centrally in rossoctl/.github.
 #
-# Reference: https://github.com/kagenti/.github/blob/main/.github/workflows/stale.yaml
+# Reference: https://github.com/rossoctl/.github/blob/main/.github/workflows/stale.yaml
 #
 name: Close Stale Issues and PRs
 
@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   stale:
-    uses: kagenti/.github/.github/workflows/stale.yaml@99700ebe858a1bc566492b1de9aea6e764ee226f  # 2026-05-05
+    uses: rossoctl/.github/.github/workflows/stale.yaml@99700ebe858a1bc566492b1de9aea6e764ee226f  # 2026-05-05
diff --git a/.gitignore b/.gitignore
index 3fea0508..c2fceab2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,10 +48,10 @@ Thumbs.db
 # Build artifacts
 **/dist/
 **/bin/
-kagenti-operator/main
+operator/main
 
 # Spurious controller-gen CRD artifact
-kagenti-operator/config/crd/bases/_.yaml
+operator/config/crd/bases/_.yaml
 
 # Temporary and debug files
 *.log
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0850280c..80b46fe9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -6,7 +6,7 @@ repos:
       - id: end-of-file-fixer
       - id: check-added-large-files
         args: ['--maxkb=1024']
-        exclude: ^kagenti-operator/bin/
+        exclude: ^operator/bin/
       - id: check-yaml
         args: ['--allow-multiple-documents']
         # Exclude Helm templates as they contain Go template syntax
@@ -32,30 +32,30 @@ repos:
 
   - repo: local
     hooks:
-      # Kagenti Operator hooks
+      # Rossoctl Operator hooks
       - id: go-fmt
         name: go-fmt
-        entry: bash -c 'cd kagenti-operator && go fmt ./...'
+        entry: bash -c 'cd rossoctl-operator && go fmt ./...'
         language: system
-        files: ^kagenti-operator/.*\.go$
+        files: ^operator/.*\.go$
         pass_filenames: false
       - id: go-vet
         name: go-vet
-        entry: bash -c 'cd kagenti-operator && go vet ./...'
+        entry: bash -c 'cd rossoctl-operator && go vet ./...'
         language: system
-        files: ^kagenti-operator/.*\.go$
+        files: ^operator/.*\.go$
         pass_filenames: false
       - id: go-mod-tidy
         name: go-mod-tidy
-        entry: bash -c 'cd kagenti-operator && go mod tidy'
+        entry: bash -c 'cd rossoctl-operator && go mod tidy'
         language: system
-        files: ^kagenti-operator/(go\.mod|go\.sum)$
+        files: ^operator/(go\.mod|go\.sum)$
         pass_filenames: false
 
       # Kubernetes YAML validation
       - id: k8s-yaml-validate
         name: validate k8s yamls
-        entry: bash -c 'find kagenti-operator/config -name "*.yaml" -not -path "*/samples/*" -exec kubectl --dry-run=client apply -f {} \;'
+        entry: bash -c 'find operator/config -name "*.yaml" -not -path "*/samples/*" -exec kubectl --dry-run=client apply -f {} \;'
         language: system
-        files: ^kagenti-operator/config/.*\.yaml$
+        files: ^operator/config/.*\.yaml$
         pass_filenames: false
diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md
index 41e2dc36..e8399d8d 100644
--- a/.specify/memory/constitution.md
+++ b/.specify/memory/constitution.md
@@ -18,7 +18,7 @@ Sync Impact Report
 - Follow-up TODOs: none
 -->
 
-# Kagenti Operator Constitution
+# Rossoctl Operator Constitution
 
 ## Core Principles
 
@@ -126,7 +126,7 @@ and developers MUST consult this section when reviewing reconciler code.
 
 ## Governance
 
-This constitution governs all development on the kagenti-operator. It
+This constitution governs all development on the rossoctl-operator. It
 supersedes informal conventions and ad-hoc patterns.
 
 **Amendment process**: Propose changes via PR. Changes to principles
diff --git a/CLAUDE.md b/CLAUDE.md
index bd6207c7..584abc88 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,4 +1,4 @@
-# CLAUDE.md - Kagenti Operator
+# CLAUDE.md - Rossoctl Operator
 
 This file provides guidance for AI assistants working with this repository.
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dfab7226..077ec815 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Contributing to this project
 
-Greetings! We are grateful for your interest in joining the Kagenti community and making a positive impact. Whether you're raising issues, enhancing documentation, fixing bugs, or developing new features, your contributions are essential to our success.
+Greetings! We are grateful for your interest in joining the Rossoctl community and making a positive impact. Whether you're raising issues, enhancing documentation, fixing bugs, or developing new features, your contributions are essential to our success.
 
 To get started, kindly read through this document and familiarize yourself with our code of conduct.
 
@@ -8,11 +8,11 @@ We can't wait to collaborate with you!
 
 ## Contributing Code
 
-Please follow the [Contribution guide](https://github.com/kagenti/kagenti/blob/main/CONTRIBUTING.md#contributing-to-this-project) as found in the Kagenti Repository for instructions on how to contribute to our repositories.
+Please follow the [Contribution guide](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md#contributing-to-this-project) as found in the Rossoctl Repository for instructions on how to contribute to our repositories.
 
 ### Developer's Guide
 
-Please follow our [Developer's Guide](https://github.com/kagenti/kagenti/blob/main/docs/dev-guide.md#developers-guide) as found in the Kagenti Repository where you can find comprehensive instructions for common development operations.
+Please follow our [Developer's Guide](https://github.com/rossoctl/rossoctl/blob/main/docs/dev-guide.md#developers-guide) as found in the Rossoctl Repository where you can find comprehensive instructions for common development operations.
 
 Please note that the section about pre-commit does not apply to this repository
 
diff --git a/README.md b/README.md
index 7c973ad9..8ef33a17 100644
--- a/README.md
+++ b/README.md
@@ -1,18 +1,18 @@
-# Kagenti Operator
+# Rossoctl Operator
 
-[![License](https://img.shields.io/github/license/kagenti/kagenti-operator)](LICENSE)
-![Contributors](https://img.shields.io/github/contributors/kagenti/kagenti-operator)
+[![License](https://img.shields.io/github/license/rossoctl/operator)](LICENSE)
+![Contributors](https://img.shields.io/github/contributors/rossoctl/operator)
 
-**Kagenti Operator** is a Kubernetes operator that automates the deployment, discovery, and security of AI agents in Kubernetes clusters. It provides workload identity (SPIFFE), mutual authentication (OAuth2/Keycloak), agent-to-agent trust (A2A signature verification), and observability (MLflow tracing) — all declaratively managed through Custom Resources.
+**Rossoctl Operator** is a Kubernetes operator that automates the deployment, discovery, and security of AI agents in Kubernetes clusters. It provides workload identity (SPIFFE), mutual authentication (OAuth2/Keycloak), agent-to-agent trust (A2A signature verification), and observability (MLflow tracing) — all declaratively managed through Custom Resources.
 
 ## Overview
 
-The Kagenti Operator manages the following Custom Resource Definitions (CRDs):
+The Rossoctl Operator manages the following Custom Resource Definitions (CRDs):
 
 | Resource | Purpose |
 |----------|---------|
-| **[AgentRuntime](./kagenti-operator/docs/api-reference.md#agentruntime)** | Enrolls a workload into the Kagenti platform — applies labels, triggers sidecar injection, and configures identity and observability |
-| **[AgentCard](./kagenti-operator/docs/api-reference.md#agentcard)** | Discovers, indexes, and verifies agent metadata for Kubernetes-native agent discovery |
+| **[AgentRuntime](./operator/docs/api-reference.md#agentruntime)** | Enrolls a workload into the Rossoctl platform — applies labels, triggers sidecar injection, and configures identity and observability |
+| **[AgentCard](./operator/docs/api-reference.md#agentcard)** | Discovers, indexes, and verifies agent metadata for Kubernetes-native agent discovery |
 
 ### Key Features
 
@@ -35,7 +35,7 @@ graph TB
         User -->|Creates| RuntimeCR[AgentRuntime CR]
     end
 
-    subgraph "Kagenti Operator"
+    subgraph "Rossoctl Operator"
         ValidationWebhook[Validating Webhooks]
         InjectionWebhook[AuthBridge Mutating Webhook]
         RuntimeController[AgentRuntime Controller]
@@ -97,9 +97,9 @@ The operator runs the following controllers and webhooks:
 
 ## Bundle Service
 
-Kagenti includes a dedicated bundle service used by AuthBridge clients to fetch authorization bundles.
+Rossoctl includes a dedicated bundle service used by AuthBridge clients to fetch authorization bundles.
 
-This service is deployed using the manifests in `kagenti-operator/config/bundleservice/` and is intended for SRE operational use.
+This service is deployed using the manifests in `operator/config/bundleservice/` and is intended for SRE operational use.
 
 Key facts:
 
@@ -109,7 +109,7 @@ Key facts:
 - Port: `8080`
 - Health endpoints: `/healthz`, `/readyz`
 
-Use `kagenti-operator/kagenti-operator/cmd/bundle-service/README.md` for SRE runbook guidance and operational details.
+Use `operator/operator/cmd/bundle-service/README.md` for SRE runbook guidance and operational details.
 
 ## Quick Start
 
@@ -122,26 +122,26 @@ Use `kagenti-operator/kagenti-operator/cmd/bundle-service/README.md` for SRE run
 
 **Option A — OpenShift (recommended for OCP)**
 
-Use [`scripts/ocp/setup-kagenti.sh`](https://github.com/kagenti/kagenti/blob/main/scripts/ocp/setup-kagenti.sh) from the [kagenti](https://github.com/kagenti/kagenti) repo. It handles RBAC, SCCs, and Helm installation in one step.
+Use [`scripts/ocp/setup-rossoctl.sh`](https://github.com/rossoctl/rossoctl/blob/main/scripts/ocp/setup-rossoctl.sh) from the [rossoctl](https://github.com/rossoctl/rossoctl) repo. It handles RBAC, SCCs, and Helm installation in one step.
 
-By default the script installs the released operator version pinned as a chart dependency in the `kagenti` repo's `charts/kagenti/Chart.yaml`. For development with a local build of this operator, two flags let you override that:
+By default the script installs the released operator version pinned as a chart dependency in the `rossoctl` repo's `charts/rossoctl/Chart.yaml`. For development with a local build of this operator, two flags let you override that:
 
 ```bash
 # Use a local chart and/or a custom operator image instead of the released version
-./scripts/ocp/setup-kagenti.sh \
-  --operator-repo /path/to/kagenti-operator \
-  --operator-image quay.io/<your-org>/kagenti-operator:dev
+./scripts/ocp/setup-rossoctl.sh \
+  --operator-repo /path/to/operator \
+  --operator-image quay.io/<your-org>/operator:dev
 ```
 
-`--operator-repo` accepts a local clone of this repository and substitutes its `charts/kagenti-operator` chart in place of the pinned dependency. `--operator-image` overrides the container image the chart pulls.
+`--operator-repo` accepts a local clone of this repository and substitutes its `charts/operator` chart in place of the pinned dependency. `--operator-image` overrides the container image the chart pulls.
 
 **Option B — Plain Kubernetes (Helm)**
 
 ```bash
 # Install the operator using OCI chart
-helm install kagenti-operator \
-  oci://ghcr.io/kagenti/kagenti-operator/kagenti-operator-chart \
-  --namespace kagenti-system \
+helm install rossoctl-operator \
+  oci://ghcr.io/rossoctl/operator/operator-chart \
+  --namespace rossoctl-system \
   --create-namespace
 ```
 
@@ -163,7 +163,7 @@ metadata:
   namespace: default
   labels:
     app.kubernetes.io/name: weather-agent
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -176,7 +176,7 @@ spec:
     spec:
       containers:
       - name: agent
-        image: "ghcr.io/kagenti/agent-examples/weather_service:v0.0.1-alpha.3"
+        image: "ghcr.io/rossoctl/examples/weather_service:v0.0.1-alpha.3"
         ports:
         - containerPort: 8000
         env:
@@ -199,7 +199,7 @@ EOF
 
 # Enroll it with an AgentRuntime CR
 kubectl apply -f - <<EOF
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
@@ -213,7 +213,7 @@ spec:
 EOF
 ```
 
-The operator will apply `kagenti.io/type: agent` labels and inject AuthBridge sidecars. The `protocol.kagenti.io/a2a` label on the Deployment triggers automatic AgentCard creation for agent discovery.
+The operator will apply `rossoctl.io/type: agent` labels and inject AuthBridge sidecars. The `protocol.rossoctl.io/a2a` label on the Deployment triggers automatic AgentCard creation for agent discovery.
 
 #### Option 2: Manual Labels
 
@@ -228,8 +228,8 @@ metadata:
   namespace: default
   labels:
     app.kubernetes.io/name: weather-agent
-    kagenti.io/type: agent
-    protocol.kagenti.io/a2a: ""
+    rossoctl.io/type: agent
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -239,11 +239,11 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: weather-agent
-        kagenti.io/type: agent
+        rossoctl.io/type: agent
     spec:
       containers:
       - name: agent
-        image: "ghcr.io/kagenti/agent-examples/weather_service:v0.0.1-alpha.3"
+        image: "ghcr.io/rossoctl/examples/weather_service:v0.0.1-alpha.3"
         ports:
         - containerPort: 8000
         env:
@@ -273,25 +273,25 @@ kubectl logs -l app.kubernetes.io/name=weather-agent
 
 | Topic | Link |
 |-------|------|
-| **Getting Started** | [Tutorials & End-to-End Walkthrough](./kagenti-operator/GETTING_STARTED.md) |
-| **API Reference** | [CRD Specifications & Examples](./kagenti-operator/docs/api-reference.md) |
-| **Architecture** | [Operator Design & Components](./kagenti-operator/docs/architecture.md) |
-| **AuthBridge Webhook** | [Sidecar Injection & Configuration](./kagenti-operator/docs/authbridge-webhook.md) |
-| **Controller-Webhook Interaction** | [AgentRuntime Controller & Webhook Coordination](./kagenti-operator/docs/controller-webhook-interaction.md) |
-| **Dynamic Discovery** | [Agent Discovery with AgentCard](./kagenti-operator/docs/dynamic-agent-discovery.md) |
-| **Signature Verification** | [A2A AgentCard Signature Verification](./kagenti-operator/docs/agentcard-signature-verification.md) |
-| **Identity Binding** | [SPIFFE Workload Identity Binding](./kagenti-operator/docs/agentcard-identity-binding.md) |
-| **MLflow Integration** | [MLflow Tracing & Experiment Tracking](./kagenti-operator/docs/mlflow-integration.md) |
-| **Client Registration** | [Operator-Managed Keycloak Registration](./kagenti-operator/docs/operator-managed-client-registration.md) |
-| **Developer Guide** | [Contributing & Development](./kagenti-operator/docs/dev.md) |
+| **Getting Started** | [Tutorials & End-to-End Walkthrough](./operator/GETTING_STARTED.md) |
+| **API Reference** | [CRD Specifications & Examples](./operator/docs/api-reference.md) |
+| **Architecture** | [Operator Design & Components](./operator/docs/architecture.md) |
+| **AuthBridge Webhook** | [Sidecar Injection & Configuration](./operator/docs/authbridge-webhook.md) |
+| **Controller-Webhook Interaction** | [AgentRuntime Controller & Webhook Coordination](./operator/docs/controller-webhook-interaction.md) |
+| **Dynamic Discovery** | [Agent Discovery with AgentCard](./operator/docs/dynamic-agent-discovery.md) |
+| **Signature Verification** | [A2A AgentCard Signature Verification](./operator/docs/agentcard-signature-verification.md) |
+| **Identity Binding** | [SPIFFE Workload Identity Binding](./operator/docs/agentcard-identity-binding.md) |
+| **MLflow Integration** | [MLflow Tracing & Experiment Tracking](./operator/docs/mlflow-integration.md) |
+| **Client Registration** | [Operator-Managed Keycloak Registration](./operator/docs/operator-managed-client-registration.md) |
+| **Developer Guide** | [Contributing & Development](./operator/docs/dev.md) |
 
 ## Examples
 
-See the [config/samples](./kagenti-operator/config/samples) directory for AgentRuntime examples:
+See the [config/samples](./operator/config/samples) directory for AgentRuntime examples:
 
-- [`agent_v1alpha1_agentruntime_basic.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml) — Minimal AgentRuntime with type + targetRef
-- [`agent_v1alpha1_agentruntime_full.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml) — With SPIFFE trust domain override and OCI skill images
-- [`agent_v1alpha1_agentruntime_tool.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml) — Tool-type workload (MCP server)
+- [`agent_v1alpha1_agentruntime_basic.yaml`](./operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml) — Minimal AgentRuntime with type + targetRef
+- [`agent_v1alpha1_agentruntime_full.yaml`](./operator/config/samples/agent_v1alpha1_agentruntime_full.yaml) — With SPIFFE trust domain override and OCI skill images
+- [`agent_v1alpha1_agentruntime_tool.yaml`](./operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml) — Tool-type workload (MCP server)
 
 ## Contributing
 
diff --git a/SECURITY.md b/SECURITY.md
index f0e389c8..0a5e49e8 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -10,14 +10,14 @@ please report it responsibly.
 1. **Do NOT create public GitHub issues** for security vulnerabilities
 2. **GitHub Security Advisories (preferred)**: Report vulnerabilities privately via
    [GitHub Security Advisories](../../security/advisories/new)
-3. **Email**: Send reports to **security@kagenti.io**
+3. **Email**: Send reports to **security@rossoctl.io**
 4. **Include**: A clear description of the vulnerability, steps to reproduce,
    and potential impact
 
 ### Security Contacts
 
-- **kagenti-maintainers@googlegroups.com**
-- **security@kagenti.io**
+- **rossoctl-maintainers@googlegroups.com**
+- **security@rossoctl.io**
 
 ### What to Expect
 
@@ -43,7 +43,7 @@ This project implements several security controls:
 
 ## Operator-Specific Security
 
-The kagenti-operator manages trusted workload identity and agent card signatures:
+The rossoctl-operator manages trusted workload identity and agent card signatures:
 
 - **SPIFFE/SPIRE Integration**: Workload identity via x509-SVIDs
 - **Agent Card Signing**: JWS signatures with x5c certificate chains (A2A spec §8.4.2)
diff --git a/brainstorm/01-agentcard-into-agentruntime.md b/brainstorm/01-agentcard-into-agentruntime.md
index 93c26afd..04b9c6f2 100644
--- a/brainstorm/01-agentcard-into-agentruntime.md
+++ b/brainstorm/01-agentcard-into-agentruntime.md
@@ -18,9 +18,9 @@ This brainstorm covers the first step: moving card data into AgentRuntime status
 ## Context
 
 - ADR: ODH-ADR-AgentOps-0002 (Agent Network Policy and mTLS Identity)
-- Upstream issue: kagenti-operator#371 (Consolidate AgentCard into AgentRuntime status)
-- Related: kagenti-operator#292 (skeleton-card problem)
-- Related: kagenti-operator#284 (mTLS verified fetch, merged 2026-05-20, infrastructure reusable later)
+- Upstream issue: rossoctl-operator#371 (Consolidate AgentCard into AgentRuntime status)
+- Related: rossoctl-operator#292 (skeleton-card problem)
+- Related: rossoctl-operator#284 (mTLS verified fetch, merged 2026-05-20, infrastructure reusable later)
 - Upstream sync: IBM maintainers agreed to AgentCard deprecation path (2026-05-15)
 - RHAISTRAT-1599 AC review: acceptance criteria updated to reflect AgentRuntime-based discovery
 
diff --git a/brainstorm/02-identity-binding-migration.md b/brainstorm/02-identity-binding-migration.md
index f20035a6..9d2760cc 100644
--- a/brainstorm/02-identity-binding-migration.md
+++ b/brainstorm/02-identity-binding-migration.md
@@ -47,7 +47,7 @@ This field serves a different purpose today (configuring the workload's own SVID
 Move `identityBinding` to AgentRuntime.spec, alongside the existing identity fields:
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 spec:
   identity:
@@ -82,7 +82,7 @@ After Phase 2, the AgentRuntime controller evaluates binding from its own spec f
 
 ### AgentCardSyncReconciler
 
-The sync controller auto-creates AgentCards for workloads with `kagenti.io/type=agent` labels. During coexistence, it continues to function. After Phase 2, the sync controller is no longer needed because:
+The sync controller auto-creates AgentCards for workloads with `rossoctl.io/type=agent` labels. During coexistence, it continues to function. After Phase 2, the sync controller is no longer needed because:
 - Card discovery is handled by AgentRuntime controller (Phase 1)
 - Identity binding is on AgentRuntime spec (Phase 2)
 - There is no remaining reason to auto-create AgentCards
diff --git a/brainstorm/03-card-discovery-refinement-alignment.md b/brainstorm/03-card-discovery-refinement-alignment.md
index b421a3cc..46b82c3d 100644
--- a/brainstorm/03-card-discovery-refinement-alignment.md
+++ b/brainstorm/03-card-discovery-refinement-alignment.md
@@ -122,18 +122,18 @@ The PR just merged. No external consumers depend on the `CardSynced` condition t
 
 **Current implementation:** `serviceHTTPPort()` looks for generic HTTP port names (`http`, `https`, `grpc`), falls back to first port.
 
-**Refinement doc:** `kagenti.io/port annotation` -> port named `a2a` -> first port -> default 8000.
+**Refinement doc:** `rossoctl.io/port annotation` -> port named `a2a` -> first port -> default 8000.
 
 **Why the doc's approach is better:**
 
 1. **Protocol-specific port name (`a2a`)**: We're fetching A2A agent cards, not generic HTTP content. If a Service has an admin port named `http` on port 80 and an A2A port named `a2a` on port 8000, our current code picks the wrong one.
 
-2. **Annotation escape hatch (`kagenti.io/port`)**: Standard Kubernetes pattern for when auto-detection fails. Near-zero implementation cost (check one annotation before the existing port resolution). Useful for multi-port Services, non-standard configurations, or when the A2A endpoint runs on an unusual port.
+2. **Annotation escape hatch (`rossoctl.io/port`)**: Standard Kubernetes pattern for when auto-detection fails. Near-zero implementation cost (check one annotation before the existing port resolution). Useful for multi-port Services, non-standard configurations, or when the A2A endpoint runs on an unusual port.
 
 3. **Default 8000**: The A2A Python SDK defaults to port 8000. Our current code has no default and relies entirely on what's in the Service spec.
 
 **Proposed resolution chain:**
-1. `kagenti.io/port` annotation on the Service (explicit override, highest priority)
+1. `rossoctl.io/port` annotation on the Service (explicit override, highest priority)
 2. Service port named `a2a` (protocol-specific match)
 3. Service port named `http` (generic fallback, backward compatible)
 4. First port in Service spec (last resort)
diff --git a/charts/kagenti-operator/.helmignore b/charts/operator/.helmignore
similarity index 100%
rename from charts/kagenti-operator/.helmignore
rename to charts/operator/.helmignore
diff --git a/charts/kagenti-operator/Chart.yaml b/charts/operator/Chart.yaml
similarity index 55%
rename from charts/kagenti-operator/Chart.yaml
rename to charts/operator/Chart.yaml
index 57f1f623..6704b786 100644
--- a/charts/kagenti-operator/Chart.yaml
+++ b/charts/operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-name: kagenti-operator-chart
-description: A Helm chart to distribute the project kagenti-operator
+name: operator-chart
+description: A Helm chart to distribute the project rossoctl-operator
 type: application
 version: 0.2.0-alpha.24
 appVersion: "0.2.0-alpha.24"
diff --git a/charts/kagenti-operator/crds/agent.kagenti.dev_agentcards.yaml b/charts/operator/crds/agent.rossoctl.dev_agentcards.yaml
similarity index 99%
rename from charts/kagenti-operator/crds/agent.kagenti.dev_agentcards.yaml
rename to charts/operator/crds/agent.rossoctl.dev_agentcards.yaml
index 593610f5..7dca3338 100644
--- a/charts/kagenti-operator/crds/agent.kagenti.dev_agentcards.yaml
+++ b/charts/operator/crds/agent.rossoctl.dev_agentcards.yaml
@@ -4,9 +4,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.1
-  name: agentcards.agent.kagenti.dev
+  name: agentcards.agent.rossoctl.dev
 spec:
-  group: agent.kagenti.dev
+  group: agent.rossoctl.dev
   names:
     kind: AgentCard
     listKind: AgentCardList
@@ -132,7 +132,7 @@ spec:
               targetRef:
                 description: |-
                   TargetRef identifies the workload backing this agent (duck typing).
-                  The workload must have the kagenti.io/type=agent label.
+                  The workload must have the rossoctl.io/type=agent label.
                 properties:
                   apiVersion:
                     description: APIVersion is the API version of the target resource
diff --git a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml b/charts/operator/crds/agent.rossoctl.dev_agentruntimes.yaml
similarity index 98%
rename from kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml
rename to charts/operator/crds/agent.rossoctl.dev_agentruntimes.yaml
index 7fa69a3e..42a0cf1c 100644
--- a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml
+++ b/charts/operator/crds/agent.rossoctl.dev_agentruntimes.yaml
@@ -4,9 +4,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.1
-  name: agentruntimes.agent.kagenti.dev
+  name: agentruntimes.agent.rossoctl.dev
 spec:
-  group: agent.kagenti.dev
+  group: agent.rossoctl.dev
   names:
     kind: AgentRuntime
     listKind: AgentRuntimeList
@@ -125,7 +125,7 @@ spec:
                   MTLSMode selects the mTLS posture between authbridge sidecars on
                   the proxy-sidecar / lite paths. envoy-sidecar handles transport
                   security through Envoy SDS, which is currently not configured by
-                  the kagenti envoy-config — admission rejects mtlsMode != disabled
+                  the rossoctl envoy-config — admission rejects mtlsMode != disabled
                   when authBridgeMode is envoy-sidecar (tracked as a follow-up).
 
                   Three valid values:
@@ -487,9 +487,9 @@ spec:
                 type: integer
               linkedSkills:
                 description: |-
-                  LinkedSkills lists skill names discovered from the kagenti.io/skills
+                  LinkedSkills lists skill names discovered from the rossoctl.io/skills
                   annotation on the target workload. This annotation is set by the
-                  kagenti backend (PR #1440) or manually by the user. The operator
+                  rossoctl backend (PR #1440) or manually by the user. The operator
                   reads but never sets this annotation.
                 items:
                   type: string
diff --git a/kagenti-operator/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml b/charts/operator/crds/agent.rossoctl.dev_authorizationpolicies.yaml
similarity index 98%
rename from kagenti-operator/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml
rename to charts/operator/crds/agent.rossoctl.dev_authorizationpolicies.yaml
index ec1ab44a..94b78c61 100644
--- a/kagenti-operator/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml
+++ b/charts/operator/crds/agent.rossoctl.dev_authorizationpolicies.yaml
@@ -4,9 +4,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.1
-  name: authorizationpolicies.agent.kagenti.dev
+  name: authorizationpolicies.agent.rossoctl.dev
 spec:
-  group: agent.kagenti.dev
+  group: agent.rossoctl.dev
   names:
     kind: AuthorizationPolicy
     listKind: AuthorizationPolicyList
diff --git a/charts/kagenti-operator/templates/_helpers.tpl b/charts/operator/templates/_helpers.tpl
similarity index 96%
rename from charts/kagenti-operator/templates/_helpers.tpl
rename to charts/operator/templates/_helpers.tpl
index e8fc03b7..4167b093 100644
--- a/charts/kagenti-operator/templates/_helpers.tpl
+++ b/charts/operator/templates/_helpers.tpl
@@ -5,10 +5,10 @@
   {{- else if .Values.nameOverride }}
     {{ .Values.nameOverride | trunc 63 | trimSuffix "-" }}
   {{- else }}
-    kagenti-operator
+    rossoctl-operator
   {{- end }}
 {{- else }}
-  kagenti-operator
+  rossoctl-operator
 {{- end }}
 {{- end }}
 
diff --git a/charts/kagenti-operator/templates/certmanager/certificate.yaml b/charts/operator/templates/certmanager/certificate.yaml
similarity index 93%
rename from charts/kagenti-operator/templates/certmanager/certificate.yaml
rename to charts/operator/templates/certmanager/certificate.yaml
index 42dffdb1..91522cc3 100644
--- a/charts/kagenti-operator/templates/certmanager/certificate.yaml
+++ b/charts/operator/templates/certmanager/certificate.yaml
@@ -30,7 +30,7 @@ spec:
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer-{{ .Release.Name }}
-  secretName: kagenti-operator-webhook-server-cert
+  secretName: rossoctl-operator-webhook-server-cert
 {{- end }}
 {{- if .Values.metrics.enable }}
 ---
@@ -53,6 +53,6 @@ spec:
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer-{{ .Release.Name }}
-  secretName: kagenti-operator-metrics-server-cert
+  secretName: rossoctl-operator-metrics-server-cert
 {{- end }}
 {{- end }}
diff --git a/charts/kagenti-operator/templates/manager/clusterspiffeid.yaml b/charts/operator/templates/manager/clusterspiffeid.yaml
similarity index 95%
rename from charts/kagenti-operator/templates/manager/clusterspiffeid.yaml
rename to charts/operator/templates/manager/clusterspiffeid.yaml
index 2b327b98..7cb45c8c 100644
--- a/charts/kagenti-operator/templates/manager/clusterspiffeid.yaml
+++ b/charts/operator/templates/manager/clusterspiffeid.yaml
@@ -2,7 +2,7 @@
 apiVersion: spire.spiffe.io/v1alpha1
 kind: ClusterSPIFFEID
 metadata:
-  name: kagenti-operator
+  name: rossoctl-operator
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 spec:
diff --git a/charts/kagenti-operator/templates/manager/configmap-feature-gates.yaml b/charts/operator/templates/manager/configmap-feature-gates.yaml
similarity index 91%
rename from charts/kagenti-operator/templates/manager/configmap-feature-gates.yaml
rename to charts/operator/templates/manager/configmap-feature-gates.yaml
index 92d0af77..3e301b33 100644
--- a/charts/kagenti-operator/templates/manager/configmap-feature-gates.yaml
+++ b/charts/operator/templates/manager/configmap-feature-gates.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kagenti-feature-gates
+  name: rossoctl-feature-gates
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
diff --git a/charts/kagenti-operator/templates/manager/configmap-platform-defaults.yaml b/charts/operator/templates/manager/configmap-platform-defaults.yaml
similarity index 90%
rename from charts/kagenti-operator/templates/manager/configmap-platform-defaults.yaml
rename to charts/operator/templates/manager/configmap-platform-defaults.yaml
index 519e0559..b1eae90d 100644
--- a/charts/kagenti-operator/templates/manager/configmap-platform-defaults.yaml
+++ b/charts/operator/templates/manager/configmap-platform-defaults.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kagenti-platform-config
+  name: rossoctl-platform-config
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
diff --git a/charts/kagenti-operator/templates/manager/configmap-spiffe-helper.yaml b/charts/operator/templates/manager/configmap-spiffe-helper.yaml
similarity index 100%
rename from charts/kagenti-operator/templates/manager/configmap-spiffe-helper.yaml
rename to charts/operator/templates/manager/configmap-spiffe-helper.yaml
diff --git a/charts/kagenti-operator/templates/manager/manager.yaml b/charts/operator/templates/manager/manager.yaml
similarity index 95%
rename from charts/kagenti-operator/templates/manager/manager.yaml
rename to charts/operator/templates/manager/manager.yaml
index d7fa042f..0721cacf 100644
--- a/charts/kagenti-operator/templates/manager/manager.yaml
+++ b/charts/operator/templates/manager/manager.yaml
@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: kagenti-controller-manager
+  name: rossoctl-controller-manager
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
@@ -79,7 +79,7 @@ spec:
             {{- end }}
             {{- if .Values.keycloak }}
             - "--keycloak-admin-secret-namespace={{ .Values.keycloak.adminSecretNamespace | default "keycloak" }}"
-            - "--keycloak-realm={{ .Values.keycloak.realm | default "kagenti" }}"
+            - "--keycloak-realm={{ .Values.keycloak.realm | default "rossoctl" }}"
             {{- end }}
             {{- if .Values.authbridgeConfig }}
             {{- if not .Values.authbridgeConfig.enabled }}
@@ -131,15 +131,15 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
             {{- if and .Values.keycloak .Values.keycloak.publicUrl }}
-            - name: KAGENTI_KEYCLOAK_PUBLIC_URL
+            - name: ROSSOCTL_KEYCLOAK_PUBLIC_URL
               value: {{ .Values.keycloak.publicUrl | quote }}
             {{- end }}
             {{- if and .Values.signatureVerification .Values.signatureVerification.spireTrustDomain }}
-            - name: KAGENTI_SPIRE_TRUST_DOMAIN
+            - name: ROSSOCTL_SPIRE_TRUST_DOMAIN
               value: {{ .Values.signatureVerification.spireTrustDomain | quote }}
             {{- end }}
             {{- if and .Values.signatureVerification .Values.signatureVerification.spireClusterName }}
-            - name: KAGENTI_SPIRE_CLUSTER_NAME
+            - name: ROSSOCTL_SPIRE_CLUSTER_NAME
               value: {{ .Values.signatureVerification.spireClusterName | quote }}
             {{- end }}
             {{- if .Values.controllerManager.container.env }}
@@ -165,10 +165,10 @@ spec:
           volumeMounts:
             {{- if .Values.webhook.enable }}
             - name: platform-config
-              mountPath: /etc/kagenti
+              mountPath: /etc/rossoctl
               readOnly: true
             - name: feature-gates
-              mountPath: /etc/kagenti/feature-gates
+              mountPath: /etc/rossoctl/feature-gates
               readOnly: true
             {{- end }}
             {{- if and .Values.webhook.enable .Values.certmanager.enable }}
@@ -193,7 +193,7 @@ spec:
             {{- end }}
         {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
         - name: spiffe-helper
-          image: ghcr.io/kagenti/kagenti-extensions/spiffe-helper:latest
+          image: ghcr.io/rossoctl/rossocortex/spiffe-helper:latest
           imagePullPolicy: IfNotPresent
           args:
             - "-config"
@@ -230,20 +230,20 @@ spec:
         {{- if .Values.webhook.enable }}
         - name: platform-config
           configMap:
-            name: kagenti-platform-config
+            name: rossoctl-platform-config
         - name: feature-gates
           configMap:
-            name: kagenti-feature-gates
+            name: rossoctl-feature-gates
         {{- end }}
         {{- if and .Values.webhook.enable .Values.certmanager.enable }}
         - name: webhook-cert
           secret:
-            secretName: kagenti-operator-webhook-server-cert
+            secretName: rossoctl-operator-webhook-server-cert
         {{- end }}
         {{- if and .Values.metrics.enable .Values.certmanager.enable }}
         - name: metrics-certs
           secret:
-            secretName: kagenti-operator-metrics-server-cert
+            secretName: rossoctl-operator-metrics-server-cert
         {{- end }}
         {{- if or .Values.verifiedFetch.enabled (and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled) }}
         - name: spiffe-workload-api
diff --git a/charts/kagenti-operator/templates/metrics/metrics-service.yaml b/charts/operator/templates/metrics/metrics-service.yaml
similarity index 100%
rename from charts/kagenti-operator/templates/metrics/metrics-service.yaml
rename to charts/operator/templates/metrics/metrics-service.yaml
diff --git a/charts/kagenti-operator/templates/network-policy/allow-metrics-traffic.yaml b/charts/operator/templates/network-policy/allow-metrics-traffic.yaml
similarity index 100%
rename from charts/kagenti-operator/templates/network-policy/allow-metrics-traffic.yaml
rename to charts/operator/templates/network-policy/allow-metrics-traffic.yaml
diff --git a/charts/kagenti-operator/templates/network-policy/allow-webhook-traffic.yaml b/charts/operator/templates/network-policy/allow-webhook-traffic.yaml
similarity index 100%
rename from charts/kagenti-operator/templates/network-policy/allow-webhook-traffic.yaml
rename to charts/operator/templates/network-policy/allow-webhook-traffic.yaml
diff --git a/charts/kagenti-operator/templates/prometheus/monitor.yaml b/charts/operator/templates/prometheus/monitor.yaml
similarity index 95%
rename from charts/kagenti-operator/templates/prometheus/monitor.yaml
rename to charts/operator/templates/prometheus/monitor.yaml
index 8737a7de..c519af00 100644
--- a/charts/kagenti-operator/templates/prometheus/monitor.yaml
+++ b/charts/operator/templates/prometheus/monitor.yaml
@@ -35,5 +35,5 @@ spec:
   selector:
     matchLabels:
       control-plane: controller-manager
-      app.kubernetes.io/name: kagenti-operator
+      app.kubernetes.io/name: rossoctl-operator
 {{- end }}
diff --git a/charts/kagenti-operator/templates/rbac/authbridge-scc.yaml b/charts/operator/templates/rbac/authbridge-scc.yaml
similarity index 87%
rename from charts/kagenti-operator/templates/rbac/authbridge-scc.yaml
rename to charts/operator/templates/rbac/authbridge-scc.yaml
index a03be078..3ec45003 100644
--- a/charts/kagenti-operator/templates/rbac/authbridge-scc.yaml
+++ b/charts/operator/templates/rbac/authbridge-scc.yaml
@@ -6,7 +6,7 @@
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:
-  name: kagenti-authbridge
+  name: rossoctl-authbridge
   labels:
     {{- include "chart.labels" . | nindent 4 }}
     app.kubernetes.io/component: authbridge
@@ -42,32 +42,32 @@ volumes:
   - projected
   - secret
 ---
-# ClusterRole granting "use" on the kagenti-authbridge SCC.
+# ClusterRole granting "use" on the rossoctl-authbridge SCC.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: system:openshift:scc:kagenti-authbridge
+  name: system:openshift:scc:rossoctl-authbridge
   labels:
     {{- include "chart.labels" . | nindent 4 }}
     app.kubernetes.io/component: authbridge
 rules:
   - apiGroups: ["security.openshift.io"]
     resources: ["securitycontextconstraints"]
-    resourceNames: ["kagenti-authbridge"]
+    resourceNames: ["rossoctl-authbridge"]
     verbs: ["use"]
 ---
 # Grants the operator SA "use" on the SCC so it can delegate via RoleBindings.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-operator-scc-authbridge
+  name: rossoctl-operator-scc-authbridge
   labels:
     {{- include "chart.labels" . | nindent 4 }}
     app.kubernetes.io/component: authbridge
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: system:openshift:scc:kagenti-authbridge
+  name: system:openshift:scc:rossoctl-authbridge
 subjects:
   - kind: ServiceAccount
     name: {{ .Values.controllerManager.serviceAccountName }}
diff --git a/charts/kagenti-operator/templates/rbac/http-route.yaml b/charts/operator/templates/rbac/http-route.yaml
similarity index 80%
rename from charts/kagenti-operator/templates/rbac/http-route.yaml
rename to charts/operator/templates/rbac/http-route.yaml
index 491f6f5b..30e4c1b1 100644
--- a/charts/kagenti-operator/templates/rbac/http-route.yaml
+++ b/charts/operator/templates/rbac/http-route.yaml
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-operator-httproute-{{ .Release.Name }}
+  name: rossoctl-operator-httproute-{{ .Release.Name }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 rules:
@@ -25,7 +25,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-operator-httproute-binding-{{ .Release.Name }}
+  name: rossoctl-operator-httproute-binding-{{ .Release.Name }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 subjects:
@@ -35,5 +35,5 @@ subjects:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kagenti-operator-httproute-{{ .Release.Name }}
+  name: rossoctl-operator-httproute-{{ .Release.Name }}
 {{- end -}}
diff --git a/charts/kagenti-operator/templates/rbac/leader_election_role.yaml b/charts/operator/templates/rbac/leader_election_role.yaml
similarity index 93%
rename from charts/kagenti-operator/templates/rbac/leader_election_role.yaml
rename to charts/operator/templates/rbac/leader_election_role.yaml
index e13bb556..37e023a2 100755
--- a/charts/kagenti-operator/templates/rbac/leader_election_role.yaml
+++ b/charts/operator/templates/rbac/leader_election_role.yaml
@@ -6,7 +6,7 @@ metadata:
   labels:
     {{- include "chart.labels" . | nindent 4 }}
   namespace: {{ .Release.Namespace }}
-  name: kagenti-leader-election-role
+  name: rossoctl-leader-election-role
 rules:
 - apiGroups:
   - ""
diff --git a/charts/kagenti-operator/templates/rbac/leader_election_role_binding.yaml b/charts/operator/templates/rbac/leader_election_role_binding.yaml
similarity index 82%
rename from charts/kagenti-operator/templates/rbac/leader_election_role_binding.yaml
rename to charts/operator/templates/rbac/leader_election_role_binding.yaml
index 9ba7e67c..29f86b2d 100755
--- a/charts/kagenti-operator/templates/rbac/leader_election_role_binding.yaml
+++ b/charts/operator/templates/rbac/leader_election_role_binding.yaml
@@ -5,11 +5,11 @@ metadata:
   labels:
     {{- include "chart.labels" . | nindent 4 }}
   namespace: {{ .Release.Namespace }}
-  name: kagenti-leader-election-rolebinding
+  name: rossoctl-leader-election-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: kagenti-leader-election-role
+  name: rossoctl-leader-election-role
 subjects:
 - kind: ServiceAccount
   name: {{ .Values.controllerManager.serviceAccountName }}
diff --git a/charts/kagenti-operator/templates/rbac/metrics_auth_role.yaml b/charts/operator/templates/rbac/metrics_auth_role.yaml
similarity index 91%
rename from charts/kagenti-operator/templates/rbac/metrics_auth_role.yaml
rename to charts/operator/templates/rbac/metrics_auth_role.yaml
index 2955cd21..318ca860 100755
--- a/charts/kagenti-operator/templates/rbac/metrics_auth_role.yaml
+++ b/charts/operator/templates/rbac/metrics_auth_role.yaml
@@ -4,7 +4,7 @@ kind: ClusterRole
 metadata:
   labels:
     {{- include "chart.labels" . | nindent 4 }}
-  name: kagenti-metrics-auth-role
+  name: rossoctl-metrics-auth-role
 rules:
 - apiGroups:
   - authentication.k8s.io
diff --git a/charts/kagenti-operator/templates/rbac/metrics_auth_role_binding.yaml b/charts/operator/templates/rbac/metrics_auth_role_binding.yaml
similarity index 83%
rename from charts/kagenti-operator/templates/rbac/metrics_auth_role_binding.yaml
rename to charts/operator/templates/rbac/metrics_auth_role_binding.yaml
index 8bbbaa23..c06a255d 100755
--- a/charts/kagenti-operator/templates/rbac/metrics_auth_role_binding.yaml
+++ b/charts/operator/templates/rbac/metrics_auth_role_binding.yaml
@@ -4,11 +4,11 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     {{- include "chart.labels" . | nindent 4 }}
-  name: kagenti-metrics-auth-rolebinding
+  name: rossoctl-metrics-auth-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kagenti-metrics-auth-role
+  name: rossoctl-metrics-auth-role
 subjects:
 - kind: ServiceAccount
   name: {{ .Values.controllerManager.serviceAccountName }}
diff --git a/charts/kagenti-operator/templates/rbac/metrics_reader_role.yaml b/charts/operator/templates/rbac/metrics_reader_role.yaml
similarity index 88%
rename from charts/kagenti-operator/templates/rbac/metrics_reader_role.yaml
rename to charts/operator/templates/rbac/metrics_reader_role.yaml
index a00d47aa..3f323daf 100755
--- a/charts/kagenti-operator/templates/rbac/metrics_reader_role.yaml
+++ b/charts/operator/templates/rbac/metrics_reader_role.yaml
@@ -4,7 +4,7 @@ kind: ClusterRole
 metadata:
   labels:
     {{- include "chart.labels" . | nindent 4 }}
-  name: kagenti-metrics-reader
+  name: rossoctl-metrics-reader
 rules:
 - nonResourceURLs:
   - "/metrics"
diff --git a/charts/kagenti-operator/templates/rbac/mlflow_binding.yaml b/charts/operator/templates/rbac/mlflow_binding.yaml
similarity index 88%
rename from charts/kagenti-operator/templates/rbac/mlflow_binding.yaml
rename to charts/operator/templates/rbac/mlflow_binding.yaml
index f0297130..92950fbb 100644
--- a/charts/kagenti-operator/templates/rbac/mlflow_binding.yaml
+++ b/charts/operator/templates/rbac/mlflow_binding.yaml
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-mlflow-integration-{{ .Release.Name }}
+  name: rossoctl-mlflow-integration-{{ .Release.Name }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 subjects:
diff --git a/charts/kagenti-operator/templates/rbac/role.yaml b/charts/operator/templates/rbac/role.yaml
similarity index 97%
rename from charts/kagenti-operator/templates/rbac/role.yaml
rename to charts/operator/templates/rbac/role.yaml
index a861d1ea..98109f83 100755
--- a/charts/kagenti-operator/templates/rbac/role.yaml
+++ b/charts/operator/templates/rbac/role.yaml
@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-manager-role
+  name: rossoctl-manager-role
   labels:
     {{- include "chart.labels" . | nindent 4 }}
 rules:
@@ -64,7 +64,7 @@ rules:
   - create
   - patch
 - apiGroups:
-  - agent.kagenti.dev
+  - agent.rossoctl.dev
   resources:
   - agentcards
   - agentruntimes
@@ -77,14 +77,14 @@ rules:
   - update
   - watch
 - apiGroups:
-  - agent.kagenti.dev
+  - agent.rossoctl.dev
   resources:
   - agentcards/finalizers
   - agentruntimes/finalizers
   verbs:
   - update
 - apiGroups:
-  - agent.kagenti.dev
+  - agent.rossoctl.dev
   resources:
   - agentcards/status
   - agentruntimes/status
diff --git a/charts/kagenti-operator/templates/rbac/role_binding.yaml b/charts/operator/templates/rbac/role_binding.yaml
similarity index 84%
rename from charts/kagenti-operator/templates/rbac/role_binding.yaml
rename to charts/operator/templates/rbac/role_binding.yaml
index 71cdc9e2..a3789546 100755
--- a/charts/kagenti-operator/templates/rbac/role_binding.yaml
+++ b/charts/operator/templates/rbac/role_binding.yaml
@@ -4,11 +4,11 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     {{- include "chart.labels" . | nindent 4 }}
-  name: kagenti-manager-rolebinding
+  name: rossoctl-manager-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kagenti-manager-role
+  name: rossoctl-manager-role
 subjects:
 - kind: ServiceAccount
   name: {{ .Values.controllerManager.serviceAccountName }}
diff --git a/charts/kagenti-operator/templates/rbac/service_account.yaml b/charts/operator/templates/rbac/service_account.yaml
similarity index 100%
rename from charts/kagenti-operator/templates/rbac/service_account.yaml
rename to charts/operator/templates/rbac/service_account.yaml
diff --git a/charts/kagenti-operator/templates/vap/validating-admission-policy-binding.yaml b/charts/operator/templates/vap/validating-admission-policy-binding.yaml
similarity index 100%
rename from charts/kagenti-operator/templates/vap/validating-admission-policy-binding.yaml
rename to charts/operator/templates/vap/validating-admission-policy-binding.yaml
diff --git a/charts/kagenti-operator/templates/vap/validating-admission-policy.yaml b/charts/operator/templates/vap/validating-admission-policy.yaml
similarity index 68%
rename from charts/kagenti-operator/templates/vap/validating-admission-policy.yaml
rename to charts/operator/templates/vap/validating-admission-policy.yaml
index c3c13e59..ac628abb 100644
--- a/charts/kagenti-operator/templates/vap/validating-admission-policy.yaml
+++ b/charts/operator/templates/vap/validating-admission-policy.yaml
@@ -18,10 +18,10 @@ spec:
   matchConditions:
     - name: 'has-agent-type-label'
       expression: >-
-        (has(object.metadata.labels) && 'kagenti.io/type' in object.metadata.labels)
+        (has(object.metadata.labels) && 'rossoctl.io/type' in object.metadata.labels)
         || (has(object.spec.template.metadata)
             && has(object.spec.template.metadata.labels)
-            && 'kagenti.io/type' in object.spec.template.metadata.labels)
+            && 'rossoctl.io/type' in object.spec.template.metadata.labels)
 
     - name: 'not-exempt-service-account'
       expression: >-
@@ -33,35 +33,35 @@ spec:
   variables:
     - name: metaLabelUnchanged
       expression: >-
-        !('kagenti.io/type' in object.metadata.labels)
+        !('rossoctl.io/type' in object.metadata.labels)
         || (request.operation == 'UPDATE'
-            && 'kagenti.io/type' in oldObject.metadata.labels
-            && oldObject.metadata.labels['kagenti.io/type'] == object.metadata.labels['kagenti.io/type'])
+            && 'rossoctl.io/type' in oldObject.metadata.labels
+            && oldObject.metadata.labels['rossoctl.io/type'] == object.metadata.labels['rossoctl.io/type'])
 
     - name: podTemplateLabelUnchanged
       expression: >-
         !(has(object.spec.template.metadata)
           && has(object.spec.template.metadata.labels)
-          && 'kagenti.io/type' in object.spec.template.metadata.labels)
+          && 'rossoctl.io/type' in object.spec.template.metadata.labels)
         || (request.operation == 'UPDATE'
             && has(oldObject.spec.template.metadata)
             && has(oldObject.spec.template.metadata.labels)
-            && 'kagenti.io/type' in oldObject.spec.template.metadata.labels
-            && oldObject.spec.template.metadata.labels['kagenti.io/type'] == object.spec.template.metadata.labels['kagenti.io/type'])
+            && 'rossoctl.io/type' in oldObject.spec.template.metadata.labels
+            && oldObject.spec.template.metadata.labels['rossoctl.io/type'] == object.spec.template.metadata.labels['rossoctl.io/type'])
 
   validations:
     - expression: "variables.metaLabelUnchanged"
       messageExpression: >-
-        'The kagenti.io/type label on '
+        'The rossoctl.io/type label on '
         + object.metadata.namespace + '/' + object.metadata.name
-        + ' can only be applied by the kagenti-operator via an AgentRuntime CR.'
+        + ' can only be applied by the rossoctl-operator via an AgentRuntime CR.'
         + ' Create an AgentRuntime targeting this workload instead of manually setting the label.'
       reason: Forbidden
     - expression: "variables.podTemplateLabelUnchanged"
       messageExpression: >-
-        'The kagenti.io/type label in the pod template of '
+        'The rossoctl.io/type label in the pod template of '
         + object.metadata.namespace + '/' + object.metadata.name
-        + ' can only be applied by the kagenti-operator via an AgentRuntime CR.'
+        + ' can only be applied by the rossoctl-operator via an AgentRuntime CR.'
         + ' Create an AgentRuntime targeting this workload instead of manually setting the label.'
       reason: Forbidden
 {{- end }}
diff --git a/charts/kagenti-operator/templates/webhook/webhooks.yaml b/charts/operator/templates/webhook/webhooks.yaml
similarity index 92%
rename from charts/kagenti-operator/templates/webhook/webhooks.yaml
rename to charts/operator/templates/webhook/webhooks.yaml
index d9eb8926..7ae453f0 100644
--- a/charts/kagenti-operator/templates/webhook/webhooks.yaml
+++ b/charts/operator/templates/webhook/webhooks.yaml
@@ -10,7 +10,7 @@ metadata:
     cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/serving-cert-{{ .Release.Name }}
   {{- end }}
 webhooks:
-- name: inject.kagenti.io
+- name: inject.rossoctl.io
   admissionReviewVersions:
   - v1
   clientConfig:
@@ -33,15 +33,15 @@ webhooks:
           - kube-node-lease
           - {{ .Release.Namespace }}
     matchLabels:
-      kagenti-enabled: "true"
+      rossoctl-enabled: "true"
   objectSelector:
     matchExpressions:
-      - key: kagenti.io/type
+      - key: rossoctl.io/type
         operator: In
         values:
           - agent
           - tool
-      - key: kagenti.io/inject
+      - key: rossoctl.io/inject
         operator: NotIn
         values:
           - disabled
@@ -72,13 +72,13 @@ webhooks:
     service:
       name: {{ include "chart.fullname" . }}-webhook-service
       namespace: {{ .Release.Namespace }}
-      path: /validate-agent-kagenti-dev-v1alpha1-agentcard
+      path: /validate-agent-rossoctl-dev-v1alpha1-agentcard
       port: 443
   failurePolicy: Fail
   name: vagentcard.kb.io
   rules:
   - apiGroups:
-    - agent.kagenti.dev
+    - agent.rossoctl.dev
     apiVersions:
     - v1alpha1
     operations:
diff --git a/charts/kagenti-operator/values.yaml b/charts/operator/values.yaml
similarity index 92%
rename from charts/kagenti-operator/values.yaml
rename to charts/operator/values.yaml
index e941c3c8..93922a58 100644
--- a/charts/kagenti-operator/values.yaml
+++ b/charts/operator/values.yaml
@@ -3,7 +3,7 @@ controllerManager:
   replicas: 1
   container:
     image:
-      repository: ghcr.io/kagenti/kagenti-operator/kagenti-operator
+      repository: ghcr.io/rossoctl/operator/operator
       tag: __PLACEHOLDER__
       pullPolicy: IfNotPresent
     args:
@@ -11,8 +11,8 @@ controllerManager:
       - "--metrics-bind-address=:8443"
       - "--health-probe-bind-address=:8081"
       - "--webhook-cert-path=/tmp/k8s-webhook-server/serving-certs"
-      - "--config-path=/etc/kagenti/config.yaml"
-      - "--feature-gates-path=/etc/kagenti/feature-gates/feature-gates.yaml"
+      - "--config-path=/etc/rossoctl/config.yaml"
+      - "--feature-gates-path=/etc/rossoctl/feature-gates/feature-gates.yaml"
       - "--enable-client-registration=true"
     cmd: /manager
     resources:
@@ -77,7 +77,7 @@ webhook:
   enable: true
 
 # [VAP]: ValidatingAdmissionPolicy for agent label protection.
-# Prevents manual application of the kagenti.io/type label on Deployments and
+# Prevents manual application of the rossoctl.io/type label on Deployments and
 # StatefulSets (both top-level metadata and pod template spec). Only the operator
 # SA (derived from controllerManager.serviceAccountName and the release namespace)
 # is exempt.
@@ -106,7 +106,7 @@ keycloak:
   # Namespace where the keycloak-initial-admin secret is located
   adminSecretNamespace: keycloak
   # Target realm for agent client registration
-  realm: kagenti
+  realm: rossoctl
   # External Keycloak URL (used for ISSUER / EXPECTED_AUDIENCE in authbridge-config).
   # Auto-discovered from OpenShift Route or Kubernetes Ingress named "keycloak" in
   # the adminSecretNamespace. Set here only to override auto-discovery.
@@ -121,7 +121,7 @@ authbridgeConfig:
 
 # [KUADRANT]: Kuadrant operand controller — reconciles Kuadrant CR in kuadrant-system.
 # When enabled, the operator creates and drift-reconciles the Kuadrant CR that
-# setup-kagenti.sh currently applies manually. Requires the Kuadrant CRD to be
+# setup-rossoctl.sh currently applies manually. Requires the Kuadrant CRD to be
 # installed (controller is a no-op otherwise).
 kuadrant:
   enable: false
@@ -133,13 +133,13 @@ mlflow:
   # Required for RHOAI MLflow; leave empty for vanilla MLflow deployments.
   workspace: ""
   # MLflow experiment name. Created automatically if it doesn't exist.
-  experimentName: "kagenti-traces"
+  experimentName: "rossoctl-traces"
 
 # [OTEL BOOTSTRAP]: OTel collector bootstrap at operator startup.
 # When enabled, the operator assembles the OTel collector ConfigMap from
 # detected components (Phoenix, MLflow) and projects the OpenShift ingress
 # CA into the operator namespace (OCP only). Replaces the Helm-based
-# otel-ingress-ca-job and kagenti.otel.collectorConfig helper.
+# otel-ingress-ca-job and rossoctl.otel.collectorConfig helper.
 otelBootstrap:
   enable: false
 
@@ -200,7 +200,7 @@ sigstore:
 # operator uses admin credentials from keycloak-admin-secret. When enabled, the
 # operator uses its own SPIFFE JWT-SVID, eliminating the need for that secret.
 # This is independent of how agent/tool workloads authenticate (see authBridge
-# clientAuthType in the kagenti chart).
+# clientAuthType in the rossoctl chart).
 spiffe:
   enabled: false
   operatorAuth:
@@ -219,7 +219,7 @@ spiffe:
 featureGates:
   globalEnabled: true
   envoyProxy: true
-  # injectTools controls whether tool workloads (kagenti.io/type=tool) receive
+  # injectTools controls whether tool workloads (rossoctl.io/type=tool) receive
   # sidecar injection. Defaults to false — tools are not injected by default.
   injectTools: false
   # perWorkloadConfigResolution controls whether namespace ConfigMaps/Secrets are
@@ -228,7 +228,7 @@ featureGates:
   # rarely change. Cache is cleared on webhook pod restart.
   perWorkloadConfigResolution: false
   # skillDiscovery controls whether the AgentRuntime controller reads the
-  # kagenti.io/skills annotation from target workloads and populates
+  # rossoctl.io/skills annotation from target workloads and populates
   # status.linkedSkills. Default false.
   skillDiscovery: false
 
@@ -246,10 +246,10 @@ featureGates:
 # proxy-sidecar / lite mode (always-on enforce-redirect egress capture).
 defaults:
   images:
-    envoyProxy: ghcr.io/kagenti/kagenti-extensions/authbridge-envoy:latest
-    authbridge: ghcr.io/kagenti/kagenti-extensions/authbridge:latest
-    authbridgeLite: ghcr.io/kagenti/kagenti-extensions/authbridge-lite:latest
-    proxyInit: ghcr.io/kagenti/kagenti-extensions/proxy-init:latest
+    envoyProxy: ghcr.io/rossoctl/rossocortex/authbridge-envoy:latest
+    authbridge: ghcr.io/rossoctl/rossocortex/authbridge:latest
+    authbridgeLite: ghcr.io/rossoctl/rossocortex/authbridge-lite:latest
+    proxyInit: ghcr.io/rossoctl/rossocortex/proxy-init:latest
     pullPolicy: IfNotPresent
 
   # Proxy settings
@@ -320,6 +320,6 @@ defaults:
       svid_bundle_file_name = "/opt/svid_bundle.pem"
       cert_file_mode = 0644
       key_file_mode = 0640
-      jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/kagenti", jwt_svid_file_name="/opt/jwt_svid.token"}]
+      jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/rossoctl", jwt_svid_file_name="/opt/jwt_svid.token"}]
       jwt_svid_file_mode = 0644
       include_federated_domains = true
diff --git a/docs/migration/migrate-agent-crd-to-workloads.md b/docs/migration/migrate-agent-crd-to-workloads.md
index 5db5b4c4..8f6dcdf9 100644
--- a/docs/migration/migrate-agent-crd-to-workloads.md
+++ b/docs/migration/migrate-agent-crd-to-workloads.md
@@ -4,7 +4,7 @@ This guide describes how to migrate from the legacy `Agent` CRD to workload-base
 
 ## Overview
 
-The Kagenti operator is transitioning from the custom `Agent` CRD to standard Kubernetes workloads (Deployments and StatefulSets) for deploying agents. This provides better alignment with Kubernetes best practices and enables more flexible deployment options.
+The Rossoctl operator is transitioning from the custom `Agent` CRD to standard Kubernetes workloads (Deployments and StatefulSets) for deploying agents. This provides better alignment with Kubernetes best practices and enables more flexible deployment options.
 
 ## Migration Timeline
 
@@ -16,7 +16,7 @@ The Kagenti operator is transitioning from the custom `Agent` CRD to standard Ku
 
 ## Prerequisites
 
-- Kagenti operator v2.x or later
+- Rossoctl operator v2.x or later
 - Access to modify workload manifests
 - Understanding of your current Agent CRD configurations
 
@@ -32,7 +32,7 @@ kubectl get agents -A
 
 For each agent, note:
 - Name and namespace
-- Labels (especially `kagenti.io/type` and protocol labels)
+- Labels (especially `rossoctl.io/type` and protocol labels)
 - PodTemplateSpec configuration
 - Service configuration
 
@@ -45,14 +45,14 @@ For each Agent CRD, create a corresponding Deployment or StatefulSet.
 **Before (Agent CRD):**
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: Agent
 metadata:
   name: my-agent
   namespace: default
   labels:
-    kagenti.io/type: agent
-    kagenti.io/agent-protocol: a2a  # Old label
+    rossoctl.io/type: agent
+    rossoctl.io/agent-protocol: a2a  # Old label
 spec:
   podTemplateSpec:
     spec:
@@ -73,8 +73,8 @@ metadata:
   namespace: default
   labels:
     app.kubernetes.io/name: my-agent
-    kagenti.io/type: agent
-    protocol.kagenti.io/a2a: ""  # New multi-protocol label
+    rossoctl.io/type: agent
+    protocol.rossoctl.io/a2a: ""  # New multi-protocol label
 spec:
   replicas: 1
   selector:
@@ -84,7 +84,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: my-agent
-        kagenti.io/type: agent
+        rossoctl.io/type: agent
     spec:
       containers:
         - name: agent
@@ -112,7 +112,7 @@ If you have manually created AgentCards using the `selector` field, migrate them
 **Before (selector-based):**
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: my-agent-card
@@ -121,13 +121,13 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: my-agent
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
 ```
 
 **After (targetRef-based):**
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: my-agent-card
@@ -178,8 +178,8 @@ Update your labels to use the new multi-protocol format:
 
 | Old Label | New Label |
 |-----------|-----------|
-| `kagenti.io/agent-protocol: a2a` | `protocol.kagenti.io/a2a: ""` |
-| `kagenti.io/protocol: a2a` | `protocol.kagenti.io/a2a: ""` |
+| `rossoctl.io/agent-protocol: a2a` | `protocol.rossoctl.io/a2a: ""` |
+| `rossoctl.io/protocol: a2a` | `protocol.rossoctl.io/a2a: ""` |
 
 Both old label formats are still supported for backward compatibility, but they will be removed in a future release. The new prefix-based format allows a single workload to declare support for multiple protocols simultaneously.
 
@@ -187,8 +187,8 @@ Both old label formats are still supported for backward compatibility, but they
 
 | Label | Value | Required |
 |-------|-------|----------|
-| `kagenti.io/type` | `agent` | Yes |
-| `protocol.kagenti.io/<name>` | `""` (existence implies support) | Yes (at least one) |
+| `rossoctl.io/type` | `agent` | Yes |
+| `protocol.rossoctl.io/<name>` | `""` (existence implies support) | Yes (at least one) |
 | `app.kubernetes.io/name` | `<agent-name>` | Recommended |
 
 ## AgentCard Naming Convention
@@ -237,8 +237,8 @@ Ensure your Deployment has the required labels:
 ```yaml
 metadata:
   labels:
-    kagenti.io/type: agent
-    kagenti.io/protocol: a2a  # or mcp, etc.
+    rossoctl.io/type: agent
+    rossoctl.io/protocol: a2a  # or mcp, etc.
 ```
 
 ### AgentCard shows "WorkloadNotFound"
@@ -246,7 +246,7 @@ metadata:
 Check that:
 1. The `targetRef` in the AgentCard points to the correct workload
 2. The workload exists in the same namespace as the AgentCard
-3. The workload has the `kagenti.io/type: agent` label
+3. The workload has the `rossoctl.io/type: agent` label
 
 ### Deprecation warnings in logs
 
@@ -255,8 +255,8 @@ If you see deprecation warnings, update your configuration:
 1. **"AgentCard uses deprecated 'selector' field"**
    - Migrate to `targetRef` as shown in Step 3
 
-2. **"workload uses deprecated label 'kagenti.io/agent-protocol'"**
-   - Update to `kagenti.io/protocol`
+2. **"workload uses deprecated label 'rossoctl.io/agent-protocol'"**
+   - Update to `rossoctl.io/protocol`
 
 ## Rollback
 
@@ -276,5 +276,5 @@ The operator supports running in hybrid mode indefinitely, so you can migrate gr
 ## Support
 
 For questions or issues:
-- Open an issue at https://github.com/kagenti/operator/issues
+- Open an issue at https://github.com/rossoctl/operator/issues
 - Refer to the full migration plan in the project documentation.
diff --git a/docs/plans/ai-gateway.md b/docs/plans/ai-gateway.md
index 2bafa47d..83449682 100644
--- a/docs/plans/ai-gateway.md
+++ b/docs/plans/ai-gateway.md
@@ -6,9 +6,9 @@ Proposal
 
 ## Summary
 
-Add AI Gateway capabilities to the Kagenti operator using the Gateway API
+Add AI Gateway capabilities to the Rossoctl operator using the Gateway API
 policy attachment pattern. Users create a standard `Gateway` resource
-(managed by Envoy Gateway), then attach Kagenti policy CRDs to control
+(managed by Envoy Gateway), then attach Rossoctl policy CRDs to control
 LLM routing and access control. Each policy generates the downstream
 Envoy AI Gateway resources needed to implement the declared intent.
 
@@ -120,21 +120,21 @@ Two controllers watch the same Gateway for different concerns:
 
 - **Envoy Gateway** — reconciles the Gateway, deploys the Envoy proxy,
   processes BackendTrafficPolicy and ClientTrafficPolicy
-- **Kagenti operator** — reconciles the two AI policy CRDs and generates
+- **Rossoctl operator** — reconciles the two AI policy CRDs and generates
   downstream resources
 
 No conflict: our controller never modifies the Gateway. It creates
-sibling resources that reference it. The two Kagenti policy controllers
+sibling resources that reference it. The two Rossoctl policy controllers
 are independent — they generate disjoint sets of resources and never
 write to each other's objects.
 
 ## API group
 
 ```
-aigateway.kagenti.dev/v1alpha1
+aigateway.rossoctl.dev/v1alpha1
 ```
 
-Separate from the operator's agent CRDs (`agent.kagenti.dev`) and from
+Separate from the operator's agent CRDs (`agent.rossoctl.dev`) and from
 Envoy AI Gateway's CRDs (`aigateway.envoyproxy.io`).
 
 ## CRDs
@@ -176,7 +176,7 @@ A single controller owns all generated resources, eliminating
 cross-controller write conflicts.
 
 ```yaml
-apiVersion: aigateway.kagenti.dev/v1alpha1
+apiVersion: aigateway.rossoctl.dev/v1alpha1
 kind: AIRoutingPolicy
 metadata:
   name: my-routing
@@ -378,7 +378,7 @@ could match on XFCC to apply per-workload rate limits, model access
 lists, or processing pipelines.
 
 ```yaml
-apiVersion: aigateway.kagenti.dev/v1alpha1
+apiVersion: aigateway.rossoctl.dev/v1alpha1
 kind: AIAccessPolicy
 metadata:
   name: my-access
@@ -673,7 +673,7 @@ spec:
     protocol: HTTPS
 ---
 # Platform admin sets access policy
-apiVersion: aigateway.kagenti.dev/v1alpha1
+apiVersion: aigateway.rossoctl.dev/v1alpha1
 kind: AIAccessPolicy
 metadata:
   name: ai-gateway-access
@@ -690,7 +690,7 @@ spec:
       namespace: spire-system
 ---
 # Team lead configures providers and models
-apiVersion: aigateway.kagenti.dev/v1alpha1
+apiVersion: aigateway.rossoctl.dev/v1alpha1
 kind: AIRoutingPolicy
 metadata:
   name: ai-gateway-routing
@@ -847,7 +847,7 @@ The operator service account needs:
 
 | API group | Resources | Verbs |
 |-----------|-----------|-------|
-| aigateway.kagenti.dev | airoutingpolicies, aiaccesspolicies + /status + /finalizers | all |
+| aigateway.rossoctl.dev | airoutingpolicies, aiaccesspolicies + /status + /finalizers | all |
 | gateway.networking.k8s.io | gateways | get, list, watch |
 | gateway.envoyproxy.io | backends, clienttrafficpolicies, backendtrafficpolicies | all |
 | aigateway.envoyproxy.io | aiservicebackends, aigatewayroutes, backendsecuritypolicies | all |
diff --git a/docs/plans/migrate-agentcard-controller-to-workloads.md b/docs/plans/migrate-agentcard-controller-to-workloads.md
index 022fb0d5..3c6daaf8 100644
--- a/docs/plans/migrate-agentcard-controller-to-workloads.md
+++ b/docs/plans/migrate-agentcard-controller-to-workloads.md
@@ -2,13 +2,13 @@
 
 **Status:** Draft
 **Created:** 2026-01-30
-**Target:** kagenti-operator v2.x
+**Target:** rossoctl-operator v2.x
 
 ## Executive Summary
 
 This document outlines the migration of the AgentCard controller from watching and reconciling based on the custom `Agent` CRD to watching standard Kubernetes workloads (Deployments and StatefulSets) that are identified by specific labels.
 
-This migration aligns with the Kagenti UI migration documented in [kagenti/docs/plans/migrate-agent-crd-to-workloads.md](https://github.com/kagenti/kagenti/blob/main/docs/plans/migrate-agent-crd-to-workloads.md), where agents are now deployed directly as Deployments/StatefulSets rather than through the Agent CRD.
+This migration aligns with the Rossoctl UI migration documented in [rossoctl/docs/plans/migrate-agent-crd-to-workloads.md](https://github.com/rossoctl/rossoctl/blob/main/docs/plans/migrate-agent-crd-to-workloads.md), where agents are now deployed directly as Deployments/StatefulSets rather than through the Agent CRD.
 
 **Goals:**
 - Support agents deployed as Deployments and StatefulSets
@@ -40,7 +40,7 @@ The AgentCard system consists of two controllers:
 
 ```
 ┌─────────────────────────────────────────────────────────────────────┐
-│                        kagenti-operator                              │
+│                        rossoctl-operator                              │
 │                                                                      │
 │  ┌─────────────────────────┐    ┌─────────────────────────────┐    │
 │  │ AgentCardSyncReconciler │    │    AgentCardReconciler      │    │
@@ -79,20 +79,20 @@ The AgentCard system consists of two controllers:
 **AgentCardReconciler** depends on Agent CRD for:
 1. **Agent Discovery**: Uses `AgentCard.Spec.Selector.MatchLabels` to find Agent
 2. **Readiness Check**: Checks `Agent.Status.DeploymentStatus.Phase == PhaseReady`
-3. **Protocol Detection**: Reads `kagenti.io/agent-protocol` label from Agent
+3. **Protocol Detection**: Reads `rossoctl.io/agent-protocol` label from Agent
 4. **Service Discovery**: Uses Agent name to find corresponding Service
 
 **AgentCardSyncReconciler** depends on Agent CRD for:
 1. **Watch Source**: Watches Agent CRD events
-2. **Label Check**: Requires `kagenti.io/type=agent` and `kagenti.io/agent-protocol` labels
+2. **Label Check**: Requires `rossoctl.io/type=agent` and `rossoctl.io/agent-protocol` labels
 3. **Owner Reference**: Sets Agent as owner of AgentCard for garbage collection
 
 ### Current Label Requirements on Agent CRD
 
 | Label | Purpose |
 |-------|---------|
-| `kagenti.io/type=agent` | Identifies resource as an agent |
-| `kagenti.io/agent-protocol` | Protocol for fetching card (e.g., "a2a") |
+| `rossoctl.io/type=agent` | Identifies resource as an agent |
+| `rossoctl.io/agent-protocol` | Protocol for fetching card (e.g., "a2a") |
 | `app.kubernetes.io/name` | Used for service discovery and selector |
 
 ---
@@ -103,7 +103,7 @@ The AgentCard system consists of two controllers:
 
 ```
 ┌─────────────────────────────────────────────────────────────────────────┐
-│                          kagenti-operator                                │
+│                          rossoctl-operator                                │
 │                                                                          │
 │  ┌────────────────────────────┐    ┌─────────────────────────────┐      │
 │  │ AgentCardSyncReconciler    │    │    AgentCardReconciler      │      │
@@ -172,7 +172,7 @@ targetRef:
   name: my-agent
 
 targetRef:
-  apiVersion: agent.kagenti.dev/v1alpha1
+  apiVersion: agent.rossoctl.dev/v1alpha1
   kind: Agent  # Legacy
   name: my-agent
 ```
@@ -181,45 +181,45 @@ targetRef:
 
 ## 3. Label Standards
 
-As defined in the Kagenti UI migration plan, all agent workloads must have these labels:
+As defined in the Rossoctl UI migration plan, all agent workloads must have these labels:
 
 ### Required Labels (All Workloads)
 
 | Label | Value | Purpose |
 |-------|-------|---------|
-| `kagenti.io/type` | `agent` | Identifies resource as a Kagenti agent |
+| `rossoctl.io/type` | `agent` | Identifies resource as a Rossoctl agent |
 | `app.kubernetes.io/name` | `<agent-name>` | Standard K8s app name label |
-| `protocol.kagenti.io/<name>` | `""` (e.g., `protocol.kagenti.io/a2a`) | Protocol(s) the agent speaks |
+| `protocol.rossoctl.io/<name>` | `""` (e.g., `protocol.rossoctl.io/a2a`) | Protocol(s) the agent speaks |
 
 ### Recommended Labels
 
 | Label | Value | Purpose |
 |-------|-------|---------|
-| `app.kubernetes.io/managed-by` | `kagenti-ui` | Resource manager |
+| `app.kubernetes.io/managed-by` | `rossoctl-ui` | Resource manager |
 | `app.kubernetes.io/component` | `agent` | Component type |
-| `kagenti.io/framework` | `<framework>` | Framework (LangGraph, CrewAI, etc.) |
-| `kagenti.io/workload-type` | `deployment` or `statefulset` | Workload type |
+| `rossoctl.io/framework` | `<framework>` | Framework (LangGraph, CrewAI, etc.) |
+| `rossoctl.io/workload-type` | `deployment` or `statefulset` | Workload type |
 
 ### Label Selector for Agents
 
 To discover all agents in a namespace:
 
 ```
-kagenti.io/type=agent
+rossoctl.io/type=agent
 ```
 
 To discover agents with a specific protocol:
 
 ```
-kagenti.io/type=agent,protocol.kagenti.io/a2a
+rossoctl.io/type=agent,protocol.rossoctl.io/a2a
 ```
 
 ### Label Changes from Agent CRD
 
 | Old Label (Agent CRD) | New Label (Workloads) |
 |-----------------------|-----------------------|
-| `kagenti.io/agent-protocol: a2a` | `protocol.kagenti.io/a2a: ""` |
-| `kagenti.io/protocol: a2a` | `protocol.kagenti.io/a2a: ""` |
+| `rossoctl.io/agent-protocol: a2a` | `protocol.rossoctl.io/a2a: ""` |
+| `rossoctl.io/protocol: a2a` | `protocol.rossoctl.io/a2a: ""` |
 
 ---
 
@@ -308,7 +308,7 @@ type AgentCardSpec struct {
     SyncPeriod string `json:"syncPeriod,omitempty"`
 
     // TargetRef identifies the workload backing this agent using duck typing.
-    // The referenced workload must have the required Kagenti labels.
+    // The referenced workload must have the required Rossoctl labels.
     // +optional
     TargetRef *TargetRef `json:"targetRef,omitempty"`
 
@@ -342,7 +342,7 @@ type AgentCardStatus struct {
 **Example AgentCard with targetRef:**
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: my-agent-card
@@ -420,9 +420,9 @@ func (r *AgentCardReconciler) getWorkloadByTargetRef(
 
     labels := obj.GetLabels()
 
-    // Validate it's a Kagenti agent
+    // Validate it's a Rossoctl agent
     if !isAgentWorkload(labels) {
-        return nil, fmt.Errorf("%w: %s/%s does not have kagenti.io/type=agent label",
+        return nil, fmt.Errorf("%w: %s/%s does not have rossoctl.io/type=agent label",
             ErrNotAgentWorkload, targetRef.Kind, targetRef.Name)
     }
 
@@ -528,9 +528,9 @@ func (r *AgentCardReconciler) hasReadyCondition(obj *unstructured.Unstructured)
     return false, nil
 }
 
-// isAgentWorkload checks if labels indicate this is a Kagenti agent
+// isAgentWorkload checks if labels indicate this is a Rossoctl agent
 func isAgentWorkload(labels map[string]string) bool {
-    return labels[LabelKagentiType] == ValueTypeAgent
+    return labels[LabelRossoctlType] == ValueTypeAgent
 }
 ```
 
@@ -572,14 +572,14 @@ func (r *AgentCardReconciler) findMatchingWorkloadBySelector(
 
 ```go
 // getWorkloadProtocol extracts the protocol from workload labels
-// Supports both old (kagenti.io/agent-protocol) and new (kagenti.io/protocol) labels
+// Supports both old (rossoctl.io/agent-protocol) and new (rossoctl.io/protocol) labels
 func getWorkloadProtocol(labels map[string]string) string {
     // Try new label first
-    if protocol := labels[LabelKagentiProtocol]; protocol != "" {
+    if protocol := labels[LabelRossoctlProtocol]; protocol != "" {
         return protocol
     }
     // Fall back to old label
-    return labels[LabelKagentiAgentProtocol]
+    return labels[LabelRossoctlAgentProtocol]
 }
 ```
 
@@ -638,7 +638,7 @@ func (r *AgentCardReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
     if protocol == "" {
         log.Info("Workload has no protocol label", "name", workload.Name)
         r.updateCondition(ctx, agentCard, ConditionSynced, metav1.ConditionFalse,
-            "NoProtocol", "Workload does not have kagenti.io/protocol label")
+            "NoProtocol", "Workload does not have rossoctl.io/protocol label")
         return ctrl.Result{RequeueAfter: 1 * time.Minute}, nil
     }
 
@@ -718,11 +718,11 @@ func (r *AgentCardReconciler) SetupWithManager(mgr ctrl.Manager) error {
     return builder.Complete(r)
 }
 
-// agentLabelPredicate filters for resources with kagenti.io/type=agent
+// agentLabelPredicate filters for resources with rossoctl.io/type=agent
 func agentLabelPredicate() predicate.Predicate {
     return predicate.NewPredicateFuncs(func(obj client.Object) bool {
         labels := obj.GetLabels()
-        return labels[LabelKagentiType] == ValueTypeAgent
+        return labels[LabelRossoctlType] == ValueTypeAgent
     })
 }
 
@@ -856,15 +856,15 @@ func (r *AgentCardSyncReconciler) ReconcileAgent(ctx context.Context, req ctrl.R
 
 // shouldSyncWorkload checks if a workload should have an AgentCard created
 func (r *AgentCardSyncReconciler) shouldSyncWorkload(labels map[string]string) bool {
-    // Must have kagenti.io/type=agent
-    if labels[LabelKagentiType] != ValueTypeAgent {
+    // Must have rossoctl.io/type=agent
+    if labels[LabelRossoctlType] != ValueTypeAgent {
         return false
     }
 
     // Must have protocol label (new or old format)
-    protocol := labels[LabelKagentiProtocol]
+    protocol := labels[LabelRossoctlProtocol]
     if protocol == "" {
-        protocol = labels[LabelKagentiAgentProtocol]
+        protocol = labels[LabelRossoctlAgentProtocol]
     }
 
     return protocol != ""
@@ -942,7 +942,7 @@ func (r *AgentCardSyncReconciler) createAgentCard(
             Namespace: obj.GetNamespace(),
             Labels: map[string]string{
                 LabelAppName:   appName,
-                LabelManagedBy: "kagenti-operator",
+                LabelManagedBy: "rossoctl-operator",
             },
             OwnerReferences: []metav1.OwnerReference{
                 *metav1.NewControllerRef(obj, gvk),
@@ -1046,16 +1046,16 @@ import "errors"
 
 const (
     // Label keys
-    LabelKagentiType          = "kagenti.io/type"
-    LabelKagentiProtocol      = "kagenti.io/protocol"
-    LabelKagentiAgentProtocol = "kagenti.io/agent-protocol"  // Legacy
-    LabelKagentiWorkloadType  = "kagenti.io/workload-type"
+    LabelRossoctlType          = "rossoctl.io/type"
+    LabelRossoctlProtocol      = "rossoctl.io/protocol"
+    LabelRossoctlAgentProtocol = "rossoctl.io/agent-protocol"  // Legacy
+    LabelRossoctlWorkloadType  = "rossoctl.io/workload-type"
     LabelAppName              = "app.kubernetes.io/name"
     LabelManagedBy            = "app.kubernetes.io/managed-by"
 
     // Label values
     ValueTypeAgent         = "agent"
-    ValueManagedByOperator = "kagenti-operator"
+    ValueManagedByOperator = "rossoctl-operator"
 )
 
 var (
@@ -1063,7 +1063,7 @@ var (
     ErrWorkloadNotFound = errors.New("workload not found")
 
     // ErrNotAgentWorkload indicates the workload doesn't have required agent labels
-    ErrNotAgentWorkload = errors.New("resource is not a Kagenti agent")
+    ErrNotAgentWorkload = errors.New("resource is not a Rossoctl agent")
 )
 ```
 
@@ -1120,21 +1120,21 @@ Add permissions for Deployments and StatefulSets:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-operator-manager-role
+  name: rossoctl-operator-manager-role
 rules:
   # Existing AgentCard permissions
-  - apiGroups: ["agent.kagenti.dev"]
+  - apiGroups: ["agent.rossoctl.dev"]
     resources: ["agentcards"]
     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["agent.kagenti.dev"]
+  - apiGroups: ["agent.rossoctl.dev"]
     resources: ["agentcards/status"]
     verbs: ["get", "update", "patch"]
-  - apiGroups: ["agent.kagenti.dev"]
+  - apiGroups: ["agent.rossoctl.dev"]
     resources: ["agentcards/finalizers"]
     verbs: ["update"]
 
   # Legacy Agent CRD permissions (can be removed after migration)
-  - apiGroups: ["agent.kagenti.dev"]
+  - apiGroups: ["agent.rossoctl.dev"]
     resources: ["agents"]
     verbs: ["get", "list", "watch"]
 
@@ -1261,8 +1261,8 @@ This is controlled by the `--enable-legacy-agent-crd` flag (default: `true`).
 ### 8.2 Label Compatibility
 
 The controller supports both label formats:
-- New: `kagenti.io/protocol`
-- Old: `kagenti.io/agent-protocol`
+- New: `rossoctl.io/protocol`
+- Old: `rossoctl.io/agent-protocol`
 
 ### 8.3 AgentCard Spec Compatibility
 
@@ -1292,7 +1292,7 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: my-agent
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
 ```
 
 After (migrated):
@@ -1305,7 +1305,7 @@ spec:
   selector:  # Preserved for reference, but not used
     matchLabels:
       app.kubernetes.io/name: my-agent
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
 ```
 
 ### 8.4 Migration Path
@@ -1313,7 +1313,7 @@ spec:
 1. **Phase 1:** Deploy updated operator (hybrid mode)
 2. **Phase 2:** Create new agents as Deployments/StatefulSets (AgentCards created with `targetRef`)
 3. **Phase 3:** Existing AgentCards with `selector` are automatically migrated to use `targetRef`
-4. **Phase 4:** Migrate existing Agent CRDs using kagenti migration tool
+4. **Phase 4:** Migrate existing Agent CRDs using rossoctl migration tool
 5. **Phase 5:** Set `--enable-legacy-agent-crd=false`
 6. **Phase 6:** Remove Agent CRD from cluster
 
@@ -1374,7 +1374,7 @@ To revert to the previous version:
 
 ## References
 
-- [Kagenti UI Migration Plan](https://github.com/kagenti/kagenti/blob/main/docs/plans/migrate-agent-crd-to-workloads.md)
+- [Rossoctl UI Migration Plan](https://github.com/rossoctl/rossoctl/blob/main/docs/plans/migrate-agent-crd-to-workloads.md)
 - [Kubernetes Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
 - [Kubernetes StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/)
 - [Controller Runtime Watches](https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/builder)
diff --git a/docs/superpowers/plans/2026-06-18-authbridge-tlsbridge-phase2-operator.md b/docs/superpowers/plans/2026-06-18-authbridge-tlsbridge-phase2-operator.md
index 840e9071..1a93c1cb 100644
--- a/docs/superpowers/plans/2026-06-18-authbridge-tlsbridge-phase2-operator.md
+++ b/docs/superpowers/plans/2026-06-18-authbridge-tlsbridge-phase2-operator.md
@@ -4,23 +4,23 @@
 
 **Goal:** Make the AuthBridge TLS bridge work end-to-end on operator-deployed agents — the operator provisions a per-agent cert-manager CA, mounts the signing key into the sidecar and the trust cert + trust env into the agent, and renders the `tls_bridge:` config block — so a real agent's outbound HTTPS is decrypted into the pipeline, gated behind an off-by-default `tlsBridgeMode`.
 
-**Architecture:** A new `tlsBridgeMode: disabled|enabled` field on the `AgentRuntime` CRD, resolved CR→namespace→default exactly like `mtlsMode`. When `enabled` (and feature-gated on, and cert-manager present, and `authBridgeMode ∈ {proxy-sidecar, lite}`), a new per-agent CA reconciler creates a SelfSigned `Issuer` + a CA `Certificate` (`isCA: true`, **no Name Constraints**) → a Secret. The mutating webhook hard-mounts `tls.crt`/`tls.key` into the sidecar (mode `0440`) and `ca.crt` + trust env into the agent, and renders `tls_bridge: {mode: enabled, ca_dir: /etc/authbridge/tls-bridge-ca}` into the per-agent config (consolidated schema, kagenti-extensions#522 — no scope/ca_source/cert-paths). The `:9094` session-API localhost-bind (it now carries decrypted bodies) already shipped authbridge-side in #522, so the operator PR carries no extensions work; raw-body redaction is a deferred follow-up.
+**Architecture:** A new `tlsBridgeMode: disabled|enabled` field on the `AgentRuntime` CRD, resolved CR→namespace→default exactly like `mtlsMode`. When `enabled` (and feature-gated on, and cert-manager present, and `authBridgeMode ∈ {proxy-sidecar, lite}`), a new per-agent CA reconciler creates a SelfSigned `Issuer` + a CA `Certificate` (`isCA: true`, **no Name Constraints**) → a Secret. The mutating webhook hard-mounts `tls.crt`/`tls.key` into the sidecar (mode `0440`) and `ca.crt` + trust env into the agent, and renders `tls_bridge: {mode: enabled, ca_dir: /etc/authbridge/tls-bridge-ca}` into the per-agent config (consolidated schema, rossocortex#522 — no scope/ca_source/cert-paths). The `:9094` session-API localhost-bind (it now carries decrypted bodies) already shipped authbridge-side in #522, so the operator PR carries no extensions work; raw-body redaction is a deferred follow-up.
 
-**Tech Stack:** Go 1.x (kagenti-operator, kubebuilder/controller-runtime), cert-manager Go API `github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1` (v1.20.2, already vendored + scheme-registered), `k8s.io/utils/ptr`. Phase-1 AuthBridge code (kagenti-extensions PR #522) is the **prerequisite** — the rendered `tls_bridge:` block is only understood by the post-#522 authbridge image.
+**Tech Stack:** Go 1.x (rossoctl-operator, kubebuilder/controller-runtime), cert-manager Go API `github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1` (v1.20.2, already vendored + scheme-registered), `k8s.io/utils/ptr`. Phase-1 AuthBridge code (rossocortex PR #522) is the **prerequisite** — the rendered `tls_bridge:` block is only understood by the post-#522 authbridge image.
 
 **Locked decisions (from brainstorming):**
 1. CRD `tlsBridgeMode: disabled|enabled` maps 1:1 to `tls_bridge.mode`; `envoy-sidecar` + `enabled` ⇒ validating-webhook reject. (The authbridge schema was consolidated in #522: no scope/external — `enabled` intercepts all eligible on the configured ports.)
 2. **Unconstrained** per-agent CA (no X.509 Name Constraints). Containment = per-agent isolation + sidecar-only `0440` key + rotation. (Avoids the cert-manager `NameConstraints` feature-gate dependency entirely.)
 3. Fully **decoupled** from SPIRE/mTLS. Hard deps only: `authBridgeMode ∈ {proxy-sidecar, lite}` + cert-manager installed.
-   - **Cross-repo dependency for true SPIRE-free operation (added post-implementation, verified e2e):** the operator alone does not achieve this. The kagenti chart renders an empty `spiffe: {}` into every agent's base config, and the pre-fix authbridge binary built the SPIFFE provider on mere presence of that block → `NewX509Source` blocked forever when no SPIRE socket was mounted. SPIRE-free boot therefore requires **kagenti-extensions #523** (need-driven SPIFFE provider: build only when mTLS or a `identity.type=spiffe` plugin consumes it). On the operator side, `applyTLSBridgeMounts` now calls `ensureFSGroup` **unconditionally** (not only under `spireEnabled`) so the non-root sidecar can read the `0440` CA Secret without SPIRE — see the `0440`/`FSGroup=0` note below, which previously held only on the SPIRE path.
+   - **Cross-repo dependency for true SPIRE-free operation (added post-implementation, verified e2e):** the operator alone does not achieve this. The rossoctl chart renders an empty `spiffe: {}` into every agent's base config, and the pre-fix authbridge binary built the SPIFFE provider on mere presence of that block → `NewX509Source` blocked forever when no SPIRE socket was mounted. SPIRE-free boot therefore requires **rossocortex #523** (need-driven SPIFFE provider: build only when mTLS or a `identity.type=spiffe` plugin consumes it). On the operator side, `applyTLSBridgeMounts` now calls `ensureFSGroup` **unconditionally** (not only under `spireEnabled`) so the non-root sidecar can read the `0440` CA Secret without SPIRE — see the `0440`/`FSGroup=0` note below, which previously held only on the SPIRE path.
 
-**Spec:** `kagenti-extensions/authbridge/docs/superpowers/specs/2026-06-12-authbridge-tlsbridge-design.md` (Phase 2 section). **Phase 1 plan:** `kagenti-extensions/authbridge/docs/superpowers/plans/2026-06-17-authbridge-tlsbridge-phase1.md`.
+**Spec:** `rossocortex/authbridge/docs/superpowers/specs/2026-06-12-authbridge-tlsbridge-design.md` (Phase 2 section). **Phase 1 plan:** `rossocortex/authbridge/docs/superpowers/plans/2026-06-17-authbridge-tlsbridge-phase1.md`.
 
 ---
 
 ## Verified anchors in the operator (source of truth)
 
-All operator paths under `kagenti-operator/kagenti-operator/` unless noted. Verified 2026-06-18.
+All operator paths under `operator/operator/` unless noted. Verified 2026-06-18.
 
 - **CRD:** `api/v1alpha1/agentruntime_types.go` — `AgentRuntimeSpec` with `AuthBridgeMode string` (`:79`, enum `proxy-sidecar;envoy-sidecar;lite;waypoint`) and `MTLSMode string` (`:116`, `+kubebuilder:default=permissive`, enum `disabled;permissive;strict`). Both are bare strings validated by kubebuilder enum markers.
 - **Mode constants:** `internal/webhook/injector/constants.go` — AuthBridge modes `:18-22` (`ModeProxySidecar`, `ModeLite`, `ModeEnvoySidecar`, `ModeWaypoint`), mTLS modes `:66-70` (`MTLSModeDisabled`/`Permissive`/`Strict`).
@@ -33,15 +33,15 @@ All operator paths under `kagenti-operator/kagenti-operator/` unless noted. Veri
 - **Volumes:** `internal/webhook/injector/volume_builder.go` — `BuildResolvedVolumes(spireEnabled bool, envoyConfigMapName string)` (`:148`, the active path), `BuildRequiredVolumes()` (`:25`), `BuildRequiredVolumesNoSpire()` (`:99`). No Secret-backed volume exists today; volumes are appended `corev1.Volume{...}` literals; `Optional: ptr.To(true)` used (`:79` etc.); **no `DefaultMode` set anywhere today**.
 - **Container mounts + securitycontext:** `internal/webhook/injector/container_builder.go` — `BuildProxySidecarContainerWithPorts` volumeMounts (`:237-274`); `SecurityContext{RunAsUser: ptr.To(b.cfg.Proxy.UID), RunAsGroup: ..., RunAsNonRoot: true, AllowPrivilegeEscalation: false}` (`:301-311`); envoy analog (`:85-143`, `:189-194`). `Proxy.UID` default 1337.
 - **cert-manager:** `internal/controller/sharedtrust_controller.go` imports `cmv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"` + `cmmeta` (`:24-25`); `cmv1.AddToScheme(scheme)` in `cmd/main.go:75`; `CertManagerCRDExists(cfg)` (`:394-430`) reusable; registration gated on it in `cmd/main.go:709-718`. **No per-agent Certificate/Issuer is created anywhere today.** `CreateOrUpdate` + `SetControllerReference` template: `internal/controller/mlflow_controller.go:281-299`.
-- **RBAC:** marker `sharedtrust_controller.go:95-96` (`certificates` + `clusterissuers`, verbs `get;list;watch`); static dupes `config/rbac/role.yaml:152-156` and `charts/kagenti-operator/templates/rbac/role.yaml:65-74` (hand-maintained, NOT marker-synced).
+- **RBAC:** marker `sharedtrust_controller.go:95-96` (`certificates` + `clusterissuers`, verbs `get;list;watch`); static dupes `config/rbac/role.yaml:152-156` and `charts/operator/templates/rbac/role.yaml:65-74` (hand-maintained, NOT marker-synced).
 - **Validating webhook:** `internal/webhook/v1alpha1/agentruntime_webhook.go` — already rejects `mtlsMode != disabled` with `envoy-sidecar`; the place to add the `tlsBridgeMode=enabled` + `envoy-sidecar` reject.
-- **cert-manager version:** `kagenti-operator/go.mod:8` → `v1.20.2`. `CertificateSpec.NameConstraints` exists but is NOT used (decision 2).
+- **cert-manager version:** `operator/go.mod:8` → `v1.20.2`. `CertificateSpec.NameConstraints` exists but is NOT used (decision 2).
 
 ---
 
 ## File Structure
 
-**kagenti-operator (bulk):**
+**rossoctl-operator (bulk):**
 - `api/v1alpha1/agentruntime_types.go` — new `TLSBridgeMode` field.
 - `internal/webhook/injector/constants.go` — `TLSBridgeMode*` consts + the CA mount path/volume names.
 - `internal/webhook/config/feature_gates.go` (+ `feature_gate_loader.go` banner) — `TLSBridge bool` gate.
@@ -54,9 +54,9 @@ All operator paths under `kagenti-operator/kagenti-operator/` unless noted. Veri
 - `internal/controller/tlsbridge_ca_controller.go` — **new** per-agent CA reconciler.
 - `internal/webhook/v1alpha1/agentruntime_webhook.go` — envoy-sidecar reject.
 - `cmd/main.go` — register the reconciler (gated).
-- RBAC marker on the new reconciler + `config/rbac/role.yaml` + `charts/kagenti-operator/templates/rbac/role.yaml`.
+- RBAC marker on the new reconciler + `config/rbac/role.yaml` + `charts/operator/templates/rbac/role.yaml`.
 
-**kagenti-extensions:** none required for this PR. The `:9094` localhost-bind already
+**rossocortex:** none required for this PR. The `:9094` localhost-bind already
 shipped in #522 (`config.Load` rewrites `session_api_addr` to loopback when
 `tls_bridge.mode=enabled`). Raw-body redaction is a deferred follow-up, not a Phase-2 blocker.
 
@@ -73,19 +73,19 @@ shipped in #522 (`config.Load` rewrites `session_api_addr` to loopback when
 - [ ] **Step 1: Branch the operator repo off current main**
 
 ```bash
-cd /Users/haihuang/works/go/src/github.com/kagenti/kagenti-operator
+cd /Users/haihuang/works/go/src/github.com/rossoctl/operator
 git fetch origin main   # or upstream main, per your remote
 git checkout -b feat/tlsbridge-phase2 origin/main
 ```
 
-(All operator work happens here. No kagenti-extensions changes are needed — the `:9094` localhost-bind already landed in #522.)
+(All operator work happens here. No rossocortex changes are needed — the `:9094` localhost-bind already landed in #522.)
 
 ---
 
 ## Task 1: CRD field `TLSBridgeMode`
 
 **Files:**
-- Modify: `kagenti-operator/api/v1alpha1/agentruntime_types.go` (after `MTLSMode`, ~`:116`)
+- Modify: `operator/api/v1alpha1/agentruntime_types.go` (after `MTLSMode`, ~`:116`)
 
 - [ ] **Step 1: Add the field** to `AgentRuntimeSpec`, immediately after the `MTLSMode` field:
 
@@ -102,17 +102,17 @@ git checkout -b feat/tlsbridge-phase2 origin/main
 - [ ] **Step 2: Regenerate CRD manifests + deepcopy**
 
 ```bash
-cd kagenti-operator && make generate manifests
+cd rossoctl-operator && make generate manifests
 ```
-Expected: `zz_generated.deepcopy.go` unchanged (string field needs no deepcopy), and `config/crd/bases/*agentruntime*.yaml` now lists `tlsBridgeMode` with enum `[disabled, enabled]`, default `disabled`. If the chart vendors the CRD, also run any chart-CRD sync target (e.g. `make sync-crds` if present) or copy the regenerated CRD into `charts/kagenti-operator/`.
+Expected: `zz_generated.deepcopy.go` unchanged (string field needs no deepcopy), and `config/crd/bases/*agentruntime*.yaml` now lists `tlsBridgeMode` with enum `[disabled, enabled]`, default `disabled`. If the chart vendors the CRD, also run any chart-CRD sync target (e.g. `make sync-crds` if present) or copy the regenerated CRD into `charts/operator/`.
 
 - [ ] **Step 3: Build + commit**
 
-Run: `cd kagenti-operator && go build ./...`
+Run: `cd rossoctl-operator && go build ./...`
 Expected: builds.
 
 ```bash
-git add kagenti-operator/api/v1alpha1/agentruntime_types.go kagenti-operator/config/crd kagenti-operator/charts 2>/dev/null
+git add operator/api/v1alpha1/agentruntime_types.go operator/config/crd operator/charts 2>/dev/null
 git commit -s -m "feat(tlsbridge): add AgentRuntime.spec.tlsBridgeMode (disabled|enabled)"
 ```
 
@@ -121,7 +121,7 @@ git commit -s -m "feat(tlsbridge): add AgentRuntime.spec.tlsBridgeMode (disabled
 ## Task 2: Constants
 
 **Files:**
-- Modify: `kagenti-operator/internal/webhook/injector/constants.go` (near the mTLS consts `:66-70`)
+- Modify: `operator/internal/webhook/injector/constants.go` (near the mTLS consts `:66-70`)
 
 - [ ] **Step 1: Add the constants** after the mTLS mode block:
 
@@ -143,7 +143,7 @@ git commit -s -m "feat(tlsbridge): add AgentRuntime.spec.tlsBridgeMode (disabled
 Run: `go build ./...`
 
 ```bash
-git add kagenti-operator/internal/webhook/injector/constants.go
+git add operator/internal/webhook/injector/constants.go
 git commit -s -m "feat(tlsbridge): mode + CA-mount constants"
 ```
 
@@ -152,8 +152,8 @@ git commit -s -m "feat(tlsbridge): mode + CA-mount constants"
 ## Task 3: Off-by-default feature gate
 
 **Files:**
-- Modify: `kagenti-operator/internal/webhook/config/feature_gates.go` (struct `:13`, `DefaultFeatureGates` `:34`, banner `:178`)
-- Test: `kagenti-operator/internal/webhook/config/feature_gates_test.go` (or the existing test file)
+- Modify: `operator/internal/webhook/config/feature_gates.go` (struct `:13`, `DefaultFeatureGates` `:34`, banner `:178`)
+- Test: `operator/internal/webhook/config/feature_gates_test.go` (or the existing test file)
 
 - [ ] **Step 1: Write the failing test** — default must be OFF:
 
@@ -168,7 +168,7 @@ func TestDefaultFeatureGates_TLSBridgeOff(t *testing.T) {
 
 - [ ] **Step 2: Run — expect FAIL** (`g.TLSBridge` undefined)
 
-Run: `cd kagenti-operator && go test ./internal/webhook/config/ -run TestDefaultFeatureGates_TLSBridge -v`
+Run: `cd rossoctl-operator && go test ./internal/webhook/config/ -run TestDefaultFeatureGates_TLSBridge -v`
 
 - [ ] **Step 3: Add the field** to the `FeatureGates` struct (after `SkillDiscovery`):
 
@@ -187,7 +187,7 @@ Run: `go test ./internal/webhook/config/ -run TestDefaultFeatureGates_TLSBridge
 - [ ] **Step 5: Commit**
 
 ```bash
-git add kagenti-operator/internal/webhook/config/
+git add operator/internal/webhook/config/
 git commit -s -m "feat(tlsbridge): add off-by-default TLSBridge feature gate"
 ```
 
@@ -199,7 +199,7 @@ git commit -s -m "feat(tlsbridge): add off-by-default TLSBridge feature gate"
 - Modify: `agentruntime_config.go` (`AgentRuntimeOverrides` `:36`, `extractOverrides` `:102-126`)
 - Modify: `namespace_config.go` (add `ExtractTLSBridgeMode`, mirror `ExtractMTLSMode` `:171-186`)
 - Modify: `resolved_config.go` (`ResolvedConfig` `:63-64`, `ResolveConfig` `:119-128`)
-- Test: `kagenti-operator/internal/webhook/injector/resolved_config_test.go`
+- Test: `operator/internal/webhook/injector/resolved_config_test.go`
 
 - [ ] **Step 1: Write the failing test** — resolution prefers CR over namespace over default:
 
@@ -222,7 +222,7 @@ func TestResolveConfig_TLSBridgeMode_Precedence(t *testing.T) {
 
 - [ ] **Step 2: Run — expect FAIL** (`TLSBridgeMode` undefined on overrides/resolved)
 
-Run: `cd kagenti-operator && go test ./internal/webhook/injector/ -run TestResolveConfig_TLSBridgeMode -v`
+Run: `cd rossoctl-operator && go test ./internal/webhook/injector/ -run TestResolveConfig_TLSBridgeMode -v`
 
 - [ ] **Step 3: Add the override field + extraction** in `agentruntime_config.go`. In `AgentRuntimeOverrides` (after `MTLSMode *string`):
 
@@ -274,7 +274,7 @@ Run: `go test ./internal/webhook/injector/ -run TestResolveConfig_TLSBridgeMode
 - [ ] **Step 7: Commit**
 
 ```bash
-git add kagenti-operator/internal/webhook/injector/agentruntime_config.go kagenti-operator/internal/webhook/injector/namespace_config.go kagenti-operator/internal/webhook/injector/resolved_config.go kagenti-operator/internal/webhook/injector/resolved_config_test.go
+git add operator/internal/webhook/injector/agentruntime_config.go operator/internal/webhook/injector/namespace_config.go operator/internal/webhook/injector/resolved_config.go operator/internal/webhook/injector/resolved_config_test.go
 git commit -s -m "feat(tlsbridge): resolve tlsBridgeMode (CR>namespace>default)"
 ```
 
@@ -283,8 +283,8 @@ git commit -s -m "feat(tlsbridge): resolve tlsBridgeMode (CR>namespace>default)"
 ## Task 5: Validating-webhook reject (enabled + envoy-sidecar)
 
 **Files:**
-- Modify: `kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook.go` (beside the existing mtls+envoy reject)
-- Test: `kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go`
+- Modify: `operator/internal/webhook/v1alpha1/agentruntime_webhook.go` (beside the existing mtls+envoy reject)
+- Test: `operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go`
 
 - [ ] **Step 1: Write the failing test**:
 
@@ -307,7 +307,7 @@ func TestValidate_TLSBridgeEnabled_RejectsEnvoySidecar(t *testing.T) {
 
 - [ ] **Step 2: Run — expect FAIL** (no rejection yet)
 
-Run: `cd kagenti-operator && go test ./internal/webhook/v1alpha1/ -run TestValidate_TLSBridgeEnabled -v`
+Run: `cd rossoctl-operator && go test ./internal/webhook/v1alpha1/ -run TestValidate_TLSBridgeEnabled -v`
 
 - [ ] **Step 3: Add the check** beside the mtls+envoy reject:
 
@@ -324,7 +324,7 @@ Run: `go test ./internal/webhook/v1alpha1/ -run TestValidate_TLSBridgeEnabled -v
 - [ ] **Step 5: Commit**
 
 ```bash
-git add kagenti-operator/internal/webhook/v1alpha1/
+git add operator/internal/webhook/v1alpha1/
 git commit -s -m "feat(tlsbridge): reject tlsBridgeMode=enabled with envoy-sidecar"
 ```
 
@@ -333,12 +333,12 @@ git commit -s -m "feat(tlsbridge): reject tlsBridgeMode=enabled with envoy-sidec
 ## Task 6: Per-agent CA reconciler (net-new)
 
 **Files:**
-- Create: `kagenti-operator/internal/controller/tlsbridge_ca_controller.go`
-- Test: `kagenti-operator/internal/controller/tlsbridge_ca_controller_test.go`
+- Create: `operator/internal/controller/tlsbridge_ca_controller.go`
+- Test: `operator/internal/controller/tlsbridge_ca_controller_test.go`
 
 This reconciler watches `AgentRuntime`. When the resolved mode is `enabled` AND the feature gate is on AND cert-manager is present, it ensures (per agent): a namespace SelfSigned `Issuer` (shared, name `authbridge-tls-bridge-selfsigned`) and a CA `Certificate` (`isCA: true`, `secretName: <agent>-tls-bridge-ca`, **no nameConstraints**) owned by the AgentRuntime. cert-manager then issues the Secret (`tls.crt`/`tls.key`/`ca.crt`). The hard pod-mount (Task 7) blocks pod start until that Secret exists — solving the ordering race.
 
-> **Contract with authbridge `FileSource` (kagenti-extensions#522).** The bridge's
+> **Contract with authbridge `FileSource` (rossocortex#522).** The bridge's
 > `NewFileSource` now *validates* the mounted Secret at boot and **fails loud** if the
 > cert is not a CA (`IsCA=false` / missing `KeyUsageCertSign`) or if cert/key don't match.
 > So the `Certificate` below MUST keep `IsCA: true` **and** `Usages` including
@@ -364,7 +364,7 @@ func TestTLSBridgeCAReconciler_CreatesIssuerAndCert(t *testing.T) {
 
 - [ ] **Step 2: Run — expect FAIL** (`TLSBridgeCAReconciler` undefined)
 
-Run: `cd kagenti-operator && go test ./internal/controller/ -run TestTLSBridgeCAReconciler -v`
+Run: `cd rossoctl-operator && go test ./internal/controller/ -run TestTLSBridgeCAReconciler -v`
 
 - [ ] **Step 3: Implement the reconciler**:
 
@@ -382,8 +382,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	ctrl "sigs.k8s.io/controller-runtime"
-	agentv1alpha1 "github.com/kagenti/kagenti-operator/api/v1alpha1"
-	"github.com/kagenti/kagenti-operator/internal/webhook/injector"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/webhook/injector"
 )
 
 const tlsBridgeSelfSignedIssuer = "authbridge-tls-bridge-selfsigned"
@@ -472,10 +472,10 @@ Run: `go test ./internal/controller/ -run TestTLSBridgeCAReconciler -v`
 
 - [ ] **Step 6: Build + commit**
 
-Run: `cd kagenti-operator && go build ./... && go test ./internal/controller/ -run TLSBridge`
+Run: `cd rossoctl-operator && go build ./... && go test ./internal/controller/ -run TLSBridge`
 
 ```bash
-git add kagenti-operator/internal/controller/tlsbridge_ca_controller.go kagenti-operator/internal/controller/tlsbridge_ca_controller_test.go kagenti-operator/cmd/main.go
+git add operator/internal/controller/tlsbridge_ca_controller.go operator/internal/controller/tlsbridge_ca_controller_test.go operator/cmd/main.go
 git commit -s -m "feat(tlsbridge): per-agent cert-manager CA reconciler (unconstrained)"
 ```
 
@@ -484,15 +484,15 @@ git commit -s -m "feat(tlsbridge): per-agent cert-manager CA reconciler (unconst
 ## Task 7: RBAC delta (create/update issuers + certificates)
 
 **Files:**
-- Modify: `kagenti-operator/config/rbac/role.yaml` (the cert-manager rule `:152-156`)
-- Modify: `kagenti-operator/charts/kagenti-operator/templates/rbac/role.yaml` (`:65-74`)
+- Modify: `operator/config/rbac/role.yaml` (the cert-manager rule `:152-156`)
+- Modify: `operator/charts/operator/templates/rbac/role.yaml` (`:65-74`)
 
 (The kubebuilder marker was added in Task 6 Step 3; `make manifests` regenerates `config/rbac/role.yaml`. The chart role is hand-maintained — edit it directly.)
 
 - [ ] **Step 1: Regenerate + verify the generated rule**
 
 ```bash
-cd kagenti-operator && make manifests
+cd rossoctl-operator && make manifests
 ```
 Expected: `config/rbac/role.yaml` now grants `create;update;patch;delete` (plus `get;list;watch`) on `cert-manager.io` `certificates` AND `issuers` (issuers newly added).
 
@@ -518,7 +518,7 @@ Expected: `config/rbac/role.yaml` now grants `create;update;patch;delete` (plus
 - [ ] **Step 3: Commit**
 
 ```bash
-git add kagenti-operator/config/rbac/role.yaml kagenti-operator/charts/kagenti-operator/templates/rbac/role.yaml
+git add operator/config/rbac/role.yaml operator/charts/operator/templates/rbac/role.yaml
 git commit -s -m "feat(tlsbridge): RBAC to create per-agent cert-manager Issuer/Certificate"
 ```
 
@@ -527,7 +527,7 @@ git commit -s -m "feat(tlsbridge): RBAC to create per-agent cert-manager Issuer/
 ## Task 8: Render the `tls_bridge:` config block
 
 **Files:**
-- Modify: `kagenti-operator/internal/webhook/injector/pod_mutator.go` — `ensurePerAgentConfigMap` (`:861`, the `mtls:` block `:930-938`); thread a `tlsBridgeMode string` param + pass it from both call sites.
+- Modify: `operator/internal/webhook/injector/pod_mutator.go` — `ensurePerAgentConfigMap` (`:861`, the `mtls:` block `:930-938`); thread a `tlsBridgeMode string` param + pass it from both call sites.
 - Test: extend `pod_mutator_test.go`
 
 - [ ] **Step 1: Write the failing test** — enabled renders the block; disabled scrubs it:
@@ -544,13 +544,13 @@ func TestEnsurePerAgentConfigMap_TLSBridgeBlock(t *testing.T) {
 
 - [ ] **Step 2: Run — expect FAIL**
 
-Run: `cd kagenti-operator && go test ./internal/webhook/injector/ -run TestEnsurePerAgentConfigMap_TLSBridge -v`
+Run: `cd rossoctl-operator && go test ./internal/webhook/injector/ -run TestEnsurePerAgentConfigMap_TLSBridge -v`
 
 - [ ] **Step 3: Add the render block** right after the `mtls:` block (`:938`), and thread `tlsBridgeMode` into the function signature + both call sites:
 
 ```go
 	if tlsBridgeMode == TLSBridgeModeEnabled {
-		// Consolidated schema (kagenti-extensions#522): mode + ca_dir only.
+		// Consolidated schema (rossocortex#522): mode + ca_dir only.
 		// ca_dir = the mounted cert-manager Secret (tls.crt/tls.key/ca.crt by
 		// convention). No scope/ca_source/cert+key paths.
 		cfg["tls_bridge"] = map[string]interface{}{
@@ -569,7 +569,7 @@ Run: `go test ./internal/webhook/injector/ -run TestEnsurePerAgentConfigMap_TLSB
 - [ ] **Step 5: Commit**
 
 ```bash
-git add kagenti-operator/internal/webhook/injector/pod_mutator.go kagenti-operator/internal/webhook/injector/pod_mutator_test.go
+git add operator/internal/webhook/injector/pod_mutator.go operator/internal/webhook/injector/pod_mutator_test.go
 git commit -s -m "feat(tlsbridge): render tls_bridge config block (mode + ca_dir)"
 ```
 
@@ -578,9 +578,9 @@ git commit -s -m "feat(tlsbridge): render tls_bridge config block (mode + ca_dir
 ## Task 9: Mount the CA — sidecar key (0440) + agent cert + trust env
 
 **Files:**
-- Modify: `kagenti-operator/internal/webhook/injector/volume_builder.go` (helper `tlsBridgeCAVolume`; add to `BuildResolvedVolumes` `:148` + the two legacy builders)
-- Modify: `kagenti-operator/internal/webhook/injector/container_builder.go` (sidecar mount `:237`)
-- Modify: `kagenti-operator/internal/webhook/injector/pod_mutator.go` (new `applyTLSBridgeMounts(podSpec, agentName, tlsBridgeMode)`; call it gated, after the agent-container loop ~`:535`)
+- Modify: `operator/internal/webhook/injector/volume_builder.go` (helper `tlsBridgeCAVolume`; add to `BuildResolvedVolumes` `:148` + the two legacy builders)
+- Modify: `operator/internal/webhook/injector/container_builder.go` (sidecar mount `:237`)
+- Modify: `operator/internal/webhook/injector/pod_mutator.go` (new `applyTLSBridgeMounts(podSpec, agentName, tlsBridgeMode)`; call it gated, after the agent-container loop ~`:535`)
 - Test: `pod_mutator_test.go`
 
 > **Mode `0440`, not `0400`.** The sidecar runs non-root as `Proxy.UID` (1337); `ensureFSGroup` sets pod `FSGroup=0`. Kubernetes group-owns Secret-volume files by `FSGroup`, so `0440` (owner+group read) lets the proxy read `tls.key` via its `FSGroup=0` supplementary group. `0400` (owner-only) would deny the non-root proxy → no minting → silent fall-open to tunnel. Verify in Task 12.
@@ -603,7 +603,7 @@ func TestApplyTLSBridgeMounts_Enabled(t *testing.T) {
 
 - [ ] **Step 2: Run — expect FAIL**
 
-Run: `cd kagenti-operator && go test ./internal/webhook/injector/ -run TestApplyTLSBridgeMounts -v`
+Run: `cd rossoctl-operator && go test ./internal/webhook/injector/ -run TestApplyTLSBridgeMounts -v`
 
 - [ ] **Step 3: Add the volume helper** in `volume_builder.go` and append it from the volume builders when bridging is on (thread an `enabled bool` + `secretName string`, or append unconditionally in a new gated call — follow the existing builder signatures):
 
@@ -671,7 +671,7 @@ Run: `go test ./internal/webhook/injector/ -run TestApplyTLSBridgeMounts -v`
 - [ ] **Step 7: Commit**
 
 ```bash
-git add kagenti-operator/internal/webhook/injector/volume_builder.go kagenti-operator/internal/webhook/injector/pod_mutator.go kagenti-operator/internal/webhook/injector/pod_mutator_test.go
+git add operator/internal/webhook/injector/volume_builder.go operator/internal/webhook/injector/pod_mutator.go operator/internal/webhook/injector/pod_mutator_test.go
 git commit -s -m "feat(tlsbridge): mount per-agent CA — sidecar key (0440) + agent ca.crt + trust env"
 ```
 
@@ -680,7 +680,7 @@ git commit -s -m "feat(tlsbridge): mount per-agent CA — sidecar key (0440) + a
 ## Task 10: Wire mode resolution → render + mounts in the mutator
 
 **Files:**
-- Modify: `kagenti-operator/internal/webhook/injector/pod_mutator.go` (the proxy-sidecar mutation path, near the `MTLS_MODE` injection `:519-526`)
+- Modify: `operator/internal/webhook/injector/pod_mutator.go` (the proxy-sidecar mutation path, near the `MTLS_MODE` injection `:519-526`)
 - Test: `pod_mutator_test.go`
 
 - [ ] **Step 1: Write the failing end-to-end mutation test** — a pod admitted for an `enabled` proxy-sidecar agent (gate on) gets BOTH the `tls_bridge:` config AND the mounts/env; an `envoy-sidecar`/disabled/gate-off agent gets neither:
@@ -723,7 +723,7 @@ Run: `go test ./internal/webhook/injector/ -v`
 - [ ] **Step 5: Commit**
 
 ```bash
-git add kagenti-operator/internal/webhook/injector/pod_mutator.go kagenti-operator/internal/webhook/injector/pod_mutator_test.go
+git add operator/internal/webhook/injector/pod_mutator.go operator/internal/webhook/injector/pod_mutator_test.go
 git commit -s -m "feat(tlsbridge): gate + wire render/mounts in the mutating webhook"
 ```
 
@@ -785,9 +785,9 @@ git commit -s -m "test(tlsbridge): e2e — operator-provisioned CA decrypts agen
 
 The operator renders a `tls_bridge:` block only the post-#522 authbridge image understands (the `:9094` localhost-bind + `FileSource` validation are already in #522). So:
 
-1. **kagenti-extensions**: merge PR #522 → tag a new `v0.x.0-alpha.N` authbridge/proxy-init image.
-2. **kagenti-operator**: merge this Phase-2 PR → tag `v0.x.0-alpha.M`.
-3. **kagenti**: bump the chart pins (operator image + authbridge sidecar images) to the new tags; this is where it becomes installable. Same operator→extensions→kagenti order as the alpha.9 release.
+1. **rossocortex**: merge PR #522 → tag a new `v0.x.0-alpha.N` authbridge/proxy-init image.
+2. **rossoctl-operator**: merge this Phase-2 PR → tag `v0.x.0-alpha.M`.
+3. **rossoctl**: bump the chart pins (operator image + authbridge sidecar images) to the new tags; this is where it becomes installable. Same operator→extensions→rossoctl order as the alpha.9 release.
 
 ---
 
diff --git a/kagenti-operator/config/security/kustomization.yaml b/kagenti-operator/config/security/kustomization.yaml
deleted file mode 100644
index ad3a3fb3..00000000
--- a/kagenti-operator/config/security/kustomization.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-resources:
-- kagenti-authbridge-scc.yaml
diff --git a/kagenti-operator/.devcontainer/devcontainer.json b/operator/.devcontainer/devcontainer.json
similarity index 100%
rename from kagenti-operator/.devcontainer/devcontainer.json
rename to operator/.devcontainer/devcontainer.json
diff --git a/kagenti-operator/.devcontainer/post-install.sh b/operator/.devcontainer/post-install.sh
similarity index 100%
rename from kagenti-operator/.devcontainer/post-install.sh
rename to operator/.devcontainer/post-install.sh
diff --git a/kagenti-operator/.dockerignore b/operator/.dockerignore
similarity index 100%
rename from kagenti-operator/.dockerignore
rename to operator/.dockerignore
diff --git a/kagenti-operator/.gitignore b/operator/.gitignore
similarity index 100%
rename from kagenti-operator/.gitignore
rename to operator/.gitignore
diff --git a/kagenti-operator/.golangci.yml b/operator/.golangci.yml
similarity index 100%
rename from kagenti-operator/.golangci.yml
rename to operator/.golangci.yml
diff --git a/kagenti-operator/Dockerfile b/operator/Dockerfile
similarity index 100%
rename from kagenti-operator/Dockerfile
rename to operator/Dockerfile
diff --git a/kagenti-operator/GETTING_STARTED.md b/operator/GETTING_STARTED.md
similarity index 78%
rename from kagenti-operator/GETTING_STARTED.md
rename to operator/GETTING_STARTED.md
index 9d805b25..d263ce24 100644
--- a/kagenti-operator/GETTING_STARTED.md
+++ b/operator/GETTING_STARTED.md
@@ -1,6 +1,6 @@
-# Getting Started with Kagenti Operator
+# Getting Started with Rossoctl Operator
 
-> **Note**: This guide assumes you have already installed the Kagenti platform on your cluster. For OpenShift, use [`scripts/ocp/setup-kagenti.sh`](https://github.com/kagenti/kagenti/blob/main/scripts/ocp/setup-kagenti.sh) — the recommended installer for OCP deployments. For plain Kubernetes, install the operator directly via Helm (see the [Quick Start](../README.md#quick-start) in the root README).
+> **Note**: This guide assumes you have already installed the Rossoctl platform on your cluster. For OpenShift, use [`scripts/ocp/setup-rossoctl.sh`](https://github.com/rossoctl/rossoctl/blob/main/scripts/ocp/setup-rossoctl.sh) — the recommended installer for OCP deployments. For plain Kubernetes, install the operator directly via Helm (see the [Quick Start](../README.md#quick-start) in the root README).
 
 ## Prerequisites
 
@@ -24,7 +24,7 @@ The agent deployments in this guide are configured with the following environmen
 
 ## Intent
 
-This guide provides step-by-step instructions for deploying and testing AI agents with the Kagenti platform. By following this guide, you will learn how to deploy agents and integrate MCP (Model Context Protocol) servers to extend agent capabilities.
+This guide provides step-by-step instructions for deploying and testing AI agents with the Rossoctl platform. By following this guide, you will learn how to deploy agents and integrate MCP (Model Context Protocol) servers to extend agent capabilities.
 
 ## Scenario
 
@@ -34,20 +34,20 @@ In this guide, you will:
 2. Deploy an MCP server that provides tools and resources to the agent
 3. Test the end-to-end flow by sending a weather query ("What is the weather in New York?") to the agent, which will communicate with the MCP server and return a response
 
-This scenario demonstrates the complete lifecycle of an AI agent deployment on the Kagenti platform, from initial deployment to integration with external tools via MCP servers.
+This scenario demonstrates the complete lifecycle of an AI agent deployment on the Rossoctl platform, from initial deployment to integration with external tools via MCP servers.
 
 ---
 ## Overview
 
-### Kagenti Operator
-The Kagenti Operator discovers, indexes, and secures AI agents deployed in Kubernetes. Enroll workloads by creating an `AgentRuntime` CR:
+### Rossoctl Operator
+The Rossoctl Operator discovers, indexes, and secures AI agents deployed in Kubernetes. Enroll workloads by creating an `AgentRuntime` CR:
 
-1. Create a Deployment with a `protocol.kagenti.io/a2a` label
+1. Create a Deployment with a `protocol.rossoctl.io/a2a` label
 2. Create an `AgentRuntime` CR pointing to it
-3. The controller applies `kagenti.io/type` labels and triggers sidecar injection automatically
+3. The controller applies `rossoctl.io/type` labels and triggers sidecar injection automatically
 4. The protocol label enables automatic AgentCard creation for agent discovery
 
-A `ValidatingAdmissionPolicy` prevents the `kagenti.io/type` label from being set directly on Deployments or StatefulSets — it can only be applied by the operator via an AgentRuntime CR.
+A `ValidatingAdmissionPolicy` prevents the `rossoctl.io/type` label from being set directly on Deployments or StatefulSets — it can only be applied by the operator via an AgentRuntime CR.
 
 > **Note:** The `Agent` Custom Resource is deprecated and will be removed in a future release.
 
@@ -55,7 +55,7 @@ A `ValidatingAdmissionPolicy` prevents the `kagenti.io/type` label from being se
 
 ## Deploy an Agent with AgentRuntime (Recommended)
 
-The AgentRuntime approach requires only a `protocol.kagenti.io/a2a` label on your Deployment — the controller applies `kagenti.io/type`, computes a config hash, and triggers the AuthBridge webhook to inject sidecars. The protocol label tells the AgentCard sync controller which protocol the agent speaks, enabling automatic discovery.
+The AgentRuntime approach requires only a `protocol.rossoctl.io/a2a` label on your Deployment — the controller applies `rossoctl.io/type`, computes a config hash, and triggers the AuthBridge webhook to inject sidecars. The protocol label tells the AgentCard sync controller which protocol the agent speaks, enabling automatic discovery.
 
 ### Step 1: Deploy a Deployment with Protocol Label
 
@@ -68,7 +68,7 @@ metadata:
   namespace: team1
   labels:
     app.kubernetes.io/name: weather-agent
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -81,7 +81,7 @@ spec:
     spec:
       containers:
       - name: agent
-        image: "ghcr.io/kagenti/agent-examples/weather_service:v0.0.1-alpha.3"
+        image: "ghcr.io/rossoctl/examples/weather_service:v0.0.1-alpha.3"
         ports:
         - containerPort: 8000
         imagePullPolicy: Always
@@ -118,7 +118,7 @@ EOF
 
 ```yaml
 kubectl apply -f - <<EOF
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
@@ -134,9 +134,9 @@ EOF
 
 The controller will:
 1. Resolve `targetRef` and verify the Deployment exists
-2. Apply `kagenti.io/type: agent` and `app.kubernetes.io/managed-by: kagenti-operator` labels
-3. Compute a config hash from cluster/namespace platform configuration and set it as a `kagenti.io/config-hash` annotation on the PodTemplateSpec
-4. Trigger a rolling update — new Pods are created with the `kagenti.io/type` label, which the AuthBridge webhook matches to inject sidecars
+2. Apply `rossoctl.io/type: agent` and `app.kubernetes.io/managed-by: rossoctl-operator` labels
+3. Compute a config hash from cluster/namespace platform configuration and set it as a `rossoctl.io/config-hash` annotation on the PodTemplateSpec
+4. Trigger a rolling update — new Pods are created with the `rossoctl.io/type` label, which the AuthBridge webhook matches to inject sidecars
 
 ### Step 3: Check Status
 
@@ -155,7 +155,7 @@ kubectl describe agentruntime weather-agent-runtime -n team1
 kubectl get deployment weather-agent -n team1 --show-labels
 
 # Check that pods received sidecar injection
-kubectl get pods -n team1 -l kagenti.io/type=agent -o jsonpath='{.items[0].spec.containers[*].name}'
+kubectl get pods -n team1 -l rossoctl.io/type=agent -o jsonpath='{.items[0].spec.containers[*].name}'
 ```
 
 ### Updating Configuration
@@ -174,8 +174,8 @@ spec:
 ### Deleting an AgentRuntime
 
 When you delete the AgentRuntime CR, the controller performs a graceful cleanup:
-- Removes the `kagenti.io/type` label from the workload metadata and PodTemplateSpec
-- Removes the `kagenti.io/config-hash` annotation from the PodTemplateSpec (triggers a rolling update so existing injected pods are replaced)
+- Removes the `rossoctl.io/type` label from the workload metadata and PodTemplateSpec
+- Removes the `rossoctl.io/config-hash` annotation from the PodTemplateSpec (triggers a rolling update so existing injected pods are replaced)
 - Removes the `app.kubernetes.io/managed-by` label
 
 ```bash
@@ -209,7 +209,7 @@ spec:
     spec:
       containers:
       - name: mcp
-        image: ghcr.io/kagenti/agent-examples/weather_tool:latest
+        image: ghcr.io/rossoctl/examples/weather_tool:latest
         imagePullPolicy: Always
         env:
         - name: PORT
@@ -227,7 +227,7 @@ spec:
       - name: cache
         emptyDir: {}
 ---
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-tool
@@ -244,12 +244,12 @@ kind: Service
 metadata:
   labels:
     app.kubernetes.io/component: agent
-    app.kubernetes.io/managed-by: kagenti-ui
+    app.kubernetes.io/managed-by: rossoctl-ui
     app.kubernetes.io/name: weather-service
-    kagenti.io/framework: LangGraph
-    kagenti.io/inject: enabled
-    kagenti.io/workload-type: deployment
-    protocol.kagenti.io/a2a: ""
+    rossoctl.io/framework: LangGraph
+    rossoctl.io/inject: enabled
+    rossoctl.io/workload-type: deployment
+    protocol.rossoctl.io/a2a: ""
   name: weather-service
   namespace: team1
 spec:
@@ -260,14 +260,14 @@ spec:
     targetPort: 8000
   selector:
     app.kubernetes.io/name: weather-service
-    kagenti.io/type: agent
+    rossoctl.io/type: agent
   type: ClusterIP
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
-    kagenti.io/managed-by: webhook
+    rossoctl.io/managed-by: webhook
   name: weather-service
   namespace: team1
 EOF
@@ -277,17 +277,17 @@ EOF
 ```bash
 
 # List deployments (mcp servers)
-kubectl get deployments -n team1 -l kagenti.io/type=tool
+kubectl get deployments -n team1 -l rossoctl.io/type=tool
 
 # List pods (mcp servers)
-kubectl get pods -n team1 -l kagenti.io/type=tool
+kubectl get pods -n team1 -l rossoctl.io/type=tool
 
 # Check detailed status
-kubectl describe deployments -l kagenti.io/type=tool -n team1
-kubectl describe pods -l kagenti.io/type=tool -n team1
+kubectl describe deployments -l rossoctl.io/type=tool -n team1
+kubectl describe pods -l rossoctl.io/type=tool -n team1
 
 # View logs
-kubectl logs -l kagenti.io/type=tool -n team1 --prefix
+kubectl logs -l rossoctl.io/type=tool -n team1 --prefix
 ```
 
 
@@ -381,7 +381,7 @@ You can watch the logs to see the agent communicating with the MCP server:
 kubectl logs -f -l app.kubernetes.io/name=weather-agent -n team1
 
 # Watch MCP server logs (in another terminal)
-kubectl logs -f -l kagenti.io/type=tool -n team1
+kubectl logs -f -l rossoctl.io/type=tool -n team1
 ```
 
 ---
@@ -415,16 +415,16 @@ kubectl get agentcard -n team1 -o jsonpath='{.items[0].status.validSignature}'
 ### MCP Server Status
 ```bash
 # List deployments (mcp servers)
-kubectl get deployments -n team1 -l kagenti.io/type=tool
+kubectl get deployments -n team1 -l rossoctl.io/type=tool
 
 # Detailed status
 kubectl describe deployment weather-tool -n team1
 
 # Check if pods are running
-kubectl get pods -n team1 -l kagenti.io/type=tool
+kubectl get pods -n team1 -l rossoctl.io/type=tool
 
 # View logs
-kubectl logs -l kagenti.io/type=tool -n team1 -f
+kubectl logs -l rossoctl.io/type=tool -n team1 -f
 ```
 
 ---
@@ -449,16 +449,16 @@ kubectl get pods -n team1 -l app.kubernetes.io/name=weather-agent
 kubectl get deployment weather-tool -n team1 -o yaml
 
 # Check pod status
-kubectl get pods -n team1 -l kagenti.io/type=tool
+kubectl get pods -n team1 -l rossoctl.io/type=tool
 
 # Check events
-kubectl get events -n team1 --field-selector involvedObject.kind=Pod,involvedObject.name=$(kubectl get pods -n team1 -l kagenti.io/type=tool -o jsonpath='{.items[0].metadata.name}') --sort-by='.lastTimestamp'
+kubectl get events -n team1 --field-selector involvedObject.kind=Pod,involvedObject.name=$(kubectl get pods -n team1 -l rossoctl.io/type=tool -o jsonpath='{.items[0].metadata.name}') --sort-by='.lastTimestamp'
 
 # Verify service account exists
 kubectl get serviceaccount weather-service -n team1
 
 # Check for image pull issues
-kubectl describe pod -n team1 -l kagenti.io/type=tool
+kubectl describe pod -n team1 -l rossoctl.io/type=tool
 ```
 
 ### Agent Not Responding to Requests
diff --git a/kagenti-operator/Makefile b/operator/Makefile
similarity index 93%
rename from kagenti-operator/Makefile
rename to operator/Makefile
index 53431f54..07f62c80 100644
--- a/kagenti-operator/Makefile
+++ b/operator/Makefile
@@ -13,7 +13,7 @@ endif
 # scaffolded by default. However, you might want to replace it to use other
 # tools. (i.e. podman)
 CONTAINER_TOOL ?= docker
-CMD_NAME ?= kagenti-operator
+CMD_NAME ?= rossoctl-operator
 LOCAL_REGISTRY ?= localhost
 IMAGE_TAG ?= $(shell git rev-parse --short HEAD)
 IMG ?= ${LOCAL_REGISTRY}/${CMD_NAME}:${IMAGE_TAG}
@@ -21,11 +21,11 @@ ARCH := $(shell go env GOARCH)
 OS := $(shell go env GOOS)
 
 # CLUSTER specifies the Kubernetes cluster name to use for deployment.
-# Default is "kagenti".
+# Default is "rossoctl".
 # If you need to deploy to a different cluster (e.g., in CI/CD or your local environment),
 # override this by running 'make CLUSTER=your-cluster-name ...' or by setting the CLUSTER environment variable.
-CLUSTER ?= kagenti
-CONTEXT ?= kind-kagenti
+CLUSTER ?= rossoctl
+CONTEXT ?= kind-rossoctl
 INTEGRATION_TAGS ?= integration
 
 HELM_IMG := --set controllerManager.container.image.repository=${LOCAL_REGISTRY}/${CMD_NAME} --set controllerManager.container.image.tag=${IMAGE_TAG}
@@ -63,7 +63,7 @@ manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and Cust
 	$(CONTROLLER_GEN) rbac:roleName=manager-role crd:allowDangerousTypes=true webhook paths="./..." output:crd:artifacts:config=config/crd/bases
 	$(MAKE) sync-chart-crds
 
-# sync-chart-crds keeps charts/kagenti-operator/crds/ in lockstep with
+# sync-chart-crds keeps charts/operator/crds/ in lockstep with
 # config/crd/bases/. Helm's crds/ directory is the install path consumers
 # get when they `helm install`; without this sync the chart copy drifts
 # silently every time a CRD field is added (which has happened multiple
@@ -72,12 +72,12 @@ manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and Cust
 # regenerated controller-gen output. Skips the stub `_.yaml` file
 # controller-gen sometimes emits.
 .PHONY: sync-chart-crds
-sync-chart-crds: ## Mirror config/crd/bases/ into charts/kagenti-operator/crds/.
+sync-chart-crds: ## Mirror config/crd/bases/ into charts/operator/crds/.
 	@for f in $$(ls config/crd/bases/*.yaml 2>/dev/null); do \
 		base=$$(basename $$f); \
 		case $$base in \
 			_.yaml) ;; \
-			*) cp $$f ../charts/kagenti-operator/crds/$$base ;; \
+			*) cp $$f ../charts/operator/crds/$$base ;; \
 		esac; \
 	done
 
@@ -188,10 +188,10 @@ docker-push: ## Push docker image with the manager.
 PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
-	- $(CONTAINER_TOOL) buildx create --name kagenti-operator-builder
-	$(CONTAINER_TOOL) buildx use kagenti-operator-builder
+	- $(CONTAINER_TOOL) buildx create --name rossoctl-operator-builder
+	$(CONTAINER_TOOL) buildx use rossoctl-operator-builder
 	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} .
-	- $(CONTAINER_TOOL) buildx rm kagenti-operator-builder
+	- $(CONTAINER_TOOL) buildx rm rossoctl-operator-builder
 
 .PHONY: manifests-openshift
 manifests-openshift: manifests kustomize ## Build OpenShift standalone kustomize overlay manifests.
@@ -203,7 +203,7 @@ build-installer: manifests generate kustomize ## Generate a consolidated YAML wi
 	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
 	$(KUSTOMIZE) build config/default > dist/install.yaml
 
-SIGNER_IMG ?= ghcr.io/kagenti/kagenti-operator/agentcard-signer:latest
+SIGNER_IMG ?= ghcr.io/rossoctl/operator/agentcard-signer:latest
 KIND_CLUSTER_NAME ?= $(CLUSTER)
 
 .PHONY: build-signer
@@ -249,8 +249,8 @@ undeploy-openshift: kustomize ## Undeploy controller with OpenShift extras. Call
 .PHONY: chart
 chart: manifests kustomize
 	cd config/manager && $(KUSTOMIZE) edit set image controller=$(shell echo ${IMG} | sed 's/\(:.*\)v/\1/')
-	$(KUSTOMIZE) build config/default > ../charts/kagenti-operator/templates/operator.yaml
-	$(KUSTOMIZE) build config/crd > ../charts/kagenti-operator/templates/crd/crds.yaml
+	$(KUSTOMIZE) build config/default > ../charts/operator/templates/operator.yaml
+	$(KUSTOMIZE) build config/crd > ../charts/operator/templates/crd/crds.yaml
 
 # this is used for local testing
 .PHONY: kind-load-image
@@ -259,7 +259,7 @@ kind-load-image:
 
 .PHONY: install-local-chart
 install-local-chart: kind-load-image
-	if [ -z "$(CONTEXT)" ] ; then helm upgrade --install --create-namespace -n kagenti-system kagenti-operator ../charts/kagenti-operator ${HELM_OPTS} ; else helm  --kube-context ${CONTEXT} upgrade --install --create-namespace -n kagenti-system kagenti-operator ../charts/kagenti-operator ${HELM_OPTS} ; fi
+	if [ -z "$(CONTEXT)" ] ; then helm upgrade --install --create-namespace -n rossoctl-system rossoctl-operator ../charts/operator ${HELM_OPTS} ; else helm  --kube-context ${CONTEXT} upgrade --install --create-namespace -n rossoctl-system rossoctl-operator ../charts/operator ${HELM_OPTS} ; fi
 ##@ Dependencies
 
 ## Location to install dependencies to
diff --git a/kagenti-operator/PROJECT b/operator/PROJECT
similarity index 68%
rename from kagenti-operator/PROJECT
rename to operator/PROJECT
index 35be1038..049504ff 100644
--- a/kagenti-operator/PROJECT
+++ b/operator/PROJECT
@@ -2,28 +2,28 @@
 # This file is used to track the info used to scaffold your project
 # and allow the plugins properly work.
 # More info: https://book.kubebuilder.io/reference/project-config.html
-domain: kagenti.dev
+domain: rossoctl.dev
 layout:
 - go.kubebuilder.io/v4
-projectName: kagenti-operator
-repo: github.com/kagenti/operator
+projectName: rossoctl-operator
+repo: github.com/rossoctl/operator
 resources:
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
-  domain: kagenti.dev
+  domain: rossoctl.dev
   group: agent
   kind: Agent
-  path: github.com/kagenti/operator/api/v1alpha1
+  path: github.com/rossoctl/operator/api/v1alpha1
   version: v1alpha1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
-  domain: kagenti.dev
+  domain: rossoctl.dev
   group: agent
   kind: AgentRuntime
-  path: github.com/kagenti/operator/api/v1alpha1
+  path: github.com/rossoctl/operator/api/v1alpha1
   version: v1alpha1
 version: "3"
diff --git a/kagenti-operator/api/v1alpha1/agentcard_types.go b/operator/api/v1alpha1/agentcard_types.go
similarity index 99%
rename from kagenti-operator/api/v1alpha1/agentcard_types.go
rename to operator/api/v1alpha1/agentcard_types.go
index 7324932c..76a0673a 100644
--- a/kagenti-operator/api/v1alpha1/agentcard_types.go
+++ b/operator/api/v1alpha1/agentcard_types.go
@@ -29,7 +29,7 @@ type AgentCardSpec struct {
 	SyncPeriod string `json:"syncPeriod,omitempty"`
 
 	// TargetRef identifies the workload backing this agent (duck typing).
-	// The workload must have the kagenti.io/type=agent label.
+	// The workload must have the rossoctl.io/type=agent label.
 	// +optional
 	TargetRef *TargetRef `json:"targetRef,omitempty"`
 
diff --git a/kagenti-operator/api/v1alpha1/agentcard_types_test.go b/operator/api/v1alpha1/agentcard_types_test.go
similarity index 100%
rename from kagenti-operator/api/v1alpha1/agentcard_types_test.go
rename to operator/api/v1alpha1/agentcard_types_test.go
diff --git a/kagenti-operator/api/v1alpha1/agentruntime_types.go b/operator/api/v1alpha1/agentruntime_types.go
similarity index 97%
rename from kagenti-operator/api/v1alpha1/agentruntime_types.go
rename to operator/api/v1alpha1/agentruntime_types.go
index 6bc99914..19593d06 100644
--- a/kagenti-operator/api/v1alpha1/agentruntime_types.go
+++ b/operator/api/v1alpha1/agentruntime_types.go
@@ -89,7 +89,7 @@ type AgentRuntimeSpec struct {
 	// MTLSMode selects the mTLS posture between authbridge sidecars on
 	// the proxy-sidecar / lite paths. envoy-sidecar handles transport
 	// security through Envoy SDS, which is currently not configured by
-	// the kagenti envoy-config — admission rejects mtlsMode != disabled
+	// the rossoctl envoy-config — admission rejects mtlsMode != disabled
 	// when authBridgeMode is envoy-sidecar (tracked as a follow-up).
 	//
 	// Three valid values:
@@ -210,9 +210,9 @@ type AgentRuntimeStatus struct {
 	// +optional
 	Card *CardStatus `json:"card,omitempty"`
 
-	// LinkedSkills lists skill names discovered from the kagenti.io/skills
+	// LinkedSkills lists skill names discovered from the rossoctl.io/skills
 	// annotation on the target workload. This annotation is set by the
-	// kagenti backend (PR #1440) or manually by the user. The operator
+	// rossoctl backend (PR #1440) or manually by the user. The operator
 	// reads but never sets this annotation.
 	// +optional
 	LinkedSkills []string `json:"linkedSkills,omitempty"`
diff --git a/kagenti-operator/api/v1alpha1/authorizationpolicy_conversion.go b/operator/api/v1alpha1/authorizationpolicy_conversion.go
similarity index 100%
rename from kagenti-operator/api/v1alpha1/authorizationpolicy_conversion.go
rename to operator/api/v1alpha1/authorizationpolicy_conversion.go
diff --git a/kagenti-operator/api/v1alpha1/authorizationpolicy_conversion_test.go b/operator/api/v1alpha1/authorizationpolicy_conversion_test.go
similarity index 95%
rename from kagenti-operator/api/v1alpha1/authorizationpolicy_conversion_test.go
rename to operator/api/v1alpha1/authorizationpolicy_conversion_test.go
index 37cf7398..6ba60a80 100644
--- a/kagenti-operator/api/v1alpha1/authorizationpolicy_conversion_test.go
+++ b/operator/api/v1alpha1/authorizationpolicy_conversion_test.go
@@ -26,7 +26,7 @@ import (
 func TestAuthorizationPolicyFromUnstructured(t *testing.T) {
 	obj := &unstructured.Unstructured{
 		Object: map[string]any{
-			"apiVersion": "agent.kagenti.dev/v1alpha1",
+			"apiVersion": "agent.rossoctl.dev/v1alpha1",
 			"kind":       "AuthorizationPolicy",
 			"metadata": map[string]any{
 				"name":      "test-client",
@@ -63,11 +63,11 @@ func TestAuthorizationPolicyFromUnstructured(t *testing.T) {
 func TestAuthorizationPolicyFromUnstructured_Global(t *testing.T) {
 	obj := &unstructured.Unstructured{
 		Object: map[string]any{
-			"apiVersion": "agent.kagenti.dev/v1alpha1",
+			"apiVersion": "agent.rossoctl.dev/v1alpha1",
 			"kind":       "AuthorizationPolicy",
 			"metadata": map[string]any{
 				"name":      "global-policy",
-				"namespace": "kagenti-system",
+				"namespace": "rossoctl-system",
 			},
 			"spec": map[string]any{
 				"scope": "global",
@@ -96,7 +96,7 @@ func TestAuthorizationPolicyFromUnstructured_Global(t *testing.T) {
 func TestAuthorizationPolicyRoundTrip(t *testing.T) {
 	original := &AuthorizationPolicy{
 		TypeMeta: metav1.TypeMeta{
-			APIVersion: "agent.kagenti.dev/v1alpha1",
+			APIVersion: "agent.rossoctl.dev/v1alpha1",
 			Kind:       "AuthorizationPolicy",
 		},
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/kagenti-operator/api/v1alpha1/authorizationpolicy_types.go b/operator/api/v1alpha1/authorizationpolicy_types.go
similarity index 100%
rename from kagenti-operator/api/v1alpha1/authorizationpolicy_types.go
rename to operator/api/v1alpha1/authorizationpolicy_types.go
diff --git a/kagenti-operator/api/v1alpha1/groupversion_info.go b/operator/api/v1alpha1/groupversion_info.go
similarity index 90%
rename from kagenti-operator/api/v1alpha1/groupversion_info.go
rename to operator/api/v1alpha1/groupversion_info.go
index cb64bee4..e05da999 100644
--- a/kagenti-operator/api/v1alpha1/groupversion_info.go
+++ b/operator/api/v1alpha1/groupversion_info.go
@@ -16,7 +16,7 @@ limitations under the License.
 
 // Package v1alpha1 contains API Schema definitions for the agent v1alpha1 API group.
 // +kubebuilder:object:generate=true
-// +groupName=agent.kagenti.dev
+// +groupName=agent.rossoctl.dev
 package v1alpha1
 
 import (
@@ -26,7 +26,7 @@ import (
 
 var (
 	// GroupVersion is group version used to register these objects.
-	GroupVersion = schema.GroupVersion{Group: "agent.kagenti.dev", Version: "v1alpha1"}
+	GroupVersion = schema.GroupVersion{Group: "agent.rossoctl.dev", Version: "v1alpha1"}
 
 	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
 	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
diff --git a/kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go b/operator/api/v1alpha1/zz_generated.deepcopy.go
similarity index 100%
rename from kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go
rename to operator/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/kagenti-operator/cmd/agentcard-signer/Dockerfile b/operator/cmd/agentcard-signer/Dockerfile
similarity index 100%
rename from kagenti-operator/cmd/agentcard-signer/Dockerfile
rename to operator/cmd/agentcard-signer/Dockerfile
diff --git a/kagenti-operator/cmd/agentcard-signer/main.go b/operator/cmd/agentcard-signer/main.go
similarity index 97%
rename from kagenti-operator/cmd/agentcard-signer/main.go
rename to operator/cmd/agentcard-signer/main.go
index f2522af6..b0f6e261 100644
--- a/kagenti-operator/cmd/agentcard-signer/main.go
+++ b/operator/cmd/agentcard-signer/main.go
@@ -33,9 +33,9 @@ import (
 	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
 	"github.com/spiffe/go-spiffe/v2/workloadapi"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/signature"
 )
 
 const (
diff --git a/kagenti-operator/cmd/agentcard-signer/main_test.go b/operator/cmd/agentcard-signer/main_test.go
similarity index 99%
rename from kagenti-operator/cmd/agentcard-signer/main_test.go
rename to operator/cmd/agentcard-signer/main_test.go
index e2ff3354..bd94513c 100644
--- a/kagenti-operator/cmd/agentcard-signer/main_test.go
+++ b/operator/cmd/agentcard-signer/main_test.go
@@ -36,8 +36,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	k8sfake "k8s.io/client-go/kubernetes/fake"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/signature"
 )
 
 // --- Test CA helpers (mirrors x5c_test.go pattern) ---
diff --git a/kagenti-operator/cmd/bundle-service/ARCHITECTURE.md b/operator/cmd/bundle-service/ARCHITECTURE.md
similarity index 93%
rename from kagenti-operator/cmd/bundle-service/ARCHITECTURE.md
rename to operator/cmd/bundle-service/ARCHITECTURE.md
index b750d327..3459bc8a 100644
--- a/kagenti-operator/cmd/bundle-service/ARCHITECTURE.md
+++ b/operator/cmd/bundle-service/ARCHITECTURE.md
@@ -1,6 +1,6 @@
 # Bundle Service Architecture
 
-This document describes the architecture of the Kagenti bundle service and its HTTP API contract.
+This document describes the architecture of the Rossoctl bundle service and its HTTP API contract.
 
 ## Overview
 
@@ -29,7 +29,7 @@ The `Verifier` interface in `internal/bundleservice/identity/` is the extension
 
 The service collects policies from `AuthorizationPolicy` CRs and packages them into the bundle payload.
 
-- **Global policies** — `scope: global`, must reside in the service namespace (`kagenti-system`). These declare the OPA query entry-point packages (e.g., `package authbridge.inbound.request`) and contain the decision logic that combines namespace and client tiers.
+- **Global policies** — `scope: global`, must reside in the service namespace (`rossoctl-system`). These declare the OPA query entry-point packages (e.g., `package authbridge.inbound.request`) and contain the decision logic that combines namespace and client tiers.
 - **Namespace policies** — `scope: namespace`, scoped to the namespace from the client's SPIFFE ID.
 - **Client policies** — `scope: client`, scoped to the CR whose name and namespace match the SPIFFE ID.
 
@@ -134,14 +134,14 @@ Response headers for `200 OK`:
 Example request:
 
 ```bash
-curl -v 'http://bundle-service.kagenti-system.svc.cluster.local:8080/bundles?spiffe=localtest.me/ns/default/sa/my-agent'
+curl -v 'http://bundle-service.rossoctl-system.svc.cluster.local:8080/bundles?spiffe=localtest.me/ns/default/sa/my-agent'
 ```
 
 ETag example:
 
 ```bash
 curl -v -H 'If-None-Match: "sha256:abc123..."' \
-  'http://bundle-service.kagenti-system.svc.cluster.local:8080/bundles?spiffe=localtest.me/ns/default/sa/my-agent'
+  'http://bundle-service.rossoctl-system.svc.cluster.local:8080/bundles?spiffe=localtest.me/ns/default/sa/my-agent'
 ```
 
 ### GET /healthz
diff --git a/kagenti-operator/cmd/bundle-service/Dockerfile b/operator/cmd/bundle-service/Dockerfile
similarity index 100%
rename from kagenti-operator/cmd/bundle-service/Dockerfile
rename to operator/cmd/bundle-service/Dockerfile
diff --git a/kagenti-operator/cmd/bundle-service/README.md b/operator/cmd/bundle-service/README.md
similarity index 87%
rename from kagenti-operator/cmd/bundle-service/README.md
rename to operator/cmd/bundle-service/README.md
index bf5dd9ed..7b441847 100644
--- a/kagenti-operator/cmd/bundle-service/README.md
+++ b/operator/cmd/bundle-service/README.md
@@ -1,6 +1,6 @@
 # Bundle Service
 
-This package contains the Kagenti bundle-service binary and SRE-facing operational guidance for running the service in Kubernetes.
+This package contains the Rossoctl bundle-service binary and SRE-facing operational guidance for running the service in Kubernetes.
 
 ## Purpose
 
@@ -12,14 +12,14 @@ The bundle service serves OPA authorization bundles to AuthBridge clients over H
 
 ```bash
 ./hack/bundle-service-kind.sh [cluster-name] [namespace]
-# Defaults: cluster=kagenti, namespace=kagenti-system
+# Defaults: cluster=rossoctl, namespace=rossoctl-system
 ```
 
 This script builds the image, loads it into kind, installs the CRD, applies the default global policy CR, and deploys the service.
 
 ### Production manifests
 
-Deploy using the manifests in `kagenti-operator/config/bundleservice/`:
+Deploy using the manifests in `operator/config/bundleservice/`:
 
 - `deployment.yaml`
 - `service.yaml`
@@ -30,7 +30,7 @@ Deploy using the manifests in `kagenti-operator/config/bundleservice/`:
 
 Default deployment settings:
 
-- Namespace: `kagenti-system`
+- Namespace: `rossoctl-system`
 - Deployment name: `bundle-service`
 - Service name: `bundle-service`
 - Port: `8080`
@@ -40,7 +40,7 @@ Default deployment settings:
 The `AuthorizationPolicy` CRD must be installed before deploying:
 
 ```bash
-kubectl apply -f config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml
+kubectl apply -f config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml
 ```
 
 The default global policy CR must be applied for the service to produce valid bundles:
@@ -129,9 +129,9 @@ Monitor:
 
 ## Related resources
 
-- `kagenti-operator/config/bundleservice/` — deployment manifests and default policy
-- `kagenti-operator/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml` — CRD definition
-- `kagenti-operator/internal/bundleservice/` — service implementation
+- `operator/config/bundleservice/` — deployment manifests and default policy
+- `operator/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml` — CRD definition
+- `operator/internal/bundleservice/` — service implementation
 
 ## Architecture and API details
 
diff --git a/kagenti-operator/cmd/bundle-service/main.go b/operator/cmd/bundle-service/main.go
similarity index 91%
rename from kagenti-operator/cmd/bundle-service/main.go
rename to operator/cmd/bundle-service/main.go
index 2d47a9a8..27477633 100644
--- a/kagenti-operator/cmd/bundle-service/main.go
+++ b/operator/cmd/bundle-service/main.go
@@ -31,11 +31,11 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/client-go/util/homedir"
 
-	"github.com/kagenti/operator/internal/bundleservice/cache"
-	"github.com/kagenti/operator/internal/bundleservice/handler"
-	"github.com/kagenti/operator/internal/bundleservice/identity"
-	"github.com/kagenti/operator/internal/bundleservice/provider"
-	"github.com/kagenti/operator/internal/bundleservice/watcher"
+	"github.com/rossoctl/operator/internal/bundleservice/cache"
+	"github.com/rossoctl/operator/internal/bundleservice/handler"
+	"github.com/rossoctl/operator/internal/bundleservice/identity"
+	"github.com/rossoctl/operator/internal/bundleservice/provider"
+	"github.com/rossoctl/operator/internal/bundleservice/watcher"
 )
 
 const version = "0.3.1"
@@ -152,5 +152,5 @@ func detectNamespace() string {
 	if ns, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace"); err == nil {
 		return string(ns)
 	}
-	return "kagenti-system"
+	return "rossoctl-system"
 }
diff --git a/kagenti-operator/cmd/configmap_cache_test.go b/operator/cmd/configmap_cache_test.go
similarity index 97%
rename from kagenti-operator/cmd/configmap_cache_test.go
rename to operator/cmd/configmap_cache_test.go
index c470f126..e725fa5a 100644
--- a/kagenti-operator/cmd/configmap_cache_test.go
+++ b/operator/cmd/configmap_cache_test.go
@@ -37,7 +37,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
-	"github.com/kagenti/operator/internal/controller"
+	"github.com/rossoctl/operator/internal/controller"
 )
 
 func TestConfigMapCacheVisibility(t *testing.T) {
@@ -120,7 +120,7 @@ func TestConfigMapCacheVisibility(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      controller.ClusterDefaultsConfigMapName,
 			Namespace: controller.ClusterDefaultsNamespace,
-			Labels:    map[string]string{"app.kubernetes.io/name": "kagenti-operator-chart"},
+			Labels:    map[string]string{"app.kubernetes.io/name": "operator-chart"},
 		},
 		Data: map[string]string{"otel-endpoint": "collector:4317"},
 	}
diff --git a/kagenti-operator/cmd/main.go b/operator/cmd/main.go
similarity index 95%
rename from kagenti-operator/cmd/main.go
rename to operator/cmd/main.go
index 1be8a4eb..ffa8629f 100644
--- a/kagenti-operator/cmd/main.go
+++ b/operator/cmd/main.go
@@ -47,19 +47,19 @@ import (
 	cmv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 	"github.com/spiffe/go-spiffe/v2/workloadapi"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/bootstrap"
-	"github.com/kagenti/operator/internal/controller"
-	"github.com/kagenti/operator/internal/discovery"
-	"github.com/kagenti/operator/internal/keycloak"
-	"github.com/kagenti/operator/internal/kuadrant"
-	"github.com/kagenti/operator/internal/mlflow"
-	"github.com/kagenti/operator/internal/signature"
-	"github.com/kagenti/operator/internal/tekton"
-	webhookconfig "github.com/kagenti/operator/internal/webhook/config"
-	"github.com/kagenti/operator/internal/webhook/injector"
-	webhookv1alpha1 "github.com/kagenti/operator/internal/webhook/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/bootstrap"
+	"github.com/rossoctl/operator/internal/controller"
+	"github.com/rossoctl/operator/internal/discovery"
+	"github.com/rossoctl/operator/internal/keycloak"
+	"github.com/rossoctl/operator/internal/kuadrant"
+	"github.com/rossoctl/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/signature"
+	"github.com/rossoctl/operator/internal/tekton"
+	webhookconfig "github.com/rossoctl/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/injector"
+	webhookv1alpha1 "github.com/rossoctl/operator/internal/webhook/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -86,8 +86,8 @@ func getOperatorNamespace() string {
 	if ns := os.Getenv("POD_NAMESPACE"); ns != "" {
 		return ns
 	}
-	setupLog.Info("POD_NAMESPACE not set, using default", "default", "kagenti-system")
-	return "kagenti-system"
+	setupLog.Info("POD_NAMESPACE not set, using default", "default", "rossoctl-system")
+	return "rossoctl-system"
 }
 
 // nolint:gocyclo
@@ -157,9 +157,9 @@ func main() {
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
 	flag.BoolVar(&enableClientRegistration, "enable-client-registration", true,
 		"Enable operator-managed Keycloak client registration for agent/tool workloads")
-	flag.StringVar(&configPath, "config-path", "/etc/kagenti/config.yaml", "Path to platform config file")
+	flag.StringVar(&configPath, "config-path", "/etc/rossoctl/config.yaml", "Path to platform config file")
 	flag.StringVar(&featureGatesPath, "feature-gates-path",
-		"/etc/kagenti/feature-gates/feature-gates.yaml", "Path to feature gates config file")
+		"/etc/rossoctl/feature-gates/feature-gates.yaml", "Path to feature gates config file")
 	flag.BoolVar(&requireA2ASignature, "require-a2a-signature", false,
 		"Require A2A agent cards to have a valid signature")
 	flag.BoolVar(&signatureAuditMode, "signature-audit-mode", false,
@@ -172,7 +172,7 @@ func main() {
 		"Enable OTel collector bootstrap (ingress CA trust and ConfigMap assembly) at startup")
 	flag.StringVar(&mlflowWorkspace, "mlflow-workspace", "",
 		"Kubernetes namespace used as the x-mlflow-workspace header value (RHOAI only)")
-	flag.StringVar(&mlflowExperimentName, "mlflow-experiment-name", "kagenti-traces",
+	flag.StringVar(&mlflowExperimentName, "mlflow-experiment-name", "rossoctl-traces",
 		"MLflow experiment name; created automatically if it doesn't exist")
 	flag.StringVar(&mlflowCAFile, "mlflow-ca-file", "",
 		"Path to PEM-encoded CA bundle for MLflow TLS verification (appended to system pool)")
@@ -200,7 +200,7 @@ func main() {
 
 	flag.StringVar(&keycloakAdminSecretNamespace, "keycloak-admin-secret-namespace", "keycloak",
 		"Namespace where keycloak-initial-admin secret is located")
-	flag.StringVar(&keycloakRealm, "keycloak-realm", "kagenti",
+	flag.StringVar(&keycloakRealm, "keycloak-realm", "rossoctl",
 		"Keycloak realm for agent client registration and identity")
 	flag.StringVar(&clientAuthType, "client-auth-type", "client-secret",
 		"Default client authentication type: client-secret or federated-jwt")
@@ -209,7 +209,7 @@ func main() {
 	flag.StringVar(&credentialWaitTimeout, "credential-wait-timeout", "120s",
 		"How long AuthBridge waits for Keycloak credentials to become available")
 	flag.BoolVar(&enableAuthbridgeConfig, "enable-authbridge-config", true,
-		"Reconcile authbridge-config ConfigMap in namespaces labeled kagenti-enabled=true")
+		"Reconcile authbridge-config ConfigMap in namespaces labeled rossoctl-enabled=true")
 	flag.BoolVar(&useSpiffeAuth, "use-spiffe-auth", false,
 		"Use JWT-SVID authentication for Keycloak client registration instead of admin credentials")
 	flag.StringVar(&jwtSVIDPath, "jwt-svid-path", "/opt/jwt_svid.token",
@@ -402,7 +402,7 @@ func main() {
 		WebhookServer:          webhookServer,
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
-		LeaderElectionID:       "b7c4ae34.kagenti.dev",
+		LeaderElectionID:       "b7c4ae34.rossoctl.dev",
 	})
 	if err != nil {
 		setupLog.Error(err, "unable to start manager")
@@ -414,7 +414,7 @@ func main() {
 	// Env vars override auto-discovery.
 	// ========================================
 	if keycloakPublicURL == "" {
-		keycloakPublicURL = os.Getenv("KAGENTI_KEYCLOAK_PUBLIC_URL")
+		keycloakPublicURL = os.Getenv("ROSSOCTL_KEYCLOAK_PUBLIC_URL")
 	}
 	if keycloakPublicURL == "" {
 		discovered, err := discovery.DiscoverKeycloakPublicURL(ctx, mgr.GetAPIReader(), keycloakAdminSecretNamespace)
@@ -427,10 +427,10 @@ func main() {
 	}
 
 	if spireTrustDomain == "" {
-		spireTrustDomain = os.Getenv("KAGENTI_SPIRE_TRUST_DOMAIN")
+		spireTrustDomain = os.Getenv("ROSSOCTL_SPIRE_TRUST_DOMAIN")
 	}
 	if spireTrustDomain == "" {
-		spireNS := os.Getenv("KAGENTI_SPIRE_NAMESPACE")
+		spireNS := os.Getenv("ROSSOCTL_SPIRE_NAMESPACE")
 		discovered, err := discovery.DiscoverSPIRETrustDomain(ctx, mgr.GetAPIReader(), spireNS)
 		if err != nil {
 			setupLog.Info("SPIRE trust domain auto-discovery failed (will retry at reconcile time)", "error", err.Error())
@@ -451,7 +451,7 @@ func main() {
 		if spireTrustDomain == "" {
 			setupLog.Error(errors.New("SPIRE trust domain not available"),
 				"spireTrustDomain is required when --require-a2a-signature=true "+
-					"(set KAGENTI_SPIRE_TRUST_DOMAIN or ensure ZTWIM/spire-bundle is accessible)")
+					"(set ROSSOCTL_SPIRE_TRUST_DOMAIN or ensure ZTWIM/spire-bundle is accessible)")
 			os.Exit(1)
 		}
 		if spireTrustBundleConfigMapName == "" || spireTrustBundleConfigMapNS == "" {
@@ -504,7 +504,7 @@ func main() {
 			if td == "" {
 				setupLog.Error(errors.New("SPIRE trust domain not available"),
 					"spireTrustDomain is required when --enable-verified-fetch=true "+
-						"(set KAGENTI_SPIRE_TRUST_DOMAIN or ensure ZTWIM/spire-bundle is accessible)")
+						"(set ROSSOCTL_SPIRE_TRUST_DOMAIN or ensure ZTWIM/spire-bundle is accessible)")
 				os.Exit(1)
 			}
 			fetcher, fetcherErr := agentcard.NewSpiffeFetcher(fetchX509Source, td)
@@ -767,7 +767,7 @@ func main() {
 			setupLog.Info("ZTWIM CRDs present but SPIRE trust domain not available; " +
 				"SPIRE operand controller will not start until trust domain is discoverable")
 		} else {
-			spireClusterName := os.Getenv("KAGENTI_SPIRE_CLUSTER_NAME")
+			spireClusterName := os.Getenv("ROSSOCTL_SPIRE_CLUSTER_NAME")
 			if err := mgr.Add(&controller.SpireBootstrapRunnable{
 				Client:      mgr.GetClient(),
 				TrustDomain: spireTrustDomain,
@@ -931,11 +931,11 @@ func getNamespacesToWatch() map[string]cache.Config {
 }
 
 // buildConfigMapCacheNamespaces returns the per-namespace cache selectors for
-// ConfigMaps. The scoped cache ensures only kagenti-relevant ConfigMaps are
+// ConfigMaps. The scoped cache ensures only rossoctl-relevant ConfigMaps are
 // watched instead of every ConfigMap cluster-wide.
 //
 // Three categories are included:
-//  1. Cluster-level defaults in kagenti-system (label selector).
+//  1. Cluster-level defaults in rossoctl-system (label selector).
 //  2. Namespace-level defaults in any namespace (label selector).
 //  3. SPIRE trust bundle (field selector on metadata.name), added only when
 //     signature verification is enabled.
@@ -946,7 +946,7 @@ func buildConfigMapCacheNamespaces(
 	namespaces := map[string]cache.Config{
 		controller.ClusterDefaultsNamespace: {
 			LabelSelector: labels.SelectorFromSet(map[string]string{
-				"app.kubernetes.io/name": "kagenti-operator-chart",
+				"app.kubernetes.io/name": "operator-chart",
 			}),
 		},
 		cache.AllNamespaces: {
diff --git a/kagenti-operator/cmd/main_test.go b/operator/cmd/main_test.go
similarity index 98%
rename from kagenti-operator/cmd/main_test.go
rename to operator/cmd/main_test.go
index 8ae28a2d..b9a498e8 100644
--- a/kagenti-operator/cmd/main_test.go
+++ b/operator/cmd/main_test.go
@@ -23,7 +23,7 @@ import (
 
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 
-	"github.com/kagenti/operator/internal/controller"
+	"github.com/rossoctl/operator/internal/controller"
 )
 
 func TestAuthBridgeWebhooksEnabled(t *testing.T) {
diff --git a/kagenti-operator/cmd/test-tls-agent/Dockerfile b/operator/cmd/test-tls-agent/Dockerfile
similarity index 100%
rename from kagenti-operator/cmd/test-tls-agent/Dockerfile
rename to operator/cmd/test-tls-agent/Dockerfile
diff --git a/kagenti-operator/cmd/test-tls-agent/main.go b/operator/cmd/test-tls-agent/main.go
similarity index 100%
rename from kagenti-operator/cmd/test-tls-agent/main.go
rename to operator/cmd/test-tls-agent/main.go
diff --git a/kagenti-operator/config/authbridge/authbridge-runtime-config.yaml b/operator/config/authbridge/authbridge-runtime-config.yaml
similarity index 82%
rename from kagenti-operator/config/authbridge/authbridge-runtime-config.yaml
rename to operator/config/authbridge/authbridge-runtime-config.yaml
index 9ac68502..a0e8bb55 100644
--- a/kagenti-operator/config/authbridge/authbridge-runtime-config.yaml
+++ b/operator/config/authbridge/authbridge-runtime-config.yaml
@@ -4,9 +4,9 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: authbridge-runtime-config
-  namespace: kagenti-operator-system
+  namespace: rossoctl-operator-system
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: authbridge
     app.kubernetes.io/managed-by: kustomize
 data:
@@ -17,15 +17,15 @@ data:
         plugins:
           - name: jwt-validation
             config:
-              issuer: "http://keycloak.localtest.me:8080/realms/kagenti"
+              issuer: "http://keycloak.localtest.me:8080/realms/rossoctl"
               keycloak_url: "http://keycloak-service.keycloak.svc:8080"
-              keycloak_realm: "kagenti"
+              keycloak_realm: "rossoctl"
       outbound:
         plugins:
           - name: token-exchange
             config:
               keycloak_url: "http://keycloak-service.keycloak.svc:8080"
-              keycloak_realm: "kagenti"
+              keycloak_realm: "rossoctl"
               default_policy: "passthrough"
               identity:
                 type: "client-secret"
diff --git a/kagenti-operator/config/authbridge/kustomization.yaml b/operator/config/authbridge/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/authbridge/kustomization.yaml
rename to operator/config/authbridge/kustomization.yaml
diff --git a/kagenti-operator/config/bundleservice/default-policy.yaml b/operator/config/bundleservice/default-policy.yaml
similarity index 96%
rename from kagenti-operator/config/bundleservice/default-policy.yaml
rename to operator/config/bundleservice/default-policy.yaml
index ace9fc9b..0d7ae8f8 100644
--- a/kagenti-operator/config/bundleservice/default-policy.yaml
+++ b/operator/config/bundleservice/default-policy.yaml
@@ -1,8 +1,8 @@
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AuthorizationPolicy
 metadata:
   name: default
-  namespace: kagenti-system
+  namespace: rossoctl-system
 spec:
   scope: global
   policies:
diff --git a/kagenti-operator/config/bundleservice/deployment.yaml b/operator/config/bundleservice/deployment.yaml
similarity index 96%
rename from kagenti-operator/config/bundleservice/deployment.yaml
rename to operator/config/bundleservice/deployment.yaml
index 0dd0c77d..0d4a05dc 100644
--- a/kagenti-operator/config/bundleservice/deployment.yaml
+++ b/operator/config/bundleservice/deployment.yaml
@@ -20,7 +20,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: bundle-service
-          image: ghcr.io/kagenti/bundle-service:latest
+          image: ghcr.io/rossoctl/bundle-service:latest
           ports:
             - name: http
               containerPort: 8080
diff --git a/kagenti-operator/config/bundleservice/networkpolicy.yaml b/operator/config/bundleservice/networkpolicy.yaml
similarity index 95%
rename from kagenti-operator/config/bundleservice/networkpolicy.yaml
rename to operator/config/bundleservice/networkpolicy.yaml
index f3bd4a31..72cb7390 100644
--- a/kagenti-operator/config/bundleservice/networkpolicy.yaml
+++ b/operator/config/bundleservice/networkpolicy.yaml
@@ -15,7 +15,7 @@ spec:
     - from:
         - podSelector:
             matchLabels:
-              kagenti.dev/authbridge: "true"
+              rossoctl.dev/authbridge: "true"
           namespaceSelector: {}
       ports:
         - protocol: TCP
diff --git a/kagenti-operator/config/bundleservice/rbac.yaml b/operator/config/bundleservice/rbac.yaml
similarity index 78%
rename from kagenti-operator/config/bundleservice/rbac.yaml
rename to operator/config/bundleservice/rbac.yaml
index 3420dde1..e2aaf8c3 100644
--- a/kagenti-operator/config/bundleservice/rbac.yaml
+++ b/operator/config/bundleservice/rbac.yaml
@@ -1,10 +1,10 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 rules:
   - apiGroups:
-      - agent.kagenti.dev
+      - agent.rossoctl.dev
     resources:
       - authorizationpolicies
     verbs:
@@ -12,7 +12,7 @@ rules:
       - list
       - watch
   - apiGroups:
-      - agent.kagenti.dev
+      - agent.rossoctl.dev
     resources:
       - authorizationpolicies/status
     verbs:
@@ -23,11 +23,11 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 subjects:
   - kind: ServiceAccount
     name: bundle-service
diff --git a/kagenti-operator/config/bundleservice/service.yaml b/operator/config/bundleservice/service.yaml
similarity index 100%
rename from kagenti-operator/config/bundleservice/service.yaml
rename to operator/config/bundleservice/service.yaml
diff --git a/kagenti-operator/config/bundleservice/serviceaccount.yaml b/operator/config/bundleservice/serviceaccount.yaml
similarity index 100%
rename from kagenti-operator/config/bundleservice/serviceaccount.yaml
rename to operator/config/bundleservice/serviceaccount.yaml
diff --git a/kagenti-operator/config/certmanager/certificate.yaml b/operator/config/certmanager/certificate.yaml
similarity index 83%
rename from kagenti-operator/config/certmanager/certificate.yaml
rename to operator/config/certmanager/certificate.yaml
index 126be533..f55a32b1 100644
--- a/kagenti-operator/config/certmanager/certificate.yaml
+++ b/operator/config/certmanager/certificate.yaml
@@ -8,8 +8,8 @@ metadata:
     app.kubernetes.io/name: certificate
     app.kubernetes.io/instance: serving-cert
     app.kubernetes.io/component: certificate
-    app.kubernetes.io/created-by: kagenti-operator
-    app.kubernetes.io/part-of: kagenti-operator
+    app.kubernetes.io/created-by: rossoctl-operator
+    app.kubernetes.io/part-of: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: selfsigned-issuer
   namespace: system
@@ -23,8 +23,8 @@ metadata:
     app.kubernetes.io/name: certificate
     app.kubernetes.io/instance: serving-cert
     app.kubernetes.io/component: certificate
-    app.kubernetes.io/created-by: kagenti-operator
-    app.kubernetes.io/part-of: kagenti-operator
+    app.kubernetes.io/created-by: rossoctl-operator
+    app.kubernetes.io/part-of: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: serving-cert  # this name should match the one appeared in kustomizeconfig.yaml
   namespace: system
@@ -35,5 +35,5 @@ spec:
   - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
   issuerRef:
     kind: Issuer
-    name: kagenti-operator-selfsigned-issuer
+    name: rossoctl-operator-selfsigned-issuer
   secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize
diff --git a/kagenti-operator/config/certmanager/kustomization.yaml b/operator/config/certmanager/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/certmanager/kustomization.yaml
rename to operator/config/certmanager/kustomization.yaml
diff --git a/kagenti-operator/config/certmanager/kustomizeconfig.yaml b/operator/config/certmanager/kustomizeconfig.yaml
similarity index 100%
rename from kagenti-operator/config/certmanager/kustomizeconfig.yaml
rename to operator/config/certmanager/kustomizeconfig.yaml
diff --git a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml b/operator/config/crd/bases/agent.rossoctl.dev_agentcards.yaml
similarity index 99%
rename from kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml
rename to operator/config/crd/bases/agent.rossoctl.dev_agentcards.yaml
index 593610f5..7dca3338 100644
--- a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml
+++ b/operator/config/crd/bases/agent.rossoctl.dev_agentcards.yaml
@@ -4,9 +4,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.1
-  name: agentcards.agent.kagenti.dev
+  name: agentcards.agent.rossoctl.dev
 spec:
-  group: agent.kagenti.dev
+  group: agent.rossoctl.dev
   names:
     kind: AgentCard
     listKind: AgentCardList
@@ -132,7 +132,7 @@ spec:
               targetRef:
                 description: |-
                   TargetRef identifies the workload backing this agent (duck typing).
-                  The workload must have the kagenti.io/type=agent label.
+                  The workload must have the rossoctl.io/type=agent label.
                 properties:
                   apiVersion:
                     description: APIVersion is the API version of the target resource
diff --git a/charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml b/operator/config/crd/bases/agent.rossoctl.dev_agentruntimes.yaml
similarity index 98%
rename from charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml
rename to operator/config/crd/bases/agent.rossoctl.dev_agentruntimes.yaml
index 7fa69a3e..42a0cf1c 100644
--- a/charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml
+++ b/operator/config/crd/bases/agent.rossoctl.dev_agentruntimes.yaml
@@ -4,9 +4,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.1
-  name: agentruntimes.agent.kagenti.dev
+  name: agentruntimes.agent.rossoctl.dev
 spec:
-  group: agent.kagenti.dev
+  group: agent.rossoctl.dev
   names:
     kind: AgentRuntime
     listKind: AgentRuntimeList
@@ -125,7 +125,7 @@ spec:
                   MTLSMode selects the mTLS posture between authbridge sidecars on
                   the proxy-sidecar / lite paths. envoy-sidecar handles transport
                   security through Envoy SDS, which is currently not configured by
-                  the kagenti envoy-config — admission rejects mtlsMode != disabled
+                  the rossoctl envoy-config — admission rejects mtlsMode != disabled
                   when authBridgeMode is envoy-sidecar (tracked as a follow-up).
 
                   Three valid values:
@@ -487,9 +487,9 @@ spec:
                 type: integer
               linkedSkills:
                 description: |-
-                  LinkedSkills lists skill names discovered from the kagenti.io/skills
+                  LinkedSkills lists skill names discovered from the rossoctl.io/skills
                   annotation on the target workload. This annotation is set by the
-                  kagenti backend (PR #1440) or manually by the user. The operator
+                  rossoctl backend (PR #1440) or manually by the user. The operator
                   reads but never sets this annotation.
                 items:
                   type: string
diff --git a/charts/kagenti-operator/crds/agent.kagenti.dev_authorizationpolicies.yaml b/operator/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml
similarity index 98%
rename from charts/kagenti-operator/crds/agent.kagenti.dev_authorizationpolicies.yaml
rename to operator/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml
index ec1ab44a..94b78c61 100644
--- a/charts/kagenti-operator/crds/agent.kagenti.dev_authorizationpolicies.yaml
+++ b/operator/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml
@@ -4,9 +4,9 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.1
-  name: authorizationpolicies.agent.kagenti.dev
+  name: authorizationpolicies.agent.rossoctl.dev
 spec:
-  group: agent.kagenti.dev
+  group: agent.rossoctl.dev
   names:
     kind: AuthorizationPolicy
     listKind: AuthorizationPolicyList
diff --git a/kagenti-operator/config/crd/kustomization.yaml b/operator/config/crd/kustomization.yaml
similarity index 87%
rename from kagenti-operator/config/crd/kustomization.yaml
rename to operator/config/crd/kustomization.yaml
index b484987d..88985dcc 100644
--- a/kagenti-operator/config/crd/kustomization.yaml
+++ b/operator/config/crd/kustomization.yaml
@@ -2,8 +2,8 @@
 # since it depends on service name and namespace that are out of this kustomize package.
 # It should be run by config/default
 resources:
-- bases/agent.kagenti.dev_agentcards.yaml
-- bases/agent.kagenti.dev_agentruntimes.yaml
+- bases/agent.rossoctl.dev_agentcards.yaml
+- bases/agent.rossoctl.dev_agentruntimes.yaml
 
 # +kubebuilder:scaffold:crdkustomizeresource
 
diff --git a/kagenti-operator/config/crd/kustomizeconfig.yaml b/operator/config/crd/kustomizeconfig.yaml
similarity index 100%
rename from kagenti-operator/config/crd/kustomizeconfig.yaml
rename to operator/config/crd/kustomizeconfig.yaml
diff --git a/kagenti-operator/config/default/cert_metrics_manager_patch.yaml b/operator/config/default/cert_metrics_manager_patch.yaml
similarity index 100%
rename from kagenti-operator/config/default/cert_metrics_manager_patch.yaml
rename to operator/config/default/cert_metrics_manager_patch.yaml
diff --git a/kagenti-operator/config/default/kustomization.yaml b/operator/config/default/kustomization.yaml
similarity index 98%
rename from kagenti-operator/config/default/kustomization.yaml
rename to operator/config/default/kustomization.yaml
index fed8ffe5..412249ae 100644
--- a/kagenti-operator/config/default/kustomization.yaml
+++ b/operator/config/default/kustomization.yaml
@@ -1,12 +1,12 @@
 # Adds namespace to all resources.
-namespace: kagenti-operator-system
+namespace: rossoctl-operator-system
 
 # Value of this field is prepended to the
 # names of all resources, e.g. a deployment named
 # "wordpress" becomes "alices-wordpress".
 # Note that it should also match with the prefix (text before '-') of the namespace
 # field above.
-namePrefix: kagenti-operator-
+namePrefix: rossoctl-operator-
 
 # Labels to add to all resources and selectors.
 #labels:
@@ -23,7 +23,7 @@ resources:
 - ../webhook
 # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
 - ../certmanager
-# [VAP] ValidatingAdmissionPolicy that prevents manual application of kagenti.io/type labels.
+# [VAP] ValidatingAdmissionPolicy that prevents manual application of rossoctl.io/type labels.
 - ../vap
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 #- ../prometheus
diff --git a/kagenti-operator/config/default/manager_metrics_patch.yaml b/operator/config/default/manager_metrics_patch.yaml
similarity index 100%
rename from kagenti-operator/config/default/manager_metrics_patch.yaml
rename to operator/config/default/manager_metrics_patch.yaml
diff --git a/kagenti-operator/config/default/manager_webhook_patch.yaml b/operator/config/default/manager_webhook_patch.yaml
similarity index 100%
rename from kagenti-operator/config/default/manager_webhook_patch.yaml
rename to operator/config/default/manager_webhook_patch.yaml
diff --git a/kagenti-operator/config/default/metrics_service.yaml b/operator/config/default/metrics_service.yaml
similarity index 78%
rename from kagenti-operator/config/default/metrics_service.yaml
rename to operator/config/default/metrics_service.yaml
index e03cbefc..a3a46efe 100644
--- a/kagenti-operator/config/default/metrics_service.yaml
+++ b/operator/config/default/metrics_service.yaml
@@ -3,7 +3,7 @@ kind: Service
 metadata:
   labels:
     control-plane: controller-manager
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: controller-manager-metrics-service
   namespace: system
@@ -15,4 +15,4 @@ spec:
     targetPort: 8443
   selector:
     control-plane: controller-manager
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
diff --git a/kagenti-operator/config/default/webhook_namespace_selector_patch.yaml b/operator/config/default/webhook_namespace_selector_patch.yaml
similarity index 75%
rename from kagenti-operator/config/default/webhook_namespace_selector_patch.yaml
rename to operator/config/default/webhook_namespace_selector_patch.yaml
index 5c2c7507..862b3c9d 100644
--- a/kagenti-operator/config/default/webhook_namespace_selector_patch.yaml
+++ b/operator/config/default/webhook_namespace_selector_patch.yaml
@@ -3,12 +3,12 @@ kind: MutatingWebhookConfiguration
 metadata:
   name: mutating-webhook-configuration
 webhooks:
-- name: inject.kagenti.io
+- name: inject.rossoctl.io
   namespaceSelector:
     matchExpressions:
       - key: kubernetes.io/metadata.name
         operator: NotIn
         values:
-          - kagenti-system
-          - kagenti-operator-system
+          - rossoctl-system
+          - rossoctl-operator-system
           - kube-system
diff --git a/kagenti-operator/config/default/webhook_selector_patch.yaml b/operator/config/default/webhook_selector_patch.yaml
similarity index 73%
rename from kagenti-operator/config/default/webhook_selector_patch.yaml
rename to operator/config/default/webhook_selector_patch.yaml
index 0b2ad97e..ac490a34 100644
--- a/kagenti-operator/config/default/webhook_selector_patch.yaml
+++ b/operator/config/default/webhook_selector_patch.yaml
@@ -1,12 +1,12 @@
 # This patch adds namespace and object selectors to the mutating webhook
 # to prevent it from intercepting ALL pod CREATEs cluster-wide.
-# Only pods in kagenti-enabled namespaces with kagenti.io/type labels are intercepted.
+# Only pods in rossoctl-enabled namespaces with rossoctl.io/type labels are intercepted.
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   name: mutating-webhook-configuration
 webhooks:
-- name: inject.kagenti.io
+- name: inject.rossoctl.io
   namespaceSelector:
     matchExpressions:
     - key: kubernetes.io/metadata.name
@@ -15,17 +15,17 @@ webhooks:
       - kube-system
       - kube-public
       - kube-node-lease
-      - kagenti-operator-system
+      - rossoctl-operator-system
     matchLabels:
-      kagenti-enabled: "true"
+      rossoctl-enabled: "true"
   objectSelector:
     matchExpressions:
-    - key: kagenti.io/type
+    - key: rossoctl.io/type
       operator: In
       values:
       - agent
       - tool
-    - key: kagenti.io/inject
+    - key: rossoctl.io/inject
       operator: NotIn
       values:
       - disabled
diff --git a/kagenti-operator/config/default/webhookcainjection_patch.yaml b/operator/config/default/webhookcainjection_patch.yaml
similarity index 83%
rename from kagenti-operator/config/default/webhookcainjection_patch.yaml
rename to operator/config/default/webhookcainjection_patch.yaml
index cd975857..57d8e9c9 100644
--- a/kagenti-operator/config/default/webhookcainjection_patch.yaml
+++ b/operator/config/default/webhookcainjection_patch.yaml
@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/name: mutatingwebhookconfiguration
     app.kubernetes.io/instance: mutating-webhook-configuration
     app.kubernetes.io/component: webhook
-    app.kubernetes.io/created-by: kagenti-operator
-    app.kubernetes.io/part-of: kagenti-operator
+    app.kubernetes.io/created-by: rossoctl-operator
+    app.kubernetes.io/part-of: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: mutating-webhook-configuration
   annotations:
@@ -21,8 +21,8 @@ metadata:
     app.kubernetes.io/name: validatingwebhookconfiguration
     app.kubernetes.io/instance: validating-webhook-configuration
     app.kubernetes.io/component: webhook
-    app.kubernetes.io/created-by: kagenti-operator
-    app.kubernetes.io/part-of: kagenti-operator
+    app.kubernetes.io/created-by: rossoctl-operator
+    app.kubernetes.io/part-of: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: validating-webhook-configuration
   annotations:
diff --git a/kagenti-operator/config/istio-trust/certificates.yaml b/operator/config/istio-trust/certificates.yaml
similarity index 93%
rename from kagenti-operator/config/istio-trust/certificates.yaml
rename to operator/config/istio-trust/certificates.yaml
index 431fb819..553f893c 100644
--- a/kagenti-operator/config/istio-trust/certificates.yaml
+++ b/operator/config/istio-trust/certificates.yaml
@@ -14,7 +14,7 @@ metadata:
   name: istio-mesh-root-ca
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: shared-trust
     app.kubernetes.io/managed-by: kustomize
 spec:
@@ -36,7 +36,7 @@ metadata:
   name: istio-cacerts-default
   namespace: istio-system
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: shared-trust
     app.kubernetes.io/managed-by: kustomize
 spec:
@@ -58,7 +58,7 @@ metadata:
   name: istio-cacerts-openshift-gateway
   namespace: openshift-ingress
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: shared-trust
     app.kubernetes.io/managed-by: kustomize
 spec:
diff --git a/kagenti-operator/config/istio-trust/cluster-issuers.yaml b/operator/config/istio-trust/cluster-issuers.yaml
similarity index 85%
rename from kagenti-operator/config/istio-trust/cluster-issuers.yaml
rename to operator/config/istio-trust/cluster-issuers.yaml
index 08e803d7..e171c729 100644
--- a/kagenti-operator/config/istio-trust/cluster-issuers.yaml
+++ b/operator/config/istio-trust/cluster-issuers.yaml
@@ -5,7 +5,7 @@ kind: ClusterIssuer
 metadata:
   name: istio-mesh-root-selfsigned
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: shared-trust
     app.kubernetes.io/managed-by: kustomize
 spec:
@@ -16,7 +16,7 @@ kind: ClusterIssuer
 metadata:
   name: istio-mesh-ca
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: shared-trust
     app.kubernetes.io/managed-by: kustomize
 spec:
diff --git a/kagenti-operator/config/istio-trust/kustomization.yaml b/operator/config/istio-trust/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/istio-trust/kustomization.yaml
rename to operator/config/istio-trust/kustomization.yaml
diff --git a/kagenti-operator/config/manager/kustomization.yaml b/operator/config/manager/kustomization.yaml
similarity index 82%
rename from kagenti-operator/config/manager/kustomization.yaml
rename to operator/config/manager/kustomization.yaml
index f42ccb62..b50553bc 100644
--- a/kagenti-operator/config/manager/kustomization.yaml
+++ b/operator/config/manager/kustomization.yaml
@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
-  newName: kagenti-operator
+  newName: rossoctl-operator
   newTag: v0.0.1
diff --git a/kagenti-operator/config/manager/manager.yaml b/operator/config/manager/manager.yaml
similarity index 94%
rename from kagenti-operator/config/manager/manager.yaml
rename to operator/config/manager/manager.yaml
index ed0278fa..26d1e64a 100644
--- a/kagenti-operator/config/manager/manager.yaml
+++ b/operator/config/manager/manager.yaml
@@ -3,7 +3,7 @@ kind: Namespace
 metadata:
   labels:
     control-plane: controller-manager
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: system
 ---
@@ -14,13 +14,13 @@ metadata:
   namespace: system
   labels:
     control-plane: controller-manager
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
 spec:
   selector:
     matchLabels:
       control-plane: controller-manager
-      app.kubernetes.io/name: kagenti-operator
+      app.kubernetes.io/name: rossoctl-operator
   replicas: 1
   template:
     metadata:
@@ -28,7 +28,7 @@ spec:
         kubectl.kubernetes.io/default-container: manager
       labels:
         control-plane: controller-manager
-        app.kubernetes.io/name: kagenti-operator
+        app.kubernetes.io/name: rossoctl-operator
     spec:
       # TODO(user): Uncomment the following code to configure the nodeAffinity expression
       # according to the platforms which are supported by your solution.
diff --git a/kagenti-operator/config/network-policy/allow-metrics-traffic.yaml b/operator/config/network-policy/allow-metrics-traffic.yaml
similarity index 88%
rename from kagenti-operator/config/network-policy/allow-metrics-traffic.yaml
rename to operator/config/network-policy/allow-metrics-traffic.yaml
index 73b46acd..8f050198 100644
--- a/kagenti-operator/config/network-policy/allow-metrics-traffic.yaml
+++ b/operator/config/network-policy/allow-metrics-traffic.yaml
@@ -5,7 +5,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: allow-metrics-traffic
   namespace: system
@@ -13,7 +13,7 @@ spec:
   podSelector:
     matchLabels:
       control-plane: controller-manager
-      app.kubernetes.io/name: kagenti-operator
+      app.kubernetes.io/name: rossoctl-operator
   policyTypes:
     - Ingress
   ingress:
diff --git a/kagenti-operator/config/network-policy/allow-webhook-traffic.yaml b/operator/config/network-policy/allow-webhook-traffic.yaml
similarity index 84%
rename from kagenti-operator/config/network-policy/allow-webhook-traffic.yaml
rename to operator/config/network-policy/allow-webhook-traffic.yaml
index dfdff8a9..15a16451 100644
--- a/kagenti-operator/config/network-policy/allow-webhook-traffic.yaml
+++ b/operator/config/network-policy/allow-webhook-traffic.yaml
@@ -5,8 +5,8 @@ metadata:
     app.kubernetes.io/name: networkpolicy
     app.kubernetes.io/instance: allow-webhook-traffic
     app.kubernetes.io/component: webhook
-    app.kubernetes.io/created-by: kagenti-operator
-    app.kubernetes.io/part-of: kagenti-operator
+    app.kubernetes.io/created-by: rossoctl-operator
+    app.kubernetes.io/part-of: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: allow-webhook-traffic
   namespace: system
diff --git a/kagenti-operator/config/network-policy/kustomization.yaml b/operator/config/network-policy/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/network-policy/kustomization.yaml
rename to operator/config/network-policy/kustomization.yaml
diff --git a/kagenti-operator/config/openshift/kustomization.yaml b/operator/config/openshift/kustomization.yaml
similarity index 84%
rename from kagenti-operator/config/openshift/kustomization.yaml
rename to operator/config/openshift/kustomization.yaml
index 81e67fe7..5de2ac86 100644
--- a/kagenti-operator/config/openshift/kustomization.yaml
+++ b/operator/config/openshift/kustomization.yaml
@@ -1,4 +1,4 @@
-# OpenShift standalone overlay for kagenti-operator.
+# OpenShift standalone overlay for rossoctl-operator.
 #
 # Composes the operator core (config/default) with OpenShift-specific
 # resources: shared Istio trust certs, AuthBridge template ConfigMaps,
diff --git a/kagenti-operator/config/openshift/patches/authbridge-keycloak.yaml b/operator/config/openshift/patches/authbridge-keycloak.yaml
similarity index 84%
rename from kagenti-operator/config/openshift/patches/authbridge-keycloak.yaml
rename to operator/config/openshift/patches/authbridge-keycloak.yaml
index 6b8bf860..e523925a 100644
--- a/kagenti-operator/config/openshift/patches/authbridge-keycloak.yaml
+++ b/operator/config/openshift/patches/authbridge-keycloak.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: authbridge-runtime-config
-  namespace: kagenti-operator-system
+  namespace: rossoctl-operator-system
 data:
   config.yaml: |
     spiffe: {}
@@ -13,15 +13,15 @@ data:
         plugins:
           - name: jwt-validation
             config:
-              issuer: "http://keycloak-service.keycloak.svc:8080/realms/kagenti"
+              issuer: "http://keycloak-service.keycloak.svc:8080/realms/rossoctl"
               keycloak_url: "http://keycloak-service.keycloak.svc:8080"
-              keycloak_realm: "kagenti"
+              keycloak_realm: "rossoctl"
       outbound:
         plugins:
           - name: token-exchange
             config:
               keycloak_url: "http://keycloak-service.keycloak.svc:8080"
-              keycloak_realm: "kagenti"
+              keycloak_realm: "rossoctl"
               default_policy: "passthrough"
               identity:
                 type: "client-secret"
diff --git a/kagenti-operator/config/prometheus/kustomization.yaml b/operator/config/prometheus/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/prometheus/kustomization.yaml
rename to operator/config/prometheus/kustomization.yaml
diff --git a/kagenti-operator/config/prometheus/monitor.yaml b/operator/config/prometheus/monitor.yaml
similarity index 92%
rename from kagenti-operator/config/prometheus/monitor.yaml
rename to operator/config/prometheus/monitor.yaml
index 1ca28c4a..abac3e93 100644
--- a/kagenti-operator/config/prometheus/monitor.yaml
+++ b/operator/config/prometheus/monitor.yaml
@@ -4,7 +4,7 @@ kind: ServiceMonitor
 metadata:
   labels:
     control-plane: controller-manager
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: controller-manager-metrics-monitor
   namespace: system
@@ -24,4 +24,4 @@ spec:
   selector:
     matchLabels:
       control-plane: controller-manager
-      app.kubernetes.io/name: kagenti-operator
+      app.kubernetes.io/name: rossoctl-operator
diff --git a/kagenti-operator/config/prometheus/monitor_tls_patch.yaml b/operator/config/prometheus/monitor_tls_patch.yaml
similarity index 100%
rename from kagenti-operator/config/prometheus/monitor_tls_patch.yaml
rename to operator/config/prometheus/monitor_tls_patch.yaml
diff --git a/kagenti-operator/config/rbac/kustomization.yaml b/operator/config/rbac/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/rbac/kustomization.yaml
rename to operator/config/rbac/kustomization.yaml
diff --git a/kagenti-operator/config/rbac/leader_election_role.yaml b/operator/config/rbac/leader_election_role.yaml
similarity index 92%
rename from kagenti-operator/config/rbac/leader_election_role.yaml
rename to operator/config/rbac/leader_election_role.yaml
index 584e20cc..5f6cc35a 100644
--- a/kagenti-operator/config/rbac/leader_election_role.yaml
+++ b/operator/config/rbac/leader_election_role.yaml
@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: leader-election-role
 rules:
diff --git a/kagenti-operator/config/rbac/leader_election_role_binding.yaml b/operator/config/rbac/leader_election_role_binding.yaml
similarity index 87%
rename from kagenti-operator/config/rbac/leader_election_role_binding.yaml
rename to operator/config/rbac/leader_election_role_binding.yaml
index c1953ecf..b43d891f 100644
--- a/kagenti-operator/config/rbac/leader_election_role_binding.yaml
+++ b/operator/config/rbac/leader_election_role_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: leader-election-rolebinding
 roleRef:
diff --git a/kagenti-operator/config/rbac/metrics_auth_role.yaml b/operator/config/rbac/metrics_auth_role.yaml
similarity index 100%
rename from kagenti-operator/config/rbac/metrics_auth_role.yaml
rename to operator/config/rbac/metrics_auth_role.yaml
diff --git a/kagenti-operator/config/rbac/metrics_auth_role_binding.yaml b/operator/config/rbac/metrics_auth_role_binding.yaml
similarity index 100%
rename from kagenti-operator/config/rbac/metrics_auth_role_binding.yaml
rename to operator/config/rbac/metrics_auth_role_binding.yaml
diff --git a/kagenti-operator/config/rbac/metrics_reader_role.yaml b/operator/config/rbac/metrics_reader_role.yaml
similarity index 100%
rename from kagenti-operator/config/rbac/metrics_reader_role.yaml
rename to operator/config/rbac/metrics_reader_role.yaml
diff --git a/kagenti-operator/config/rbac/mlflow_binding.yaml b/operator/config/rbac/mlflow_binding.yaml
similarity index 88%
rename from kagenti-operator/config/rbac/mlflow_binding.yaml
rename to operator/config/rbac/mlflow_binding.yaml
index 408a976e..55015eaf 100644
--- a/kagenti-operator/config/rbac/mlflow_binding.yaml
+++ b/operator/config/rbac/mlflow_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: mlflow-integration-binding
 roleRef:
diff --git a/kagenti-operator/config/rbac/role.yaml b/operator/config/rbac/role.yaml
similarity index 98%
rename from kagenti-operator/config/rbac/role.yaml
rename to operator/config/rbac/role.yaml
index ea9af69a..9125b7d7 100644
--- a/kagenti-operator/config/rbac/role.yaml
+++ b/operator/config/rbac/role.yaml
@@ -63,7 +63,7 @@ rules:
   - create
   - patch
 - apiGroups:
-  - agent.kagenti.dev
+  - agent.rossoctl.dev
   resources:
   - agentcards
   - agentruntimes
@@ -76,14 +76,14 @@ rules:
   - update
   - watch
 - apiGroups:
-  - agent.kagenti.dev
+  - agent.rossoctl.dev
   resources:
   - agentcards/finalizers
   - agentruntimes/finalizers
   verbs:
   - update
 - apiGroups:
-  - agent.kagenti.dev
+  - agent.rossoctl.dev
   resources:
   - agentcards/status
   - agentruntimes/status
diff --git a/kagenti-operator/config/rbac/role_binding.yaml b/operator/config/rbac/role_binding.yaml
similarity index 87%
rename from kagenti-operator/config/rbac/role_binding.yaml
rename to operator/config/rbac/role_binding.yaml
index cc98143e..5926ab5a 100644
--- a/kagenti-operator/config/rbac/role_binding.yaml
+++ b/operator/config/rbac/role_binding.yaml
@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: manager-rolebinding
 roleRef:
diff --git a/kagenti-operator/config/rbac/service_account.yaml b/operator/config/rbac/service_account.yaml
similarity index 76%
rename from kagenti-operator/config/rbac/service_account.yaml
rename to operator/config/rbac/service_account.yaml
index 07fdedb0..82677797 100644
--- a/kagenti-operator/config/rbac/service_account.yaml
+++ b/operator/config/rbac/service_account.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/managed-by: kustomize
   name: controller-manager
   namespace: system
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml b/operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
similarity index 69%
rename from kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
rename to operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
index 5fbd9d4b..a6ab3c3e 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
+++ b/operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
@@ -1,9 +1,9 @@
 # Basic AgentRuntime: enroll a Deployment as an agent with default configuration.
-# The controller applies kagenti.io/type label and triggers sidecar injection.
+# The controller applies rossoctl.io/type label and triggers sidecar injection.
 # Configuration settings come from cluster and namespace defaults.
-# Note: The target Deployment should have a protocol.kagenti.io/a2a label
+# Note: The target Deployment should have a protocol.rossoctl.io/a2a label
 # for automatic AgentCard creation and agent discovery.
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml b/operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
similarity index 87%
rename from kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
rename to operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
index dd47826b..3a856510 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
+++ b/operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
@@ -1,5 +1,5 @@
 # Full AgentRuntime: enroll a Deployment as an agent.
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_skill_discovery.yaml b/operator/config/samples/agent_v1alpha1_agentruntime_skill_discovery.yaml
similarity index 82%
rename from kagenti-operator/config/samples/agent_v1alpha1_agentruntime_skill_discovery.yaml
rename to operator/config/samples/agent_v1alpha1_agentruntime_skill_discovery.yaml
index 8a0dd46a..c9d4e1a0 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_skill_discovery.yaml
+++ b/operator/config/samples/agent_v1alpha1_agentruntime_skill_discovery.yaml
@@ -1,4 +1,4 @@
-# AgentRuntime with skill discovery: reads the kagenti.io/skills annotation
+# AgentRuntime with skill discovery: reads the rossoctl.io/skills annotation
 # from the target workload to discover linked skills.
 # Requires: skillDiscovery feature gate enabled.
 #
@@ -11,7 +11,7 @@
 #        image:
 #          reference: quay.io/myorg/openshift-review:1.0.0
 #
-# 2. ConfigMap volumes (kagenti backend, PR #1440):
+# 2. ConfigMap volumes (rossoctl backend, PR #1440):
 #    volumes:
 #      - name: skill-0
 #        configMap:
@@ -19,7 +19,7 @@
 #
 # Both paths set SKILL_FOLDERS so the agent discovers skills at startup.
 # The agent reports discovered skills in its A2A card.
-# The operator reads the kagenti.io/skills annotation and populates
+# The operator reads the rossoctl.io/skills annotation and populates
 # status.linkedSkills.
 ---
 # Example Deployment with OCI skill ImageVolume
@@ -29,9 +29,9 @@ metadata:
   name: my-agent
   labels:
     app.kubernetes.io/name: my-agent
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
   annotations:
-    kagenti.io/skills: '["openshift-review"]'
+    rossoctl.io/skills: '["openshift-review"]'
 spec:
   replicas: 1
   selector:
@@ -41,7 +41,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: my-agent
-        kagenti.io/type: agent
+        rossoctl.io/type: agent
     spec:
       securityContext:
         runAsNonRoot: true
@@ -49,7 +49,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: agent
-          image: ghcr.io/kagenti/agent-examples/a2a_currency_converter:v0.1.0-alpha.1
+          image: ghcr.io/rossoctl/examples/a2a_currency_converter:v0.1.0-alpha.1
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -70,7 +70,7 @@ spec:
             reference: quay.io/myorg/openshift-review:1.0.0
 ---
 # AgentRuntime observes the Deployment — no spec.skills needed
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: my-agent
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml b/operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
similarity index 90%
rename from kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
rename to operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
index b2a7d77b..f7aaed72 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
+++ b/operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
@@ -1,6 +1,6 @@
 # Tool AgentRuntime: enroll a Deployment as a tool (e.g., MCP server).
 # Requires the injectTools feature gate to be enabled for sidecar injection.
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: calculator-tool-runtime
diff --git a/kagenti-operator/config/samples/kustomization.yaml b/operator/config/samples/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/samples/kustomization.yaml
rename to operator/config/samples/kustomization.yaml
diff --git a/operator/config/security/kustomization.yaml b/operator/config/security/kustomization.yaml
new file mode 100644
index 00000000..e4cdbc58
--- /dev/null
+++ b/operator/config/security/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+- rossoctl-authbridge-scc.yaml
diff --git a/kagenti-operator/config/security/kagenti-authbridge-scc.yaml b/operator/config/security/rossoctl-authbridge-scc.yaml
similarity index 76%
rename from kagenti-operator/config/security/kagenti-authbridge-scc.yaml
rename to operator/config/security/rossoctl-authbridge-scc.yaml
index ebd0a693..7af2384d 100644
--- a/kagenti-operator/config/security/kagenti-authbridge-scc.yaml
+++ b/operator/config/security/rossoctl-authbridge-scc.yaml
@@ -6,9 +6,9 @@
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:
-  name: kagenti-authbridge
+  name: rossoctl-authbridge
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: authbridge
     app.kubernetes.io/managed-by: kustomize
 groups: []
@@ -43,35 +43,35 @@ volumes:
   - projected
   - secret
 ---
-# ClusterRole granting "use" on the kagenti-authbridge SCC.
+# ClusterRole granting "use" on the rossoctl-authbridge SCC.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: system:openshift:scc:kagenti-authbridge
+  name: system:openshift:scc:rossoctl-authbridge
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: authbridge
     app.kubernetes.io/managed-by: kustomize
 rules:
   - apiGroups: ["security.openshift.io"]
     resources: ["securitycontextconstraints"]
-    resourceNames: ["kagenti-authbridge"]
+    resourceNames: ["rossoctl-authbridge"]
     verbs: ["use"]
 ---
 # Grants the operator SA "use" on the SCC so it can delegate via RoleBindings.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-operator-scc-authbridge
+  name: rossoctl-operator-scc-authbridge
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: authbridge
     app.kubernetes.io/managed-by: kustomize
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: system:openshift:scc:kagenti-authbridge
+  name: system:openshift:scc:rossoctl-authbridge
 subjects:
   - kind: ServiceAccount
-    name: kagenti-operator-controller-manager
-    namespace: kagenti-operator-system
+    name: rossoctl-operator-controller-manager
+    namespace: rossoctl-operator-system
diff --git a/kagenti-operator/config/vap/kustomization.yaml b/operator/config/vap/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/vap/kustomization.yaml
rename to operator/config/vap/kustomization.yaml
diff --git a/kagenti-operator/config/vap/validating-admission-policy-binding.yaml b/operator/config/vap/validating-admission-policy-binding.yaml
similarity index 84%
rename from kagenti-operator/config/vap/validating-admission-policy-binding.yaml
rename to operator/config/vap/validating-admission-policy-binding.yaml
index efbcd6c9..1ffdfd01 100644
--- a/kagenti-operator/config/vap/validating-admission-policy-binding.yaml
+++ b/operator/config/vap/validating-admission-policy-binding.yaml
@@ -3,7 +3,7 @@ kind: ValidatingAdmissionPolicyBinding
 metadata:
   name: agent-label-protection
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: admission
 spec:
   policyName: agent-label-protection
diff --git a/kagenti-operator/config/vap/validating-admission-policy.yaml b/operator/config/vap/validating-admission-policy.yaml
similarity index 65%
rename from kagenti-operator/config/vap/validating-admission-policy.yaml
rename to operator/config/vap/validating-admission-policy.yaml
index 2c300c84..cc1cb55f 100644
--- a/kagenti-operator/config/vap/validating-admission-policy.yaml
+++ b/operator/config/vap/validating-admission-policy.yaml
@@ -1,5 +1,5 @@
-# ValidatingAdmissionPolicy: prevent manual application of the kagenti.io/type
-# label on Deployments and StatefulSets.  Only the kagenti-operator controller
+# ValidatingAdmissionPolicy: prevent manual application of the rossoctl.io/type
+# label on Deployments and StatefulSets.  Only the rossoctl-operator controller
 # (via an AgentRuntime CR) is allowed to set this label.  Users who need the
 # label must create an AgentRuntime targeting their workload instead.
 #
@@ -15,8 +15,8 @@
 #     2. The request originates from a trusted service account.
 #        Two operator SA identities are listed because kustomize (make deploy)
 #        and Helm use different namespaces and SA names:
-#          - kagenti-operator-system/kagenti-operator-controller-manager  (kustomize)
-#          - kagenti-system/controller-manager                            (Helm)
+#          - rossoctl-operator-system/rossoctl-operator-controller-manager  (kustomize)
+#          - rossoctl-system/controller-manager                            (Helm)
 #
 #   validations      — for everyone else, allow only UPDATE requests where the
 #     label already existed on the previous revision with the same value in
@@ -30,7 +30,7 @@ kind: ValidatingAdmissionPolicy
 metadata:
   name: agent-label-protection
   labels:
-    app.kubernetes.io/name: kagenti-operator
+    app.kubernetes.io/name: rossoctl-operator
     app.kubernetes.io/component: admission
 spec:
   failurePolicy: Fail
@@ -44,47 +44,47 @@ spec:
   matchConditions:
     - name: 'has-agent-type-label'
       expression: >-
-        (has(object.metadata.labels) && 'kagenti.io/type' in object.metadata.labels)
+        (has(object.metadata.labels) && 'rossoctl.io/type' in object.metadata.labels)
         || (has(object.spec.template.metadata)
             && has(object.spec.template.metadata.labels)
-            && 'kagenti.io/type' in object.spec.template.metadata.labels)
+            && 'rossoctl.io/type' in object.spec.template.metadata.labels)
 
     - name: 'not-operator-service-account'
       expression: >-
-        !(request.userInfo.username == 'system:serviceaccount:kagenti-operator-system:kagenti-operator-controller-manager')
-        && !(request.userInfo.username == 'system:serviceaccount:kagenti-system:controller-manager')
+        !(request.userInfo.username == 'system:serviceaccount:rossoctl-operator-system:rossoctl-operator-controller-manager')
+        && !(request.userInfo.username == 'system:serviceaccount:rossoctl-system:controller-manager')
 
   variables:
     - name: metaLabelUnchanged
       expression: >-
-        !('kagenti.io/type' in object.metadata.labels)
+        !('rossoctl.io/type' in object.metadata.labels)
         || (request.operation == 'UPDATE'
-            && 'kagenti.io/type' in oldObject.metadata.labels
-            && oldObject.metadata.labels['kagenti.io/type'] == object.metadata.labels['kagenti.io/type'])
+            && 'rossoctl.io/type' in oldObject.metadata.labels
+            && oldObject.metadata.labels['rossoctl.io/type'] == object.metadata.labels['rossoctl.io/type'])
 
     - name: podTemplateLabelUnchanged
       expression: >-
         !(has(object.spec.template.metadata)
           && has(object.spec.template.metadata.labels)
-          && 'kagenti.io/type' in object.spec.template.metadata.labels)
+          && 'rossoctl.io/type' in object.spec.template.metadata.labels)
         || (request.operation == 'UPDATE'
             && has(oldObject.spec.template.metadata)
             && has(oldObject.spec.template.metadata.labels)
-            && 'kagenti.io/type' in oldObject.spec.template.metadata.labels
-            && oldObject.spec.template.metadata.labels['kagenti.io/type'] == object.spec.template.metadata.labels['kagenti.io/type'])
+            && 'rossoctl.io/type' in oldObject.spec.template.metadata.labels
+            && oldObject.spec.template.metadata.labels['rossoctl.io/type'] == object.spec.template.metadata.labels['rossoctl.io/type'])
 
   validations:
     - expression: "variables.metaLabelUnchanged"
       messageExpression: >-
-        'The kagenti.io/type label on '
+        'The rossoctl.io/type label on '
         + object.metadata.namespace + '/' + object.metadata.name
-        + ' can only be applied by the kagenti-operator via an AgentRuntime CR.'
+        + ' can only be applied by the rossoctl-operator via an AgentRuntime CR.'
         + ' Create an AgentRuntime targeting this workload instead of manually setting the label.'
       reason: Forbidden
     - expression: "variables.podTemplateLabelUnchanged"
       messageExpression: >-
-        'The kagenti.io/type label in the pod template of '
+        'The rossoctl.io/type label in the pod template of '
         + object.metadata.namespace + '/' + object.metadata.name
-        + ' can only be applied by the kagenti-operator via an AgentRuntime CR.'
+        + ' can only be applied by the rossoctl-operator via an AgentRuntime CR.'
         + ' Create an AgentRuntime targeting this workload instead of manually setting the label.'
       reason: Forbidden
diff --git a/kagenti-operator/config/webhook/kustomization.yaml b/operator/config/webhook/kustomization.yaml
similarity index 100%
rename from kagenti-operator/config/webhook/kustomization.yaml
rename to operator/config/webhook/kustomization.yaml
diff --git a/kagenti-operator/config/webhook/kustomizeconfig.yaml b/operator/config/webhook/kustomizeconfig.yaml
similarity index 100%
rename from kagenti-operator/config/webhook/kustomizeconfig.yaml
rename to operator/config/webhook/kustomizeconfig.yaml
diff --git a/kagenti-operator/config/webhook/manifests.yaml b/operator/config/webhook/manifests.yaml
similarity index 86%
rename from kagenti-operator/config/webhook/manifests.yaml
rename to operator/config/webhook/manifests.yaml
index 434c7a5c..4d09feb3 100644
--- a/kagenti-operator/config/webhook/manifests.yaml
+++ b/operator/config/webhook/manifests.yaml
@@ -12,7 +12,7 @@ webhooks:
       namespace: system
       path: /mutate-workloads-authbridge
   failurePolicy: Fail
-  name: inject.kagenti.io
+  name: inject.rossoctl.io
   reinvocationPolicy: IfNeeded
   rules:
   - apiGroups:
@@ -36,12 +36,12 @@ webhooks:
     service:
       name: webhook-service
       namespace: system
-      path: /validate-agent-kagenti-dev-v1alpha1-agentcard
+      path: /validate-agent-rossoctl-dev-v1alpha1-agentcard
   failurePolicy: Fail
   name: vagentcard.kb.io
   rules:
   - apiGroups:
-    - agent.kagenti.dev
+    - agent.rossoctl.dev
     apiVersions:
     - v1alpha1
     operations:
@@ -56,12 +56,12 @@ webhooks:
     service:
       name: webhook-service
       namespace: system
-      path: /validate-agent-kagenti-dev-v1alpha1-agentruntime
+      path: /validate-agent-rossoctl-dev-v1alpha1-agentruntime
   failurePolicy: Fail
   name: vagentruntime.kb.io
   rules:
   - apiGroups:
-    - agent.kagenti.dev
+    - agent.rossoctl.dev
     apiVersions:
     - v1alpha1
     operations:
diff --git a/kagenti-operator/config/webhook/service.yaml b/operator/config/webhook/service.yaml
similarity index 100%
rename from kagenti-operator/config/webhook/service.yaml
rename to operator/config/webhook/service.yaml
diff --git a/kagenti-operator/demos/agentcard-enforcement/demo.md b/operator/demos/agentcard-enforcement/demo.md
similarity index 100%
rename from kagenti-operator/demos/agentcard-enforcement/demo.md
rename to operator/demos/agentcard-enforcement/demo.md
diff --git a/kagenti-operator/demos/agentcard-enforcement/run-demo-commands.sh b/operator/demos/agentcard-enforcement/run-demo-commands.sh
similarity index 97%
rename from kagenti-operator/demos/agentcard-enforcement/run-demo-commands.sh
rename to operator/demos/agentcard-enforcement/run-demo-commands.sh
index 5ff527ef..20d4e585 100755
--- a/kagenti-operator/demos/agentcard-enforcement/run-demo-commands.sh
+++ b/operator/demos/agentcard-enforcement/run-demo-commands.sh
@@ -24,7 +24,7 @@ print(f'  Reason:         {s.get(\"bindingStatus\", {}).get(\"reason\")}')
 get_label() {
   local val
   val=$(kubectl get deployment "$DEPLOYMENT" -n "$NAMESPACE" \
-    -o jsonpath='{.spec.template.metadata.labels.agent\.kagenti\.dev/signature-verified}')
+    -o jsonpath='{.spec.template.metadata.labels.agent\.rossoctl\.dev/signature-verified}')
   echo "  Label:          ${val:-<removed>}"
 }
 
diff --git a/kagenti-operator/demos/agentcard-enforcement/teardown-demo.sh b/operator/demos/agentcard-enforcement/teardown-demo.sh
similarity index 100%
rename from kagenti-operator/demos/agentcard-enforcement/teardown-demo.sh
rename to operator/demos/agentcard-enforcement/teardown-demo.sh
diff --git a/kagenti-operator/demos/agentcard-proactive-restart/demo.md b/operator/demos/agentcard-proactive-restart/demo.md
similarity index 100%
rename from kagenti-operator/demos/agentcard-proactive-restart/demo.md
rename to operator/demos/agentcard-proactive-restart/demo.md
diff --git a/kagenti-operator/demos/agentcard-proactive-restart/run-demo-commands.sh b/operator/demos/agentcard-proactive-restart/run-demo-commands.sh
similarity index 93%
rename from kagenti-operator/demos/agentcard-proactive-restart/run-demo-commands.sh
rename to operator/demos/agentcard-proactive-restart/run-demo-commands.sh
index a765d6b6..33b1eeb3 100755
--- a/kagenti-operator/demos/agentcard-proactive-restart/run-demo-commands.sh
+++ b/operator/demos/agentcard-proactive-restart/run-demo-commands.sh
@@ -12,8 +12,8 @@ set -euo pipefail
 NAMESPACE="${NAMESPACE:-agents}"
 AGENTCARD="${AGENTCARD:-weather-agent-deployment-card}"
 DEPLOYMENT="${DEPLOYMENT:-weather-agent}"
-OPERATOR_NS="${OPERATOR_NS:-kagenti-system}"
-OPERATOR_DEPLOY="${OPERATOR_DEPLOY:-kagenti-controller-manager}"
+OPERATOR_NS="${OPERATOR_NS:-rossoctl-system}"
+OPERATOR_DEPLOY="${OPERATOR_DEPLOY:-rossoctl-controller-manager}"
 
 # Capture the live operator args so we can restore them exactly after the demo.
 ORIGINAL_ARGS_JSON=$(kubectl get deployment "$OPERATOR_DEPLOY" -n "$OPERATOR_NS" \
@@ -45,7 +45,7 @@ BASELINE_KEYID=$(kubectl get agentcard "$AGENTCARD" -n "$NAMESPACE" \
 echo "  Baseline KeyId: ${BASELINE_KEYID:-(none)}"
 
 RESIGN=$(kubectl get deployment "$DEPLOYMENT" -n "$NAMESPACE" \
-  -o jsonpath='{.spec.template.metadata.annotations.agentcard\.kagenti\.dev/resign-trigger}' 2>/dev/null || true)
+  -o jsonpath='{.spec.template.metadata.annotations.agentcard\.rossoctl\.dev/resign-trigger}' 2>/dev/null || true)
 echo "  resign-trigger: ${RESIGN:-(not set)}"
 echo ""
 
@@ -67,7 +67,7 @@ kubectl logs -n "$OPERATOR_NS" deployment/"$OPERATOR_DEPLOY" 2>&1 | \
 echo ""
 
 RESIGN_AFTER=$(kubectl get deployment "$DEPLOYMENT" -n "$NAMESPACE" \
-  -o jsonpath='{.spec.template.metadata.annotations.agentcard\.kagenti\.dev/resign-trigger}' 2>/dev/null || true)
+  -o jsonpath='{.spec.template.metadata.annotations.agentcard\.rossoctl\.dev/resign-trigger}' 2>/dev/null || true)
 echo "  resign-trigger: ${RESIGN_AFTER:-(not set)}"
 
 echo ""
diff --git a/kagenti-operator/demos/agentcard-proactive-restart/teardown-demo.sh b/operator/demos/agentcard-proactive-restart/teardown-demo.sh
similarity index 89%
rename from kagenti-operator/demos/agentcard-proactive-restart/teardown-demo.sh
rename to operator/demos/agentcard-proactive-restart/teardown-demo.sh
index b8ee9526..5120dbfd 100755
--- a/kagenti-operator/demos/agentcard-proactive-restart/teardown-demo.sh
+++ b/operator/demos/agentcard-proactive-restart/teardown-demo.sh
@@ -6,8 +6,8 @@
 
 set -euo pipefail
 
-OPERATOR_NS="${OPERATOR_NS:-kagenti-system}"
-OPERATOR_DEPLOY="${OPERATOR_DEPLOY:-kagenti-controller-manager}"
+OPERATOR_NS="${OPERATOR_NS:-rossoctl-system}"
+OPERATOR_DEPLOY="${OPERATOR_DEPLOY:-rossoctl-controller-manager}"
 
 echo "=== AgentCard Proactive Restart Demo Teardown ==="
 echo ""
diff --git a/kagenti-operator/demos/agentcard-spire-signing/demo.md b/operator/demos/agentcard-spire-signing/demo.md
similarity index 81%
rename from kagenti-operator/demos/agentcard-spire-signing/demo.md
rename to operator/demos/agentcard-spire-signing/demo.md
index 42dbd504..7c5bec19 100644
--- a/kagenti-operator/demos/agentcard-spire-signing/demo.md
+++ b/operator/demos/agentcard-spire-signing/demo.md
@@ -27,8 +27,8 @@ The operator verifies the JWS signature using the x5c certificate chain embedded
 
 ## Prerequisites
 
-- Kubernetes cluster with SPIRE installed (e.g. `kagenti/scripts/kind/setup-kagenti.sh --with-spire`)
-- kagenti-operator deployed with the following signature verification flags:
+- Kubernetes cluster with SPIRE installed (e.g. `rossoctl/scripts/kind/setup-rossoctl.sh --with-spire`)
+- rossoctl-operator deployed with the following signature verification flags:
 
 ```bash
 --require-a2a-signature=true
@@ -38,25 +38,25 @@ The operator verifies the JWS signature using the x5c certificate chain embedded
 --spire-trust-bundle-configmap-namespace=<spire-bundle-namespace> # 'spire-system' in Kind, 'zero-trust-workload-identity-manager' in OpenShift by default
 ```
 
-If SPIRE was installed alongside Kagenti with the script above or similar, you can run the following helm command to apply the required flags:
+If SPIRE was installed alongside Rossoctl with the script above or similar, you can run the following helm command to apply the required flags:
 
 ```bash
-KAGENTI_REPO=<path-to-your-kagenti-repo>
-helm upgrade kagenti "$KAGENTI_REPO/charts/kagenti/" \
-  -n kagenti-system \
+ROSSOCTL_REPO=<path-to-your-rossoctl-repo>
+helm upgrade rossoctl "$ROSSOCTL_REPO/charts/rossoctl/" \
+  -n rossoctl-system \
   --reuse-values \
-  -f "$KAGENTI_REPO/charts/kagenti/.secrets.yaml" \
-  --set kagenti-operator-chart.signatureVerification.enabled=true \
-  --set kagenti-operator-chart.signatureVerification.enforceNetworkPolicies=true \
-  --set kagenti-operator-chart.signatureVerification.spireTrustDomain=<your-trust-domain> \
-  --set kagenti-operator-chart.signatureVerification.spireTrustBundle.configMapName=spire-bundle \
-  --set kagenti-operator-chart.signatureVerification.spireTrustBundle.configMapNamespace=<spire-bundle-namespace>
+  -f "$ROSSOCTL_REPO/charts/rossoctl/.secrets.yaml" \
+  --set operator-chart.signatureVerification.enabled=true \
+  --set operator-chart.signatureVerification.enforceNetworkPolicies=true \
+  --set operator-chart.signatureVerification.spireTrustDomain=<your-trust-domain> \
+  --set operator-chart.signatureVerification.spireTrustBundle.configMapName=spire-bundle \
+  --set operator-chart.signatureVerification.spireTrustBundle.configMapNamespace=<spire-bundle-namespace>
 ```
 
 If you are using OpenShift, include the following flag to use the correct bundle data field:
 
 ```bash
-  --set kagenti-operator-chart.signatureVerification.spireTrustBundle.configMapKey=bundle.crt
+  --set operator-chart.signatureVerification.spireTrustBundle.configMapKey=bundle.crt
 ```
 
 You can check the name of the spire domain with the following command:
@@ -70,7 +70,7 @@ kubectl get configmap spire-server -n zero-trust-workload-identity-manager -o js
 ### 1. Deploy the Demo
 
 ```bash
-cd <path-to-your-kagenti-operator-repo>/kagenti-operator
+cd <path-to-your-rossoctl-operator-repo>/operator
 kubectl apply -f demos/agentcard-spire-signing/k8s/namespace.yaml
 kubectl apply -f demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
 kubectl apply -f demos/agentcard-spire-signing/k8s/agent-deployment.yaml
@@ -120,7 +120,7 @@ Expected output:
   Bound:          True
 
 === 6. Signature Label ===
-  agent.kagenti.dev/signature-verified: true
+  agent.rossoctl.dev/signature-verified: true
 
 === 7. AgentCard Summary ===
 NAME                PROTOCOL   KIND         TARGET          AGENT            VERIFIED   BOUND   SYNCED   ...
@@ -136,7 +136,7 @@ weather-agent-deployment-card  a2a        Deployment   weather-agent   Weather A
 5. The operator fetches the card, verifies the JWS signature against the SPIRE trust bundle
 6. The operator extracts the SPIFFE ID from the leaf certificate's SAN URI
 7. If the SPIFFE ID belongs to the configured trust domain, the card is marked as Bound
-8. The `agent.kagenti.dev/signature-verified` label is set on the workload
+8. The `agent.rossoctl.dev/signature-verified` label is set on the workload
 
 ## Cleanup
 
@@ -169,11 +169,11 @@ oc patch deployment weather-agent -n agents --type=json -p='[{"op":"replace","pa
 You can build your own image and upload it to Kind/OpenShift internal registry with the following commands:
 
 ```bash
-cd kagenti-operator/
+cd operator/
 
 # Kind
 make build-signer # Build the signer image
-make load-signer-image KIND_CLUSTER_NAME=kagenti # Load the signer image into the default "kagenti" cluster
+make load-signer-image KIND_CLUSTER_NAME=rossoctl # Load the signer image into the default "rossoctl" cluster
 
 # OpenShift
 oc new-build -n agents --name agentcard-signer --binary --strategy docker --to=agentcard-signer # Create a binary BuildConfig that outputs the signer image
diff --git a/kagenti-operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml b/operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml
similarity index 96%
rename from kagenti-operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml
rename to operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml
index 5bf471a4..1ea4a979 100644
--- a/kagenti-operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml
+++ b/operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml
@@ -62,7 +62,7 @@ metadata:
   name: weather-agent
   namespace: agents
   labels:
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
     app.kubernetes.io/name: weather-agent
 spec:
   replicas: 1
@@ -73,7 +73,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: weather-agent
-        protocol.kagenti.io/a2a: ""
+        protocol.rossoctl.io/a2a: ""
         istio.io/dataplane-mode: none
     spec:
       serviceAccountName: weather-agent-sa
@@ -81,7 +81,7 @@ spec:
         - name: sign-agentcard
           # Local/Kind: make build-signer && make load-signer-image
           # Override:   set image to a custom registry if needed (e.g. ttl.sh for dev)
-          image: ghcr.io/kagenti/kagenti-operator/agentcard-signer:latest
+          image: ghcr.io/rossoctl/operator/agentcard-signer:latest
           imagePullPolicy: IfNotPresent
           env:
             - name: SPIFFE_ENDPOINT_SOCKET
@@ -156,7 +156,7 @@ spec:
     - port: 8080
       targetPort: 8080
 ---
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
diff --git a/kagenti-operator/demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml b/operator/demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
similarity index 90%
rename from kagenti-operator/demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
rename to operator/demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
index b9e581d6..f2abd5b2 100644
--- a/kagenti-operator/demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
+++ b/operator/demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
@@ -6,7 +6,7 @@ spec:
   spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
   podSelector:
     matchLabels:
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
   namespaceSelector:
     matchLabels:
       agentcard: "true"
diff --git a/kagenti-operator/demos/agentcard-spire-signing/k8s/namespace.yaml b/operator/demos/agentcard-spire-signing/k8s/namespace.yaml
similarity index 100%
rename from kagenti-operator/demos/agentcard-spire-signing/k8s/namespace.yaml
rename to operator/demos/agentcard-spire-signing/k8s/namespace.yaml
diff --git a/kagenti-operator/demos/agentcard-spire-signing/run-demo-commands.sh b/operator/demos/agentcard-spire-signing/run-demo-commands.sh
similarity index 93%
rename from kagenti-operator/demos/agentcard-spire-signing/run-demo-commands.sh
rename to operator/demos/agentcard-spire-signing/run-demo-commands.sh
index 12779527..6e4dfb46 100755
--- a/kagenti-operator/demos/agentcard-spire-signing/run-demo-commands.sh
+++ b/operator/demos/agentcard-spire-signing/run-demo-commands.sh
@@ -66,8 +66,8 @@ echo ""
 
 echo "=== 6. Signature Label ==="
 LABEL=$(kubectl get deployment weather-agent -n "$NAMESPACE" \
-  -o jsonpath='{.spec.template.metadata.labels.agent\.kagenti\.dev/signature-verified}')
-echo "  agent.kagenti.dev/signature-verified: ${LABEL:-<not set>}"
+  -o jsonpath='{.spec.template.metadata.labels.agent\.rossoctl\.dev/signature-verified}')
+echo "  agent.rossoctl.dev/signature-verified: ${LABEL:-<not set>}"
 echo ""
 
 echo "=== 7. AgentCard Summary ==="
diff --git a/kagenti-operator/demos/agentcard-spire-signing/teardown-demo.sh b/operator/demos/agentcard-spire-signing/teardown-demo.sh
similarity index 100%
rename from kagenti-operator/demos/agentcard-spire-signing/teardown-demo.sh
rename to operator/demos/agentcard-spire-signing/teardown-demo.sh
diff --git a/kagenti-operator/docs/agentcard-identity-binding.md b/operator/docs/agentcard-identity-binding.md
similarity index 99%
rename from kagenti-operator/docs/agentcard-identity-binding.md
rename to operator/docs/agentcard-identity-binding.md
index eaddf5a7..ecc65e90 100644
--- a/kagenti-operator/docs/agentcard-identity-binding.md
+++ b/operator/docs/agentcard-identity-binding.md
@@ -70,7 +70,7 @@ Set the default trust domain for all AgentCards:
 Override the trust domain for a specific AgentCard:
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: weather-agent-card
diff --git a/kagenti-operator/docs/agentcard-signature-verification.md b/operator/docs/agentcard-signature-verification.md
similarity index 89%
rename from kagenti-operator/docs/agentcard-signature-verification.md
rename to operator/docs/agentcard-signature-verification.md
index 468e960d..da2f8477 100644
--- a/kagenti-operator/docs/agentcard-signature-verification.md
+++ b/operator/docs/agentcard-signature-verification.md
@@ -1,8 +1,8 @@
 # AgentCard Signature Verification
 
-**GitHub Issue:** [#116 - Feature: Strict CardSignature Checking](https://github.com/kagenti/kagenti-operator/issues/116)
+**GitHub Issue:** [#116 - Feature: Strict CardSignature Checking](https://github.com/rossoctl/operator/issues/116)
 
-This guide covers how AgentCard signature verification works in the kagenti-operator. Agents sign their AgentCards at pod startup using a SPIRE init-container, and the operator verifies signatures using `x5c` certificate chain validation against the SPIRE trust bundle.
+This guide covers how AgentCard signature verification works in the rossoctl-operator. Agents sign their AgentCards at pod startup using a SPIRE init-container, and the operator verifies signatures using `x5c` certificate chain validation against the SPIRE trust bundle.
 
 ---
 
@@ -61,7 +61,7 @@ The `protected` header contains:
 
 ## Setup
 
-### 1. Register Kagenti agents with SPIRE
+### 1. Register Rossoctl agents with SPIRE
 
 Create a `ClusterSPIFFEID` so SPIRE automatically issues SVIDs to agent pods:
 
@@ -69,12 +69,12 @@ Create a `ClusterSPIFFEID` so SPIRE automatically issues SVIDs to agent pods:
 apiVersion: spire.spiffe.io/v1alpha1
 kind: ClusterSPIFFEID
 metadata:
-  name: kagenti-agents
+  name: rossoctl-agents
 spec:
   spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
   podSelector:
     matchLabels:
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
   namespaceSelector:
     matchLabels: {}
 ```
@@ -102,7 +102,7 @@ See `demos/agentcard-spire-signing/` for complete manifests and a runnable demo.
 ```yaml
 initContainers:
   - name: sign-agentcard
-    image: kagenti/agentcard-signer:latest
+    image: rossoctl/agentcard-signer:latest
     env:
       - name: SPIFFE_ENDPOINT_SOCKET
         value: unix:///run/spire/agent-sockets/spire-agent.sock
@@ -126,7 +126,7 @@ initContainers:
 ### 5. Create the AgentCard CR
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: weather-agent-card
@@ -180,10 +180,10 @@ Expected status:
 
 | Metric | Type | Description |
 |--------|------|-------------|
-| `kagenti_x5c_chain_validation_total` | Counter | Chain validation attempts (labels: valid, reason) |
-| `kagenti_x5c_trust_bundle_age_seconds` | Gauge | Age of the cached trust bundle |
-| `kagenti_x5c_trust_bundle_load_errors_total` | Counter | Trust bundle load failures |
-| `kagenti_x5c_binding_trust_domain_mismatch_total` | Counter | Trust domain mismatches |
+| `rossoctl_x5c_chain_validation_total` | Counter | Chain validation attempts (labels: valid, reason) |
+| `rossoctl_x5c_trust_bundle_age_seconds` | Gauge | Age of the cached trust bundle |
+| `rossoctl_x5c_trust_bundle_load_errors_total` | Counter | Trust bundle load failures |
+| `rossoctl_x5c_binding_trust_domain_mismatch_total` | Counter | Trust domain mismatches |
 
 ## Troubleshooting
 
diff --git a/kagenti-operator/docs/api-reference.md b/operator/docs/api-reference.md
similarity index 86%
rename from kagenti-operator/docs/api-reference.md
rename to operator/docs/api-reference.md
index 101573ec..62668c2d 100644
--- a/kagenti-operator/docs/api-reference.md
+++ b/operator/docs/api-reference.md
@@ -1,6 +1,6 @@
 # API Reference
 
-This document provides a comprehensive reference for the Kagenti Operator Custom Resource Definitions (CRDs).
+This document provides a comprehensive reference for the Rossoctl Operator Custom Resource Definitions (CRDs).
 
 ## Custom Resources
 
@@ -15,7 +15,7 @@ The `AgentCard` Custom Resource stores agent metadata for dynamic discovery and
 
 ### API Group and Version
 
-- **API Group:** `agent.kagenti.dev`
+- **API Group:** `agent.rossoctl.dev`
 - **API Version:** `v1alpha1`
 - **Kind:** `AgentCard`
 - **Short Names:** `agentcards`, `cards`
@@ -151,7 +151,7 @@ Represents the A2A agent card structure based on the [A2A specification](https:/
 
 #### Deploy Agent with AgentRuntime (Recommended)
 
-Create a Deployment with a protocol label and an `AgentRuntime` CR to enroll it. The operator applies `kagenti.io/type: agent` to the Deployment, and the AgentCardSync controller auto-creates an AgentCard named `weather-agent-deployment-card` (pattern: `{name}-{kind}-card`):
+Create a Deployment with a protocol label and an `AgentRuntime` CR to enroll it. The operator applies `rossoctl.io/type: agent` to the Deployment, and the AgentCardSync controller auto-creates an AgentCard named `weather-agent-deployment-card` (pattern: `{name}-{kind}-card`):
 
 ```yaml
 apiVersion: apps/v1
@@ -161,7 +161,7 @@ metadata:
   namespace: default
   labels:
     app.kubernetes.io/name: weather-agent
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -174,14 +174,14 @@ spec:
     spec:
       containers:
       - name: agent
-        image: "ghcr.io/kagenti/agent-examples/weather_service:v0.0.1-alpha.3"
+        image: "ghcr.io/rossoctl/examples/weather_service:v0.0.1-alpha.3"
         ports:
         - containerPort: 8000
         env:
         - name: PORT
           value: "8000"
 ---
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent
@@ -199,7 +199,7 @@ spec:
 If you need `identityBinding.strict: true` (enforcement mode), create the AgentCard before the workload is labeled. The sync controller will skip auto-creation when it finds an existing card targeting the same workload:
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: weather-agent-deployment-card
@@ -231,7 +231,7 @@ kubectl describe agentcard weather-agent-deployment-card
 #### AgentCard Status Example
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: weather-agent-deployment-card
@@ -330,7 +330,7 @@ kubectl get agentcard weather-agent-deployment-card \
 ---
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: custom-agent-card
@@ -352,7 +352,7 @@ spec:
 | `Synced` | `True` | `SyncSucceeded` | Agent card fetched successfully |
 | `Synced` | `False` | `WorkloadNotFound` | Referenced workload does not exist |
 | `Synced` | `False` | `WorkloadNotReady` | Workload is not ready to serve |
-| `Synced` | `False` | `NoProtocol` | Workload missing `protocol.kagenti.io/<name>` label |
+| `Synced` | `False` | `NoProtocol` | Workload missing `protocol.rossoctl.io/<name>` label |
 | `Synced` | `False` | `FetchFailed` | Failed to fetch agent card from endpoint |
 | `Synced` | `False` | `SignatureInvalid` | Signature verification failed (enforce mode) |
 | `Ready` | `True` | `ReadyToServe` | Agent index ready for queries |
@@ -365,12 +365,12 @@ spec:
 
 ## Required Labels for Workload-Based Agents
 
-For Deployments and StatefulSets to be automatically discovered by the operator, the following labels are needed on the workload. `kagenti.io/type` is applied by the operator via an AgentRuntime CR (a `ValidatingAdmissionPolicy` prevents setting it directly). Protocol labels are set by the user:
+For Deployments and StatefulSets to be automatically discovered by the operator, the following labels are needed on the workload. `rossoctl.io/type` is applied by the operator via an AgentRuntime CR (a `ValidatingAdmissionPolicy` prevents setting it directly). Protocol labels are set by the user:
 
 | Label | Value | Set By | Description |
 |-------|-------|--------|-------------|
-| `kagenti.io/type` | `agent` or `tool` | Operator (via AgentRuntime) | Classifies the workload. Applied automatically when an AgentRuntime CR targets it. |
-| `protocol.kagenti.io/<name>` | `""` (existence implies support) | User | Protocol(s) the agent speaks (e.g., `protocol.kagenti.io/a2a`, `protocol.kagenti.io/mcp`). Required for AgentCard auto-creation. |
+| `rossoctl.io/type` | `agent` or `tool` | Operator (via AgentRuntime) | Classifies the workload. Applied automatically when an AgentRuntime CR targets it. |
+| `protocol.rossoctl.io/<name>` | `""` (existence implies support) | User | Protocol(s) the agent speaks (e.g., `protocol.rossoctl.io/a2a`, `protocol.rossoctl.io/mcp`). Required for AgentCard auto-creation. |
 | `app.kubernetes.io/name` | `<agent-name>` | User | Standard Kubernetes app name label (recommended) |
 
 ---
@@ -381,7 +381,7 @@ The `AgentRuntime` Custom Resource configures identity (SPIFFE) for agent and to
 
 ### API Group and Version
 
-- **API Group:** `agent.kagenti.dev`
+- **API Group:** `agent.rossoctl.dev`
 - **API Version:** `v1alpha1`
 - **Kind:** `AgentRuntime`
 - **Short Names:** `art`, `agentrt`
@@ -399,12 +399,12 @@ Both resources use the shared `TargetRef` type to reference the backing workload
 
 The controller computes the config hash from two platform layers (highest priority wins):
 
-1. **Namespace defaults** — ConfigMap with `kagenti.io/defaults=true` label in the workload's namespace
-2. **Cluster defaults** — `kagenti-platform-config` ConfigMap in `kagenti-system`
+1. **Namespace defaults** — ConfigMap with `rossoctl.io/defaults=true` label in the workload's namespace
+2. **Cluster defaults** — `rossoctl-platform-config` ConfigMap in `rossoctl-system`
 
 > **Note:** Per-CR overrides (authBridgeMode, mtlsMode) are **not** included in the controller's config hash. The webhook reads these fields at pod CREATE time.
 
-> **Note:** Feature gates (`kagenti-feature-gates`) are platform-wide policy and are **not** overrideable by namespace defaults or AgentRuntime CRs. They control which AuthBridge components (envoy proxy, SPIFFE helper, client registration) are enabled globally, and whether skill discovery (`skillDiscovery`) is active.
+> **Note:** Feature gates (`rossoctl-feature-gates`) are platform-wide policy and are **not** overrideable by namespace defaults or AgentRuntime CRs. They control which AuthBridge components (envoy proxy, SPIFFE helper, client registration) are enabled globally, and whether skill discovery (`skillDiscovery`) is active.
 
 ### Spec Fields
 
@@ -420,26 +420,26 @@ The AgentRuntime controller applies the following labels and annotations to the
 
 | Label | Value | Description |
 |-------|-------|-------------|
-| `kagenti.io/type` | `agent` or `tool` | Classifies the workload (from `spec.type`) |
-| `app.kubernetes.io/managed-by` | `kagenti-operator` | Indicates the workload is managed by the operator. Removed on AgentRuntime deletion. |
+| `rossoctl.io/type` | `agent` or `tool` | Classifies the workload (from `spec.type`) |
+| `app.kubernetes.io/managed-by` | `rossoctl-operator` | Indicates the workload is managed by the operator. Removed on AgentRuntime deletion. |
 
 **Workload metadata annotations:**
 
 | Annotation | Value | Description |
 |------------|-------|-------------|
-| `kagenti.io/skills` | JSON array of skill names | Read by the operator (not set by it) to discover linked skills. Set by the kagenti backend or the user. Value is a JSON array (e.g., `["weather-forecast","resume-reviewer"]`). Populates `status.linkedSkills` when the `skillDiscovery` feature gate is enabled. |
+| `rossoctl.io/skills` | JSON array of skill names | Read by the operator (not set by it) to discover linked skills. Set by the rossoctl backend or the user. Value is a JSON array (e.g., `["weather-forecast","resume-reviewer"]`). Populates `status.linkedSkills` when the `skillDiscovery` feature gate is enabled. |
 
 **PodTemplateSpec labels:**
 
 | Label | Value | Description |
 |-------|-------|-------------|
-| `kagenti.io/type` | `agent` or `tool` | Classifies pods spawned by this workload |
+| `rossoctl.io/type` | `agent` or `tool` | Classifies pods spawned by this workload |
 
 **PodTemplateSpec annotations:**
 
 | Annotation | Value | Description |
 |------------|-------|-------------|
-| `kagenti.io/config-hash` | SHA-256 hex string | Deterministic hash of the resolved configuration. Changes trigger rolling updates. |
+| `rossoctl.io/config-hash` | SHA-256 hex string | Deterministic hash of the resolved configuration. Changes trigger rolling updates. |
 
 ### Status Fields
 
@@ -456,12 +456,12 @@ The AgentRuntime controller applies the following labels and annotations to the
 | `TargetResolved` | True | `TargetFound` | Target Deployment/StatefulSet exists |
 | `TargetResolved` | False | `TargetNotFound` | Target workload not found; controller requeues after 30s |
 | `ConfigResolved` | True | `ConfigResolved` | Configuration merged successfully from all layers |
-| `ConfigResolved` | True | `ConfigWarning` | Configuration merged but ambiguity detected (e.g., multiple namespace defaults ConfigMaps with `kagenti.io/defaults=true`). The warning is surfaced in the condition message and as a Kubernetes event. |
+| `ConfigResolved` | True | `ConfigWarning` | Configuration merged but ambiguity detected (e.g., multiple namespace defaults ConfigMaps with `rossoctl.io/defaults=true`). The warning is surfaced in the condition message and as a Kubernetes event. |
 | `Ready` | True | `Configured` | Labels and config-hash applied to the target workload |
 | `Ready` | False | `ConfigHashError` | Failed to compute the config hash |
 | `Ready` | False | `ConfigApplyError` | Failed to apply labels/annotations to the workload |
 | `IstioMeshEnrolled` | True | `NamespaceLabeled` | Namespace labeled with `istio-discovery=enabled` and `istio.io/dataplane-mode=ambient` for Istio ambient mesh enrollment |
-| `IstioMeshEnrolled` | False | `OptedOut` | Namespace has `kagenti.io/istio-mesh=disabled` annotation; Istio mesh labels not applied |
+| `IstioMeshEnrolled` | False | `OptedOut` | Namespace has `rossoctl.io/istio-mesh=disabled` annotation; Istio mesh labels not applied |
 | `IstioMeshEnrolled` | False | `PatchFailed` | Failed to patch namespace labels (e.g., RBAC misconfiguration). Non-fatal; reconcile continues. |
 | `SkillsMounted` | True | `SkillsApplied` | OCI skill ImageVolumes applied to the target workload |
 | `SkillsMounted` | False | `FeatureGateDisabled` | Skills defined but `skillImageVolumes` feature gate is disabled |
@@ -474,7 +474,7 @@ A validating webhook prevents ownership conflicts:
 - **Duplicate targetRef rejection**: If an AgentRuntime CR already targets a given workload (same `apiVersion` + `kind` + `name`) in the same namespace, creating or updating another AgentRuntime to target the same workload is rejected at admission time.
 - **Fail-open on API errors**: If the webhook's internal list call fails (e.g., transient API server error), the request is allowed through to avoid blocking deployments. Note: the Kubernetes-level `failurePolicy` is set to `Fail`, so if the webhook pod itself is unreachable, the API server will reject AgentRuntime creates/updates. This is consistent with the AgentCard webhook.
 
-This prevents conflicting label updates where two AgentRuntime CRs with different `type` values (e.g., `agent` vs `tool`) would fight over the same workload's `kagenti.io/type` label.
+This prevents conflicting label updates where two AgentRuntime CRs with different `type` values (e.g., `agent` vs `tool`) would fight over the same workload's `rossoctl.io/type` label.
 
 - **Skill validation**: Duplicate skill names and duplicate mount paths within the same AgentRuntime are rejected.
 
@@ -483,7 +483,7 @@ This prevents conflicting label updates where two AgentRuntime CRs with differen
 #### Basic Agent Runtime
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
@@ -499,7 +499,7 @@ spec:
 #### Agent Runtime with Identity Overrides
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent-runtime
@@ -518,7 +518,7 @@ spec:
 #### Tool Runtime
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: calculator-tool-runtime
@@ -533,10 +533,10 @@ spec:
 
 #### Agent Runtime with Skill Discovery
 
-When the `skillDiscovery` feature gate is enabled, the operator reads the `kagenti.io/skills` annotation from the target workload and populates `status.linkedSkills`.
+When the `skillDiscovery` feature gate is enabled, the operator reads the `rossoctl.io/skills` annotation from the target workload and populates `status.linkedSkills`.
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: resume-agent-runtime
@@ -552,7 +552,7 @@ spec:
 To enable skill discovery:
 
 ```yaml
-# In the kagenti-feature-gates ConfigMap (kagenti-system namespace)
+# In the rossoctl-feature-gates ConfigMap (rossoctl-system namespace)
 # or via Helm values:
 featureGates:
   skillDiscovery: true
diff --git a/kagenti-operator/docs/architecture.md b/operator/docs/architecture.md
similarity index 82%
rename from kagenti-operator/docs/architecture.md
rename to operator/docs/architecture.md
index e6f4f621..d7105127 100644
--- a/kagenti-operator/docs/architecture.md
+++ b/operator/docs/architecture.md
@@ -1,6 +1,6 @@
 # Architecture
 
-This document provides a detailed overview of the Kagenti Operator architecture, including its components, workflows, and design principles.
+This document provides a detailed overview of the Rossoctl Operator architecture, including its components, workflows, and design principles.
 
 ## Table of Contents
 
@@ -16,7 +16,7 @@ This document provides a detailed overview of the Kagenti Operator architecture,
 
 ## Overview
 
-The Kagenti Operator is a Kubernetes controller that implements the [Operator Pattern](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) to automate the discovery and lifecycle management of AI agents. It follows a **Deployment-first model**: users create standard Kubernetes Deployments or StatefulSets, and the operator discovers them via `AgentCard` CRs with `targetRef`.
+The Rossoctl Operator is a Kubernetes controller that implements the [Operator Pattern](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) to automate the discovery and lifecycle management of AI agents. It follows a **Deployment-first model**: users create standard Kubernetes Deployments or StatefulSets, and the operator discovers them via `AgentCard` CRs with `targetRef`.
 
 ### Design Goals
 
@@ -39,12 +39,12 @@ The Kagenti Operator is a Kubernetes controller that implements the [Operator Pa
 - Stores agent capabilities, skills, and endpoint information
 
 #### AgentRuntime CRD
-- The declarative way to enroll a workload into the Kagenti platform
+- The declarative way to enroll a workload into the Rossoctl platform
 - Developer creates an AgentRuntime CR with `targetRef` — the controller applies labels and triggers injection
 - Platform-level config (cluster → namespace) drives the config hash; per-CR overrides are read by the webhook at pod CREATE time
 - Uses `targetRef` to reference backing workloads (Deployment, StatefulSet)
-- The `kagenti.io/type` label applied by the controller triggers the webhook's `objectSelector`
-- Developer workloads only need a `protocol.kagenti.io/a2a` label — the controller applies `kagenti.io/type` and `managed-by` labels automatically
+- The `rossoctl.io/type` label applied by the controller triggers the webhook's `objectSelector`
+- Developer workloads only need a `protocol.rossoctl.io/a2a` label — the controller applies `rossoctl.io/type` and `managed-by` labels automatically
 
 ### Controllers
 
@@ -68,9 +68,9 @@ The Kagenti Operator is a Kubernetes controller that implements the [Operator Pa
 
 #### AgentRuntime Controller
 - Watches AgentRuntime CRs, Deployments, StatefulSets, and ConfigMaps
-- Applies `kagenti.io/type` label and `kagenti.io/config-hash` annotation to target workloads
+- Applies `rossoctl.io/type` label and `rossoctl.io/config-hash` annotation to target workloads
 - Computes config hash from 2-layer merged configuration (cluster defaults → namespace defaults)
-- Discovers linked skills by reading the `kagenti.io/skills` annotation from target workloads when the `skillDiscovery` feature gate is enabled
+- Discovers linked skills by reading the `rossoctl.io/skills` annotation from target workloads when the `skillDiscovery` feature gate is enabled
 - Triggers rolling updates when configuration changes
 - On CR deletion: removes type label, managed-by label and config-hash annotation (causing the workload to lose sidecars)
 - Coordinates with the AuthBridge mutating webhook (in-process) which injects sidecars at Pod CREATE time
@@ -91,7 +91,7 @@ The Kagenti Operator is a Kubernetes controller that implements the [Operator Pa
 - **AgentRuntime Validator**: Rejects duplicate `targetRef` entries (prevents multiple AgentRuntime CRs targeting the same workload in a namespace). Uses authoritative API server reads to eliminate informer cache-lag races.
 
 #### Admission Policies
-- **Agent Label Protection (ValidatingAdmissionPolicy)**: Prevents manual application of the `kagenti.io/type` label on Deployments and StatefulSets. Only the operator's service account (via an AgentRuntime CR) is allowed to set this label. Users who attempt to add the label directly are rejected with a message directing them to create an AgentRuntime instead. The policy allows non-operator users to update workloads that already carry the label, as long as they don't change its value.
+- **Agent Label Protection (ValidatingAdmissionPolicy)**: Prevents manual application of the `rossoctl.io/type` label on Deployments and StatefulSets. Only the operator's service account (via an AgentRuntime CR) is allowed to set this label. Users who attempt to add the label directly are rejected with a message directing them to create an AgentRuntime instead. The policy allows non-operator users to update workloads that already carry the label, as long as they don't change its value.
 
 #### Signature Providers
 - **X5CProvider**: Validates `x5c` certificate chains against the SPIRE X.509 trust bundle and verifies JWS signatures using the leaf public key
@@ -109,7 +109,7 @@ graph TB
         User -->|Creates| RuntimeCR[AgentRuntime CR]
     end
 
-    subgraph "Kagenti Operator"
+    subgraph "Rossoctl Operator"
         ValidationWebhook[Validating Webhooks]
         InjectionWebhook[AuthBridge Mutating Webhook]
         VAP[Agent Label Protection VAP]
@@ -119,7 +119,7 @@ graph TB
         SpireController[SPIRE Operand Controller]
         CardCR -->|Validates| ValidationWebhook
         RuntimeCR -->|Validates| ValidationWebhook
-        Deployment -->|CREATE/UPDATE with kagenti.io/type| VAP
+        Deployment -->|CREATE/UPDATE with rossoctl.io/type| VAP
 
         ValidationWebhook -->|Valid CR| CardController
     end
@@ -219,26 +219,26 @@ The AgentRuntime Controller reconciles AgentRuntime CRs by resolving the target
 ```
 1. Fetch AgentRuntime CR
 2. Handle deletion (if marked for deletion):
-   a. Remove kagenti.io/type label from workload metadata and PodTemplateSpec
-   b. Remove kagenti.io/config-hash annotation from PodTemplateSpec (triggers rolling update)
+   a. Remove rossoctl.io/type label from workload metadata and PodTemplateSpec
+   b. Remove rossoctl.io/config-hash annotation from PodTemplateSpec (triggers rolling update)
    c. Remove managed-by label
    d. Remove finalizer
-3. Ensure kagenti.io/cleanup finalizer is present
+3. Ensure rossoctl.io/cleanup finalizer is present
 4. Resolve targetRef (verify Deployment/StatefulSet exists)
 5. Compute config hash from merged configuration:
-   a. Read cluster defaults (kagenti-platform-config)
-   b. Read cluster feature gates (kagenti-feature-gates)
+   a. Read cluster defaults (rossoctl-platform-config)
+   b. Read cluster feature gates (rossoctl-feature-gates)
       Note: feature gates are platform-wide policy — they are NOT
       overrideable by namespace defaults or AgentRuntime CRs.
-   c. Read namespace defaults (ConfigMap with kagenti.io/defaults=true)
+   c. Read namespace defaults (ConfigMap with rossoctl.io/defaults=true)
    d. Merge defaults: cluster → namespace (2-layer, no CR fields)
    e. Hash the merged result (deterministic SHA256)
    f. Surface warnings (e.g., multiple namespace defaults ConfigMaps)
       as a ConfigResolved condition on the AgentRuntime status
 6. Apply to target workload:
-   a. kagenti.io/type label on workload metadata + PodTemplateSpec
-   b. app.kubernetes.io/managed-by: kagenti-operator on workload metadata
-   c. kagenti.io/config-hash annotation on PodTemplateSpec
+   a. rossoctl.io/type label on workload metadata + PodTemplateSpec
+   b. app.kubernetes.io/managed-by: rossoctl-operator on workload metadata
+   c. rossoctl.io/config-hash annotation on PodTemplateSpec
 7. Count configured pods and update status
 ```
 
@@ -248,9 +248,9 @@ The controller and the AuthBridge mutating webhook (both in the same operator bi
 
 ```
 AgentRuntime CR created/updated
-  → Controller applies kagenti.io/type label + config-hash annotation
+  → Controller applies rossoctl.io/type label + config-hash annotation
     → PodTemplateSpec change triggers Kubernetes rolling update
-      → New Pods created with kagenti.io/type label
+      → New Pods created with rossoctl.io/type label
         → Webhook's objectSelector matches → injects AuthBridge sidecars
 ```
 
@@ -269,8 +269,8 @@ AgentRuntime CR created/updated
 | AgentRuntime | All namespaces | Primary resource |
 | Deployment | All namespaces | Re-reconcile if target workload modified externally |
 | StatefulSet | All namespaces | Re-reconcile if target workload modified externally |
-| ConfigMap (cluster) | `kagenti-system` | Recompute hash when cluster defaults change |
-| ConfigMap (namespace) | `kagenti.io/defaults=true` | Recompute hash when namespace defaults change |
+| ConfigMap (cluster) | `rossoctl-system` | Recompute hash when cluster defaults change |
+| ConfigMap (namespace) | `rossoctl.io/defaults=true` | Recompute hash when namespace defaults change |
 
 #### Conditions
 
@@ -332,7 +332,7 @@ All CRs are `operator.openshift.io/v1alpha1`, cluster-scoped, name `"cluster"`:
 
 #### Drift Correction
 
-Uses `controllerutil.CreateOrUpdate` — if a CR exists but spec differs from desired state, it is updated. If a CR is deleted, it is recreated on next reconcile (triggered by the child watch). All CRs are labeled `app.kubernetes.io/managed-by: kagenti-operator`.
+Uses `controllerutil.CreateOrUpdate` — if a CR exists but spec differs from desired state, it is updated. If a CR is deleted, it is recreated on next reconcile (triggered by the child watch). All CRs are labeled `app.kubernetes.io/managed-by: rossoctl-operator`.
 
 ### NetworkPolicy Controller
 
@@ -398,11 +398,11 @@ Source: `internal/controller/agentruntime_controller.go`
 
 | API Group | Resources | Verbs | Purpose |
 |-----------|-----------|-------|---------|
-| `agent.kagenti.dev` | `agentruntimes` | get, list, watch, create, update, patch, delete | Full lifecycle management of the primary resource |
-| `agent.kagenti.dev` | `agentruntimes/status` | get, update, patch | Set phase (Pending/Active/Error), conditions, and configuredPods count |
-| `agent.kagenti.dev` | `agentruntimes/finalizers` | update | Add/remove `kagenti.io/cleanup` finalizer for graceful deletion |
-| `apps` | `deployments`, `statefulsets` | get, list, watch, update, patch | Resolve targetRef, apply labels (`kagenti.io/type`, `managed-by`) and config-hash annotation |
-| `""` (core) | `configmaps` | get, list, watch | Read cluster defaults (`kagenti-platform-config`), feature gates (`kagenti-feature-gates`), and namespace defaults |
+| `agent.rossoctl.dev` | `agentruntimes` | get, list, watch, create, update, patch, delete | Full lifecycle management of the primary resource |
+| `agent.rossoctl.dev` | `agentruntimes/status` | get, update, patch | Set phase (Pending/Active/Error), conditions, and configuredPods count |
+| `agent.rossoctl.dev` | `agentruntimes/finalizers` | update | Add/remove `rossoctl.io/cleanup` finalizer for graceful deletion |
+| `apps` | `deployments`, `statefulsets` | get, list, watch, update, patch | Resolve targetRef, apply labels (`rossoctl.io/type`, `managed-by`) and config-hash annotation |
+| `""` (core) | `configmaps` | get, list, watch | Read cluster defaults (`rossoctl-platform-config`), feature gates (`rossoctl-feature-gates`), and namespace defaults |
 | `""` (core) | `namespaces` | get, list, watch, patch | Read and label namespaces for Istio ambient mesh enrollment |
 | `""` (core) | `pods` | get, list, watch | Count configured pods and verify ownership chains |
 | `""` (core) | `events` | create, patch | Record reconciliation events (TargetNotFound, ConfigWarning, Configured) |
@@ -413,9 +413,9 @@ Source: `internal/controller/agentcard_controller.go`
 
 | API Group | Resources | Verbs | Purpose |
 |-----------|-----------|-------|---------|
-| `agent.kagenti.dev` | `agentcards` | get, list, watch, create, update, patch, delete | Full lifecycle management |
-| `agent.kagenti.dev` | `agentcards/status` | get, update, patch | Store cached card data, sync conditions, signature results |
-| `agent.kagenti.dev` | `agentcards/finalizers` | update | Finalizer management |
+| `agent.rossoctl.dev` | `agentcards` | get, list, watch, create, update, patch, delete | Full lifecycle management |
+| `agent.rossoctl.dev` | `agentcards/status` | get, update, patch | Store cached card data, sync conditions, signature results |
+| `agent.rossoctl.dev` | `agentcards/finalizers` | update | Finalizer management |
 | `apps` | `deployments`, `statefulsets` | get, list, watch, update, patch | Resolve targetRef and propagate signature labels |
 | `""` (core) | `services` | get, list, watch | Construct service URLs for agent card fetching |
 | `""` (core) | `configmaps` | get, list, watch | Read SPIRE trust bundle for signature verification |
@@ -445,30 +445,30 @@ Source: `internal/controller/spire_operand_controller.go`
 
 - The operator uses a **ClusterRole** and **ClusterRoleBinding** in cluster-wide mode, allowing it to reconcile resources across all namespaces
 - In **namespaced mode** (`NAMESPACES2WATCH` env var), the same permissions are scoped to specific namespaces via **Role** and **RoleBinding**
-- The AgentRuntime controller reads ConfigMaps from `kagenti-system` (cluster defaults) regardless of mode — this requires cross-namespace read access
+- The AgentRuntime controller reads ConfigMaps from `rossoctl-system` (cluster defaults) regardless of mode — this requires cross-namespace read access
 - Namespace defaults ConfigMaps are read from the workload's own namespace
 
 ### Admission Control — Agent Label Protection
 
-The operator deploys a `ValidatingAdmissionPolicy` (VAP) that prevents direct application of the `kagenti.io/type` label on Deployments and StatefulSets. This label is the entry point for the entire kagenti platform (webhook injection, agent discovery, client registration), so it must only be set through the official enrollment path — creating an AgentRuntime CR.
+The operator deploys a `ValidatingAdmissionPolicy` (VAP) that prevents direct application of the `rossoctl.io/type` label on Deployments and StatefulSets. This label is the entry point for the entire rossoctl platform (webhook injection, agent discovery, client registration), so it must only be set through the official enrollment path — creating an AgentRuntime CR.
 
 #### How It Works
 
 | Layer | Purpose |
 |-------|---------|
 | **matchConstraints** | Targets CREATE and UPDATE of `apps/v1` Deployments and StatefulSets |
-| **matchConditions** | Skips evaluation when the object doesn't have `kagenti.io/type` or when the request comes from the operator's service account |
-| **validation** | On UPDATE, allows the request only if `kagenti.io/type` was already present with the same value (user is modifying other fields). On CREATE, always rejects since the label should not be set manually. |
+| **matchConditions** | Skips evaluation when the object doesn't have `rossoctl.io/type` or when the request comes from the operator's service account |
+| **validation** | On UPDATE, allows the request only if `rossoctl.io/type` was already present with the same value (user is modifying other fields). On CREATE, always rejects since the label should not be set manually. |
 
 #### Scenarios
 
 | Action | Result |
 |--------|--------|
-| User creates Deployment with `kagenti.io/type: agent` | **Rejected** — create an AgentRuntime instead |
-| User adds `kagenti.io/type` to existing Deployment | **Rejected** — create an AgentRuntime instead |
-| User changes `kagenti.io/type` from `agent` to `tool` | **Rejected** — update the AgentRuntime instead |
+| User creates Deployment with `rossoctl.io/type: agent` | **Rejected** — create an AgentRuntime instead |
+| User adds `rossoctl.io/type` to existing Deployment | **Rejected** — create an AgentRuntime instead |
+| User changes `rossoctl.io/type` from `agent` to `tool` | **Rejected** — update the AgentRuntime instead |
 | User updates Deployment that already has the label (label unchanged) | **Allowed** |
-| User removes `kagenti.io/type` from Deployment | **Allowed** (matchCondition skips — new object has no label) |
+| User removes `rossoctl.io/type` from Deployment | **Allowed** (matchCondition skips — new object has no label) |
 | Operator controller applies label via AgentRuntime | **Allowed** (service account exemption) |
 
 #### Resources
@@ -534,9 +534,9 @@ func (r *AgentCardReconciler) Reconcile(ctx context.Context, req Request) (Resul
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-operator-manager-role
+  name: rossoctl-operator-manager-role
 rules:
-  - apiGroups: ["agent.kagenti.dev"]
+  - apiGroups: ["agent.rossoctl.dev"]
     resources: ["agentcards"]
     verbs: ["*"]
 ```
@@ -552,10 +552,10 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: kagenti-operator-manager-role
+  name: rossoctl-operator-manager-role
   namespace: team1
 rules:
-  - apiGroups: ["agent.kagenti.dev"]
+  - apiGroups: ["agent.rossoctl.dev"]
     resources: ["agentcards"]
     verbs: ["*"]
 ```
diff --git a/kagenti-operator/docs/authbridge-webhook.md b/operator/docs/authbridge-webhook.md
similarity index 84%
rename from kagenti-operator/docs/authbridge-webhook.md
rename to operator/docs/authbridge-webhook.md
index 241af1ba..281ca863 100644
--- a/kagenti-operator/docs/authbridge-webhook.md
+++ b/operator/docs/authbridge-webhook.md
@@ -1,10 +1,10 @@
 # AuthBridge Webhook Design
 
-The AuthBridge webhook is a Kubernetes mutating admission webhook that injects sidecar containers into agent and tool Pods. It runs as part of the kagenti-operator binary and intercepts Pod CREATE requests to add networking, identity, and registration sidecars.
+The AuthBridge webhook is a Kubernetes mutating admission webhook that injects sidecar containers into agent and tool Pods. It runs as part of the rossoctl-operator binary and intercepts Pod CREATE requests to add networking, identity, and registration sidecars.
 
 ## Deployment Modes
 
-The webhook supports multiple deployment modes controlled by the `kagenti.io/authbridge-mode` annotation on the workload's pod template. If not set, the default is `envoy-sidecar`.
+The webhook supports multiple deployment modes controlled by the `rossoctl.io/authbridge-mode` annotation on the workload's pod template. If not set, the default is `envoy-sidecar`.
 
 | Mode | Annotation value | Image | How it works |
 |------|-----------------|-------|-------------|
@@ -16,7 +16,7 @@ The webhook supports multiple deployment modes controlled by the `kagenti.io/aut
 
 Transparent interception via iptables. All inbound/outbound traffic is redirected through Envoy, which delegates auth decisions to the authbridge binary via ext_proc gRPC. The agent is unaware of the proxy.
 
-Containers injected: `proxy-init` (init), `envoy-proxy`, `spiffe-helper`, `kagenti-client-registration`
+Containers injected: `proxy-init` (init), `envoy-proxy`, `spiffe-helper`, `rossoctl-client-registration`
 
 ### proxy-sidecar
 
@@ -27,7 +27,7 @@ Lightweight mode without Envoy or iptables. The webhook:
 3. **Injects `HTTP_PROXY`** — all app containers get `HTTP_PROXY`/`HTTPS_PROXY` env vars pointing to the forward proxy for outbound traffic
 4. Port assignment uses collision detection — scans all container ports to avoid conflicts
 
-Containers injected: `authbridge-proxy`, `spiffe-helper`, `kagenti-client-registration`
+Containers injected: `authbridge-proxy`, `spiffe-helper`, `rossoctl-client-registration`
 No init containers (no iptables).
 
 The `authbridge-proxy` container receives `REVERSE_PROXY_ADDR`, `REVERSE_PROXY_BACKEND`, and `FORWARD_PROXY_ADDR` env vars with the dynamically assigned ports. These are expanded via `${...}` placeholders in the authbridge config YAML.
@@ -46,7 +46,7 @@ The webhook can inject up to four containers depending on mode:
 | `authbridge-proxy` | sidecar | proxy-sidecar | Reverse + forward proxy for JWT validation and token exchange (uses `authbridge-light` image) |
 | `proxy-init` | init | envoy-sidecar | iptables rules to redirect traffic through envoy-proxy |
 | `spiffe-helper` | sidecar | envoy-sidecar, proxy-sidecar | Obtains and rotates SPIFFE SVIDs via the SPIRE workload API |
-| `kagenti-client-registration` | sidecar | envoy-sidecar, proxy-sidecar | Registers the workload as an OAuth2 client in Keycloak |
+| `rossoctl-client-registration` | sidecar | envoy-sidecar, proxy-sidecar | Registers the workload as an OAuth2 client in Keycloak |
 
 In envoy-sidecar mode, `proxy-init` always follows `envoy-proxy` — if envoy is skipped, proxy-init is also skipped.
 
@@ -54,15 +54,15 @@ In envoy-sidecar mode, `proxy-init` always follows `envoy-proxy` — if envoy is
 
 Injection requires **all** of the following:
 
-1. The Pod has label `kagenti.io/type=agent` (or `tool` with the `injectTools` gate enabled)
+1. The Pod has label `rossoctl.io/type=agent` (or `tool` with the `injectTools` gate enabled)
 2. A matching **AgentRuntime CR** exists in the same namespace with `spec.targetRef.name` matching the workload name
 3. The global feature gate is enabled
-4. The Pod has not opted out via `kagenti.io/inject=disabled`
+4. The Pod has not opted out via `rossoctl.io/inject=disabled`
 5. At least one sidecar passes the per-sidecar precedence chain
 
 The AgentRuntime CR requirement means Pods deployed before the CR is created will **not** receive sidecars. The AgentRuntime CR acts as the explicit trigger for injection.
 
-**Note:** The `client-registration` sidecar uses **opt-in** semantics (see [Per-Sidecar Precedence Evaluation](#phase-2-per-sidecar-precedence-evaluation)). It is only injected when `kagenti.io/client-registration-inject=true` is set; the default path is operator-managed Keycloak registration. See [Operator-Managed Client Registration](operator-managed-client-registration.md).
+**Note:** The `client-registration` sidecar uses **opt-in** semantics (see [Per-Sidecar Precedence Evaluation](#phase-2-per-sidecar-precedence-evaluation)). It is only injected when `rossoctl.io/client-registration-inject=true` is set; the default path is operator-managed Keycloak registration. See [Operator-Managed Client Registration](operator-managed-client-registration.md).
 
 ## Injection Precedence Chain
 
@@ -74,10 +74,10 @@ These checks run first in `PodMutator.InjectAuthBridge()` (`internal/webhook/inj
 
 | Order | Check | Source | Skip condition |
 |-------|-------|--------|----------------|
-| 1 | Workload type | Pod label `kagenti.io/type` | Not `agent` or `tool` |
+| 1 | Workload type | Pod label `rossoctl.io/type` | Not `agent` or `tool` |
 | 2 | Global kill switch | `featureGates.globalEnabled` | `false` |
-| 3 | Tool gate | `featureGates.injectTools` | `kagenti.io/type=tool` and gate is `false` |
-| 4 | Workload opt-out | Pod label `kagenti.io/inject` | Value is `disabled` |
+| 3 | Tool gate | `featureGates.injectTools` | `rossoctl.io/type=tool` and gate is `false` |
+| 4 | Workload opt-out | Pod label `rossoctl.io/inject` | Value is `disabled` |
 | 5 | Per-sidecar precedence | See Phase 2 | All sidecars evaluate to skip |
 | 6 | AgentRuntime CR | Matches by `spec.targetRef.name` | No matching CR found in namespace |
 
@@ -88,17 +88,17 @@ After pre-filtering passes, `PrecedenceEvaluator.Evaluate()` (`internal/webhook/
 | Layer | Source | Effect |
 |-------|--------|--------|
 | 1 (highest) | Feature gate (`featureGates.<sidecar>`) | `false` disables the sidecar cluster-wide |
-| 2 | Workload label (`kagenti.io/<sidecar>-inject`) | `false` disables the sidecar for this workload |
+| 2 | Workload label (`rossoctl.io/<sidecar>-inject`) | `false` disables the sidecar for this workload |
 
 The per-sidecar labels are:
 
 | Label | Controls |
 |-------|----------|
-| `kagenti.io/envoy-proxy-inject` | envoy-proxy + proxy-init |
-| `kagenti.io/spiffe-helper-inject` | spiffe-helper |
-| `kagenti.io/client-registration-inject` | client-registration (**opt-in**: must be `"true"` to inject) |
+| `rossoctl.io/envoy-proxy-inject` | envoy-proxy + proxy-init |
+| `rossoctl.io/spiffe-helper-inject` | spiffe-helper |
+| `rossoctl.io/client-registration-inject` | client-registration (**opt-in**: must be `"true"` to inject) |
 
-**Client-registration uses opt-in semantics**: unlike envoy-proxy and spiffe-helper (which inject by default and can be opted out), the client-registration sidecar only injects when `kagenti.io/client-registration-inject=true` is explicitly set. The default path is operator-managed Keycloak registration, which creates a Secret and mounts it via pod annotation.
+**Client-registration uses opt-in semantics**: unlike envoy-proxy and spiffe-helper (which inject by default and can be opted out), the client-registration sidecar only injects when `rossoctl.io/client-registration-inject=true` is explicitly set. The default path is operator-managed Keycloak registration, which creates a Secret and mounts it via pod annotation.
 
 If all sidecars evaluate to "skip", no mutation occurs (equivalent to a pre-filter rejection).
 
@@ -107,10 +107,10 @@ If all sidecars evaluate to "skip", no mutation occurs (equivalent to a pre-filt
 ```
 Pod CREATE request
   │
-  ├─ kagenti.io/type not agent|tool? ──→ ALLOW (no mutation)
+  ├─ rossoctl.io/type not agent|tool? ──→ ALLOW (no mutation)
   ├─ globalEnabled=false? ─────────────→ ALLOW (no mutation)
   ├─ type=tool and injectTools=false? ─→ ALLOW (no mutation)
-  ├─ kagenti.io/inject=disabled? ──────→ ALLOW (no mutation)
+  ├─ rossoctl.io/inject=disabled? ──────→ ALLOW (no mutation)
   │
   ├─ Per-sidecar precedence evaluation
   │   ├─ envoy-proxy:  gate → label → inject?
@@ -153,7 +153,7 @@ When the `perWorkloadConfigResolution` feature gate is enabled, the webhook reso
 
 ### Layer 1: PlatformConfig (compiled defaults + config file)
 
-**Source**: `internal/webhook/config/defaults.go` (compiled defaults) merged with `/etc/kagenti/config.yaml` (file overrides).
+**Source**: `internal/webhook/config/defaults.go` (compiled defaults) merged with `/etc/rossoctl/config.yaml` (file overrides).
 
 **Loaded by**: `ConfigLoader` (`internal/webhook/config/loader.go`) with fsnotify hot-reload.
 
@@ -213,7 +213,7 @@ PodMutator.InjectAuthBridge()                       ← pod_mutator.go
 
 ## Feature Gates
 
-Feature gates are loaded from `/etc/kagenti/feature-gates/feature-gates.yaml` with fsnotify hot-reload. Defined in `internal/webhook/config/feature_gates.go`.
+Feature gates are loaded from `/etc/rossoctl/feature-gates/feature-gates.yaml` with fsnotify hot-reload. Defined in `internal/webhook/config/feature_gates.go`.
 
 | Gate | Default | Effect |
 |------|---------|--------|
@@ -221,7 +221,7 @@ Feature gates are loaded from `/etc/kagenti/feature-gates/feature-gates.yaml` wi
 | `envoyProxy` | `true` | Enable/disable envoy-proxy + proxy-init injection |
 | `spiffeHelper` | `true` | Enable/disable spiffe-helper injection |
 | `clientRegistration` | `true` | Enable/disable client-registration injection |
-| `injectTools` | `false` | Allow injection for `kagenti.io/type=tool` workloads |
+| `injectTools` | `false` | Allow injection for `rossoctl.io/type=tool` workloads |
 | `perWorkloadConfigResolution` | `false` | Switch from ValueFrom refs to literal env var injection |
 
 ## Workload Name Derivation
@@ -249,7 +249,7 @@ Implementation: `deriveWorkloadName()` in `internal/webhook/v1alpha1/authbridge_
 
 ## Idempotency and Reinvocation
 
-The webhook is idempotent. If any injected container (`envoy-proxy`, `spiffe-helper`, `kagenti-client-registration`, `authbridge`) or init container (`proxy-init`) is already present in the Pod spec, the webhook skips full mutation. This is checked by `isAlreadyInjected()` in `authbridge_webhook.go` before `InjectAuthBridge()` is called.
+The webhook is idempotent. If any injected container (`envoy-proxy`, `spiffe-helper`, `rossoctl-client-registration`, `authbridge`) or init container (`proxy-init`) is already present in the Pod spec, the webhook skips full mutation. This is checked by `isAlreadyInjected()` in `authbridge_webhook.go` before `InjectAuthBridge()` is called.
 
 Additionally, each container and volume append in `InjectAuthBridge()` is guarded by `containerExists()`/`volumeExists()` checks.
 
@@ -259,7 +259,7 @@ The MutatingWebhookConfiguration uses `reinvocationPolicy: IfNeeded` so the webh
 
 When sidecars are already injected but operator-managed Keycloak client credentials are not yet mounted, the webhook applies **only** the Secret volume mounts on reinvocation:
 
-1. `NeedsKeycloakClientCredentialsVolumePatch()` checks if the Pod annotation `kagenti.io/keycloak-client-credentials-secret-name` is set but the corresponding Secret volume is missing.
+1. `NeedsKeycloakClientCredentialsVolumePatch()` checks if the Pod annotation `rossoctl.io/keycloak-client-credentials-secret-name` is set but the corresponding Secret volume is missing.
 2. If so, `ApplyKeycloakClientCredentialsSecretVolumes()` adds the Secret volume and subPath mounts (`client-id.txt`, `client-secret.txt`) into containers that have `shared-data` volume mounts.
 
 This handles the case where the operator annotates the pod template **after** the first webhook pass (e.g., the operator creates the Keycloak Secret and patches the annotation between the initial injection and a rolling restart).
@@ -270,8 +270,8 @@ Per-workload iptables overrides for proxy-init:
 
 | Annotation | Effect |
 |------------|--------|
-| `kagenti.io/outbound-ports-exclude` | Comma-separated ports appended to the mandatory 8080 exclusion |
-| `kagenti.io/inbound-ports-exclude` | Comma-separated ports excluded from inbound interception |
+| `rossoctl.io/outbound-ports-exclude` | Comma-separated ports appended to the mandatory 8080 exclusion |
+| `rossoctl.io/inbound-ports-exclude` | Comma-separated ports excluded from inbound interception |
 
 ## Key Source Files
 
diff --git a/kagenti-operator/docs/controller-webhook-interaction.md b/operator/docs/controller-webhook-interaction.md
similarity index 75%
rename from kagenti-operator/docs/controller-webhook-interaction.md
rename to operator/docs/controller-webhook-interaction.md
index 1b1891c6..192fd65f 100644
--- a/kagenti-operator/docs/controller-webhook-interaction.md
+++ b/operator/docs/controller-webhook-interaction.md
@@ -7,7 +7,7 @@ This document describes how the AgentRuntime controller and AuthBridge mutating
 The AgentRuntime system uses a two-phase model:
 
 1. **Controller phase**: The AgentRuntime controller watches CRs and applies labels + a config-hash annotation to the target workload's PodTemplateSpec. This triggers a Kubernetes rolling update.
-2. **Webhook phase**: The AuthBridge mutating webhook intercepts Pod CREATE requests. When a Pod has the `kagenti.io/type` label (applied by the controller), the webhook injects sidecar containers.
+2. **Webhook phase**: The AuthBridge mutating webhook intercepts Pod CREATE requests. When a Pod has the `rossoctl.io/type` label (applied by the controller), the webhook injects sidecar containers.
 
 The controller never mutates Pods directly. The webhook does not decide *which labels to apply* — that is encoded by the controller. However, the webhook does require a matching AgentRuntime CR to exist as a gate before injecting sidecars, and reads the CR for per-workload configuration overrides.
 
@@ -30,15 +30,15 @@ sequenceDiagram
     API-->>Ctrl: Reconcile event
 
     Ctrl->>API: Get target Deployment
-    Ctrl->>API: Get cluster defaults ConfigMap (kagenti-platform-config)
-    Ctrl->>API: Get feature gates ConfigMap (kagenti-feature-gates)
-    Ctrl->>API: List namespace defaults ConfigMaps (kagenti.io/defaults=true)
+    Ctrl->>API: Get cluster defaults ConfigMap (rossoctl-platform-config)
+    Ctrl->>API: Get feature gates ConfigMap (rossoctl-feature-gates)
+    Ctrl->>API: List namespace defaults ConfigMaps (rossoctl.io/defaults=true)
     Note over Ctrl: Merge config: cluster → namespace (2-layer)
     Note over Ctrl: Compute SHA256 config hash
 
-    Ctrl->>API: Patch Deployment:<br/>+ kagenti.io/type label<br/>+ managed-by label<br/>+ config-hash annotation on PodTemplateSpec
+    Ctrl->>API: Patch Deployment:<br/>+ rossoctl.io/type label<br/>+ managed-by label<br/>+ config-hash annotation on PodTemplateSpec
     API-->>K8s: PodTemplateSpec changed → rolling update
-    K8s->>API: Create new Pod (with kagenti.io/type label)
+    K8s->>API: Create new Pod (with rossoctl.io/type label)
     API->>WH: Mutating admission (Pod CREATE)
     WH->>API: Read AgentRuntime CR overrides
     WH->>API: Read namespace ConfigMaps
@@ -81,7 +81,7 @@ sequenceDiagram
     participant Ctrl as AgentRuntime Controller
     participant K8s as Kubernetes (ReplicaSet)
 
-    Admin->>API: Update kagenti-platform-config ConfigMap
+    Admin->>API: Update rossoctl-platform-config ConfigMap
     API-->>Ctrl: Watch fires → reconcile all affected AgentRuntimes
 
     loop For each AgentRuntime targeting a workload
@@ -109,9 +109,9 @@ sequenceDiagram
     User->>API: kubectl delete AgentRuntime CR
     API-->>Ctrl: Reconcile (deletionTimestamp set)
 
-    Note over Ctrl: Finalizer kagenti.io/cleanup is present
+    Note over Ctrl: Finalizer rossoctl.io/cleanup is present
 
-    Ctrl->>API: Patch Deployment:<br/>- Remove kagenti.io/type label<br/>- Remove kagenti.io/config-hash annotation<br/>- Remove managed-by label
+    Ctrl->>API: Patch Deployment:<br/>- Remove rossoctl.io/type label<br/>- Remove rossoctl.io/config-hash annotation<br/>- Remove managed-by label
     API-->>K8s: PodTemplateSpec changed → rolling update
     Note over K8s: New Pods lack the type label — webhook skips injection
 
@@ -140,31 +140,31 @@ The controller computes the config hash from platform-level configuration only (
 ┌──────────────────────────────────────┐
 │ Layer 2: Namespace defaults          │  ← higher precedence
 │   (ConfigMap with                    │
-│    kagenti.io/defaults=true label)   │
+│    rossoctl.io/defaults=true label)   │
 ├──────────────────────────────────────┤
 │ Layer 1: Cluster defaults            │  ← lower precedence
-│   (kagenti-platform-config in        │
-│    kagenti-system namespace)         │
+│   (rossoctl-platform-config in        │
+│    rossoctl-system namespace)         │
 └──────────────────────────────────────┘
 ```
 
 **CR-level overrides** (type, authBridgeMode, mtlsMode, skills) are **not** included in the controller's config hash. The webhook reads these fields at pod CREATE time.
 
-**Feature gates** (`kagenti-feature-gates` ConfigMap) are platform-wide policy and are **not** part of the merge hierarchy. They control which sidecar components are enabled globally and cannot be overridden by namespace defaults or AgentRuntime CRs.
+**Feature gates** (`rossoctl-feature-gates` ConfigMap) are platform-wide policy and are **not** part of the merge hierarchy. They control which sidecar components are enabled globally and cannot be overridden by namespace defaults or AgentRuntime CRs.
 
-The controller uses the merged config to compute a deterministic SHA256 hash. This hash is set as the `kagenti.io/config-hash` annotation on the workload's PodTemplateSpec. When platform config changes (cluster or namespace ConfigMaps), the hash changes, which triggers a Kubernetes rolling update. CR spec changes do **not** change the hash.
+The controller uses the merged config to compute a deterministic SHA256 hash. This hash is set as the `rossoctl.io/config-hash` annotation on the workload's PodTemplateSpec. When platform config changes (cluster or namespace ConfigMaps), the hash changes, which triggers a Kubernetes rolling update. CR spec changes do **not** change the hash.
 
 The webhook performs its own merge at Pod CREATE time, including CR overrides, to resolve the actual configuration values used for sidecar container environment variables.
 
-> **Note:** The controller and webhook use slightly different sources for layer 1. The controller reads the `kagenti-platform-config` ConfigMap from `kagenti-system` via the API server. The webhook uses compiled defaults overlaid with `/etc/kagenti/config.yaml` (PlatformConfig), which is designed to carry equivalent values. Both produce the same effective defaults in a correctly deployed cluster.
+> **Note:** The controller and webhook use slightly different sources for layer 1. The controller reads the `rossoctl-platform-config` ConfigMap from `rossoctl-system` via the API server. The webhook uses compiled defaults overlaid with `/etc/rossoctl/config.yaml` (PlatformConfig), which is designed to carry equivalent values. Both produce the same effective defaults in a correctly deployed cluster.
 
 ## Global and Cluster Configuration
 
-When workloads have the `kagenti.io/type` label (applied by the operator via an AgentRuntime CR), the webhook uses two levels of global configuration:
+When workloads have the `rossoctl.io/type` label (applied by the operator via an AgentRuntime CR), the webhook uses two levels of global configuration:
 
 ### PlatformConfig (Global Defaults)
 
-The webhook loads **PlatformConfig** at startup from compiled defaults overlaid with `/etc/kagenti/config.yaml`. This provides:
+The webhook loads **PlatformConfig** at startup from compiled defaults overlaid with `/etc/rossoctl/config.yaml`. This provides:
 
 - Sidecar container images and resource requests/limits
 - Proxy ports and UID
@@ -176,7 +176,7 @@ PlatformConfig is hot-reloaded via fsnotify when the config file changes. It for
 
 ### Feature Gates (Global Policy)
 
-Feature gates are loaded from the `kagenti-feature-gates` ConfigMap (mounted at `/etc/kagenti/feature-gates/feature-gates.yaml`) and hot-reloaded. They act as cluster-wide kill switches:
+Feature gates are loaded from the `rossoctl-feature-gates` ConfigMap (mounted at `/etc/rossoctl/feature-gates/feature-gates.yaml`) and hot-reloaded. They act as cluster-wide kill switches:
 
 | Gate | Default | Effect |
 |------|---------|--------|
@@ -184,7 +184,7 @@ Feature gates are loaded from the `kagenti-feature-gates` ConfigMap (mounted at
 | `envoyProxy` | `true` | Enable/disable envoy-proxy + proxy-init |
 | `spiffeHelper` | `true` | Enable/disable spiffe-helper |
 | `clientRegistration` | `true` | Enable/disable client-registration |
-| `injectTools` | `false` | Allow injection for `kagenti.io/type=tool` workloads |
+| `injectTools` | `false` | Allow injection for `rossoctl.io/type=tool` workloads |
 | `perWorkloadConfigResolution` | `false` | Switch from ValueFrom refs to literal env var injection |
 
 Feature gates are **not** part of the config merge — they cannot be overridden by namespace defaults or AgentRuntime CRs.
@@ -197,7 +197,7 @@ When `perWorkloadConfigResolution` is **true**, the webhook resolves all config
 
 ## AgentRuntime Required — Admission Policy
 
-A `ValidatingAdmissionPolicy` prevents the `kagenti.io/type` label from being set directly on Deployments or StatefulSets. Only the operator's service account (via the AgentRuntime controller) can apply this label. This ensures every enrolled workload has a corresponding AgentRuntime CR, which provides:
+A `ValidatingAdmissionPolicy` prevents the `rossoctl.io/type` label from being set directly on Deployments or StatefulSets. Only the operator's service account (via the AgentRuntime controller) can apply this label. This ensures every enrolled workload has a corresponding AgentRuntime CR, which provides:
 - Automatic rolling updates on config change (any layer)
 - Status reporting (phase, conditions, configured pod count)
 - Graceful cleanup via finalizer
diff --git a/kagenti-operator/docs/dev.md b/operator/docs/dev.md
similarity index 91%
rename from kagenti-operator/docs/dev.md
rename to operator/docs/dev.md
index 49b9ca20..2ae4e3f3 100644
--- a/kagenti-operator/docs/dev.md
+++ b/operator/docs/dev.md
@@ -1,6 +1,6 @@
 # Developer Guide
 
-This guide covers everything you need to know to develop, test, and contribute to the Kagenti Operator.
+This guide covers everything you need to know to develop, test, and contribute to the Rossoctl Operator.
 
 ## Table of Contents
 
@@ -36,8 +36,8 @@ The Makefile will automatically install these tools to `./bin` when needed:
 ### Clone the Repository
 
 ```bash
-git clone https://github.com/kagenti/kagenti-operator.git
-cd kagenti-operator/kagenti-operator
+git clone https://github.com/rossoctl/operator.git
+cd operator/operator
 ```
 
 ### Install Dependencies
@@ -55,7 +55,7 @@ make controller-gen kustomize setup-envtest golangci-lint
 ## Project Structure
 
 ```
-kagenti-operator/
+operator/
 ├── api/
 │   └── v1alpha1/              # CRD definitions
 │       ├── agent_types.go     # Agent CRD
@@ -169,14 +169,14 @@ kubectl get agentcards
 kubectl describe agentcard weather-agent
 
 # View logs
-kubectl logs -n kagenti-system -l control-plane=controller-manager
+kubectl logs -n rossoctl-system -l control-plane=controller-manager
 ```
 
 ### 5. Clean Up
 
 ```bash
 # Uninstall from cluster
-helm uninstall kagenti-operator -n kagenti-system
+helm uninstall rossoctl-operator -n rossoctl-system
 
 # Remove CRDs
 make uninstall
@@ -215,8 +215,8 @@ var _ = Describe("AgentCard Sync Controller", func() {
                     Name:      "test-agent",
                     Namespace: "default",
                     Labels: map[string]string{
-                        "kagenti.io/type":     "agent",
-                        "kagenti.io/protocol": "a2a",
+                        "rossoctl.io/type":     "agent",
+                        "rossoctl.io/protocol": "a2a",
                     },
                 },
                 Spec: appsv1.DeploymentSpec{
@@ -261,7 +261,7 @@ E2E tests run against a real cluster:
 
 ```bash
 # Ensure Kind cluster is running
-kind create cluster --name kagenti
+kind create cluster --name rossoctl
 
 # Run e2e tests
 make test-e2e
@@ -290,7 +290,7 @@ kubectl get agents,agentcards -w
 
 ```bash
 # Set image name
-export IMG=myregistry/kagenti-operator:v1.0.0
+export IMG=myregistry/operator:v1.0.0
 
 # Build Docker image
 make docker-build
@@ -308,7 +308,7 @@ make docker-push
 make install
 
 # Deploy operator
-make deploy IMG=myregistry/kagenti-operator:v1.0.0
+make deploy IMG=myregistry/operator:v1.0.0
 ```
 
 #### Using Helm
@@ -318,17 +318,17 @@ make deploy IMG=myregistry/kagenti-operator:v1.0.0
 make chart
 
 # Install from local chart
-helm install kagenti-operator ../charts/kagenti-operator \
-  --namespace kagenti-system \
+helm install rossoctl-operator ../charts/operator \
+  --namespace rossoctl-system \
   --create-namespace \
-  --set controllerManager.container.image.repository=myregistry/kagenti-operator \
+  --set controllerManager.container.image.repository=myregistry/operator \
   --set controllerManager.container.image.tag=v1.0.0
 
 # Or install from OCI registry
-helm install kagenti-operator \
-  oci://ghcr.io/kagenti/kagenti-operator/kagenti-operator-chart \
+helm install rossoctl-operator \
+  oci://ghcr.io/rossoctl/operator/operator-chart \
   --version 0.2.0-alpha.19 \
-  --namespace kagenti-system \
+  --namespace rossoctl-system \
   --create-namespace
 ```
 
@@ -472,7 +472,7 @@ ENTRYPOINT ["/dlv", "--listen=:2345", "--headless=true", "--api-version=2", "exe
 2. Forward port:
 
 ```bash
-kubectl port-forward -n kagenti-system deployment/kagenti-operator-controller-manager 2345:2345
+kubectl port-forward -n rossoctl-system deployment/rossoctl-operator-controller-manager 2345:2345
 ```
 
 3. Connect with your IDE's debugger
@@ -481,7 +481,7 @@ kubectl port-forward -n kagenti-system deployment/kagenti-operator-controller-ma
 
 ```bash
 # Controller logs
-kubectl logs -n kagenti-system -l control-plane=controller-manager -f
+kubectl logs -n rossoctl-system -l control-plane=controller-manager -f
 
 # Agent logs
 kubectl logs -l app.kubernetes.io/name=my-agent -f
@@ -506,7 +506,7 @@ make uninstall install
 #### AgentCard Not Syncing
 
 1. Check AgentCard status: `kubectl describe agentcard <name>`
-2. Verify the backing workload has `kagenti.io/type=agent` label
+2. Verify the backing workload has `rossoctl.io/type=agent` label
 3. Check workload readiness and service availability
 4. Review controller logs for fetch or signature errors
 
@@ -528,7 +528,7 @@ kubectl apply -f config/samples/weather-agent-image-deployment.yaml
 
 ```bash
 # Test on Kind
-export CONTEXT=kind-kagenti
+export CONTEXT=kind-rossoctl
 make install-local-chart CONTEXT=$CONTEXT
 
 # Test on OpenShift
@@ -555,7 +555,7 @@ See [Kubebuilder Book](https://book.kubebuilder.io/) for more markers.
 
 ```bash
 # View all CRDs
-kubectl get crds | grep agent.kagenti.dev
+kubectl get crds | grep agent.rossoctl.dev
 
 # View CRD schema
 kubectl explain agentcard.spec
@@ -588,8 +588,8 @@ kubectl delete agentcard my-agent-deployment-card --grace-period=0 --force
 
 ## Getting Help
 
-- **GitHub Issues**: [Report bugs or request features](https://github.com/kagenti/kagenti-operator/issues)
-- **Discussions**: [Ask questions](https://github.com/kagenti/kagenti-operator/discussions)
+- **GitHub Issues**: [Report bugs or request features](https://github.com/rossoctl/operator/issues)
+- **Discussions**: [Ask questions](https://github.com/rossoctl/operator/discussions)
 - **Contributing**: See [CONTRIBUTING.md](../CONTRIBUTING.md)
 
 ---
diff --git a/kagenti-operator/docs/dynamic-agent-discovery.md b/operator/docs/dynamic-agent-discovery.md
similarity index 90%
rename from kagenti-operator/docs/dynamic-agent-discovery.md
rename to operator/docs/dynamic-agent-discovery.md
index aa07a35c..fdd5f272 100644
--- a/kagenti-operator/docs/dynamic-agent-discovery.md
+++ b/operator/docs/dynamic-agent-discovery.md
@@ -1,6 +1,6 @@
 # Dynamic Agent Discovery
 
-This document describes the Kagenti Operator's dynamic agent discovery feature, which enables Kubernetes-native discovery and introspection of deployed AI agents.
+This document describes the Rossoctl Operator's dynamic agent discovery feature, which enables Kubernetes-native discovery and introspection of deployed AI agents.
 
 ## Overview
 
@@ -8,7 +8,7 @@ Dynamic agent discovery solves a fundamental challenge in multi-agent systems: *
 
 ## Problem Statement
 
-Agent discovery followed by invocation is a complex problem in agentic systems. Kagenti provides a straightforward, durable, and Kubernetes-native solution that:
+Agent discovery followed by invocation is a complex problem in agentic systems. Rossoctl provides a straightforward, durable, and Kubernetes-native solution that:
 
 - Works with existing Kubernetes tooling (`kubectl`, `oc`)
 - Requires no external registry or service
@@ -42,7 +42,7 @@ Exposes /.well-known/    Enables kubectl get agentcards
 
 ### 1. Workload Enrollment via AgentRuntime
 
-Agent workloads (Deployments or StatefulSets) are enrolled by creating an `AgentRuntime` CR. The operator's controller applies the `kagenti.io/type` label automatically — a `ValidatingAdmissionPolicy` prevents setting it directly on workloads.
+Agent workloads (Deployments or StatefulSets) are enrolled by creating an `AgentRuntime` CR. The operator's controller applies the `rossoctl.io/type` label automatically — a `ValidatingAdmissionPolicy` prevents setting it directly on workloads.
 
 The workload itself carries a protocol label to declare which protocol it speaks:
 
@@ -52,12 +52,12 @@ kind: Deployment
 metadata:
   name: weather-agent
   labels:
-    protocol.kagenti.io/a2a: ""        # Speaks A2A protocol
+    protocol.rossoctl.io/a2a: ""        # Speaks A2A protocol
     app.kubernetes.io/name: weather-agent
 spec:
   # ... standard Deployment spec
 ---
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: weather-agent
@@ -73,8 +73,8 @@ Multiple protocols can be declared simultaneously on the Deployment:
 
 ```yaml
   labels:
-    protocol.kagenti.io/a2a: ""        # Speaks A2A
-    protocol.kagenti.io/mcp: ""        # Also speaks MCP
+    protocol.rossoctl.io/a2a: ""        # Speaks A2A
+    protocol.rossoctl.io/mcp: ""        # Also speaks MCP
 ```
 
 ### 2. AgentCard Creation
@@ -82,7 +82,7 @@ Multiple protocols can be declared simultaneously on the Deployment:
 When a workload with appropriate labels is deployed, an AgentCard is automatically created by the AgentCardSync controller, or users can create one explicitly with `targetRef`:
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: weather-agent-deployment-card
@@ -215,7 +215,7 @@ kind: Deployment
 metadata:
   name: assistant-agent
   labels:
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
     app.kubernetes.io/name: assistant-agent
 spec:
   replicas: 1
@@ -245,7 +245,7 @@ spec:
       port: 8000
       targetPort: 8000
 ---
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: assistant-agent
@@ -257,7 +257,7 @@ spec:
     name: assistant-agent
 ```
 
-The operator applies the `kagenti.io/type: agent` label to the Deployment, and the AgentCard is created automatically by the AgentCardSync controller when both `kagenti.io/type` and a protocol label are present.
+The operator applies the `rossoctl.io/type: agent` label to the Deployment, and the AgentCard is created automatically by the AgentCardSync controller when both `rossoctl.io/type` and a protocol label are present.
 
 ### Query Agent Cards
 
@@ -272,7 +272,7 @@ kubectl get agentcard assistant-agent-card -o yaml
 kubectl get agentcards -w
 
 # Filter by protocol
-kubectl get agentcards -l protocol.kagenti.io/a2a
+kubectl get agentcards -l protocol.rossoctl.io/a2a
 ```
 
 ### Access Agent Metadata
@@ -302,7 +302,7 @@ This creates a simple entry point for:
 - Agents discovering and invoking peers
 - Dynamic multi-agent orchestration
 
-See [feature: Add an A2A MCP Bridge](https://github.com/kagenti/agent-examples/issues/84) for details.
+See [feature: Add an A2A MCP Bridge](https://github.com/rossoctl/examples/issues/84) for details.
 
 ## Status Conditions
 
@@ -362,7 +362,7 @@ kind: Role
 metadata:
   name: agent-discoverer
 rules:
-- apiGroups: ["agent.kagenti.dev"]
+- apiGroups: ["agent.rossoctl.dev"]
   resources: ["agentcards"]
   verbs: ["get", "list", "watch"]
 ```
@@ -431,5 +431,5 @@ kubectl delete agentcard <orphaned-card-name>
 - [API Reference - AgentCard](./api-reference.md#agentcard)
 - [Architecture Documentation](./architecture.md)
 - [A2A Protocol Specification](https://a2a-protocol.org/dev/specification/)
-- [GitHub Issue #303](https://github.com/kagenti/kagenti/issues/303)
-- [Pull Request #114](https://github.com/kagenti/kagenti-operator/pull/114)
+- [GitHub Issue #303](https://github.com/rossoctl/rossoctl/issues/303)
+- [Pull Request #114](https://github.com/rossoctl/operator/pull/114)
diff --git a/kagenti-operator/docs/mlflow-integration.md b/operator/docs/mlflow-integration.md
similarity index 75%
rename from kagenti-operator/docs/mlflow-integration.md
rename to operator/docs/mlflow-integration.md
index 9ca663f3..f29b2340 100644
--- a/kagenti-operator/docs/mlflow-integration.md
+++ b/operator/docs/mlflow-integration.md
@@ -1,6 +1,6 @@
 # MLflow Tracing Integration
 
-The kagenti-operator automatically integrates deployed agents with MLflow on OpenShift, using the RHOAI-managed MLflow instance (DSC `mlflowoperator`). When enabled, the operator's `MLflowReconciler` watches every Deployment labelled `kagenti.io/type=agent` and automatically discovers the MLflow tracking server, creates an experiment per agent, injects environment variables, and creates a RoleBinding for authentication. No manual environment variable configuration is required — agents that emit traces via the MLflow SDK will see them appear in MLflow automatically after deployment.
+The rossoctl-operator automatically integrates deployed agents with MLflow on OpenShift, using the RHOAI-managed MLflow instance (DSC `mlflowoperator`). When enabled, the operator's `MLflowReconciler` watches every Deployment labelled `rossoctl.io/type=agent` and automatically discovers the MLflow tracking server, creates an experiment per agent, injects environment variables, and creates a RoleBinding for authentication. No manual environment variable configuration is required — agents that emit traces via the MLflow SDK will see them appear in MLflow automatically after deployment.
 
 ## Requirements
 
@@ -46,11 +46,11 @@ The agent code must emit traces using `mlflow[kubernetes]>=3.11.1`. The `kuberne
 Set `mlflow.enable` to `true` in the operator Helm chart values:
 
 ```bash
-helm upgrade kagenti-operator ./charts/kagenti-operator \
+helm upgrade rossoctl-operator ./charts/operator \
   --set mlflow.enable=true
 ```
 
-This adds the `--enable-mlflow=true` flag to the operator manager container (see `charts/kagenti-operator/templates/manager/manager.yaml`).
+This adds the `--enable-mlflow=true` flag to the operator manager container (see `charts/operator/templates/manager/manager.yaml`).
 
 ### Via operator binary flag
 
@@ -75,10 +75,10 @@ The following annotations are set on the Deployment's PodTemplateSpec:
 
 | Annotation                          | Value                   |
 |--------------------------------------|-------------------------|
-| `mlflow.kagenti.io/experiment-id`    | Experiment ID           |
-| `mlflow.kagenti.io/experiment-name`  | Experiment name         |
-| `mlflow.kagenti.io/tracking-uri`     | MLflow tracking URI     |
-| `mlflow.kagenti.io/tracking-auth`    | `kubernetes-namespaced` |
+| `mlflow.rossoctl.io/experiment-id`    | Experiment ID           |
+| `mlflow.rossoctl.io/experiment-name`  | Experiment name         |
+| `mlflow.rossoctl.io/tracking-uri`     | MLflow tracking URI     |
+| `mlflow.rossoctl.io/tracking-auth`    | `kubernetes-namespaced` |
 
 ## Authentication & RBAC
 
@@ -87,7 +87,7 @@ The MLflow controller uses Kubernetes namespace-scoped authentication with least
 1. **Operator access**: The controller-manager's ServiceAccount is bound (via a ClusterRoleBinding shipped in the Helm chart / kustomize) to the broad `mlflow-operator-mlflow-integration` ClusterRole. This lets the operator call the MLflow REST API to create experiments. The `X-MLFLOW-WORKSPACE` header is set to the agent's namespace, scoping the experiment to that workspace.
 
 2. **Agent access (scoped)**: For each agent Deployment the controller creates:
-   - A **Role** named `kagenti-mlflow-<deployment-name>` with `get` and `update` on the `experiments` resource (API group `mlflow.kubeflow.org`), scoped to the agent's own experiment via `resourceNames`. This means agents **cannot** create/delete experiments or access `registeredmodels` or `gatewayendpoints`.
+   - A **Role** named `rossoctl-mlflow-<deployment-name>` with `get` and `update` on the `experiments` resource (API group `mlflow.kubeflow.org`), scoped to the agent's own experiment via `resourceNames`. This means agents **cannot** create/delete experiments or access `registeredmodels` or `gatewayendpoints`.
    - A **RoleBinding** with the same name that binds the agent's ServiceAccount to the scoped Role.
 
    The agent authenticates to MLflow using its projected SA token at `/var/run/secrets/kubernetes.io/serviceaccount/token`.
@@ -114,7 +114,7 @@ kubectl get deployment <agent-name> -n <namespace> \
   -o jsonpath='{.spec.template.spec.containers[0].env[*].name}' | tr ' ' '\n' | grep MLFLOW
 
 # Check the RoleBinding
-kubectl get rolebinding kagenti-mlflow-<agent-name> -n <namespace>
+kubectl get rolebinding rossoctl-mlflow-<agent-name> -n <namespace>
 
 # Check operator events
 kubectl get events -n <namespace> --field-selector reason=MLflowConfigured
diff --git a/kagenti-operator/docs/operator-managed-client-registration.md b/operator/docs/operator-managed-client-registration.md
similarity index 70%
rename from kagenti-operator/docs/operator-managed-client-registration.md
rename to operator/docs/operator-managed-client-registration.md
index bfc6c69d..e1d59c61 100644
--- a/kagenti-operator/docs/operator-managed-client-registration.md
+++ b/operator/docs/operator-managed-client-registration.md
@@ -2,7 +2,7 @@
 
 This document describes the split responsibility between the **operator controllers** and the **AuthBridge mutating webhook** for registering agent workloads as OAuth clients in Keycloak and delivering credentials to AuthBridge sidecars.
 
-Both the operator controllers and the webhook now live in a single binary in this repository (`kagenti-operator`).
+Both the operator controllers and the webhook now live in a single binary in this repository (`rossoctl-operator`).
 
 ---
 
@@ -10,7 +10,7 @@ Both the operator controllers and the webhook now live in a single binary in thi
 
 ### 1.1 Problem
 
-By default, the mutating webhook injects a **`kagenti-client-registration`** sidecar (or embeds equivalent behavior inside the combined **authbridge** container). That sidecar:
+By default, the mutating webhook injects a **`rossoctl-client-registration`** sidecar (or embeds equivalent behavior inside the combined **authbridge** container). That sidecar:
 
 - Runs **inside every pod**, uses workload identity (SPIFFE when SPIRE is enabled), and talks to Keycloak to register or refresh the OAuth client.
 - Competes for startup ordering and resources with the application and other sidecars.
@@ -19,13 +19,13 @@ Some deployments want **Envoy / SPIFFE / AuthBridge** injection to stay **pod-lo
 
 ### 1.2 Approach
 
-**By default**, agent and tool workloads use **operator-managed** Keycloak registration: the webhook does **not** inject the legacy **`kagenti-client-registration`** sidecar (and disables the registration slice in combined **authbridge**). The **operator** then:
+**By default**, agent and tool workloads use **operator-managed** Keycloak registration: the webhook does **not** inject the legacy **`rossoctl-client-registration`** sidecar (and disables the registration slice in combined **authbridge**). The **operator** then:
 
 1. Registers the workload as a Keycloak client using the **Keycloak admin API** (same conceptual contract as the sidecar).
 2. Creates a **Secret** in the workload namespace with `client-id.txt` and `client-secret.txt`.
 3. Annotates the pod template so the **webhook** can mount that Secret into every container that already uses the **`shared-data`** volume, at the **same paths** the sidecar used (`/shared/client-id.txt`, `/shared/client-secret.txt`).
 
-Workloads that need the **legacy** in-pod registration path **opt in** with `kagenti.io/client-registration-inject: "true"`; the operator skips those workloads.
+Workloads that need the **legacy** in-pod registration path **opt in** with `rossoctl.io/client-registration-inject: "true"`; the operator skips those workloads.
 
 The webhook continues to inject **proxy-init**, **envoy** / **authbridge**, and **spiffe-helper** according to existing precedence and feature gates.
 
@@ -33,7 +33,7 @@ The webhook continues to inject **proxy-init**, **envoy** / **authbridge**, and
 
 - **Fewer containers** when the sidecar path is not desired.
 - **Centralized registration** using namespace `keycloak-admin-secret` (already provisioned for the sidecar contract).
-- **Deterministic secret naming** derived from namespace and workload name (`kagenti-keycloak-client-credentials-<hash>`), with **owner references** to the Deployment or StatefulSet.
+- **Deterministic secret naming** derived from namespace and workload name (`rossoctl-keycloak-client-credentials-<hash>`), with **owner references** to the Deployment or StatefulSet.
 - **Safe ordering**: the operator creates the Secret **before** setting the pod-template annotation, so new Pods do not reference a missing Secret.
 - **Admission reinvocation**: the webhook uses `reinvocationPolicy: IfNeeded` so a second pass can add Secret volume mounts if the operator annotates the template **after** the first injection.
 
@@ -45,9 +45,9 @@ The webhook continues to inject **proxy-init**, **envoy** / **authbridge**, and
 
 | Key | Value | Meaning |
 |-----|--------|---------|
-| `kagenti.io/client-registration-inject` | absent, `"false"`, or any value other than `"true"` | **Default**: operator-managed registration; webhook does **not** inject the legacy client-registration sidecar / combined registration slice. |
-| `kagenti.io/client-registration-inject` | `"true"` | **Legacy**: webhook injects the client-registration sidecar (or enables registration in combined authbridge); operator **does not** manage registration for this workload. |
-| `kagenti.io/keycloak-client-credentials-secret-name` | Secret name | Set by the operator on the **pod template**; webhook reads it from **Pod** annotations at admission time and mounts the Secret. |
+| `rossoctl.io/client-registration-inject` | absent, `"false"`, or any value other than `"true"` | **Default**: operator-managed registration; webhook does **not** inject the legacy client-registration sidecar / combined registration slice. |
+| `rossoctl.io/client-registration-inject` | `"true"` | **Legacy**: webhook injects the client-registration sidecar (or enables registration in combined authbridge); operator **does not** manage registration for this workload. |
+| `rossoctl.io/keycloak-client-credentials-secret-name` | Secret name | Set by the operator on the **pod template**; webhook reads it from **Pod** annotations at admission time and mounts the Secret. |
 
 The label and annotation key constants are shared within the repository:
 
@@ -58,21 +58,21 @@ The label and annotation key constants are shared within the repository:
 
 The **ClientRegistration** controller watches **Deployments** and **StatefulSets** whose pod template labels satisfy:
 
-- `kagenti.io/client-registration-inject` is **not** `"true"` (legacy sidecar opt-in disables the operator for that workload).
-- `kagenti.io/type` is **`agent`**, or **`tool`** when the cluster feature gate **`injectTools`** is true (tools are skipped if `injectTools` is false).
+- `rossoctl.io/client-registration-inject` is **not** `"true"` (legacy sidecar opt-in disables the operator for that workload).
+- `rossoctl.io/type` is **`agent`**, or **`tool`** when the cluster feature gate **`injectTools`** is true (tools are skipped if `injectTools` is false).
 
 Other workloads are ignored by this controller.
 
 ### 2.3 Webhook behavior
 
-1. **Precedence**: `kagenti.io/client-registration-inject=true` **enables** injection of the client-registration sidecar / registration slice in combined authbridge; otherwise that path is off (`precedence.go`).
+1. **Precedence**: `rossoctl.io/client-registration-inject=true` **enables** injection of the client-registration sidecar / registration slice in combined authbridge; otherwise that path is off (`precedence.go`).
 2. **After** sidecars and volumes are applied, **`ApplyKeycloakClientCredentialsSecretVolumes`** runs for **every** mutation:
-   - If the pod (template) annotation `kagenti.io/keycloak-client-credentials-secret-name` is set, the webhook adds a **Secret volume** named like the Secret (`kagenti-keycloak-client-credentials-<uniq-id>`) and **subPath mounts** for `client-id.txt` and `client-secret.txt` into **each container that already has a `shared-data` volume mount**.
+   - If the pod (template) annotation `rossoctl.io/keycloak-client-credentials-secret-name` is set, the webhook adds a **Secret volume** named like the Secret (`rossoctl-keycloak-client-credentials-<uniq-id>`) and **subPath mounts** for `client-id.txt` and `client-secret.txt` into **each container that already has a `shared-data` volume mount**.
 3. **Reinvocation**: if the pod is already considered “injected” (e.g. envoy or proxy-init present) but operator mounts are still missing, **`NeedsKeycloakClientCredentialsVolumePatch`** returns true and the webhook applies **only** the operator Secret mounts (`authbridge_webhook.go`).
 
 ### 2.4 Operator reconcile flow (simplified)
 
-1. Read **cluster feature gates** (`kagenti-webhook` ConfigMap in the cluster defaults namespace). If `globalEnabled` or `clientRegistration` is false, skip.
+1. Read **cluster feature gates** (`rossoctl-webhook` ConfigMap in the cluster defaults namespace). If `globalEnabled` or `clientRegistration` is false, skip.
 2. Read **`authbridge-config`** in the workload namespace (`KEYCLOAK_URL`, `KEYCLOAK_REALM`, etc.).
 3. Read **`keycloak-admin-secret`** (admin username/password).
 4. Compute **Keycloak client ID**:
@@ -80,7 +80,7 @@ Other workloads are ignored by this controller.
    - If `--spire-trust-domain` is set: `spiffe://<trust-domain>/ns/<namespace>/sa/<serviceAccount>` (requires a **non-default** `serviceAccountName`).
 5. **Register or fetch** the client via Keycloak admin API (`internal/keycloak`).
 6. **Create or update** the credentials Secret; set **owner** to the Deployment/StatefulSet.
-7. **Patch** the pod template annotation `kagenti.io/keycloak-client-credentials-secret-name` to the deterministic secret name.
+7. **Patch** the pod template annotation `rossoctl.io/keycloak-client-credentials-secret-name` to the deterministic secret name.
 
 ### 2.5 Feature flags
 
@@ -89,7 +89,7 @@ Other workloads are ignored by this controller.
 | Operator (controller) | `--enable-operator-client-registration` (default **false**) | Master switch for the ClientRegistration controller. |
 | Operator (controller) | `--spire-trust-domain` | Required for SPIFFE-shaped client IDs; presence of this flag enables SPIRE-based registration. |
 | Operator (webhook) | `--enable-client-registration` | Cluster-wide gate for client-registration **injection** (precedence still applies). |
-| Operator (webhook) | Feature gates file (`/etc/kagenti/feature-gates/feature-gates.yaml`) | `clientRegistration`, `injectTools`, `globalEnabled`, etc., same as for injected sidecars. |
+| Operator (webhook) | Feature gates file (`/etc/rossoctl/feature-gates/feature-gates.yaml`) | `clientRegistration`, `injectTools`, `globalEnabled`, etc., same as for injected sidecars. |
 
 ---
 
@@ -99,18 +99,18 @@ Other workloads are ignored by this controller.
 
 - **`authbridge-config`** ConfigMap in the workload namespace with at least `KEYCLOAK_URL` and `KEYCLOAK_REALM`.
 - **`keycloak-admin-secret`** in the same namespace with `KEYCLOAK_ADMIN_USERNAME` and `KEYCLOAK_ADMIN_PASSWORD`.
-- **kagenti-operator** deployed with webhook enabled (`webhook.enable: true` in Helm values).
+- **rossoctl-operator** deployed with webhook enabled (`webhook.enable: true` in Helm values).
 
 ### 3.2 Workload
 
 - **Deployment** or **StatefulSet** (not bare Pods for operator ownership of Secrets).
-- An **AgentRuntime** CR targeting the workload — the operator applies `kagenti.io/type` to the Deployment/StatefulSet and its PodTemplateSpec (a `ValidatingAdmissionPolicy` prevents manual application). Do **not** set `kagenti.io/client-registration-inject: "true"` unless you require the legacy sidecar.
+- An **AgentRuntime** CR targeting the workload — the operator applies `rossoctl.io/type` to the Deployment/StatefulSet and its PodTemplateSpec (a `ValidatingAdmissionPolicy` prevents manual application). Do **not** set `rossoctl.io/client-registration-inject: "true"` unless you require the legacy sidecar.
 - For **SPIRE-enabled** namespaces: `spec.template.spec.serviceAccountName` must be a **dedicated** ServiceAccount (not `default`).
 
 ### 3.3 Operator configuration
 
 - Configure **`--spire-trust-domain`** to match the SPIRE server trust domain when SPIRE is deployed (same value as used for workload SPIFFE IDs).
-- Ensure the operator can read **`authbridge-config`** and **`keycloak-admin-secret`** in agent namespaces, and create/update **`kagenti-keycloak-client-credentials-*`** Secrets there (see RBAC below).
+- Ensure the operator can read **`authbridge-config`** and **`keycloak-admin-secret`** in agent namespaces, and create/update **`rossoctl-keycloak-client-credentials-*`** Secrets there (see RBAC below).
 
 ### 3.4 RBAC: why Secret rules are cluster-wide
 
@@ -133,7 +133,7 @@ That shape is intentional for this controller:
 ### 3.5 Webhook configuration
 
 - **`reinvocationPolicy: IfNeeded`** on the mutating webhook so late annotations still get mounts.
-- Pod template must eventually carry **`kagenti.io/keycloak-client-credentials-secret-name`** once the operator has reconciled; until then, auth consumers on `shared-data` may not see credentials (operator retries with backoff).
+- Pod template must eventually carry **`rossoctl.io/keycloak-client-credentials-secret-name`** once the operator has reconciled; until then, auth consumers on `shared-data` may not see credentials (operator retries with backoff).
 
 ---
 
@@ -141,17 +141,17 @@ That shape is intentional for this controller:
 
 ### 4.1 Recommended rollout order
 
-1. **Upgrade kagenti-operator** to a version that includes the AuthBridge webhook and ClientRegistration controller.
+1. **Upgrade rossoctl-operator** to a version that includes the AuthBridge webhook and ClientRegistration controller.
 2. **Enable the webhook** via Helm values (`webhook.enable: true`) and optionally `--enable-operator-client-registration`.
 3. **Configure** `--spire-trust-domain` if agent namespaces use SPIRE.
-4. **Remove the kagenti-extensions webhook** chart dependency from the umbrella chart once the operator webhook is verified.
+4. **Remove the rossocortex webhook** chart dependency from the umbrella chart once the operator webhook is verified.
 
 Since both the webhook and controller ship in the same binary, there is no ordering concern between them.
 
 ### 4.2 Operator-managed registration (default)
 
 1. Ensure the namespace has `authbridge-config` and `keycloak-admin-secret`.
-2. Use normal agent/tool labels; **omit** `kagenti.io/client-registration-inject: "true"` unless you need the legacy sidecar.
+2. Use normal agent/tool labels; **omit** `rossoctl.io/client-registration-inject: "true"` unless you need the legacy sidecar.
 3. If SPIRE is on, set a **dedicated** `serviceAccountName`.
 4. **Restart** or roll the workload so the operator reconciles and the webhook applies Secret mounts (including on reinvocation).
 
@@ -159,9 +159,9 @@ The operator will create or reuse the Keycloak client and Secret; the webhook wi
 
 ### 4.3 Rollback to legacy sidecar registration
 
-- Set **`kagenti.io/client-registration-inject: "true"`** on the pod template and **remove** the operator annotation `kagenti.io/keycloak-client-credentials-secret-name` if present.
+- Set **`rossoctl.io/client-registration-inject: "true"`** on the pod template and **remove** the operator annotation `rossoctl.io/keycloak-client-credentials-secret-name` if present.
 - Roll pods so the **client-registration sidecar** (or combined authbridge with registration) runs again.
-- Optionally delete operator-created Secrets named `kagenti-keycloak-client-credentials-*` after confirming Keycloak clients are recreated by the sidecar path if needed.
+- Optionally delete operator-created Secrets named `rossoctl-keycloak-client-credentials-*` after confirming Keycloak clients are recreated by the sidecar path if needed.
 
 Disabling **`--enable-operator-client-registration`** stops new reconciliation but does not remove existing annotations or Secrets; clean those up if you need a full rollback.
 
@@ -171,9 +171,9 @@ Switching from **sidecar** to **operator** registration may change the **client
 
 ### 4.5 Consolidation status
 
-The webhook and operator now live in one repository (`kagenti-operator`). This document is the single **source of truth** for the contract. Constants are co-located in the `internal/webhook/injector` package to avoid drift between annotation/label keys.
+The webhook and operator now live in one repository (`rossoctl-operator`). This document is the single **source of truth** for the contract. Constants are co-located in the `internal/webhook/injector` package to avoid drift between annotation/label keys.
 
-The webhook was previously part of `kagenti-extensions`; migration tracking is in [kagenti-extensions#266](https://github.com/kagenti/kagenti-extensions/issues/266).
+The webhook was previously part of `rossocortex`; migration tracking is in [rossocortex#266](https://github.com/rossoctl/rossocortex/issues/266).
 
 ---
 
@@ -191,5 +191,5 @@ The webhook was previously part of `kagenti-extensions`; migration tracking is i
 
 ## 6. Operational notes
 
-- If logs show **`cannot resolve Keycloak client id yet`** with reason **`--spire-trust-domain is required`**, configure the operator trust domain to match SPIRE (see platform docs / `kagenti-deps` `spire.trustDomain` on Kind installs).
+- If logs show **`cannot resolve Keycloak client id yet`** with reason **`--spire-trust-domain is required`**, configure the operator trust domain to match SPIRE (see platform docs / `rossoctl-deps` `spire.trustDomain` on Kind installs).
 - Operator reads **`authbridge-config`** via an **uncached API reader** because ConfigMaps may be excluded from the controller-runtime cache for scalability; this matches how the webhook resolves namespace config.
diff --git a/kagenti-operator/docs/operator.md b/operator/docs/operator.md
similarity index 86%
rename from kagenti-operator/docs/operator.md
rename to operator/docs/operator.md
index 475b452f..12d4ff9b 100644
--- a/kagenti-operator/docs/operator.md
+++ b/operator/docs/operator.md
@@ -1,4 +1,4 @@
-# Kagenti Operator
+# Rossoctl Operator
 
 This document presents a proposal for a Kubernetes Operator to automate the lifecycle management of AI agents within a Kubernetes cluster. The operator follows a **Deployment-first model**: users create standard Kubernetes Deployments or StatefulSets for their agents, and the operator discovers them via `AgentCard` Custom Resources with `targetRef`.
 
@@ -15,7 +15,7 @@ The `AgentCard` CR provides dynamic agent discovery by fetching and caching agen
 
 ## Deployment Modes
 
-The kagenti operator supports both cluster-wide and namespaced deployment modes. In cluster-wide mode, it uses ClusterRoleBinding to watch and reconcile resources across all namespaces. For stricter isolation, it can run in namespaced scope using the `NAMESPACES2WATCH` environment variable, allowing the operator to only manage resources in explicitly authorized namespaces while maintaining least-privilege access controls.
+The rossoctl operator supports both cluster-wide and namespaced deployment modes. In cluster-wide mode, it uses ClusterRoleBinding to watch and reconcile resources across all namespaces. For stricter isolation, it can run in namespaced scope using the `NAMESPACES2WATCH` environment variable, allowing the operator to only manage resources in explicitly authorized namespaces while maintaining least-privilege access controls.
 
 ## Architecture
 
@@ -59,7 +59,7 @@ The operator runs the following controllers:
 Reconciles `AgentCard` CRs by resolving the backing workload via `spec.targetRef` (duck typing), fetching the agent card from the workload's `/.well-known/agent-card.json` endpoint, verifying JWS signatures, evaluating SPIFFE identity binding, and updating the AgentCard status.
 
 ### AgentCard Sync Controller
-Watches Deployments and StatefulSets labeled with `kagenti.io/type=agent` and one or more `protocol.kagenti.io/<name>` labels (e.g., `protocol.kagenti.io/a2a`). Automatically creates AgentCard resources with `targetRef` pointing to the discovered workloads. Sets owner references for garbage collection.
+Watches Deployments and StatefulSets labeled with `rossoctl.io/type=agent` and one or more `protocol.rossoctl.io/<name>` labels (e.g., `protocol.rossoctl.io/a2a`). Automatically creates AgentCard resources with `targetRef` pointing to the discovered workloads. Sets owner references for garbage collection.
 
 ### SPIRE Operand Controller
 Creates and reconciles 5 SPIRE operand CRs (`operator.openshift.io/v1alpha1`) when ZTWIM CRDs are present on the cluster. CRD-gated — no feature flag needed, automatically activates on OpenShift 4.19+. Manages ZeroTrustWorkloadIdentityManager (parent), SpiffeCSIDriver, SpireServer, SpireAgent, and SpireOIDCDiscoveryProvider (children). Corrects drift on any manual change or deletion. Uses a bootstrap runnable to create the initial ZTWIM CR at startup.
diff --git a/kagenti-operator/examples/ci-agent-card.json b/operator/examples/ci-agent-card.json
similarity index 100%
rename from kagenti-operator/examples/ci-agent-card.json
rename to operator/examples/ci-agent-card.json
diff --git a/kagenti-operator/go.mod b/operator/go.mod
similarity index 99%
rename from kagenti-operator/go.mod
rename to operator/go.mod
index 2524b06d..7800a141 100644
--- a/kagenti-operator/go.mod
+++ b/operator/go.mod
@@ -1,4 +1,4 @@
-module github.com/kagenti/operator
+module github.com/rossoctl/operator
 
 go 1.26.0
 
diff --git a/kagenti-operator/go.sum b/operator/go.sum
similarity index 100%
rename from kagenti-operator/go.sum
rename to operator/go.sum
diff --git a/kagenti-operator/hack/boilerplate.go.txt b/operator/hack/boilerplate.go.txt
similarity index 100%
rename from kagenti-operator/hack/boilerplate.go.txt
rename to operator/hack/boilerplate.go.txt
diff --git a/kagenti-operator/hack/bundle-service-kind.sh b/operator/hack/bundle-service-kind.sh
similarity index 89%
rename from kagenti-operator/hack/bundle-service-kind.sh
rename to operator/hack/bundle-service-kind.sh
index 45f7d4da..e5489fa4 100755
--- a/kagenti-operator/hack/bundle-service-kind.sh
+++ b/operator/hack/bundle-service-kind.sh
@@ -5,16 +5,16 @@
 #   ./hack/bundle-service-kind.sh [kind-cluster-name] [namespace]
 #
 # Defaults:
-#   cluster:   kagenti
-#   namespace: kagenti-system
+#   cluster:   rossoctl
+#   namespace: rossoctl-system
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-CLUSTER="${1:-kagenti}"
-NAMESPACE="${2:-kagenti-system}"
+CLUSTER="${1:-rossoctl}"
+NAMESPACE="${2:-rossoctl-system}"
 IMAGE="localhost/bundle-service:latest"
 
 echo "==> Building bundle-service image"
@@ -27,8 +27,8 @@ echo "==> Ensuring namespace '${NAMESPACE}' exists"
 kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
 
 echo "==> Ensuring CRD is installed"
-if [ -f "${ROOT_DIR}/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml" ]; then
-  kubectl apply -f "${ROOT_DIR}/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml"
+if [ -f "${ROOT_DIR}/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml" ]; then
+  kubectl apply -f "${ROOT_DIR}/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml"
 fi
 
 echo "==> Applying default global AuthorizationPolicy"
@@ -50,10 +50,10 @@ kubectl apply -f - <<EOF
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 rules:
   - apiGroups:
-      - agent.kagenti.dev
+      - agent.rossoctl.dev
     resources:
       - authorizationpolicies
     verbs:
@@ -61,7 +61,7 @@ rules:
       - list
       - watch
   - apiGroups:
-      - agent.kagenti.dev
+      - agent.rossoctl.dev
     resources:
       - authorizationpolicies/status
     verbs:
@@ -72,11 +72,11 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 subjects:
   - kind: ServiceAccount
     name: bundle-service
diff --git a/kagenti-operator/hack/kind-reload-all.sh b/operator/hack/kind-reload-all.sh
similarity index 88%
rename from kagenti-operator/hack/kind-reload-all.sh
rename to operator/hack/kind-reload-all.sh
index 5b416a29..564557d1 100755
--- a/kagenti-operator/hack/kind-reload-all.sh
+++ b/operator/hack/kind-reload-all.sh
@@ -3,7 +3,7 @@
 # Creates deployments if they don't exist, updates them if they do.
 #
 # Services:
-#   1. kagenti-controller-manager (operator)
+#   1. rossoctl-controller-manager (operator)
 #   2. bundle-service (OPA bundle server)
 #   3. token-broker (OAuth token management)
 #
@@ -11,20 +11,20 @@
 #   ./hack/kind-reload-all.sh [kind-cluster-name] [namespace]
 #
 # Defaults:
-#   cluster:   kagenti
-#   namespace: kagenti-system
+#   cluster:   rossoctl
+#   namespace: rossoctl-system
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-CLUSTER="${1:-kagenti}"
-NAMESPACE="${2:-kagenti-system}"
+CLUSTER="${1:-rossoctl}"
+NAMESPACE="${2:-rossoctl-system}"
 CONTAINER_TOOL="${CONTAINER_TOOL:-docker}"
 IMAGE_TAG="$(git -C "${ROOT_DIR}" rev-parse --short HEAD)"
 
-OPERATOR_IMG="localhost/kagenti-operator:${IMAGE_TAG}"
+OPERATOR_IMG="localhost/operator:${IMAGE_TAG}"
 BUNDLE_IMG="localhost/bundle-service:${IMAGE_TAG}"
 TOKEN_BROKER_IMG="localhost/token-broker:${IMAGE_TAG}"
 
@@ -44,14 +44,14 @@ kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply
 
 echo ""
 echo "==> Ensuring CRDs are installed"
-if [ -f "${ROOT_DIR}/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml" ]; then
-  kubectl apply -f "${ROOT_DIR}/config/crd/bases/agent.kagenti.dev_authorizationpolicies.yaml"
+if [ -f "${ROOT_DIR}/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml" ]; then
+  kubectl apply -f "${ROOT_DIR}/config/crd/bases/agent.rossoctl.dev_authorizationpolicies.yaml"
 fi
 
 # --- Build images ---
 
 echo ""
-echo "==> Building kagenti-operator image"
+echo "==> Building rossoctl-operator image"
 ${CONTAINER_TOOL} build -t "${OPERATOR_IMG}" -f "${ROOT_DIR}/Dockerfile" "${ROOT_DIR}"
 
 if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
@@ -80,12 +80,12 @@ if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
   kind load docker-image "${TOKEN_BROKER_IMG}" --name "${CLUSTER}"
 fi
 
-# --- Deploy kagenti-controller-manager ---
+# --- Deploy rossoctl-controller-manager ---
 
 echo ""
-echo "==> Deploying kagenti-controller-manager"
-if kubectl get deployment kagenti-controller-manager -n "${NAMESPACE}" &>/dev/null; then
-  kubectl set image deployment/kagenti-controller-manager \
+echo "==> Deploying rossoctl-controller-manager"
+if kubectl get deployment rossoctl-controller-manager -n "${NAMESPACE}" &>/dev/null; then
+  kubectl set image deployment/rossoctl-controller-manager \
     manager="${OPERATOR_IMG}" \
     -n "${NAMESPACE}"
 else
@@ -113,10 +113,10 @@ kubectl apply -f - <<EOF
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 rules:
   - apiGroups:
-      - agent.kagenti.dev
+      - agent.rossoctl.dev
     resources:
       - authorizationpolicies
     verbs:
@@ -124,7 +124,7 @@ rules:
       - list
       - watch
   - apiGroups:
-      - agent.kagenti.dev
+      - agent.rossoctl.dev
     resources:
       - authorizationpolicies/status
     verbs:
@@ -135,11 +135,11 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kagenti-bundle-service
+  name: rossoctl-bundle-service
 subjects:
   - kind: ServiceAccount
     name: bundle-service
@@ -259,7 +259,7 @@ kubectl create secret generic github-oauth-credentials \
 echo "    OAuth secret created"
 
 # Apply the deployment manifests (single source of truth).
-# These pin namespace kagenti-system and include the OAuth-callback HTTPRoute
+# These pin namespace rossoctl-system and include the OAuth-callback HTTPRoute
 # (attached to the shared "http" gateway). The secret is created above from
 # .env, so the secret example manifest is intentionally skipped.
 DEPLOY_DIR="${ROOT_DIR}/cmd/token-broker/deploy"
@@ -296,9 +296,9 @@ fi
 # --- Wait for rollouts ---
 
 echo ""
-echo "==> Waiting for kagenti-controller-manager rollout"
-kubectl rollout status deployment/kagenti-controller-manager -n "${NAMESPACE}" --timeout=120s 2>/dev/null || \
-  echo "    WARNING: kagenti-controller-manager rollout did not complete"
+echo "==> Waiting for rossoctl-controller-manager rollout"
+kubectl rollout status deployment/rossoctl-controller-manager -n "${NAMESPACE}" --timeout=120s 2>/dev/null || \
+  echo "    WARNING: rossoctl-controller-manager rollout did not complete"
 
 if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
   echo "==> Waiting for bundle-service rollout"
@@ -326,7 +326,7 @@ if [ -f "${ROOT_DIR}/cmd/token-broker/Dockerfile" ]; then
 fi
 echo ""
 echo " Namespace: ${NAMESPACE}"
-echo "   - kagenti-controller-manager"
+echo "   - rossoctl-controller-manager"
 if [ -f "${ROOT_DIR}/cmd/bundle-service/Dockerfile" ]; then
   echo "   - bundle-service"
 fi
diff --git a/kagenti-operator/internal/agentcard/fetcher.go b/operator/internal/agentcard/fetcher.go
similarity index 99%
rename from kagenti-operator/internal/agentcard/fetcher.go
rename to operator/internal/agentcard/fetcher.go
index 390f145d..bc087b29 100644
--- a/kagenti-operator/internal/agentcard/fetcher.go
+++ b/operator/internal/agentcard/fetcher.go
@@ -36,7 +36,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 )
 
diff --git a/kagenti-operator/internal/agentcard/fetcher_test.go b/operator/internal/agentcard/fetcher_test.go
similarity index 100%
rename from kagenti-operator/internal/agentcard/fetcher_test.go
rename to operator/internal/agentcard/fetcher_test.go
diff --git a/kagenti-operator/internal/agentcard/fetcher_verified_test.go b/operator/internal/agentcard/fetcher_verified_test.go
similarity index 100%
rename from kagenti-operator/internal/agentcard/fetcher_verified_test.go
rename to operator/internal/agentcard/fetcher_verified_test.go
diff --git a/kagenti-operator/internal/bootstrap/keycloak.go b/operator/internal/bootstrap/keycloak.go
similarity index 97%
rename from kagenti-operator/internal/bootstrap/keycloak.go
rename to operator/internal/bootstrap/keycloak.go
index 59bee1b0..546c3178 100644
--- a/kagenti-operator/internal/bootstrap/keycloak.go
+++ b/operator/internal/bootstrap/keycloak.go
@@ -39,7 +39,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-const fieldManager = "kagenti-operator-bootstrap"
+const fieldManager = "rossoctl-operator-bootstrap"
 
 var (
 	keycloakGVK    = schema.GroupVersionKind{Group: "k8s.keycloak.org", Version: "v2alpha1", Kind: "Keycloak"}
@@ -352,7 +352,7 @@ func (r *KeycloakBootstrapRunnable) discoverPublicURL(ctx context.Context, log l
 
 func (r *KeycloakBootstrapRunnable) ensureTestUsersSecret(ctx context.Context, log logr.Logger) (map[string]string, error) {
 	secret := &corev1.Secret{}
-	key := types.NamespacedName{Name: "kagenti-test-users", Namespace: r.Namespace}
+	key := types.NamespacedName{Name: "rossoctl-test-users", Namespace: r.Namespace}
 	if err := r.APIReader.Get(ctx, key, secret); err == nil {
 		return map[string]string{
 			"admin-password":    string(secret.Data["admin-password"]),
@@ -360,7 +360,7 @@ func (r *KeycloakBootstrapRunnable) ensureTestUsersSecret(ctx context.Context, l
 			"ns-admin-password": string(secret.Data["ns-admin-password"]),
 		}, nil
 	} else if !errors.IsNotFound(err) {
-		return nil, fmt.Errorf("reading kagenti-test-users: %w", err)
+		return nil, fmt.Errorf("reading rossoctl-test-users: %w", err)
 	}
 
 	passwords := map[string]string{
@@ -371,7 +371,7 @@ func (r *KeycloakBootstrapRunnable) ensureTestUsersSecret(ctx context.Context, l
 
 	secret = &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "kagenti-test-users",
+			Name:      "rossoctl-test-users",
 			Namespace: r.Namespace,
 			Labels:    keycloakLabels(),
 		},
@@ -386,16 +386,16 @@ func (r *KeycloakBootstrapRunnable) ensureTestUsersSecret(ctx context.Context, l
 		if errors.IsAlreadyExists(err) {
 			return r.ensureTestUsersSecret(ctx, log)
 		}
-		return nil, fmt.Errorf("creating kagenti-test-users: %w", err)
+		return nil, fmt.Errorf("creating rossoctl-test-users: %w", err)
 	}
-	log.Info("Created kagenti-test-users Secret")
+	log.Info("Created rossoctl-test-users Secret")
 	return passwords, nil
 }
 
 func (r *KeycloakBootstrapRunnable) ensureRealmImport(ctx context.Context, log logr.Logger, passwords map[string]string, publicURL string) error {
 	realm := r.Realm
 	if realm == "" {
-		realm = "kagenti"
+		realm = "rossoctl"
 	}
 
 	name := realm + "-realm-import"
@@ -453,8 +453,8 @@ func buildRealmSpec(realm string, passwords map[string]string, publicURL string)
 
 func keycloakLabels() map[string]string {
 	return map[string]string{
-		"app":                          "kagenti",
-		"app.kubernetes.io/managed-by": "kagenti-operator",
+		"app":                          "rossoctl",
+		"app.kubernetes.io/managed-by": "rossoctl-operator",
 	}
 }
 
@@ -648,7 +648,7 @@ const realmTemplate = `{
       "emailVerified": true,
       "firstName": "Admin",
       "lastName": "User",
-      "email": "admin@kagenti.local",
+      "email": "admin@rossoctl.local",
       "credentials": [{"type": "password", "value": "__ADMIN_PASS__", "temporary": false}],
       "realmRoles": ["admin"],
       "groups": ["mlflow-admin", "mlflow"]
@@ -659,7 +659,7 @@ const realmTemplate = `{
       "emailVerified": true,
       "firstName": "Dev",
       "lastName": "User",
-      "email": "dev-user@kagenti.local",
+      "email": "dev-user@rossoctl.local",
       "credentials": [{"type": "password", "value": "__DEV_PASS__", "temporary": false}],
       "realmRoles": ["developer"],
       "groups": ["mlflow"]
@@ -670,7 +670,7 @@ const realmTemplate = `{
       "emailVerified": true,
       "firstName": "Namespace",
       "lastName": "Admin",
-      "email": "ns-admin@kagenti.local",
+      "email": "ns-admin@rossoctl.local",
       "credentials": [{"type": "password", "value": "__NSADMIN_PASS__", "temporary": false}],
       "realmRoles": ["ns-admin"],
       "groups": ["mlflow"]
@@ -796,7 +796,7 @@ const realmTemplate = `{
       ]
     },
     {
-      "name": "kagenti-platform-audience",
+      "name": "rossoctl-platform-audience",
       "description": "Adds the realm issuer URL as an audience claim so AuthBridge ext-proc accepts the token",
       "protocol": "openid-connect",
       "attributes": {
@@ -805,7 +805,7 @@ const realmTemplate = `{
       },
       "protocolMappers": [
         {
-          "name": "kagenti-platform-audience-mapper",
+          "name": "rossoctl-platform-audience-mapper",
           "protocol": "openid-connect",
           "protocolMapper": "oidc-audience-mapper",
           "config": {
@@ -818,7 +818,7 @@ const realmTemplate = `{
       ]
     }
   ],
-  "defaultDefaultClientScopes": ["openid", "email", "profile", "roles", "web-origins", "kagenti-platform-audience"],
+  "defaultDefaultClientScopes": ["openid", "email", "profile", "roles", "web-origins", "rossoctl-platform-audience"],
   "clients": [
     {
       "clientId": "mlflow",
diff --git a/kagenti-operator/internal/bootstrap/keycloak_test.go b/operator/internal/bootstrap/keycloak_test.go
similarity index 94%
rename from kagenti-operator/internal/bootstrap/keycloak_test.go
rename to operator/internal/bootstrap/keycloak_test.go
index f91d12be..5b02c6d3 100644
--- a/kagenti-operator/internal/bootstrap/keycloak_test.go
+++ b/operator/internal/bootstrap/keycloak_test.go
@@ -169,8 +169,8 @@ func TestKeycloak_CreatesTestUsersSecret(t *testing.T) {
 	}
 
 	secret := &corev1.Secret{}
-	if err := r.Client.Get(context.Background(), types.NamespacedName{Name: "kagenti-test-users", Namespace: "keycloak"}, secret); err != nil {
-		t.Fatalf("kagenti-test-users not created: %v", err)
+	if err := r.Client.Get(context.Background(), types.NamespacedName{Name: "rossoctl-test-users", Namespace: "keycloak"}, secret); err != nil {
+		t.Fatalf("rossoctl-test-users not created: %v", err)
 	}
 	if len(secret.Data["admin-password"]) == 0 {
 		t.Error("admin-password is empty")
@@ -185,7 +185,7 @@ func TestKeycloak_CreatesTestUsersSecret(t *testing.T) {
 
 func TestKeycloak_DoesNotOverwriteTestUsersSecret(t *testing.T) {
 	existingSecret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: "kagenti-test-users", Namespace: "keycloak"},
+		ObjectMeta: metav1.ObjectMeta{Name: "rossoctl-test-users", Namespace: "keycloak"},
 		Data: map[string][]byte{
 			"admin-password":    []byte("kept-admin"),
 			"dev-user-password": []byte("kept-dev"),
@@ -200,7 +200,7 @@ func TestKeycloak_DoesNotOverwriteTestUsersSecret(t *testing.T) {
 	}
 
 	secret := &corev1.Secret{}
-	_ = r.Client.Get(context.Background(), types.NamespacedName{Name: "kagenti-test-users", Namespace: "keycloak"}, secret)
+	_ = r.Client.Get(context.Background(), types.NamespacedName{Name: "rossoctl-test-users", Namespace: "keycloak"}, secret)
 	if string(secret.Data["admin-password"]) != "kept-admin" {
 		t.Errorf("test-users Secret was overwritten, got admin-password=%s", secret.Data["admin-password"])
 	}
@@ -208,7 +208,7 @@ func TestKeycloak_DoesNotOverwriteTestUsersSecret(t *testing.T) {
 
 func TestKeycloak_CreatesRealmImport(t *testing.T) {
 	r := newKeycloakRunnable()
-	r.Realm = "kagenti"
+	r.Realm = "rossoctl"
 	r.KeycloakPublicURL = "https://keycloak.example.com"
 
 	if err := r.Start(context.Background()); err != nil {
@@ -217,12 +217,12 @@ func TestKeycloak_CreatesRealmImport(t *testing.T) {
 
 	cr := &unstructured.Unstructured{}
 	cr.SetGroupVersionKind(realmImportGVK)
-	if err := r.Client.Get(context.Background(), types.NamespacedName{Name: "kagenti-realm-import", Namespace: "keycloak"}, cr); err != nil {
+	if err := r.Client.Get(context.Background(), types.NamespacedName{Name: "rossoctl-realm-import", Namespace: "keycloak"}, cr); err != nil {
 		t.Fatalf("KeycloakRealmImport not created: %v", err)
 	}
 
 	realm, _, _ := unstructured.NestedString(cr.Object, "spec", "realm", "realm")
-	if realm != "kagenti" {
+	if realm != "rossoctl" {
 		t.Errorf("unexpected realm: %s", realm)
 	}
 
diff --git a/kagenti-operator/internal/bootstrap/otel.go b/operator/internal/bootstrap/otel.go
similarity index 98%
rename from kagenti-operator/internal/bootstrap/otel.go
rename to operator/internal/bootstrap/otel.go
index 3e29541a..8da1d5b9 100644
--- a/kagenti-operator/internal/bootstrap/otel.go
+++ b/operator/internal/bootstrap/otel.go
@@ -43,7 +43,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/yaml"
 
-	"github.com/kagenti/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/mlflow"
 )
 
 const (
@@ -59,7 +59,7 @@ const (
 	configMapDataKey  = "base.yaml"
 	caBundleKey       = "ca-bundle.crt"
 	rootCAKey         = "ca.crt"
-	restartAnnotation = "kagenti.io/otel-config-hash"
+	restartAnnotation = "rossoctl.io/otel-config-hash"
 	ocpAPIGroup       = "config.openshift.io"
 	mlflowCRDGroup    = "mlflow.opendatahub.io"
 	mlflowCRDVersion  = "v1"
@@ -99,7 +99,7 @@ type OtelBootstrapRunnable struct {
 // operatorDeploymentNames lists possible Deployment names for the operator itself,
 // used to set OwnerReferences on bootstrap-created resources.
 var operatorDeploymentNames = []string{
-	"kagenti-controller-manager",
+	"rossoctl-controller-manager",
 	"controller-manager",
 }
 
@@ -228,7 +228,7 @@ func (r *OtelBootstrapRunnable) reconcileIngressCA(ctx context.Context, log logr
 				Name:      ingressCAConfigMap,
 				Namespace: r.Namespace,
 				Labels: map[string]string{
-					"app.kubernetes.io/managed-by": "kagenti-operator",
+					"app.kubernetes.io/managed-by": "rossoctl-operator",
 					"app.kubernetes.io/component":  "otel-bootstrap",
 				},
 			},
@@ -258,7 +258,7 @@ func (r *OtelBootstrapRunnable) reconcileIngressCA(ctx context.Context, log logr
 	if existing.Labels == nil {
 		existing.Labels = map[string]string{}
 	}
-	existing.Labels["app.kubernetes.io/managed-by"] = "kagenti-operator"
+	existing.Labels["app.kubernetes.io/managed-by"] = "rossoctl-operator"
 	existing.Labels["app.kubernetes.io/component"] = "otel-bootstrap"
 	if err := r.Client.Update(ctx, existing); err != nil {
 		return fmt.Errorf("updating %s ConfigMap: %w", ingressCAConfigMap, err)
@@ -320,7 +320,7 @@ func (r *OtelBootstrapRunnable) reconcileCollectorConfig(ctx context.Context, lo
 				Name:      collectorConfigMapName,
 				Namespace: r.Namespace,
 				Labels: map[string]string{
-					"app.kubernetes.io/managed-by": "kagenti-operator",
+					"app.kubernetes.io/managed-by": "rossoctl-operator",
 					"app.kubernetes.io/component":  "otel-bootstrap",
 				},
 				Annotations: map[string]string{
@@ -359,7 +359,7 @@ func (r *OtelBootstrapRunnable) reconcileCollectorConfig(ctx context.Context, lo
 	if existing.Labels == nil {
 		existing.Labels = map[string]string{}
 	}
-	existing.Labels["app.kubernetes.io/managed-by"] = "kagenti-operator"
+	existing.Labels["app.kubernetes.io/managed-by"] = "rossoctl-operator"
 	existing.Labels["app.kubernetes.io/component"] = "otel-bootstrap"
 	if err := r.Client.Update(ctx, existing); err != nil {
 		return fmt.Errorf("updating collector ConfigMap: %w", err)
@@ -388,7 +388,7 @@ func (r *OtelBootstrapRunnable) discoverMLflow(ctx context.Context, log logr.Log
 	if !crdExists {
 		log.Info("MLflow CRD (mlflows.mlflow.opendatahub.io) not found. " +
 			"MLflow presets will be skipped. If the MLflow operator is installed later, " +
-			"restart the kagenti-operator pod to pick up MLflow configuration.")
+			"restart the rossoctl-operator pod to pick up MLflow configuration.")
 		return &mlflowInfo{}, nil
 	}
 
@@ -538,7 +538,7 @@ func (r *OtelBootstrapRunnable) ensureMLflowExperiment(ctx context.Context, log
 
 	expName := r.MLflowExperimentName
 	if expName == "" {
-		expName = "kagenti-traces"
+		expName = "rossoctl-traces"
 	}
 
 	expID, err := c.CreateExperiment(ctx, expName, workspace)
diff --git a/kagenti-operator/internal/bootstrap/otel_test.go b/operator/internal/bootstrap/otel_test.go
similarity index 99%
rename from kagenti-operator/internal/bootstrap/otel_test.go
rename to operator/internal/bootstrap/otel_test.go
index efdb7a5e..17f43cc0 100644
--- a/kagenti-operator/internal/bootstrap/otel_test.go
+++ b/operator/internal/bootstrap/otel_test.go
@@ -31,10 +31,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
-	"github.com/kagenti/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/mlflow"
 )
 
-const testNamespace = "kagenti-system"
+const testNamespace = "rossoctl-system"
 
 func testScheme() *runtime.Scheme {
 	s := runtime.NewScheme()
@@ -326,7 +326,7 @@ func TestMLflowCRDPresent_OCP_WithWorkspace_SetsHeaders(t *testing.T) {
 		WithObjects(dep, cr, ingressCertCM).Build()
 	r := newRunnable(cl, isOpenShift, mlflowCRDPresent)
 	r.MLflowWorkspace = "team1"
-	r.MLflowExperimentName = "kagenti-traces"
+	r.MLflowExperimentName = "rossoctl-traces"
 	r.EnsureExperiment = func(_ context.Context, _, _ string) (string, error) {
 		return "42", nil
 	}
diff --git a/kagenti-operator/internal/bootstrap/presets.go b/operator/internal/bootstrap/presets.go
similarity index 95%
rename from kagenti-operator/internal/bootstrap/presets.go
rename to operator/internal/bootstrap/presets.go
index 86811ae8..373bf528 100644
--- a/kagenti-operator/internal/bootstrap/presets.go
+++ b/operator/internal/bootstrap/presets.go
@@ -16,9 +16,9 @@ limitations under the License.
 
 package bootstrap
 
-// OTel collector configuration presets ported from the kagenti-deps Helm chart
-// (charts/kagenti-deps/values.yaml). The assembleCollectorConfig function merges
-// these in the same order as the Helm kagenti.otel.collectorConfig helper.
+// OTel collector configuration presets ported from the rossoctl-deps Helm chart
+// (charts/rossoctl-deps/values.yaml). The assembleCollectorConfig function merges
+// these in the same order as the Helm rossoctl.otel.collectorConfig helper.
 
 const baseConfig = `
 receivers:
diff --git a/kagenti-operator/internal/bootstrap/uiconfig.go b/operator/internal/bootstrap/uiconfig.go
similarity index 94%
rename from kagenti-operator/internal/bootstrap/uiconfig.go
rename to operator/internal/bootstrap/uiconfig.go
index 62ebad59..23032362 100644
--- a/kagenti-operator/internal/bootstrap/uiconfig.go
+++ b/operator/internal/bootstrap/uiconfig.go
@@ -27,15 +27,15 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/kagenti/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/mlflow"
 )
 
 const (
-	uiConfigMapName       = "kagenti-ui-config"
+	uiConfigMapName       = "rossoctl-ui-config"
 	mlflowDashboardURLKey = "MLFLOW_DASHBOARD_URL"
 )
 
-// UIConfigBootstrapRunnable patches the kagenti-ui-config ConfigMap with the
+// UIConfigBootstrapRunnable patches the rossoctl-ui-config ConfigMap with the
 // MLflow dashboard URL. Runs once at startup; skips gracefully if MLflow or
 // the UI ConfigMap are not present.
 type UIConfigBootstrapRunnable struct {
diff --git a/kagenti-operator/internal/bootstrap/uiconfig_test.go b/operator/internal/bootstrap/uiconfig_test.go
similarity index 100%
rename from kagenti-operator/internal/bootstrap/uiconfig_test.go
rename to operator/internal/bootstrap/uiconfig_test.go
diff --git a/kagenti-operator/internal/bundleservice/bundle/builder.go b/operator/internal/bundleservice/bundle/builder.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/bundle/builder.go
rename to operator/internal/bundleservice/bundle/builder.go
diff --git a/kagenti-operator/internal/bundleservice/bundle/builder_test.go b/operator/internal/bundleservice/bundle/builder_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/bundle/builder_test.go
rename to operator/internal/bundleservice/bundle/builder_test.go
diff --git a/kagenti-operator/internal/bundleservice/bundle/hash.go b/operator/internal/bundleservice/bundle/hash.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/bundle/hash.go
rename to operator/internal/bundleservice/bundle/hash.go
diff --git a/kagenti-operator/internal/bundleservice/bundle/hash_test.go b/operator/internal/bundleservice/bundle/hash_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/bundle/hash_test.go
rename to operator/internal/bundleservice/bundle/hash_test.go
diff --git a/kagenti-operator/internal/bundleservice/cache/bundle.go b/operator/internal/bundleservice/cache/bundle.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/cache/bundle.go
rename to operator/internal/bundleservice/cache/bundle.go
diff --git a/kagenti-operator/internal/bundleservice/cache/bundle_test.go b/operator/internal/bundleservice/cache/bundle_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/cache/bundle_test.go
rename to operator/internal/bundleservice/cache/bundle_test.go
diff --git a/kagenti-operator/internal/bundleservice/cache/etag.go b/operator/internal/bundleservice/cache/etag.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/cache/etag.go
rename to operator/internal/bundleservice/cache/etag.go
diff --git a/kagenti-operator/internal/bundleservice/cache/etag_test.go b/operator/internal/bundleservice/cache/etag_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/cache/etag_test.go
rename to operator/internal/bundleservice/cache/etag_test.go
diff --git a/kagenti-operator/internal/bundleservice/cache/policy.go b/operator/internal/bundleservice/cache/policy.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/cache/policy.go
rename to operator/internal/bundleservice/cache/policy.go
diff --git a/kagenti-operator/internal/bundleservice/cache/policy_test.go b/operator/internal/bundleservice/cache/policy_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/cache/policy_test.go
rename to operator/internal/bundleservice/cache/policy_test.go
diff --git a/kagenti-operator/internal/bundleservice/handler/handler.go b/operator/internal/bundleservice/handler/handler.go
similarity index 95%
rename from kagenti-operator/internal/bundleservice/handler/handler.go
rename to operator/internal/bundleservice/handler/handler.go
index 97f6b179..b83cf1c9 100644
--- a/kagenti-operator/internal/bundleservice/handler/handler.go
+++ b/operator/internal/bundleservice/handler/handler.go
@@ -6,8 +6,8 @@ import (
 	"log/slog"
 	"net/http"
 
-	"github.com/kagenti/operator/internal/bundleservice/identity"
-	"github.com/kagenti/operator/internal/bundleservice/provider"
+	"github.com/rossoctl/operator/internal/bundleservice/identity"
+	"github.com/rossoctl/operator/internal/bundleservice/provider"
 )
 
 type BundleProvider interface {
diff --git a/kagenti-operator/internal/bundleservice/handler/handler_test.go b/operator/internal/bundleservice/handler/handler_test.go
similarity index 97%
rename from kagenti-operator/internal/bundleservice/handler/handler_test.go
rename to operator/internal/bundleservice/handler/handler_test.go
index 788bc6da..38476165 100644
--- a/kagenti-operator/internal/bundleservice/handler/handler_test.go
+++ b/operator/internal/bundleservice/handler/handler_test.go
@@ -6,8 +6,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/kagenti/operator/internal/bundleservice/identity"
-	"github.com/kagenti/operator/internal/bundleservice/provider"
+	"github.com/rossoctl/operator/internal/bundleservice/identity"
+	"github.com/rossoctl/operator/internal/bundleservice/provider"
 )
 
 type mockProvider struct {
diff --git a/kagenti-operator/internal/bundleservice/identity/identity.go b/operator/internal/bundleservice/identity/identity.go
similarity index 96%
rename from kagenti-operator/internal/bundleservice/identity/identity.go
rename to operator/internal/bundleservice/identity/identity.go
index e1d62bc9..e42b904e 100644
--- a/kagenti-operator/internal/bundleservice/identity/identity.go
+++ b/operator/internal/bundleservice/identity/identity.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/kagenti/operator/internal/bundleservice/spiffeid"
+	"github.com/rossoctl/operator/internal/bundleservice/spiffeid"
 )
 
 // ClientIdentity represents a client's namespace and name derived from the
diff --git a/kagenti-operator/internal/bundleservice/identity/identity_test.go b/operator/internal/bundleservice/identity/identity_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/identity/identity_test.go
rename to operator/internal/bundleservice/identity/identity_test.go
diff --git a/kagenti-operator/internal/bundleservice/provider/errors.go b/operator/internal/bundleservice/provider/errors.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/provider/errors.go
rename to operator/internal/bundleservice/provider/errors.go
diff --git a/kagenti-operator/internal/bundleservice/provider/provider.go b/operator/internal/bundleservice/provider/provider.go
similarity index 94%
rename from kagenti-operator/internal/bundleservice/provider/provider.go
rename to operator/internal/bundleservice/provider/provider.go
index a3008b2c..8d99ded3 100644
--- a/kagenti-operator/internal/bundleservice/provider/provider.go
+++ b/operator/internal/bundleservice/provider/provider.go
@@ -7,11 +7,11 @@ import (
 	"golang.org/x/sync/singleflight"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
-	v1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/bundleservice/bundle"
-	"github.com/kagenti/operator/internal/bundleservice/cache"
-	"github.com/kagenti/operator/internal/bundleservice/identity"
-	"github.com/kagenti/operator/internal/bundleservice/watcher"
+	v1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/bundleservice/bundle"
+	"github.com/rossoctl/operator/internal/bundleservice/cache"
+	"github.com/rossoctl/operator/internal/bundleservice/identity"
+	"github.com/rossoctl/operator/internal/bundleservice/watcher"
 )
 
 const (
diff --git a/kagenti-operator/internal/bundleservice/provider/provider_test.go b/operator/internal/bundleservice/provider/provider_test.go
similarity index 90%
rename from kagenti-operator/internal/bundleservice/provider/provider_test.go
rename to operator/internal/bundleservice/provider/provider_test.go
index 865816af..656ecd90 100644
--- a/kagenti-operator/internal/bundleservice/provider/provider_test.go
+++ b/operator/internal/bundleservice/provider/provider_test.go
@@ -12,16 +12,16 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	dynamicfake "k8s.io/client-go/dynamic/fake"
 
-	"github.com/kagenti/operator/internal/bundleservice/cache"
-	"github.com/kagenti/operator/internal/bundleservice/identity"
-	"github.com/kagenti/operator/internal/bundleservice/watcher"
+	"github.com/rossoctl/operator/internal/bundleservice/cache"
+	"github.com/rossoctl/operator/internal/bundleservice/identity"
+	"github.com/rossoctl/operator/internal/bundleservice/watcher"
 )
 
 func newFakeClient(objects ...runtime.Object) *dynamicfake.FakeDynamicClient {
 	scheme := runtime.NewScheme()
 	return dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme,
 		map[schema.GroupVersionResource]string{
-			{Group: "agent.kagenti.dev", Version: "v1alpha1", Resource: "authorizationpolicies"}: "AuthorizationPolicyList",
+			{Group: "agent.rossoctl.dev", Version: "v1alpha1", Resource: "authorizationpolicies"}: "AuthorizationPolicyList",
 		},
 		objects...,
 	)
@@ -30,7 +30,7 @@ func newFakeClient(objects ...runtime.Object) *dynamicfake.FakeDynamicClient {
 func newClientPolicy(name, ns string) *unstructured.Unstructured {
 	return &unstructured.Unstructured{
 		Object: map[string]any{
-			"apiVersion": "agent.kagenti.dev/v1alpha1",
+			"apiVersion": "agent.rossoctl.dev/v1alpha1",
 			"kind":       "AuthorizationPolicy",
 			"metadata": map[string]any{
 				"name":      name,
@@ -52,7 +52,7 @@ func newClientPolicy(name, ns string) *unstructured.Unstructured {
 func newGlobalPolicy(name, ns string) *unstructured.Unstructured {
 	return &unstructured.Unstructured{
 		Object: map[string]any{
-			"apiVersion": "agent.kagenti.dev/v1alpha1",
+			"apiVersion": "agent.rossoctl.dev/v1alpha1",
 			"kind":       "AuthorizationPolicy",
 			"metadata": map[string]any{
 				"name":      name,
@@ -78,7 +78,7 @@ func setupWatcher(t *testing.T, objects ...runtime.Object) (*watcher.Watcher, *c
 	bc := cache.NewBundleCache(100, time.Minute)
 	pc := cache.NewPolicyCache()
 
-	w := watcher.New(client, "kagenti-system", ec, bc, pc)
+	w := watcher.New(client, "rossoctl-system", ec, bc, pc)
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 	go w.Run(ctx)
@@ -152,7 +152,7 @@ func TestProvider_GetBundle_NoCRsReturnsEmptyBundle(t *testing.T) {
 }
 
 func TestProvider_GetBundle_IncludesGlobalPolicies(t *testing.T) {
-	global := newGlobalPolicy("global", "kagenti-system")
+	global := newGlobalPolicy("global", "rossoctl-system")
 	clientPol := newClientPolicy("my-agent", "default")
 	w, ec, bc, pc := setupWatcher(t, global, clientPol)
 
diff --git a/kagenti-operator/internal/bundleservice/spiffeid/spiffeid.go b/operator/internal/bundleservice/spiffeid/spiffeid.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/spiffeid/spiffeid.go
rename to operator/internal/bundleservice/spiffeid/spiffeid.go
diff --git a/kagenti-operator/internal/bundleservice/spiffeid/spiffeid_test.go b/operator/internal/bundleservice/spiffeid/spiffeid_test.go
similarity index 100%
rename from kagenti-operator/internal/bundleservice/spiffeid/spiffeid_test.go
rename to operator/internal/bundleservice/spiffeid/spiffeid_test.go
diff --git a/kagenti-operator/internal/bundleservice/watcher/watcher.go b/operator/internal/bundleservice/watcher/watcher.go
similarity index 97%
rename from kagenti-operator/internal/bundleservice/watcher/watcher.go
rename to operator/internal/bundleservice/watcher/watcher.go
index f7c6e749..f24b1b23 100644
--- a/kagenti-operator/internal/bundleservice/watcher/watcher.go
+++ b/operator/internal/bundleservice/watcher/watcher.go
@@ -10,8 +10,8 @@ import (
 	"k8s.io/client-go/dynamic/dynamicinformer"
 	"k8s.io/client-go/tools/cache"
 
-	v1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	bundlecache "github.com/kagenti/operator/internal/bundleservice/cache"
+	v1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	bundlecache "github.com/rossoctl/operator/internal/bundleservice/cache"
 )
 
 const (
diff --git a/kagenti-operator/internal/bundleservice/watcher/watcher_test.go b/operator/internal/bundleservice/watcher/watcher_test.go
similarity index 95%
rename from kagenti-operator/internal/bundleservice/watcher/watcher_test.go
rename to operator/internal/bundleservice/watcher/watcher_test.go
index 19fc0226..fe3d503e 100644
--- a/kagenti-operator/internal/bundleservice/watcher/watcher_test.go
+++ b/operator/internal/bundleservice/watcher/watcher_test.go
@@ -10,16 +10,16 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	dynamicfake "k8s.io/client-go/dynamic/fake"
 
-	bundlecache "github.com/kagenti/operator/internal/bundleservice/cache"
+	bundlecache "github.com/rossoctl/operator/internal/bundleservice/cache"
 )
 
-const testServiceNamespace = "kagenti-system"
+const testServiceNamespace = "rossoctl-system"
 
 func newFakeClient(objects ...runtime.Object) *dynamicfake.FakeDynamicClient {
 	scheme := runtime.NewScheme()
 	return dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme,
 		map[schema.GroupVersionResource]string{
-			{Group: "agent.kagenti.dev", Version: "v1alpha1", Resource: "authorizationpolicies"}: "AuthorizationPolicyList",
+			{Group: "agent.rossoctl.dev", Version: "v1alpha1", Resource: "authorizationpolicies"}: "AuthorizationPolicyList",
 		},
 		objects...,
 	)
@@ -40,7 +40,7 @@ func newPolicy(name, ns, scope, clientID string) *unstructured.Unstructured {
 	}
 	return &unstructured.Unstructured{
 		Object: map[string]any{
-			"apiVersion": "agent.kagenti.dev/v1alpha1",
+			"apiVersion": "agent.rossoctl.dev/v1alpha1",
 			"kind":       "AuthorizationPolicy",
 			"metadata": map[string]any{
 				"name":      name,
diff --git a/kagenti-operator/internal/clientreg/names.go b/operator/internal/clientreg/names.go
similarity index 86%
rename from kagenti-operator/internal/clientreg/names.go
rename to operator/internal/clientreg/names.go
index 6555f6b0..def06e59 100644
--- a/kagenti-operator/internal/clientreg/names.go
+++ b/operator/internal/clientreg/names.go
@@ -21,7 +21,7 @@ import (
 const (
 	// LabelAgentType distinguishes agents from tools; operator-managed registration runs for
 	// agents unconditionally and for tools only when the injectTools feature gate is on.
-	LabelAgentType  = "kagenti.io/type"
+	LabelAgentType  = "rossoctl.io/type"
 	LabelValueAgent = "agent"
 	// LabelValueTool matches agentv1alpha1.RuntimeTypeTool — kept here as a string to avoid
 	// importing the API package from this leaf utility.
@@ -31,7 +31,7 @@ const (
 	// and pre-populated on new pods (by the webhook) to signal the name of the Secret holding
 	// Keycloak client credentials. The webhook mounts that Secret into /shared/client-id.txt
 	// and /shared/client-secret.txt for any container that already mounts the shared-data volume.
-	AnnotationKeycloakClientSecretName = "kagenti.io/keycloak-client-credentials-secret-name"
+	AnnotationKeycloakClientSecretName = "rossoctl.io/keycloak-client-credentials-secret-name"
 )
 
 // KeycloakClientCredentialsSecretName returns the deterministic name of the Secret the
@@ -40,8 +40,8 @@ const (
 // API server, so a Secret volume can be declared before the controller has run. Kubelet will
 // retry the mount until the Secret appears.
 func KeycloakClientCredentialsSecretName(namespace, workload string) string {
-	sum := sha256.Sum256([]byte(namespace + "\000" + workload + "\000kagenti-keycloak-client-credentials"))
-	return "kagenti-keycloak-client-credentials-" + hex.EncodeToString(sum[:8])
+	sum := sha256.Sum256([]byte(namespace + "\000" + workload + "\000rossoctl-keycloak-client-credentials"))
+	return "rossoctl-keycloak-client-credentials-" + hex.EncodeToString(sum[:8])
 }
 
 // SkipReason returns a non-empty human-readable reason when operator-managed client registration
@@ -56,15 +56,15 @@ func SkipReason(labels map[string]string, injectTools bool) string {
 		return ""
 	case LabelValueTool:
 		if !injectTools {
-			return "kagenti.io/type is tool but cluster injectTools feature gate is disabled"
+			return "rossoctl.io/type is tool but cluster injectTools feature gate is disabled"
 		}
 		return ""
 	default:
 		t := labels[LabelAgentType]
 		if t == "" {
-			return "kagenti.io/type label is missing or not agent/tool"
+			return "rossoctl.io/type label is missing or not agent/tool"
 		}
-		return fmt.Sprintf("kagenti.io/type=%q is not agent or tool", t)
+		return fmt.Sprintf("rossoctl.io/type=%q is not agent or tool", t)
 	}
 }
 
diff --git a/kagenti-operator/internal/clientreg/names_test.go b/operator/internal/clientreg/names_test.go
similarity index 100%
rename from kagenti-operator/internal/clientreg/names_test.go
rename to operator/internal/clientreg/names_test.go
diff --git a/kagenti-operator/internal/controller/agentcard_controller.go b/operator/internal/controller/agentcard_controller.go
similarity index 96%
rename from kagenti-operator/internal/controller/agentcard_controller.go
rename to operator/internal/controller/agentcard_controller.go
index dfaa5e7c..2f82b0b2 100644
--- a/kagenti-operator/internal/controller/agentcard_controller.go
+++ b/operator/internal/controller/agentcard_controller.go
@@ -45,45 +45,45 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/signature"
 )
 
 const (
-	LabelAgentType       = "kagenti.io/type"
-	LabelAgentProtocol   = "kagenti.io/agent-protocol" // deprecated
-	LabelKagentiProtocol = "kagenti.io/protocol"       // deprecated; use ProtocolLabelPrefix
-	LabelValueAgent      = "agent"
+	LabelAgentType        = "rossoctl.io/type"
+	LabelAgentProtocol    = "rossoctl.io/agent-protocol" // deprecated
+	LabelRossoctlProtocol = "rossoctl.io/protocol"       // deprecated; use ProtocolLabelPrefix
+	LabelValueAgent       = "agent"
 
 	// ProtocolLabelPrefix is the label key prefix for multi-protocol support.
 	// The existence of a label with this prefix implies support for the named protocol.
-	// For example, protocol.kagenti.io/a2a on a workload means it speaks A2A.
-	ProtocolLabelPrefix = "protocol.kagenti.io/"
+	// For example, protocol.rossoctl.io/a2a on a workload means it speaks A2A.
+	ProtocolLabelPrefix = "protocol.rossoctl.io/"
 
 	// LabelSignatureVerified is used by NetworkPolicy rules to gate traffic between verified agents.
-	LabelSignatureVerified = "agent.kagenti.dev/signature-verified"
+	LabelSignatureVerified = "agent.rossoctl.dev/signature-verified"
 
 	// Deprecated: superseded by AnnotationVerifiedStatePrefix. Kept for cleanup on existing workloads.
-	AnnotationLastVerifiedState = "agent.kagenti.dev/last-verified-state"
+	AnnotationLastVerifiedState = "agent.rossoctl.dev/last-verified-state"
 
 	// AnnotationVerifiedStatePrefix stores per-card verified state on the workload.
 	// Multiple cards targeting the same workload are AND-aggregated for the label.
-	AnnotationVerifiedStatePrefix = "verified-state.agent.kagenti.dev/"
+	AnnotationVerifiedStatePrefix = "verified-state.agent.rossoctl.dev/"
 
 	// AnnotationResignTrigger is patched onto the pod template to trigger a rolling restart
 	// when the operator detects that the signing SVID is expiring or the CA has rotated.
-	AnnotationResignTrigger = "agentcard.kagenti.dev/resign-trigger"
+	AnnotationResignTrigger = "agentcard.rossoctl.dev/resign-trigger"
 
 	// AnnotationResignLeafExpiry records the LeafNotAfter of the cert that prompted the
 	// last resign-triggered restart. Prevents cyclic restarts when the SVID TTL is ≤ 2×grace:
 	// the operator skips re-triggering if the current cert's expiry matches the stored value.
-	AnnotationResignLeafExpiry = "agentcard.kagenti.dev/resign-leaf-expiry"
+	AnnotationResignLeafExpiry = "agentcard.rossoctl.dev/resign-leaf-expiry"
 
 	// AnnotationBundleHash records the trust bundle hash at the time of the last signing.
-	AnnotationBundleHash = "agentcard.kagenti.dev/bundle-hash"
+	AnnotationBundleHash = "agentcard.rossoctl.dev/bundle-hash"
 
-	AgentCardFinalizer = "agentcard.kagenti.dev/finalizer"
+	AgentCardFinalizer = "agentcard.rossoctl.dev/finalizer"
 	DefaultSyncPeriod  = 30 * time.Second
 
 	DefaultSVIDExpiryGracePeriod = 30 * time.Minute
@@ -106,7 +106,7 @@ var (
 	agentCardLogger = ctrl.Log.WithName("controller").WithName("AgentCard")
 
 	ErrWorkloadNotFound = errors.New("workload not found")
-	ErrNotAgentWorkload = errors.New("resource is not a Kagenti agent")
+	ErrNotAgentWorkload = errors.New("resource is not a Rossoctl agent")
 )
 
 type WorkloadInfo struct {
@@ -149,9 +149,9 @@ type AgentCardReconciler struct {
 	SVIDExpiryGracePeriod time.Duration
 }
 
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentcards,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentcards/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentcards/finalizers,verbs=update
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentcards,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentcards/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentcards/finalizers,verbs=update
 // +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;update;patch
@@ -234,7 +234,7 @@ func (r *AgentCardReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 	protocol := getWorkloadProtocol(workload.Labels)
 	if protocol == "" {
 		if condErr := r.updateCondition(ctx, agentCard, "Synced", metav1.ConditionFalse, "NoProtocol",
-			"Workload does not have a protocol.kagenti.io/<name> label"); condErr != nil {
+			"Workload does not have a protocol.rossoctl.io/<name> label"); condErr != nil {
 			return ctrl.Result{}, condErr
 		}
 		return ctrl.Result{RequeueAfter: 1 * time.Minute}, nil
@@ -574,7 +574,7 @@ func (r *AgentCardReconciler) getWorkload(ctx context.Context, agentCard *agentv
 
 	labels := obj.GetLabels()
 	if !isAgentWorkload(labels) {
-		return nil, fmt.Errorf("%w: %s %s does not have kagenti.io/type=agent label",
+		return nil, fmt.Errorf("%w: %s %s does not have rossoctl.io/type=agent label",
 			ErrNotAgentWorkload, targetRef.Kind, targetRef.Name)
 	}
 
@@ -659,8 +659,8 @@ func hasReadyCondition(obj *unstructured.Unstructured) bool {
 }
 
 // getWorkloadProtocols returns all protocols declared on a workload via the
-// protocol.kagenti.io/<name> label prefix. Falls back to the deprecated
-// kagenti.io/protocol and kagenti.io/agent-protocol single-value labels.
+// protocol.rossoctl.io/<name> label prefix. Falls back to the deprecated
+// rossoctl.io/protocol and rossoctl.io/agent-protocol single-value labels.
 func getWorkloadProtocols(labels map[string]string) []string {
 	if labels == nil {
 		return nil
@@ -680,13 +680,13 @@ func getWorkloadProtocols(labels map[string]string) []string {
 	}
 
 	// Fall back to deprecated single-value labels.
-	if protocol := labels[LabelKagentiProtocol]; protocol != "" {
-		agentCardLogger.V(1).Info("Deprecated label kagenti.io/protocol in use; migrate to protocol.kagenti.io/<name>",
+	if protocol := labels[LabelRossoctlProtocol]; protocol != "" {
+		agentCardLogger.V(1).Info("Deprecated label rossoctl.io/protocol in use; migrate to protocol.rossoctl.io/<name>",
 			"protocol", protocol)
 		return []string{protocol}
 	}
 	if protocol := labels[LabelAgentProtocol]; protocol != "" {
-		agentCardLogger.V(1).Info("Deprecated label kagenti.io/agent-protocol in use; migrate to protocol.kagenti.io/<name>",
+		agentCardLogger.V(1).Info("Deprecated label rossoctl.io/agent-protocol in use; migrate to protocol.rossoctl.io/<name>",
 			"protocol", protocol)
 		return []string{protocol}
 	}
@@ -714,7 +714,7 @@ func hasProtocolLabels(labels map[string]string) bool {
 			return true
 		}
 	}
-	return labels[LabelKagentiProtocol] != "" || labels[LabelAgentProtocol] != ""
+	return labels[LabelRossoctlProtocol] != "" || labels[LabelAgentProtocol] != ""
 }
 
 func (r *AgentCardReconciler) getService(ctx context.Context, namespace, name string) (*corev1.Service, error) {
diff --git a/kagenti-operator/internal/controller/agentcard_controller_test.go b/operator/internal/controller/agentcard_controller_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/agentcard_controller_test.go
rename to operator/internal/controller/agentcard_controller_test.go
index 85bcfc75..ed967d09 100644
--- a/kagenti-operator/internal/controller/agentcard_controller_test.go
+++ b/operator/internal/controller/agentcard_controller_test.go
@@ -34,8 +34,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
 )
 
 // mockFetcher implements agentcard.Fetcher for testing
@@ -704,7 +704,7 @@ var _ = Describe("getWorkloadProtocol", func() {
 	It("should prefer prefix labels over deprecated single-value labels", func() {
 		labels := map[string]string{
 			ProtocolLabelPrefix + "mcp": "",
-			LabelKagentiProtocol:        "a2a",
+			LabelRossoctlProtocol:       "a2a",
 		}
 
 		protocol := getWorkloadProtocol(labels)
@@ -712,9 +712,9 @@ var _ = Describe("getWorkloadProtocol", func() {
 		Expect(protocol).To(Equal("mcp"))
 	})
 
-	It("should fall back to deprecated kagenti.io/protocol label", func() {
+	It("should fall back to deprecated rossoctl.io/protocol label", func() {
 		labels := map[string]string{
-			LabelKagentiProtocol: "a2a",
+			LabelRossoctlProtocol: "a2a",
 		}
 
 		protocol := getWorkloadProtocol(labels)
@@ -722,7 +722,7 @@ var _ = Describe("getWorkloadProtocol", func() {
 		Expect(protocol).To(Equal("a2a"))
 	})
 
-	It("should fall back to deprecated kagenti.io/agent-protocol label", func() {
+	It("should fall back to deprecated rossoctl.io/agent-protocol label", func() {
 		labels := map[string]string{
 			LabelAgentProtocol: "a2a",
 		}
@@ -784,9 +784,9 @@ var _ = Describe("getWorkloadProtocols", func() {
 		Expect(getWorkloadProtocols(nil)).To(BeNil())
 	})
 
-	It("should fall back to deprecated kagenti.io/protocol label", func() {
+	It("should fall back to deprecated rossoctl.io/protocol label", func() {
 		labels := map[string]string{
-			LabelKagentiProtocol: "a2a",
+			LabelRossoctlProtocol: "a2a",
 		}
 
 		protocols := getWorkloadProtocols(labels)
@@ -794,7 +794,7 @@ var _ = Describe("getWorkloadProtocols", func() {
 		Expect(protocols).To(Equal([]string{"a2a"}))
 	})
 
-	It("should fall back to deprecated kagenti.io/agent-protocol label", func() {
+	It("should fall back to deprecated rossoctl.io/agent-protocol label", func() {
 		labels := map[string]string{
 			LabelAgentProtocol: "a2a",
 		}
@@ -813,14 +813,14 @@ var _ = Describe("hasProtocolLabels", func() {
 		Expect(hasProtocolLabels(labels)).To(BeTrue())
 	})
 
-	It("should return true for deprecated kagenti.io/protocol", func() {
+	It("should return true for deprecated rossoctl.io/protocol", func() {
 		labels := map[string]string{
-			LabelKagentiProtocol: "a2a",
+			LabelRossoctlProtocol: "a2a",
 		}
 		Expect(hasProtocolLabels(labels)).To(BeTrue())
 	})
 
-	It("should return true for deprecated kagenti.io/agent-protocol", func() {
+	It("should return true for deprecated rossoctl.io/agent-protocol", func() {
 		labels := map[string]string{
 			LabelAgentProtocol: "a2a",
 		}
diff --git a/kagenti-operator/internal/controller/agentcard_networkpolicy_controller.go b/operator/internal/controller/agentcard_networkpolicy_controller.go
similarity index 97%
rename from kagenti-operator/internal/controller/agentcard_networkpolicy_controller.go
rename to operator/internal/controller/agentcard_networkpolicy_controller.go
index 03ae1044..0c5af765 100644
--- a/kagenti-operator/internal/controller/agentcard_networkpolicy_controller.go
+++ b/operator/internal/controller/agentcard_networkpolicy_controller.go
@@ -37,10 +37,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
-const NetworkPolicyFinalizer = "agentcard.kagenti.dev/network-policy"
+const NetworkPolicyFinalizer = "agentcard.rossoctl.dev/network-policy"
 
 var networkPolicyLogger = ctrl.Log.WithName("controller").WithName("AgentCardNetworkPolicy")
 
@@ -167,9 +167,9 @@ func (r *AgentCardNetworkPolicyReconciler) upsertNetworkPolicy(ctx context.Conte
 			Name:      policyName,
 			Namespace: agentCard.Namespace,
 			Labels: map[string]string{
-				"managed-by":              "kagenti-operator",
-				"kagenti.dev/agentcard":   agentCard.Name,
-				"kagenti.dev/policy-type": "identity-verification",
+				"managed-by":               "rossoctl-operator",
+				"rossoctl.dev/agentcard":   agentCard.Name,
+				"rossoctl.dev/policy-type": "identity-verification",
 			},
 		},
 		Spec: spec,
diff --git a/kagenti-operator/internal/controller/agentcard_networkpolicy_controller_test.go b/operator/internal/controller/agentcard_networkpolicy_controller_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/agentcard_networkpolicy_controller_test.go
rename to operator/internal/controller/agentcard_networkpolicy_controller_test.go
index 6b91e357..9e751f97 100644
--- a/kagenti-operator/internal/controller/agentcard_networkpolicy_controller_test.go
+++ b/operator/internal/controller/agentcard_networkpolicy_controller_test.go
@@ -31,7 +31,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 func newNPReconciler(enforce bool) *AgentCardNetworkPolicyReconciler {
@@ -39,7 +39,7 @@ func newNPReconciler(enforce bool) *AgentCardNetworkPolicyReconciler {
 		Client:                 k8sClient,
 		Scheme:                 k8sClient.Scheme(),
 		EnforceNetworkPolicies: enforce,
-		OperatorNamespace:      "kagenti-operator-system",
+		OperatorNamespace:      "rossoctl-operator-system",
 		KubeAPIServerCIDRs:     []string{"10.0.0.1/32", "10.0.0.2/32"},
 	}
 }
diff --git a/kagenti-operator/internal/controller/agentcardsync_controller.go b/operator/internal/controller/agentcardsync_controller.go
similarity index 98%
rename from kagenti-operator/internal/controller/agentcardsync_controller.go
rename to operator/internal/controller/agentcardsync_controller.go
index 195124fb..a499e58e 100644
--- a/kagenti-operator/internal/controller/agentcardsync_controller.go
+++ b/operator/internal/controller/agentcardsync_controller.go
@@ -32,7 +32,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 var syncLogger = ctrl.Log.WithName("controller").WithName("AgentCardSync")
@@ -41,7 +41,7 @@ const (
 	// LabelManagedBy identifies auto-created AgentCards so the sync controller
 	// can distinguish its own cards from manually-created ones.
 	LabelManagedBy      = "app.kubernetes.io/managed-by"
-	LabelManagedByValue = "kagenti-operator"
+	LabelManagedByValue = "rossoctl-operator"
 )
 
 // AgentCardSyncReconciler auto-creates AgentCards for labelled agent workloads.
@@ -51,7 +51,7 @@ type AgentCardSyncReconciler struct {
 	SpireTrustDomain string
 }
 
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentcards,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentcards,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch
 // +kubebuilder:rbac:groups=apps,resources=deployments/finalizers,verbs=update
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch
diff --git a/kagenti-operator/internal/controller/agentcardsync_controller_test.go b/operator/internal/controller/agentcardsync_controller_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/agentcardsync_controller_test.go
rename to operator/internal/controller/agentcardsync_controller_test.go
index a34a6cd8..ad4de1aa 100644
--- a/kagenti-operator/internal/controller/agentcardsync_controller_test.go
+++ b/operator/internal/controller/agentcardsync_controller_test.go
@@ -28,7 +28,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	"k8s.io/utils/ptr"
 )
 
@@ -48,7 +48,7 @@ var _ = Describe("AgentCardSync Controller", func() {
 		}
 
 		BeforeEach(func() {
-			By("creating a Deployment with kagenti.io/type=agent label")
+			By("creating a Deployment with rossoctl.io/type=agent label")
 			deployment := &appsv1.Deployment{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      deploymentName,
@@ -362,7 +362,7 @@ var _ = Describe("AgentCardSync Controller", func() {
 		}
 
 		BeforeEach(func() {
-			By("creating a StatefulSet with kagenti.io/type=agent label")
+			By("creating a StatefulSet with rossoctl.io/type=agent label")
 			statefulset := &appsv1.StatefulSet{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      statefulsetName,
diff --git a/kagenti-operator/internal/controller/agentruntime_config.go b/operator/internal/controller/agentruntime_config.go
similarity index 94%
rename from kagenti-operator/internal/controller/agentruntime_config.go
rename to operator/internal/controller/agentruntime_config.go
index c349be22..03415e7b 100644
--- a/kagenti-operator/internal/controller/agentruntime_config.go
+++ b/operator/internal/controller/agentruntime_config.go
@@ -32,16 +32,16 @@ import (
 
 const (
 	// ClusterDefaultsConfigMapName is the ConfigMap containing platform-wide webhook defaults.
-	ClusterDefaultsConfigMapName = "kagenti-platform-config"
+	ClusterDefaultsConfigMapName = "rossoctl-platform-config"
 
 	// ClusterFeatureGatesConfigMapName is the ConfigMap containing feature gate settings.
-	ClusterFeatureGatesConfigMapName = "kagenti-feature-gates"
+	ClusterFeatureGatesConfigMapName = "rossoctl-feature-gates"
 
 	// clusterDefaultsNamespaceDefault is the fallback namespace when POD_NAMESPACE is not set.
-	clusterDefaultsNamespaceDefault = "kagenti-system"
+	clusterDefaultsNamespaceDefault = "rossoctl-system"
 
 	// LabelNamespaceDefaults identifies namespace-level defaults ConfigMaps.
-	LabelNamespaceDefaults = "kagenti.io/defaults"
+	LabelNamespaceDefaults = "rossoctl.io/defaults"
 
 	// AuthBridgeRuntimeConfigMapName is the namespace-scoped ConfigMap that
 	// holds the authbridge runtime config (config.yaml). Edits to this
@@ -56,7 +56,7 @@ const (
 )
 
 // ClusterDefaultsNamespace is the namespace where cluster-level ConfigMaps
-// and template ConfigMaps live. Defaults to "kagenti-system"; set once to the
+// and template ConfigMaps live. Defaults to "rossoctl-system"; set once to the
 // operator's own namespace by main() via SetClusterDefaultsNamespace.
 //
 // Write-once semantics: SetClusterDefaultsNamespace must be called exactly once
@@ -114,8 +114,8 @@ func ComputeConfigHash(ctx context.Context, c client.Reader, namespace string) (
 }
 
 // resolveConfig merges the two platform configuration layers:
-// 1. Cluster defaults (ConfigMaps in kagenti-system)
-// 2. Namespace defaults (ConfigMap with kagenti.io/defaults=true label)
+// 1. Cluster defaults (ConfigMaps in rossoctl-system)
+// 2. Namespace defaults (ConfigMap with rossoctl.io/defaults=true label)
 func resolveConfig(ctx context.Context, c client.Reader, namespace string) (resolvedConfig, []string) {
 	var warnings []string
 
@@ -171,7 +171,7 @@ func readConfigMapData(ctx context.Context, c client.Reader, namespace, name str
 }
 
 // readNamespaceDefaults reads the namespace-level defaults ConfigMap.
-// Expects at most one ConfigMap with the kagenti.io/defaults=true label per namespace.
+// Expects at most one ConfigMap with the rossoctl.io/defaults=true label per namespace.
 // Returns the ConfigMap data and a warning if multiple ConfigMaps are found.
 func readNamespaceDefaults(ctx context.Context, c client.Reader, namespace string) (map[string]string, string) {
 	logger := log.FromContext(ctx)
diff --git a/kagenti-operator/internal/controller/agentruntime_config_test.go b/operator/internal/controller/agentruntime_config_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/agentruntime_config_test.go
rename to operator/internal/controller/agentruntime_config_test.go
index a28cba69..1a49e00d 100644
--- a/kagenti-operator/internal/controller/agentruntime_config_test.go
+++ b/operator/internal/controller/agentruntime_config_test.go
@@ -29,10 +29,10 @@ import (
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
-// createClusterDefaults creates the kagenti-webhook-defaults ConfigMap in envtest.
+// createClusterDefaults creates the rossoctl-webhook-defaults ConfigMap in envtest.
 func createClusterDefaults(ctx context.Context, data map[string]string) *corev1.ConfigMap {
 	// Ensure the namespace exists
 	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: ClusterDefaultsNamespace}}
@@ -49,7 +49,7 @@ func createClusterDefaults(ctx context.Context, data map[string]string) *corev1.
 	return cm
 }
 
-// createClusterFeatureGates creates the kagenti-webhook-feature-gates ConfigMap in envtest.
+// createClusterFeatureGates creates the rossoctl-webhook-feature-gates ConfigMap in envtest.
 func createClusterFeatureGates(ctx context.Context, data map[string]string) *corev1.ConfigMap {
 	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: ClusterDefaultsNamespace}}
 	_ = k8sClient.Create(ctx, ns)
diff --git a/kagenti-operator/internal/controller/agentruntime_controller.go b/operator/internal/controller/agentruntime_controller.go
similarity index 94%
rename from kagenti-operator/internal/controller/agentruntime_controller.go
rename to operator/internal/controller/agentruntime_controller.go
index 90536059..39b50acc 100644
--- a/kagenti-operator/internal/controller/agentruntime_controller.go
+++ b/operator/internal/controller/agentruntime_controller.go
@@ -47,31 +47,31 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/signature"
-	webhookconfig "github.com/kagenti/operator/internal/webhook/config"
-	"github.com/kagenti/operator/internal/workload"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/signature"
+	webhookconfig "github.com/rossoctl/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/workload"
 )
 
 const (
-	AgentRuntimeFinalizer = "kagenti.io/cleanup"
+	AgentRuntimeFinalizer = "rossoctl.io/cleanup"
 
 	// AnnotationConfigHash is the annotation applied to PodTemplateSpec to trigger rolling updates.
-	AnnotationConfigHash = "kagenti.io/config-hash"
+	AnnotationConfigHash = "rossoctl.io/config-hash"
 
 	// AnnotationSkills is read from target workloads to discover linked skills.
-	// Value is a JSON array of skill names, set by the kagenti backend or the user.
-	AnnotationSkills = "kagenti.io/skills"
+	// Value is a JSON array of skill names, set by the rossoctl backend or the user.
+	AnnotationSkills = "rossoctl.io/skills"
 
 	// AnnotationMTLSMode is the annotation applied to PodTemplateSpec to advertise the
 	// resolved mTLS posture. Read by authbridge sidecars for observability.
-	AnnotationMTLSMode = "kagenti.io/mtls-mode"
+	AnnotationMTLSMode = "rossoctl.io/mtls-mode"
 
 	// AnnotationRestartPending marks a Sandbox that was scaled to 0 and needs
 	// to be scaled back to 1 on the next reconcile cycle. Two-phase restart
 	// avoids a race with the Sandbox controller's pod-name annotation.
-	AnnotationRestartPending = "kagenti.io/restart-pending"
+	AnnotationRestartPending = "rossoctl.io/restart-pending"
 
 	// Condition types for AgentRuntime status.
 	ConditionTypeReady          = "Ready"
@@ -81,7 +81,7 @@ const (
 
 	// AnnotationLastCardFetchHash stores the change-detection key used to skip
 	// redundant card fetches when the workload's pod template has not changed.
-	AnnotationLastCardFetchHash = "agent.kagenti.dev/last-card-fetch-hash"
+	AnnotationLastCardFetchHash = "agent.rossoctl.dev/last-card-fetch-hash"
 
 	// KindSandbox is the workload kind for agent-sandbox CRs.
 	KindSandbox = "Sandbox"
@@ -132,9 +132,9 @@ func (r *AgentRuntimeReconciler) getPlatformConfig() *webhookconfig.PlatformConf
 	return webhookconfig.CompiledDefaults()
 }
 
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentruntimes,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentruntimes/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=agent.kagenti.dev,resources=agentruntimes/finalizers,verbs=update
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentruntimes,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentruntimes/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=agent.rossoctl.dev,resources=agentruntimes/finalizers,verbs=update
 // +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes,verbs=get;list;watch;update;patch
@@ -194,7 +194,7 @@ func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	}
 
 	// 4.5. Ensure required authbridge ConfigMaps exist in the namespace.
-	// Copies templates from kagenti-system if missing, matching the backend's
+	// Copies templates from rossoctl-system if missing, matching the backend's
 	// _ensure_authbridge_configmaps() semantics (create-if-not-exists).
 	if err := r.ensureNamespaceConfigMaps(ctx, rt.Namespace); err != nil {
 		logger.Error(err, "Failed to ensure namespace ConfigMaps")
@@ -244,7 +244,7 @@ func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request
 
 	// 4.8. Ensure SCC RoleBinding exists in the namespace.
 	// Creates a RoleBinding granting all ServiceAccounts in the namespace
-	// access to the kagenti-authbridge SCC. No-op on non-OpenShift clusters.
+	// access to the rossoctl-authbridge SCC. No-op on non-OpenShift clusters.
 	// On OpenShift, a transient failure is retried via requeue to prevent
 	// agent pods from failing with SCC violations at runtime.
 	if err := r.ensureNamespaceSCCBinding(ctx, rt.Namespace); err != nil {
@@ -290,7 +290,7 @@ func (r *AgentRuntimeReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
 	}
 
-	// 6.5. Discover linked skills from workload annotation (set by kagenti backend or user)
+	// 6.5. Discover linked skills from workload annotation (set by rossoctl backend or user)
 	fg := r.getFeatureGates()
 	var linkedSkills []string
 	if fg.SkillDiscovery {
@@ -356,7 +356,7 @@ func (r *AgentRuntimeReconciler) resolveTargetRef(ctx context.Context, rt *agent
 	return nil
 }
 
-// applyWorkloadConfig applies kagenti labels and config-hash annotation to the
+// applyWorkloadConfig applies rossoctl labels and config-hash annotation to the
 // target workload's metadata and PodTemplateSpec.
 func (r *AgentRuntimeReconciler) applyWorkloadConfig(ctx context.Context, rt *agentv1alpha1.AgentRuntime, configHash string) error {
 	logger := log.FromContext(ctx)
@@ -531,7 +531,7 @@ func (r *AgentRuntimeReconciler) completeSandboxRestart(ctx context.Context, rt
 	return ctrl.Result{RequeueAfter: 5 * time.Second}, true, nil
 }
 
-// countConfiguredPods counts pods that have the kagenti.io/type label matching the runtime type.
+// countConfiguredPods counts pods that have the rossoctl.io/type label matching the runtime type.
 func (r *AgentRuntimeReconciler) countConfiguredPods(ctx context.Context, rt *agentv1alpha1.AgentRuntime) (int32, error) {
 	podList := &corev1.PodList{}
 	if err := r.List(ctx, podList,
@@ -551,8 +551,8 @@ func (r *AgentRuntimeReconciler) countConfiguredPods(ctx context.Context, rt *ag
 	return count, nil
 }
 
-// readLinkedSkills reads the kagenti.io/skills annotation from the target
-// workload and returns the skill names. This annotation is set by the kagenti
+// readLinkedSkills reads the rossoctl.io/skills annotation from the target
+// workload and returns the skill names. This annotation is set by the rossoctl
 // backend (PR #1440) or manually by the user — the operator reads but never
 // sets it.
 func (r *AgentRuntimeReconciler) readLinkedSkills(ctx context.Context, rt *agentv1alpha1.AgentRuntime) []string {
@@ -582,10 +582,10 @@ func (r *AgentRuntimeReconciler) readLinkedSkills(ctx context.Context, rt *agent
 
 	var skills []string
 	if err := json.Unmarshal([]byte(raw), &skills); err != nil {
-		logger.V(1).Info("Failed to parse kagenti.io/skills annotation", "error", err, "raw", raw)
+		logger.V(1).Info("Failed to parse rossoctl.io/skills annotation", "error", err, "raw", raw)
 		if r.Recorder != nil {
 			r.Recorder.Eventf(rt, nil, corev1.EventTypeWarning, "SkillAnnotationParseError",
-				"ReadLinkedSkills", "Failed to parse kagenti.io/skills annotation: %v", err)
+				"ReadLinkedSkills", "Failed to parse rossoctl.io/skills annotation: %v", err)
 		}
 		return nil
 	}
@@ -676,12 +676,12 @@ func selectorMatchesLabels(selector, labels map[string]string) bool {
 func serviceHTTPPort(ctx context.Context, svc *corev1.Service) int32 {
 	logger := log.FromContext(ctx)
 
-	if ann, ok := svc.Annotations["kagenti.io/port"]; ok {
+	if ann, ok := svc.Annotations["rossoctl.io/port"]; ok {
 		port, err := strconv.ParseInt(ann, 10, 32)
 		if err == nil && port > 0 {
 			return int32(port)
 		}
-		logger.Info("Invalid kagenti.io/port annotation, falling back to port name resolution",
+		logger.Info("Invalid rossoctl.io/port annotation, falling back to port name resolution",
 			"service", svc.Name, "annotation", ann)
 	}
 
@@ -719,7 +719,7 @@ func isPodOwnedByWorkload(pod *corev1.Pod, workloadName string) bool {
 }
 
 // handleDeletion runs finalizer logic when an AgentRuntime is deleted.
-// It removes the kagenti.io/type label and kagenti.io/config-hash annotation so that
+// It removes the rossoctl.io/type label and rossoctl.io/config-hash annotation so that
 // the next rolling update creates pods without sidecars, returning the workload to its
 // pre-AR state.
 func (r *AgentRuntimeReconciler) handleDeletion(ctx context.Context, rt *agentv1alpha1.AgentRuntime) (ctrl.Result, error) {
@@ -743,19 +743,19 @@ func (r *AgentRuntimeReconciler) handleDeletion(ctx context.Context, rt *agentv1
 				return err
 			}
 
-			// Remove kagenti.io/type and kagenti.io/managed-by from workload metadata.
+			// Remove rossoctl.io/type and rossoctl.io/managed-by from workload metadata.
 			workloadLabels := acc.obj.GetLabels()
 			delete(workloadLabels, LabelAgentType)
 			delete(workloadLabels, LabelManagedBy)
 			acc.obj.SetLabels(workloadLabels)
 
-			// Remove kagenti.io/type from PodTemplateSpec pod labels so future pods
+			// Remove rossoctl.io/type from PodTemplateSpec pod labels so future pods
 			// are not presented to the webhook with the type label.
 			podLabels := acc.getPodLabels(acc.obj)
 			delete(podLabels, LabelAgentType)
 			acc.setPodLabels(acc.obj, podLabels)
 
-			// Remove kagenti.io/config-hash and kagenti.io/mtls-mode from PodTemplateSpec
+			// Remove rossoctl.io/config-hash and rossoctl.io/mtls-mode from PodTemplateSpec
 			// pod annotations. This triggers the rolling update that replaces existing
 			// injected pods, and leaves the workload annotation-clean for any future AR.
 			podAnnotations := acc.getPodAnnotations(acc.obj)
@@ -763,7 +763,7 @@ func (r *AgentRuntimeReconciler) handleDeletion(ctx context.Context, rt *agentv1
 			delete(podAnnotations, AnnotationMTLSMode)
 			acc.setPodAnnotations(acc.obj, podAnnotations)
 
-			logger.Info("Removed kagenti labels and config-hash from workload on AgentRuntime deletion",
+			logger.Info("Removed rossoctl labels and config-hash from workload on AgentRuntime deletion",
 				"workload", ref.Name, "kind", ref.Kind)
 			return r.Update(ctx, acc.obj)
 		})
@@ -1063,14 +1063,14 @@ func computeCardContentHash(cardData *agentv1alpha1.AgentCardData) string {
 
 // templateConfigMapNames lists the well-known ConfigMaps that authbridge sidecars
 // require. The Helm chart and backend API create these in agent namespaces; the
-// operator copies templates from kagenti-system for namespaces created by other
+// operator copies templates from rossoctl-system for namespaces created by other
 // means (GitOps, manual kubectl).
 var templateConfigMapNames = []string{
 	"authbridge-config",
 	"authbridge-runtime-config",
 }
 
-// ensureNamespaceConfigMaps copies template ConfigMaps from kagenti-system to the
+// ensureNamespaceConfigMaps copies template ConfigMaps from rossoctl-system to the
 // target namespace if they don't already exist. This mirrors the backend's
 // ensure_configmap() semantics: create-if-not-exists, preserving user customizations.
 func (r *AgentRuntimeReconciler) ensureNamespaceConfigMaps(ctx context.Context, namespace string) error {
@@ -1091,7 +1091,7 @@ func (r *AgentRuntimeReconciler) ensureNamespaceConfigMaps(ctx context.Context,
 		templateKey := client.ObjectKey{Namespace: ClusterDefaultsNamespace, Name: name}
 		if err := reader.Get(ctx, templateKey, template); err != nil {
 			if apierrors.IsNotFound(err) {
-				logger.V(1).Info("Template ConfigMap not found in kagenti-system, skipping",
+				logger.V(1).Info("Template ConfigMap not found in rossoctl-system, skipping",
 					"name", name)
 				continue
 			}
@@ -1179,13 +1179,13 @@ func (r *AgentRuntimeReconciler) ensureSpiffeHelperConfigMap(ctx context.Context
 }
 
 const (
-	sccClusterRoleName = "system:openshift:scc:kagenti-authbridge"
+	sccClusterRoleName = "system:openshift:scc:rossoctl-authbridge"
 	sccRoleBindingName = "agent-authbridge-scc"
 )
 
 // ensureNamespaceSCCBinding creates a RoleBinding in the target namespace that
-// grants all ServiceAccounts access to the kagenti-authbridge SCC via the
-// system:openshift:scc:kagenti-authbridge ClusterRole. On non-OpenShift clusters
+// grants all ServiceAccounts access to the rossoctl-authbridge SCC via the
+// system:openshift:scc:rossoctl-authbridge ClusterRole. On non-OpenShift clusters
 // (ClusterRole absent), this is a silent no-op.
 func (r *AgentRuntimeReconciler) ensureNamespaceSCCBinding(ctx context.Context, namespace string) error {
 	logger := log.FromContext(ctx)
@@ -1277,7 +1277,7 @@ func (r *AgentRuntimeReconciler) mapWorkloadToAgentRuntime(apiVersion, kind stri
 }
 
 // mapClusterConfigMapToAgentRuntimes maps changes to cluster-level ConfigMaps
-// (kagenti-webhook-defaults and kagenti-webhook-feature-gates) to all AgentRuntime
+// (rossoctl-webhook-defaults and rossoctl-webhook-feature-gates) to all AgentRuntime
 // reconcile requests across all namespaces.
 func (r *AgentRuntimeReconciler) mapClusterConfigMapToAgentRuntimes(ctx context.Context, obj client.Object) []reconcile.Request {
 	if obj.GetNamespace() != ClusterDefaultsNamespace {
@@ -1298,7 +1298,7 @@ func (r *AgentRuntimeReconciler) mapClusterConfigMapToAgentRuntimes(ctx context.
 // namespace-scoped ConfigMaps to AgentRuntimes in the same namespace.
 // Two ConfigMap shapes are watched:
 //
-//  1. Namespace defaults — labeled kagenti.io/defaults=true. Folded into
+//  1. Namespace defaults — labeled rossoctl.io/defaults=true. Folded into
 //     resolvedConfig.Defaults during resolveConfig.
 //  2. authbridge-runtime-config (matched by name, no label required) —
 //     this is the ConfigMap the admission webhook reads at pod creation.
diff --git a/kagenti-operator/internal/controller/agentruntime_controller_test.go b/operator/internal/controller/agentruntime_controller_test.go
similarity index 97%
rename from kagenti-operator/internal/controller/agentruntime_controller_test.go
rename to operator/internal/controller/agentruntime_controller_test.go
index d162d716..0554ef84 100644
--- a/kagenti-operator/internal/controller/agentruntime_controller_test.go
+++ b/operator/internal/controller/agentruntime_controller_test.go
@@ -35,9 +35,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	webhookconfig "github.com/kagenti/operator/internal/webhook/config"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	webhookconfig "github.com/rossoctl/operator/internal/webhook/config"
 )
 
 // updateFailClient wraps a client.Client and rejects Update calls on
@@ -208,7 +208,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 	})
 
-	Context("When kagenti.io/skills annotation exists on workload", func() {
+	Context("When rossoctl.io/skills annotation exists on workload", func() {
 		It("should read linked skills into status", func() {
 			dep := newDeployment("skills-read-deploy", namespace)
 			dep.Annotations = map[string]string{
@@ -468,7 +468,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 			_ = k8sClient.Delete(ctx, dep)
 		})
 
-		It("should apply kagenti.io/type=tool label", func() {
+		It("should apply rossoctl.io/type=tool label", func() {
 			r := newReconciler()
 
 			_, _ = r.Reconcile(ctx, reconcile.Request{
@@ -534,14 +534,14 @@ var _ = Describe("AgentRuntime Controller", func() {
 			depAfter := &appsv1.Deployment{}
 			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "del-deploy", Namespace: namespace}, depAfter)).To(Succeed())
 
-			// kagenti.io/type removed from both workload metadata and PodTemplateSpec
+			// rossoctl.io/type removed from both workload metadata and PodTemplateSpec
 			Expect(depAfter.Labels).NotTo(HaveKey(LabelAgentType))
 			Expect(depAfter.Spec.Template.Labels).NotTo(HaveKey(LabelAgentType))
 
-			// kagenti.io/managed-by removed
+			// rossoctl.io/managed-by removed
 			Expect(depAfter.Labels).NotTo(HaveKey(LabelManagedBy))
 
-			// kagenti.io/config-hash removed from PodTemplateSpec
+			// rossoctl.io/config-hash removed from PodTemplateSpec
 			Expect(depAfter.Spec.Template.Annotations).NotTo(HaveKey(AnnotationConfigHash))
 
 			// Finalizer removed — AgentRuntime should be gone
@@ -692,7 +692,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		const cmTestNS = "cm-test-ns"
 
 		BeforeEach(func() {
-			// Create the kagenti-system namespace for templates
+			// Create the rossoctl-system namespace for templates
 			ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: ClusterDefaultsNamespace}}
 			_ = k8sClient.Create(ctx, ns)
 
@@ -711,7 +711,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 
 		It("should create missing ConfigMaps from templates", func() {
-			// Create template ConfigMaps in kagenti-system
+			// Create template ConfigMaps in rossoctl-system
 			for _, name := range templateConfigMapNames {
 				cm := &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
@@ -735,7 +735,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 
 		It("should skip ConfigMaps that already exist", func() {
-			// Create template in kagenti-system
+			// Create template in rossoctl-system
 			template := &corev1.ConfigMap{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "authbridge-config",
@@ -777,7 +777,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 
 		It("should only create missing ConfigMaps when some already exist", func() {
-			// Create all templates in kagenti-system
+			// Create all templates in rossoctl-system
 			for _, name := range templateConfigMapNames {
 				cm := &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
@@ -1387,12 +1387,12 @@ var _ = Describe("AgentRuntime Controller", func() {
 	})
 
 	Context("Protocol-aware port resolution (US4)", func() {
-		It("should use kagenti.io/port annotation when present", func() {
+		It("should use rossoctl.io/port annotation when present", func() {
 			svc := &corev1.Service{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:        "port-anno-svc",
 					Namespace:   namespace,
-					Annotations: map[string]string{"kagenti.io/port": "9090"},
+					Annotations: map[string]string{"rossoctl.io/port": "9090"},
 				},
 				Spec: corev1.ServiceSpec{
 					Ports: []corev1.ServicePort{
@@ -1425,7 +1425,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 				ObjectMeta: metav1.ObjectMeta{
 					Name:        "port-invalid-anno-svc",
 					Namespace:   namespace,
-					Annotations: map[string]string{"kagenti.io/port": "not-a-number"},
+					Annotations: map[string]string{"rossoctl.io/port": "not-a-number"},
 				},
 				Spec: corev1.ServiceSpec{
 					Ports: []corev1.ServicePort{
@@ -1442,7 +1442,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 				ObjectMeta: metav1.ObjectMeta{
 					Name:        "port-anno-vs-a2a-svc",
 					Namespace:   namespace,
-					Annotations: map[string]string{"kagenti.io/port": "7777"},
+					Annotations: map[string]string{"rossoctl.io/port": "7777"},
 				},
 				Spec: corev1.ServiceSpec{
 					Ports: []corev1.ServicePort{
@@ -1490,12 +1490,12 @@ var _ = Describe("AgentRuntime Controller", func() {
 			Expect(labels).To(HaveKeyWithValue("app", "my-agent"))
 
 			// Write new labels
-			labels["kagenti.io/type"] = "agent"
+			labels["rossoctl.io/type"] = "agent"
 			acc.setPodLabels(acc.obj, labels)
 
 			// Verify labels were set
 			updatedLabels := acc.getPodLabels(acc.obj)
-			Expect(updatedLabels).To(HaveKeyWithValue("kagenti.io/type", "agent"))
+			Expect(updatedLabels).To(HaveKeyWithValue("rossoctl.io/type", "agent"))
 			Expect(updatedLabels).To(HaveKeyWithValue("app", "my-agent"))
 
 			// Read existing annotations
@@ -1540,9 +1540,9 @@ var _ = Describe("AgentRuntime Controller", func() {
 			Expect(labels).To(BeNil())
 
 			// Setting labels should work even without existing metadata
-			acc.setPodLabels(acc.obj, map[string]string{"kagenti.io/type": "agent"})
+			acc.setPodLabels(acc.obj, map[string]string{"rossoctl.io/type": "agent"})
 			labels = acc.getPodLabels(acc.obj)
-			Expect(labels).To(HaveKeyWithValue("kagenti.io/type", "agent"))
+			Expect(labels).To(HaveKeyWithValue("rossoctl.io/type", "agent"))
 
 			// Annotations should be nil when no metadata.annotations exists
 			annotations := acc.getPodAnnotations(acc.obj)
diff --git a/kagenti-operator/internal/controller/agentruntime_istio.go b/operator/internal/controller/agentruntime_istio.go
similarity index 93%
rename from kagenti-operator/internal/controller/agentruntime_istio.go
rename to operator/internal/controller/agentruntime_istio.go
index b35d3062..48b58805 100644
--- a/kagenti-operator/internal/controller/agentruntime_istio.go
+++ b/operator/internal/controller/agentruntime_istio.go
@@ -27,7 +27,7 @@ import (
 const (
 	ConditionTypeIstioMeshEnrolled = "IstioMeshEnrolled"
 
-	AnnotationIstioMeshOptOut = "kagenti.io/istio-mesh"
+	AnnotationIstioMeshOptOut = "rossoctl.io/istio-mesh"
 
 	LabelIstioDiscovery     = "istio-discovery"
 	LabelIstioDataplaneMode = "istio.io/dataplane-mode"
@@ -36,7 +36,7 @@ const (
 // +kubebuilder:rbac:groups=core,resources=namespaces,verbs=get;list;watch;patch
 
 // ensureIstioMeshLabels patches the namespace with Istio ambient mesh labels
-// unless the namespace has opted out via the kagenti.io/istio-mesh annotation.
+// unless the namespace has opted out via the rossoctl.io/istio-mesh annotation.
 // Returns true if labels were applied (or already present), false if opted out.
 func (r *AgentRuntimeReconciler) ensureIstioMeshLabels(ctx context.Context, namespace string) (bool, error) {
 	logger := log.FromContext(ctx)
diff --git a/kagenti-operator/internal/controller/agentruntime_istio_test.go b/operator/internal/controller/agentruntime_istio_test.go
similarity index 100%
rename from kagenti-operator/internal/controller/agentruntime_istio_test.go
rename to operator/internal/controller/agentruntime_istio_test.go
diff --git a/kagenti-operator/internal/controller/authbridgeconfig_controller.go b/operator/internal/controller/authbridgeconfig_controller.go
similarity index 90%
rename from kagenti-operator/internal/controller/authbridgeconfig_controller.go
rename to operator/internal/controller/authbridgeconfig_controller.go
index c21e9d38..4cbb8400 100644
--- a/kagenti-operator/internal/controller/authbridgeconfig_controller.go
+++ b/operator/internal/controller/authbridgeconfig_controller.go
@@ -23,9 +23,9 @@ import (
 )
 
 const (
-	labelKagentiEnabled  = "kagenti-enabled"
+	labelRossoctlEnabled = "rossoctl-enabled"
 	authbridgeConfigCM   = "authbridge-config"
-	defaultKeycloakRealm = "kagenti"
+	defaultKeycloakRealm = "rossoctl"
 )
 
 // AuthbridgeConfigPlatform holds the platform-level settings used to generate authbridge-config.
@@ -39,7 +39,7 @@ type AuthbridgeConfigPlatform struct {
 }
 
 // AuthbridgeConfigReconciler reconciles authbridge-config ConfigMaps in namespaces
-// labeled with kagenti-enabled=true.
+// labeled with rossoctl-enabled=true.
 type AuthbridgeConfigReconciler struct {
 	client.Client
 	Platform AuthbridgeConfigPlatform
@@ -59,7 +59,7 @@ func (r *AuthbridgeConfigReconciler) Reconcile(ctx context.Context, req ctrl.Req
 		return ctrl.Result{}, err
 	}
 
-	if ns.Labels[labelKagentiEnabled] != "true" {
+	if ns.Labels[labelRossoctlEnabled] != "true" {
 		return ctrl.Result{}, nil
 	}
 
@@ -77,7 +77,7 @@ func (r *AuthbridgeConfigReconciler) Reconcile(ctx context.Context, req ctrl.Req
 				Name:      authbridgeConfigCM,
 				Namespace: ns.Name,
 				Labels: map[string]string{
-					"app.kubernetes.io/managed-by": "kagenti-operator",
+					"app.kubernetes.io/managed-by": "rossoctl-operator",
 					LabelNamespaceDefaults:         "true",
 				},
 			},
@@ -105,14 +105,14 @@ func (r *AuthbridgeConfigReconciler) Reconcile(ctx context.Context, req ctrl.Req
 	if cm.Labels == nil {
 		cm.Labels = make(map[string]string)
 	}
-	cm.Labels["app.kubernetes.io/managed-by"] = "kagenti-operator"
+	cm.Labels["app.kubernetes.io/managed-by"] = "rossoctl-operator"
 	cm.Labels[LabelNamespaceDefaults] = "true"
 	if cm.Data == nil {
 		cm.Data = make(map[string]string)
 	}
 	// Fill in defaults only for keys that are missing or empty; preserve any
 	// explicitly-set per-namespace value (e.g. KEYCLOAK_REALM). This ConfigMap
-	// is a namespace-defaults source (kagenti.io/defaults=true), so defaults
+	// is a namespace-defaults source (rossoctl.io/defaults=true), so defaults
 	// must not clobber a value provided by an operator/admin/CI. See issue #433.
 	for k, v := range desired {
 		if existing, ok := cm.Data[k]; ok && existing != "" {
@@ -186,11 +186,11 @@ func (r *AuthbridgeConfigReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		For(&corev1.Namespace{}, builder.WithPredicates(
 			predicate.Funcs{
 				CreateFunc: func(e event.CreateEvent) bool {
-					return e.Object.GetLabels()[labelKagentiEnabled] == "true"
+					return e.Object.GetLabels()[labelRossoctlEnabled] == "true"
 				},
 				UpdateFunc: func(e event.UpdateEvent) bool {
-					oldVal := e.ObjectOld.GetLabels()[labelKagentiEnabled]
-					newVal := e.ObjectNew.GetLabels()[labelKagentiEnabled]
+					oldVal := e.ObjectOld.GetLabels()[labelRossoctlEnabled]
+					newVal := e.ObjectNew.GetLabels()[labelRossoctlEnabled]
 					return newVal == "true" || oldVal != newVal
 				},
 				DeleteFunc: func(e event.DeleteEvent) bool {
diff --git a/kagenti-operator/internal/controller/authbridgeconfig_controller_test.go b/operator/internal/controller/authbridgeconfig_controller_test.go
similarity index 86%
rename from kagenti-operator/internal/controller/authbridgeconfig_controller_test.go
rename to operator/internal/controller/authbridgeconfig_controller_test.go
index bb902b35..48242629 100644
--- a/kagenti-operator/internal/controller/authbridgeconfig_controller_test.go
+++ b/operator/internal/controller/authbridgeconfig_controller_test.go
@@ -22,21 +22,21 @@ import (
 const authbridgeConfigTestNamespace = "tx-e2e"
 
 // authbridgeTestPlatform returns a platform config whose default realm is the
-// platform-global "kagenti" — i.e. the value that would clobber a per-namespace
+// platform-global "rossoctl" — i.e. the value that would clobber a per-namespace
 // override if the reconciler overwrote existing keys.
 func authbridgeTestPlatform() AuthbridgeConfigPlatform {
 	return AuthbridgeConfigPlatform{
 		KeycloakAdminSecretNamespace: "keycloak",
-		KeycloakRealm:                "kagenti",
+		KeycloakRealm:                "rossoctl",
 		KeycloakPublicURL:            "https://keycloak.example",
 	}
 }
 
-func kagentiEnabledNamespace(name string) *corev1.Namespace {
+func rossoctlEnabledNamespace(name string) *corev1.Namespace {
 	return &corev1.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   name,
-			Labels: map[string]string{labelKagentiEnabled: "true"},
+			Labels: map[string]string{labelRossoctlEnabled: "true"},
 		},
 	}
 }
@@ -64,7 +64,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 			// survive reconciliation rather than being reset to the platform default.
 			name: "preserves explicitly-set KEYCLOAK_REALM on existing ConfigMap",
 			objs: []client.Object{
-				kagentiEnabledNamespace(authbridgeConfigTestNamespace),
+				rossoctlEnabledNamespace(authbridgeConfigTestNamespace),
 				&corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      authbridgeConfigCM,
@@ -87,17 +87,17 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 		{
 			name: "creates ConfigMap with platform defaults when none exists",
 			objs: []client.Object{
-				kagentiEnabledNamespace(authbridgeConfigTestNamespace),
+				rossoctlEnabledNamespace(authbridgeConfigTestNamespace),
 			},
 			check: func(t *testing.T, c client.Client) {
 				cm := getCM(t, c)
-				if got := cm.Data["KEYCLOAK_REALM"]; got != "kagenti" {
-					t.Fatalf("KEYCLOAK_REALM = %q, want platform default %q", got, "kagenti")
+				if got := cm.Data["KEYCLOAK_REALM"]; got != "rossoctl" {
+					t.Fatalf("KEYCLOAK_REALM = %q, want platform default %q", got, "rossoctl")
 				}
 				if got := cm.Data["KEYCLOAK_URL"]; got == "" {
 					t.Fatalf("KEYCLOAK_URL should be populated from platform defaults, got empty")
 				}
-				if cm.Labels["app.kubernetes.io/managed-by"] != "kagenti-operator" {
+				if cm.Labels["app.kubernetes.io/managed-by"] != "rossoctl-operator" {
 					t.Fatalf("missing managed-by label, got %v", cm.Labels)
 				}
 				if cm.Labels[LabelNamespaceDefaults] != "true" {
@@ -108,7 +108,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 		{
 			name: "fills missing/empty keys without overwriting present ones",
 			objs: []client.Object{
-				kagentiEnabledNamespace(authbridgeConfigTestNamespace),
+				rossoctlEnabledNamespace(authbridgeConfigTestNamespace),
 				&corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      authbridgeConfigCM,
@@ -136,7 +136,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 		{
 			name: "stamps ownership labels on an externally-created ConfigMap",
 			objs: []client.Object{
-				kagentiEnabledNamespace(authbridgeConfigTestNamespace),
+				rossoctlEnabledNamespace(authbridgeConfigTestNamespace),
 				&corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      authbridgeConfigCM,
@@ -147,7 +147,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 			},
 			check: func(t *testing.T, c client.Client) {
 				cm := getCM(t, c)
-				if cm.Labels["app.kubernetes.io/managed-by"] != "kagenti-operator" {
+				if cm.Labels["app.kubernetes.io/managed-by"] != "rossoctl-operator" {
 					t.Fatalf("missing managed-by label, got %v", cm.Labels)
 				}
 				if cm.Labels[LabelNamespaceDefaults] != "true" {
@@ -158,7 +158,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 		{
 			name: "created ConfigMap has no SPIRE_ENABLED key",
 			objs: []client.Object{
-				kagentiEnabledNamespace(authbridgeConfigTestNamespace),
+				rossoctlEnabledNamespace(authbridgeConfigTestNamespace),
 			},
 			check: func(t *testing.T, c client.Client) {
 				cm := getCM(t, c)
@@ -168,7 +168,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 			},
 		},
 		{
-			name: "skips namespace without kagenti-enabled label",
+			name: "skips namespace without rossoctl-enabled label",
 			objs: []client.Object{
 				&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: authbridgeConfigTestNamespace}},
 			},
@@ -176,7 +176,7 @@ func TestAuthbridgeConfigReconciler_Reconcile(t *testing.T) {
 				cm := &corev1.ConfigMap{}
 				err := c.Get(ctx, client.ObjectKey{Namespace: authbridgeConfigTestNamespace, Name: authbridgeConfigCM}, cm)
 				if err == nil {
-					t.Fatalf("expected no authbridge-config to be created for non-kagenti-enabled namespace")
+					t.Fatalf("expected no authbridge-config to be created for non-rossoctl-enabled namespace")
 				}
 			},
 		},
diff --git a/kagenti-operator/internal/controller/clientregistration_controller.go b/operator/internal/controller/clientregistration_controller.go
similarity index 98%
rename from kagenti-operator/internal/controller/clientregistration_controller.go
rename to operator/internal/controller/clientregistration_controller.go
index 0ea3d6e2..e0dcec9a 100644
--- a/kagenti-operator/internal/controller/clientregistration_controller.go
+++ b/operator/internal/controller/clientregistration_controller.go
@@ -34,8 +34,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/yaml"
 
-	"github.com/kagenti/operator/internal/clientreg"
-	"github.com/kagenti/operator/internal/keycloak"
+	"github.com/rossoctl/operator/internal/clientreg"
+	"github.com/rossoctl/operator/internal/keycloak"
 )
 
 // Well-known namespace resources.
@@ -45,7 +45,7 @@ const (
 	// keycloakInitialAdminSecret is the RHBK-managed secret with keys "username"/"password".
 	keycloakInitialAdminSecret = "keycloak-initial-admin"
 
-	// AnnotationKeycloakClientSecretName must match kagenti-webhook injector.AnnotationKeycloakClientSecretName.
+	// AnnotationKeycloakClientSecretName must match rossoctl-webhook injector.AnnotationKeycloakClientSecretName.
 	// Re-exported from internal/clientreg to give both the controller and the webhook one source of truth.
 	AnnotationKeycloakClientSecretName = clientreg.AnnotationKeycloakClientSecretName
 )
@@ -82,7 +82,7 @@ type ClientRegistrationReconciler struct {
 	// Only used when UseSpiffeAuth is true. Default: /opt/jwt_svid.token
 	JWTSVIDPath string
 
-	// OperatorClientID is the operator's SPIFFE ID (e.g., spiffe://localtest.me/ns/kagenti-operator-system/sa/...).
+	// OperatorClientID is the operator's SPIFFE ID (e.g., spiffe://localtest.me/ns/rossoctl-operator-system/sa/...).
 	// Only used when UseSpiffeAuth is true.
 	OperatorClientID string
 
@@ -444,7 +444,7 @@ func readAuthbridgeConfigMap(ctx context.Context, c client.Reader, namespace str
 func parsePlatformClientIDs(raw string) []string {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
-		return []string{"kagenti"}
+		return []string{"rossoctl"}
 	}
 	var out []string
 	for _, p := range strings.Split(raw, ",") {
@@ -454,7 +454,7 @@ func parsePlatformClientIDs(raw string) []string {
 		}
 	}
 	if len(out) == 0 {
-		return []string{"kagenti"}
+		return []string{"rossoctl"}
 	}
 	return out
 }
diff --git a/kagenti-operator/internal/controller/clientregistration_controller_test.go b/operator/internal/controller/clientregistration_controller_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/clientregistration_controller_test.go
rename to operator/internal/controller/clientregistration_controller_test.go
index bd6cdab8..4258cf65 100644
--- a/kagenti-operator/internal/controller/clientregistration_controller_test.go
+++ b/operator/internal/controller/clientregistration_controller_test.go
@@ -16,8 +16,8 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/keycloak/testidp"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/keycloak/testidp"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -72,7 +72,7 @@ func TestWorkloadWantsOperatorClientReg(t *testing.T) {
 
 func TestInjectKeycloakClientCredentialsAnnotation(t *testing.T) {
 	pt := &corev1.PodTemplateSpec{}
-	secretName := "kagenti-keycloak-client-credentials-deadbeefcafe4242"
+	secretName := "rossoctl-keycloak-client-credentials-deadbeefcafe4242"
 	if !injectKeycloakClientCredentialsAnnotation(pt, secretName) {
 		t.Fatal("expected change")
 	}
@@ -85,13 +85,13 @@ func TestInjectKeycloakClientCredentialsAnnotation(t *testing.T) {
 }
 
 func TestParsePlatformClientIDs(t *testing.T) {
-	if got := parsePlatformClientIDs(""); len(got) != 1 || got[0] != "kagenti" {
+	if got := parsePlatformClientIDs(""); len(got) != 1 || got[0] != "rossoctl" {
 		t.Fatalf("empty: %v", got)
 	}
 	if got := parsePlatformClientIDs("a, b"); len(got) != 2 || got[0] != "a" || got[1] != "b" {
 		t.Fatalf("list: %v", got)
 	}
-	if got := parsePlatformClientIDs("  ,  "); len(got) != 1 || got[0] != "kagenti" {
+	if got := parsePlatformClientIDs("  ,  "); len(got) != 1 || got[0] != "rossoctl" {
 		t.Fatalf("all blank: %v", got)
 	}
 }
@@ -168,7 +168,7 @@ func authbridgeConfigMapForTest(ns, keycloakURL string) *corev1.ConfigMap {
 		},
 		Data: map[string]string{
 			"KEYCLOAK_URL":                    keycloakURL,
-			"KEYCLOAK_REALM":                  "kagenti",
+			"KEYCLOAK_REALM":                  "rossoctl",
 			"KEYCLOAK_AUDIENCE_SCOPE_ENABLED": "false",
 		},
 	}
diff --git a/kagenti-operator/internal/controller/identity_binding_test.go b/operator/internal/controller/identity_binding_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/identity_binding_test.go
rename to operator/internal/controller/identity_binding_test.go
index dc52dd97..02bd0b32 100644
--- a/kagenti-operator/internal/controller/identity_binding_test.go
+++ b/operator/internal/controller/identity_binding_test.go
@@ -25,7 +25,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 var _ = Describe("Identity Binding — Trust Domain Only", func() {
diff --git a/kagenti-operator/internal/controller/indexers.go b/operator/internal/controller/indexers.go
similarity index 97%
rename from kagenti-operator/internal/controller/indexers.go
rename to operator/internal/controller/indexers.go
index a6f5ef94..2aa49cf3 100644
--- a/kagenti-operator/internal/controller/indexers.go
+++ b/operator/internal/controller/indexers.go
@@ -22,7 +22,7 @@ import (
 	"sync"
 
 	"github.com/go-logr/logr"
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/kagenti-operator/internal/controller/indexers_test.go b/operator/internal/controller/indexers_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/indexers_test.go
rename to operator/internal/controller/indexers_test.go
index 594c2eac..d683a3ff 100644
--- a/kagenti-operator/internal/controller/indexers_test.go
+++ b/operator/internal/controller/indexers_test.go
@@ -26,7 +26,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 var _ = Describe("mapWorkloadToAgentCards", func() {
diff --git a/kagenti-operator/internal/controller/kuadrant_controller.go b/operator/internal/controller/kuadrant_controller.go
similarity index 98%
rename from kagenti-operator/internal/controller/kuadrant_controller.go
rename to operator/internal/controller/kuadrant_controller.go
index f9689cf4..d07e5b94 100644
--- a/kagenti-operator/internal/controller/kuadrant_controller.go
+++ b/operator/internal/controller/kuadrant_controller.go
@@ -30,7 +30,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
-	"github.com/kagenti/operator/internal/kuadrant"
+	"github.com/rossoctl/operator/internal/kuadrant"
 )
 
 const (
@@ -41,7 +41,7 @@ const (
 var kuadrantLogger = ctrl.Log.WithName("controller").WithName("Kuadrant")
 
 // KuadrantReconciler ensures a Kuadrant CR exists in kuadrant-system.
-// It replaces the manual `kubectl apply` in setup-kagenti.sh, providing
+// It replaces the manual `kubectl apply` in setup-rossoctl.sh, providing
 // drift reconciliation and idempotent creation.
 type KuadrantReconciler struct {
 	client.Client
diff --git a/kagenti-operator/internal/controller/kuadrant_controller_test.go b/operator/internal/controller/kuadrant_controller_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/kuadrant_controller_test.go
rename to operator/internal/controller/kuadrant_controller_test.go
index 52cbe435..c70e9ce3 100644
--- a/kagenti-operator/internal/controller/kuadrant_controller_test.go
+++ b/operator/internal/controller/kuadrant_controller_test.go
@@ -29,7 +29,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"github.com/kagenti/operator/internal/kuadrant"
+	"github.com/rossoctl/operator/internal/kuadrant"
 )
 
 var _ = Describe("KuadrantReconciler", func() {
diff --git a/kagenti-operator/internal/controller/mlflow_controller.go b/operator/internal/controller/mlflow_controller.go
similarity index 96%
rename from kagenti-operator/internal/controller/mlflow_controller.go
rename to operator/internal/controller/mlflow_controller.go
index c796cd83..301e0418 100644
--- a/kagenti-operator/internal/controller/mlflow_controller.go
+++ b/operator/internal/controller/mlflow_controller.go
@@ -36,7 +36,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
-	"github.com/kagenti/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/mlflow"
 )
 
 const (
@@ -49,13 +49,13 @@ const (
 	MLflowExperimentsResource = "experiments"
 
 	// MLflow annotation keys stored on the PodTemplateSpec.
-	AnnotationMLflowExperimentID   = "mlflow.kagenti.io/experiment-id"
-	AnnotationMLflowExperimentName = "mlflow.kagenti.io/experiment-name"
-	AnnotationMLflowTrackingURI    = "mlflow.kagenti.io/tracking-uri"
-	AnnotationMLflowTrackingAuth   = "mlflow.kagenti.io/tracking-auth"
+	AnnotationMLflowExperimentID   = "mlflow.rossoctl.io/experiment-id"
+	AnnotationMLflowExperimentName = "mlflow.rossoctl.io/experiment-name"
+	AnnotationMLflowTrackingURI    = "mlflow.rossoctl.io/tracking-uri"
+	AnnotationMLflowTrackingAuth   = "mlflow.rossoctl.io/tracking-auth"
 )
 
-// MLflowReconciler reconciles Deployments labelled kagenti.io/type=agent.
+// MLflowReconciler reconciles Deployments labelled rossoctl.io/type=agent.
 // It auto-discovers MLflow availability via the mlflows.mlflow.opendatahub.io CRD.
 //
 // For each agent Deployment the reconciler creates a scoped Role granting only
@@ -270,7 +270,7 @@ func (r *MLflowReconciler) configureDeployment(ctx context.Context, dep *appsv1.
 // and a RoleBinding that grants the agent SA only get+update on that experiment.
 // Both resources are owned by the Deployment so they are garbage-collected on deletion.
 func (r *MLflowReconciler) ensureScopedRBAC(ctx context.Context, dep *appsv1.Deployment, saName, experimentName string) error {
-	roleName := fmt.Sprintf("kagenti-mlflow-%s", dep.Name)
+	roleName := fmt.Sprintf("rossoctl-mlflow-%s", dep.Name)
 
 	role := &rbacv1.Role{
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/kagenti-operator/internal/controller/mlflow_controller_test.go b/operator/internal/controller/mlflow_controller_test.go
similarity index 97%
rename from kagenti-operator/internal/controller/mlflow_controller_test.go
rename to operator/internal/controller/mlflow_controller_test.go
index 3bf00687..aa95e005 100644
--- a/kagenti-operator/internal/controller/mlflow_controller_test.go
+++ b/operator/internal/controller/mlflow_controller_test.go
@@ -26,9 +26,9 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/kagenti/operator/internal/mlflow"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	"github.com/rossoctl/operator/internal/mlflow"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -238,7 +238,7 @@ var _ = Describe("MLflow Controller", func() {
 
 			role := &rbacv1.Role{}
 			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: "kagenti-mlflow-mlflow-full", Namespace: namespace,
+				Name: "rossoctl-mlflow-mlflow-full", Namespace: namespace,
 			}, role)).To(Succeed())
 			Expect(role.Rules).To(HaveLen(1))
 			Expect(role.Rules[0].APIGroups).To(Equal([]string{MLflowExperimentsAPIGroup}))
@@ -248,12 +248,12 @@ var _ = Describe("MLflow Controller", func() {
 
 			rb := &rbacv1.RoleBinding{}
 			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: "kagenti-mlflow-mlflow-full", Namespace: namespace,
+				Name: "rossoctl-mlflow-mlflow-full", Namespace: namespace,
 			}, rb)).To(Succeed())
 			Expect(rb.Subjects).To(HaveLen(1))
 			Expect(rb.Subjects[0].Name).To(Equal("test-sa"))
 			Expect(rb.RoleRef.Kind).To(Equal("Role"))
-			Expect(rb.RoleRef.Name).To(Equal("kagenti-mlflow-mlflow-full"))
+			Expect(rb.RoleRef.Name).To(Equal("rossoctl-mlflow-mlflow-full"))
 
 			updated := &appsv1.Deployment{}
 			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: "mlflow-full", Namespace: namespace}, updated)).To(Succeed())
@@ -283,13 +283,13 @@ var _ = Describe("MLflow Controller", func() {
 
 			role := &rbacv1.Role{}
 			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: "kagenti-mlflow-mlflow-default-sa", Namespace: namespace,
+				Name: "rossoctl-mlflow-mlflow-default-sa", Namespace: namespace,
 			}, role)).To(Succeed())
 			Expect(role.Rules[0].ResourceNames).To(Equal([]string{"mlflow-default-sa"}))
 
 			rb := &rbacv1.RoleBinding{}
 			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: "kagenti-mlflow-mlflow-default-sa", Namespace: namespace,
+				Name: "rossoctl-mlflow-mlflow-default-sa", Namespace: namespace,
 			}, rb)).To(Succeed())
 			Expect(rb.Subjects[0].Name).To(Equal("default"))
 			Expect(rb.RoleRef.Kind).To(Equal("Role"))
diff --git a/kagenti-operator/internal/controller/mlflow_operand_controller.go b/operator/internal/controller/mlflow_operand_controller.go
similarity index 98%
rename from kagenti-operator/internal/controller/mlflow_operand_controller.go
rename to operator/internal/controller/mlflow_operand_controller.go
index 07994249..4de21472 100644
--- a/kagenti-operator/internal/controller/mlflow_operand_controller.go
+++ b/operator/internal/controller/mlflow_operand_controller.go
@@ -42,7 +42,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	"github.com/kagenti/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/mlflow"
 )
 
 const (
@@ -83,7 +83,7 @@ type MLflowOperandReconciler struct {
 	Scheme   *runtime.Scheme
 	Recorder record.EventRecorder
 
-	// OperatorNamespace is the namespace the operator runs in (default: kagenti-system).
+	// OperatorNamespace is the namespace the operator runs in (default: rossoctl-system).
 	OperatorNamespace string
 
 	// ResolveMLflowClusterRole overrides ClusterRole discovery for testing.
@@ -347,7 +347,7 @@ func (r *MLflowOperandReconciler) resolveMLflowClusterRole(ctx context.Context)
 }
 
 // agentNamespaces returns the set of namespaces containing at least one
-// Deployment or StatefulSet with the kagenti.io/type=agent label.
+// Deployment or StatefulSet with the rossoctl.io/type=agent label.
 func (r *MLflowOperandReconciler) agentNamespaces(ctx context.Context) ([]string, error) {
 	agentLabel := client.MatchingLabels{LabelAgentType: LabelValueAgent}
 	seen := make(map[string]struct{})
@@ -383,7 +383,7 @@ func (r *MLflowOperandReconciler) operatorNamespace() string {
 	if r.OperatorNamespace != "" {
 		return r.OperatorNamespace
 	}
-	return "kagenti-system"
+	return "rossoctl-system"
 }
 
 // dscMLflowChangePredicate fires only when the DSC mlflowoperator managementState changes.
diff --git a/kagenti-operator/internal/controller/mlflow_operand_controller_test.go b/operator/internal/controller/mlflow_operand_controller_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/mlflow_operand_controller_test.go
rename to operator/internal/controller/mlflow_operand_controller_test.go
index 30d378ab..4d36c5f3 100644
--- a/kagenti-operator/internal/controller/mlflow_operand_controller_test.go
+++ b/operator/internal/controller/mlflow_operand_controller_test.go
@@ -34,7 +34,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	"github.com/kagenti/operator/internal/mlflow"
+	"github.com/rossoctl/operator/internal/mlflow"
 )
 
 func newMLflowTestScheme() *runtime.Scheme {
@@ -92,7 +92,7 @@ func newOperandReconciler(cl client.Client, scheme *runtime.Scheme) *MLflowOpera
 	return &MLflowOperandReconciler{
 		Client:            cl,
 		Scheme:            scheme,
-		OperatorNamespace: "kagenti-system",
+		OperatorNamespace: "rossoctl-system",
 		ResolveMLflowClusterRole: func(_ context.Context) string {
 			return MLflowClusterRoleIntegration
 		},
@@ -281,7 +281,7 @@ var _ = Describe("MLflow Operand Controller", func() {
 			Expect(rb.Subjects).To(HaveLen(1))
 			Expect(rb.Subjects[0].Kind).To(Equal("ServiceAccount"))
 			Expect(rb.Subjects[0].Name).To(Equal(OTELCollectorSAName))
-			Expect(rb.Subjects[0].Namespace).To(Equal("kagenti-system"))
+			Expect(rb.Subjects[0].Namespace).To(Equal("rossoctl-system"))
 			Expect(rb.Labels[LabelManagedBy]).To(Equal(LabelManagedByValue))
 
 			// Verify OTEL RoleBinding in MLflow namespace
@@ -372,7 +372,7 @@ var _ = Describe("MLflow Operand Controller", func() {
 			r := &MLflowOperandReconciler{
 				Client:            cl,
 				Scheme:            s,
-				OperatorNamespace: "kagenti-system",
+				OperatorNamespace: "rossoctl-system",
 				ResolveMLflowClusterRole: func(_ context.Context) string {
 					return "" // no ClusterRole found
 				},
@@ -424,7 +424,7 @@ var _ = Describe("MLflow Operand Controller", func() {
 					Name:     MLflowClusterRoleEdit,
 				},
 				Subjects: []rbacv1.Subject{
-					{Kind: rbacv1.ServiceAccountKind, Name: OTELCollectorSAName, Namespace: "kagenti-system"},
+					{Kind: rbacv1.ServiceAccountKind, Name: OTELCollectorSAName, Namespace: "rossoctl-system"},
 				},
 			}
 
diff --git a/kagenti-operator/internal/controller/negative_signature_test.go b/operator/internal/controller/negative_signature_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/negative_signature_test.go
rename to operator/internal/controller/negative_signature_test.go
index 7d91482e..83720bb5 100644
--- a/kagenti-operator/internal/controller/negative_signature_test.go
+++ b/operator/internal/controller/negative_signature_test.go
@@ -28,7 +28,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 func buildTamperedCard(privKey *rsa.PrivateKey) *agentv1alpha1.AgentCardData {
diff --git a/kagenti-operator/internal/controller/network_check.go b/operator/internal/controller/network_check.go
similarity index 100%
rename from kagenti-operator/internal/controller/network_check.go
rename to operator/internal/controller/network_check.go
diff --git a/kagenti-operator/internal/controller/network_check_test.go b/operator/internal/controller/network_check_test.go
similarity index 100%
rename from kagenti-operator/internal/controller/network_check_test.go
rename to operator/internal/controller/network_check_test.go
diff --git a/kagenti-operator/internal/controller/proactive_restart_test.go b/operator/internal/controller/proactive_restart_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/proactive_restart_test.go
rename to operator/internal/controller/proactive_restart_test.go
index 8bae27a7..210d99ed 100644
--- a/kagenti-operator/internal/controller/proactive_restart_test.go
+++ b/operator/internal/controller/proactive_restart_test.go
@@ -28,8 +28,8 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/signature"
 )
 
 type mockSignatureProviderWithBundleHash struct {
diff --git a/kagenti-operator/internal/controller/sharedtrust_controller.go b/operator/internal/controller/sharedtrust_controller.go
similarity index 99%
rename from kagenti-operator/internal/controller/sharedtrust_controller.go
rename to operator/internal/controller/sharedtrust_controller.go
index eca68674..47e60a59 100644
--- a/kagenti-operator/internal/controller/sharedtrust_controller.go
+++ b/operator/internal/controller/sharedtrust_controller.go
@@ -77,12 +77,12 @@ var (
 	}
 
 	staleConfigMapNamespaces = []string{
-		"kagenti-system", "gateway-system", "keycloak",
+		"rossoctl-system", "gateway-system", "keycloak",
 		"mcp-system", "istio-system", "istio-ztunnel",
 	}
 
 	// intermediateConfigs matches the standard RHOAI/OSSM3 layout.
-	// Values are intentionally hardcoded to match setup-kagenti.sh.
+	// Values are intentionally hardcoded to match setup-rossoctl.sh.
 	intermediateConfigs = []struct {
 		SecretName string
 		Namespace  string
diff --git a/kagenti-operator/internal/controller/sharedtrust_controller_test.go b/operator/internal/controller/sharedtrust_controller_test.go
similarity index 100%
rename from kagenti-operator/internal/controller/sharedtrust_controller_test.go
rename to operator/internal/controller/sharedtrust_controller_test.go
diff --git a/kagenti-operator/internal/controller/sharedtrust_helpers.go b/operator/internal/controller/sharedtrust_helpers.go
similarity index 100%
rename from kagenti-operator/internal/controller/sharedtrust_helpers.go
rename to operator/internal/controller/sharedtrust_helpers.go
diff --git a/kagenti-operator/internal/controller/sharedtrust_helpers_test.go b/operator/internal/controller/sharedtrust_helpers_test.go
similarity index 100%
rename from kagenti-operator/internal/controller/sharedtrust_helpers_test.go
rename to operator/internal/controller/sharedtrust_helpers_test.go
diff --git a/kagenti-operator/internal/controller/signature_verification_test.go b/operator/internal/controller/signature_verification_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/signature_verification_test.go
rename to operator/internal/controller/signature_verification_test.go
index 0c0433bc..1eecfad8 100644
--- a/kagenti-operator/internal/controller/signature_verification_test.go
+++ b/operator/internal/controller/signature_verification_test.go
@@ -36,9 +36,9 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/signature"
 )
 
 var _ = Describe("Signature Verification", func() {
diff --git a/kagenti-operator/internal/controller/spire_operand_controller.go b/operator/internal/controller/spire_operand_controller.go
similarity index 99%
rename from kagenti-operator/internal/controller/spire_operand_controller.go
rename to operator/internal/controller/spire_operand_controller.go
index 1201b501..b3ba470d 100644
--- a/kagenti-operator/internal/controller/spire_operand_controller.go
+++ b/operator/internal/controller/spire_operand_controller.go
@@ -38,7 +38,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	kd "github.com/kagenti/operator/internal/discovery"
+	kd "github.com/rossoctl/operator/internal/discovery"
 )
 
 const (
diff --git a/kagenti-operator/internal/controller/spire_operand_controller_test.go b/operator/internal/controller/spire_operand_controller_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/spire_operand_controller_test.go
rename to operator/internal/controller/spire_operand_controller_test.go
index fc8cd36c..dbffa6dc 100644
--- a/kagenti-operator/internal/controller/spire_operand_controller_test.go
+++ b/operator/internal/controller/spire_operand_controller_test.go
@@ -29,7 +29,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	kd "github.com/kagenti/operator/internal/discovery"
+	kd "github.com/rossoctl/operator/internal/discovery"
 )
 
 const testTrustDomain = "example.test"
diff --git a/kagenti-operator/internal/controller/suite_test.go b/operator/internal/controller/suite_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/suite_test.go
rename to operator/internal/controller/suite_test.go
index 5b45d756..4cd0e68d 100644
--- a/kagenti-operator/internal/controller/suite_test.go
+++ b/operator/internal/controller/suite_test.go
@@ -35,7 +35,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
diff --git a/kagenti-operator/internal/controller/tektonconfig_controller.go b/operator/internal/controller/tektonconfig_controller.go
similarity index 98%
rename from kagenti-operator/internal/controller/tektonconfig_controller.go
rename to operator/internal/controller/tektonconfig_controller.go
index e072a26e..dcf9e16c 100644
--- a/kagenti-operator/internal/controller/tektonconfig_controller.go
+++ b/operator/internal/controller/tektonconfig_controller.go
@@ -27,7 +27,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
-	"github.com/kagenti/operator/internal/tekton"
+	"github.com/rossoctl/operator/internal/tekton"
 )
 
 var tektonConfigLogger = ctrl.Log.WithName("controller").WithName("TektonConfig")
diff --git a/kagenti-operator/internal/controller/tektonconfig_controller_test.go b/operator/internal/controller/tektonconfig_controller_test.go
similarity index 99%
rename from kagenti-operator/internal/controller/tektonconfig_controller_test.go
rename to operator/internal/controller/tektonconfig_controller_test.go
index 1efc682c..39bd84ba 100644
--- a/kagenti-operator/internal/controller/tektonconfig_controller_test.go
+++ b/operator/internal/controller/tektonconfig_controller_test.go
@@ -29,7 +29,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"github.com/kagenti/operator/internal/tekton"
+	"github.com/rossoctl/operator/internal/tekton"
 )
 
 var _ = Describe("TektonConfigReconciler", func() {
diff --git a/kagenti-operator/internal/controller/tlsbridge_ca_controller.go b/operator/internal/controller/tlsbridge_ca_controller.go
similarity index 98%
rename from kagenti-operator/internal/controller/tlsbridge_ca_controller.go
rename to operator/internal/controller/tlsbridge_ca_controller.go
index ffd79ae7..f49571be 100644
--- a/kagenti-operator/internal/controller/tlsbridge_ca_controller.go
+++ b/operator/internal/controller/tlsbridge_ca_controller.go
@@ -13,7 +13,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 // tlsBridgeSelfSignedIssuer is the per-namespace SelfSigned issuer that
diff --git a/kagenti-operator/internal/controller/tlsbridge_ca_controller_test.go b/operator/internal/controller/tlsbridge_ca_controller_test.go
similarity index 98%
rename from kagenti-operator/internal/controller/tlsbridge_ca_controller_test.go
rename to operator/internal/controller/tlsbridge_ca_controller_test.go
index c7839c64..8a53e54b 100644
--- a/kagenti-operator/internal/controller/tlsbridge_ca_controller_test.go
+++ b/operator/internal/controller/tlsbridge_ca_controller_test.go
@@ -11,7 +11,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 func tlsBridgeScheme(t *testing.T) *runtime.Scheme {
diff --git a/kagenti-operator/internal/discovery/discovery.go b/operator/internal/discovery/discovery.go
similarity index 100%
rename from kagenti-operator/internal/discovery/discovery.go
rename to operator/internal/discovery/discovery.go
diff --git a/kagenti-operator/internal/keycloak/admin.go b/operator/internal/keycloak/admin.go
similarity index 99%
rename from kagenti-operator/internal/keycloak/admin.go
rename to operator/internal/keycloak/admin.go
index 20f5b104..8f7087ae 100644
--- a/kagenti-operator/internal/keycloak/admin.go
+++ b/operator/internal/keycloak/admin.go
@@ -127,7 +127,7 @@ func (a *Admin) PasswordGrantToken(ctx context.Context, adminUser, adminPass str
 }
 
 // JWTSVIDGrantToken authenticates using JWT-SVID and returns an access token.
-// The clientID must be the operator's SPIFFE ID (e.g., spiffe://localtest.me/ns/kagenti-operator-system/sa/...).
+// The clientID must be the operator's SPIFFE ID (e.g., spiffe://localtest.me/ns/rossoctl-operator-system/sa/...).
 // The operator client must be configured in Keycloak with:
 //   - clientAuthenticatorType: "federated-jwt"
 //   - attributes.jwt.credential.issuer: SPIFFE IdP alias
diff --git a/kagenti-operator/internal/keycloak/admin_test.go b/operator/internal/keycloak/admin_test.go
similarity index 81%
rename from kagenti-operator/internal/keycloak/admin_test.go
rename to operator/internal/keycloak/admin_test.go
index df07172b..8b7a227b 100644
--- a/kagenti-operator/internal/keycloak/admin_test.go
+++ b/operator/internal/keycloak/admin_test.go
@@ -34,22 +34,22 @@ func TestAdmin_RegisterOrFetchClient(t *testing.T) {
 			tokenCalls++
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "t"})
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") != "":
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") != "":
 			listCalls++
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "uuid-1", "clientId": "ns/workload"}})
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients/") && strings.HasSuffix(r.URL.Path, "/client-secret"):
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients/") && strings.HasSuffix(r.URL.Path, "/client-secret"):
 			secretCalls++
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"value": "topsecret"})
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients/") && r.Method == http.MethodGet:
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients/") && r.Method == http.MethodGet:
 			getCalls++
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(inSyncClientRep())
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients/") && r.Method == http.MethodPut:
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients/") && r.Method == http.MethodPut:
 			putCalls++
 			t.Fatal("unexpected PUT when client is in sync")
-		case r.URL.Path == "/admin/realms/kagenti/clients" && r.Method == http.MethodPost:
+		case r.URL.Path == "/admin/realms/rossoctl/clients" && r.Method == http.MethodPost:
 			createCalls++
 			t.Fatal("unexpected create when client exists")
 		default:
@@ -60,7 +60,7 @@ func TestAdmin_RegisterOrFetchClient(t *testing.T) {
 
 	a := Admin{BaseURL: srv.URL, HTTPClient: srv.Client()}
 	id, sec, err := a.RegisterOrFetchClient(context.Background(), "admin", "pw", ClientRegistrationParams{
-		Realm:      "kagenti",
+		Realm:      "rossoctl",
 		ClientID:   "ns/workload",
 		ClientName: "ns/workload",
 	})
@@ -82,19 +82,19 @@ func TestAdmin_RegisterOrFetchClient_updatesDrift(t *testing.T) {
 		case r.URL.Path == testMasterRealmTokenPath:
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "t"})
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") != "":
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") != "":
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "uuid-1", "clientId": "ns/workload"}})
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients/") && strings.HasSuffix(r.URL.Path, "/client-secret"):
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients/") && strings.HasSuffix(r.URL.Path, "/client-secret"):
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"value": "topsecret"})
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients/") && r.Method == http.MethodGet:
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients/") && r.Method == http.MethodGet:
 			getCalls++
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(inSyncClientRep())
-		case strings.HasPrefix(r.URL.Path, "/admin/realms/kagenti/clients/") && r.Method == http.MethodPut:
+		case strings.HasPrefix(r.URL.Path, "/admin/realms/rossoctl/clients/") && r.Method == http.MethodPut:
 			putCalls++
-			if r.URL.Path != "/admin/realms/kagenti/clients/uuid-1" {
+			if r.URL.Path != "/admin/realms/rossoctl/clients/uuid-1" {
 				t.Fatalf("unexpected PUT path %s", r.URL.Path)
 			}
 			var body map[string]interface{}
@@ -110,7 +110,7 @@ func TestAdmin_RegisterOrFetchClient_updatesDrift(t *testing.T) {
 				t.Fatalf("expected token exchange true in PUT, got %#v", attrs["standard.token.exchange.enabled"])
 			}
 			w.WriteHeader(http.StatusNoContent)
-		case r.URL.Path == "/admin/realms/kagenti/clients" && r.Method == http.MethodPost:
+		case r.URL.Path == "/admin/realms/rossoctl/clients" && r.Method == http.MethodPost:
 			t.Fatal("unexpected create")
 		default:
 			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
@@ -120,7 +120,7 @@ func TestAdmin_RegisterOrFetchClient_updatesDrift(t *testing.T) {
 
 	a := Admin{BaseURL: srv.URL, HTTPClient: srv.Client()}
 	_, _, err := a.RegisterOrFetchClient(context.Background(), "admin", "pw", ClientRegistrationParams{
-		Realm:               "kagenti",
+		Realm:               "rossoctl",
 		ClientID:            "ns/workload",
 		ClientName:          "ns/workload",
 		TokenExchangeEnable: true,
diff --git a/kagenti-operator/internal/keycloak/audience.go b/operator/internal/keycloak/audience.go
similarity index 100%
rename from kagenti-operator/internal/keycloak/audience.go
rename to operator/internal/keycloak/audience.go
diff --git a/kagenti-operator/internal/keycloak/audience_test.go b/operator/internal/keycloak/audience_test.go
similarity index 83%
rename from kagenti-operator/internal/keycloak/audience_test.go
rename to operator/internal/keycloak/audience_test.go
index fc3ee8ff..a4f078c1 100644
--- a/kagenti-operator/internal/keycloak/audience_test.go
+++ b/operator/internal/keycloak/audience_test.go
@@ -17,7 +17,7 @@ func TestAudienceScopeName(t *testing.T) {
 }
 
 func TestEnsureAudienceScope(t *testing.T) {
-	var listScopesCalls, postScopeCalls, postMapperCalls, putRealmCalls, listKagentiCalls, putClientCalls int
+	var listScopesCalls, postScopeCalls, postMapperCalls, putRealmCalls, listRossoctlCalls, putClientCalls int
 	var srv *httptest.Server
 	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		path := r.URL.Path
@@ -25,12 +25,12 @@ func TestEnsureAudienceScope(t *testing.T) {
 		case path == testMasterRealmTokenPath:
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			listScopesCalls++
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{})
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodPost:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodPost:
 			postScopeCalls++
-			w.Header().Set("Location", srv.URL+"/admin/realms/kagenti/client-scopes/new-scope-id")
+			w.Header().Set("Location", srv.URL+"/admin/realms/rossoctl/client-scopes/new-scope-id")
 			w.WriteHeader(http.StatusCreated)
 		case strings.Contains(path, "/client-scopes/new-scope-id/protocol-mappers/models") && r.Method == http.MethodPost:
 			postMapperCalls++
@@ -41,13 +41,13 @@ func TestEnsureAudienceScope(t *testing.T) {
 				ProtocolMapper: "oidc-audience-mapper",
 				Config:         map[string]string{"included.custom.audience": "ns/wl"},
 			}})
-		case path == "/admin/realms/kagenti/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			putRealmCalls++
 			w.WriteHeader(http.StatusNoContent)
-		case strings.HasPrefix(path, "/admin/realms/kagenti/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") == "kagenti":
-			listKagentiCalls++
-			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "plat-int", "clientId": "kagenti"}})
-		case path == "/admin/realms/kagenti/clients/plat-int/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case strings.HasPrefix(path, "/admin/realms/rossoctl/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") == "rossoctl":
+			listRossoctlCalls++
+			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "plat-int", "clientId": "rossoctl"}})
+		case path == "/admin/realms/rossoctl/clients/plat-int/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			putClientCalls++
 			w.WriteHeader(http.StatusNoContent)
 		default:
@@ -62,10 +62,10 @@ func TestEnsureAudienceScope(t *testing.T) {
 		t.Fatal(err)
 	}
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     "ns/wl",
-		PlatformClientIDs:    []string{"kagenti"},
+		PlatformClientIDs:    []string{"rossoctl"},
 		AudienceScopeEnabled: true,
 	})
 	if err != nil {
@@ -74,8 +74,8 @@ func TestEnsureAudienceScope(t *testing.T) {
 	if listScopesCalls != 1 {
 		t.Fatalf("listScopesCalls=%d", listScopesCalls)
 	}
-	if postScopeCalls != 1 || postMapperCalls != 1 || putRealmCalls != 1 || listKagentiCalls != 1 || putClientCalls != 1 {
-		t.Fatalf("calls scope=%d mapper=%d realm=%d listK=%d putC=%d", postScopeCalls, postMapperCalls, putRealmCalls, listKagentiCalls, putClientCalls)
+	if postScopeCalls != 1 || postMapperCalls != 1 || putRealmCalls != 1 || listRossoctlCalls != 1 || putClientCalls != 1 {
+		t.Fatalf("calls scope=%d mapper=%d realm=%d listK=%d putC=%d", postScopeCalls, postMapperCalls, putRealmCalls, listRossoctlCalls, putClientCalls)
 	}
 }
 
@@ -92,10 +92,10 @@ func TestEnsureAudienceScope_AttachesToAgentClient(t *testing.T) {
 		case path == testMasterRealmTokenPath:
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{})
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodPost:
-			w.Header().Set("Location", srv.URL+"/admin/realms/kagenti/client-scopes/new-scope-id")
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodPost:
+			w.Header().Set("Location", srv.URL+"/admin/realms/rossoctl/client-scopes/new-scope-id")
 			w.WriteHeader(http.StatusCreated)
 		case strings.Contains(path, "/client-scopes/new-scope-id/protocol-mappers/models") && r.Method == http.MethodPost:
 			w.WriteHeader(http.StatusCreated)
@@ -105,14 +105,14 @@ func TestEnsureAudienceScope_AttachesToAgentClient(t *testing.T) {
 				ProtocolMapper: "oidc-audience-mapper",
 				Config:         map[string]string{"included.custom.audience": "ns/wl"},
 			}})
-		case path == "/admin/realms/kagenti/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
-		case strings.HasPrefix(path, "/admin/realms/kagenti/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") == "kagenti":
-			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "plat-int", "clientId": "kagenti"}})
-		case path == "/admin/realms/kagenti/clients/agent-uuid-123/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case strings.HasPrefix(path, "/admin/realms/rossoctl/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") == "rossoctl":
+			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "plat-int", "clientId": "rossoctl"}})
+		case path == "/admin/realms/rossoctl/clients/agent-uuid-123/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			putAgentClientCalls++
 			w.WriteHeader(http.StatusNoContent)
-		case path == "/admin/realms/kagenti/clients/plat-int/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/clients/plat-int/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			putPlatformClientCalls++
 			w.WriteHeader(http.StatusNoContent)
 		default:
@@ -127,10 +127,10 @@ func TestEnsureAudienceScope_AttachesToAgentClient(t *testing.T) {
 		t.Fatal(err)
 	}
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     "ns/wl",
-		PlatformClientIDs:    []string{"kagenti"},
+		PlatformClientIDs:    []string{"rossoctl"},
 		AudienceScopeEnabled: true,
 		AgentClientUUID:      "agent-uuid-123",
 	})
@@ -155,10 +155,10 @@ func TestEnsureAudienceScope_NoAgentAttachWhenUUIDEmpty(t *testing.T) {
 		case path == testMasterRealmTokenPath:
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{})
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodPost:
-			w.Header().Set("Location", srv.URL+"/admin/realms/kagenti/client-scopes/new-scope-id")
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodPost:
+			w.Header().Set("Location", srv.URL+"/admin/realms/rossoctl/client-scopes/new-scope-id")
 			w.WriteHeader(http.StatusCreated)
 		case strings.Contains(path, "/client-scopes/new-scope-id/protocol-mappers/models") && r.Method == http.MethodPost:
 			w.WriteHeader(http.StatusCreated)
@@ -168,11 +168,11 @@ func TestEnsureAudienceScope_NoAgentAttachWhenUUIDEmpty(t *testing.T) {
 				ProtocolMapper: "oidc-audience-mapper",
 				Config:         map[string]string{"included.custom.audience": "ns/wl"},
 			}})
-		case path == "/admin/realms/kagenti/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
-		case strings.HasPrefix(path, "/admin/realms/kagenti/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") == "kagenti":
-			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "plat-int", "clientId": "kagenti"}})
-		case path == "/admin/realms/kagenti/clients/plat-int/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case strings.HasPrefix(path, "/admin/realms/rossoctl/clients") && r.Method == http.MethodGet && r.URL.Query().Get("clientId") == "rossoctl":
+			_ = json.NewEncoder(w).Encode([]map[string]string{{"id": "plat-int", "clientId": "rossoctl"}})
+		case path == "/admin/realms/rossoctl/clients/plat-int/default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
 		default:
 			// Critical: any PUT to /clients/<uuid>/default-client-scopes/... where uuid != plat-int
@@ -188,10 +188,10 @@ func TestEnsureAudienceScope_NoAgentAttachWhenUUIDEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     "ns/wl",
-		PlatformClientIDs:    []string{"kagenti"},
+		PlatformClientIDs:    []string{"rossoctl"},
 		AudienceScopeEnabled: true,
 		// AgentClientUUID intentionally empty
 	})
@@ -216,7 +216,7 @@ func TestEnsureAudienceScope_UpdatesStaleMapper(t *testing.T) {
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
 
 		// Scope already exists
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{{ID: "scope-123", Name: "agent-ns-wl-aud"}})
 
 		// POST mapper returns 409 (already exists)
@@ -251,7 +251,7 @@ func TestEnsureAudienceScope_UpdatesStaleMapper(t *testing.T) {
 			w.WriteHeader(http.StatusNoContent)
 
 		// Realm default scope
-		case path == "/admin/realms/kagenti/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
 
 		default:
@@ -267,7 +267,7 @@ func TestEnsureAudienceScope_UpdatesStaleMapper(t *testing.T) {
 	}
 
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     spiffeURI,
 		AudienceScopeEnabled: true,
@@ -298,7 +298,7 @@ func TestEnsureAudienceScope_SkipsUpdateWhenCorrect(t *testing.T) {
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
 
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{{ID: "scope-123", Name: "agent-ns-wl-aud"}})
 
 		case strings.Contains(path, "/client-scopes/scope-123/protocol-mappers/models") && r.Method == http.MethodPost:
@@ -323,7 +323,7 @@ func TestEnsureAudienceScope_SkipsUpdateWhenCorrect(t *testing.T) {
 			putMapperCalls++
 			w.WriteHeader(http.StatusNoContent)
 
-		case path == "/admin/realms/kagenti/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
 
 		default:
@@ -339,7 +339,7 @@ func TestEnsureAudienceScope_SkipsUpdateWhenCorrect(t *testing.T) {
 	}
 
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     "spiffe://example.org/ns/ns/sa/wl",
 		AudienceScopeEnabled: true,
@@ -367,12 +367,12 @@ func TestEnsureAudienceScope_MapperFailureForNewScope(t *testing.T) {
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
 
 		// Scope does not exist yet
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{})
 
 		// Scope creation succeeds
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodPost:
-			w.Header().Set("Location", srv.URL+"/admin/realms/kagenti/client-scopes/new-scope-id")
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodPost:
+			w.Header().Set("Location", srv.URL+"/admin/realms/rossoctl/client-scopes/new-scope-id")
 			w.WriteHeader(http.StatusCreated)
 
 		// Mapper POST: first call (from ensureAudienceMapper) returns 500, second call
@@ -391,7 +391,7 @@ func TestEnsureAudienceScope_MapperFailureForNewScope(t *testing.T) {
 			_ = json.NewEncoder(w).Encode([]protocolMapperRep{})
 
 		// Realm default scope
-		case path == "/admin/realms/kagenti/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/new-scope-id" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
 
 		default:
@@ -407,7 +407,7 @@ func TestEnsureAudienceScope_MapperFailureForNewScope(t *testing.T) {
 	}
 
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     "spiffe://example.org/ns/ns/sa/wl",
 		AudienceScopeEnabled: true,
@@ -435,7 +435,7 @@ func TestEnsureAudienceScope_VerifyRecreatesMissingMapper(t *testing.T) {
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
 
 		// Scope already exists from prior run
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{{ID: "scope-123", Name: "agent-ns-wl-aud"}})
 
 		// ensureAudienceMapper POST — mapper created (scope exists, mapper doesn't)
@@ -458,7 +458,7 @@ func TestEnsureAudienceScope_VerifyRecreatesMissingMapper(t *testing.T) {
 			}
 
 		// Realm default scope
-		case path == "/admin/realms/kagenti/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
 
 		default:
@@ -474,7 +474,7 @@ func TestEnsureAudienceScope_VerifyRecreatesMissingMapper(t *testing.T) {
 	}
 
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     spiffeURI,
 		AudienceScopeEnabled: true,
@@ -505,7 +505,7 @@ func TestEnsureAudienceScope_DeletesCorruptedMapper(t *testing.T) {
 			_ = json.NewEncoder(w).Encode(map[string]string{"access_token": "tok"})
 
 		// Scope already exists
-		case path == "/admin/realms/kagenti/client-scopes" && r.Method == http.MethodGet:
+		case path == "/admin/realms/rossoctl/client-scopes" && r.Method == http.MethodGet:
 			_ = json.NewEncoder(w).Encode([]clientScopeListItem{{ID: "scope-123", Name: "agent-ns-wl-aud"}})
 
 		// ensureAudienceMapper POST — 409 conflict (name collision with corrupted mapper)
@@ -542,7 +542,7 @@ func TestEnsureAudienceScope_DeletesCorruptedMapper(t *testing.T) {
 			w.WriteHeader(http.StatusNoContent)
 
 		// Realm default scope
-		case path == "/admin/realms/kagenti/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
+		case path == "/admin/realms/rossoctl/default-default-client-scopes/scope-123" && r.Method == http.MethodPut:
 			w.WriteHeader(http.StatusNoContent)
 
 		default:
@@ -558,7 +558,7 @@ func TestEnsureAudienceScope_DeletesCorruptedMapper(t *testing.T) {
 	}
 
 	err = a.EnsureAudienceScope(context.Background(), token, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           "ns/wl",
 		AudienceClientID:     spiffeURI,
 		AudienceScopeEnabled: true,
diff --git a/kagenti-operator/internal/keycloak/authflow_test.go b/operator/internal/keycloak/authflow_test.go
similarity index 97%
rename from kagenti-operator/internal/keycloak/authflow_test.go
rename to operator/internal/keycloak/authflow_test.go
index a638435d..a23890e7 100644
--- a/kagenti-operator/internal/keycloak/authflow_test.go
+++ b/operator/internal/keycloak/authflow_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/kagenti/operator/internal/keycloak/testidp"
+	"github.com/rossoctl/operator/internal/keycloak/testidp"
 )
 
 // TestAuthFlow_TokenAcquisition validates the full operator-to-workload auth flow:
@@ -24,7 +24,7 @@ func TestAuthFlow_TokenAcquisition(t *testing.T) {
 	clientID := "test-ns/my-workload"
 
 	internalID, secret, err := a.RegisterOrFetchClient(context.Background(), "admin", "admin", ClientRegistrationParams{
-		Realm:      "kagenti",
+		Realm:      "rossoctl",
 		ClientID:   clientID,
 		ClientName: clientID,
 	})
@@ -217,7 +217,7 @@ func TestAuthFlow_EndToEnd_RegisterAndAuthenticate(t *testing.T) {
 	// Step 2: Register client with token
 	clientID := "production/my-agent"
 	internalID, secret, err := a.RegisterOrFetchClientWithToken(ctx, adminToken, ClientRegistrationParams{
-		Realm:               "kagenti",
+		Realm:               "rossoctl",
 		ClientID:            clientID,
 		ClientName:          clientID,
 		TokenExchangeEnable: true,
@@ -231,10 +231,10 @@ func TestAuthFlow_EndToEnd_RegisterAndAuthenticate(t *testing.T) {
 
 	// Step 3: Ensure audience scope (best-effort, like the operator)
 	err = a.EnsureAudienceScope(ctx, adminToken, AudienceParams{
-		Realm:                "kagenti",
+		Realm:                "rossoctl",
 		ClientName:           clientID,
 		AudienceClientID:     clientID,
-		PlatformClientIDs:    []string{"kagenti"},
+		PlatformClientIDs:    []string{"rossoctl"},
 		AudienceScopeEnabled: true,
 	})
 	if err != nil {
diff --git a/kagenti-operator/internal/keycloak/const_test.go b/operator/internal/keycloak/const_test.go
similarity index 100%
rename from kagenti-operator/internal/keycloak/const_test.go
rename to operator/internal/keycloak/const_test.go
diff --git a/kagenti-operator/internal/keycloak/testidp/fake_idp.go b/operator/internal/keycloak/testidp/fake_idp.go
similarity index 99%
rename from kagenti-operator/internal/keycloak/testidp/fake_idp.go
rename to operator/internal/keycloak/testidp/fake_idp.go
index 9d399799..4a0fc750 100644
--- a/kagenti-operator/internal/keycloak/testidp/fake_idp.go
+++ b/operator/internal/keycloak/testidp/fake_idp.go
@@ -56,7 +56,7 @@ func WithTokenTTL(d time.Duration) Option {
 	return func(f *FakeIDP) { f.tokenTTL = d }
 }
 
-// WithRealm sets the realm name used in URL paths (default: "kagenti").
+// WithRealm sets the realm name used in URL paths (default: "rossoctl").
 func WithRealm(realm string) Option {
 	return func(f *FakeIDP) { f.realm = realm }
 }
@@ -104,7 +104,7 @@ type mapperEntry struct {
 func Start(t testing.TB, opts ...Option) *FakeIDP {
 	t.Helper()
 	f := &FakeIDP{
-		realm:     "kagenti",
+		realm:     "rossoctl",
 		adminUser: "admin",
 		adminPass: "admin",
 		tokenTTL:  time.Hour,
diff --git a/kagenti-operator/internal/keycloak/token_cache.go b/operator/internal/keycloak/token_cache.go
similarity index 100%
rename from kagenti-operator/internal/keycloak/token_cache.go
rename to operator/internal/keycloak/token_cache.go
diff --git a/kagenti-operator/internal/keycloak/token_cache_test.go b/operator/internal/keycloak/token_cache_test.go
similarity index 100%
rename from kagenti-operator/internal/keycloak/token_cache_test.go
rename to operator/internal/keycloak/token_cache_test.go
diff --git a/kagenti-operator/internal/kuadrant/types.go b/operator/internal/kuadrant/types.go
similarity index 100%
rename from kagenti-operator/internal/kuadrant/types.go
rename to operator/internal/kuadrant/types.go
diff --git a/kagenti-operator/internal/mlflow/client.go b/operator/internal/mlflow/client.go
similarity index 100%
rename from kagenti-operator/internal/mlflow/client.go
rename to operator/internal/mlflow/client.go
diff --git a/kagenti-operator/internal/mlflow/client_test.go b/operator/internal/mlflow/client_test.go
similarity index 100%
rename from kagenti-operator/internal/mlflow/client_test.go
rename to operator/internal/mlflow/client_test.go
diff --git a/kagenti-operator/internal/mlflow/types.go b/operator/internal/mlflow/types.go
similarity index 100%
rename from kagenti-operator/internal/mlflow/types.go
rename to operator/internal/mlflow/types.go
diff --git a/kagenti-operator/internal/signature/metrics.go b/operator/internal/signature/metrics.go
similarity index 93%
rename from kagenti-operator/internal/signature/metrics.go
rename to operator/internal/signature/metrics.go
index 3916c8b3..fa9a96fd 100644
--- a/kagenti-operator/internal/signature/metrics.go
+++ b/operator/internal/signature/metrics.go
@@ -49,7 +49,7 @@ var (
 
 	SigstoreVerificationTotal = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
-			Name: "kagenti_sigstore_verification_total",
+			Name: "rossoctl_sigstore_verification_total",
 			Help: "Sigstore SignedAgentCard bundle verification attempts",
 		},
 		[]string{"result", "reason"},
@@ -57,7 +57,7 @@ var (
 
 	SigstoreVerificationDuration = prometheus.NewHistogramVec(
 		prometheus.HistogramOpts{
-			Name:    "kagenti_sigstore_verification_duration_seconds",
+			Name:    "rossoctl_sigstore_verification_duration_seconds",
 			Help:    "Sigstore bundle verification latency",
 			Buckets: prometheus.DefBuckets,
 		},
@@ -66,14 +66,14 @@ var (
 
 	SigstoreTrustedRootAgeSeconds = prometheus.NewGauge(
 		prometheus.GaugeOpts{
-			Name: "kagenti_sigstore_trusted_root_age_seconds",
+			Name: "rossoctl_sigstore_trusted_root_age_seconds",
 			Help: "Age of the cached Sigstore trusted root material",
 		},
 	)
 
 	SLSAProvenanceVerifiedTotal = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
-			Name: "kagenti_slsa_provenance_verified_total",
+			Name: "rossoctl_slsa_provenance_verified_total",
 			Help: "SLSA provenance bundle observations after Sigstore verify",
 		},
 		[]string{"result"},
diff --git a/kagenti-operator/internal/signature/metrics_test.go b/operator/internal/signature/metrics_test.go
similarity index 100%
rename from kagenti-operator/internal/signature/metrics_test.go
rename to operator/internal/signature/metrics_test.go
diff --git a/kagenti-operator/internal/signature/provider.go b/operator/internal/signature/provider.go
similarity index 98%
rename from kagenti-operator/internal/signature/provider.go
rename to operator/internal/signature/provider.go
index 3f6dcd65..3faf53ba 100644
--- a/kagenti-operator/internal/signature/provider.go
+++ b/operator/internal/signature/provider.go
@@ -21,7 +21,7 @@ import (
 	"fmt"
 	"time"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
diff --git a/kagenti-operator/internal/signature/provider_test.go b/operator/internal/signature/provider_test.go
similarity index 100%
rename from kagenti-operator/internal/signature/provider_test.go
rename to operator/internal/signature/provider_test.go
diff --git a/kagenti-operator/internal/signature/signer.go b/operator/internal/signature/signer.go
similarity index 98%
rename from kagenti-operator/internal/signature/signer.go
rename to operator/internal/signature/signer.go
index a70752b6..80fbe126 100644
--- a/kagenti-operator/internal/signature/signer.go
+++ b/operator/internal/signature/signer.go
@@ -28,7 +28,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 // SignCard signs AgentCard data with the given private key and certificate chain,
diff --git a/kagenti-operator/internal/signature/signer_test.go b/operator/internal/signature/signer_test.go
similarity index 98%
rename from kagenti-operator/internal/signature/signer_test.go
rename to operator/internal/signature/signer_test.go
index 7288a0bc..949ab930 100644
--- a/kagenti-operator/internal/signature/signer_test.go
+++ b/operator/internal/signature/signer_test.go
@@ -25,7 +25,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 func TestSignCard_ECDSA_P256(t *testing.T) {
diff --git a/kagenti-operator/internal/signature/sigstore.go b/operator/internal/signature/sigstore.go
similarity index 99%
rename from kagenti-operator/internal/signature/sigstore.go
rename to operator/internal/signature/sigstore.go
index 333799d6..2b019140 100644
--- a/kagenti-operator/internal/signature/sigstore.go
+++ b/operator/internal/signature/sigstore.go
@@ -26,7 +26,7 @@ import (
 	"time"
 
 	"github.com/gowebpki/jcs"
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	sigbundle "github.com/sigstore/sigstore-go/pkg/bundle"
 	"github.com/sigstore/sigstore-go/pkg/root"
 	"github.com/sigstore/sigstore-go/pkg/tuf"
diff --git a/kagenti-operator/internal/signature/sigstore_parse_test.go b/operator/internal/signature/sigstore_parse_test.go
similarity index 100%
rename from kagenti-operator/internal/signature/sigstore_parse_test.go
rename to operator/internal/signature/sigstore_parse_test.go
diff --git a/kagenti-operator/internal/signature/verifier.go b/operator/internal/signature/verifier.go
similarity index 99%
rename from kagenti-operator/internal/signature/verifier.go
rename to operator/internal/signature/verifier.go
index 78a5b4eb..1d01f98d 100644
--- a/kagenti-operator/internal/signature/verifier.go
+++ b/operator/internal/signature/verifier.go
@@ -32,7 +32,7 @@ import (
 	"math/big"
 	"sort"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 // ProtectedHeader represents the decoded JWS protected header (A2A spec section 8.4.2).
diff --git a/kagenti-operator/internal/signature/verifier_test.go b/operator/internal/signature/verifier_test.go
similarity index 99%
rename from kagenti-operator/internal/signature/verifier_test.go
rename to operator/internal/signature/verifier_test.go
index e7deb7ab..754605bc 100644
--- a/kagenti-operator/internal/signature/verifier_test.go
+++ b/operator/internal/signature/verifier_test.go
@@ -30,7 +30,7 @@ import (
 	"encoding/pem"
 	"testing"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 // --- Test helpers ---
diff --git a/kagenti-operator/internal/signature/x5c.go b/operator/internal/signature/x5c.go
similarity index 97%
rename from kagenti-operator/internal/signature/x5c.go
rename to operator/internal/signature/x5c.go
index 494d52b5..1d91b5bc 100644
--- a/kagenti-operator/internal/signature/x5c.go
+++ b/operator/internal/signature/x5c.go
@@ -30,8 +30,8 @@ import (
 	"sync"
 	"time"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
 	"github.com/prometheus/client_golang/prometheus"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -44,27 +44,27 @@ var x5cLogger = ctrl.Log.WithName("signature").WithName("x5c")
 var (
 	x5cChainValidationTotal = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
-			Name: "kagenti_x5c_chain_validation_total",
+			Name: "rossoctl_x5c_chain_validation_total",
 			Help: "Total x5c chain validation attempts",
 		},
 		[]string{"valid", "reason"},
 	)
 	x5cTrustBundleAgeSeconds = prometheus.NewGauge(
 		prometheus.GaugeOpts{
-			Name: "kagenti_x5c_trust_bundle_age_seconds",
+			Name: "rossoctl_x5c_trust_bundle_age_seconds",
 			Help: "Age of the cached trust bundle in seconds",
 		},
 	)
 	x5cTrustBundleLoadErrorsTotal = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
-			Name: "kagenti_x5c_trust_bundle_load_errors_total",
+			Name: "rossoctl_x5c_trust_bundle_load_errors_total",
 			Help: "Trust bundle load/parse failures",
 		},
 		[]string{"reason"},
 	)
 	x5cBindingTrustDomainMismatchTotal = prometheus.NewCounter(
 		prometheus.CounterOpts{
-			Name: "kagenti_x5c_binding_trust_domain_mismatch_total",
+			Name: "rossoctl_x5c_binding_trust_domain_mismatch_total",
 			Help: "Count of cert SAN SPIFFE ID trust domain mismatches",
 		},
 	)
diff --git a/kagenti-operator/internal/signature/x5c_test.go b/operator/internal/signature/x5c_test.go
similarity index 99%
rename from kagenti-operator/internal/signature/x5c_test.go
rename to operator/internal/signature/x5c_test.go
index c89ad4a7..aca3e335 100644
--- a/kagenti-operator/internal/signature/x5c_test.go
+++ b/operator/internal/signature/x5c_test.go
@@ -34,7 +34,7 @@ import (
 	"testing"
 	"time"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 )
 
 type testCA struct {
diff --git a/kagenti-operator/internal/tekton/types.go b/operator/internal/tekton/types.go
similarity index 100%
rename from kagenti-operator/internal/tekton/types.go
rename to operator/internal/tekton/types.go
diff --git a/kagenti-operator/internal/webhook/config/defaults.go b/operator/internal/webhook/config/defaults.go
similarity index 88%
rename from kagenti-operator/internal/webhook/config/defaults.go
rename to operator/internal/webhook/config/defaults.go
index 8a9c36d8..b00b8372 100644
--- a/kagenti-operator/internal/webhook/config/defaults.go
+++ b/operator/internal/webhook/config/defaults.go
@@ -6,7 +6,7 @@ import (
 )
 
 // DefaultSpiffeHelperConfig is the default helper.conf content for spiffe-helper.
-// Keep in sync with charts/kagenti-operator/values.yaml defaults.spiffe.helperConfig.
+// Keep in sync with charts/operator/values.yaml defaults.spiffe.helperConfig.
 // The jwt_audience below targets a local dev Keycloak. Production and OpenShift
 // deployments MUST override this via Helm values (defaults.spiffe.helperConfig)
 // to set the in-cluster Keycloak audience.
@@ -18,7 +18,7 @@ svid_key_file_name = "/opt/svid_key.pem"
 svid_bundle_file_name = "/opt/svid_bundle.pem"
 cert_file_mode = 0644
 key_file_mode = 0640
-jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/kagenti", jwt_svid_file_name="/opt/jwt_svid.token"}]
+jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/rossoctl", jwt_svid_file_name="/opt/jwt_svid.token"}]
 jwt_svid_file_mode = 0644
 include_federated_domains = true
 `
@@ -27,22 +27,22 @@ include_federated_domains = true
 func CompiledDefaults() *PlatformConfig {
 	return &PlatformConfig{
 		// Compiled defaults are overridden at runtime by the platform-config
-		// ConfigMap (kagenti-platform-config). These serve as fallbacks only.
+		// ConfigMap (rossoctl-platform-config). These serve as fallbacks only.
 		Images: ImageConfig{
 			// authbridge-envoy: combined image for envoy-sidecar mode
 			// (Envoy + ext_proc authbridge + spiffe-helper bundled).
-			EnvoyProxy: "ghcr.io/kagenti/kagenti-extensions/authbridge-envoy:latest",
+			EnvoyProxy: "ghcr.io/rossoctl/rossocortex/authbridge-envoy:latest",
 			// authbridge: combined image for proxy-sidecar mode (default
 			// deployment shape) — authbridge-proxy + spiffe-helper
 			// bundled, no Envoy, no gRPC.
-			AuthBridge: "ghcr.io/kagenti/kagenti-extensions/authbridge:latest",
+			AuthBridge: "ghcr.io/rossoctl/rossocortex/authbridge:latest",
 			// authbridge-lite: size-optimized variant for the "lite"
 			// mode. Same listener layout as AuthBridge but parsers
 			// (a2a/mcp/inference) are dropped.
-			AuthBridgeLite: "ghcr.io/kagenti/kagenti-extensions/authbridge-lite:latest",
+			AuthBridgeLite: "ghcr.io/rossoctl/rossocortex/authbridge-lite:latest",
 			// proxy-init: iptables init container, used by
 			// envoy-sidecar mode only.
-			ProxyInit:  "ghcr.io/kagenti/kagenti-extensions/proxy-init:latest",
+			ProxyInit:  "ghcr.io/rossoctl/rossocortex/proxy-init:latest",
 			PullPolicy: corev1.PullIfNotPresent,
 		},
 		Proxy: ProxyConfig{
diff --git a/kagenti-operator/internal/webhook/config/feature_gate_loader.go b/operator/internal/webhook/config/feature_gate_loader.go
similarity index 100%
rename from kagenti-operator/internal/webhook/config/feature_gate_loader.go
rename to operator/internal/webhook/config/feature_gate_loader.go
diff --git a/kagenti-operator/internal/webhook/config/feature_gates.go b/operator/internal/webhook/config/feature_gates.go
similarity index 93%
rename from kagenti-operator/internal/webhook/config/feature_gates.go
rename to operator/internal/webhook/config/feature_gates.go
index 8c8ea88c..bdac099b 100644
--- a/kagenti-operator/internal/webhook/config/feature_gates.go
+++ b/operator/internal/webhook/config/feature_gates.go
@@ -13,7 +13,7 @@ package config
 type FeatureGates struct {
 	GlobalEnabled bool `json:"globalEnabled" yaml:"globalEnabled"`
 	EnvoyProxy    bool `json:"envoyProxy" yaml:"envoyProxy"`
-	// InjectTools controls whether tool workloads (kagenti.io/type=tool) receive
+	// InjectTools controls whether tool workloads (rossoctl.io/type=tool) receive
 	// sidecar injection. Defaults to false — tools are not injected by default.
 	InjectTools bool `json:"injectTools" yaml:"injectTools"`
 	// PerWorkloadConfigResolution controls the env-var injection mode:
@@ -23,7 +23,7 @@ type FeatureGates struct {
 	//                     admission time and injects literal env var values.
 	PerWorkloadConfigResolution bool `json:"perWorkloadConfigResolution" yaml:"perWorkloadConfigResolution"`
 	// SkillDiscovery controls whether the AgentRuntime controller reads the
-	// kagenti.io/skills annotation from target workloads and populates
+	// rossoctl.io/skills annotation from target workloads and populates
 	// status.linkedSkills. When disabled, skill discovery is skipped and
 	// the SkillsDiscovered condition is not set.
 	SkillDiscovery bool `json:"skillDiscovery" yaml:"skillDiscovery"`
diff --git a/kagenti-operator/internal/webhook/config/loader.go b/operator/internal/webhook/config/loader.go
similarity index 100%
rename from kagenti-operator/internal/webhook/config/loader.go
rename to operator/internal/webhook/config/loader.go
diff --git a/kagenti-operator/internal/webhook/config/loader_onchange_test.go b/operator/internal/webhook/config/loader_onchange_test.go
similarity index 100%
rename from kagenti-operator/internal/webhook/config/loader_onchange_test.go
rename to operator/internal/webhook/config/loader_onchange_test.go
diff --git a/kagenti-operator/internal/webhook/config/types.go b/operator/internal/webhook/config/types.go
similarity index 100%
rename from kagenti-operator/internal/webhook/config/types.go
rename to operator/internal/webhook/config/types.go
diff --git a/kagenti-operator/internal/webhook/config/types_test.go b/operator/internal/webhook/config/types_test.go
similarity index 100%
rename from kagenti-operator/internal/webhook/config/types_test.go
rename to operator/internal/webhook/config/types_test.go
diff --git a/kagenti-operator/internal/webhook/injector/constants.go b/operator/internal/webhook/injector/constants.go
similarity index 94%
rename from kagenti-operator/internal/webhook/injector/constants.go
rename to operator/internal/webhook/injector/constants.go
index a495a0a9..66a0d605 100644
--- a/kagenti-operator/internal/webhook/injector/constants.go
+++ b/operator/internal/webhook/injector/constants.go
@@ -3,8 +3,8 @@ package injector
 // Label constants used by the precedence evaluator.
 const (
 	// Per-sidecar workload labels — set value to "false" to disable injection
-	LabelEnvoyProxyInject   = "kagenti.io/envoy-proxy-inject"
-	LabelSpiffeHelperInject = "kagenti.io/spiffe-helper-inject"
+	LabelEnvoyProxyInject   = "rossoctl.io/envoy-proxy-inject"
+	LabelSpiffeHelperInject = "rossoctl.io/spiffe-helper-inject"
 )
 
 // AuthBridge deployment modes. Selected via the namespace
@@ -23,7 +23,7 @@ const (
 	// mode on first redeploy.
 	//
 	// Deprecated: set mode in the namespace authbridge-runtime-config ConfigMap.
-	AnnotationAuthBridgeMode = "kagenti.io/authbridge-mode"
+	AnnotationAuthBridgeMode = "rossoctl.io/authbridge-mode"
 
 	// Container name for proxy-sidecar mode
 	AuthBridgeProxyContainerName = "authbridge-proxy"
@@ -68,7 +68,7 @@ const (
 // mTLS modes for the proxy-sidecar / lite paths. Selected via the
 // namespace `authbridge-runtime-config` ConfigMap's `mtls.mode` field,
 // then MTLSModeDisabled. envoy-sidecar mode is incompatible with mTLS
-// today (Envoy SDS not configured by the kagenti envoy-config) —
+// today (Envoy SDS not configured by the rossoctl envoy-config) —
 // admission rejects mtlsMode != disabled in that combination.
 const (
 	MTLSModeDisabled   = "disabled"
diff --git a/kagenti-operator/internal/webhook/injector/container_builder.go b/operator/internal/webhook/injector/container_builder.go
similarity index 99%
rename from kagenti-operator/internal/webhook/injector/container_builder.go
rename to operator/internal/webhook/injector/container_builder.go
index c3b07ca5..74bc607b 100644
--- a/kagenti-operator/internal/webhook/injector/container_builder.go
+++ b/operator/internal/webhook/injector/container_builder.go
@@ -22,7 +22,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/kagenti/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/config"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/utils/ptr"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
@@ -457,7 +457,7 @@ const mandatoryOutboundExclude = "8080"
 // mode selects the interception strategy the init script runs:
 //   - "redirect" (envoy-sidecar): transparently REDIRECT pod traffic to the
 //     Envoy listeners. outboundPortsExclude / inboundPortsExclude (from the
-//     kagenti.io/outbound-ports-exclude and kagenti.io/inbound-ports-exclude
+//     rossoctl.io/outbound-ports-exclude and rossoctl.io/inbound-ports-exclude
 //     pod annotations; mandatory 8080 always included outbound) tune it.
 //   - "enforce-redirect" (proxy-sidecar): a fail-closed egress guard that
 //     REDIRECTs external TCP bypassing the forward proxy to the transparent
diff --git a/kagenti-operator/internal/webhook/injector/container_builder_test.go b/operator/internal/webhook/injector/container_builder_test.go
similarity index 99%
rename from kagenti-operator/internal/webhook/injector/container_builder_test.go
rename to operator/internal/webhook/injector/container_builder_test.go
index 84a0eec1..7d60d989 100644
--- a/kagenti-operator/internal/webhook/injector/container_builder_test.go
+++ b/operator/internal/webhook/injector/container_builder_test.go
@@ -20,7 +20,7 @@ import (
 	"strconv"
 	"testing"
 
-	"github.com/kagenti/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/config"
 )
 
 func TestBuildEnvoyProxyContainer_SpireEnabled_HasSvidOutputMount(t *testing.T) {
diff --git a/kagenti-operator/internal/webhook/injector/envoy.yaml.tmpl b/operator/internal/webhook/injector/envoy.yaml.tmpl
similarity index 100%
rename from kagenti-operator/internal/webhook/injector/envoy.yaml.tmpl
rename to operator/internal/webhook/injector/envoy.yaml.tmpl
diff --git a/kagenti-operator/internal/webhook/injector/envoy_template.go b/operator/internal/webhook/injector/envoy_template.go
similarity index 100%
rename from kagenti-operator/internal/webhook/injector/envoy_template.go
rename to operator/internal/webhook/injector/envoy_template.go
diff --git a/kagenti-operator/internal/webhook/injector/envoy_template_test.go b/operator/internal/webhook/injector/envoy_template_test.go
similarity index 98%
rename from kagenti-operator/internal/webhook/injector/envoy_template_test.go
rename to operator/internal/webhook/injector/envoy_template_test.go
index 49203f44..aa2b50ad 100644
--- a/kagenti-operator/internal/webhook/injector/envoy_template_test.go
+++ b/operator/internal/webhook/injector/envoy_template_test.go
@@ -20,7 +20,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/kagenti/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/config"
 )
 
 func TestRenderEnvoyConfig_TemplateRendering(t *testing.T) {
diff --git a/kagenti-operator/internal/webhook/injector/injection_decision.go b/operator/internal/webhook/injector/injection_decision.go
similarity index 94%
rename from kagenti-operator/internal/webhook/injector/injection_decision.go
rename to operator/internal/webhook/injector/injection_decision.go
index 839b8fd2..933faf82 100644
--- a/kagenti-operator/internal/webhook/injector/injection_decision.go
+++ b/operator/internal/webhook/injector/injection_decision.go
@@ -19,7 +19,7 @@ type SidecarDecision struct {
 // no longer represented in the decision struct.
 //
 // TODO: rename SpiffeHelper to SpireEnabled (and the
-// kagenti.io/spiffe-helper-inject label to kagenti.io/spire-enabled) so
+// rossoctl.io/spiffe-helper-inject label to rossoctl.io/spire-enabled) so
 // the names match what the field actually controls now that the
 // standalone helper sidecar is gone. Left for a follow-up PR to keep
 // this one focused.
diff --git a/kagenti-operator/internal/webhook/injector/keycloak_client_credentials.go b/operator/internal/webhook/injector/keycloak_client_credentials.go
similarity index 97%
rename from kagenti-operator/internal/webhook/injector/keycloak_client_credentials.go
rename to operator/internal/webhook/injector/keycloak_client_credentials.go
index a7f0792a..2241557f 100644
--- a/kagenti-operator/internal/webhook/injector/keycloak_client_credentials.go
+++ b/operator/internal/webhook/injector/keycloak_client_credentials.go
@@ -26,12 +26,12 @@ import (
 
 var keycloakClientRegistrationLog = logf.Log.WithName("keycloak-client-registration")
 
-// AnnotationKeycloakClientSecretName is set on the pod template by kagenti-operator when it manages
+// AnnotationKeycloakClientSecretName is set on the pod template by rossoctl-operator when it manages
 // Keycloak OAuth2/OIDC client registration. The value is the name of a Secret in the pod namespace containing
 // keys client-id.txt and client-secret.txt. The webhook mounts them for every container that uses
 // the shared-data volume (same paths as the client-registration sidecar: /shared/client-id.txt,
 // /shared/client-secret.txt).
-const AnnotationKeycloakClientSecretName = "kagenti.io/keycloak-client-credentials-secret-name"
+const AnnotationKeycloakClientSecretName = "rossoctl.io/keycloak-client-credentials-secret-name"
 
 // keycloakClientCredentialsVolumeName is the in-pod Volume name for the Secret that holds Keycloak
 // client credentials.
diff --git a/kagenti-operator/internal/webhook/injector/namespace_config.go b/operator/internal/webhook/injector/namespace_config.go
similarity index 100%
rename from kagenti-operator/internal/webhook/injector/namespace_config.go
rename to operator/internal/webhook/injector/namespace_config.go
diff --git a/kagenti-operator/internal/webhook/injector/namespace_config_test.go b/operator/internal/webhook/injector/namespace_config_test.go
similarity index 96%
rename from kagenti-operator/internal/webhook/injector/namespace_config_test.go
rename to operator/internal/webhook/injector/namespace_config_test.go
index c0f8126e..2d31a526 100644
--- a/kagenti-operator/internal/webhook/injector/namespace_config_test.go
+++ b/operator/internal/webhook/injector/namespace_config_test.go
@@ -38,7 +38,7 @@ func TestReadNamespaceConfig_AllPresent(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: AuthBridgeConfigMapName, Namespace: "ns1"},
 		Data: map[string]string{
 			"KEYCLOAK_URL":            "http://keycloak:8080",
-			"KEYCLOAK_REALM":          "kagenti",
+			"KEYCLOAK_REALM":          "rossoctl",
 			"PLATFORM_CLIENT_IDS":     "id1,id2",
 			"TOKEN_URL":               "http://keycloak:8080/realms/demo/protocol/openid-connect/token",
 			"ISSUER":                  "http://keycloak:8080/realms/demo",
@@ -62,8 +62,8 @@ func TestReadNamespaceConfig_AllPresent(t *testing.T) {
 	if cfg.KeycloakURL != "http://keycloak:8080" {
 		t.Errorf("KeycloakURL = %q, want %q", cfg.KeycloakURL, "http://keycloak:8080")
 	}
-	if cfg.KeycloakRealm != "kagenti" {
-		t.Errorf("KeycloakRealm = %q, want %q", cfg.KeycloakRealm, "kagenti")
+	if cfg.KeycloakRealm != "rossoctl" {
+		t.Errorf("KeycloakRealm = %q, want %q", cfg.KeycloakRealm, "rossoctl")
 	}
 	if cfg.TokenURL != "http://keycloak:8080/realms/demo/protocol/openid-connect/token" {
 		t.Errorf("TokenURL = %q", cfg.TokenURL)
@@ -100,7 +100,7 @@ func TestReadNamespaceConfig_PartialConfig(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: AuthBridgeConfigMapName, Namespace: "ns1"},
 		Data: map[string]string{
 			"KEYCLOAK_URL":   "http://keycloak:8080",
-			"KEYCLOAK_REALM": "kagenti",
+			"KEYCLOAK_REALM": "rossoctl",
 		},
 	}
 
diff --git a/kagenti-operator/internal/webhook/injector/pod_mutator.go b/operator/internal/webhook/injector/pod_mutator.go
similarity index 96%
rename from kagenti-operator/internal/webhook/injector/pod_mutator.go
rename to operator/internal/webhook/injector/pod_mutator.go
index 55e6534a..35a5cb2d 100644
--- a/kagenti-operator/internal/webhook/injector/pod_mutator.go
+++ b/operator/internal/webhook/injector/pod_mutator.go
@@ -21,8 +21,8 @@ import (
 	"fmt"
 	"slices"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/webhook/config"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/webhook/config"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -44,15 +44,15 @@ const (
 	// default. Setting AuthBridgeInjectLabel=AuthBridgeDisabledValue on a
 	// workload explicitly opts it out. Any other value (including absent) does
 	// not block injection.
-	AuthBridgeInjectLabel   = "kagenti.io/inject"
+	AuthBridgeInjectLabel   = "rossoctl.io/inject"
 	AuthBridgeInjectValue   = "enabled" // retained for backwards compat / tests
 	AuthBridgeDisabledValue = "disabled"
 
-	// SPIRE opt-out label. Setting kagenti.io/spire=disabled on a workload blocks
+	// SPIRE opt-out label. Setting rossoctl.io/spire=disabled on a workload blocks
 	// spiffe-helper injection (layer 7 of the precedence chain). Any other value
 	// (including absence of the label) leaves spiffe-helper injection to the
 	// upstream precedence layers.
-	SpireEnableLabel   = "kagenti.io/spire"
+	SpireEnableLabel   = "rossoctl.io/spire"
 	SpireDisabledValue = "disabled"
 	// SpireEnabledValue is a non-operative label value under the opt-out model.
 	// Retained as a named constant so tests can assert that a non-disabled value
@@ -65,17 +65,17 @@ const (
 	// Port exclusion annotations — per-workload iptables overrides.
 	// Values are comma-separated port numbers. Outbound values are appended
 	// to the mandatory exclusion (8080). Example: "11434,4317"
-	OutboundPortsExcludeAnnotation = "kagenti.io/outbound-ports-exclude"
-	InboundPortsExcludeAnnotation  = "kagenti.io/inbound-ports-exclude"
+	OutboundPortsExcludeAnnotation = "rossoctl.io/outbound-ports-exclude"
+	InboundPortsExcludeAnnotation  = "rossoctl.io/inbound-ports-exclude"
 
 	sourceNamespaceConfigMap = "namespace-configmap"
 
-	// KagentiTypeLabel is the label key that identifies the workload type
-	KagentiTypeLabel = "kagenti.io/type"
-	// KagentiTypeAgent is the label value that identifies agent workloads
-	KagentiTypeAgent = "agent"
-	// KagentiTypeTool is the label value that identifies tool workloads
-	KagentiTypeTool = "tool"
+	// RossoctlTypeLabel is the label key that identifies the workload type
+	RossoctlTypeLabel = "rossoctl.io/type"
+	// RossoctlTypeAgent is the label value that identifies agent workloads
+	RossoctlTypeAgent = "agent"
+	// RossoctlTypeTool is the label value that identifies tool workloads
+	RossoctlTypeTool = "tool"
 )
 
 type PodMutator struct {
@@ -109,12 +109,12 @@ func NewPodMutator(
 func (m *PodMutator) InjectAuthBridge(ctx context.Context, podSpec *corev1.PodSpec, namespace, crName, workloadKind string, labels, annotations map[string]string) (bool, error) {
 	mutatorLog.Info("InjectAuthBridge called", "namespace", namespace, "crName", crName, "labels", labels)
 
-	// Pre-filter: kagenti.io/type must be agent or tool.
-	kagentiType, hasKagentiLabel := labels[KagentiTypeLabel]
-	if !hasKagentiLabel || (kagentiType != KagentiTypeAgent && kagentiType != KagentiTypeTool) {
+	// Pre-filter: rossoctl.io/type must be agent or tool.
+	rossoctlType, hasRossoctlLabel := labels[RossoctlTypeLabel]
+	if !hasRossoctlLabel || (rossoctlType != RossoctlTypeAgent && rossoctlType != RossoctlTypeTool) {
 		mutatorLog.Info("Skipping mutation: workload is not an agent or a tool",
-			"hasLabel", hasKagentiLabel,
-			"labelValue", kagentiType)
+			"hasLabel", hasRossoctlLabel,
+			"labelValue", rossoctlType)
 		return false, nil
 	}
 
@@ -130,15 +130,15 @@ func (m *PodMutator) InjectAuthBridge(ctx context.Context, podSpec *corev1.PodSp
 	}
 
 	// Tool workloads are only injected when the injectTools feature gate is on.
-	if kagentiType == KagentiTypeTool && !currentGates.InjectTools {
+	if rossoctlType == RossoctlTypeTool && !currentGates.InjectTools {
 		mutatorLog.Info("Skipping mutation: tool injection disabled via injectTools feature gate",
 			"namespace", namespace, "crName", crName)
 		return false, nil
 	}
 
-	// Opt-out: skip injection when kagenti.io/inject=disabled is explicitly set.
+	// Opt-out: skip injection when rossoctl.io/inject=disabled is explicitly set.
 	if labels[AuthBridgeInjectLabel] == AuthBridgeDisabledValue {
-		mutatorLog.Info("Skipping mutation: workload opted out via kagenti.io/inject=disabled",
+		mutatorLog.Info("Skipping mutation: workload opted out via rossoctl.io/inject=disabled",
 			"namespace", namespace, "crName", crName)
 		return false, nil
 	}
@@ -386,7 +386,7 @@ func (m *PodMutator) InjectAuthBridge(ctx context.Context, podSpec *corev1.PodSp
 	//
 	// Resolution chain (first non-empty wins):
 	//   1. namespace authbridge-runtime-config `mode:` field (namespace default)
-	//   2. kagenti.io/authbridge-mode annotation             (deprecated)
+	//   2. rossoctl.io/authbridge-mode annotation             (deprecated)
 	//   3. ModeProxySidecar                                  (cluster-wide fallback)
 	authBridgeMode := ""
 	modeSource := ""
@@ -398,7 +398,7 @@ func (m *PodMutator) InjectAuthBridge(ctx context.Context, podSpec *corev1.PodSp
 		if m := annotations[AnnotationAuthBridgeMode]; m != "" {
 			authBridgeMode = m
 			modeSource = "annotation-deprecated"
-			mutatorLog.Info("DEPRECATED: kagenti.io/authbridge-mode annotation used; set mode in namespace authbridge-runtime-config ConfigMap instead",
+			mutatorLog.Info("DEPRECATED: rossoctl.io/authbridge-mode annotation used; set mode in namespace authbridge-runtime-config ConfigMap instead",
 				"namespace", namespace, "crName", crName, "mode", authBridgeMode)
 		}
 	}
@@ -735,7 +735,7 @@ func (m *PodMutator) InjectAuthBridge(ctx context.Context, podSpec *corev1.PodSp
 	return true, nil
 }
 
-const managedByLabel = "kagenti.io/managed-by"
+const managedByLabel = "rossoctl.io/managed-by"
 const managedByValue = "webhook"
 
 // ensureServiceAccount creates a ServiceAccount in the given namespace if it
@@ -801,7 +801,7 @@ func perAgentEnvoyConfigMapName(crName string) string {
 // maps 1:1 to NamespaceConfig (env-var-style authbridge-config
 // values). Used only when the namespace's authbridge-runtime-config
 // ConfigMap has no `pipeline:` of its own — typically a demo or
-// operator-managed namespace that bypassed the Kagenti Helm chart.
+// operator-managed namespace that bypassed the Rossoctl Helm chart.
 //
 // The synthesized shape matches what plugins expect:
 //   - jwt-validation.config.issuer from NamespaceConfig.Issuer
@@ -810,7 +810,7 @@ func perAgentEnvoyConfigMapName(crName string) string {
 //     also passed through so the plugin can derive jwks_url from the
 //     INTERNAL URL — the sidecar actually GETs this URL from inside
 //     the cluster, and the public hostname typically won't resolve
-//     from inside the mesh. See kagenti-extensions#383 for why the
+//     from inside the mesh. See rossocortex#383 for why the
 //     jwt-validation plugin needs its own copy of these fields.
 //     Other plugin settings fall back to their own defaults —
 //     audience_file=/shared/client-id.txt, bypass_paths=standard
@@ -932,7 +932,7 @@ func (m *PodMutator) ensurePerAgentConfigMap(
 	//      found is left alone and ignored; the synthesized
 	//      `pipeline:` is what authbridge actually reads.
 	//
-	// When the base YAML already has `pipeline:` (Kagenti Helm chart
+	// When the base YAML already has `pipeline:` (Rossoctl Helm chart
 	// emits it), this branch is skipped and we only layer mode +
 	// listener overrides on top — the chart owns the plugin config
 	// contents. See authbridge/authlib/plugins/CONVENTIONS.md for
@@ -1010,7 +1010,7 @@ func (m *PodMutator) ensurePerAgentConfigMap(
 		cmApply = cmApply.WithOwnerReferences(ownerRef)
 	}
 
-	if err := m.Client.Apply(ctx, cmApply, client.FieldOwner("kagenti-webhook"), client.ForceOwnership); err != nil {
+	if err := m.Client.Apply(ctx, cmApply, client.FieldOwner("rossoctl-webhook"), client.ForceOwnership); err != nil {
 		return "", fmt.Errorf("failed to apply per-agent ConfigMap %s/%s: %w", namespace, cmName, err)
 	}
 	mutatorLog.Info("Applied per-agent ConfigMap",
@@ -1056,7 +1056,7 @@ func (m *PodMutator) ensurePerAgentEnvoyConfigMap(
 		cmApply = cmApply.WithOwnerReferences(ownerRef)
 	}
 
-	if err := m.Client.Apply(ctx, cmApply, client.FieldOwner("kagenti-webhook"), client.ForceOwnership); err != nil {
+	if err := m.Client.Apply(ctx, cmApply, client.FieldOwner("rossoctl-webhook"), client.ForceOwnership); err != nil {
 		return "", fmt.Errorf("failed to apply per-agent envoy ConfigMap %s/%s: %w", namespace, cmName, err)
 	}
 	mutatorLog.Info("Applied per-agent envoy ConfigMap",
diff --git a/kagenti-operator/internal/webhook/injector/pod_mutator_test.go b/operator/internal/webhook/injector/pod_mutator_test.go
similarity index 95%
rename from kagenti-operator/internal/webhook/injector/pod_mutator_test.go
rename to operator/internal/webhook/injector/pod_mutator_test.go
index 503ead69..bc959c11 100644
--- a/kagenti-operator/internal/webhook/injector/pod_mutator_test.go
+++ b/operator/internal/webhook/injector/pod_mutator_test.go
@@ -20,8 +20,8 @@ import (
 	"context"
 	"testing"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/webhook/config"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/webhook/config"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -128,7 +128,7 @@ func TestInjectAuthBridge_NoAgentRuntime_InjectsWithDefaults(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	injected, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
@@ -159,7 +159,7 @@ func TestInjectAuthBridge_SetsServiceAccountName(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	injected, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
@@ -187,7 +187,7 @@ func TestInjectAuthBridge_RespectsExistingServiceAccountName(t *testing.T) {
 		ServiceAccountName: "custom-sa",
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	injected, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
@@ -217,7 +217,7 @@ func TestInjectAuthBridge_NoSACreationWhenSpiffeHelperDisabled(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel:        KagentiTypeAgent,
+		RossoctlTypeLabel:       RossoctlTypeAgent,
 		LabelSpiffeHelperInject: "false", // explicitly opt out of spiffe-helper
 	}
 
@@ -247,7 +247,7 @@ func TestInjectAuthBridge_Tool_SkipsInjectionByDefault(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeTool,
+		RossoctlTypeLabel: RossoctlTypeTool,
 	}
 
 	injected, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-tool", "Deployment", labels, nil)
@@ -264,13 +264,13 @@ func TestInjectAuthBridge_Tool_SkipsInjectionByDefault(t *testing.T) {
 }
 
 func TestInjectAuthBridge_GlobalOptOut_Agent(t *testing.T) {
-	// Agent workloads are injected by default; kagenti.io/inject=disabled opts out.
+	// Agent workloads are injected by default; rossoctl.io/inject=disabled opts out.
 	m := newTestMutator()
 	ctx := context.Background()
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel:      KagentiTypeAgent,
+		RossoctlTypeLabel:     RossoctlTypeAgent,
 		AuthBridgeInjectLabel: AuthBridgeDisabledValue,
 	}
 
@@ -279,7 +279,7 @@ func TestInjectAuthBridge_GlobalOptOut_Agent(t *testing.T) {
 		t.Fatalf("InjectAuthBridge() returned error: %v", err)
 	}
 	if injected {
-		t.Fatal("expected InjectAuthBridge to return false when kagenti.io/inject=disabled")
+		t.Fatal("expected InjectAuthBridge to return false when rossoctl.io/inject=disabled")
 	}
 	if len(podSpec.Containers) != 0 || len(podSpec.InitContainers) != 0 {
 		t.Errorf("expected no containers to be injected, got containers=%v initContainers=%v",
@@ -295,7 +295,7 @@ func TestInjectAuthBridge_Tool_SkippedByGateRegardlessOfOptOut(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel:      KagentiTypeTool,
+		RossoctlTypeLabel:     RossoctlTypeTool,
 		AuthBridgeInjectLabel: AuthBridgeDisabledValue,
 	}
 
@@ -320,7 +320,7 @@ func TestInjectAuthBridge_DefaultSAOverridden(t *testing.T) {
 		ServiceAccountName: "default",
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	injected, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
@@ -342,7 +342,7 @@ func TestInjectAuthBridge_OutboundPortsExcludeAnnotation(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 	annotations := map[string]string{
 		OutboundPortsExcludeAnnotation: "11434",
@@ -380,7 +380,7 @@ func TestInjectAuthBridge_InboundPortsExcludeAnnotation(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 	annotations := map[string]string{
 		OutboundPortsExcludeAnnotation: "11434",
@@ -432,7 +432,7 @@ func TestInjectAuthBridge_NilAnnotations(t *testing.T) {
 
 	podSpec := &corev1.PodSpec{}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	injected, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
@@ -481,7 +481,7 @@ func authbridgeRuntimeConfigMap(namespace, mode string) *corev1.ConfigMap {
 
 // Mode resolution chain (first non-empty wins):
 //   1. namespace authbridge-runtime-config mode field
-//   2. kagenti.io/authbridge-mode annotation (deprecated)
+//   2. rossoctl.io/authbridge-mode annotation (deprecated)
 //   3. ModeProxySidecar (cluster default)
 
 func TestInjectAuthBridge_ModeResolution_NamespaceConfigMap(t *testing.T) {
@@ -494,7 +494,7 @@ func TestInjectAuthBridge_ModeResolution_NamespaceConfigMap(t *testing.T) {
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -528,7 +528,7 @@ func TestInjectAuthBridge_ModeResolution_NamespaceConfigMapWinsOverCR(t *testing
 		ServiceAccountName: "my-agent",
 		Containers:         []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -554,7 +554,7 @@ func TestInjectAuthBridge_ModeResolution_DeprecatedAnnotation(t *testing.T) {
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 	annotations := map[string]string{AnnotationAuthBridgeMode: ModeEnvoySidecar}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, annotations)
@@ -580,7 +580,7 @@ func TestInjectAuthBridge_ModeResolution_AnnotationWinsOverCR(t *testing.T) {
 		ServiceAccountName: "my-agent",
 		Containers:         []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 	annotations := map[string]string{AnnotationAuthBridgeMode: ModeEnvoySidecar}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, annotations)
@@ -608,7 +608,7 @@ func TestInjectAuthBridge_ModeResolution_ClusterDefault(t *testing.T) {
 		ServiceAccountName: "my-agent",
 		Containers:         []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -635,7 +635,7 @@ func TestInjectAuthBridge_LiteMode_UsesAuthBridgeLiteImage(t *testing.T) {
 		ServiceAccountName: "my-agent",
 		Containers:         []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -678,7 +678,7 @@ func TestInjectAuthBridge_LiteMode_FromNamespaceConfigMap(t *testing.T) {
 		ServiceAccountName: "my-agent",
 		Containers:         []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -710,7 +710,7 @@ func TestInjectAuthBridge_ModeResolution_UnrecognizedFallsBackToProxySidecar(t *
 		ServiceAccountName: "my-agent",
 		Containers:         []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -739,7 +739,7 @@ func TestInjectAuthBridge_WaypointMode_SkipsInjection(t *testing.T) {
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
@@ -759,7 +759,7 @@ func TestInjectAuthBridge_WaypointMode_SkipsInjection(t *testing.T) {
 // uses redirect mode, tested elsewhere).
 func TestInjectAuthBridge_ProxySidecar_EgressEnforcement(t *testing.T) {
 	ctx := context.Background()
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 	makePod := func() *corev1.PodSpec {
 		return &corev1.PodSpec{
 			ServiceAccountName: "my-agent",
@@ -832,7 +832,7 @@ func TestInjectAuthBridge_ProxySidecarMode_InjectsCorrectly(t *testing.T) {
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
@@ -918,10 +918,10 @@ func TestInjectAuthBridge_ProxySidecarMode_MountsKeycloakCredentials(t *testing.
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 	annotations := map[string]string{
-		AnnotationKeycloakClientSecretName: "kagenti-keycloak-client-credentials-abc12345",
+		AnnotationKeycloakClientSecretName: "rossoctl-keycloak-client-credentials-abc12345",
 	}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, annotations)
@@ -935,7 +935,7 @@ func TestInjectAuthBridge_ProxySidecarMode_MountsKeycloakCredentials(t *testing.
 	// The Secret volume must be declared so kubelet can resolve it.
 	volFound := false
 	for _, v := range podSpec.Volumes {
-		if v.Secret != nil && v.Secret.SecretName == "kagenti-keycloak-client-credentials-abc12345" {
+		if v.Secret != nil && v.Secret.SecretName == "rossoctl-keycloak-client-credentials-abc12345" {
 			volFound = true
 			break
 		}
@@ -1029,7 +1029,7 @@ func TestInjectAuthBridge_ProxySidecarMode_PortCollision(t *testing.T) {
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
@@ -1087,7 +1087,7 @@ func TestInjectAuthBridge_ProxySidecarMode_ForwardProxyCollision(t *testing.T) {
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
@@ -1198,7 +1198,7 @@ func TestInjectAuthBridge_ProxySidecarMode_NoPorts_UsesDefault(t *testing.T) {
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel: KagentiTypeAgent,
+		RossoctlTypeLabel: RossoctlTypeAgent,
 	}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
@@ -1278,9 +1278,9 @@ func TestEnsurePerAgentConfigMap_EmptyBaseYAML_FallbackFromNsConfig(t *testing.T
 	ctx := context.Background()
 
 	nsConfig := &NamespaceConfig{
-		Issuer:                "http://keycloak:8080/realms/kagenti",
+		Issuer:                "http://keycloak:8080/realms/rossoctl",
 		KeycloakURL:           "http://keycloak:8080",
-		KeycloakRealm:         "kagenti",
+		KeycloakRealm:         "rossoctl",
 		DefaultOutboundPolicy: "passthrough",
 		ClientAuthType:        "client-secret",
 	}
@@ -1308,17 +1308,17 @@ func TestEnsurePerAgentConfigMap_EmptyBaseYAML_FallbackFromNsConfig(t *testing.T
 	// when it reads this config. See
 	// authbridge/authlib/plugins/CONVENTIONS.md.
 	jwtCfg := pluginConfigAt(t, cfg, "inbound", "jwt-validation")
-	if got, want := jwtCfg["issuer"], "http://keycloak:8080/realms/kagenti"; got != want {
+	if got, want := jwtCfg["issuer"], "http://keycloak:8080/realms/rossoctl"; got != want {
 		t.Errorf("jwt-validation.config.issuer = %v, want %v", got, want)
 	}
 	// keycloak_url + keycloak_realm are passed to jwt-validation so the
 	// plugin derives jwks_url from the internal URL. Required for
 	// split-horizon deployments where `issuer` (public) isn't reachable
-	// from inside the pod. See kagenti-extensions#383.
+	// from inside the pod. See rossocortex#383.
 	if got, want := jwtCfg["keycloak_url"], "http://keycloak:8080"; got != want {
 		t.Errorf("jwt-validation.config.keycloak_url = %v, want %v", got, want)
 	}
-	if got, want := jwtCfg["keycloak_realm"], "kagenti"; got != want {
+	if got, want := jwtCfg["keycloak_realm"], "rossoctl"; got != want {
 		t.Errorf("jwt-validation.config.keycloak_realm = %v, want %v", got, want)
 	}
 
@@ -1326,7 +1326,7 @@ func TestEnsurePerAgentConfigMap_EmptyBaseYAML_FallbackFromNsConfig(t *testing.T
 	if got, want := tokCfg["keycloak_url"], "http://keycloak:8080"; got != want {
 		t.Errorf("token-exchange.config.keycloak_url = %v, want %v", got, want)
 	}
-	if got, want := tokCfg["keycloak_realm"], "kagenti"; got != want {
+	if got, want := tokCfg["keycloak_realm"], "rossoctl"; got != want {
 		t.Errorf("token-exchange.config.keycloak_realm = %v, want %v", got, want)
 	}
 	if got, want := tokCfg["default_policy"], "passthrough"; got != want {
@@ -1378,7 +1378,7 @@ func TestEnsurePerAgentConfigMap_BaseYAML_PreservesExistingFields(t *testing.T)
 	m := newTestMutator()
 	ctx := context.Background()
 
-	// baseYAML uses the per-plugin schema the Kagenti Helm chart
+	// baseYAML uses the per-plugin schema the Rossoctl Helm chart
 	// emits post-migration. When pipeline: is already present, the
 	// webhook must not touch plugin config — only mode + listener
 	// overrides layer on top.
@@ -1450,7 +1450,7 @@ pipeline:
       - name: token-exchange
         config:
           keycloak_url: "http://keycloak:8080"
-          keycloak_realm: "kagenti"
+          keycloak_realm: "rossoctl"
           identity:
             type: client-secret
 `
@@ -1659,9 +1659,9 @@ func TestEnsurePerAgentConfigMap_FederatedJWT_MapsToSpiffe(t *testing.T) {
 	ctx := context.Background()
 
 	nsConfig := &NamespaceConfig{
-		Issuer:         "http://keycloak:8080/realms/kagenti",
+		Issuer:         "http://keycloak:8080/realms/rossoctl",
 		KeycloakURL:    "http://keycloak:8080",
-		KeycloakRealm:  "kagenti",
+		KeycloakRealm:  "rossoctl",
 		ClientAuthType: "federated-jwt",
 	}
 
@@ -1695,11 +1695,11 @@ func TestEnsurePerAgentConfigMap_FederatedJWT_SetsJWTAudience(t *testing.T) {
 	ctx := context.Background()
 
 	nsConfig := &NamespaceConfig{
-		Issuer:         "http://keycloak:8080/realms/kagenti",
+		Issuer:         "http://keycloak:8080/realms/rossoctl",
 		KeycloakURL:    "http://keycloak:8080",
-		KeycloakRealm:  "kagenti",
+		KeycloakRealm:  "rossoctl",
 		ClientAuthType: "federated-jwt",
-		JWTAudience:    "http://keycloak:8080/realms/kagenti",
+		JWTAudience:    "http://keycloak:8080/realms/rossoctl",
 	}
 
 	cmName, err := m.ensurePerAgentConfigMap(ctx, "team1", "spiffe-agent",
@@ -1716,8 +1716,8 @@ func TestEnsurePerAgentConfigMap_FederatedJWT_SetsJWTAudience(t *testing.T) {
 	if identity == nil {
 		t.Fatal("expected identity block under token-exchange config")
 	}
-	if identity["jwt_audience"] != "http://keycloak:8080/realms/kagenti" {
-		t.Errorf("identity.jwt_audience = %v, want http://keycloak:8080/realms/kagenti", identity["jwt_audience"])
+	if identity["jwt_audience"] != "http://keycloak:8080/realms/rossoctl" {
+		t.Errorf("identity.jwt_audience = %v, want http://keycloak:8080/realms/rossoctl", identity["jwt_audience"])
 	}
 }
 
@@ -1911,7 +1911,7 @@ func TestInjectAuthBridge_EgressEnforcement_DefaultInjectsProxyInit(t *testing.T
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -1929,7 +1929,7 @@ func TestInjectAuthBridge_EgressEnforcement_NoneSkipsProxyInit(t *testing.T) {
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -1950,7 +1950,7 @@ func TestInjectAuthBridge_EgressEnforcement_EnforceRedirectInjectsProxyInit(t *t
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -1968,7 +1968,7 @@ func TestInjectAuthBridge_EgressEnforcement_NamespaceConfigMapNone(t *testing.T)
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -1986,7 +1986,7 @@ func TestInjectAuthBridge_EgressEnforcement_UnknownValueFailsClosed(t *testing.T
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -2004,7 +2004,7 @@ func TestInjectAuthBridge_EgressEnforcement_EnvoySidecarIgnoresNone(t *testing.T
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -2040,7 +2040,7 @@ func TestInjectAuthBridge_EgressEnforcement_PlatformPolicyBlocksNone(t *testing.
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -2059,7 +2059,7 @@ func TestInjectAuthBridge_EgressEnforcement_PlatformPolicyAllowsNone(t *testing.
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -2077,7 +2077,7 @@ func TestInjectAuthBridge_EgressEnforcement_PlatformPolicyOnlyNone(t *testing.T)
 	podSpec := &corev1.PodSpec{
 		Containers: []corev1.Container{{Name: "agent", Image: "my-agent:latest"}},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	_, err := m.InjectAuthBridge(ctx, podSpec, "test-ns", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -2149,7 +2149,7 @@ func TestInjectAuthBridge_TLSBridge_Enabled_MountsCA(t *testing.T) {
 			{Name: "agent", Image: "my-agent:latest", Ports: []corev1.ContainerPort{{ContainerPort: 8000}}},
 		},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	mutated, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil)
 	if err != nil {
@@ -2250,7 +2250,7 @@ func TestInjectAuthBridge_TLSBridge_Disabled_NoMount(t *testing.T) {
 			{Name: "agent", Image: "my-agent:latest", Ports: []corev1.ContainerPort{{ContainerPort: 8000}}},
 		},
 	}
-	labels := map[string]string{KagentiTypeLabel: KagentiTypeAgent}
+	labels := map[string]string{RossoctlTypeLabel: RossoctlTypeAgent}
 
 	if _, err := m.InjectAuthBridge(ctx, podSpec, "team1", "my-agent", "Deployment", labels, nil); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -2347,7 +2347,7 @@ func TestInjectAuthBridge_TLSBridge_NoSPIRE_NoForcedFSGroup(t *testing.T) {
 		},
 	}
 	labels := map[string]string{
-		KagentiTypeLabel:        KagentiTypeAgent,
+		RossoctlTypeLabel:       RossoctlTypeAgent,
 		LabelSpiffeHelperInject: "false", // SPIRE off
 	}
 
diff --git a/kagenti-operator/internal/webhook/injector/precedence.go b/operator/internal/webhook/injector/precedence.go
similarity index 91%
rename from kagenti-operator/internal/webhook/injector/precedence.go
rename to operator/internal/webhook/injector/precedence.go
index 666a7061..d608554b 100644
--- a/kagenti-operator/internal/webhook/injector/precedence.go
+++ b/operator/internal/webhook/injector/precedence.go
@@ -1,7 +1,7 @@
 package injector
 
 import (
-	"github.com/kagenti/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/config"
 )
 
 const (
@@ -14,10 +14,10 @@ const (
 //
 // Precedence order (highest to lowest):
 //  1. Per-sidecar feature gate (featureGates.<sidecar>=false disables cluster-wide)
-//  2. Workload label (kagenti.io/<sidecar>-inject=false) — per-sidecar opt-out
+//  2. Workload label (rossoctl.io/<sidecar>-inject=false) — per-sidecar opt-out
 //
 // Global and workload-level pre-filtering (globalEnabled kill switch, type check,
-// injectTools gate, kagenti.io/inject=disabled opt-out) is handled upstream in
+// injectTools gate, rossoctl.io/inject=disabled opt-out) is handled upstream in
 // PodMutator before this evaluator is reached.
 type PrecedenceEvaluator struct {
 	featureGates *config.FeatureGates
@@ -60,7 +60,7 @@ func (e *PrecedenceEvaluator) Evaluate(
 }
 
 // evaluateSpiffeHelper resolves the per-workload SPIRE-enabled flag from
-// the kagenti.io/spiffe-helper-inject label. Spiffe-helper is bundled
+// the rossoctl.io/spiffe-helper-inject label. Spiffe-helper is bundled
 // inside the combined authbridge images and gated by the SPIRE_ENABLED
 // env var rather than by feature-gate, so this skips the feature-gate
 // layer that evaluateSidecar applies.
diff --git a/kagenti-operator/internal/webhook/injector/precedence_test.go b/operator/internal/webhook/injector/precedence_test.go
similarity index 98%
rename from kagenti-operator/internal/webhook/injector/precedence_test.go
rename to operator/internal/webhook/injector/precedence_test.go
index ddcce29a..12993622 100644
--- a/kagenti-operator/internal/webhook/injector/precedence_test.go
+++ b/operator/internal/webhook/injector/precedence_test.go
@@ -3,7 +3,7 @@ package injector
 import (
 	"testing"
 
-	"github.com/kagenti/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/config"
 )
 
 func allEnabledGates() *config.FeatureGates {
diff --git a/kagenti-operator/internal/webhook/injector/resolved_config.go b/operator/internal/webhook/injector/resolved_config.go
similarity index 96%
rename from kagenti-operator/internal/webhook/injector/resolved_config.go
rename to operator/internal/webhook/injector/resolved_config.go
index 053d9016..b16745a2 100644
--- a/kagenti-operator/internal/webhook/injector/resolved_config.go
+++ b/operator/internal/webhook/injector/resolved_config.go
@@ -17,8 +17,8 @@ limitations under the License.
 package injector
 
 import (
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/webhook/config"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/webhook/config"
 )
 
 // ResolvedConfig is the fully-merged configuration for a single workload injection.
diff --git a/kagenti-operator/internal/webhook/injector/resolved_config_test.go b/operator/internal/webhook/injector/resolved_config_test.go
similarity index 97%
rename from kagenti-operator/internal/webhook/injector/resolved_config_test.go
rename to operator/internal/webhook/injector/resolved_config_test.go
index e6be76fa..0e53629a 100644
--- a/kagenti-operator/internal/webhook/injector/resolved_config_test.go
+++ b/operator/internal/webhook/injector/resolved_config_test.go
@@ -19,7 +19,7 @@ package injector
 import (
 	"testing"
 
-	"github.com/kagenti/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/config"
 )
 
 func TestResolveConfig_NilInputs(t *testing.T) {
@@ -35,7 +35,7 @@ func TestResolveConfig_NilInputs(t *testing.T) {
 func TestResolveConfig_NamespaceOnly(t *testing.T) {
 	ns := &NamespaceConfig{
 		KeycloakURL:    "http://keycloak:8080",
-		KeycloakRealm:  "kagenti",
+		KeycloakRealm:  "rossoctl",
 		TokenURL:       "http://keycloak:8080/token",
 		Issuer:         "http://keycloak:8080/realms/demo",
 		TargetAudience: "my-audience",
diff --git a/kagenti-operator/internal/webhook/injector/volume_builder.go b/operator/internal/webhook/injector/volume_builder.go
similarity index 99%
rename from kagenti-operator/internal/webhook/injector/volume_builder.go
rename to operator/internal/webhook/injector/volume_builder.go
index 62f76384..c69fdaaa 100644
--- a/kagenti-operator/internal/webhook/injector/volume_builder.go
+++ b/operator/internal/webhook/injector/volume_builder.go
@@ -17,7 +17,7 @@ limitations under the License.
 package injector
 
 import (
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/utils/ptr"
 )
diff --git a/kagenti-operator/internal/webhook/injector/volume_builder_test.go b/operator/internal/webhook/injector/volume_builder_test.go
similarity index 100%
rename from kagenti-operator/internal/webhook/injector/volume_builder_test.go
rename to operator/internal/webhook/injector/volume_builder_test.go
diff --git a/kagenti-operator/internal/webhook/v1alpha1/agentcard_webhook.go b/operator/internal/webhook/v1alpha1/agentcard_webhook.go
similarity index 92%
rename from kagenti-operator/internal/webhook/v1alpha1/agentcard_webhook.go
rename to operator/internal/webhook/v1alpha1/agentcard_webhook.go
index ff870ffd..1f3343dd 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/agentcard_webhook.go
+++ b/operator/internal/webhook/v1alpha1/agentcard_webhook.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"fmt"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
@@ -34,7 +34,7 @@ func SetupAgentCardWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-//+kubebuilder:webhook:path=/validate-agent-kagenti-dev-v1alpha1-agentcard,mutating=false,failurePolicy=fail,sideEffects=None,groups=agent.kagenti.dev,resources=agentcards,verbs=create;update,versions=v1alpha1,name=vagentcard.kb.io,admissionReviewVersions=v1
+//+kubebuilder:webhook:path=/validate-agent-rossoctl-dev-v1alpha1-agentcard,mutating=false,failurePolicy=fail,sideEffects=None,groups=agent.rossoctl.dev,resources=agentcards,verbs=create;update,versions=v1alpha1,name=vagentcard.kb.io,admissionReviewVersions=v1
 
 type AgentCardValidator struct {
 	// Reader is an uncached client for authoritative reads from the API server.
diff --git a/kagenti-operator/internal/webhook/v1alpha1/agentcard_webhook_test.go b/operator/internal/webhook/v1alpha1/agentcard_webhook_test.go
similarity index 99%
rename from kagenti-operator/internal/webhook/v1alpha1/agentcard_webhook_test.go
rename to operator/internal/webhook/v1alpha1/agentcard_webhook_test.go
index 7ab8286b..223dd293 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/agentcard_webhook_test.go
+++ b/operator/internal/webhook/v1alpha1/agentcard_webhook_test.go
@@ -21,7 +21,7 @@ import (
 	"strings"
 	"testing"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook.go b/operator/internal/webhook/v1alpha1/agentruntime_webhook.go
similarity index 94%
rename from kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook.go
rename to operator/internal/webhook/v1alpha1/agentruntime_webhook.go
index 4b6d2ff2..994d88c4 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook.go
+++ b/operator/internal/webhook/v1alpha1/agentruntime_webhook.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"fmt"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
@@ -34,7 +34,7 @@ func SetupAgentRuntimeWebhookWithManager(mgr ctrl.Manager) error {
 		Complete()
 }
 
-// +kubebuilder:webhook:path=/validate-agent-kagenti-dev-v1alpha1-agentruntime,mutating=false,failurePolicy=fail,sideEffects=None,groups=agent.kagenti.dev,resources=agentruntimes,verbs=create;update,versions=v1alpha1,name=vagentruntime.kb.io,admissionReviewVersions=v1
+// +kubebuilder:webhook:path=/validate-agent-rossoctl-dev-v1alpha1-agentruntime,mutating=false,failurePolicy=fail,sideEffects=None,groups=agent.rossoctl.dev,resources=agentruntimes,verbs=create;update,versions=v1alpha1,name=vagentruntime.kb.io,admissionReviewVersions=v1
 
 type AgentRuntimeValidator struct {
 	// Reader is an uncached client for authoritative reads from the API server.
diff --git a/kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go b/operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go
similarity index 99%
rename from kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go
rename to operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go
index b5c1c69a..b1e3ea5e 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go
+++ b/operator/internal/webhook/v1alpha1/agentruntime_webhook_test.go
@@ -21,7 +21,7 @@ import (
 	"strings"
 	"testing"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
diff --git a/kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook.go b/operator/internal/webhook/v1alpha1/authbridge_webhook.go
similarity index 96%
rename from kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook.go
rename to operator/internal/webhook/v1alpha1/authbridge_webhook.go
index e480af87..9e4df115 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook.go
+++ b/operator/internal/webhook/v1alpha1/authbridge_webhook.go
@@ -21,9 +21,9 @@ import (
 	"encoding/json"
 	"net/http"
 
-	"github.com/kagenti/operator/internal/clientreg"
-	"github.com/kagenti/operator/internal/webhook/injector"
-	"github.com/kagenti/operator/internal/workload"
+	"github.com/rossoctl/operator/internal/clientreg"
+	"github.com/rossoctl/operator/internal/webhook/injector"
+	"github.com/rossoctl/operator/internal/workload"
 	corev1 "k8s.io/api/core/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
@@ -196,4 +196,4 @@ func (w *AuthBridgeWebhook) isAlreadyInjected(podSpec *corev1.PodSpec) bool {
 	return false
 }
 
-// +kubebuilder:webhook:path=/mutate-workloads-authbridge,mutating=true,failurePolicy=fail,sideEffects=None,groups="",resources=pods,verbs=create,versions=v1,name=inject.kagenti.io,admissionReviewVersions=v1,reinvocationPolicy=IfNeeded
+// +kubebuilder:webhook:path=/mutate-workloads-authbridge,mutating=true,failurePolicy=fail,sideEffects=None,groups="",resources=pods,verbs=create,versions=v1,name=inject.rossoctl.io,admissionReviewVersions=v1,reinvocationPolicy=IfNeeded
diff --git a/kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook_test.go b/operator/internal/webhook/v1alpha1/authbridge_webhook_test.go
similarity index 88%
rename from kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook_test.go
rename to operator/internal/webhook/v1alpha1/authbridge_webhook_test.go
index 68963c64..3a911160 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/authbridge_webhook_test.go
+++ b/operator/internal/webhook/v1alpha1/authbridge_webhook_test.go
@@ -19,10 +19,10 @@ package v1alpha1
 import (
 	"fmt"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/webhook/injector"
 	. "github.com/onsi/ginkgo/v2" //nolint:revive // dot import is standard Ginkgo usage
 	. "github.com/onsi/gomega"    //nolint:revive // dot import is standard Gomega usage
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/webhook/injector"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -64,7 +64,7 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 	var testNamespace string
 
 	BeforeEach(func() {
-		// Create a unique namespace with kagenti-enabled=true for each test
+		// Create a unique namespace with rossoctl-enabled=true for each test
 		testNsCounter++
 		testNamespace = fmt.Sprintf("test-webhook-%d", testNsCounter)
 
@@ -72,7 +72,7 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: testNamespace,
 				Labels: map[string]string{
-					"kagenti-enabled": "true",
+					"rossoctl-enabled": "true",
 				},
 			},
 		}
@@ -98,7 +98,7 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 		}
 	}
 
-	Context("when a Pod has kagenti.io/type=agent and kagenti.io/inject=enabled", func() {
+	Context("when a Pod has rossoctl.io/type=agent and rossoctl.io/inject=enabled", func() {
 		It("should inject sidecars", func() {
 			// Namespace ConfigMap pins envoy-sidecar mode so this test exercises
 			// the envoy-proxy + proxy-init injection path.
@@ -114,8 +114,8 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 			Expect(k8sClient.Create(ctx, cm)).To(Succeed())
 
 			pod := newTestPod("agent-pod", map[string]string{
-				"kagenti.io/type":   "agent",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "agent",
+				"rossoctl.io/inject": "enabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
@@ -131,11 +131,11 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 		})
 	})
 
-	Context("when a Pod has kagenti.io/type=tool and kagenti.io/inject=enabled", func() {
+	Context("when a Pod has rossoctl.io/type=tool and rossoctl.io/inject=enabled", func() {
 		It("should not inject sidecars (injectTools feature gate is disabled by default)", func() {
 			pod := newTestPod("tool-pod", map[string]string{
-				"kagenti.io/type":   "tool",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "tool",
+				"rossoctl.io/inject": "enabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
@@ -149,10 +149,10 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 		})
 	})
 
-	Context("when a Pod does not have kagenti.io/type label", func() {
+	Context("when a Pod does not have rossoctl.io/type label", func() {
 		It("should not inject sidecars", func() {
 			pod := newTestPod("no-type-pod", map[string]string{
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/inject": "enabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
@@ -166,11 +166,11 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 		})
 	})
 
-	Context("when a Pod has kagenti.io/inject=disabled", func() {
+	Context("when a Pod has rossoctl.io/inject=disabled", func() {
 		It("should not inject sidecars", func() {
 			pod := newTestPod("disabled-pod", map[string]string{
-				"kagenti.io/type":   "agent",
-				"kagenti.io/inject": "disabled",
+				"rossoctl.io/type":   "agent",
+				"rossoctl.io/inject": "disabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
@@ -184,11 +184,11 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 		})
 	})
 
-	Context("when a Pod has kagenti.io/type=agent but no AgentRuntime CR", func() {
+	Context("when a Pod has rossoctl.io/type=agent but no AgentRuntime CR", func() {
 		It("should inject sidecars with defaults-only config", func() {
 			pod := newTestPod("no-runtime-pod", map[string]string{
-				"kagenti.io/type":   "agent",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "agent",
+				"rossoctl.io/inject": "enabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
@@ -211,8 +211,8 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 			createAgentRuntime(testNamespace, "already-injected-pod")
 
 			pod := newTestPod("already-injected-pod", map[string]string{
-				"kagenti.io/type":   "agent",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "agent",
+				"rossoctl.io/inject": "enabled",
 			})
 			// Pre-add the envoy-proxy container to simulate prior injection
 			pod.Spec.Containers = append(pod.Spec.Containers, corev1.Container{
@@ -247,8 +247,8 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 			createAgentRuntime(testNamespace, "prepop-agent")
 
 			pod := newTestPod("prepop-agent", map[string]string{
-				"kagenti.io/type":   "agent",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "agent",
+				"rossoctl.io/inject": "enabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
@@ -259,7 +259,7 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 
 			Expect(pod.Annotations).To(HaveKey(injector.AnnotationKeycloakClientSecretName))
 			Expect(pod.Annotations[injector.AnnotationKeycloakClientSecretName]).
-				To(HavePrefix("kagenti-keycloak-client-credentials-"))
+				To(HavePrefix("rossoctl-keycloak-client-credentials-"))
 
 			// The webhook should also have declared the Secret volume (lazy-resolved by kubelet).
 			found := false
@@ -275,10 +275,10 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 		It("does not overwrite an existing annotation", func() {
 			createAgentRuntime(testNamespace, "prepop-existing")
 
-			const preset = "kagenti-keycloak-client-credentials-deadbeef"
+			const preset = "rossoctl-keycloak-client-credentials-deadbeef"
 			pod := newTestPod("prepop-existing", map[string]string{
-				"kagenti.io/type":   "agent",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "agent",
+				"rossoctl.io/inject": "enabled",
 			})
 			pod.Annotations = map[string]string{
 				injector.AnnotationKeycloakClientSecretName: preset,
@@ -295,8 +295,8 @@ var _ = Describe("AuthBridge Pod Webhook", func() {
 
 		It("skips tool workloads when the injectTools gate is disabled", func() {
 			pod := newTestPod("prepop-tool", map[string]string{
-				"kagenti.io/type":   "tool",
-				"kagenti.io/inject": "enabled",
+				"rossoctl.io/type":   "tool",
+				"rossoctl.io/inject": "enabled",
 			})
 
 			err := k8sClient.Create(ctx, pod)
diff --git a/kagenti-operator/internal/webhook/v1alpha1/webhook_suite_test.go b/operator/internal/webhook/v1alpha1/webhook_suite_test.go
similarity index 96%
rename from kagenti-operator/internal/webhook/v1alpha1/webhook_suite_test.go
rename to operator/internal/webhook/v1alpha1/webhook_suite_test.go
index 930e3eeb..2bca28a6 100644
--- a/kagenti-operator/internal/webhook/v1alpha1/webhook_suite_test.go
+++ b/operator/internal/webhook/v1alpha1/webhook_suite_test.go
@@ -29,9 +29,9 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/webhook/config"
-	"github.com/kagenti/operator/internal/webhook/injector"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/webhook/config"
+	"github.com/rossoctl/operator/internal/webhook/injector"
 	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	apimachineryruntime "k8s.io/apimachinery/pkg/runtime"
diff --git a/kagenti-operator/internal/workload/owner.go b/operator/internal/workload/owner.go
similarity index 100%
rename from kagenti-operator/internal/workload/owner.go
rename to operator/internal/workload/owner.go
diff --git a/kagenti-operator/internal/workload/owner_test.go b/operator/internal/workload/owner_test.go
similarity index 100%
rename from kagenti-operator/internal/workload/owner_test.go
rename to operator/internal/workload/owner_test.go
diff --git a/kagenti-operator/scripts/operator-rollout.sh b/operator/scripts/operator-rollout.sh
similarity index 89%
rename from kagenti-operator/scripts/operator-rollout.sh
rename to operator/scripts/operator-rollout.sh
index d7a75b87..51dd9a4a 100755
--- a/kagenti-operator/scripts/operator-rollout.sh
+++ b/operator/scripts/operator-rollout.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 #
-# operator-rollout.sh — Build, load, and deploy the kagenti-operator with
+# operator-rollout.sh — Build, load, and deploy the rossoctl-operator with
 # AuthBridge webhook into a local Kind cluster.
 #
 # This script builds the operator, loads it into Kind, and deploys via Helm
 # with webhook, cert-manager, and metrics enabled. It:
 #   1. Detects container runtime (docker/podman)
 #   2. Builds the operator image with ko and loads into Kind
-#   3. Disables the old kagenti-webhook MWC from kagenti-extensions
+#   3. Disables the old rossoctl-webhook MWC from rossocortex
 #   4. Ensures CRDs are installed (Helm skips crds/ on upgrade)
 #   5. Cleans up immutable RBAC resources (roleRef conflicts)
 #   6. Deploys the operator via Helm with webhook enabled
@@ -19,7 +19,7 @@
 #
 # Options:
 #   --demo-ns <ns>    Also set up a demo namespace with authbridge ConfigMaps
-#   --cluster <name>  Kind cluster name (default: kagenti)
+#   --cluster <name>  Kind cluster name (default: rossoctl)
 #   --skip-build      Skip image build and load (use existing image)
 #   --skip-disable    Skip disabling the old webhook MWC
 #   --help            Show this help message
@@ -28,13 +28,13 @@ set -euo pipefail
 
 # --- Defaults ----------------------------------------------------------------
 
-CLUSTER="kagenti"
+CLUSTER="rossoctl"
 DEMO_NS=""
 SKIP_BUILD=false
 SKIP_DISABLE=false
-OPERATOR_NS="kagenti-system"
-OLD_MWC_NAME="kagenti-webhook-authbridge-mutating-webhook-configuration"
-CHART_DIR="../charts/kagenti-operator"
+OPERATOR_NS="rossoctl-system"
+OLD_MWC_NAME="rossoctl-webhook-authbridge-mutating-webhook-configuration"
+CHART_DIR="../charts/operator"
 
 # Resolve script location for relative paths
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -109,7 +109,7 @@ echo "==> Container runtime: ${CONTAINER_TOOL}"
 
 IMAGE_TAG="$(git -C "${REPO_ROOT}" rev-parse --short HEAD)"
 KO_DOCKER_REPO="ko.local"
-CMD_NAME="kagenti-operator"
+CMD_NAME="rossoctl-operator"
 IMG="${KO_DOCKER_REPO}/${CMD_NAME}:${IMAGE_TAG}"
 ARCH="$(go env GOARCH)"
 
@@ -142,7 +142,7 @@ fi
 
 if [[ "${SKIP_DISABLE}" == "false" ]]; then
     echo ""
-    echo "==> Checking for old kagenti-webhook MWC..."
+    echo "==> Checking for old rossoctl-webhook MWC..."
     if kubectl get mutatingwebhookconfiguration "${OLD_MWC_NAME}" &>/dev/null 2>&1; then
         echo "    Found '${OLD_MWC_NAME}' — deleting..."
         kubectl delete mutatingwebhookconfiguration "${OLD_MWC_NAME}"
@@ -176,14 +176,14 @@ fi
 #   b) Changing Helm release name between deploys
 # Detect conflicts and delete the stale bindings so Helm can recreate them.
 
-HELM_RELEASE="${HELM_RELEASE:-kagenti}"
+HELM_RELEASE="${HELM_RELEASE:-rossoctl}"
 
 echo ""
 echo "==> Checking for ClusterRoleBinding roleRef conflicts..."
 
-# Collect all kagenti ClusterRoleBindings that Helm will try to manage
+# Collect all rossoctl ClusterRoleBindings that Helm will try to manage
 EXPECTED_CRBS=(
-    "kagenti-operator-httproute-binding-${HELM_RELEASE}"
+    "rossoctl-operator-httproute-binding-${HELM_RELEASE}"
 )
 
 for crb_name in "${EXPECTED_CRBS[@]}"; do
@@ -206,10 +206,10 @@ for crb_name in "${EXPECTED_CRBS[@]}"; do
 done
 
 # Also clean up bindings from a prior subchart install with a different naming convention
-for crb in $(kubectl get clusterrolebinding -o name 2>/dev/null | grep 'kagenti-operator-httproute-binding' || true); do
+for crb in $(kubectl get clusterrolebinding -o name 2>/dev/null | grep 'rossoctl-operator-httproute-binding' || true); do
     crb_short="${crb#clusterrolebinding.rbac.authorization.k8s.io/}"
     # Skip the one we expect (already handled above)
-    if [[ "${crb_short}" == "kagenti-operator-httproute-binding-${HELM_RELEASE}" ]]; then
+    if [[ "${crb_short}" == "rossoctl-operator-httproute-binding-${HELM_RELEASE}" ]]; then
         continue
     fi
     echo "    Found stale binding from prior install: '${crb_short}' — deleting..."
@@ -219,8 +219,8 @@ done
 
 # --- Step 5: Deploy Operator via Helm ----------------------------------------
 # Helm chart manages all resources including:
-#   - kagenti-platform-config ConfigMap (from values.yaml .defaults)
-#   - kagenti-feature-gates ConfigMap (from values.yaml .featureGates)
+#   - rossoctl-platform-config ConfigMap (from values.yaml .defaults)
+#   - rossoctl-feature-gates ConfigMap (from values.yaml .featureGates)
 #   - MutatingWebhookConfiguration, ValidatingWebhookConfiguration
 #   - RBAC, ServiceAccount, CRDs
 
@@ -249,7 +249,7 @@ helm "${HELM_ARGS[@]}"
 echo ""
 echo "==> Verifying required ConfigMaps..."
 MISSING_CMS=()
-for cm in kagenti-platform-config kagenti-feature-gates; do
+for cm in rossoctl-platform-config rossoctl-feature-gates; do
     if kubectl get configmap "${cm}" -n "${OPERATOR_NS}" &>/dev/null; then
         echo "    ConfigMap '${cm}' found."
     else
@@ -270,17 +270,17 @@ fi
 
 echo ""
 echo "==> Verifying webhook endpoint..."
-kubectl get mutatingwebhookconfiguration -o name 2>/dev/null | grep -q "kagenti" && \
+kubectl get mutatingwebhookconfiguration -o name 2>/dev/null | grep -q "rossoctl" && \
     echo "    MWC found." || \
-    echo "    WARNING: No kagenti MWC found. The operator may need cert-manager to provision certs first."
+    echo "    WARNING: No rossoctl MWC found. The operator may need cert-manager to provision certs first."
 
 # --- Step 7: Restart and Wait for Rollout ------------------------------------
 
 echo ""
 echo "==> Restarting operator to pick up new image..."
-kubectl rollout restart deployment/kagenti-controller-manager -n "${OPERATOR_NS}"
+kubectl rollout restart deployment/rossoctl-controller-manager -n "${OPERATOR_NS}"
 echo "==> Waiting for operator rollout..."
-kubectl rollout status deployment/kagenti-controller-manager -n "${OPERATOR_NS}" --timeout=120s
+kubectl rollout status deployment/rossoctl-controller-manager -n "${OPERATOR_NS}" --timeout=120s
 
 # --- Step 8 (Optional): Demo Namespace Setup ---------------------------------
 
@@ -289,7 +289,7 @@ if [[ -n "${DEMO_NS}" ]]; then
     echo "==> Setting up demo namespace '${DEMO_NS}'..."
 
     kubectl create namespace "${DEMO_NS}" 2>/dev/null || true
-    kubectl label namespace "${DEMO_NS}" kagenti-enabled=true --overwrite
+    kubectl label namespace "${DEMO_NS}" rossoctl-enabled=true --overwrite
 
     echo "==> Deploying required per-namespace ConfigMaps in '${DEMO_NS}'..."
     kubectl apply -n "${DEMO_NS}" -f - <<EOF
@@ -299,13 +299,13 @@ metadata:
   name: authbridge-config
 data:
   KEYCLOAK_URL: "http://keycloak.${OPERATOR_NS}.svc.cluster.local:8080"
-  KEYCLOAK_REALM: "kagenti"
+  KEYCLOAK_REALM: "rossoctl"
   SPIRE_ENABLED: "false"
   PLATFORM_CLIENT_IDS: ""
-  TOKEN_URL: "http://keycloak.${OPERATOR_NS}.svc.cluster.local:8080/realms/kagenti/protocol/openid-connect/token"
-  ISSUER: "http://keycloak.${OPERATOR_NS}.svc.cluster.local:8080/realms/kagenti"
-  EXPECTED_AUDIENCE: "kagenti"
-  TARGET_AUDIENCE: "kagenti"
+  TOKEN_URL: "http://keycloak.${OPERATOR_NS}.svc.cluster.local:8080/realms/rossoctl/protocol/openid-connect/token"
+  ISSUER: "http://keycloak.${OPERATOR_NS}.svc.cluster.local:8080/realms/rossoctl"
+  EXPECTED_AUDIENCE: "rossoctl"
+  TARGET_AUDIENCE: "rossoctl"
   TARGET_SCOPES: "openid"
   DEFAULT_OUTBOUND_POLICY: "passthrough"
 ---
@@ -323,7 +323,7 @@ data:
     svid_file_name = "svid.pem"
     svid_key_file_name = "svid_key.pem"
     svid_bundle_file_name = "svid_bundle.pem"
-    jwt_svids = [{jwt_audience="kagenti", jwt_svid_file_name="jwt_svid.token"}]
+    jwt_svids = [{jwt_audience="rossoctl", jwt_svid_file_name="jwt_svid.token"}]
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -463,8 +463,8 @@ EOF
     echo "==> Demo namespace '${DEMO_NS}' ready."
     echo "    To test injection, create an AgentRuntime CR and deploy a pod with:"
     echo "      labels:"
-    echo "        kagenti.io/type: agent"
-    echo "        kagenti.io/inject: enabled"
+    echo "        rossoctl.io/type: agent"
+    echo "        rossoctl.io/inject: enabled"
 fi
 
 # --- Summary -----------------------------------------------------------------
@@ -482,10 +482,10 @@ fi
 echo ""
 echo "  To verify injection:"
 echo "    1. Create an AgentRuntime CR targeting your workload"
-echo "    2. Deploy a pod with labels kagenti.io/type=agent, kagenti.io/inject=enabled"
+echo "    2. Deploy a pod with labels rossoctl.io/type=agent, rossoctl.io/inject=enabled"
 echo "    3. Check: kubectl get pod <name> -o jsonpath='{.spec.containers[*].name}'"
 echo ""
 echo "  To revert to old webhook:"
 echo "    1. Delete operator MWC: kubectl delete mutatingwebhookconfiguration <name>"
-echo "    2. Re-deploy kagenti-extensions chart (restores old MWC)"
+echo "    2. Re-deploy rossocortex chart (restores old MWC)"
 echo "============================================="
diff --git a/kagenti-operator/test/e2e/README.md b/operator/test/e2e/README.md
similarity index 84%
rename from kagenti-operator/test/e2e/README.md
rename to operator/test/e2e/README.md
index ad54bdd5..804bfe0d 100644
--- a/kagenti-operator/test/e2e/README.md
+++ b/operator/test/e2e/README.md
@@ -1,6 +1,6 @@
 # E2E Tests
 
-End-to-end tests for the kagenti-operator. The suite runs 25 specs:
+End-to-end tests for the rossoctl-operator. The suite runs 25 specs:
 
 - **Manager tests** (2 specs) — controller pod readiness and Prometheus metrics
 - **AuthBridge Injection tests** (4 specs) — sidecar injection, idempotency, opt-out, and HTTP validation
@@ -15,7 +15,7 @@ End-to-end tests for the kagenti-operator. The suite runs 25 specs:
 - [kubectl](https://kubernetes.io/docs/tasks/tools/) — `brew install kubectl`
 - Container runtime: **Docker** or **Podman**
 
-The test suite auto-detects Docker vs Podman. No env vars needed. AuthBridge sidecar images (`authbridge-envoy`, `proxy-init`, `spiffe-helper`) are pulled from `ghcr.io/kagenti/kagenti-extensions` and loaded into Kind during setup.
+The test suite auto-detects Docker vs Podman. No env vars needed. AuthBridge sidecar images (`authbridge-envoy`, `proxy-init`, `spiffe-helper`) are pulled from `ghcr.io/rossoctl/rossocortex` and loaded into Kind during setup.
 
 ## Run
 
@@ -72,20 +72,20 @@ kind delete cluster
 |----------|---------|---------------|
 | Inject sidecars | AuthBridge injection | Webhook injects `envoy-proxy`, `spiffe-helper` containers, `proxy-init` init container, and expected volumes |
 | Idempotency | AuthBridge injection | Pod recreation produces exactly 1 of each sidecar (no duplicates) |
-| Injection opt-out | AuthBridge injection | Pod with `kagenti.io/inject=disabled` label gets zero sidecars |
+| Injection opt-out | AuthBridge injection | Pod with `rossoctl.io/inject=disabled` label gets zero sidecars |
 | HTTP validation | AuthBridge injection | Traffic flows through injected envoy proxy (curl → service → iptables → envoy → app) |
 | Reject missing targetRef | Without signature | Webhook rejects AgentCard with no `spec.targetRef` |
-| No protocol label | Without signature | Workload with `kagenti.io/type=agent` but no `protocol.kagenti.io/*` label gets no auto-created card |
+| No protocol label | Without signature | Workload with `rossoctl.io/type=agent` but no `protocol.rossoctl.io/*` label gets no auto-created card |
 | Auto-discovery | Without signature | Properly labeled workload gets an auto-created AgentCard with correct targetRef, protocol, and Synced=True |
 | Duplicate prevention | Without signature | Webhook rejects a second AgentCard targeting the same workload |
 | Audit mode | With signature | Unsigned card syncs (Synced=True) but reports SignatureVerified=False with reason SignatureInvalidAudit |
 | Signed agent | With signature | SPIRE-signed card gets SignatureVerified=True, correct SPIFFE ID, Synced=True, and Bound=True |
-| Apply labels and config-hash | Agent lifecycle | AgentRuntime controller adds `kagenti.io/type=agent`, `managed-by`, config-hash, and triggers AgentCard auto-creation |
+| Apply labels and config-hash | Agent lifecycle | AgentRuntime controller adds `rossoctl.io/type=agent`, `managed-by`, config-hash, and triggers AgentCard auto-creation |
 | Ready=True | Agent lifecycle | AgentRuntime CR reaches Ready=True condition |
 | Idempotent re-reconcile | Agent lifecycle | Deployment generation stays stable over 30s (no spurious updates) |
-| Clean up on deletion | Agent lifecycle | Deletion removes `kagenti.io/type`, `managed-by`, and config-hash from the workload |
+| Clean up on deletion | Agent lifecycle | Deletion removes `rossoctl.io/type`, `managed-by`, and config-hash from the workload |
 | Missing target error | Error cases | AgentRuntime targeting non-existent Deployment sets TargetResolved=False |
-| Tool type label | Tool type | AgentRuntime with type=tool applies `kagenti.io/type=tool` label and no AgentCard is created |
+| Tool type label | Tool type | AgentRuntime with type=tool applies `rossoctl.io/type=tool` label and no AgentCard is created |
 | StatefulSet target | StatefulSet target | AgentRuntime applies labels, config-hash, and reaches Active for a StatefulSet workload |
 | CR overrides | CR overrides | AgentRuntime with CR overrides produces the same config-hash as a minimal CR (CR fields excluded from hash) |
 ## Architecture
@@ -108,7 +108,7 @@ BeforeAll (per Describe block)
 ├── make deploy → creates namespace, RBAC, Deployment, webhook, ServiceMonitor
 ├── Wait for controller pod Running + webhook endpoint ready
 └── Create test namespace:
-    ├── e2e-authbridge-test (kagenti-enabled=true, PSA privileged — for proxy-init NET_ADMIN)
+    ├── e2e-authbridge-test (rossoctl-enabled=true, PSA privileged — for proxy-init NET_ADMIN)
     └── e2e-agentcard-test (agentcard=true, PSA restricted)
 ```
 
@@ -125,7 +125,7 @@ Dockerfile                       │                          │
 kind load docker-image           ▼                   kubectl apply --server-side
 (podman fallback)         AgentCard CRD created              │
                                                              ▼
-                                                     kagenti-operator-system:
+                                                     rossoctl-operator-system:
                                                      ├── ServiceAccount
                                                      ├── ClusterRole + Binding
                                                      ├── Certificate + Issuer (cert-manager)
@@ -145,7 +145,7 @@ kind load docker-image           ▼                   kubectl apply --server-si
 └───────────────────────────┬──────────────────────────────────────┘
                             │ TLS cert
                             ▼
-┌─ kagenti-operator-system ────────────────────────────────────────┐
+┌─ rossoctl-operator-system ────────────────────────────────────────┐
 │  Controller Manager Pod                                           │
 │  ├── Mutating webhook (injects AuthBridge sidecars into pods)     │
 │  ├── Validating webhook (validates AgentCard/AgentRuntime CRs)    │
@@ -184,15 +184,15 @@ BeforeAll (AgentRuntime E2E)
 ├── Deploy controller (make install + make deploy)
 ├── Wait for controller pod Running + webhook endpoint ready
 ├── Create namespace e2e-agentruntime-test (PSA restricted)
-├── Ensure kagenti-system namespace exists
-├── Create kagenti-platform-config ConfigMap (cluster defaults, layer 1)
+├── Ensure rossoctl-system namespace exists
+├── Create rossoctl-platform-config ConfigMap (cluster defaults, layer 1)
 └── Create runtime-ns-defaults ConfigMap (namespace defaults, layer 2)
 ```
 
 ```
 AgentRuntime controller flow:
-                                                    ┌─ kagenti-system ──────────────────┐
-                                                    │  kagenti-platform-config ConfigMap │
+                                                    ┌─ rossoctl-system ──────────────────┐
+                                                    │  rossoctl-platform-config ConfigMap │
                                                     │  (cluster defaults, layer 1)       │
                                                     └────────────┬──────────────────────┘
                                                                  │
@@ -208,21 +208,21 @@ AgentRuntime controller flow:
                                              │                         └──────────────────────────────────┘
                                              ▼
                                   Target Deployment updated:
-                                  ├── kagenti.io/type = agent|tool
-                                  ├── app.kubernetes.io/managed-by = kagenti-operator
-                                  └── kagenti.io/config-hash = SHA256 (pod template annotation)
+                                  ├── rossoctl.io/type = agent|tool
+                                  ├── app.kubernetes.io/managed-by = rossoctl-operator
+                                  └── rossoctl.io/config-hash = SHA256 (pod template annotation)
 ```
 
-**Cross-controller note:** The agent target fixture includes `protocol.kagenti.io/a2a`. When
-AgentRuntime adds `kagenti.io/type=agent`, AgentCardSync auto-creates an AgentCard that fails
+**Cross-controller note:** The agent target fixture includes `protocol.rossoctl.io/a2a`. When
+AgentRuntime adds `rossoctl.io/type=agent`, AgentCardSync auto-creates an AgentCard that fails
 to sync (pause container serves no HTTP). This is expected and harmless.
 
 ### Test scenario details
 
 #### Inject sidecars
 
-Deploys `authbridge-agent` with `kagenti.io/type=agent` label and a matching AgentRuntime CR.
-The mutating webhook (`inject.kagenti.io`) intercepts the pod CREATE, calls `InjectAuthBridge`,
+Deploys `authbridge-agent` with `rossoctl.io/type=agent` label and a matching AgentRuntime CR.
+The mutating webhook (`inject.rossoctl.io`) intercepts the pod CREATE, calls `InjectAuthBridge`,
 and adds: `envoy-proxy` sidecar (envoy with passthrough config), `spiffe-helper` sidecar
 (manages SVID rotation), and `proxy-init` init container (sets up iptables rules for traffic
 interception as root with NET_ADMIN/NET_RAW). The test verifies container names, init container
@@ -237,8 +237,8 @@ no duplicate injection occurs on pod recreation.
 
 #### Injection opt-out
 
-Deploys `disabled-agent` with `kagenti.io/inject=disabled` label on the pod template.
-The webhook's `objectSelector` (matching `kagenti.io/inject NOT IN [disabled]`) filters
+Deploys `disabled-agent` with `rossoctl.io/inject=disabled` label on the pod template.
+The webhook's `objectSelector` (matching `rossoctl.io/inject NOT IN [disabled]`) filters
 this pod at the API server level, so the webhook handler is never called. The test verifies
 zero sidecar containers and zero init containers.
 
@@ -256,7 +256,7 @@ Applies an AgentCard with no `spec.targetRef`. The validating webhook checks
 
 #### No protocol label
 
-Deploys `noproto-agent` with `kagenti.io/type=agent` but no `protocol.kagenti.io/*` label.
+Deploys `noproto-agent` with `rossoctl.io/type=agent` but no `protocol.rossoctl.io/*` label.
 The sync controller's `shouldSyncWorkload()` requires both the agent type AND a protocol
 label, so it skips this workload. The test uses `Consistently` for 30s to prove no card appears.
 
@@ -302,15 +302,15 @@ Test verifies: `SignatureVerified=True` (reason `SignatureValid`),
 
 #### Apply labels and config-hash
 
-Deploys `runtime-agent-target` (pause container with `protocol.kagenti.io/a2a` label) and
+Deploys `runtime-agent-target` (pause container with `protocol.rossoctl.io/a2a` label) and
 creates an AgentRuntime CR with `type: agent` targeting it. The controller resolves the target,
-merges 2-layer config (cluster ConfigMap `kagenti-platform-config` in `kagenti-system` +
-namespace ConfigMap with `kagenti.io/defaults=true` + CR-level overrides), and applies labels
-to the Deployment. Test verifies `kagenti.io/type=agent` on both workload metadata and pod
-template, `app.kubernetes.io/managed-by=kagenti-operator` on workload metadata, and
-`kagenti.io/config-hash` annotation (non-empty, 64 hex chars) on the pod template. Also
-verifies the cross-controller interaction: once `kagenti.io/type=agent` is applied alongside
-the existing `protocol.kagenti.io/a2a` label, AgentCardSync auto-creates an AgentCard
+merges 2-layer config (cluster ConfigMap `rossoctl-platform-config` in `rossoctl-system` +
+namespace ConfigMap with `rossoctl.io/defaults=true` + CR-level overrides), and applies labels
+to the Deployment. Test verifies `rossoctl.io/type=agent` on both workload metadata and pod
+template, `app.kubernetes.io/managed-by=rossoctl-operator` on workload metadata, and
+`rossoctl.io/config-hash` annotation (non-empty, 64 hex chars) on the pod template. Also
+verifies the cross-controller interaction: once `rossoctl.io/type=agent` is applied alongside
+the existing `protocol.rossoctl.io/a2a` label, AgentCardSync auto-creates an AgentCard
 (`runtime-agent-target-deployment-card`) with the correct `managed-by` label and targetRef.
 
 #### Ready=True
@@ -328,12 +328,12 @@ spec on each reconcile loop, which would trigger unnecessary rolling restarts.
 
 #### Clean up on deletion
 
-Deletes the AgentRuntime CR and verifies the finalizer (`kagenti.io/cleanup`) runs correctly:
+Deletes the AgentRuntime CR and verifies the finalizer (`rossoctl.io/cleanup`) runs correctly:
 
 1. **Target Deployment still exists** — the controller cleans up labels, not the workload
-2. **`kagenti.io/type` removed** — the label was applied by the operator and is removed on cleanup
+2. **`rossoctl.io/type` removed** — the label was applied by the operator and is removed on cleanup
 3. **`app.kubernetes.io/managed-by` removed** — workload is no longer operator-managed
-4. **`kagenti.io/config-hash` removed** — annotation is cleared since the workload is no longer managed
+4. **`rossoctl.io/config-hash` removed** — annotation is cleared since the workload is no longer managed
 5. **AgentRuntime CR returns 404** — finalizer completed and CR was fully deleted
 
 #### Missing target error
@@ -345,8 +345,8 @@ resolution fails because no Deployment with that name exists. The controller set
 #### Tool type label
 
 Deploys `runtime-tool-target` (pause container without protocol labels) and creates an
-AgentRuntime CR with `type: tool`. The controller applies `kagenti.io/type=tool` to the
-workload metadata. Unlike the agent fixture, the tool target has no `protocol.kagenti.io/*`
+AgentRuntime CR with `type: tool`. The controller applies `rossoctl.io/type=tool` to the
+workload metadata. Unlike the agent fixture, the tool target has no `protocol.rossoctl.io/*`
 label, so AgentCardSync does not auto-create an AgentCard. The test verifies this with a
 15-second `Consistently` check confirming no AgentCard referencing `runtime-tool-target` exists.
 
@@ -355,14 +355,14 @@ label, so AgentCardSync does not auto-create an AgentCard. The test verifies thi
 Deploys `runtime-sts-target` (StatefulSet with headless Service and pause container) and
 creates an AgentRuntime CR with `kind: StatefulSet` in the targetRef. The controller resolves
 the StatefulSet target identically to Deployments via `runtimePodTemplateAccessor`. Test
-verifies `kagenti.io/type=agent` and `app.kubernetes.io/managed-by=kagenti-operator` on
+verifies `rossoctl.io/type=agent` and `app.kubernetes.io/managed-by=rossoctl-operator` on
 StatefulSet metadata, Phase=Active, and a valid 64-char config-hash on the pod template.
 
 #### CR overrides
 
 Deploys two target Deployments and creates two AgentRuntime CRs: one minimal (no overrides)
 and one with CR-level fields. Both CRs reach Phase=Active. The test records each Deployment's
-`kagenti.io/config-hash` annotation and asserts they are the same, confirming that CR-level
+`rossoctl.io/config-hash` annotation and asserts they are the same, confirming that CR-level
 overrides are excluded from the config hash (2-layer merge). The webhook reads CR overrides
 at pod CREATE time instead.
 
diff --git a/kagenti-operator/test/e2e/e2e_suite_test.go b/operator/test/e2e/e2e_suite_test.go
similarity index 93%
rename from kagenti-operator/test/e2e/e2e_suite_test.go
rename to operator/test/e2e/e2e_suite_test.go
index 5b7a997c..5ece0308 100644
--- a/kagenti-operator/test/e2e/e2e_suite_test.go
+++ b/operator/test/e2e/e2e_suite_test.go
@@ -26,7 +26,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	"github.com/kagenti/operator/test/utils"
+	"github.com/rossoctl/operator/test/utils"
 )
 
 var (
@@ -51,21 +51,21 @@ var (
 
 	// projectImage is the name of the image which will be build and loaded
 	// with the code source changes to be tested.
-	projectImage = "example.com/kagenti-operator:v0.0.1"
+	projectImage = "example.com/operator:v0.0.1"
 
 	// signerImage is the agentcard-signer init-container image
-	signerImage = "ghcr.io/kagenti/kagenti-operator/agentcard-signer:e2e-test"
+	signerImage = "ghcr.io/rossoctl/operator/agentcard-signer:e2e-test"
 
 	// sidecarImages are the AuthBridge sidecar images to pull and load into Kind.
-	// kagenti-extensions ships two combined images plus proxy-init:
+	// rossocortex ships two combined images plus proxy-init:
 	//   * authbridge-envoy: envoy-sidecar mode (Envoy + ext_proc + bundled spiffe-helper)
 	//   * authbridge:       proxy-sidecar mode (authbridge-proxy + bundled spiffe-helper)
 	//   * proxy-init:       iptables init container, envoy-sidecar mode only
 	// Spiffe-helper and client-registration are no longer separate images.
 	sidecarImages = []string{
-		"ghcr.io/kagenti/kagenti-extensions/authbridge-envoy:latest",
-		"ghcr.io/kagenti/kagenti-extensions/authbridge:latest",
-		"ghcr.io/kagenti/kagenti-extensions/proxy-init:latest",
+		"ghcr.io/rossoctl/rossocortex/authbridge-envoy:latest",
+		"ghcr.io/rossoctl/rossocortex/authbridge:latest",
+		"ghcr.io/rossoctl/rossocortex/proxy-init:latest",
 	}
 )
 
@@ -75,7 +75,7 @@ var (
 // CertManager and Prometheus.
 func TestE2E(t *testing.T) {
 	RegisterFailHandler(Fail)
-	_, _ = fmt.Fprintf(GinkgoWriter, "Starting kagenti-operator integration test suite\n")
+	_, _ = fmt.Fprintf(GinkgoWriter, "Starting rossoctl-operator integration test suite\n")
 	RunSpecs(t, "e2e suite")
 }
 
diff --git a/kagenti-operator/test/e2e/e2e_test.go b/operator/test/e2e/e2e_test.go
similarity index 94%
rename from kagenti-operator/test/e2e/e2e_test.go
rename to operator/test/e2e/e2e_test.go
index e44bae9c..6b1a4964 100644
--- a/kagenti-operator/test/e2e/e2e_test.go
+++ b/operator/test/e2e/e2e_test.go
@@ -28,40 +28,40 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	"github.com/kagenti/operator/test/utils"
+	"github.com/rossoctl/operator/test/utils"
 )
 
 func controllerNS() string {
 	if v := os.Getenv("E2E_CONTROLLER_NAMESPACE"); v != "" {
 		return v
 	}
-	return "kagenti-operator-system"
+	return "rossoctl-operator-system"
 }
 
 func controllerDeploy() string {
 	if v := os.Getenv("E2E_CONTROLLER_DEPLOYMENT"); v != "" {
 		return v
 	}
-	return "kagenti-operator-controller-manager"
+	return "rossoctl-operator-controller-manager"
 }
 
 func webhookServiceName() string {
 	if v := os.Getenv("E2E_WEBHOOK_SERVICE"); v != "" {
 		return v
 	}
-	return "kagenti-operator-webhook-service"
+	return "rossoctl-operator-webhook-service"
 }
 
 var namespace = controllerNS()
 
 // serviceAccountName created for the project
-const serviceAccountName = "kagenti-operator-controller-manager"
+const serviceAccountName = "rossoctl-operator-controller-manager"
 
 // metricsServiceName is the name of the metrics service of the project
-const metricsServiceName = "kagenti-operator-controller-manager-metrics-service"
+const metricsServiceName = "rossoctl-operator-controller-manager-metrics-service"
 
 // metricsRoleBindingName is the name of the RBAC that will be created to allow get the metrics data
-const metricsRoleBindingName = "kagenti-operator-metrics-binding"
+const metricsRoleBindingName = "rossoctl-operator-metrics-binding"
 
 var _ = Describe("Manager", Ordered, func() {
 	var controllerPodName string
@@ -171,7 +171,7 @@ var _ = Describe("Manager", Ordered, func() {
 		It("should ensure the metrics endpoint is serving metrics", func() {
 			By("creating a ClusterRoleBinding for the service account to allow access to metrics")
 			cmd := exec.Command("kubectl", "create", "clusterrolebinding", metricsRoleBindingName,
-				"--clusterrole=kagenti-operator-metrics-reader",
+				"--clusterrole=rossoctl-operator-metrics-reader",
 				fmt.Sprintf("--serviceaccount=%s:%s", namespace, serviceAccountName),
 			)
 			_, err := utils.Run(cmd)
@@ -386,7 +386,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 		Expect(err).NotTo(HaveOccurred())
 
 		cmd = exec.Command("kubectl", "label", "--overwrite", "ns", authBridgeTestNamespace,
-			"kagenti-enabled=true",
+			"rossoctl-enabled=true",
 			"pod-security.kubernetes.io/enforce=privileged",
 			"pod-security.kubernetes.io/warn=baseline")
 		_, err = utils.Run(cmd)
@@ -470,18 +470,18 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 			_, err := utils.KubectlApplyStdin(authBridgeAgentFixture(), authBridgeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
 
-			By("waiting for operator to apply kagenti.io/type label via AgentRuntime")
+			By("waiting for operator to apply rossoctl.io/type label via AgentRuntime")
 			Eventually(func(g Gomega) {
 				typeLabel, labelErr := utils.KubectlGetJsonpath("deployment", "authbridge-agent", authBridgeTestNamespace,
-					"{.metadata.labels.kagenti\\.io/type}")
+					"{.metadata.labels.rossoctl\\.io/type}")
 				g.Expect(labelErr).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}, 1*time.Minute, 2*time.Second).Should(Succeed())
 
-			By("waiting for pod template to have kagenti.io/type label (triggers rolling update)")
+			By("waiting for pod template to have rossoctl.io/type label (triggers rolling update)")
 			Eventually(func(g Gomega) {
 				tmplLabel, labelErr := utils.KubectlGetJsonpath("deployment", "authbridge-agent", authBridgeTestNamespace,
-					"{.spec.template.metadata.labels.kagenti\\.io/type}")
+					"{.spec.template.metadata.labels.rossoctl\\.io/type}")
 				g.Expect(labelErr).NotTo(HaveOccurred())
 				g.Expect(tmplLabel).To(Equal("agent"))
 			}, 1*time.Minute, 2*time.Second).Should(Succeed())
@@ -510,7 +510,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 				g.Expect(containers).To(ContainSubstring("envoy-proxy"))
 				g.Expect(containers).NotTo(ContainSubstring("spiffe-helper"),
 					"spiffe-helper is bundled inside envoy-proxy, not a separate container")
-				g.Expect(containers).NotTo(ContainSubstring("kagenti-client-registration"))
+				g.Expect(containers).NotTo(ContainSubstring("rossoctl-client-registration"))
 			}).Should(Succeed())
 
 			By("verifying spiffe-helper is wired into envoy-proxy via SPIRE_ENABLED env")
@@ -555,7 +555,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 			var oldPodName string
 			Eventually(func(g Gomega) {
 				cmd := exec.Command("kubectl", "get", "pods",
-					"-l", "app.kubernetes.io/name=authbridge-agent,kagenti.io/type=agent",
+					"-l", "app.kubernetes.io/name=authbridge-agent,rossoctl.io/type=agent",
 					"-n", authBridgeTestNamespace,
 					"-o", "jsonpath={.items[0].metadata.name}")
 				output, err := utils.Run(cmd)
@@ -572,7 +572,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 			By("waiting for new pod to be running with a different name")
 			Eventually(func(g Gomega) {
 				cmd := exec.Command("kubectl", "get", "pods",
-					"-l", "app.kubernetes.io/name=authbridge-agent,kagenti.io/type=agent",
+					"-l", "app.kubernetes.io/name=authbridge-agent,rossoctl.io/type=agent",
 					"-n", authBridgeTestNamespace,
 					"-o", "jsonpath={.items[0].metadata.name}")
 				output, err := utils.Run(cmd)
@@ -587,7 +587,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 
 			By("verifying exactly 1 envoy-proxy and 1 proxy-init (no separate spiffe-helper)")
 			cmd = exec.Command("kubectl", "get", "pods",
-				"-l", "app.kubernetes.io/name=authbridge-agent,kagenti.io/type=agent",
+				"-l", "app.kubernetes.io/name=authbridge-agent,rossoctl.io/type=agent",
 				"-n", authBridgeTestNamespace,
 				"-o", "jsonpath={.items[0].spec.containers[*].name}")
 			containers, err := utils.Run(cmd)
@@ -597,7 +597,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 				"spiffe-helper is bundled inside envoy-proxy, should not appear as a separate container")
 
 			cmd = exec.Command("kubectl", "get", "pods",
-				"-l", "app.kubernetes.io/name=authbridge-agent,kagenti.io/type=agent",
+				"-l", "app.kubernetes.io/name=authbridge-agent,rossoctl.io/type=agent",
 				"-n", authBridgeTestNamespace,
 				"-o", "jsonpath={.items[0].spec.initContainers[*].name}")
 			initContainers, err := utils.Run(cmd)
@@ -607,7 +607,7 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 	})
 
 	Context("Injection opt-out", func() {
-		It("should not inject when kagenti.io/inject=disabled", func() {
+		It("should not inject when rossoctl.io/inject=disabled", func() {
 			var err error
 			By("creating AgentRuntime for disabled agent")
 			Eventually(func(g Gomega) {
@@ -624,10 +624,10 @@ var _ = Describe("AuthBridge Injection E2E", Ordered, func() {
 			_, err = utils.KubectlApplyStdin(authBridgeDisabledAgentFixture(), authBridgeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
 
-			By("waiting for operator to apply kagenti.io/type label via AgentRuntime")
+			By("waiting for operator to apply rossoctl.io/type label via AgentRuntime")
 			Eventually(func(g Gomega) {
 				typeLabel, labelErr := utils.KubectlGetJsonpath("deployment", "authbridge-disabled-agent",
-					authBridgeTestNamespace, "{.metadata.labels.kagenti\\.io/type}")
+					authBridgeTestNamespace, "{.metadata.labels.rossoctl\\.io/type}")
 				g.Expect(labelErr).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}, 1*time.Minute, 2*time.Second).Should(Succeed())
@@ -859,10 +859,10 @@ var _ = Describe("AgentCard E2E", Ordered, func() {
 				g.Expect(applyErr).NotTo(HaveOccurred())
 			}, 2*time.Minute, 2*time.Second).Should(Succeed())
 
-			By("waiting for operator to apply kagenti.io/type label")
+			By("waiting for operator to apply rossoctl.io/type label")
 			Eventually(func(g Gomega) {
 				typeLabel, labelErr := utils.KubectlGetJsonpath("deployment", "noproto-agent", testNamespace,
-					"{.metadata.labels.kagenti\\.io/type}")
+					"{.metadata.labels.rossoctl\\.io/type}")
 				g.Expect(labelErr).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}, 1*time.Minute, 2*time.Second).Should(Succeed())
@@ -890,10 +890,10 @@ var _ = Describe("AgentCard E2E", Ordered, func() {
 				g.Expect(applyErr).NotTo(HaveOccurred())
 			}, 2*time.Minute, 2*time.Second).Should(Succeed())
 
-			By("waiting for operator to apply kagenti.io/type label")
+			By("waiting for operator to apply rossoctl.io/type label")
 			Eventually(func(g Gomega) {
 				typeLabel, labelErr := utils.KubectlGetJsonpath("deployment", "echo-agent", testNamespace,
-					"{.metadata.labels.kagenti\\.io/type}")
+					"{.metadata.labels.rossoctl\\.io/type}")
 				g.Expect(labelErr).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}, 1*time.Minute, 2*time.Second).Should(Succeed())
@@ -908,7 +908,7 @@ var _ = Describe("AgentCard E2E", Ordered, func() {
 				managedBy, err := utils.KubectlGetJsonpath("agentcard", cardName, testNamespace,
 					"{.metadata.labels['app\\.kubernetes\\.io/managed-by']}")
 				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(managedBy).To(Equal("kagenti-operator"))
+				g.Expect(managedBy).To(Equal("rossoctl-operator"))
 			}).Should(Succeed())
 
 			By("verifying targetRef")
@@ -966,15 +966,15 @@ var _ = Describe("AgentCard E2E", Ordered, func() {
 				"--spire-trust-bundle-configmap=spire-bundle",
 				"--spire-trust-bundle-configmap-namespace=spire-system",
 			}, map[string]string{
-				"KAGENTI_SPIRE_TRUST_DOMAIN": "example.org",
+				"ROSSOCTL_SPIRE_TRUST_DOMAIN": "example.org",
 			})
 			Expect(err).NotTo(HaveOccurred())
 		})
 
 		AfterAll(func() {
-			By("removing KAGENTI_SPIRE_TRUST_DOMAIN env var")
+			By("removing ROSSOCTL_SPIRE_TRUST_DOMAIN env var")
 			cmd := exec.Command("kubectl", "set", "env", "deployment/"+controllerDeployment,
-				"-n", controllerNamespace, "KAGENTI_SPIRE_TRUST_DOMAIN-")
+				"-n", controllerNamespace, "ROSSOCTL_SPIRE_TRUST_DOMAIN-")
 			_, _ = utils.Run(cmd)
 
 			By("restoring original controller args")
@@ -1031,10 +1031,10 @@ var _ = Describe("AgentCard E2E", Ordered, func() {
 					g.Expect(applyErr).NotTo(HaveOccurred())
 				}, 2*time.Minute, 2*time.Second).Should(Succeed())
 
-				By("waiting for operator to apply kagenti.io/type label")
+				By("waiting for operator to apply rossoctl.io/type label")
 				Eventually(func(g Gomega) {
 					typeLabel, labelErr := utils.KubectlGetJsonpath("deployment", "audit-agent", testNamespace,
-						"{.metadata.labels.kagenti\\.io/type}")
+						"{.metadata.labels.rossoctl\\.io/type}")
 					g.Expect(labelErr).NotTo(HaveOccurred())
 					g.Expect(typeLabel).To(Equal("agent"))
 				}, 1*time.Minute, 2*time.Second).Should(Succeed())
@@ -1087,10 +1087,10 @@ var _ = Describe("AgentCard E2E", Ordered, func() {
 				g.Expect(applyErr).NotTo(HaveOccurred())
 			}, 2*time.Minute, 2*time.Second).Should(Succeed())
 
-			By("waiting for operator to apply kagenti.io/type label")
+			By("waiting for operator to apply rossoctl.io/type label")
 			Eventually(func(g Gomega) {
 				typeLabel, labelErr := utils.KubectlGetJsonpath("deployment", "signed-agent", testNamespace,
-					"{.metadata.labels.kagenti\\.io/type}")
+					"{.metadata.labels.rossoctl\\.io/type}")
 				g.Expect(labelErr).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}, 1*time.Minute, 2*time.Second).Should(Succeed())
@@ -1199,12 +1199,12 @@ rules:
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("ensuring kagenti-system namespace exists")
-		cmd = exec.Command("kubectl", "create", "ns", "kagenti-system")
+		By("ensuring rossoctl-system namespace exists")
+		cmd = exec.Command("kubectl", "create", "ns", "rossoctl-system")
 		_, _ = utils.Run(cmd) // ignore error; namespace may already exist
 
 		By("creating cluster defaults ConfigMap")
-		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "kagenti-system")
+		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "rossoctl-system")
 		Expect(err).NotTo(HaveOccurred())
 
 		By("creating namespace defaults ConfigMap")
@@ -1218,8 +1218,8 @@ rules:
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up cluster defaults ConfigMap")
-		cmd = exec.Command("kubectl", "delete", "configmap", "kagenti-platform-config",
-			"-n", "kagenti-system", "--ignore-not-found")
+		cmd = exec.Command("kubectl", "delete", "configmap", "rossoctl-platform-config",
+			"-n", "rossoctl-system", "--ignore-not-found")
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up mlflow-operator ClusterRole")
@@ -1279,10 +1279,10 @@ rules:
 				return err
 			}, 1*time.Minute, 5*time.Second).Should(Succeed())
 
-			By("verifying kagenti.io/type=agent on workload metadata")
+			By("verifying rossoctl.io/type=agent on workload metadata")
 			Eventually(func(g Gomega) {
 				typeLabel, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
-					agentRuntimeTestNamespace, "{.metadata.labels['kagenti\\.io/type']}")
+					agentRuntimeTestNamespace, "{.metadata.labels['rossoctl\\.io/type']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}).Should(Succeed())
@@ -1292,14 +1292,14 @@ rules:
 				managedBy, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
 					agentRuntimeTestNamespace, "{.metadata.labels['app\\.kubernetes\\.io/managed-by']}")
 				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(managedBy).To(Equal("kagenti-operator"))
+				g.Expect(managedBy).To(Equal("rossoctl-operator"))
 			}).Should(Succeed())
 
-			By("verifying kagenti.io/type=agent on pod template")
+			By("verifying rossoctl.io/type=agent on pod template")
 			Eventually(func(g Gomega) {
 				podTypeLabel, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
 					agentRuntimeTestNamespace,
-					"{.spec.template.metadata.labels['kagenti\\.io/type']}")
+					"{.spec.template.metadata.labels['rossoctl\\.io/type']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(podTypeLabel).To(Equal("agent"))
 			}).Should(Succeed())
@@ -1308,7 +1308,7 @@ rules:
 			Eventually(func(g Gomega) {
 				hash, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
 					agentRuntimeTestNamespace,
-					"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+					"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(hash).NotTo(BeEmpty())
 				g.Expect(hash).To(HaveLen(64))
@@ -1321,7 +1321,7 @@ rules:
 					agentRuntimeTestNamespace,
 					"{.metadata.labels['app\\.kubernetes\\.io/managed-by']}")
 				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(managedBy).To(Equal("kagenti-operator"))
+				g.Expect(managedBy).To(Equal("rossoctl-operator"))
 			}).Should(Succeed())
 
 			By("verifying AgentCard targetRef points to the runtime target")
@@ -1386,18 +1386,18 @@ rules:
 			_, err = utils.Run(cmd)
 			Expect(err).NotTo(HaveOccurred())
 
-			By("verifying kagenti.io/type label is removed from workload metadata")
+			By("verifying rossoctl.io/type label is removed from workload metadata")
 			Eventually(func(g Gomega) {
 				typeLabel, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
-					agentRuntimeTestNamespace, "{.metadata.labels['kagenti\\.io/type']}")
+					agentRuntimeTestNamespace, "{.metadata.labels['rossoctl\\.io/type']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(BeEmpty())
 			}).Should(Succeed())
 
-			By("verifying kagenti.io/type label is removed from PodTemplateSpec")
+			By("verifying rossoctl.io/type label is removed from PodTemplateSpec")
 			Eventually(func(g Gomega) {
 				typeLabel, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
-					agentRuntimeTestNamespace, "{.spec.template.metadata.labels['kagenti\\.io/type']}")
+					agentRuntimeTestNamespace, "{.spec.template.metadata.labels['rossoctl\\.io/type']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(BeEmpty())
 			}).Should(Succeed())
@@ -1414,7 +1414,7 @@ rules:
 			Eventually(func(g Gomega) {
 				hash, err := utils.KubectlGetJsonpath("deployment", "runtime-agent-target",
 					agentRuntimeTestNamespace,
-					"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+					"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(hash).To(BeEmpty())
 			}).Should(Succeed())
@@ -1452,7 +1452,7 @@ rules:
 	})
 
 	Context("Tool type", func() {
-		It("should apply kagenti.io/type=tool label", func() {
+		It("should apply rossoctl.io/type=tool label", func() {
 			By("deploying the tool target workload")
 			_, err := utils.KubectlApplyStdin(runtimeToolTargetDeploymentFixture(), agentRuntimeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
@@ -1462,10 +1462,10 @@ rules:
 			_, err = utils.KubectlApplyStdin(runtimeToolCRFixture(), agentRuntimeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
 
-			By("verifying kagenti.io/type=tool on workload metadata")
+			By("verifying rossoctl.io/type=tool on workload metadata")
 			Eventually(func(g Gomega) {
 				typeLabel, err := utils.KubectlGetJsonpath("deployment", "runtime-tool-target",
-					agentRuntimeTestNamespace, "{.metadata.labels['kagenti\\.io/type']}")
+					agentRuntimeTestNamespace, "{.metadata.labels['rossoctl\\.io/type']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("tool"))
 			}).Should(Succeed())
@@ -1504,10 +1504,10 @@ rules:
 			_, err = utils.KubectlApplyStdin(runtimeStatefulSetCRFixture(), agentRuntimeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
 
-			By("verifying kagenti.io/type=agent on StatefulSet metadata")
+			By("verifying rossoctl.io/type=agent on StatefulSet metadata")
 			Eventually(func(g Gomega) {
 				typeLabel, err := utils.KubectlGetJsonpath("statefulset", "runtime-sts-target",
-					agentRuntimeTestNamespace, "{.metadata.labels['kagenti\\.io/type']}")
+					agentRuntimeTestNamespace, "{.metadata.labels['rossoctl\\.io/type']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(typeLabel).To(Equal("agent"))
 			}).Should(Succeed())
@@ -1517,7 +1517,7 @@ rules:
 				managedBy, err := utils.KubectlGetJsonpath("statefulset", "runtime-sts-target",
 					agentRuntimeTestNamespace, "{.metadata.labels['app\\.kubernetes\\.io/managed-by']}")
 				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(managedBy).To(Equal("kagenti-operator"))
+				g.Expect(managedBy).To(Equal("rossoctl-operator"))
 			}).Should(Succeed())
 
 			By("verifying Ready=True")
@@ -1532,7 +1532,7 @@ rules:
 			Eventually(func(g Gomega) {
 				hash, err := utils.KubectlGetJsonpath("statefulset", "runtime-sts-target",
 					agentRuntimeTestNamespace,
-					"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+					"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(hash).To(HaveLen(64))
 			}).Should(Succeed())
@@ -1579,7 +1579,7 @@ rules:
 			Eventually(func(g Gomega) {
 				hash, err := utils.KubectlGetJsonpath("deployment", "runtime-minimal-target",
 					agentRuntimeTestNamespace,
-					"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+					"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(hash).To(HaveLen(64))
 				minimalHash = hash
@@ -1597,7 +1597,7 @@ rules:
 			Eventually(func(g Gomega) {
 				hash, err := utils.KubectlGetJsonpath("deployment", "runtime-overrides-target",
 					agentRuntimeTestNamespace,
-					"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+					"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 				g.Expect(err).NotTo(HaveOccurred())
 				g.Expect(hash).To(HaveLen(64))
 				overridesHash = hash
@@ -1662,9 +1662,9 @@ rules:
 			return utils.ProbeWebhookReady(controllerNamespace)
 		}, 2*time.Minute, 2*time.Second).Should(Succeed())
 
-		By("setting KAGENTI_SPIRE_TRUST_DOMAIN env var")
+		By("setting ROSSOCTL_SPIRE_TRUST_DOMAIN env var")
 		envCmd := exec.Command("kubectl", "set", "env", "deployment/"+controllerDeployment,
-			"-n", controllerNamespace, "KAGENTI_SPIRE_TRUST_DOMAIN=example.org")
+			"-n", controllerNamespace, "ROSSOCTL_SPIRE_TRUST_DOMAIN=example.org")
 		_, err := utils.Run(envCmd)
 		Expect(err).NotTo(HaveOccurred())
 		Expect(utils.WaitForRollout(controllerDeployment, controllerNamespace, 2*time.Minute)).To(Succeed())
@@ -1675,7 +1675,7 @@ rules:
 		Expect(err).NotTo(HaveOccurred())
 
 		cmd = exec.Command("kubectl", "label", "--overwrite", "ns", combinedTestNamespace,
-			"kagenti-enabled=true",
+			"rossoctl-enabled=true",
 			"pod-security.kubernetes.io/enforce=privileged",
 			"pod-security.kubernetes.io/warn=baseline")
 		_, err = utils.Run(cmd)
@@ -1708,12 +1708,12 @@ rules:
 			combinedTestNamespace)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("ensuring kagenti-system namespace exists")
-		cmd = exec.Command("kubectl", "create", "ns", "kagenti-system")
+		By("ensuring rossoctl-system namespace exists")
+		cmd = exec.Command("kubectl", "create", "ns", "rossoctl-system")
 		_, _ = utils.Run(cmd)
 
 		By("creating cluster defaults ConfigMap")
-		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "kagenti-system")
+		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "rossoctl-system")
 		Expect(err).NotTo(HaveOccurred())
 
 		By("deploying combined agent")
@@ -1731,9 +1731,9 @@ rules:
 	})
 
 	AfterAll(func() {
-		By("removing KAGENTI_SPIRE_TRUST_DOMAIN env var")
+		By("removing ROSSOCTL_SPIRE_TRUST_DOMAIN env var")
 		envCmd := exec.Command("kubectl", "set", "env", "deployment/"+controllerDeployment,
-			"-n", controllerNamespace, "KAGENTI_SPIRE_TRUST_DOMAIN-")
+			"-n", controllerNamespace, "ROSSOCTL_SPIRE_TRUST_DOMAIN-")
 		_, _ = utils.Run(envCmd)
 
 		By("restoring original controller args")
@@ -1751,8 +1751,8 @@ rules:
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up cluster defaults ConfigMap")
-		cmd = exec.Command("kubectl", "delete", "configmap", "kagenti-platform-config",
-			"-n", "kagenti-system", "--ignore-not-found")
+		cmd = exec.Command("kubectl", "delete", "configmap", "rossoctl-platform-config",
+			"-n", "rossoctl-system", "--ignore-not-found")
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up mlflow-operator ClusterRole")
@@ -1825,10 +1825,10 @@ rules:
 			g.Expect(readyStatus).To(Equal("True"))
 		}).Should(Succeed())
 
-		By("verifying kagenti.io/type=agent on deployment metadata")
+		By("verifying rossoctl.io/type=agent on deployment metadata")
 		Eventually(func(g Gomega) {
 			typeLabel, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
-				combinedTestNamespace, "{.metadata.labels['kagenti\\.io/type']}")
+				combinedTestNamespace, "{.metadata.labels['rossoctl\\.io/type']}")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(typeLabel).To(Equal("agent"))
 		}).Should(Succeed())
@@ -1838,31 +1838,31 @@ rules:
 			managedBy, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
 				combinedTestNamespace, "{.metadata.labels['app\\.kubernetes\\.io/managed-by']}")
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(managedBy).To(Equal("kagenti-operator"))
+			g.Expect(managedBy).To(Equal("rossoctl-operator"))
 		}).Should(Succeed())
 
-		By("verifying kagenti.io/type=agent on pod template")
+		By("verifying rossoctl.io/type=agent on pod template")
 		Eventually(func(g Gomega) {
 			podTypeLabel, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
 				combinedTestNamespace,
-				"{.spec.template.metadata.labels['kagenti\\.io/type']}")
+				"{.spec.template.metadata.labels['rossoctl\\.io/type']}")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(podTypeLabel).To(Equal("agent"))
 		}).Should(Succeed())
 
-		By("verifying protocol.kagenti.io/a2a label preserved")
+		By("verifying protocol.rossoctl.io/a2a label preserved")
 		Eventually(func(g Gomega) {
 			labelsJSON, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
 				combinedTestNamespace, "{.metadata.labels}")
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(labelsJSON).To(ContainSubstring("protocol.kagenti.io/a2a"))
+			g.Expect(labelsJSON).To(ContainSubstring("protocol.rossoctl.io/a2a"))
 		}).Should(Succeed())
 
 		By("verifying config-hash annotation is 64-char hex")
 		Eventually(func(g Gomega) {
 			hash, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
 				combinedTestNamespace,
-				"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+				"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(hash).To(HaveLen(64))
 		}).Should(Succeed())
@@ -1877,7 +1877,7 @@ rules:
 				combinedTestNamespace,
 				"{.metadata.labels['app\\.kubernetes\\.io/managed-by']}")
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(managedBy).To(Equal("kagenti-operator"))
+			g.Expect(managedBy).To(Equal("rossoctl-operator"))
 		}).Should(Succeed())
 
 		By("verifying targetRef")
@@ -2021,18 +2021,18 @@ rules:
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("verifying kagenti.io/type label removed from workload metadata")
+		By("verifying rossoctl.io/type label removed from workload metadata")
 		Eventually(func(g Gomega) {
 			typeLabel, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
-				combinedTestNamespace, "{.metadata.labels['kagenti\\.io/type']}")
+				combinedTestNamespace, "{.metadata.labels['rossoctl\\.io/type']}")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(typeLabel).To(BeEmpty())
 		}).Should(Succeed())
 
-		By("verifying kagenti.io/type label removed from PodTemplateSpec")
+		By("verifying rossoctl.io/type label removed from PodTemplateSpec")
 		Eventually(func(g Gomega) {
 			typeLabel, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
-				combinedTestNamespace, "{.spec.template.metadata.labels['kagenti\\.io/type']}")
+				combinedTestNamespace, "{.spec.template.metadata.labels['rossoctl\\.io/type']}")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(typeLabel).To(BeEmpty())
 		}).Should(Succeed())
@@ -2049,7 +2049,7 @@ rules:
 		Eventually(func(g Gomega) {
 			hash, err := utils.KubectlGetJsonpath("deployment", "combined-agent",
 				combinedTestNamespace,
-				"{.spec.template.metadata.annotations['kagenti\\.io/config-hash']}")
+				"{.spec.template.metadata.annotations['rossoctl\\.io/config-hash']}")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(hash).To(BeEmpty())
 		}).Should(Succeed())
@@ -2110,7 +2110,7 @@ rules:
 		utils.UndeployController()
 
 		By("cleaning up stale feature-gates ConfigMap")
-		cleanupCmd := exec.Command("kubectl", "delete", "configmap", "kagenti-feature-gates",
+		cleanupCmd := exec.Command("kubectl", "delete", "configmap", "rossoctl-feature-gates",
 			"-n", controllerNamespace, "--ignore-not-found")
 		_, _ = utils.Run(cleanupCmd)
 
@@ -2151,12 +2151,12 @@ rules:
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("ensuring kagenti-system namespace exists")
-		cmd = exec.Command("kubectl", "create", "ns", "kagenti-system")
+		By("ensuring rossoctl-system namespace exists")
+		cmd = exec.Command("kubectl", "create", "ns", "rossoctl-system")
 		_, _ = utils.Run(cmd)
 
 		By("creating cluster defaults ConfigMap")
-		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "kagenti-system")
+		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "rossoctl-system")
 		Expect(err).NotTo(HaveOccurred())
 
 		By("deploying target Deployment with skills annotation")
@@ -2173,12 +2173,12 @@ rules:
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up cluster defaults ConfigMap")
-		cmd = exec.Command("kubectl", "delete", "configmap", "kagenti-platform-config",
-			"-n", "kagenti-system", "--ignore-not-found")
+		cmd = exec.Command("kubectl", "delete", "configmap", "rossoctl-platform-config",
+			"-n", "rossoctl-system", "--ignore-not-found")
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up feature-gates ConfigMap")
-		cmd = exec.Command("kubectl", "delete", "configmap", "kagenti-feature-gates",
+		cmd = exec.Command("kubectl", "delete", "configmap", "rossoctl-feature-gates",
 			"-n", controllerNamespace, "--ignore-not-found")
 		_, _ = utils.Run(cmd)
 
@@ -2342,7 +2342,7 @@ rules:
 			cmd := exec.Command("kubectl", "annotate", "--overwrite",
 				"deployment", "skill-discovery-agent",
 				"-n", skillDiscoveryTestNamespace,
-				`kagenti.io/skills=["summarizer","translator","openshift-review"]`)
+				`rossoctl.io/skills=["summarizer","translator","openshift-review"]`)
 			_, err := utils.Run(cmd)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -2363,7 +2363,7 @@ rules:
 			cmd := exec.Command("kubectl", "annotate",
 				"deployment", "skill-discovery-agent",
 				"-n", skillDiscoveryTestNamespace,
-				"kagenti.io/skills-")
+				"rossoctl.io/skills-")
 			_, err := utils.Run(cmd)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -2455,11 +2455,11 @@ rules:
 		})
 
 		It("should degrade gracefully with malformed skills annotation", func() {
-			By("setting a malformed kagenti.io/skills annotation")
+			By("setting a malformed rossoctl.io/skills annotation")
 			cmd := exec.Command("kubectl", "annotate", "--overwrite",
 				"deployment", "skill-discovery-agent",
 				"-n", skillDiscoveryTestNamespace,
-				`kagenti.io/skills=not-valid-json`)
+				`rossoctl.io/skills=not-valid-json`)
 			_, err := utils.Run(cmd)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -2487,14 +2487,14 @@ rules:
 					"-o", "jsonpath={.items[*].message}")
 				output, err := utils.Run(cmd)
 				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(output).To(ContainSubstring("Failed to parse kagenti.io/skills annotation"))
+				g.Expect(output).To(ContainSubstring("Failed to parse rossoctl.io/skills annotation"))
 			}).Should(Succeed())
 
 			By("restoring valid annotation")
 			cmd = exec.Command("kubectl", "annotate", "--overwrite",
 				"deployment", "skill-discovery-agent",
 				"-n", skillDiscoveryTestNamespace,
-				`kagenti.io/skills=["summarizer","openshift-review"]`)
+				`rossoctl.io/skills=["summarizer","openshift-review"]`)
 			_, err = utils.Run(cmd)
 			Expect(err).NotTo(HaveOccurred())
 		})
@@ -2504,7 +2504,7 @@ rules:
 			cmd := exec.Command("kubectl", "annotate", "--overwrite",
 				"deployment", "skill-discovery-agent",
 				"-n", skillDiscoveryTestNamespace,
-				`kagenti.io/skills=["summarizer","openshift-review"]`)
+				`rossoctl.io/skills=["summarizer","openshift-review"]`)
 			_, err := utils.Run(cmd)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -2576,16 +2576,16 @@ var _ = Describe("Istio Mesh Enrollment E2E", Ordered, func() {
 
 		By("annotating opt-out namespace")
 		cmd = exec.Command("kubectl", "annotate", "ns", istioMeshOptOutTestNamespace,
-			"kagenti.io/istio-mesh=disabled")
+			"rossoctl.io/istio-mesh=disabled")
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred())
 
-		By("ensuring kagenti-system namespace exists")
-		cmd = exec.Command("kubectl", "create", "ns", "kagenti-system")
+		By("ensuring rossoctl-system namespace exists")
+		cmd = exec.Command("kubectl", "create", "ns", "rossoctl-system")
 		_, _ = utils.Run(cmd)
 
 		By("creating cluster defaults ConfigMap")
-		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "kagenti-system")
+		_, err = utils.KubectlApplyStdin(runtimeClusterDefaultsConfigMapFixture(), "rossoctl-system")
 		Expect(err).NotTo(HaveOccurred())
 
 		By("deploying workload")
@@ -2618,8 +2618,8 @@ var _ = Describe("Istio Mesh Enrollment E2E", Ordered, func() {
 		_, _ = utils.Run(cmd)
 
 		By("cleaning up cluster defaults ConfigMap")
-		cmd = exec.Command("kubectl", "delete", "configmap", "kagenti-platform-config",
-			"-n", "kagenti-system", "--ignore-not-found")
+		cmd = exec.Command("kubectl", "delete", "configmap", "rossoctl-platform-config",
+			"-n", "rossoctl-system", "--ignore-not-found")
 		_, _ = utils.Run(cmd)
 
 		utils.UndeployController()
diff --git a/kagenti-operator/test/e2e/fixtures.go b/operator/test/e2e/fixtures.go
similarity index 92%
rename from kagenti-operator/test/e2e/fixtures.go
rename to operator/test/e2e/fixtures.go
index ff6cde27..3c84aac8 100644
--- a/kagenti-operator/test/e2e/fixtures.go
+++ b/operator/test/e2e/fixtures.go
@@ -21,7 +21,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/kagenti/operator/internal/clientreg"
+	"github.com/rossoctl/operator/internal/clientreg"
 )
 
 // curlImage returns the container image used for curl-based test pods.
@@ -102,7 +102,7 @@ data:
 }
 
 // echoAgentFixture returns YAML for echo-agent Deployment + Service (used by S1, S3).
-// The kagenti.io/type label is applied by the operator via an AgentRuntime CR.
+// The rossoctl.io/type label is applied by the operator via an AgentRuntime CR.
 func echoAgentFixture() string {
 	return `apiVersion: apps/v1
 kind: Deployment
@@ -110,7 +110,7 @@ metadata:
   name: echo-agent
   namespace: ` + testNamespace + `
   labels:
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
     app.kubernetes.io/name: echo-agent
 spec:
   replicas: 1
@@ -121,8 +121,8 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: echo-agent
-        kagenti.io/inject: disabled
-        protocol.kagenti.io/a2a: ""
+        rossoctl.io/inject: disabled
+        protocol.rossoctl.io/a2a: ""
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -174,8 +174,8 @@ spec:
 }
 
 // noProtocolAgentFixture returns YAML for noproto-agent Deployment (S2) - receives
-// kagenti.io/type=agent via AgentRuntime but has NO protocol.kagenti.io/* label.
-// kagenti.io/inject=disabled is set because this test validates AgentCard sync
+// rossoctl.io/type=agent via AgentRuntime but has NO protocol.rossoctl.io/* label.
+// rossoctl.io/inject=disabled is set because this test validates AgentCard sync
 // behaviour, not sidecar injection.
 func noProtocolAgentFixture() string {
 	return `apiVersion: apps/v1
@@ -194,7 +194,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: noproto-agent
-        kagenti.io/inject: disabled
+        rossoctl.io/inject: disabled
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -214,7 +214,7 @@ spec:
 
 // manualAgentCardFixture returns YAML for a manual AgentCard targeting echo-agent (S3).
 func manualAgentCardFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: echo-agent-manual-card
@@ -229,7 +229,7 @@ spec:
 
 // invalidAgentCardFixture returns YAML for an AgentCard WITHOUT spec.targetRef (S6).
 func invalidAgentCardFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: invalid-no-targetref
@@ -240,7 +240,7 @@ spec:
 }
 
 // auditAgentFixture returns YAML for audit-agent Deployment + Service (S5).
-// The kagenti.io/type label is applied by the operator via an AgentRuntime CR.
+// The rossoctl.io/type label is applied by the operator via an AgentRuntime CR.
 func auditAgentFixture() string {
 	return `apiVersion: apps/v1
 kind: Deployment
@@ -248,7 +248,7 @@ metadata:
   name: audit-agent
   namespace: ` + testNamespace + `
   labels:
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
     app.kubernetes.io/name: audit-agent
 spec:
   replicas: 1
@@ -259,8 +259,8 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: audit-agent
-        kagenti.io/inject: disabled
-        protocol.kagenti.io/a2a: ""
+        rossoctl.io/inject: disabled
+        protocol.rossoctl.io/a2a: ""
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -314,14 +314,14 @@ spec:
 // auditModeAgentCardFixture returns YAML for AgentCard targeting audit-agent.
 // Uses the auto-created card name so kubectl apply updates the existing card.
 func auditModeAgentCardFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: audit-agent-deployment-card
   namespace: ` + testNamespace + `
   labels:
     app.kubernetes.io/name: audit-agent
-    app.kubernetes.io/managed-by: kagenti-operator
+    app.kubernetes.io/managed-by: rossoctl-operator
 spec:
   targetRef:
     apiVersion: apps/v1
@@ -398,7 +398,7 @@ metadata:
   name: signed-agent
   namespace: ` + testNamespace + `
   labels:
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
     app.kubernetes.io/name: signed-agent
 spec:
   replicas: 1
@@ -409,8 +409,8 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: signed-agent
-        kagenti.io/inject: disabled
-        protocol.kagenti.io/a2a: ""
+        rossoctl.io/inject: disabled
+        protocol.rossoctl.io/a2a: ""
     spec:
       serviceAccountName: signed-agent-sa
       securityContext:
@@ -419,7 +419,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: sign-agentcard
-          image: ghcr.io/kagenti/kagenti-operator/agentcard-signer:e2e-test
+          image: ghcr.io/rossoctl/operator/agentcard-signer:e2e-test
           imagePullPolicy: IfNotPresent
           env:
             - name: SPIFFE_ENDPOINT_SOCKET
@@ -505,14 +505,14 @@ spec:
 // signedAgentCardFixture returns YAML for AgentCard with identityBinding for signed-agent (S4).
 // Uses the auto-created card name so kubectl apply updates the existing card.
 func signedAgentCardFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentCard
 metadata:
   name: signed-agent-deployment-card
   namespace: ` + testNamespace + `
   labels:
     app.kubernetes.io/name: signed-agent
-    app.kubernetes.io/managed-by: kagenti-operator
+    app.kubernetes.io/managed-by: rossoctl-operator
 spec:
   syncPeriod: "30s"
   targetRef:
@@ -534,7 +534,7 @@ spec:
   spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
   podSelector:
     matchLabels:
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
   namespaceSelector:
     matchLabels:
       agentcard: "true"
@@ -543,7 +543,7 @@ spec:
 
 // echoAgentRuntimeFixture returns YAML for an AgentRuntime CR targeting echo-agent.
 func echoAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: echo-agent
@@ -559,7 +559,7 @@ spec:
 
 // noProtoAgentRuntimeFixture returns YAML for an AgentRuntime CR targeting noproto-agent.
 func noProtoAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: noproto-agent
@@ -575,7 +575,7 @@ spec:
 
 // auditAgentRuntimeFixture returns YAML for an AgentRuntime CR targeting audit-agent.
 func auditAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: audit-agent
@@ -591,7 +591,7 @@ spec:
 
 // signedAgentRuntimeFixture returns YAML for an AgentRuntime CR targeting signed-agent.
 func signedAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: signed-agent
@@ -619,7 +619,7 @@ metadata:
   namespace: ` + agentRuntimeTestNamespace + `
   labels:
     app.kubernetes.io/name: runtime-agent-target
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -648,7 +648,7 @@ spec:
 
 // runtimeAgentCRFixture returns YAML for an AgentRuntime CR with type=agent.
 func runtimeAgentCRFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: test-agent-runtime
@@ -664,7 +664,7 @@ spec:
 
 // runtimeMissingTargetCRFixture returns YAML for an AgentRuntime CR targeting a non-existent deployment.
 func runtimeMissingTargetCRFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: test-missing-target
@@ -715,7 +715,7 @@ spec:
 
 // runtimeToolCRFixture returns YAML for an AgentRuntime CR with type=tool.
 func runtimeToolCRFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: test-tool-runtime
@@ -730,20 +730,20 @@ spec:
 }
 
 // runtimeClusterDefaultsConfigMapFixture returns YAML for the cluster-level defaults ConfigMap
-// in kagenti-system namespace (layer 1 of 3-layer config merge).
+// in rossoctl-system namespace (layer 1 of 3-layer config merge).
 func runtimeClusterDefaultsConfigMapFixture() string {
 	return `apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kagenti-platform-config
-  namespace: kagenti-system
+  name: rossoctl-platform-config
+  namespace: rossoctl-system
 data:
   trace.endpoint: "http://otel-collector.observability:4317"
 `
 }
 
 // runtimeNamespaceDefaultsConfigMapFixture returns YAML for the namespace-level defaults ConfigMap
-// (layer 2 of 3-layer config merge). Must have kagenti.io/defaults=true label.
+// (layer 2 of 3-layer config merge). Must have rossoctl.io/defaults=true label.
 func runtimeNamespaceDefaultsConfigMapFixture() string {
 	return `apiVersion: v1
 kind: ConfigMap
@@ -751,7 +751,7 @@ metadata:
   name: runtime-ns-defaults
   namespace: ` + agentRuntimeTestNamespace + `
   labels:
-    kagenti.io/defaults: "true"
+    rossoctl.io/defaults: "true"
 data:
   log.level: debug
 `
@@ -807,7 +807,7 @@ spec:
 
 // runtimeStatefulSetCRFixture returns YAML for an AgentRuntime CR targeting a StatefulSet.
 func runtimeStatefulSetCRFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: test-sts-runtime
@@ -858,7 +858,7 @@ spec:
 
 // runtimeMinimalCRFixture returns YAML for an AgentRuntime CR without overrides (baseline for hash comparison).
 func runtimeMinimalCRFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: test-minimal-runtime
@@ -911,7 +911,7 @@ spec:
 // The mtlsMode override is a real spec field that the controller stamps as an annotation
 // but excludes from the config hash, so the hash should match the minimal CR.
 func runtimeOverridesCRFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: test-overrides-runtime
@@ -961,7 +961,7 @@ data:
     svid_file_name = "svid.pem"
     svid_key_file_name = "svid_key.pem"
     svid_bundle_file_name = "svid_bundle.pem"
-    jwt_svids = [{jwt_audience="kagenti", jwt_svid_file_name="jwt_svid.token"}]
+    jwt_svids = [{jwt_audience="rossoctl", jwt_svid_file_name="jwt_svid.token"}]
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -993,7 +993,7 @@ data:
 // authBridgeAgentRuntimeFixture returns YAML for an AgentRuntime CR targeting
 // the authbridge-agent Deployment.
 func authBridgeAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: authbridge-agent
@@ -1008,7 +1008,7 @@ spec:
 }
 
 // authBridgeAgentFixture returns YAML for the authbridge-agent Deployment,
-// ServiceAccount, and Service. The kagenti.io/type label is applied by the
+// ServiceAccount, and Service. The rossoctl.io/type label is applied by the
 // operator via the AgentRuntime CR created in BeforeAll.
 func authBridgeAgentFixture() string {
 	return `apiVersion: v1
@@ -1079,8 +1079,8 @@ spec:
 }
 
 // authBridgeDisabledAgentFixture returns YAML for a Deployment that opts out
-// of sidecar injection via the kagenti.io/inject=disabled pod template label.
-// The kagenti.io/type label is applied by the operator via an AgentRuntime CR.
+// of sidecar injection via the rossoctl.io/inject=disabled pod template label.
+// The rossoctl.io/type label is applied by the operator via an AgentRuntime CR.
 func authBridgeDisabledAgentFixture() string {
 	return `apiVersion: apps/v1
 kind: Deployment
@@ -1098,7 +1098,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: authbridge-disabled-agent
-        kagenti.io/inject: disabled
+        rossoctl.io/inject: disabled
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -1119,7 +1119,7 @@ spec:
 // authBridgeDisabledAgentRuntimeFixture returns YAML for an AgentRuntime CR
 // targeting the disabled agent.
 func authBridgeDisabledAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: authbridge-disabled-agent
@@ -1144,10 +1144,10 @@ spec:
   spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
   podSelector:
     matchLabels:
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
   namespaceSelector:
     matchLabels:
-      kagenti-enabled: "true"
+      rossoctl-enabled: "true"
 `
 }
 
@@ -1171,7 +1171,7 @@ metadata:
   name: combined-agent
   namespace: ` + combinedTestNamespace + `
   labels:
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
     app.kubernetes.io/name: combined-agent
 spec:
   replicas: 1
@@ -1182,7 +1182,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: combined-agent
-        protocol.kagenti.io/a2a: ""
+        protocol.rossoctl.io/a2a: ""
     spec:
       serviceAccountName: combined-agent
       securityContext:
@@ -1247,7 +1247,7 @@ spec:
 // combinedAgentRuntimeFixture returns YAML for an AgentRuntime CR targeting
 // the combined-agent Deployment.
 func combinedAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: combined-agent
@@ -1292,7 +1292,7 @@ data:
     svid_file_name = "svid.pem"
     svid_key_file_name = "svid_key.pem"
     svid_bundle_file_name = "svid_bundle.pem"
-    jwt_svids = [{jwt_audience="kagenti", jwt_svid_file_name="jwt_svid.token"}]
+    jwt_svids = [{jwt_audience="rossoctl", jwt_svid_file_name="jwt_svid.token"}]
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -1326,7 +1326,7 @@ data:
 const skillDiscoveryTestNamespace = "e2e-skill-discovery-test"
 
 // skillDiscoveryDeploymentFixture returns YAML for a Deployment with the
-// kagenti.io/skills annotation set by the user (or kagenti backend).
+// rossoctl.io/skills annotation set by the user (or rossoctl backend).
 func skillDiscoveryDeploymentFixture() string {
 	return `apiVersion: apps/v1
 kind: Deployment
@@ -1336,7 +1336,7 @@ metadata:
   labels:
     app.kubernetes.io/name: skill-discovery-agent
   annotations:
-    kagenti.io/skills: '["summarizer","openshift-review"]'
+    rossoctl.io/skills: '["summarizer","openshift-review"]'
 spec:
   replicas: 1
   selector:
@@ -1346,7 +1346,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: skill-discovery-agent
-        kagenti.io/inject: disabled
+        rossoctl.io/inject: disabled
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -1368,7 +1368,7 @@ spec:
 // targeting the skill-discovery-agent Deployment. No spec.skills — the
 // operator discovers skills from the Deployment's annotation.
 func skillDiscoveryAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: skill-discovery-agent
@@ -1383,7 +1383,7 @@ spec:
 }
 
 // ociSkillDeploymentFixture returns YAML for a Deployment with two OCI
-// ImageVolume skills and the kagenti.io/skills annotation listing both.
+// ImageVolume skills and the rossoctl.io/skills annotation listing both.
 func ociSkillDeploymentFixture() string {
 	return `apiVersion: apps/v1
 kind: Deployment
@@ -1393,7 +1393,7 @@ metadata:
   labels:
     app.kubernetes.io/name: oci-skill-agent
   annotations:
-    kagenti.io/skills: '["summarizer","openshift-review"]'
+    rossoctl.io/skills: '["summarizer","openshift-review"]'
 spec:
   replicas: 1
   selector:
@@ -1403,7 +1403,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: oci-skill-agent
-        kagenti.io/inject: disabled
+        rossoctl.io/inject: disabled
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -1446,7 +1446,7 @@ metadata:
   labels:
     app.kubernetes.io/name: oci-skill-agent
   annotations:
-    kagenti.io/skills: '["summarizer"]'
+    rossoctl.io/skills: '["summarizer"]'
 spec:
   replicas: 1
   selector:
@@ -1456,7 +1456,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: oci-skill-agent
-        kagenti.io/inject: disabled
+        rossoctl.io/inject: disabled
     spec:
       securityContext:
         runAsNonRoot: true` + runAsUserYAML("1000") + `
@@ -1485,7 +1485,7 @@ spec:
 // ociSkillAgentRuntimeFixture returns YAML for an AgentRuntime CR
 // targeting the oci-skill-agent Deployment.
 func ociSkillAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: oci-skill-agent
@@ -1510,10 +1510,10 @@ spec:
   spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
   podSelector:
     matchLabels:
-      kagenti.io/type: agent
+      rossoctl.io/type: agent
   namespaceSelector:
     matchLabels:
-      kagenti-enabled: "true"
+      rossoctl-enabled: "true"
 `
 }
 
@@ -1530,7 +1530,7 @@ metadata:
   namespace: ` + istioMeshTestNamespace + `
   labels:
     app.kubernetes.io/name: istio-mesh-agent
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -1558,7 +1558,7 @@ spec:
 }
 
 func istioMeshAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: istio-mesh-test-runtime
@@ -1580,7 +1580,7 @@ metadata:
   namespace: ` + istioMeshOptOutTestNamespace + `
   labels:
     app.kubernetes.io/name: istio-mesh-optout-agent
-    protocol.kagenti.io/a2a: ""
+    protocol.rossoctl.io/a2a: ""
 spec:
   replicas: 1
   selector:
@@ -1608,7 +1608,7 @@ spec:
 }
 
 func istioMeshOptOutAgentRuntimeFixture() string {
-	return `apiVersion: agent.kagenti.dev/v1alpha1
+	return `apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 metadata:
   name: istio-mesh-optout-runtime
diff --git a/kagenti-operator/test/e2e/sharedtrust_test.go b/operator/test/e2e/sharedtrust_test.go
similarity index 99%
rename from kagenti-operator/test/e2e/sharedtrust_test.go
rename to operator/test/e2e/sharedtrust_test.go
index 47b6bafd..72668b72 100644
--- a/kagenti-operator/test/e2e/sharedtrust_test.go
+++ b/operator/test/e2e/sharedtrust_test.go
@@ -25,7 +25,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	"github.com/kagenti/operator/test/utils"
+	"github.com/rossoctl/operator/test/utils"
 )
 
 var _ = Describe("SharedTrust E2E", Ordered, func() {
diff --git a/kagenti-operator/test/e2e/spire_operand_test.go b/operator/test/e2e/spire_operand_test.go
similarity index 96%
rename from kagenti-operator/test/e2e/spire_operand_test.go
rename to operator/test/e2e/spire_operand_test.go
index 67358f68..d7a47a08 100644
--- a/kagenti-operator/test/e2e/spire_operand_test.go
+++ b/operator/test/e2e/spire_operand_test.go
@@ -25,7 +25,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	"github.com/kagenti/operator/test/utils"
+	"github.com/rossoctl/operator/test/utils"
 )
 
 // SPIRE operand CRD kinds and their plural resource names.
@@ -48,7 +48,7 @@ var spireOperandResources = []struct {
 }
 
 var _ = Describe("SPIRE Operand Controller E2E", Ordered, func() {
-	const controllerNamespace = "kagenti-operator-system"
+	const controllerNamespace = "rossoctl-operator-system"
 
 	BeforeAll(func() {
 		By("installing mock ZTWIM CRDs into Kind cluster")
@@ -72,9 +72,9 @@ var _ = Describe("SPIRE Operand Controller E2E", Ordered, func() {
 
 		By("setting SPIRE trust domain for SPIRE operand controller (no ZTWIM CR to discover from in Kind)")
 		setEnvCmd := exec.Command("kubectl", "set", "env",
-			"deployment/kagenti-operator-controller-manager",
+			"deployment/rossoctl-operator-controller-manager",
 			"-n", controllerNamespace,
-			"KAGENTI_SPIRE_TRUST_DOMAIN=example.org")
+			"ROSSOCTL_SPIRE_TRUST_DOMAIN=example.org")
 		_, err = utils.Run(setEnvCmd)
 		Expect(err).NotTo(HaveOccurred())
 
@@ -140,7 +140,7 @@ var _ = Describe("SPIRE Operand Controller E2E", Ordered, func() {
 		}
 	})
 
-	It("should label all CRs with managed-by kagenti-operator", func() {
+	It("should label all CRs with managed-by rossoctl-operator", func() {
 		for _, res := range spireOperandResources {
 			Eventually(func(g Gomega) {
 				output, err := utils.KubectlGetJsonpath(
@@ -148,7 +148,7 @@ var _ = Describe("SPIRE Operand Controller E2E", Ordered, func() {
 					"cluster", "",
 					"{.metadata.labels.app\\.kubernetes\\.io/managed-by}")
 				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(strings.TrimSpace(output)).To(Equal("kagenti-operator"))
+				g.Expect(strings.TrimSpace(output)).To(Equal("rossoctl-operator"))
 			}).Should(Succeed(), fmt.Sprintf("%s missing managed-by label", res.kind))
 		}
 	})
@@ -232,7 +232,7 @@ var _ = Describe("SPIRE Operand Controller E2E", Ordered, func() {
 				"cluster", "",
 				"{.metadata.labels.app\\.kubernetes\\.io/managed-by}")
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(strings.TrimSpace(output)).To(Equal("kagenti-operator"))
+			g.Expect(strings.TrimSpace(output)).To(Equal("rossoctl-operator"))
 		}).Should(Succeed())
 	})
 
diff --git a/kagenti-operator/test/integration/README.md b/operator/test/integration/README.md
similarity index 80%
rename from kagenti-operator/test/integration/README.md
rename to operator/test/integration/README.md
index d32b0ef3..be905e79 100644
--- a/kagenti-operator/test/integration/README.md
+++ b/operator/test/integration/README.md
@@ -1,18 +1,18 @@
 # Integration Tests
 
-Integration tests for the kagenti-operator that run against a live Kubernetes cluster. They exercise the reconciler's binding evaluation and trust bundle rotation logic using real CRDs and API server interactions, with mocked fetcher and signature providers.
+Integration tests for the rossoctl-operator that run against a live Kubernetes cluster. They exercise the reconciler's binding evaluation and trust bundle rotation logic using real CRDs and API server interactions, with mocked fetcher and signature providers.
 
 ## Prerequisites
 
 - [Kind](https://kind.sigs.k8s.io/) installed
 - `kubectl` configured (Kind sets this up automatically)
-- A running Kind cluster with kagenti CRDs installed (`make install` handles CRD installation)
-- The kagenti operator must **not** be running in the cluster — these tests call `Reconcile` manually, and a running operator would cause concurrent reconciliations that interfere with assertions
+- A running Kind cluster with rossoctl CRDs installed (`make install` handles CRD installation)
+- The rossoctl operator must **not** be running in the cluster — these tests call `Reconcile` manually, and a running operator would cause concurrent reconciliations that interfere with assertions
 
 ## Running
 
 ```sh
-# From the kagenti-operator directory:
+# From the rossoctl-operator directory:
 make test-integration
 ```
 
diff --git a/kagenti-operator/test/integration/authbridge_auth_flow_integration_test.go b/operator/test/integration/authbridge_auth_flow_integration_test.go
similarity index 97%
rename from kagenti-operator/test/integration/authbridge_auth_flow_integration_test.go
rename to operator/test/integration/authbridge_auth_flow_integration_test.go
index a11f8ba8..58e550c6 100644
--- a/kagenti-operator/test/integration/authbridge_auth_flow_integration_test.go
+++ b/operator/test/integration/authbridge_auth_flow_integration_test.go
@@ -11,13 +11,13 @@ deployment: token acquisition via client_credentials, Envoy policy enforcement
 (valid token → 200, no token → 401/403), and token refresh on expiry.
 
 Prerequisites:
-  - kubectl configured with access to a Kubernetes cluster with kagenti CRDs installed
+  - kubectl configured with access to a Kubernetes cluster with rossoctl CRDs installed
   - A Keycloak instance accessible from the test runner
   - Environment variables set:
     KEYCLOAK_URL            — base URL (e.g. https://keycloak.apps.example.com)
     KEYCLOAK_ADMIN_USER     — admin username
     KEYCLOAK_ADMIN_PASSWORD — admin password
-    KEYCLOAK_REALM          — realm name (default: kagenti)
+    KEYCLOAK_REALM          — realm name (default: rossoctl)
     ENVOY_PROXY_URL         — (optional) URL of an Auth Bridge Envoy proxy to test policy enforcement
     KEYCLOAK_CA_CERT        — (optional) path to PEM CA bundle for custom Keycloak TLS
 
@@ -39,7 +39,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/kagenti/operator/internal/keycloak"
+	"github.com/rossoctl/operator/internal/keycloak"
 )
 
 // httpClient returns an *http.Client that trusts the CA bundle at KEYCLOAK_CA_CERT
@@ -75,7 +75,7 @@ func keycloakEnvOrSkip(t *testing.T) (baseURL, adminUser, adminPass, realm strin
 	adminPass = os.Getenv("KEYCLOAK_ADMIN_PASSWORD")
 	realm = os.Getenv("KEYCLOAK_REALM")
 	if realm == "" {
-		realm = "kagenti"
+		realm = "rossoctl"
 	}
 	if baseURL == "" || adminUser == "" || adminPass == "" {
 		t.Skip("requires real Keycloak deployment — set KEYCLOAK_URL, " +
@@ -149,7 +149,7 @@ func TestAuthBridge_RealEnvoy_PolicyEnforcement(t *testing.T) {
 	workloadClientSecret := os.Getenv("WORKLOAD_CLIENT_SECRET")
 	if workloadClientID == "" || workloadClientSecret == "" {
 		t.Skip("requires WORKLOAD_CLIENT_ID and WORKLOAD_CLIENT_SECRET — " +
-			"read from the kagenti-keycloak-client-credentials-* Secret in the test namespace")
+			"read from the rossoctl-keycloak-client-credentials-* Secret in the test namespace")
 	}
 
 	// Obtain a valid token using the workload's own credentials
diff --git a/kagenti-operator/test/integration/identity_binding_integration_test.go b/operator/test/integration/identity_binding_integration_test.go
similarity index 97%
rename from kagenti-operator/test/integration/identity_binding_integration_test.go
rename to operator/test/integration/identity_binding_integration_test.go
index f239bee5..5473c1c8 100644
--- a/kagenti-operator/test/integration/identity_binding_integration_test.go
+++ b/operator/test/integration/identity_binding_integration_test.go
@@ -7,7 +7,7 @@ Copyright 2025.
 Integration test for AgentCard Identity Binding (Step 1)
 
 Run with: go test -v -tags=integration ./test/integration/... -timeout 5m
-Prerequisites: kubectl configured with access to a Kubernetes cluster with kagenti CRDs installed
+Prerequisites: kubectl configured with access to a Kubernetes cluster with rossoctl CRDs installed
 */
 
 package integration
@@ -19,10 +19,10 @@ import (
 	"testing"
 	"time"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/controller"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/controller"
+	"github.com/rossoctl/operator/internal/signature"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -355,8 +355,8 @@ func createTestDeployment(t *testing.T, ctx context.Context, ns, name, saName st
 	t.Helper()
 	labels := map[string]string{
 		"app.kubernetes.io/name":  name,
-		"kagenti.io/type":         "agent",
-		"protocol.kagenti.io/a2a": "",
+		"rossoctl.io/type":         "agent",
+		"protocol.rossoctl.io/a2a": "",
 	}
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/kagenti-operator/test/integration/sigstore_verification_integration_test.go b/operator/test/integration/sigstore_verification_integration_test.go
similarity index 98%
rename from kagenti-operator/test/integration/sigstore_verification_integration_test.go
rename to operator/test/integration/sigstore_verification_integration_test.go
index e9e20e34..edabfed4 100644
--- a/kagenti-operator/test/integration/sigstore_verification_integration_test.go
+++ b/operator/test/integration/sigstore_verification_integration_test.go
@@ -7,7 +7,7 @@ Copyright 2026.
 Integration test for Sigstore SignedAgentCard Bundle Verification
 
 Run with: go test -v -tags=integration ./test/integration/... -timeout 5m -run TestSigstoreVerification
-Prerequisites: kubectl configured with access to a Kubernetes cluster with kagenti CRDs installed
+Prerequisites: kubectl configured with access to a Kubernetes cluster with rossoctl CRDs installed
 */
 
 package integration
@@ -18,10 +18,10 @@ import (
 	"testing"
 	"time"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/agentcard"
-	"github.com/kagenti/operator/internal/controller"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/agentcard"
+	"github.com/rossoctl/operator/internal/controller"
+	"github.com/rossoctl/operator/internal/signature"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -35,9 +35,9 @@ import (
 const (
 	sigstoreTestNamespace = "sigstore-test"
 	testOIDCIssuer        = "https://token.actions.githubusercontent.com"
-	testIdentity          = "https://github.com/kagenti/operator/.github/workflows/sign-agent-card.yml@refs/heads/main"
+	testIdentity          = "https://github.com/rossoctl/operator/.github/workflows/sign-agent-card.yml@refs/heads/main"
 	testRekorIndex        = "123456789"
-	testSLSARepo          = "https://github.com/kagenti/operator"
+	testSLSARepo          = "https://github.com/rossoctl/operator"
 	testSLSACommit        = "abc123def456"
 )
 
@@ -715,8 +715,8 @@ func createSigstoreTestDeployment(t *testing.T, ctx context.Context, namespace,
 	t.Helper()
 	labels := map[string]string{
 		"app.kubernetes.io/name":  name,
-		"kagenti.io/type":         "agent",
-		"protocol.kagenti.io/a2a": "",
+		"rossoctl.io/type":         "agent",
+		"protocol.rossoctl.io/a2a": "",
 	}
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/kagenti-operator/test/integration/trust_bundle_rotation_integration_test.go b/operator/test/integration/trust_bundle_rotation_integration_test.go
similarity index 97%
rename from kagenti-operator/test/integration/trust_bundle_rotation_integration_test.go
rename to operator/test/integration/trust_bundle_rotation_integration_test.go
index 5e804e74..d9ebddac 100644
--- a/kagenti-operator/test/integration/trust_bundle_rotation_integration_test.go
+++ b/operator/test/integration/trust_bundle_rotation_integration_test.go
@@ -10,7 +10,7 @@ Verifies that when the trust bundle hash changes (simulating CA rotation),
 the operator detects the mismatch and triggers a workload rollout restart.
 
 Run with: go test -v -tags=integration ./test/integration/... -timeout 5m -run TestTrustBundleRotation
-Prerequisites: kubectl configured with access to a Kubernetes cluster with kagenti CRDs installed.
+Prerequisites: kubectl configured with access to a Kubernetes cluster with rossoctl CRDs installed.
                The operator should NOT be running (scale to 0 or uninstall) — this test calls Reconcile manually.
 */
 
@@ -22,9 +22,9 @@ import (
 	"testing"
 	"time"
 
-	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
-	"github.com/kagenti/operator/internal/controller"
-	"github.com/kagenti/operator/internal/signature"
+	agentv1alpha1 "github.com/rossoctl/operator/api/v1alpha1"
+	"github.com/rossoctl/operator/internal/controller"
+	"github.com/rossoctl/operator/internal/signature"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
diff --git a/kagenti-operator/test/utils/utils.go b/operator/test/utils/utils.go
similarity index 98%
rename from kagenti-operator/test/utils/utils.go
rename to operator/test/utils/utils.go
index 38648306..816c2bff 100644
--- a/kagenti-operator/test/utils/utils.go
+++ b/operator/test/utils/utils.go
@@ -640,7 +640,7 @@ func EnableSkillDiscovery(namespace, deploy string) error {
 	cmd.Stdin = strings.NewReader(`apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kagenti-feature-gates
+  name: rossoctl-feature-gates
 data:
   feature-gates.yaml: |
     globalEnabled: true
@@ -656,8 +656,8 @@ data:
 	By("patching controller to mount feature-gates ConfigMap")
 	patch := `{"spec":{"template":{"spec":{` +
 		`"containers":[{"name":"manager",` +
-		`"volumeMounts":[{"name":"feature-gates","mountPath":"/etc/kagenti/feature-gates","readOnly":true}]}],` +
-		`"volumes":[{"name":"feature-gates","configMap":{"name":"kagenti-feature-gates"}}]}}}}`
+		`"volumeMounts":[{"name":"feature-gates","mountPath":"/etc/rossoctl/feature-gates","readOnly":true}]}],` +
+		`"volumes":[{"name":"feature-gates","configMap":{"name":"rossoctl-feature-gates"}}]}}}}`
 	cmd = exec.Command("kubectl", "patch", "deployment", deploy,
 		"-n", namespace,
 		"--type=strategic",
@@ -679,7 +679,7 @@ func DisableSkillDiscovery(namespace string) error {
 	cmd.Stdin = strings.NewReader(`apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: kagenti-feature-gates
+  name: rossoctl-feature-gates
 data:
   feature-gates.yaml: |
     globalEnabled: true
diff --git a/kagenti-operator/token-broker b/operator/token-broker
similarity index 100%
rename from kagenti-operator/token-broker
rename to operator/token-broker
diff --git a/scripts/dev-build-podman.sh b/scripts/dev-build-podman.sh
index 3e591e51..5de9a91d 100755
--- a/scripts/dev-build-podman.sh
+++ b/scripts/dev-build-podman.sh
@@ -2,17 +2,17 @@
 
 set -euo pipefail
 
-CLUSTER_NAME=${CLUSTER_NAME:-kagenti}
-NAMESPACE=${NAMESPACE:-kagenti-system}
+CLUSTER_NAME=${CLUSTER_NAME:-rossoctl}
+NAMESPACE=${NAMESPACE:-rossoctl-system}
 
-cd "$(dirname "$0")/../kagenti-operator"
+cd "$(dirname "$0")/../operator"
 
 TAG=$(date +%Y%m%d%H%M%S)
-echo "Building kagenti-operator:${TAG}..."
-podman build . --tag "kagenti-operator:${TAG}"
+echo "Building rossoctl-operator:${TAG}..."
+podman build . --tag "rossoctl-operator:${TAG}"
 
 echo "Loading image into kind cluster ${CLUSTER_NAME}..."
-kind load --name "${CLUSTER_NAME}" docker-image "localhost/kagenti-operator:${TAG}"
+kind load --name "${CLUSTER_NAME}" docker-image "localhost/operator:${TAG}"
 
 if ! kubectl get namespace "${NAMESPACE}" &>/dev/null; then
   echo "Creating namespace ${NAMESPACE}..."
@@ -20,10 +20,10 @@ if ! kubectl get namespace "${NAMESPACE}" &>/dev/null; then
 fi
 
 echo "Updating deployment in namespace ${NAMESPACE}..."
-kubectl -n "${NAMESPACE}" set image deployment/kagenti-controller-manager manager="localhost/kagenti-operator:${TAG}"
+kubectl -n "${NAMESPACE}" set image deployment/rossoctl-controller-manager manager="localhost/operator:${TAG}"
 
 echo "Waiting for rollout..."
-kubectl rollout status -n "${NAMESPACE}" deployment/kagenti-controller-manager
+kubectl rollout status -n "${NAMESPACE}" deployment/rossoctl-controller-manager
 
 echo "Current pods:"
 kubectl get pods -n "${NAMESPACE}" -l control-plane=controller-manager
diff --git a/scripts/dev-build.sh b/scripts/dev-build.sh
index 849c4cfe..5c7985c2 100755
--- a/scripts/dev-build.sh
+++ b/scripts/dev-build.sh
@@ -2,17 +2,17 @@
 
 set -e
 
-CLUSTER_NAME=${CLUSTER_NAME:-kagenti}
-NAMESPACE=${NAMESPACE:-kagenti-system}
+CLUSTER_NAME=${CLUSTER_NAME:-rossoctl}
+NAMESPACE=${NAMESPACE:-rossoctl-system}
 
-cd "$(dirname "$0")/../kagenti-operator"
+cd "$(dirname "$0")/../operator"
 
 TAG=$(date +%Y%m%d%H%M%S)
-echo "Building kagenti-operator:${TAG}..."
-docker build . --tag local/kagenti-operator:${TAG} --load
+echo "Building rossoctl-operator:${TAG}..."
+docker build . --tag local/operator:${TAG} --load
 
 echo "Loading image into kind cluster ${CLUSTER_NAME}..."
-kind load --name "${CLUSTER_NAME}" docker-image local/kagenti-operator:${TAG}
+kind load --name "${CLUSTER_NAME}" docker-image local/operator:${TAG}
 
 if ! kubectl get namespace "${NAMESPACE}" &>/dev/null; then
   echo "Creating namespace ${NAMESPACE}..."
@@ -20,10 +20,10 @@ if ! kubectl get namespace "${NAMESPACE}" &>/dev/null; then
 fi
 
 echo "Updating deployment in namespace ${NAMESPACE}..."
-kubectl -n "${NAMESPACE}" set image deployment/kagenti-controller-manager manager=local/kagenti-operator:${TAG}
+kubectl -n "${NAMESPACE}" set image deployment/rossoctl-controller-manager manager=local/operator:${TAG}
 
 echo "Waiting for rollout..."
-kubectl rollout status -n "${NAMESPACE}" deployment/kagenti-controller-manager
+kubectl rollout status -n "${NAMESPACE}" deployment/rossoctl-controller-manager
 
 echo "Current pods:"
 kubectl get pods -n "${NAMESPACE}" -l control-plane=controller-manager
diff --git a/specs/001-agentcard-into-status/contracts/agentruntime-status-card.md b/specs/001-agentcard-into-status/contracts/agentruntime-status-card.md
index 0e8e787e..3ab83c81 100644
--- a/specs/001-agentcard-into-status/contracts/agentruntime-status-card.md
+++ b/specs/001-agentcard-into-status/contracts/agentruntime-status-card.md
@@ -7,7 +7,7 @@ The `status.card` field on the AgentRuntime CRD exposes discovered A2A agent car
 ## CRD Status Extension
 
 ```yaml
-apiVersion: agent.kagenti.dev/v1alpha1
+apiVersion: agent.rossoctl.dev/v1alpha1
 kind: AgentRuntime
 status:
   phase: Active
diff --git a/specs/001-agentcard-into-status/data-model.md b/specs/001-agentcard-into-status/data-model.md
index 9440f8ad..2b5be52b 100644
--- a/specs/001-agentcard-into-status/data-model.md
+++ b/specs/001-agentcard-into-status/data-model.md
@@ -31,7 +31,7 @@ Added to `AgentRuntimeStatus` as an optional field.
 | `signatureVerificationDetails` | string | Verification details/error message | New field |
 | `attestedAgentSpiffeID` | string | SPIFFE ID from mTLS peer certificate | New field |
 
-**Note**: Change-detection hash (`lastPodTemplateHash`) is stored as an annotation (`agent.kagenti.dev/last-card-fetch-hash`) on the AgentRuntime, not in the CRD status. This keeps the implementation mechanism out of the public API surface.
+**Note**: Change-detection hash (`lastPodTemplateHash`) is stored as an annotation (`agent.rossoctl.dev/last-card-fetch-hash`) on the AgentRuntime, not in the CRD status. This keeps the implementation mechanism out of the public API surface.
 
 ### Modified: AgentRuntimeStatus
 
diff --git a/specs/001-agentcard-into-status/plan.md b/specs/001-agentcard-into-status/plan.md
index b41a316b..b8976b24 100644
--- a/specs/001-agentcard-into-status/plan.md
+++ b/specs/001-agentcard-into-status/plan.md
@@ -43,7 +43,7 @@ specs/001-agentcard-into-status/
 ### Source Code (repository root)
 
 ```text
-kagenti-operator/
+operator/
 ├── api/v1alpha1/
 │   ├── agentruntime_types.go       # MODIFY: add CardStatus to AgentRuntimeStatus
 │   ├── agentcard_types.go          # READ-ONLY: reuse AgentCardData struct
diff --git a/specs/001-agentcard-into-status/research.md b/specs/001-agentcard-into-status/research.md
index cfde7133..f6cb882d 100644
--- a/specs/001-agentcard-into-status/research.md
+++ b/specs/001-agentcard-into-status/research.md
@@ -15,7 +15,7 @@
 
 ## R2: Card Fetch Trigger Mechanism
 
-**Decision**: Pod template hash change detection. The AgentRuntime controller already watches workloads and reconciles on changes. The card fetch phase checks whether the workload's pod-template-hash (or generation for StatefulSets/Sandboxes) has changed since the last successful fetch by comparing against a hash stored in an annotation (`agent.kagenti.dev/last-card-fetch-hash`), not in the CRD status API surface.
+**Decision**: Pod template hash change detection. The AgentRuntime controller already watches workloads and reconciles on changes. The card fetch phase checks whether the workload's pod-template-hash (or generation for StatefulSets/Sandboxes) has changed since the last successful fetch by comparing against a hash stored in an annotation (`agent.rossoctl.dev/last-card-fetch-hash`), not in the CRD status API surface.
 
 **Rationale**: Avoids unnecessary HTTP calls on every reconcile. Pod template hash changes correlate with actual code/config changes that could affect the agent card. The AgentRuntime controller already reconciles on Deployment changes, so no new watches needed.
 
@@ -61,7 +61,7 @@
 - Fetch metadata: `fetchedAt` (timestamp), `cardId` (SHA-256 content hash), `protocol` (detected agent protocol)
 - Verification: `validSignature` (bool), `signatureKeyID`, `attestedAgentSpiffeID`, `signatureVerificationDetails`
 
-**Note (from review feedback)**: `lastPodTemplateHash` was originally in this struct but moved to an annotation (`agent.kagenti.dev/last-card-fetch-hash`) to avoid coupling the change-detection mechanism to the public API surface.
+**Note (from review feedback)**: `lastPodTemplateHash` was originally in this struct but moved to an annotation (`agent.rossoctl.dev/last-card-fetch-hash`) to avoid coupling the change-detection mechanism to the public API surface.
 
 ## R6: Deprecation Warning Implementation
 
diff --git a/specs/001-agentcard-into-status/review-findings.md b/specs/001-agentcard-into-status/review-findings.md
index ef24b0e4..54a88efe 100644
--- a/specs/001-agentcard-into-status/review-findings.md
+++ b/specs/001-agentcard-into-status/review-findings.md
@@ -23,7 +23,7 @@
 ### FINDING-1
 - **Severity:** Critical
 - **Confidence:** 95
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:635-707
+- **File:** operator/internal/controller/agentruntime_controller.go:635-707
 - **Category:** correctness / production-readiness
 - **Source:** correctness-agent (also reported by: architecture-agent, prod-readiness-agent)
 - **Round found:** 1
@@ -41,7 +41,7 @@ Added `persistCardFetchAnnotation()` using `client.MergeFrom` patch to write the
 ### FINDING-2
 - **Severity:** Critical
 - **Confidence:** 95
-- **File:** kagenti-operator/internal/controller/agentcard_controller_test.go:1726-1818
+- **File:** operator/internal/controller/agentcard_controller_test.go:1726-1818
 - **Category:** test-quality
 - **Source:** test-quality-agent (also reported by: coderabbit)
 - **Round found:** 1
@@ -59,7 +59,7 @@ Added `record.NewFakeRecorder(10)` to the test reconciler and assertion that a "
 ### FINDING-3
 - **Severity:** Critical
 - **Confidence:** 90
-- **File:** kagenti-operator/internal/controller/agentruntime_controller_test.go (missing)
+- **File:** operator/internal/controller/agentruntime_controller_test.go (missing)
 - **Category:** test-quality
 - **Source:** test-quality-agent
 - **Round found:** 1
@@ -77,7 +77,7 @@ Added "Card data retention on fetch failure (FR-013)" test that verifies existin
 ### FINDING-4
 - **Severity:** Important
 - **Confidence:** 80
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:748-761
+- **File:** operator/internal/controller/agentruntime_controller.go:748-761
 - **Category:** correctness
 - **Source:** correctness-agent
 - **Round found:** 1
@@ -95,7 +95,7 @@ The spec says "Pod template hash changes (or generation for StatefulSets/Sandbox
 ### FINDING-5
 - **Severity:** Important
 - **Confidence:** 92
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:501-520
+- **File:** operator/internal/controller/agentruntime_controller.go:501-520
 - **Category:** architecture
 - **Source:** architecture-agent
 - **Round found:** 1
@@ -110,7 +110,7 @@ The functions are small and self-contained. Extracting to a shared utility is a
 ### FINDING-6
 - **Severity:** Important
 - **Confidence:** 90
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:763-773
+- **File:** operator/internal/controller/agentruntime_controller.go:763-773
 - **Category:** architecture
 - **Source:** architecture-agent
 - **Round found:** 1
@@ -125,7 +125,7 @@ Same as FINDING-5. The duplication will be resolved when AgentCard is fully depr
 ### FINDING-7
 - **Severity:** Important
 - **Confidence:** 85
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:666
+- **File:** operator/internal/controller/agentruntime_controller.go:666
 - **Category:** architecture
 - **Source:** architecture-agent
 - **Round found:** 1
@@ -140,7 +140,7 @@ This feature is specifically about A2A card discovery. The spec only mentions A2
 ### FINDING-8
 - **Severity:** Important
 - **Confidence:** 90
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:200, 668-671
+- **File:** operator/internal/controller/agentruntime_controller.go:200, 668-671
 - **Category:** production-readiness
 - **Source:** prod-readiness-agent
 - **Round found:** 1
@@ -155,7 +155,7 @@ The reconcile loop already re-triggers on any workload change. Card discovery is
 ### FINDING-9
 - **Severity:** Important
 - **Confidence:** 90
-- **File:** kagenti-operator/internal/controller/agentruntime_controller_test.go (missing)
+- **File:** operator/internal/controller/agentruntime_controller_test.go (missing)
 - **Category:** test-quality
 - **Source:** test-quality-agent (also reported by: coderabbit)
 - **Round found:** 1
@@ -170,7 +170,7 @@ The test requires setting up a `mockFetcher` implementation and injecting it int
 ### FINDING-10
 - **Severity:** Important
 - **Confidence:** 50
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:711-745
+- **File:** operator/internal/controller/agentruntime_controller.go:711-745
 - **Category:** security
 - **Source:** security-agent
 - **Round found:** 1
diff --git a/specs/001-agentcard-into-status/tasks.md b/specs/001-agentcard-into-status/tasks.md
index 4b1bc952..376c8fb9 100644
--- a/specs/001-agentcard-into-status/tasks.md
+++ b/specs/001-agentcard-into-status/tasks.md
@@ -17,9 +17,9 @@
 
 **Purpose**: CRD type changes and code generation that all stories depend on
 
-- [X] T001 Add `CardStatus` struct to `AgentRuntimeStatus` in `kagenti-operator/api/v1alpha1/agentruntime_types.go`. The `CardStatus` struct embeds `AgentCardData` (reuse existing struct) and adds: `FetchedAt *metav1.Time`, `CardId string`, `Protocol string`, `ValidSignature *bool`, `SignatureKeyID string`, `SignatureVerificationDetails string`, `AttestedAgentSpiffeID string`. The change-detection hash is stored as an annotation (`agent.kagenti.dev/last-card-fetch-hash`), not in the struct. Add the `Card *CardStatus` field to `AgentRuntimeStatus`. Add `CardSynced` as a new condition type constant.
-- [X] T002 Run `make generate` and `make manifests` in `kagenti-operator/` to regenerate deepcopy functions and CRD manifests. Verify `zz_generated.deepcopy.go` has the new `CardStatus` deepcopy method and `config/crd/bases/` has the updated AgentRuntime CRD.
-- [X] T003 Add `--enable-card-discovery` boolean flag (default: false) to `kagenti-operator/cmd/main.go`. When enabled, create `agentcard.NewConfigMapFetcher()` and `agentcard.NewSpiffeFetcher()` (conditional on SPIRE config), and inject them into the `AgentRuntimeReconciler` as new fields: `AgentFetcher agentcard.Fetcher`, `AuthenticatedFetcher agentcard.AuthenticatedFetcher`, `SignatureProvider signature.Provider`, `EnableCardDiscovery bool`, `SpireTrustDomain string`. Follow the existing pattern of `--enable-verified-fetch` flag wiring for the AgentCard controller.
+- [X] T001 Add `CardStatus` struct to `AgentRuntimeStatus` in `operator/api/v1alpha1/agentruntime_types.go`. The `CardStatus` struct embeds `AgentCardData` (reuse existing struct) and adds: `FetchedAt *metav1.Time`, `CardId string`, `Protocol string`, `ValidSignature *bool`, `SignatureKeyID string`, `SignatureVerificationDetails string`, `AttestedAgentSpiffeID string`. The change-detection hash is stored as an annotation (`agent.rossoctl.dev/last-card-fetch-hash`), not in the struct. Add the `Card *CardStatus` field to `AgentRuntimeStatus`. Add `CardSynced` as a new condition type constant.
+- [X] T002 Run `make generate` and `make manifests` in `operator/` to regenerate deepcopy functions and CRD manifests. Verify `zz_generated.deepcopy.go` has the new `CardStatus` deepcopy method and `config/crd/bases/` has the updated AgentRuntime CRD.
+- [X] T003 Add `--enable-card-discovery` boolean flag (default: false) to `operator/cmd/main.go`. When enabled, create `agentcard.NewConfigMapFetcher()` and `agentcard.NewSpiffeFetcher()` (conditional on SPIRE config), and inject them into the `AgentRuntimeReconciler` as new fields: `AgentFetcher agentcard.Fetcher`, `AuthenticatedFetcher agentcard.AuthenticatedFetcher`, `SignatureProvider signature.Provider`, `EnableCardDiscovery bool`, `SpireTrustDomain string`. Follow the existing pattern of `--enable-verified-fetch` flag wiring for the AgentCard controller.
 
 **Checkpoint**: CRD types updated, code generated, flag wired. Ready for controller changes.
 
@@ -31,8 +31,8 @@
 
 **CRITICAL**: No user story work can begin until this phase is complete
 
-- [X] T004 Add a `resolveServiceForWorkload` method to `AgentRuntimeReconciler` in `kagenti-operator/internal/controller/agentruntime_controller.go`. Given a namespace and Deployment name, first try to get a Service with the same name (matching existing AgentCard convention). If not found, list Services in the namespace, match by Pod selector labels from the Deployment, and return the first match. Return the Service object and the selected port (first HTTP port, or default 8000). Also add `getAgentTLSPort` (reuse logic from `agentcard_controller.go` line 684).
-- [X] T005 [P] Add Service `get;list;watch` RBAC for the agentruntime controller in `kagenti-operator/internal/controller/agentruntime_controller.go` via kubebuilder RBAC markers: `// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch`. Run `make manifests` to update `config/rbac/`.
+- [X] T004 Add a `resolveServiceForWorkload` method to `AgentRuntimeReconciler` in `operator/internal/controller/agentruntime_controller.go`. Given a namespace and Deployment name, first try to get a Service with the same name (matching existing AgentCard convention). If not found, list Services in the namespace, match by Pod selector labels from the Deployment, and return the first match. Return the Service object and the selected port (first HTTP port, or default 8000). Also add `getAgentTLSPort` (reuse logic from `agentcard_controller.go` line 684).
+- [X] T005 [P] Add Service `get;list;watch` RBAC for the agentruntime controller in `operator/internal/controller/agentruntime_controller.go` via kubebuilder RBAC markers: `// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch`. Run `make manifests` to update `config/rbac/`.
 
 **Checkpoint**: Service resolution and RBAC ready. User story implementation can begin.
 
@@ -46,14 +46,14 @@
 
 ### Tests for User Story 1
 
-- [X] T006 [P] [US1] Add unit tests for `resolveServiceForWorkload` in `kagenti-operator/internal/controller/agentruntime_controller_test.go`. Test cases: Service found by name, Service found by selector match, no matching Service, multiple ports (uses first HTTP port), Deployment with no ready pods.
-- [X] T007 [P] [US1] Add unit tests for the card fetch phase in `kagenti-operator/internal/controller/agentruntime_controller_test.go`. Test cases: successful fetch populates `status.card` with all fields, fetch failure retains stale data and sets `CardSynced=False`, invalid JSON sets `CardParseFailed` condition, feature flag disabled skips fetch, pod template hash unchanged skips fetch, feature flag toggled off clears `status.card`.
+- [X] T006 [P] [US1] Add unit tests for `resolveServiceForWorkload` in `operator/internal/controller/agentruntime_controller_test.go`. Test cases: Service found by name, Service found by selector match, no matching Service, multiple ports (uses first HTTP port), Deployment with no ready pods.
+- [X] T007 [P] [US1] Add unit tests for the card fetch phase in `operator/internal/controller/agentruntime_controller_test.go`. Test cases: successful fetch populates `status.card` with all fields, fetch failure retains stale data and sets `CardSynced=False`, invalid JSON sets `CardParseFailed` condition, feature flag disabled skips fetch, pod template hash unchanged skips fetch, feature flag toggled off clears `status.card`.
 
 ### Implementation for User Story 1
 
-- [X] T008 [US1] Add a `fetchAndUpdateCard` method to `AgentRuntimeReconciler` in `kagenti-operator/internal/controller/agentruntime_controller.go`. This is the main card fetch phase, called from `Reconcile()` after step 5 (config hash). Logic: (1) If `EnableCardDiscovery` is false, clear `status.card` if populated, set `CardSynced` condition to `CardDiscoveryDisabled`, return. (2) Read the change-detection hash from annotation `agent.kagenti.dev/last-card-fetch-hash` on the AgentRuntime; compare against current workload pod template hash (or generation for StatefulSet/Sandbox); if unchanged and `status.card` is populated, set `CardSynced` to `FetchSkipped`, return. (3) Call `resolveServiceForWorkload`. (4) Build service URL via `agentcard.GetServiceURL`. (5) Call `AgentFetcher.Fetch()`. (6) On success: build `CardStatus` from fetched `AgentCardData`, set `fetchedAt`, compute `cardId` via SHA-256, set `protocol`, store current hash in annotation. (7) On failure: retain existing `status.card`, set `CardSynced=False` with error reason. (8) Update status via `r.Status().Update()` with retry. Note: FR-009 (max response body size) is implicitly satisfied because the reused `doHTTPFetch()` in `internal/agentcard/fetcher.go` already enforces `maxCardSize = 1 MiB`.
-- [X] T009 [US1] Wire the `fetchAndUpdateCard` call into the `Reconcile()` method in `kagenti-operator/internal/controller/agentruntime_controller.go`. Insert after the config hash computation (step 5, around line 165) and before the label propagation phase. Pass the resolved target workload info.
-- [X] T010 [US1] Extract the change-detection key from the target workload in the `fetchAndUpdateCard` method. For Deployments, read the pod-template-hash label. For StatefulSets and Sandboxes, use the resource generation. Store the key in the `agent.kagenti.dev/last-card-fetch-hash` annotation on the AgentRuntime object (not in status).
+- [X] T008 [US1] Add a `fetchAndUpdateCard` method to `AgentRuntimeReconciler` in `operator/internal/controller/agentruntime_controller.go`. This is the main card fetch phase, called from `Reconcile()` after step 5 (config hash). Logic: (1) If `EnableCardDiscovery` is false, clear `status.card` if populated, set `CardSynced` condition to `CardDiscoveryDisabled`, return. (2) Read the change-detection hash from annotation `agent.rossoctl.dev/last-card-fetch-hash` on the AgentRuntime; compare against current workload pod template hash (or generation for StatefulSet/Sandbox); if unchanged and `status.card` is populated, set `CardSynced` to `FetchSkipped`, return. (3) Call `resolveServiceForWorkload`. (4) Build service URL via `agentcard.GetServiceURL`. (5) Call `AgentFetcher.Fetch()`. (6) On success: build `CardStatus` from fetched `AgentCardData`, set `fetchedAt`, compute `cardId` via SHA-256, set `protocol`, store current hash in annotation. (7) On failure: retain existing `status.card`, set `CardSynced=False` with error reason. (8) Update status via `r.Status().Update()` with retry. Note: FR-009 (max response body size) is implicitly satisfied because the reused `doHTTPFetch()` in `internal/agentcard/fetcher.go` already enforces `maxCardSize = 1 MiB`.
+- [X] T009 [US1] Wire the `fetchAndUpdateCard` call into the `Reconcile()` method in `operator/internal/controller/agentruntime_controller.go`. Insert after the config hash computation (step 5, around line 165) and before the label propagation phase. Pass the resolved target workload info.
+- [X] T010 [US1] Extract the change-detection key from the target workload in the `fetchAndUpdateCard` method. For Deployments, read the pod-template-hash label. For StatefulSets and Sandboxes, use the resource generation. Store the key in the `agent.rossoctl.dev/last-card-fetch-hash` annotation on the AgentRuntime object (not in status).
 
 **Checkpoint**: US1 complete. `status.card` is populated on reconcile when the flag is enabled.
 
@@ -67,12 +67,12 @@
 
 ### Tests for User Story 2
 
-- [X] T011 [P] [US2] Add unit tests for mTLS card fetch in `kagenti-operator/internal/controller/agentruntime_controller_test.go`. Test cases: mTLS fetch populates `attestedAgentSpiffeID` and `validSignature`, mTLS handshake failure retains stale data and sets condition, fallback to HTTP when no TLS port, JWS signature verification populates `signatureKeyID`.
+- [X] T011 [P] [US2] Add unit tests for mTLS card fetch in `operator/internal/controller/agentruntime_controller_test.go`. Test cases: mTLS fetch populates `attestedAgentSpiffeID` and `validSignature`, mTLS handshake failure retains stale data and sets condition, fallback to HTTP when no TLS port, JWS signature verification populates `signatureKeyID`.
 
 ### Implementation for User Story 2
 
-- [X] T012 [US2] Extend `fetchAndUpdateCard` in `kagenti-operator/internal/controller/agentruntime_controller.go` to support mTLS. After resolving the Service, check for the `agent-tls` named port (reuse `getAgentTLSPort`). If present and `AuthenticatedFetcher` is not nil, call `AuthenticatedFetcher.FetchAuthenticated()` instead of `AgentFetcher.Fetch()`. On success, populate `attestedAgentSpiffeID` from `FetchResult.AgentSpiffeID`.
-- [X] T013 [US2] Add JWS signature verification to `fetchAndUpdateCard` in `kagenti-operator/internal/controller/agentruntime_controller.go`. After fetching the card data (mTLS or HTTP), if `SignatureProvider` is not nil and the card has signatures, call `SignatureProvider.VerifySignature()`. Populate `status.card.validSignature`, `status.card.signatureKeyID`, and `status.card.signatureVerificationDetails` from the `VerificationResult`.
+- [X] T012 [US2] Extend `fetchAndUpdateCard` in `operator/internal/controller/agentruntime_controller.go` to support mTLS. After resolving the Service, check for the `agent-tls` named port (reuse `getAgentTLSPort`). If present and `AuthenticatedFetcher` is not nil, call `AuthenticatedFetcher.FetchAuthenticated()` instead of `AgentFetcher.Fetch()`. On success, populate `attestedAgentSpiffeID` from `FetchResult.AgentSpiffeID`.
+- [X] T013 [US2] Add JWS signature verification to `fetchAndUpdateCard` in `operator/internal/controller/agentruntime_controller.go`. After fetching the card data (mTLS or HTTP), if `SignatureProvider` is not nil and the card has signatures, call `SignatureProvider.VerifySignature()`. Populate `status.card.validSignature`, `status.card.signatureKeyID`, and `status.card.signatureVerificationDetails` from the `VerificationResult`.
 - [X] T014 [US2] Handle mTLS fallback to HTTP in `fetchAndUpdateCard`. If `AuthenticatedFetcher` is set but no `agent-tls` port exists on the Service, fall back to `AgentFetcher.Fetch()` and leave verification fields empty. Log a warning and emit a Kubernetes Event (reuse pattern from agentcard_controller.go line 351-356).
 
 **Checkpoint**: US2 complete. mTLS verified card fetch works with SPIFFE identity extraction and JWS signature validation.
@@ -87,11 +87,11 @@
 
 ### Tests for User Story 3
 
-- [X] T015 [P] [US3] Add unit test for deprecation warning in `kagenti-operator/internal/controller/agentcard_controller_test.go`. Verify that reconciling a recently created AgentCard emits a deprecation log message and Kubernetes Event.
+- [X] T015 [P] [US3] Add unit test for deprecation warning in `operator/internal/controller/agentcard_controller_test.go`. Verify that reconciling a recently created AgentCard emits a deprecation log message and Kubernetes Event.
 
 ### Implementation for User Story 3
 
-- [X] T016 [US3] Add deprecation warning to `AgentCardReconciler.Reconcile()` in `kagenti-operator/internal/controller/agentcard_controller.go`. After the deletion/finalizer check (around line 166), check if `agentCard.CreationTimestamp` is within the last 5 minutes. If so, log a warning: "AgentCard is deprecated; card data is now available via AgentRuntime status.card. Migrate to AgentRuntime-based discovery." Also emit a Kubernetes Event with reason "Deprecated" and type Warning.
+- [X] T016 [US3] Add deprecation warning to `AgentCardReconciler.Reconcile()` in `operator/internal/controller/agentcard_controller.go`. After the deletion/finalizer check (around line 166), check if `agentCard.CreationTimestamp` is within the last 5 minutes. If so, log a warning: "AgentCard is deprecated; card data is now available via AgentRuntime status.card. Migrate to AgentRuntime-based discovery." Also emit a Kubernetes Event with reason "Deprecated" and type Warning.
 
 **Checkpoint**: US3 complete. Deprecation warnings emitted for new AgentCard CRs.
 
@@ -105,7 +105,7 @@
 
 ### Tests and Verification for User Story 4
 
-- [X] T017 [US4] Add unit tests for feature flag toggle behavior in `kagenti-operator/internal/controller/agentruntime_controller_test.go`. Test cases: (1) flag disabled means no card fetch attempted and `status.card` remains nil, (2) flag disabled clears existing populated `status.card` data and sets `CardSynced` condition to `CardDiscoveryDisabled`, (3) flag enabled triggers fetch and populates `status.card`, (4) toggling flag off after previous population clears data on next reconcile. These tests validate the flag-off cleanup logic built in T008 step 1.
+- [X] T017 [US4] Add unit tests for feature flag toggle behavior in `operator/internal/controller/agentruntime_controller_test.go`. Test cases: (1) flag disabled means no card fetch attempted and `status.card` remains nil, (2) flag disabled clears existing populated `status.card` data and sets `CardSynced` condition to `CardDiscoveryDisabled`, (3) flag enabled triggers fetch and populates `status.card`, (4) toggling flag off after previous population clears data on next reconcile. These tests validate the flag-off cleanup logic built in T008 step 1.
 
 **Checkpoint**: US4 complete. Feature flag fully controls card discovery lifecycle.
 
@@ -115,10 +115,10 @@
 
 **Purpose**: End-to-end validation, documentation, and CRD manifest finalization
 
-- [X] T018 [P] Run `make generate && make manifests` in `kagenti-operator/` to ensure all generated code and CRD manifests are up to date after all changes.
-- [X] T019 [P] Add a `CardSynced` print column to the AgentRuntime CRD in `kagenti-operator/api/v1alpha1/agentruntime_types.go` via kubebuilder marker: `// +kubebuilder:printcolumn:name="CardSynced",type="string",JSONPath=".status.conditions[?(@.type=='CardSynced')].status",description="Card Sync Status"`. Regenerate manifests.
-- [ ] T020 [P] Add e2e test scenario to `kagenti-operator/test/e2e/e2e_test.go` that deploys a test agent Deployment with a mock `/.well-known/agent-card.json` endpoint, creates an AgentRuntime targeting it with card discovery enabled, and verifies `status.card` is populated within 30 seconds.
-- [ ] T021 Run full test suite: `make test` in `kagenti-operator/`. Fix any regressions. Ensure existing AgentCard controller tests still pass.
+- [X] T018 [P] Run `make generate && make manifests` in `operator/` to ensure all generated code and CRD manifests are up to date after all changes.
+- [X] T019 [P] Add a `CardSynced` print column to the AgentRuntime CRD in `operator/api/v1alpha1/agentruntime_types.go` via kubebuilder marker: `// +kubebuilder:printcolumn:name="CardSynced",type="string",JSONPath=".status.conditions[?(@.type=='CardSynced')].status",description="Card Sync Status"`. Regenerate manifests.
+- [ ] T020 [P] Add e2e test scenario to `operator/test/e2e/e2e_test.go` that deploys a test agent Deployment with a mock `/.well-known/agent-card.json` endpoint, creates an AgentRuntime targeting it with card discovery enabled, and verifies `status.card` is populated within 30 seconds.
+- [ ] T021 Run full test suite: `make test` in `operator/`. Fix any regressions. Ensure existing AgentCard controller tests still pass.
 - [ ] T022 Verify CRD backward compatibility: confirm existing AgentRuntime CRs without `status.card` continue to work without errors when the operator runs with card discovery disabled.
 
 ---
diff --git a/specs/002-card-discovery-alignment/REVIEWERS.md b/specs/002-card-discovery-alignment/REVIEWERS.md
index 2f2b5693..179e7c8c 100644
--- a/specs/002-card-discovery-alignment/REVIEWERS.md
+++ b/specs/002-card-discovery-alignment/REVIEWERS.md
@@ -14,7 +14,7 @@ Six breaking changes to the AgentRuntime CRD status fields:
 2. Condition type renamed from `CardSynced` to `CardFetched` with transport-aware reasons (`Fetched` vs `FetchedInsecure`)
 3. `cardId` field renamed to `cardHash` (it holds a SHA-256 content hash, not an identifier)
 4. `fetchedAt` field renamed to `lastCardFetchTime` (clarifies this is the controller's fetch timestamp, not the card's creation time)
-5. Port resolution now checks `kagenti.io/port` annotation, then port named `a2a`, before falling back to `http`/first port
+5. Port resolution now checks `rossoctl.io/port` annotation, then port named `a2a`, before falling back to `http`/first port
 6. New `WorkloadNotReady` condition reason split from `ServiceNotFound`
 
 All changes are backward-incompatible CRD field/condition renames. No migration needed since there are no consumers yet.
@@ -50,7 +50,7 @@ The changes modify four layers:
 
 2. **Condition model where every reason maps to one diagnostic action.** `CardFetched` as the type (past participle, like Kubernetes' `Scheduled` or `Initialized`) instead of `CardSynced` (implies polling, which we don't do). Transport-aware reasons (`Fetched` vs `FetchedInsecure`) for security visibility. `WorkloadNotReady` split from `ServiceNotFound` because they require different operator responses (wait vs check config). `FetchSkipped` and `DiscoveryDisabled` retained from PR #372 for feature flag and no-op cases.
 
-3. **Port resolution with annotation escape hatch.** The `kagenti.io/port` annotation on Services handles multi-port edge cases where auto-detection picks the wrong port. The `a2a` port name takes priority over generic `http` because we're specifically fetching A2A protocol cards.
+3. **Port resolution with annotation escape hatch.** The `rossoctl.io/port` annotation on Services handles multi-port edge cases where auto-detection picks the wrong port. The `a2a` port name takes priority over generic `http` because we're specifically fetching A2A protocol cards.
 
 4. **`cardHash` over `cardId`.** The field holds a SHA-256 content hash for change detection, not a unique identifier. `cardId` suggests a stable ID (like a UUID); `cardHash` accurately conveys "content fingerprint that changes when the card changes."
 
diff --git a/specs/002-card-discovery-alignment/data-model.md b/specs/002-card-discovery-alignment/data-model.md
index a5b3d806..3118b3a4 100644
--- a/specs/002-card-discovery-alignment/data-model.md
+++ b/specs/002-card-discovery-alignment/data-model.md
@@ -75,6 +75,6 @@ type CardStatus struct {
 
 | Annotation | Scope | Type | Example |
 |------------|-------|------|---------|
-| `kagenti.io/port` | Service | string (numeric) | `"9090"` |
+| `rossoctl.io/port` | Service | string (numeric) | `"9090"` |
 
 Resolution chain: annotation > port named `a2a` > port named `http` > first port > default 8000
diff --git a/specs/002-card-discovery-alignment/plan.md b/specs/002-card-discovery-alignment/plan.md
index 7731d27f..4921229a 100644
--- a/specs/002-card-discovery-alignment/plan.md
+++ b/specs/002-card-discovery-alignment/plan.md
@@ -46,7 +46,7 @@ specs/002-card-discovery-alignment/
 ### Source Code (files to modify)
 
 ```text
-kagenti-operator/
+operator/
 ├── api/v1alpha1/
 │   ├── agentruntime_types.go          # CardStatus struct (field renames + new field)
 │   └── zz_generated.deepcopy.go       # Auto-generated
@@ -54,12 +54,12 @@ kagenti-operator/
 │   └── main.go                        # No changes needed (fetcher wiring unchanged)
 ├── config/
 │   ├── crd/bases/
-│   │   └── agent.kagenti.dev_agentruntimes.yaml  # CRD schema
+│   │   └── agent.rossoctl.dev_agentruntimes.yaml  # CRD schema
 │   └── rbac/
 │       └── role.yaml                  # No changes needed
-├── charts/kagenti-operator/
+├── charts/operator/
 │   └── crds/
-│       └── agent.kagenti.dev_agentruntimes.yaml  # Helm chart CRD
+│       └── agent.rossoctl.dev_agentruntimes.yaml  # Helm chart CRD
 ├── internal/controller/
 │   ├── agentruntime_controller.go     # Condition constants, fetchAndUpdateCard, serviceHTTPPort
 │   └── agentruntime_controller_test.go # All card-related tests
diff --git a/specs/002-card-discovery-alignment/research.md b/specs/002-card-discovery-alignment/research.md
index 793c0074..459633b5 100644
--- a/specs/002-card-discovery-alignment/research.md
+++ b/specs/002-card-discovery-alignment/research.md
@@ -18,13 +18,13 @@
 
 ## R-002: Port resolution annotation name
 
-**Decision**: Use `kagenti.io/port` on the Service.
+**Decision**: Use `rossoctl.io/port` on the Service.
 
-**Rationale**: Follows the project's existing annotation namespace (`kagenti.io/type`, `kagenti.io/framework`). Placed on the Service (not the Deployment) because the port is a Service-level concern.
+**Rationale**: Follows the project's existing annotation namespace (`rossoctl.io/type`, `rossoctl.io/framework`). Placed on the Service (not the Deployment) because the port is a Service-level concern.
 
 **Alternatives considered**:
-- `agent.kagenti.dev/port`: uses the CRD API group, which is for CRD fields not annotations
-- `protocol.kagenti.io/a2a-port`: too specific, couples annotation to one protocol
+- `agent.rossoctl.dev/port`: uses the CRD API group, which is for CRD fields not annotations
+- `protocol.rossoctl.io/a2a-port`: too specific, couples annotation to one protocol
 
 ## R-003: Workload readiness check placement
 
@@ -85,7 +85,7 @@ func serviceHTTPPort(svc *corev1.Service) int32 {
 ```
 
 **New implementation**:
-1. Check `kagenti.io/port` annotation (parse as int32, validate > 0)
+1. Check `rossoctl.io/port` annotation (parse as int32, validate > 0)
 2. Look for port named `a2a`
 3. Look for port named `http`
 4. First port in spec
diff --git a/specs/002-card-discovery-alignment/review-findings.md b/specs/002-card-discovery-alignment/review-findings.md
index 937102f5..89df92f4 100644
--- a/specs/002-card-discovery-alignment/review-findings.md
+++ b/specs/002-card-discovery-alignment/review-findings.md
@@ -25,7 +25,7 @@ Note: 3 remaining Important findings are pre-existing architectural patterns (re
 ### FINDING-1
 - **Severity:** Important
 - **Confidence:** 85
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:905-910
+- **File:** operator/internal/controller/agentruntime_controller.go:905-910
 - **Category:** correctness
 - **Source:** correctness-agent
 - **Round found:** 1
@@ -43,7 +43,7 @@ Added nil check after the plain HTTP fetch, matching the pattern already used in
 ### FINDING-2
 - **Severity:** Important
 - **Confidence:** 90
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:594-595
+- **File:** operator/internal/controller/agentruntime_controller.go:594-595
 - **Category:** production-readiness
 - **Source:** production-agent (also reported by: correctness-agent, architecture-agent)
 - **Round found:** 1
@@ -61,7 +61,7 @@ Changed function signature to accept `ctx context.Context` and updated all call
 ### FINDING-3
 - **Severity:** Important
 - **Confidence:** 95
-- **File:** kagenti-operator/internal/controller/agentruntime_controller_test.go (missing test)
+- **File:** operator/internal/controller/agentruntime_controller_test.go (missing test)
 - **Category:** test-quality
 - **Source:** test-agent
 - **Round found:** 1
@@ -79,7 +79,7 @@ Added test that performs a successful fetch, then calls `fetchAndUpdateCard` aga
 ### FINDING-4
 - **Severity:** Important
 - **Confidence:** 95
-- **File:** kagenti-operator/internal/controller/agentruntime_controller_test.go (missing test)
+- **File:** operator/internal/controller/agentruntime_controller_test.go (missing test)
 - **Category:** test-quality
 - **Source:** test-agent
 - **Round found:** 1
@@ -97,7 +97,7 @@ Added test with a ready Deployment + Service and a stub fetcher that returns an
 ### FINDING-5 (pre-existing, not fixed)
 - **Severity:** Important
 - **Confidence:** 85
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:753-840
+- **File:** operator/internal/controller/agentruntime_controller.go:753-840
 - **Category:** production-readiness
 - **Source:** production-agent
 - **Round found:** 1
@@ -114,7 +114,7 @@ Unnecessary API server load in steady state.
 ### FINDING-6 (pre-existing, not fixed)
 - **Severity:** Important
 - **Confidence:** 80
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:849-866
+- **File:** operator/internal/controller/agentruntime_controller.go:849-866
 - **Category:** production-readiness
 - **Source:** production-agent
 - **Round found:** 1
@@ -128,7 +128,7 @@ Unnecessary API server load in steady state.
 ### FINDING-7 (pre-existing, not fixed)
 - **Severity:** Important
 - **Confidence:** 85
-- **File:** kagenti-operator/internal/controller/agentruntime_controller.go:213
+- **File:** operator/internal/controller/agentruntime_controller.go:213
 - **Category:** production-readiness
 - **Source:** production-agent
 - **Round found:** 1
diff --git a/specs/002-card-discovery-alignment/spec.md b/specs/002-card-discovery-alignment/spec.md
index a44e368c..eb50af64 100644
--- a/specs/002-card-discovery-alignment/spec.md
+++ b/specs/002-card-discovery-alignment/spec.md
@@ -69,16 +69,16 @@ A platform engineer deploys an agent with a multi-port Service (e.g., an admin H
 **Acceptance Scenarios**:
 
 1. **Given** a Service with a port named `a2a`, **When** the controller resolves the card endpoint, **Then** it uses the `a2a` port.
-2. **Given** a Service with a `kagenti.io/port` annotation set to `9090`, **When** the controller resolves the card endpoint, **Then** it uses port 9090 regardless of port names.
+2. **Given** a Service with a `rossoctl.io/port` annotation set to `9090`, **When** the controller resolves the card endpoint, **Then** it uses port 9090 regardless of port names.
 3. **Given** a Service with no `a2a` port and no annotation, **When** the controller resolves the card endpoint, **Then** it falls back to the port named `http`, then to the first port.
-4. **Given** a Service with the `kagenti.io/port` annotation and a port named `a2a`, **When** the controller resolves the card endpoint, **Then** the annotation takes priority over the port name.
+4. **Given** a Service with the `rossoctl.io/port` annotation and a port named `a2a`, **When** the controller resolves the card endpoint, **Then** the annotation takes priority over the port name.
 
 ---
 
 ### Edge Cases
 
 - What happens when `transportSecurity` is `"http"` and a policy engine requires mTLS? The field provides the signal; enforcement is out of scope for this feature (deferred to identity binding migration).
-- What happens when a Service has the `kagenti.io/port` annotation with an invalid value (non-numeric, port 0)? The controller falls back to port name resolution and logs a warning.
+- What happens when a Service has the `rossoctl.io/port` annotation with an invalid value (non-numeric, port 0)? The controller falls back to port name resolution and logs a warning.
 - What happens when the `cardHash` changes but the card payload fields are semantically identical (e.g., JSON key ordering difference)? The hash is computed from the serialized JSON, so ordering differences produce different hashes. This is intentional: any byte-level change triggers a re-fetch timestamp update.
 - What happens when a workload is intentionally scaled to zero (KEDA, Knative, manual `replicas: 0`)? The current generation-based change detection treats a replica count change as a workload mutation, triggering a re-fetch attempt that fails with `WorkloadNotReady` even though the card data (baked into the image) is still valid. The condition self-heals when pods return, but the flapping is noisy for operators. Existing card data is always retained (FR-013). A follow-up improvement should switch change detection from `metadata.generation` (increments on any spec change including replicas) to the Kubernetes pod template hash (only changes when `spec.template` changes: image, env, volumes). Replicas are not part of `spec.template`, so scale events would be correctly ignored.
 
@@ -97,7 +97,7 @@ A platform engineer deploys an agent with a multi-port Service (e.g., an admin H
 - **FR-003**: The `CardFetched` condition MUST use these reasons: `Fetched` (mTLS success), `FetchedInsecure` (plain HTTP success), `FetchSkipped` (pod template unchanged), `FetchFailed` (fetch error), `ServiceNotFound` (no matching Service), `WorkloadNotReady` (no Ready pods), `DiscoveryDisabled` (feature flag off).
 - **FR-004**: The system MUST rename the `cardId` field to `cardHash` in `CardStatus`.
 - **FR-005**: The system MUST rename the `fetchedAt` field to `lastCardFetchTime` in `CardStatus`.
-- **FR-006**: The system MUST resolve the A2A card endpoint port using this chain: `kagenti.io/port` annotation on the Service (highest priority), then port named `a2a`, then port named `http`, then first port.
+- **FR-006**: The system MUST resolve the A2A card endpoint port using this chain: `rossoctl.io/port` annotation on the Service (highest priority), then port named `a2a`, then port named `http`, then first port.
 - **FR-007**: The system MUST check workload readiness before attempting service resolution. For Deployments and StatefulSets, check `readyReplicas > 0`. For Sandboxes (unstructured), skip the readiness check and proceed directly to service resolution. If the readiness check fails, set `CardFetched=False` with reason `WorkloadNotReady`.
 - **FR-008**: The `CardFetched` printer column MUST replace the existing `CardSynced` printer column in the CRD.
 - **FR-009**: The project constitution MUST be updated to reflect the new condition type and field names.
@@ -121,6 +121,6 @@ A platform engineer deploys an agent with a multi-port Service (e.g., an admin H
 
 - The PR #372 merged recently enough that no external consumers depend on the current field names or condition type. Breaking changes are acceptable.
 - The `transportSecurity` values `"mtls"` and `"http"` are sufficient for v1alpha1. New values (e.g., `"ztunnel"`) can be added via normal CRD schema evolution. The field uses a typed Go enum (`TransportSecurity`) with kubebuilder validation to prevent silent divergence in consumer comparisons.
-- The `kagenti.io/port` annotation is a new API surface. No existing workloads use it, so there is no migration concern.
+- The `rossoctl.io/port` annotation is a new API surface. No existing workloads use it, so there is no migration concern.
 - The ConfigMap fetch path (init-container signing) is being deprecated. It is not represented in the `transportSecurity` enum; a value can be added if needed during the coexistence period.
 - Workload readiness can be determined by checking for pods matching the workload's selector with a Ready condition. This reuses existing pod listing logic.
diff --git a/specs/002-card-discovery-alignment/tasks.md b/specs/002-card-discovery-alignment/tasks.md
index 08b3a746..4328b61c 100644
--- a/specs/002-card-discovery-alignment/tasks.md
+++ b/specs/002-card-discovery-alignment/tasks.md
@@ -17,15 +17,15 @@
 
 **Purpose**: Rename fields and condition type across all files. These are blocking prerequisites for all user stories since US1-US4 all reference the new names.
 
-- [X] T001 Rename `CardID` to `CardHash` and `FetchedAt` to `LastCardFetchTime` in `CardStatus` struct, update JSON tags from `cardId`/`fetchedAt` to `cardHash`/`lastCardFetchTime` in `kagenti-operator/api/v1alpha1/agentruntime_types.go`
-- [X] T002 Add `TransportSecurity string` field with JSON tag `transportSecurity` and godoc to `CardStatus` struct in `kagenti-operator/api/v1alpha1/agentruntime_types.go`
-- [X] T003 Run `make generate` to regenerate `kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go`
-- [X] T004 Rename `ConditionTypeCardSynced` to `ConditionTypeCardFetched` with value `"CardFetched"` in `kagenti-operator/internal/controller/agentruntime_controller.go` (line 74)
-- [X] T005 Update all condition reason string constants: `"CardSynced"` to `"Fetched"`, `"CardFetchFailed"` to `"FetchFailed"`, `"CardDiscoveryDisabled"` to `"DiscoveryDisabled"` in `kagenti-operator/internal/controller/agentruntime_controller.go`
-- [X] T006 Update all references from `CardID` to `CardHash` and `FetchedAt` to `LastCardFetchTime` in `fetchAndUpdateCard` function in `kagenti-operator/internal/controller/agentruntime_controller.go`
-- [X] T007 Rename printer column from `CardSynced` to `CardFetched` and update JSONPath from `CardSynced` to `CardFetched` in kubebuilder marker on `AgentRuntime` struct in `kagenti-operator/api/v1alpha1/agentruntime_types.go`
-- [X] T008 Run `make manifests` to regenerate CRD YAMLs in `kagenti-operator/config/crd/bases/` and sync to `charts/kagenti-operator/crds/` via `make sync-chart-crds`
-- [X] T009 Update all test assertions referencing `CardSynced`, `CardID`, `FetchedAt`, and old reason strings in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
+- [X] T001 Rename `CardID` to `CardHash` and `FetchedAt` to `LastCardFetchTime` in `CardStatus` struct, update JSON tags from `cardId`/`fetchedAt` to `cardHash`/`lastCardFetchTime` in `operator/api/v1alpha1/agentruntime_types.go`
+- [X] T002 Add `TransportSecurity string` field with JSON tag `transportSecurity` and godoc to `CardStatus` struct in `operator/api/v1alpha1/agentruntime_types.go`
+- [X] T003 Run `make generate` to regenerate `operator/api/v1alpha1/zz_generated.deepcopy.go`
+- [X] T004 Rename `ConditionTypeCardSynced` to `ConditionTypeCardFetched` with value `"CardFetched"` in `operator/internal/controller/agentruntime_controller.go` (line 74)
+- [X] T005 Update all condition reason string constants: `"CardSynced"` to `"Fetched"`, `"CardFetchFailed"` to `"FetchFailed"`, `"CardDiscoveryDisabled"` to `"DiscoveryDisabled"` in `operator/internal/controller/agentruntime_controller.go`
+- [X] T006 Update all references from `CardID` to `CardHash` and `FetchedAt` to `LastCardFetchTime` in `fetchAndUpdateCard` function in `operator/internal/controller/agentruntime_controller.go`
+- [X] T007 Rename printer column from `CardSynced` to `CardFetched` and update JSONPath from `CardSynced` to `CardFetched` in kubebuilder marker on `AgentRuntime` struct in `operator/api/v1alpha1/agentruntime_types.go`
+- [X] T008 Run `make manifests` to regenerate CRD YAMLs in `operator/config/crd/bases/` and sync to `charts/operator/crds/` via `make sync-chart-crds`
+- [X] T009 Update all test assertions referencing `CardSynced`, `CardID`, `FetchedAt`, and old reason strings in `operator/internal/controller/agentruntime_controller_test.go`
 - [X] T010 Run `make test` to verify zero regressions after renames
 
 ## Phase 2: US1 - Transport Security Visibility (P1)
@@ -34,11 +34,11 @@
 
 **Independent Test**: Deploy agents with and without mTLS, verify `transportSecurity` field and condition reason reflect the transport used.
 
-- [X] T011 [US1] Set `TransportSecurity` field in `fetchCard` function: set `"mTLS"` when `AuthenticatedFetcher` path executes (fetchResult != nil), set `"plainHTTP"` when `AgentFetcher` HTTP fallback path executes, in `kagenti-operator/internal/controller/agentruntime_controller.go`
-- [X] T012 [US1] Update `fetchAndUpdateCard` to pass `transportSecurity` from `fetchCard` into `cardStatus.TransportSecurity` and use transport-aware condition reasons: `"Fetched"` for mTLS, `"FetchedInsecure"` for plainHTTP, in `kagenti-operator/internal/controller/agentruntime_controller.go`
-- [X] T013 [US1] Add test: card fetched with stub fetcher (simulating plain HTTP) sets `transportSecurity: "plainHTTP"` and reason `FetchedInsecure` in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T014 [US1] Add test: card fetched with authenticated fetcher mock sets `transportSecurity: "mTLS"` and reason `Fetched` in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T015 [US1] Add test: transport security field updates when transport changes (mTLS to plainHTTP on re-fetch) in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
+- [X] T011 [US1] Set `TransportSecurity` field in `fetchCard` function: set `"mTLS"` when `AuthenticatedFetcher` path executes (fetchResult != nil), set `"plainHTTP"` when `AgentFetcher` HTTP fallback path executes, in `operator/internal/controller/agentruntime_controller.go`
+- [X] T012 [US1] Update `fetchAndUpdateCard` to pass `transportSecurity` from `fetchCard` into `cardStatus.TransportSecurity` and use transport-aware condition reasons: `"Fetched"` for mTLS, `"FetchedInsecure"` for plainHTTP, in `operator/internal/controller/agentruntime_controller.go`
+- [X] T013 [US1] Add test: card fetched with stub fetcher (simulating plain HTTP) sets `transportSecurity: "plainHTTP"` and reason `FetchedInsecure` in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T014 [US1] Add test: card fetched with authenticated fetcher mock sets `transportSecurity: "mTLS"` and reason `Fetched` in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T015 [US1] Add test: transport security field updates when transport changes (mTLS to plainHTTP on re-fetch) in `operator/internal/controller/agentruntime_controller_test.go`
 
 ## Phase 3: US2 - Unified Condition Model (P1)
 
@@ -46,12 +46,12 @@
 
 **Independent Test**: Create AgentRuntimes in all states and verify each condition type/status/reason combination.
 
-- [X] T016 [US2] Add `checkWorkloadReady` helper that checks `readyReplicas > 0` for Deployments/StatefulSets and skips check for Sandboxes in `kagenti-operator/internal/controller/agentruntime_controller.go`
-- [X] T017 [US2] Call `checkWorkloadReady` before `resolveServiceForWorkload` in `fetchAndUpdateCard`; set `CardFetched=False, reason=WorkloadNotReady` if check fails, in `kagenti-operator/internal/controller/agentruntime_controller.go`
-- [X] T018 [US2] Add test: workload with zero readyReplicas sets `CardFetched False WorkloadNotReady` in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T019 [US2] Add test: workload ready but no Service sets `CardFetched False ServiceNotFound` (existing test, update assertions) in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T020 [US2] Add test: discovery disabled sets `CardFetched False DiscoveryDisabled` (existing test, update assertions) in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T021 [US2] Verify existing `FetchSkipped` test passes with new condition type name in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
+- [X] T016 [US2] Add `checkWorkloadReady` helper that checks `readyReplicas > 0` for Deployments/StatefulSets and skips check for Sandboxes in `operator/internal/controller/agentruntime_controller.go`
+- [X] T017 [US2] Call `checkWorkloadReady` before `resolveServiceForWorkload` in `fetchAndUpdateCard`; set `CardFetched=False, reason=WorkloadNotReady` if check fails, in `operator/internal/controller/agentruntime_controller.go`
+- [X] T018 [US2] Add test: workload with zero readyReplicas sets `CardFetched False WorkloadNotReady` in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T019 [US2] Add test: workload ready but no Service sets `CardFetched False ServiceNotFound` (existing test, update assertions) in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T020 [US2] Add test: discovery disabled sets `CardFetched False DiscoveryDisabled` (existing test, update assertions) in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T021 [US2] Verify existing `FetchSkipped` test passes with new condition type name in `operator/internal/controller/agentruntime_controller_test.go`
 
 ## Phase 4: US3 - Accurate Field Names (P2)
 
@@ -59,20 +59,20 @@
 
 **Independent Test**: Create AgentRuntime in envtest, run reconcile with stub fetcher, read back from API server, verify field names.
 
-- [X] T022 [P] [US3] Add envtest integration test: create AgentRuntime, reconcile with stub fetcher, read back from API server, assert `status.card.cardHash` is a SHA-256 hex string and `status.card.lastCardFetchTime` is an RFC 3339 timestamp in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T023 [US3] Verify CRD schema contains `cardHash` and `lastCardFetchTime` fields and does NOT contain `cardId` or `fetchedAt` by inspecting generated `kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml`
+- [X] T022 [P] [US3] Add envtest integration test: create AgentRuntime, reconcile with stub fetcher, read back from API server, assert `status.card.cardHash` is a SHA-256 hex string and `status.card.lastCardFetchTime` is an RFC 3339 timestamp in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T023 [US3] Verify CRD schema contains `cardHash` and `lastCardFetchTime` fields and does NOT contain `cardId` or `fetchedAt` by inspecting generated `operator/config/crd/bases/agent.rossoctl.dev_agentruntimes.yaml`
 
 ## Phase 5: US4 - Protocol-Aware Port Resolution (P2)
 
-**Goal**: Port resolution uses `kagenti.io/port` annotation, then `a2a` port name, then `http`, then first port.
+**Goal**: Port resolution uses `rossoctl.io/port` annotation, then `a2a` port name, then `http`, then first port.
 
 **Independent Test**: Create Services with various port configurations and verify correct port selection.
 
-- [X] T024 [US4] Replace body of `serviceHTTPPort` in `kagenti-operator/internal/controller/agentruntime_controller.go`: check `kagenti.io/port` annotation first (parse as int32, validate > 0, log warning on invalid), then port named `a2a`, then port named `http`, then first port, default 8000
-- [X] T025 [US4] Add test: Service with `kagenti.io/port` annotation uses annotated port in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T026 [US4] Add test: Service with port named `a2a` uses that port (no annotation) in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T027 [US4] Add test: Service with invalid `kagenti.io/port` annotation falls back to port name resolution in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
-- [X] T028 [P] [US4] Add test: Service with both annotation and `a2a` port, annotation takes priority in `kagenti-operator/internal/controller/agentruntime_controller_test.go`
+- [X] T024 [US4] Replace body of `serviceHTTPPort` in `operator/internal/controller/agentruntime_controller.go`: check `rossoctl.io/port` annotation first (parse as int32, validate > 0, log warning on invalid), then port named `a2a`, then port named `http`, then first port, default 8000
+- [X] T025 [US4] Add test: Service with `rossoctl.io/port` annotation uses annotated port in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T026 [US4] Add test: Service with port named `a2a` uses that port (no annotation) in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T027 [US4] Add test: Service with invalid `rossoctl.io/port` annotation falls back to port name resolution in `operator/internal/controller/agentruntime_controller_test.go`
+- [X] T028 [P] [US4] Add test: Service with both annotation and `a2a` port, annotation takes priority in `operator/internal/controller/agentruntime_controller_test.go`
 
 ## Phase 6: Polish & Cross-Cutting
 
@@ -80,7 +80,7 @@
 
 - [X] T029 Update `ConditionTypeCardSynced` references to `ConditionTypeCardFetched` in constitution at `.specify/memory/constitution.md`
 - [X] T030 Run full `make test` to verify all tests pass (zero regressions, target: 181+ tests passing)
-- [X] T031 Verify no references to old names (`cardId`, `fetchedAt`, `CardSynced`) remain in Go source files via `grep -r` across `kagenti-operator/`
+- [X] T031 Verify no references to old names (`cardId`, `fetchedAt`, `CardSynced`) remain in Go source files via `grep -r` across `operator/`
 
 ## Dependencies
 
diff --git a/specs/003-mtls-transport-security/REVIEWERS.md b/specs/003-mtls-transport-security/REVIEWERS.md
index 300bdfeb..ab23e3b7 100644
--- a/specs/003-mtls-transport-security/REVIEWERS.md
+++ b/specs/003-mtls-transport-security/REVIEWERS.md
@@ -4,7 +4,7 @@
 
 ## Why This Change
 
-Agent-to-agent and controller-to-agent communication in kagenti currently runs over plaintext HTTP by default. While authbridge already has full mTLS support implemented (permissive/strict modes, SPIRE-based SVIDs, per-handshake cert rotation), the operator doesn't activate it by default. Operators must manually set flags and configure mTLS mode. This spec makes mTLS the default transport security, with clear error conditions when SPIRE is unavailable.
+Agent-to-agent and controller-to-agent communication in rossoctl currently runs over plaintext HTTP by default. While authbridge already has full mTLS support implemented (permissive/strict modes, SPIRE-based SVIDs, per-handshake cert rotation), the operator doesn't activate it by default. Operators must manually set flags and configure mTLS mode. This spec makes mTLS the default transport security, with clear error conditions when SPIRE is unavailable.
 
 ## What Changes
 
@@ -12,7 +12,7 @@ Agent-to-agent and controller-to-agent communication in kagenti currently runs o
 2. **MTLSReady condition**: New status condition on AgentRuntime showing whether mTLS infrastructure (SPIRE) is available, with actionable error messages when it's not.
 3. **Controller uses mTLS by default**: `--enable-verified-fetch` and `--enable-card-discovery` flags flip to `true`. SpiffeFetcher becomes the default card fetcher.
 4. **JWS signing deprecation**: Legacy signing flags (`--require-a2a-signature`, `--signature-audit-mode`, `--enforce-network-policies`) emit deprecation warnings.
-5. **Annotation-based mTLS delivery**: Controller sets `kagenti.io/mtls-mode` annotation on pod template (triggers restart on change). Webhook reads `mTLSMode` from AgentRuntime CR at pod CREATE and sets `MTLS_MODE` env var on authbridge container.
+5. **Annotation-based mTLS delivery**: Controller sets `rossoctl.io/mtls-mode` annotation on pod template (triggers restart on change). Webhook reads `mTLSMode` from AgentRuntime CR at pod CREATE and sets `MTLS_MODE` env var on authbridge container.
 
 No breaking changes. Existing deployments without SPIRE get a clear `MTLSReady=False` condition and can opt out with `mTLSMode: disabled`.
 
@@ -20,10 +20,10 @@ No breaking changes. Existing deployments without SPIRE get a clear `MTLSReady=F
 
 The implementation leverages heavily what's already built:
 
-- **Authbridge** (kagenti-extensions): mTLS is fully implemented across all proxy modes. No changes needed, only verification.
-- **Operator**: The main work is (a) changing the `mTLSMode` kubebuilder default to `permissive`, (b) setting `kagenti.io/mtls-mode` annotation on the pod template, (c) adding `MTLSReady` condition logic, (d) flipping flag defaults, and (e) webhook sets `MTLS_MODE` env var on authbridge container.
+- **Authbridge** (rossocortex): mTLS is fully implemented across all proxy modes. No changes needed, only verification.
+- **Operator**: The main work is (a) changing the `mTLSMode` kubebuilder default to `permissive`, (b) setting `rossoctl.io/mtls-mode` annotation on the pod template, (c) adding `MTLSReady` condition logic, (d) flipping flag defaults, and (e) webhook sets `MTLS_MODE` env var on authbridge container.
 - **SPIRE detection**: The controller checks whether spiffe-helper volume mounts exist in the workload's pod template. If absent while mTLS is enabled, `MTLSReady=False/SPIREUnavailable`.
-- **Rolling restart**: When `mTLSMode` changes, the `kagenti.io/mtls-mode` annotation on the pod template changes, triggering a Kubernetes rolling restart. This is independent of the platform config hash (per PR #405).
+- **Rolling restart**: When `mTLSMode` changes, the `rossoctl.io/mtls-mode` annotation on the pod template changes, triggering a Kubernetes rolling restart. This is independent of the platform config hash (per PR #405).
 
 Of 24 tasks, 2 are already done (`[DONE]`), 1 is partial (`[PARTIAL]`), and the remaining 21 are new work, mostly focused on the operator side.
 
@@ -36,14 +36,14 @@ Of 24 tasks, 2 are already done (`[DONE]`), 1 is partial (`[PARTIAL]`), and the
 - Migrating from JWS signing to mTLS-based identity
 
 **Does not apply when**:
-- Using Istio service mesh for mTLS (explicitly out of scope, separate effort in [#399](https://github.com/kagenti/kagenti-operator/issues/399))
+- Using Istio service mesh for mTLS (explicitly out of scope, separate effort in [#399](https://github.com/rossoctl/operator/issues/399))
 - Working with user-supplied certificates or cert-manager (future iteration)
 - Authbridge plugin changes (orthogonal)
 - Cross-cluster agent federation (future work)
 
 ## Key Decisions
 
-1. **SPIRE only, no Istio dependency**: The spec explicitly scopes to SPIRE-based mTLS. Istio service mesh mTLS (L4, pod-to-pod) is a separate effort tracked in [#399](https://github.com/kagenti/kagenti-operator/issues/399) and [PR #383](https://github.com/kagenti/kagenti-operator/pull/383). These are complementary (SPIRE = application-layer identity, Istio = infrastructure-layer encryption), not competing.
+1. **SPIRE only, no Istio dependency**: The spec explicitly scopes to SPIRE-based mTLS. Istio service mesh mTLS (L4, pod-to-pod) is a separate effort tracked in [#399](https://github.com/rossoctl/operator/issues/399) and [PR #383](https://github.com/rossoctl/operator/pull/383). These are complementary (SPIRE = application-layer identity, Istio = infrastructure-layer encryption), not competing.
 
 2. **Permissive as default, not strict**: Accepts both TLS and plaintext inbound. This allows gradual rollout without breaking existing agents that haven't enabled SPIRE yet.
 
@@ -55,9 +55,9 @@ Of 24 tasks, 2 are already done (`[DONE]`), 1 is partial (`[PARTIAL]`), and the
 
 ## Areas Needing Attention
 
-- **Overlap with Istio mTLS work**: [PR #383](https://github.com/kagenti/kagenti-operator/pull/383) (SharedTrust controller, already merged) and [Issue #399](https://github.com/kagenti/kagenti-operator/issues/399) (Istio auto-labeling) introduce Istio-based mTLS at the infrastructure layer. This spec operates at the application layer (SPIRE). Reviewers should verify these don't conflict at the configuration level (e.g., what happens when both SPIRE mTLS and Istio mTLS are active on the same workload).
+- **Overlap with Istio mTLS work**: [PR #383](https://github.com/rossoctl/operator/pull/383) (SharedTrust controller, already merged) and [Issue #399](https://github.com/rossoctl/operator/issues/399) (Istio auto-labeling) introduce Istio-based mTLS at the infrastructure layer. This spec operates at the application layer (SPIRE). Reviewers should verify these don't conflict at the configuration level (e.g., what happens when both SPIRE mTLS and Istio mTLS are active on the same workload).
 
-- **Annotation + env var contract**: T005 (controller sets `kagenti.io/mtls-mode` annotation, webhook sets `MTLS_MODE` env var) and T020 (verifying authbridge reads this env var) are the critical integration point. If authbridge doesn't read `MTLS_MODE`, mTLS mode changes have no effect.
+- **Annotation + env var contract**: T005 (controller sets `rossoctl.io/mtls-mode` annotation, webhook sets `MTLS_MODE` env var) and T020 (verifying authbridge reads this env var) are the critical integration point. If authbridge doesn't read `MTLS_MODE`, mTLS mode changes have no effect.
 
 - **MTLSReady condition gating Ready**: T016 proposes that `MTLSReady=False` should affect the overall `Ready` condition. The exact behavior (block Ready entirely vs. add a warning) needs careful design, since it changes the controller's availability semantics.
 
@@ -65,7 +65,7 @@ Of 24 tasks, 2 are already done (`[DONE]`), 1 is partial (`[PARTIAL]`), and the
 
 ## Open Questions
 
-- How do SPIRE-based mTLS (this spec) and Istio-based mTLS ([PR #383](https://github.com/kagenti/kagenti-operator/pull/383), [Issue #399](https://github.com/kagenti/kagenti-operator/issues/399)) coexist? Is double encryption acceptable, or should one disable when the other is active?
+- How do SPIRE-based mTLS (this spec) and Istio-based mTLS ([PR #383](https://github.com/rossoctl/operator/pull/383), [Issue #399](https://github.com/rossoctl/operator/issues/399)) coexist? Is double encryption acceptable, or should one disable when the other is active?
 - Should `MTLSReady=False` block the overall `Ready=True` condition, or just add a warning?
 - Does the SPIRE detection heuristic (spiffe-helper volume check) cover SPIRE CSI driver deployments?
 
@@ -75,7 +75,7 @@ Of 24 tasks, 2 are already done (`[DONE]`), 1 is partial (`[PARTIAL]`), and the
 - [ ] Scope matches the stated boundaries (no Istio, no user certs, no cross-cluster)
 - [ ] Constitution compliance verified (all 5 principles addressed in plan.md)
 - [ ] Annotation + env var contract matches authbridge expectations
-- [ ] No conflict with existing SharedTrust controller ([PR #383](https://github.com/kagenti/kagenti-operator/pull/383))
+- [ ] No conflict with existing SharedTrust controller ([PR #383](https://github.com/rossoctl/operator/pull/383))
 - [ ] Task reconciliation against `main` is accurate ([DONE]/[PARTIAL] markers)
 - [ ] Success criteria are achievable and testable
 - [ ] Deprecation warnings are clear and actionable
diff --git a/specs/003-mtls-transport-security/brainstorm.md b/specs/003-mtls-transport-security/brainstorm.md
index 8c461ec0..6eb470c5 100644
--- a/specs/003-mtls-transport-security/brainstorm.md
+++ b/specs/003-mtls-transport-security/brainstorm.md
@@ -42,7 +42,7 @@ The mTLS implementation must be sidecar-agnostic — the certificate presentatio
 
 **Answer: SPIRE only.** Single certificate provider for the initial implementation:
 
-1. **SPIRE (default and only)** — SPIRE-issued X.509 SVIDs via the Workload API. Already deployed for JWT SVIDs in Kagenti. The spiffe-helper sidecar or go-spiffe SDK provides certificates.
+1. **SPIRE (default and only)** — SPIRE-issued X.509 SVIDs via the Workload API. Already deployed for JWT SVIDs in Rossoctl. The spiffe-helper sidecar or go-spiffe SDK provides certificates.
 
 Istio, user-supplied certificates, and cert-manager are explicitly out of scope. No Istio dependency — Istio support can be added in a future iteration if needed.
 
@@ -58,15 +58,15 @@ Istio, user-supplied certificates, and cert-manager are explicitly out of scope.
 
 **Answer: spiffe-helper sidecar (file-based, option a).** A spiffe-helper container fetches SVIDs from SPIRE and writes them as PEM files (`svid.pem`, `svid_key.pem`, `bundle.pem`) to a shared volume. The proxy reads these files and reloads on change. This is already implemented and deployed.
 
-**Why not go-spiffe SDK directly in the proxy (option b)?** Option (b) eliminates the spiffe-helper container and keeps certs in memory, but it ties the proxy to SPIRE's Workload API. Option (a) keeps the proxy certificate-source-agnostic — it reads PEM files regardless of where they came from. This preserves the sidecar-agnostic constraint and works across all authbridge modes. Option (b) is the long-term direction per `kagenti-extensions#332` but is deferred.
+**Why not go-spiffe SDK directly in the proxy (option b)?** Option (b) eliminates the spiffe-helper container and keeps certs in memory, but it ties the proxy to SPIRE's Workload API. Option (a) keeps the proxy certificate-source-agnostic — it reads PEM files regardless of where they came from. This preserves the sidecar-agnostic constraint and works across all authbridge modes. Option (b) is the long-term direction per `rossocortex#332` but is deferred.
 
 ### Q7: What happens when mTLS is enabled but SPIRE is not deployed?
 
 **Answer: Fail clearly (option b).** If mTLS is the default and SPIRE isn't available, set the AgentRuntime to an error state with a clear condition. The operator must either deploy SPIRE or explicitly set `mTLSMode: disabled`. No silent fallback to plain HTTP — that would mask a real security gap.
 
-### Q8: Should this spec cover authbridge code changes in kagenti-extensions?
+### Q8: Should this spec cover authbridge code changes in rossocortex?
 
-**Answer: Yes — cover both repos.** This spec defines the work required in both `kagenti-operator` (controller, CRD, webhook) and `kagenti-extensions` (authbridge proxy TLS contexts). The spec captures what needs to change in authbridge to enable mTLS (DownstreamTlsContext, UpstreamTlsContext, certificate loading). Downstreaming logistics (how to bring authbridge code into the product build) are explicitly out of scope — that's a separate spike.
+**Answer: Yes — cover both repos.** This spec defines the work required in both `rossoctl-operator` (controller, CRD, webhook) and `rossocortex` (authbridge proxy TLS contexts). The spec captures what needs to change in authbridge to enable mTLS (DownstreamTlsContext, UpstreamTlsContext, certificate loading). Downstreaming logistics (how to bring authbridge code into the product build) are explicitly out of scope — that's a separate spike.
 
 ### Q5: Istio integration?
 
@@ -144,9 +144,9 @@ Istio, user-supplied certificates, and cert-manager are explicitly out of scope.
 - **AgentCardReconciler**: has `EnableVerifiedFetch`, `AuthenticatedFetcher`, SVID expiry grace period, signature verification
 - **AgentCardNetworkPolicyReconciler**: creates NetworkPolicies based on signature verification (to be replaced by policy enforcement from AgentRuntime)
 
-## Authbridge (kagenti-extensions) Current State
+## Authbridge (rossocortex) Current State
 
-The authbridge in `kagenti-extensions` already has significant mTLS infrastructure:
+The authbridge in `rossocortex` already has significant mTLS infrastructure:
 
 ### Existing mTLS Code
 
@@ -186,7 +186,7 @@ Each has its own `main.go`, `Dockerfile`, and `entrypoint.sh`.
 - Potentially: Envoy-specific DownstreamTlsContext/UpstreamTlsContext (if not already done)
 
 **The main remaining work is on the operator side:**
-- Setting `kagenti.io/mtls-mode` annotation on pod template + webhook sets `MTLS_MODE` env var on authbridge
+- Setting `rossoctl.io/mtls-mode` annotation on pod template + webhook sets `MTLS_MODE` env var on authbridge
 - Making mTLS enabled by default
 - Error conditions when SPIRE is unavailable
 - Controller-to-agent mTLS (SpiffeFetcher integration)
diff --git a/specs/003-mtls-transport-security/contracts/authbridge-mtls-config.md b/specs/003-mtls-transport-security/contracts/authbridge-mtls-config.md
index 4d197311..f6721b04 100644
--- a/specs/003-mtls-transport-security/contracts/authbridge-mtls-config.md
+++ b/specs/003-mtls-transport-security/contracts/authbridge-mtls-config.md
@@ -4,7 +4,7 @@
 
 ## Owner
 
-kagenti-operator controller + webhook (producer) → authbridge sidecar (consumer)
+rossoctl-operator controller + webhook (producer) → authbridge sidecar (consumer)
 
 ## Current Contract: Annotation + Env Var
 
@@ -15,7 +15,7 @@ The controller sets an annotation on the workload's pod template:
 ```yaml
 metadata:
   annotations:
-    kagenti.io/mtls-mode: "permissive"  # or "strict" or "disabled"
+    rossoctl.io/mtls-mode: "permissive"  # or "strict" or "disabled"
 ```
 
 When `mTLSMode` changes on the AgentRuntime CR, this annotation changes, triggering a rolling restart via Kubernetes pod template change detection.
@@ -44,7 +44,7 @@ Authbridge reads `MTLS_MODE` at startup to configure its TLS listeners.
 
 | Component | Responsibility |
 |-----------|---------------|
-| **Controller** | Sets `kagenti.io/mtls-mode` annotation on pod template. Triggers rolling restart on change. |
+| **Controller** | Sets `rossoctl.io/mtls-mode` annotation on pod template. Triggers rolling restart on change. |
 | **Webhook** | Reads `mTLSMode` from AgentRuntime CR at pod CREATE. Sets `MTLS_MODE` env var on authbridge container. |
 | **Authbridge** | Reads `MTLS_MODE` env var at startup. Configures TLS listeners accordingly. No Kubernetes API dependency. |
 
diff --git a/specs/003-mtls-transport-security/data-model.md b/specs/003-mtls-transport-security/data-model.md
index 31fa6cc2..295238fd 100644
--- a/specs/003-mtls-transport-security/data-model.md
+++ b/specs/003-mtls-transport-security/data-model.md
@@ -40,11 +40,11 @@ Added to AgentRuntime `status.conditions[]`.
 
 ### New: Pod Template Annotation
 
-The controller sets a `kagenti.io/mtls-mode` annotation on the workload's pod template. This serves two purposes: (1) triggers a rolling restart when the value changes, and (2) makes the mTLS mode visible on the pod.
+The controller sets a `rossoctl.io/mtls-mode` annotation on the workload's pod template. This serves two purposes: (1) triggers a rolling restart when the value changes, and (2) makes the mTLS mode visible on the pod.
 
 | Annotation | Values | Set By |
 |------------|--------|--------|
-| `kagenti.io/mtls-mode` | `permissive`, `strict`, `disabled` | Controller (on pod template) |
+| `rossoctl.io/mtls-mode` | `permissive`, `strict`, `disabled` | Controller (on pod template) |
 
 ### New: Authbridge Sidecar Env Var
 
@@ -68,7 +68,7 @@ The webhook sets an `MTLS_MODE` environment variable on the authbridge sidecar c
 ```
 AgentRuntime.spec.mTLSMode
     │
-    ├── Controller sets kagenti.io/mtls-mode annotation on pod template
+    ├── Controller sets rossoctl.io/mtls-mode annotation on pod template
     │       │
     │       └── Annotation change triggers rolling restart
     │
diff --git a/specs/003-mtls-transport-security/pending-changes.md b/specs/003-mtls-transport-security/pending-changes.md
index f92d4942..e24eb5af 100644
--- a/specs/003-mtls-transport-security/pending-changes.md
+++ b/specs/003-mtls-transport-security/pending-changes.md
@@ -5,9 +5,9 @@
 
 ## Changes needed after alignment
 
-1. **FR-009**: Change from "rolling restart via ConfigMap hash change" to annotation-based restart (`kagenti.io/mtls-mode` annotation on pod template)
+1. **FR-009**: Change from "rolling restart via ConfigMap hash change" to annotation-based restart (`rossoctl.io/mtls-mode` annotation on pod template)
 2. **Remove ConfigMap mtls: block injection**: Controller does NOT inject `mtls:` block into authbridge ConfigMap. The webhook reads `mTLSMode` from the AgentRuntime CR and configures authbridge at pod CREATE time.
 3. **Update tasks T005 and contracts/authbridge-mtls-config.md** to reflect webhook-driven config delivery instead of controller-driven ConfigMap injection.
-4. **Add**: Controller sets `kagenti.io/mtls-mode` annotation on the pod template. When `mTLSMode` changes on the CR, annotation changes → pod template changes → rolling restart.
+4. **Add**: Controller sets `rossoctl.io/mtls-mode` annotation on the pod template. When `mTLSMode` changes on the CR, annotation changes → pod template changes → rolling restart.
 5. **Add**: Webhook reads `mTLSMode` from AgentRuntime CR at pod CREATE time, sets `MTLS_MODE` env var on authbridge sidecar container.
 6. **Clarify controller/webhook boundary**: Controller owns labels, annotations, status. Webhook owns sidecar injection and container configuration.
diff --git a/specs/003-mtls-transport-security/plan.md b/specs/003-mtls-transport-security/plan.md
index 657bd0d3..51909e93 100644
--- a/specs/003-mtls-transport-security/plan.md
+++ b/specs/003-mtls-transport-security/plan.md
@@ -6,7 +6,7 @@
 
 ## Summary
 
-Enable mTLS as the default transport security for controller-to-agent and agent-to-agent communication. Authbridge mTLS is already implemented in kagenti-extensions across all proxy modes (envoy, proxy-sidecar, lite). The remaining work is operator-side: the controller sets a `kagenti.io/mtls-mode` annotation on the pod template (triggering rolling restart on change), the webhook reads `mTLSMode` from the AgentRuntime CR and sets `MTLS_MODE` env var on the authbridge container, defaulting `mTLSMode` to `permissive`, wiring `SpiffeFetcher` as the default card fetcher, adding `MTLSReady` status conditions, and deprecating the JWS signing pipeline flags. SPIRE is the sole certificate provider; Istio is out of scope.
+Enable mTLS as the default transport security for controller-to-agent and agent-to-agent communication. Authbridge mTLS is already implemented in rossocortex across all proxy modes (envoy, proxy-sidecar, lite). The remaining work is operator-side: the controller sets a `rossoctl.io/mtls-mode` annotation on the pod template (triggering rolling restart on change), the webhook reads `mTLSMode` from the AgentRuntime CR and sets `MTLS_MODE` env var on the authbridge container, defaulting `mTLSMode` to `permissive`, wiring `SpiffeFetcher` as the default card fetcher, adding `MTLSReady` status conditions, and deprecating the JWS signing pipeline flags. SPIRE is the sole certificate provider; Istio is out of scope.
 
 ## Technical Context
 
@@ -57,15 +57,15 @@ specs/003-mtls-transport-security/
 └── tasks.md             # Phase 2 output (/speckit-tasks)
 ```
 
-### Source Code (kagenti-operator)
+### Source Code (rossoctl-operator)
 
 ```text
-kagenti-operator/
+operator/
 ├── api/v1alpha1/
 │   ├── agentruntime_types.go       # MODIFY: mTLSMode default, MTLSReady condition type
 │   └── zz_generated.deepcopy.go    # REGENERATE: after type changes
 ├── internal/controller/
-│   ├── agentruntime_controller.go      # MODIFY: set kagenti.io/mtls-mode annotation, MTLSReady condition, SpiffeFetcher default
+│   ├── agentruntime_controller.go      # MODIFY: set rossoctl.io/mtls-mode annotation, MTLSReady condition, SpiffeFetcher default
 │   ├── agentruntime_controller_test.go # MODIFY: tests for mTLS annotation, conditions, defaults
 ├── internal/webhook/injector/
 │   └── pod_mutator.go                  # MODIFY: read mTLSMode from AgentRuntime CR, set MTLS_MODE env var on authbridge
@@ -79,10 +79,10 @@ kagenti-operator/
     └── integration/                # MODIFY: mTLS integration test
 ```
 
-### Source Code (kagenti-extensions — verification only)
+### Source Code (rossocortex — verification only)
 
 ```text
-kagenti-extensions/authbridge/
+rossocortex/authbridge/
 ├── cmd/
 │   ├── authbridge-envoy/main.go    # VERIFY: mTLS wiring exists
 │   ├── authbridge-proxy/main.go    # VERIFIED: mTLS wiring complete
diff --git a/specs/003-mtls-transport-security/research.md b/specs/003-mtls-transport-security/research.md
index 1204429b..84df415e 100644
--- a/specs/003-mtls-transport-security/research.md
+++ b/specs/003-mtls-transport-security/research.md
@@ -2,9 +2,9 @@
 
 ## R1: Authbridge mTLS Config Delivery (UPDATED)
 
-**Decision**: ~~The operator injects `mtls:` block into the authbridge ConfigMap.~~ **Superseded per PR #405 review.** The controller sets a `kagenti.io/mtls-mode` annotation on the pod template. The webhook reads `mTLSMode` from the AgentRuntime CR at pod CREATE time and sets `MTLS_MODE` env var on the authbridge container.
+**Decision**: ~~The operator injects `mtls:` block into the authbridge ConfigMap.~~ **Superseded per PR #405 review.** The controller sets a `rossoctl.io/mtls-mode` annotation on the pod template. The webhook reads `mTLSMode` from the AgentRuntime CR at pod CREATE time and sets `MTLS_MODE` env var on the authbridge container.
 
-**Annotation**: `kagenti.io/mtls-mode: permissive` (or `strict` or `disabled`) on pod template.
+**Annotation**: `rossoctl.io/mtls-mode: permissive` (or `strict` or `disabled`) on pod template.
 
 **Env var**: `MTLS_MODE=permissive` (or `strict` or `disabled`) on authbridge container.
 
@@ -34,7 +34,7 @@ spiffe:
 
 ## R3: Rolling Restart Mechanism (UPDATED)
 
-**Decision**: ~~mTLSMode flows through the config hash.~~ **Superseded per PR #405.** The controller sets a `kagenti.io/mtls-mode` annotation on the workload's pod template. When the annotation value changes (e.g., `permissive` → `strict`), Kubernetes detects a pod template change and triggers a rolling restart. This is independent of the platform config hash (`kagenti.io/config-hash`), which now only reflects cluster + namespace defaults.
+**Decision**: ~~mTLSMode flows through the config hash.~~ **Superseded per PR #405.** The controller sets a `rossoctl.io/mtls-mode` annotation on the workload's pod template. When the annotation value changes (e.g., `permissive` → `strict`), Kubernetes detects a pod template change and triggers a rolling restart. This is independent of the platform config hash (`rossoctl.io/config-hash`), which now only reflects cluster + namespace defaults.
 
 **Rationale**: PR #405 removes all CR-level fields from the config hash (2-layer merge: cluster + namespace only). A separate annotation preserves per-AgentRuntime mTLSMode restart semantics without conflating it with platform config.
 
diff --git a/specs/003-mtls-transport-security/spec.md b/specs/003-mtls-transport-security/spec.md
index d99d4456..372776be 100644
--- a/specs/003-mtls-transport-security/spec.md
+++ b/specs/003-mtls-transport-security/spec.md
@@ -11,7 +11,7 @@
 
 ## Scope
 
-Enable mutual TLS (mTLS) as the default transport security layer for two communication paths in the Kagenti platform:
+Enable mutual TLS (mTLS) as the default transport security layer for two communication paths in the Rossoctl platform:
 
 1. **Controller-to-agent** — the operator controller fetching agent cards and verifying agent identity over mTLS
 2. **Agent-to-agent** — inter-agent calls where both sides prove identity via SPIRE-issued X.509 certificates
@@ -26,7 +26,7 @@ All status updates (transport security, attested SPIFFE ID, mTLS readiness condi
 - AgentCard CRD removal — separate migration spec
 - Cross-cluster agent federation — future work
 - Bearer token / OAuth2 authorization — handled by authbridge, orthogonal to mTLS
-- Downstreaming logistics for kagenti-extensions — separate spike
+- Downstreaming logistics for rossocortex — separate spike
 - Webhook injector changes — existing spiffe-helper injection is sufficient
 
 ## Clarifications
@@ -42,7 +42,7 @@ All status updates (transport security, attested SPIFFE ID, mTLS readiness condi
 
 ## Current State — What Already Exists
 
-### Authbridge (kagenti-extensions) — DONE
+### Authbridge (rossocortex) — DONE
 
 mTLS is fully implemented in authbridge across all three proxy modes on main:
 
@@ -57,7 +57,7 @@ mTLS is fully implemented in authbridge across all three proxy modes on main:
 - Per-handshake certificate rotation from spiffe-helper files
 - `authtls.Metrics` for TLS handshake observability
 
-### Operator (kagenti-operator) — Partially Done
+### Operator (rossoctl-operator) — Partially Done
 
 - `MTLSMode` field on `AgentRuntimeSpec`: enum with values `disabled`, `permissive`, `strict` (defaults to `disabled`)
 - `CardStatus` struct on `AgentRuntimeStatus`: includes `TransportSecurity`, `AttestedAgentSpiffeID`, `ValidSignature`
@@ -173,14 +173,14 @@ The controller detects SPIRE availability by checking for the spiffe-helper init
 ### Functional Requirements
 
 - **FR-001**: The system MUST default `mTLSMode` to `permissive` when not explicitly set on an AgentRuntime CR.
-- **FR-002**: The controller MUST set a `kagenti.io/mtls-mode` annotation on the workload's pod template with the resolved `mTLSMode` value (`permissive`, `strict`, or `disabled`). The webhook reads this annotation (and/or the AgentRuntime CR directly) at pod CREATE time to configure the authbridge sidecar.
+- **FR-002**: The controller MUST set a `rossoctl.io/mtls-mode` annotation on the workload's pod template with the resolved `mTLSMode` value (`permissive`, `strict`, or `disabled`). The webhook reads this annotation (and/or the AgentRuntime CR directly) at pod CREATE time to configure the authbridge sidecar.
 - **FR-003**: The webhook MUST set the `MTLS_MODE` environment variable on the authbridge sidecar container based on the AgentRuntime's `mTLSMode` value. Authbridge reads this env var at startup to configure its TLS listeners.
 - **FR-004**: The system MUST set an `MTLSReady` condition on AgentRuntime status indicating whether mTLS infrastructure (SPIRE) is available.
 - **FR-005**: The system MUST use `SpiffeFetcher` (mTLS) as the default card fetcher when the controller has access to the SPIRE Workload API socket.
 - **FR-006**: The system MUST fall back to `DefaultFetcher` (plain HTTP) when SPIRE is not configured on the controller pod.
 - **FR-007**: The system MUST record `status.card.transportSecurity` as `mtls` or `http` on AgentRuntime to indicate which transport was used for the card fetch.
 - **FR-008**: The system MUST record `status.card.attestedAgentSpiffeID` on AgentRuntime with the SPIFFE ID extracted from the peer certificate when the card is fetched over mTLS.
-- **FR-009**: The system MUST trigger a rolling restart of the workload when `mTLSMode` changes. The controller sets a `kagenti.io/mtls-mode` annotation on the pod template; when this annotation value changes, Kubernetes triggers a rolling restart. This is independent of the platform config hash.
+- **FR-009**: The system MUST trigger a rolling restart of the workload when `mTLSMode` changes. The controller sets a `rossoctl.io/mtls-mode` annotation on the pod template; when this annotation value changes, Kubernetes triggers a rolling restart. This is independent of the platform config hash.
 - **FR-010**: The system MUST log deprecation warnings at operator startup when legacy JWS signing flags (`--require-a2a-signature`, `--signature-audit-mode`, `--enforce-network-policies`) are set to `true`.
 - **FR-011**: The system MUST default legacy JWS signing flags to `false`.
 - **FR-012**: The system MUST change the `--enable-verified-fetch` flag default to `true` (kill switch retained for one release cycle).
@@ -206,25 +206,25 @@ The controller detects SPIRE availability by checking for the spiffe-helper init
 ## Assumptions
 
 - SPIRE is deployed in the cluster and the SPIRE agent socket is accessible to both the controller pod and agent workload pods.
-- The authbridge mTLS implementation in kagenti-extensions (on main) is stable and tested.
+- The authbridge mTLS implementation in rossocortex (on main) is stable and tested.
 - Each agent workload has exactly one Pod (one-agent-per-pod model), so pod identity equals agent identity (SPIFFE ID).
 - The spiffe-helper sidecar is already injected by the webhook when `mTLSMode` is non-disabled — no changes to injection logic are needed.
 - The authbridge sidecar supports an `MTLS_MODE` environment variable to configure TLS listener mode at startup.
 
 ## Repositories Affected
 
-### kagenti-operator (primary)
+### rossoctl-operator (primary)
 
 | File | Change |
 |------|--------|
 | `api/v1alpha1/agentruntime_types.go` | Change `mTLSMode` default to `permissive`; add `MTLSReady` condition type |
-| `internal/controller/agentruntime_controller.go` | Set `kagenti.io/mtls-mode` annotation on pod template; set `MTLSReady` condition; use SpiffeFetcher by default |
+| `internal/controller/agentruntime_controller.go` | Set `rossoctl.io/mtls-mode` annotation on pod template; set `MTLSReady` condition; use SpiffeFetcher by default |
 | `internal/controller/agentruntime_controller_test.go` | Tests for mTLS annotation, default mTLS, MTLSReady condition |
 | `internal/webhook/injector/pod_mutator.go` | Read `mTLSMode` from AgentRuntime CR; set `MTLS_MODE` env var on authbridge container |
 | `cmd/main.go` | Default `--enable-verified-fetch` to `true`; default signing flags to `false`; add deprecation log warnings |
 | `config/crd/bases/` | Regenerate CRD manifests if type changes |
 
-### kagenti-extensions (verification + testing)
+### rossocortex (verification + testing)
 
 | File | Change |
 |------|--------|
diff --git a/specs/003-mtls-transport-security/tasks.md b/specs/003-mtls-transport-security/tasks.md
index 320e08cf..35fdccfb 100644
--- a/specs/003-mtls-transport-security/tasks.md
+++ b/specs/003-mtls-transport-security/tasks.md
@@ -18,7 +18,7 @@
 
 ## File Paths
 
-All paths are relative to `kagenti-operator/` (the Go module root inside the repo):
+All paths are relative to `operator/` (the Go module root inside the repo):
 
 - `api/v1alpha1/agentruntime_types.go` — CRD types
 - `internal/controller/agentruntime_controller.go` — main reconciler (has `fetchCard()`, conditions, etc.)
@@ -61,7 +61,7 @@ The following are already implemented and do NOT need new code:
 
 **CRITICAL**: No user story work can begin until this phase is complete
 
-- [ ] T005 [SUPERSEDED → REPLACED] Add `kagenti.io/mtls-mode` annotation to the workload's pod template in `internal/controller/agentruntime_controller.go`. In `applyWorkloadConfig()`, set the annotation value to the resolved `mTLSMode` (`permissive`, `strict`, or `disabled`). When `mTLSMode` changes on the AgentRuntime CR, the annotation value changes, causing Kubernetes to trigger a rolling restart. This replaces the previous ConfigMap-based approach — the webhook reads `mTLSMode` from the AgentRuntime CR at pod CREATE time and sets `MTLS_MODE` env var on the authbridge container. Update the webhook in `internal/webhook/injector/pod_mutator.go` to set this env var.
+- [ ] T005 [SUPERSEDED → REPLACED] Add `rossoctl.io/mtls-mode` annotation to the workload's pod template in `internal/controller/agentruntime_controller.go`. In `applyWorkloadConfig()`, set the annotation value to the resolved `mTLSMode` (`permissive`, `strict`, or `disabled`). When `mTLSMode` changes on the AgentRuntime CR, the annotation value changes, causing Kubernetes to trigger a rolling restart. This replaces the previous ConfigMap-based approach — the webhook reads `mTLSMode` from the AgentRuntime CR at pod CREATE time and sets `MTLS_MODE` env var on the authbridge container. Update the webhook in `internal/webhook/injector/pod_mutator.go` to set this env var.
 - [ ] T006 Add `MTLSReady` condition logic to the reconcile loop in `internal/controller/agentruntime_controller.go`. Insert after target resolution (around line 170) and before the Ready condition (line 251). Logic: if `mTLSMode` resolves to `disabled` or empty-before-default → `MTLSReady=True/MTLSDisabled`; if `permissive` or `strict` → check whether the workload's pod template has spiffe-helper volume mounts or the SPIRE agent socket mount → if present `MTLSReady=True/SPIREAvailable`, if absent `MTLSReady=False/SPIREUnavailable` with message `"mTLS requires SPIRE; either deploy SPIRE or set mTLSMode: disabled"`. Use `r.setCondition()` (existing helper). Follow save/restore pattern around Patch calls (Constitution I).
 
 **Checkpoint**: MTLSReady condition and mTLS annotation ready.
@@ -72,18 +72,18 @@ The following are already implemented and do NOT need new code:
 
 **Goal**: Agents deployed with SPIRE communicate over mTLS automatically without explicit mTLSMode configuration because mTLSMode defaults to permissive.
 
-**Independent Test**: Deploy two agent workloads with SPIRE, create AgentRuntimes with no explicit mTLSMode, verify the pod template has `kagenti.io/mtls-mode: permissive` annotation, authbridge sidecar has `MTLS_MODE=permissive` env var, and `MTLSReady=True`.
+**Independent Test**: Deploy two agent workloads with SPIRE, create AgentRuntimes with no explicit mTLSMode, verify the pod template has `rossoctl.io/mtls-mode: permissive` annotation, authbridge sidecar has `MTLS_MODE=permissive` env var, and `MTLSReady=True`.
 
 ### Tests for User Story 1
 
-- [ ] T007 [P] [US1] Add unit tests for `kagenti.io/mtls-mode` annotation in `internal/controller/agentruntime_controller_test.go`. Test cases: (a) mTLSMode unset (defaults to permissive via kubebuilder marker) → pod template annotation is `kagenti.io/mtls-mode: permissive`; (b) mTLSMode `strict` → annotation is `strict`; (c) mTLSMode `disabled` → annotation is `disabled`. Also test webhook: verify `MTLS_MODE` env var is set on authbridge container. Create objects in envtest and read back from API server (Constitution II).
+- [ ] T007 [P] [US1] Add unit tests for `rossoctl.io/mtls-mode` annotation in `internal/controller/agentruntime_controller_test.go`. Test cases: (a) mTLSMode unset (defaults to permissive via kubebuilder marker) → pod template annotation is `rossoctl.io/mtls-mode: permissive`; (b) mTLSMode `strict` → annotation is `strict`; (c) mTLSMode `disabled` → annotation is `disabled`. Also test webhook: verify `MTLS_MODE` env var is set on authbridge container. Create objects in envtest and read back from API server (Constitution II).
 - [ ] T008 [P] [US1] Add unit tests for `MTLSReady` condition in `internal/controller/agentruntime_controller_test.go`. Test cases: (a) mTLSMode permissive + spiffe-helper present → `MTLSReady=True/SPIREAvailable`; (b) mTLSMode permissive + no spiffe-helper → `MTLSReady=False/SPIREUnavailable`; (c) mTLSMode disabled → `MTLSReady=True/MTLSDisabled`. Read back AgentRuntime from envtest API server (Constitution II).
-- [ ] T009 [P] [US1] Add unit test for annotation change on mTLSMode transition in `internal/controller/agentruntime_controller_test.go`. Verify that changing mTLSMode from `permissive` to `strict` or `disabled` results in a different `kagenti.io/mtls-mode` annotation on the workload pod template, triggering a rolling restart. Note: mTLSMode is NOT in the config hash (per PR #405) — the annotation is the restart mechanism.
+- [ ] T009 [P] [US1] Add unit test for annotation change on mTLSMode transition in `internal/controller/agentruntime_controller_test.go`. Verify that changing mTLSMode from `permissive` to `strict` or `disabled` results in a different `rossoctl.io/mtls-mode` annotation on the workload pod template, triggering a rolling restart. Note: mTLSMode is NOT in the config hash (per PR #405) — the annotation is the restart mechanism.
 
 ### Implementation for User Story 1
 
-- [ ] T010 [US1] Wire T005 and T006 into the reconcile flow end-to-end. Create an AgentRuntime with no explicit mTLSMode, reconcile, verify: (a) the resolved mTLSMode is `permissive`; (b) the pod template has `kagenti.io/mtls-mode: permissive` annotation; (c) `MTLSReady` condition is set; (d) webhook sets `MTLS_MODE` env var on authbridge container.
-- [ ] T011 [US1] Verify that changing `mTLSMode` on an existing AgentRuntime triggers a workload rolling restart via the `kagenti.io/mtls-mode` annotation change on the pod template (NOT via config hash — mTLSMode is excluded from the hash per PR #405).
+- [ ] T010 [US1] Wire T005 and T006 into the reconcile flow end-to-end. Create an AgentRuntime with no explicit mTLSMode, reconcile, verify: (a) the resolved mTLSMode is `permissive`; (b) the pod template has `rossoctl.io/mtls-mode: permissive` annotation; (c) `MTLSReady` condition is set; (d) webhook sets `MTLS_MODE` env var on authbridge container.
+- [ ] T011 [US1] Verify that changing `mTLSMode` on an existing AgentRuntime triggers a workload rolling restart via the `rossoctl.io/mtls-mode` annotation change on the pod template (NOT via config hash — mTLSMode is excluded from the hash per PR #405).
 
 **Checkpoint**: Agent-to-agent mTLS defaults to permissive. Annotation and conditions correct.
 
@@ -146,12 +146,12 @@ The following are already implemented and do NOT need new code:
 
 ---
 
-## Phase 7: Authbridge Verification (kagenti-extensions)
+## Phase 7: Authbridge Verification (rossocortex)
 
 **Purpose**: Verify authbridge mTLS is complete and matches operator expectations
 
 - [x] T019 [DONE] Envoy mTLS wiring confirmed — webhook injector has `MTLSEnabled`, `MTLSPermissive`, `MTLSStrict` template fields driving envoy TLS contexts.
-- [ ] T020 [P] Verify the `cfg.MTLS` config schema in `authbridge/authlib/config/config.go` matches what the operator generates. Specifically: does the authbridge expect `mtls:\n  mode: permissive` or a different shape? Clone `kagenti-extensions` and check.
+- [ ] T020 [P] Verify the `cfg.MTLS` config schema in `authbridge/authlib/config/config.go` matches what the operator generates. Specifically: does the authbridge expect `mtls:\n  mode: permissive` or a different shape? Clone `rossocortex` and check.
 - [ ] T021 Add mTLS integration tests (if not already present in authbridge). Test: (a) permissive accepts TLS + plaintext; (b) strict rejects plaintext; (c) cert rotation.
 
 **Checkpoint**: Authbridge config contract verified.
@@ -174,7 +174,7 @@ The following are already implemented and do NOT need new code:
 | T002 | NEW | make generate && make manifests |
 | T003 | NEW | Flip two flag defaults to true |
 | T004 | NEW | Add deprecation warning logs (flag defaults already false) |
-| T005 | REPLACED | Set `kagenti.io/mtls-mode` annotation on pod template + webhook sets `MTLS_MODE` env var |
+| T005 | REPLACED | Set `rossoctl.io/mtls-mode` annotation on pod template + webhook sets `MTLS_MODE` env var |
 | T006 | NEW | MTLSReady condition logic in reconcile loop |
 | T007-T009 | NEW | Unit tests for annotation, condition, annotation change |
 | T010-T011 | NEW | End-to-end wiring verification |
diff --git a/token-broker/README.md b/token-broker/README.md
index fc3e2a6a..3054ed1b 100644
--- a/token-broker/README.md
+++ b/token-broker/README.md
@@ -1,16 +1,16 @@
 # Token Broker Service
 
-The Token Broker is a standalone Kagenti service that enables **HITL (Human-in-the-Loop) Authorization** — allowing agents to obtain additional user permissions at runtime, beyond those provided when the task was submitted.
+The Token Broker is a standalone Rossoctl service that enables **HITL (Human-in-the-Loop) Authorization** — allowing agents to obtain additional user permissions at runtime, beyond those provided when the task was submitted.
 
 ## Overview
 
-Kagenti supports three route types for outbound agent requests:
+Rossoctl supports three route types for outbound agent requests:
 
 - **Passthrough** — forward the token as-is
 - **Token Exchange** — use a subset of the permissions already in the agent's token
 - **Token Broker** — obtain additional permissions with the user's help (this service)
 
-The Token Broker handles the third case. When an agent needs to access an external or internal resource that requires permissions not already present in its token, the Token Broker brings the user into the loop via an OAuth 2.0 PKCE flow — obtaining just-in-time, user-scoped credentials. Neither the agent nor Kagenti ever holds the user's credentials; the Token Broker only caches the resulting access token and controls which agents (those in the same user session) may use it.
+The Token Broker handles the third case. When an agent needs to access an external or internal resource that requires permissions not already present in its token, the Token Broker brings the user into the loop via an OAuth 2.0 PKCE flow — obtaining just-in-time, user-scoped credentials. Neither the agent nor Rossoctl ever holds the user's credentials; the Token Broker only caches the resulting access token and controls which agents (those in the same user session) may use it.
 
 The Token Broker:
 - **Acts as the OAuth client** with OAuth credentials (client_id, client_secret)
@@ -117,8 +117,8 @@ export OAUTH_CLIENT_ID=Ov23liXXXXXXXXXXXXXX
 export OAUTH_CLIENT_SECRET=your_oauth_app_secret
 export OAUTH_CALLBACK_URL=https://token-broker.example.com/oauth/callback
 export ALLOWED_REDIRECT_HOSTS=app.example.com
-export JWT_JWKS_URL=https://keycloak.example.com/realms/kagenti/protocol/openid-connect/certs
-export JWT_ISSUER=https://keycloak.example.com/realms/kagenti
+export JWT_JWKS_URL=https://keycloak.example.com/realms/rossoctl/protocol/openid-connect/certs
+export JWT_ISSUER=https://keycloak.example.com/realms/rossoctl
 export TOKEN_BROKER_SESSION_TIMEOUT=60s
 export TOKEN_BROKER_MAX_SESSIONS_PER_USER=5
 export TOKEN_BROKER_TOKEN_WAIT_TIMEOUT=300s
diff --git a/token-broker/cmd/main.go b/token-broker/cmd/main.go
index b5bc1a3d..bea557dc 100644
--- a/token-broker/cmd/main.go
+++ b/token-broker/cmd/main.go
@@ -30,12 +30,12 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
-	"github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins/jwtvalidation/validation"
-	"github.com/kagenti/token-broker/internal/api"
-	"github.com/kagenti/token-broker/internal/cache"
-	"github.com/kagenti/token-broker/internal/core"
-	"github.com/kagenti/token-broker/internal/oauth"
-	"github.com/kagenti/token-broker/internal/session"
+	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation/validation"
+	"github.com/rossoctl/token-broker/internal/api"
+	"github.com/rossoctl/token-broker/internal/cache"
+	"github.com/rossoctl/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/oauth"
+	"github.com/rossoctl/token-broker/internal/session"
 )
 
 // Config holds the Token Broker configuration.
diff --git a/token-broker/deploy/00-serviceaccount.yaml b/token-broker/deploy/00-serviceaccount.yaml
index 35533c73..3da6da8a 100644
--- a/token-broker/deploy/00-serviceaccount.yaml
+++ b/token-broker/deploy/00-serviceaccount.yaml
@@ -7,6 +7,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: token-broker
-  namespace: kagenti-system
+  namespace: rossoctl-system
   labels:
     app: token-broker
diff --git a/token-broker/deploy/01-secret.example.yaml b/token-broker/deploy/01-secret.example.yaml
index ec224f6b..74e04e46 100644
--- a/token-broker/deploy/01-secret.example.yaml
+++ b/token-broker/deploy/01-secret.example.yaml
@@ -5,7 +5,7 @@
 # these keys to an external secret store (e.g. ExternalSecrets / Vault).
 #
 # Create directly without committing a file:
-#   kubectl create secret generic github-oauth-credentials -n kagenti-system \
+#   kubectl create secret generic github-oauth-credentials -n rossoctl-system \
 #     --from-literal=client-id=<CLIENT_ID> \
 #     --from-literal=client-secret=<CLIENT_SECRET>
 ---
@@ -13,7 +13,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: github-oauth-credentials
-  namespace: kagenti-system
+  namespace: rossoctl-system
   labels:
     app: token-broker
 type: Opaque
diff --git a/token-broker/deploy/02-deployment.yaml b/token-broker/deploy/02-deployment.yaml
index 51323fc6..ea767f01 100644
--- a/token-broker/deploy/02-deployment.yaml
+++ b/token-broker/deploy/02-deployment.yaml
@@ -10,7 +10,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: token-broker
-  namespace: kagenti-system
+  namespace: rossoctl-system
   labels:
     app: token-broker
 spec:
@@ -62,9 +62,9 @@ spec:
             # JWT_ISSUER:   Expected issuer claim in incoming JWTs.
             # JWT_AUDIENCE: Comma-separated expected audience(s).
             # - name: JWT_JWKS_URL
-            #   value: "https://keycloak.example.com/realms/kagenti/protocol/openid-connect/certs"
+            #   value: "https://keycloak.example.com/realms/rossoctl/protocol/openid-connect/certs"
             # - name: JWT_ISSUER
-            #   value: "https://keycloak.example.com/realms/kagenti"
+            #   value: "https://keycloak.example.com/realms/rossoctl"
             # - name: JWT_AUDIENCE
             #   value: "token-broker"
             # Optional tunables (defaults in cmd/token-broker/main.go):
@@ -87,7 +87,7 @@ spec:
             - name: RESOURCE_CONFIG
               value: >-
                 {
-                  "http://mcp-server-service.kagenti-demo.svc.cluster.local:8184": {"scopes": ["read:user", "user:email"]}
+                  "http://mcp-server-service.rossoctl-demo.svc.cluster.local:8184": {"scopes": ["read:user", "user:email"]}
                 }
           livenessProbe:
             httpGet:
diff --git a/token-broker/deploy/03-service.yaml b/token-broker/deploy/03-service.yaml
index 848839bc..9732a5c4 100644
--- a/token-broker/deploy/03-service.yaml
+++ b/token-broker/deploy/03-service.yaml
@@ -1,13 +1,13 @@
 # Token Broker Service (in-cluster).
 #
 # Consumed by AuthBridge and the Backend at:
-#   http://token-broker.kagenti-system.svc.cluster.local:8190
+#   http://token-broker.rossoctl-system.svc.cluster.local:8190
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: token-broker
-  namespace: kagenti-system
+  namespace: rossoctl-system
   labels:
     app: token-broker
 spec:
diff --git a/token-broker/deploy/04-httproute.yaml b/token-broker/deploy/04-httproute.yaml
index 50a9118a..91764c3f 100644
--- a/token-broker/deploy/04-httproute.yaml
+++ b/token-broker/deploy/04-httproute.yaml
@@ -5,12 +5,12 @@
 # /oauth/callback on the broker — otherwise the redirect 404s and the broker
 # waits for a callback that never arrives.
 #
-# This route lives in kagenti-system (same namespace as the Service AND the
+# This route lives in rossoctl-system (same namespace as the Service AND the
 # gateway), so:
-#   - the parentRef is local (gateway "http" in kagenti-system), and
+#   - the parentRef is local (gateway "http" in rossoctl-system), and
 #   - the backendRef is same-namespace, so NO ReferenceGrant is needed.
 #
-# The kagenti-system namespace carries the label shared-gateway-access: "true",
+# The rossoctl-system namespace carries the label shared-gateway-access: "true",
 # which the "http" gateway's listener selects — same as the working app-demo route.
 #
 # The hostname MUST match the host in the Deployment's OAUTH_CALLBACK_URL.
@@ -19,13 +19,13 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: token-broker-oauth-callback
-  namespace: kagenti-system
+  namespace: rossoctl-system
   labels:
     app: token-broker
 spec:
   parentRefs:
     - name: http
-      namespace: kagenti-system
+      namespace: rossoctl-system
   hostnames:
     - "token-broker.localtest.me"
   rules:
diff --git a/token-broker/deploy/README.md b/token-broker/deploy/README.md
index 2944f2e2..c2f4770d 100644
--- a/token-broker/deploy/README.md
+++ b/token-broker/deploy/README.md
@@ -1,7 +1,7 @@
 # Token Broker — Kubernetes deployment
 
 Manifests that accompany the `token-broker` image produced by the build script.
-All objects live in the `kagenti-system` namespace.
+All objects live in the `rossoctl-system` namespace.
 
 ## Manifests (apply in order)
 
@@ -10,7 +10,7 @@ All objects live in the `kagenti-system` namespace.
 | `00-serviceaccount.yaml` | ServiceAccount | No RBAC — the broker does not call the Kubernetes API. |
 | `01-secret.example.yaml` | Secret (template) | OAuth client credentials. **Do not commit real values** — see below. |
 | `02-deployment.yaml` | Deployment | Set `image:` and `OAUTH_CALLBACK_URL`. `replicas: 1` (in-memory state). |
-| `03-service.yaml` | Service (ClusterIP) | `token-broker.kagenti-system.svc.cluster.local:8190`. |
+| `03-service.yaml` | Service (ClusterIP) | `token-broker.rossoctl-system.svc.cluster.local:8190`. |
 | `04-httproute.yaml` | HTTPRoute | Exposes `GET /oauth/callback` via the shared `http` gateway. |
 
 ## Credentials
@@ -18,7 +18,7 @@ All objects live in the `kagenti-system` namespace.
 Do not apply `01-secret.example.yaml` as-is. Create the secret out of band:
 
 ```sh
-kubectl create secret generic github-oauth-credentials -n kagenti-system \
+kubectl create secret generic github-oauth-credentials -n rossoctl-system \
   --from-literal=client-id=<CLIENT_ID> \
   --from-literal=client-secret=<CLIENT_SECRET>
 ```
@@ -39,18 +39,18 @@ URL; the gateway routes the host + `/oauth/callback` to the broker. A mismatch
 (or a missing/unattached route) makes the post-consent redirect 404, and the
 broker then blocks waiting for a callback that never arrives.
 
-The route attaches to the gateway `http` in `kagenti-system`. That listener
+The route attaches to the gateway `http` in `rossoctl-system`. That listener
 admits routes from namespaces labelled `shared-gateway-access: "true"`, which
-`kagenti-system` already carries.
+`rossoctl-system` already carries.
 
 ## Migrating from the old ad-hoc objects
 
-Earlier deployments placed the HTTPRoute in `kagenti-demo` with a parentRef to a
-non-existent `kagenti-gateway`/`istio-system`, which never attached (404 on the
-callback). The token broker does not deploy into `kagenti-demo`. Remove the
+Earlier deployments placed the HTTPRoute in `rossoctl-demo` with a parentRef to a
+non-existent `rossoctl-gateway`/`istio-system`, which never attached (404 on the
+callback). The token broker does not deploy into `rossoctl-demo`. Remove the
 stale objects:
 
 ```sh
-kubectl delete httproute token-broker-oauth-callback -n kagenti-demo --ignore-not-found
-kubectl delete referencegrant allow-demo-httproute-to-token-broker -n kagenti-system --ignore-not-found
+kubectl delete httproute token-broker-oauth-callback -n rossoctl-demo --ignore-not-found
+kubectl delete referencegrant allow-demo-httproute-to-token-broker -n rossoctl-system --ignore-not-found
 ```
diff --git a/token-broker/docs/API_SPECIFICATION.md b/token-broker/docs/API_SPECIFICATION.md
index afce08a1..df841db9 100644
--- a/token-broker/docs/API_SPECIFICATION.md
+++ b/token-broker/docs/API_SPECIFICATION.md
@@ -71,7 +71,7 @@ The AuthBridge Sidecar calls the Token Broker to obtain OAuth tokens for resourc
 
 **Purpose**: Request an OAuth token for a specific resource server using JWT-based authentication. This call blocks until the token is available or the request times out.
 
-**Called By**: AuthBridge Sidecar (from kagenti-extensions/authbridge)
+**Called By**: AuthBridge Sidecar (from rossocortex/authbridge)
 
 **Authentication**: JWT Bearer token containing user ID and session key
 
diff --git a/token-broker/docs/ARCHITECTURE.md b/token-broker/docs/ARCHITECTURE.md
index 42ba4416..ce284f89 100644
--- a/token-broker/docs/ARCHITECTURE.md
+++ b/token-broker/docs/ARCHITECTURE.md
@@ -4,7 +4,7 @@
 
 The Token Broker enables **HITL (Human-in-the-Loop) Authorization**: when an agent needs access to a resource that requires OAuth permissions not already present in its token, the Token Broker brings the user into the loop via an OAuth 2.0 PKCE flow and caches the resulting access token for the session.
 
-Kagenti supports three route types for outbound agent requests:
+Rossoctl supports three route types for outbound agent requests:
 - **Passthrough** — forward the token as-is
 - **Token Exchange** — use a subset of permissions already in the agent's token
 - **Token Broker** — obtain additional permissions with the user's help (this service)
diff --git a/token-broker/go.mod b/token-broker/go.mod
index 0ea5ff9e..a71ba910 100644
--- a/token-broker/go.mod
+++ b/token-broker/go.mod
@@ -1,11 +1,11 @@
-module github.com/kagenti/token-broker
+module github.com/rossoctl/token-broker
 
 go 1.26.0
 
 require (
 	github.com/go-chi/chi/v5 v5.3.0
 	github.com/google/uuid v1.6.0
-	github.com/kagenti/kagenti-extensions/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8
+	github.com/rossoctl/rossocortex/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8
 	github.com/stretchr/testify v1.10.0
 )
 
diff --git a/token-broker/go.sum b/token-broker/go.sum
index 7bcbc58f..68ec00ae 100644
--- a/token-broker/go.sum
+++ b/token-broker/go.sum
@@ -9,8 +9,6 @@ github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
 github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/kagenti/kagenti-extensions/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8 h1:O5bcG8b5QGbIOGUVOFwrEBHso5pwmaRWg9UNC8OtxFI=
-github.com/kagenti/kagenti-extensions/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8/go.mod h1:C9cgtHUtuGLTO/dl0xbXL2zflPwopI2SE0UqDf5C/lA=
 github.com/lestrrat-go/blackmagic v1.0.3 h1:94HXkVLxkZO9vJI/w2u1T0DAoprShFd13xtnSINtDWs=
 github.com/lestrrat-go/blackmagic v1.0.3/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
diff --git a/token-broker/internal/api/handlers.go b/token-broker/internal/api/handlers.go
index eecf2d30..8ca4505b 100644
--- a/token-broker/internal/api/handlers.go
+++ b/token-broker/internal/api/handlers.go
@@ -10,9 +10,9 @@ import (
 	"net/url"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins/jwtvalidation/validation"
-	"github.com/kagenti/token-broker/internal/auth"
-	"github.com/kagenti/token-broker/internal/core"
+	"github.com/rossoctl/rossocortex/authbridge/authlib/plugins/jwtvalidation/validation"
+	"github.com/rossoctl/token-broker/internal/auth"
+	"github.com/rossoctl/token-broker/internal/core"
 )
 
 // TokenBroker defines the interface for token acquisition operations.
diff --git a/token-broker/internal/api/handlers_test.go b/token-broker/internal/api/handlers_test.go
index 78e9810f..fd041553 100644
--- a/token-broker/internal/api/handlers_test.go
+++ b/token-broker/internal/api/handlers_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/kagenti/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/core"
 )
 
 // mockBroker implements a mock TokenBroker for testing
diff --git a/token-broker/internal/cache/token_cache.go b/token-broker/internal/cache/token_cache.go
index 84f72c78..85e1703a 100644
--- a/token-broker/internal/cache/token_cache.go
+++ b/token-broker/internal/cache/token_cache.go
@@ -6,7 +6,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/kagenti/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/core"
 )
 
 // TokenEntry represents a cached token.
diff --git a/token-broker/internal/cache/token_cache_test.go b/token-broker/internal/cache/token_cache_test.go
index f7bae304..d7455446 100644
--- a/token-broker/internal/cache/token_cache_test.go
+++ b/token-broker/internal/cache/token_cache_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/kagenti/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/core"
 )
 
 // FakeClock implements core.Clock for testing.
diff --git a/token-broker/internal/core/broker.go b/token-broker/internal/core/broker.go
index 3966690c..19f966af 100644
--- a/token-broker/internal/core/broker.go
+++ b/token-broker/internal/core/broker.go
@@ -6,8 +6,8 @@ import (
 	"log/slog"
 	"time"
 
-	"github.com/kagenti/token-broker/internal/oauth"
-	pkgauth "github.com/kagenti/token-broker/pkg/oauth"
+	"github.com/rossoctl/token-broker/internal/oauth"
+	pkgauth "github.com/rossoctl/token-broker/pkg/oauth"
 )
 
 // TokenBroker orchestrates token acquisition for OAuth sessions.
diff --git a/token-broker/internal/core/broker_test.go b/token-broker/internal/core/broker_test.go
index d0cccd86..7993296f 100644
--- a/token-broker/internal/core/broker_test.go
+++ b/token-broker/internal/core/broker_test.go
@@ -8,10 +8,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/kagenti/token-broker/internal/cache"
-	"github.com/kagenti/token-broker/internal/core"
-	"github.com/kagenti/token-broker/internal/oauth"
-	"github.com/kagenti/token-broker/internal/session"
+	"github.com/rossoctl/token-broker/internal/cache"
+	"github.com/rossoctl/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/oauth"
+	"github.com/rossoctl/token-broker/internal/session"
 )
 
 // TestAcquireToken_UnblocksOnSessionEnd verifies that ending a session while a
diff --git a/token-broker/internal/core/interfaces.go b/token-broker/internal/core/interfaces.go
index b3f8b7c7..e6b2be04 100644
--- a/token-broker/internal/core/interfaces.go
+++ b/token-broker/internal/core/interfaces.go
@@ -5,7 +5,7 @@ import (
 	"context"
 	"time"
 
-	pkgauth "github.com/kagenti/token-broker/pkg/oauth"
+	pkgauth "github.com/rossoctl/token-broker/pkg/oauth"
 )
 
 // SessionStore manages OAuth sessions and their lifecycle.
diff --git a/token-broker/internal/oauth/client.go b/token-broker/internal/oauth/client.go
index ff22ac4d..5caccd37 100644
--- a/token-broker/internal/oauth/client.go
+++ b/token-broker/internal/oauth/client.go
@@ -11,7 +11,7 @@ import (
 	"strings"
 
 	// Reuse existing PKCE implementation
-	pkgauth "github.com/kagenti/token-broker/pkg/oauth"
+	pkgauth "github.com/rossoctl/token-broker/pkg/oauth"
 )
 
 // Config holds OAuth client configuration for the Token Broker.
diff --git a/token-broker/internal/session/manager.go b/token-broker/internal/session/manager.go
index b4a5b4cf..8eced380 100644
--- a/token-broker/internal/session/manager.go
+++ b/token-broker/internal/session/manager.go
@@ -6,7 +6,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/kagenti/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/core"
 )
 
 // SessionManager manages OAuth sessions and their lifecycle.
diff --git a/token-broker/internal/session/manager_test.go b/token-broker/internal/session/manager_test.go
index 947ebfe3..1fcf5852 100644
--- a/token-broker/internal/session/manager_test.go
+++ b/token-broker/internal/session/manager_test.go
@@ -8,7 +8,7 @@ import (
 	"os"
 
 	"github.com/google/uuid"
-	"github.com/kagenti/token-broker/internal/core"
+	"github.com/rossoctl/token-broker/internal/core"
 )
 
 // FakeClock for testing