diff --git a/.github/ISSUE_TEMPLATE/3-bug-report.yml b/.github/ISSUE_TEMPLATE/3-bug-report.yml
index 64c1665..fadbc38 100644
--- a/.github/ISSUE_TEMPLATE/3-bug-report.yml
+++ b/.github/ISSUE_TEMPLATE/3-bug-report.yml
@@ -38,10 +38,10 @@ body:
- type: input
id: version
attributes:
- label: Kagenti Version
+ label: Rossoctl Version
description: |
- If this bug is for the Kagenti platform, which version were you running? Check with:
- helm list -n kagenti-system (app version column), or the git tag you checked out.
+ If this bug is for the Rossoctl platform, which version were you running? Check with:
+ helm list -n rossoctl-system (app version column), or the git tag you checked out.
placeholder: "v0.6.0"
validations:
required: false
diff --git a/.github/ISSUE_TEMPLATE/4-epic.yml b/.github/ISSUE_TEMPLATE/4-epic.yml
index 4e4b308..d7820f2 100644
--- a/.github/ISSUE_TEMPLATE/4-epic.yml
+++ b/.github/ISSUE_TEMPLATE/4-epic.yml
@@ -38,7 +38,7 @@ body:
attributes:
label: Success criteria
placeholder: |
- - [ ] (Example) X is integrated with Kagenti
+ - [ ] (Example) X is integrated with Rossoctl
validations:
required: true
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 941cfc1..d7fc4c8 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,7 +1,7 @@
`). After the event, these elements should be removed or replaced with the next event.
-
-## Design System
-
-The site uses the Red Hat Design System token palette and typefaces:
-
-- **Red Hat Display** — hero headline
-- **Red Hat Text** — body copy
-- **Red Hat Mono** — code samples and labels
-- Colors follow RHDS tokens; all text meets WCAG AA contrast (4.5:1 minimum)
+| Path | Purpose |
+|------|---------|
+| `ecosystem/` | Landing + ecosystem guide (served at `/`) |
+| `docs/` | **Synced** from `rossoctl/rossoctl:docs/` (git-ignored) |
+| `contributing/` | Contributing docs instance |
+| `src/`, `static/` | Theme customizations, CSS, and assets |
+| `scripts/sync-docs.sh` | Docs sync from the source repo |
-## Files
+## Contributing
-| File | Purpose |
-|------|---------|
-| `index.html` | Main marketing page |
-| `talk-to-us.html` | Contact / demo request page |
-| `privacy.html` | Privacy policy |
-| `style.css` | All styles, using CSS custom property token system |
-| `script.js` | Tab carousel, banner dismiss, GA4 consent logic, CTA tracking |
-| `img/kagenti-ui-light.png` | Dashboard screenshot — light mode |
-| `img/kagenti-ui-dark.png` | Dashboard screenshot — dark mode |
-| `favicon.svg` | Kagenti logo mark |
+Commits require **DCO sign-off** (`git commit -s`). See [`CLAUDE.md`](./CLAUDE.md)
+for the sign-off and attribution policy, and enable the hook with
+`git config core.hooksPath scripts/hooks`.
diff --git a/docusaurus.config.ts b/docusaurus.config.ts
new file mode 100644
index 0000000..405e241
--- /dev/null
+++ b/docusaurus.config.ts
@@ -0,0 +1,250 @@
+import {themes as prismThemes} from 'prism-react-renderer';
+import type {Config} from '@docusaurus/types';
+import type * as Preset from '@docusaurus/preset-classic';
+
+// This runs in Node.js - Don't use client-side code here (browser APIs, JSX...)
+
+const config: Config = {
+ title: 'rossoctl',
+ tagline:
+ 'A framework-neutral, scalable, secure platform for deploying, securing, and governing AI agents.',
+ favicon: 'img/favicon.svg',
+
+ // Note: the `future.v4`/`experimental_faster` (Rspack) bundler is intentionally
+ // NOT enabled — it requires the extra @docusaurus/faster native package. The
+ // default webpack bundler keeps this setup minimal and portable. Re-add
+ // `@docusaurus/faster` + `future: { experimental_faster: true }` if build
+ // speed becomes a concern.
+
+ // === GitHub Pages: deployed from the rossoctl/.github repo ===
+ // Served today at https://rossoctl.github.io/.github/ (project-page path =
+ // repo name ".github"). When a custom domain is added, flip baseUrl to '/'
+ // and drop a static/CNAME file (change all four below together).
+ // On GitHub Pages this is a project page served at rossoctl.github.io/.github/.
+ // On Netlify PR previews the site is served at the domain root, so baseUrl must
+ // be '/' there (Netlify sets NETLIFY=true and DEPLOY_PRIME_URL). When the
+ // rossoctl.dev custom domain is added, baseUrl becomes '/' everywhere.
+ url: process.env.DEPLOY_PRIME_URL || 'https://rossoctl.github.io',
+ baseUrl: process.env.NETLIFY ? '/' : '/.github/',
+ organizationName: 'rossoctl', // GitHub org that owns the repo
+ projectName: '.github', // repo name -> drives the Pages path
+
+ // Relaxed to 'warn' so the docs synced from rossoctl/rossoctl:docs/ (which
+ // still contain some cross-repo relative links) don't fail the Pages build.
+ // Tighten to 'throw' once the upstream docs links are cleaned up.
+ onBrokenLinks: 'warn',
+
+ markdown: {
+ // 'detect' = .md files render as (lenient) CommonMark, .mdx as MDX. Lets the
+ // synced upstream GitHub-flavored .md render without MDX parse errors on bare
+ // '<', '{', or raw HTML. Our own .mdx pages keep MDX powers.
+ format: 'detect',
+ mermaid: true, // render ```mermaid fenced blocks as diagrams (used by the docs)
+ hooks: {
+ onBrokenMarkdownLinks: 'warn',
+ },
+ },
+
+ i18n: {
+ defaultLocale: 'en',
+ locales: ['en'],
+ },
+
+ presets: [
+ [
+ 'classic',
+ {
+ // === TEMPORARY: docs hidden until ready for public launch ===
+ // The docs aren't ready to go public yet; the landing page and other
+ // pages ship first. `docs: false` stops Docusaurus from generating any
+ // /docs/* routes at all, so they're unreachable by direct URL, search,
+ // and sitemap — not merely hidden from the navbar. Doc authoring
+ // continues upstream in rossoctl/rossoctl:docs/.
+ // TO RESTORE: delete `docs: false` and uncomment the block below.
+ docs: false,
+ /* docs: {
+ // Read docs from a local docs/ folder that mirrors the source of
+ // truth 1:1. This folder is NOT committed — scripts/sync-docs.sh syncs
+ // it from rossoctl/rossoctl:docs/ at build time. routeBasePath keeps
+ // the public URLs at /docs/* and the navbar label is "Docs".
+ path: 'docs',
+ routeBasePath: 'docs',
+ sidebarPath: './sidebars.ts',
+ // "Edit this page" points at the source of truth upstream.
+ editUrl: 'https://github.com/rossoctl/rossoctl/tree/main/docs/',
+ // Versioning: the current (un-versioned) docs are the in-progress
+ // "dev" docs, shown in the header version dropdown. No released
+ // versions exist yet. When the first is cut
+ // (`npm run docusaurus docs:version 0.7`), it becomes the default
+ // "latest" and "dev" stays as the work-in-progress version.
+ versions: {
+ current: {
+ label: 'dev',
+ },
+ },
+ }, */
+ // Blog is an EXTERNAL Medium link (see navbar) — no local blog.
+ blog: false,
+ theme: {
+ customCss: './src/css/custom.css',
+ },
+ sitemap: {
+ changefreq: 'weekly',
+ priority: 0.5,
+ filename: 'sitemap.xml',
+ },
+ } satisfies Preset.Options,
+ ],
+ ],
+
+ plugins: [
+ // Offline, build-time full-text search. No external service.
+ [require.resolve('docusaurus-lunr-search'), {languages: ['en']}],
+ // Dedicated docs instance for the Contributing section, so /contributing
+ // renders with the SAME layout as docs (breadcrumb, content position,
+ // typography) instead of a bespoke standalone page. Same pattern llm-d
+ // uses for its Community section.
+ [
+ '@docusaurus/plugin-content-docs',
+ {
+ id: 'contributing',
+ path: 'contributing',
+ routeBasePath: 'contributing',
+ sidebarPath: './sidebarsContributing.ts',
+ editUrl: 'https://github.com/Ibrahim2595/rossoctl-website/tree/main/',
+ },
+ ],
+ // "Ecosystem Guide" — a faithful recreation of rossoctl/ecosystem-guide,
+ // rebranded to rossoctl. This instance IS the site landing experience:
+ // routeBasePath '/' serves it at the site root, and welcome.md (slug '/')
+ // is the homepage, reproducing the upstream Welcome/README page inside the
+ // normal docs layout (left sidebar + content), NOT a custom hero. The
+ // sidebar groups mirror that repo's mkdocs.yml nav. Pages: About,
+ // Onboarding, Workstreams, Key Dates, Content, Resources.
+ [
+ '@docusaurus/plugin-content-docs',
+ {
+ id: 'ecosystem',
+ path: 'ecosystem',
+ routeBasePath: '/',
+ sidebarPath: './sidebarsEcosystem.ts',
+ editUrl:
+ 'https://github.com/rossoctl/ecosystem-guide/tree/main/content/',
+ },
+ ],
+ ],
+
+ // Enables Mermaid diagram rendering (paired with markdown.mermaid: true).
+ themes: ['@docusaurus/theme-mermaid'],
+
+ themeConfig: {
+ image: 'img/logo.svg',
+ colorMode: {
+ respectPrefersColorScheme: true,
+ },
+ navbar: {
+ title: 'rossoctl',
+ logo: {
+ alt: 'rossoctl',
+ src: 'img/logo.svg',
+ // clicking the logo/title goes to '/', the landing page
+ },
+ items: [
+ // === TEMPORARY: "Documentation" nav item hidden until docs go public. ===
+ // TO RESTORE: uncomment this item (requires re-enabling `docs` in the preset above).
+ /* {
+ type: 'docSidebar',
+ sidebarId: 'docsSidebar',
+ position: 'left',
+ label: 'Documentation',
+ }, */
+ {
+ // Single "Contributing" page rendered from the contributing docs
+ // instance (docs layout + breadcrumbs). Content mirrors rossoctl's
+ // CONTRIBUTING.md.
+ type: 'docSidebar',
+ sidebarId: 'contributingSidebar',
+ docsPluginId: 'contributing',
+ position: 'left',
+ label: 'Contributing',
+ },
+ {
+ // EXTERNAL blog — opens in a new tab.
+ href: 'https://medium.com/kagenti-the-agentic-platform',
+ label: 'Blog',
+ position: 'left',
+ target: '_blank',
+ rel: 'noopener noreferrer',
+ },
+ // === TEMPORARY: "dev" version dropdown hidden until docs go public. ===
+ // It only links into /docs/*, so it's removed while docs are unpublished.
+ // TO RESTORE: uncomment this item (requires re-enabling `docs` in the preset above).
+ /* {
+ // Docs version selector, on the left after Blog. Rendered as an
+ // explicit dropdown (caret + menu) because Docusaurus collapses its
+ // built-in `docsVersionDropdown` to a plain link while only one
+ // version exists. Selecting "dev" opens the first docs page
+ // (Getting Started). When v0.7 is cut, replace this with
+ // `{ type: 'docsVersionDropdown', position: 'left' }` — it will then
+ // auto-list v0.7 (latest) and dev.
+ type: 'dropdown',
+ label: 'dev',
+ position: 'left',
+ items: [
+ {
+ label: 'dev',
+ to: '/docs/category/getting-started',
+ },
+ ],
+ }, */
+ {
+ // Live GitHub star count (icon + "N stars"), fetched client-side.
+ // See src/components/GitHubStars + theme/NavbarItem/ComponentTypes.
+ type: 'custom-gitHubStars',
+ position: 'right',
+ repo: 'rossoctl/rossoctl',
+ },
+ {
+ // Slack icon + small "Join Slack" label (see .header-slack-link in custom.css).
+ href: 'https://ibm.biz/kagenti-slack',
+ position: 'right',
+ className: 'header-slack-link',
+ label: 'Join Slack',
+ 'aria-label': 'Slack community',
+ },
+ ],
+ },
+ footer: {
+ style: 'dark',
+ logo: {
+ alt: 'rossoctl',
+ src: 'img/logo.svg',
+ width: 22,
+ height: 22,
+ },
+ // Design footer: brand + a left-aligned row of doc links, no copyright.
+ // (The mock's "Intro to llm-d" is an llm-d template leftover — replaced
+ // with rossoctl-appropriate doc links.)
+ links: [
+ {
+ items: [
+ // === TEMPORARY: docs footer links hidden until docs go public. ===
+ // TO RESTORE: uncomment these four links.
+ // {label: 'Documentation', to: '/docs/category/getting-started'},
+ // {label: 'Quickstart', to: '/docs/getting-started/quickstart'},
+ // {label: 'Architecture', to: '/docs/concepts/architecture'},
+ // {label: 'Guides', to: '/docs/category/guides'},
+ {label: 'Contributing', to: '/contributing'},
+ ],
+ },
+ ],
+ },
+ prism: {
+ theme: prismThemes.github,
+ darkTheme: prismThemes.dracula,
+ additionalLanguages: ['bash', 'yaml', 'json', 'go'],
+ },
+ } satisfies Preset.ThemeConfig,
+};
+
+export default config;
diff --git a/ecosystem/content.md b/ecosystem/content.md
new file mode 100644
index 0000000..b1d03f9
--- /dev/null
+++ b/ecosystem/content.md
@@ -0,0 +1,21 @@
+# Content
+
+| Date | Title | Authors | Source | Type |
+|------|-------|---------|--------|------|
+| Apr 2026 | [The AI-Native Pivot: What KubeCon Amsterdam 2026 Taught Me About Production Infrastructure](https://medium.com/@osw.gom89/the-ai-native-pivot-what-kubecon-amsterdam-2026-taught-me-about-production-infrastructure-e5fd438c1244) | Oswaldo Gomez | Medium | Blog |
+| Apr 2026 | [Deploying agents with Red Hat AI: The curious case of OpenClaw](https://developers.redhat.com/articles/2026/04/14/deploying-agents-red-hat-ai-openclaw) | Nati Fridman, Sally O'Malley, Adel Zaalouk | Red Hat Developer | Blog |
+| Mar 2026 | [Operationalizing "Bring Your Own Agent" on Red Hat AI, the OpenClaw Edition](https://www.redhat.com/en/blog/operationalizing-bring-your-own-agent-red-hat-ai-openclaw-edition) | Adel Zaalouk | Red Hat Blog | Blog |
+| Mar 2026 | [Kagenti - A Kubernetes Control Plane for AI Agents](https://www.thecloudcast.net/2026/03/kagenti-kubernetes-control-plane-for-ai.html) | Morgan Foster | The Reasoning Show | Podcast |
+| Mar 2026 | [Using containers to bring software engineering rigor to AI workloads](https://www.redhat.com/en/blog/using-containers-bring-software-engineering-rigor-ai-workloads) | Ann Marie Fred | Red Hat Blog | Blog |
+| Feb 2026 | [Don't Teach Your Agents Karate](https://adelzaalouk.me/2026/Feb/22/agent-access-control-zero-code-security/) | Adel Zaalouk | adelzaalouk.me | Blog |
+| Mar 2026 | [Zero trust AI agents on Kubernetes](https://next.redhat.com/2026/03/05/zero-trust-ai-agents-on-kubernetes-what-i-learned-deploying-multi-agent-systems-on-kagenti/) | Roy Belio | Red Hat Emerging Technologies | Blog |
+| Dec 2025 | [Advanced authentication and authorization for MCP Gateway](https://developers.redhat.com/articles/2025/12/12/advanced-authentication-authorization-mcp-gateway) | Guilherme Cassolato | Red Hat Developer | Blog |
+| Dec 2025 | [Developer Guide: Building a Cloud-Native Agent for Kagenti](https://medium.com/kagenti-the-agentic-platform/developer-guide-building-a-cloud-native-agent-for-kagenti-5bd0dc4dc2fd) | Peter Zhao | Medium | Blog |
+| Nov 2025 | [Hands-On with MCP Gateway](https://medium.com/kagenti-the-agentic-platform/hands-on-with-mcp-gateway-from-local-setup-to-agent-integration-in-kagenti-f9bd3b7cc334) | Hai Huang, Evaline Ju, Gloire Rubambiza, Jim Cadden | Medium | Blog |
+| Nov 2025 | [Introducing MCP-Gateway in Kagenti](https://medium.com/kagenti-the-agentic-platform/introducing-mcp-gateway-in-kagenti-a-unified-front-door-for-your-mcp-servers-28db5b6ef62d) | Hai Huang, Maia Iyer, Evaline Ju, Mariusz Sabath, Paolo Dettori | Medium | Blog |
+| Oct 2025 | [Hands-On Introduction to Agentic AI Concepts with Kagenti](https://medium.com/kagenti-the-agentic-platform/hands-on-introduction-to-agentic-ai-concepts-with-kagenti-d70f15aa9051) | Gloire Rubambiza, Evaline Ju | Medium | Blog |
+| Jun 2025 | [Security in and around MCP: Part 3 — MCP Server Identity](https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-3-mcp-server-identity-10d6768d96c1) | Maia Iyer, Mariusz Sabath, Hai Huang, James Cadden, Alan Cha, Paolo Dettori, Jarek Cwiklik | Medium | Blog |
+| Jun 2025 | [Security in and around MCP: Part 2 — MCP in Deployment](https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-2-mcp-in-deployment-65bdd0ba9dc6) | Maia Iyer, Mariusz Sabath, Alan Cha, Hai Huang, Paolo Dettori, James Cadden, Jarek Cwiklik | Medium | Blog |
+| Jun 2025 | [Security in and around MCP: Part 1 — OAuth in MCP](https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-1-oauth-in-mcp-3f15fed0dd6e) | Maia Iyer, Mariusz Sabath, Alan Cha, Hai Huang, Paolo Dettori, James Cadden, Jarek Cwiklik | Medium | Blog |
+| Jun 2025 | [Identity in Agentic Platforms](https://medium.com/kagenti-the-agentic-platform/identity-in-agentic-platforms-enabling-secure-least-privilege-access-996527f1c983) | Mariusz Sabath, Paolo Dettori, Maia Iyer, Alan Cha, Hai Huang, Jarek Cwiklik | Medium | Blog |
+| May 2025 | [Toward a Cloud-Native Platform for AI Agents](https://medium.com/kagenti-the-agentic-platform/toward-a-cloud-native-platform-for-ai-agents-70081f15316d) | Paolo Dettori, Alan Cha, Hai Huang, Jarek Cwiklik, Maia Iyer, Mariusz Sabath | Medium | Blog |
diff --git a/ecosystem/key-dates.md b/ecosystem/key-dates.md
new file mode 100644
index 0000000..67672d6
--- /dev/null
+++ b/ecosystem/key-dates.md
@@ -0,0 +1,16 @@
+# Key Dates
+
+## Upcoming
+
+| Date | Event | Notes |
+|------|-------|-------|
+| Nov 9-12, 2026 | KubeCon + CloudNativeCon NA | |
+
+## Past
+
+| Date | Event | Notes |
+|------|-------|-------|
+| May 11-14, 2026 | Red Hat Summit | |
+| Apr 15, 2026 | Red Hat Summit Code Freeze | Operator + Webhook, AuthBridge (Mariusz), Kuadrant (Rong Chang) |
+| Mar 2026 | KubeCon EU | rossoctl cited for solving agent identity problem. Talks + demos |
+| Nov 2025 | KubeCon + CloudNativeCon NA | "Who Let the Agents Out?" talk, "Build-a-Bot" SPIRE+MCP tutorial, IBM booth #700 |
diff --git a/ecosystem/onboarding.md b/ecosystem/onboarding.md
new file mode 100644
index 0000000..52a4bcb
--- /dev/null
+++ b/ecosystem/onboarding.md
@@ -0,0 +1,26 @@
+# Contributor Onboarding
+
+Guide for new contributors joining the rossoctl ecosystem.
+
+## 1. Join the Community
+
+- **GitHub** — Browse the [rossoctl org](https://github.com/rossoctl/) and fork any repo to start contributing
+- **Slack** — [Join the community](https://ibm.biz/kagenti-slack) for real-time discussion
+- **Google Group** — Join [kagenti-contributors](https://groups.google.com/g/kagenti-contributors) for shared docs and announcements
+
+## 2. Join the Community Calendar
+
+- Add the [rossoctl community calendar](https://calendar.google.com/calendar/embed?src=kagenti%40kagenti.io&ctz=America%2FNew_York) for biweekly community meetings
+
+## 3. Explore the Project
+
+- **[Welcome to rossoctl](welcome.mdx)** — What the project is and what it covers
+- **[Workstreams](workstreams.md)** — Active areas of development, each with its own scope and contributors
+- **[rossoctl Issue Prioritization](https://github.com/orgs/rossoctl/projects/8)** — Current priorities and open issues
+
+## 4. Start Contributing
+
+1. Read the [Contributing Guide](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md)
+2. Pick a workstream that matches your interest and expertise
+3. Look for issues labeled `good first issue` or `help wanted` on the relevant repo
+4. Fork, branch, and open a PR
diff --git a/ecosystem/resources.md b/ecosystem/resources.md
new file mode 100644
index 0000000..47d7b44
--- /dev/null
+++ b/ecosystem/resources.md
@@ -0,0 +1,11 @@
+# Resources
+
+| Resource | URL |
+|----------|-----|
+| Website | [rossoctl.dev](https://rossoctl.dev) |
+| GitHub | [github.com/rossoctl](https://github.com/rossoctl/) |
+| Project Board | [rossoctl Issue Prioritization](https://github.com/orgs/rossoctl/projects/8) |
+| Blog | [Medium](https://medium.com/kagenti-the-agentic-platform) |
+| Slack | [Join the community](https://ibm.biz/kagenti-slack) |
+| Google Group | [kagenti-contributors](https://groups.google.com/g/kagenti-contributors) |
+| Community Calendar | [kagenti@kagenti.io](https://calendar.google.com/calendar/embed?src=kagenti%40kagenti.io&ctz=America%2FNew_York) |
\ No newline at end of file
diff --git a/ecosystem/welcome-copy.md b/ecosystem/welcome-copy.md
new file mode 100644
index 0000000..d342f43
--- /dev/null
+++ b/ecosystem/welcome-copy.md
@@ -0,0 +1,69 @@
+---
+draft: true
+sidebar_label: Welcome (previous version)
+---
+
+
+
+# Welcome to rossoctl
+
+rossoctl is an open source platform for deploying and governing AI agents on Kubernetes. It's framework-neutral — agents built with LangGraph, CrewAI, AG2, AutoGen, or any A2A-compatible framework all run on rossoctl. Communication uses open standards (A2A and MCP) so teams aren't locked into any vendor's stack.
+
+The project started in early 2025 out of IBM Research with deep collaboration from Red Hat, and has grown to 12 repos, 43 org members, and 80+ contributors across both organizations.
+
+## Where we're headed
+
+Agents are changing. The tools developers reach for daily — Claude Code, Codex, OpenClaw — run continuously, rewrite their own files, and act without being asked. rossoctl's direction is the **secure deployment of autonomous agents on Kubernetes**.
+
+The goal is a platform where always-on, self-modifying agents can run on your own infrastructure with real identity, governance, and isolation. Even companies using cloud-hosted agents will have workloads that can't leave their network — agents touching internal databases, proprietary code, secrets, internal APIs. rossoctl is intended to be where those agents run.
+
+## The Problem
+
+Frameworks and harnesses for building agents are maturing fast. But there is no widely adopted platform that gives you identity, governance, sandboxing, and audit for agents on Kubernetes — especially autonomous ones that make their own decisions and run unsupervised.
+
+This is the same gap Kubernetes filled for containers a decade ago. Agents are the new workload.
+
+## Who it's for
+
+**Platform Engineer** — "People are deploying agents. I need to govern them." They need to enforce safety policies, scope permissions, audit what agents do, and isolate tenants.
+
+**AI Engineer** — "I have an agent and I need to run it securely." Their agent needs to touch internal systems that can't leave their network, and cloud platforms can't give them the identity, governance, and audit their company requires.
+
+## Differentiating capabilities
+
+What rossoctl is building toward:
+
+| Capability | What it solves |
+|------------|---------------|
+| **Workload Identity** | Cryptographic identity for agents via SPIFFE/SPIRE, not just API keys |
+| **Tool Governance** | Deterministic filtering between agents and external services, with audit trails and human-in-the-loop approval |
+| **Guardrails Enforcement** | Content safety and compliance policies for agents making autonomous decisions |
+| **Sandboxing** | Isolated execution environments for agents running arbitrary code |
+| **Authorization & Policy** | Scoped permissions with runtime policy enforcement |
+| **Audit Trail** | Full record of agent actions for compliance |
+| **Workspace Isolation** | Multi-tenant filesystem isolation for self-modifying agents |
+| **State Management** | Persistent state and session management across restarts |
+| **Agent Trust** | Signed agent cards, attestation of capabilities |
+| **Skills Governance** | Skills as versioned, signed, governed artifacts |
+
+## What the ecosystem covers today
+
+| Area | What it does |
+|------|-------------|
+| **Developer Tooling** | ADK — CLI, Python + TypeScript SDKs, and a local dev environment. Build and test agents without a cluster. |
+| **Lifecycle Orchestration** | Deploy agents and tools as containers via AgentCard CRDs. Auto-build with Shipwright. Discovery and registration handled by the operator. |
+| **Networking** | MCP Gateway routes tool calls across agents. Istio service mesh for mTLS. Gateway API for ingress. |
+| **Security** | Zero-trust from the ground up. SPIFFE/SPIRE for cryptographic workload identity. Keycloak for OAuth/OIDC. AuthBridge for token exchange. No static credentials. |
+| **Observability** | Distributed tracing via MLflow, Langflow, and Phoenix. Network visualization through Kiali. Token cost attribution. OpenTelemetry auto-instrumentation. |
+| **Security Testing** | Capture the Flag — red-team scenarios with real AI agents probing for policy violations. |
+| **Benchmarking** | Agent benchmarking and test infrastructure for evaluating agent behavior at scale. |
+
+## Community
+
+The community ships weekly, publishes on [Medium](https://medium.com/kagenti-the-agentic-platform), and has presented at KubeCon NA 2025, KubeCon EU 2026, and The Cloudcast podcast.
+
+See [Content](content.md) for the full list of blogs, demos, and coverage.
diff --git a/ecosystem/welcome.mdx b/ecosystem/welcome.mdx
new file mode 100644
index 0000000..16e4eba
--- /dev/null
+++ b/ecosystem/welcome.mdx
@@ -0,0 +1,139 @@
+---
+slug: /
+sidebar_label: Welcome to rossoctl
+title: Welcome to rossoctl
+---
+
+import Link from '@docusaurus/Link';
+import Accordion from '@site/src/components/Accordion';
+import ArchitectureDiagram from '@site/src/components/ArchitectureDiagram';
+
+export const cortexFunctions = [
+ {
+ number: '01',
+ status: 'Ready',
+ title: 'Agent identity',
+ description:
+ 'Every agent carries a verifiable identity, so the platform knows who is acting before it decides what they may do.',
+ },
+ {
+ number: '02',
+ status: 'Ready',
+ title: 'Authorization and access',
+ description:
+ 'Agents run with least privilege and act by delegation, never with more authority than the user and the agent both hold.',
+ },
+ {
+ number: '03',
+ status: 'In progress',
+ title: 'Intent-based access',
+ description:
+ "Access is tied to what the user actually asked for, so an agent that drifts off task can't quietly reuse its access for something else.",
+ },
+ {
+ number: '04',
+ status: 'In progress',
+ title: 'Tool semantic validation',
+ description:
+ "Tool calls are checked for correctness and meaning before they run, catching calls that are malformed or don't match the task.",
+ },
+ {
+ number: '05',
+ status: 'Next',
+ title: 'Context compaction',
+ description:
+ "The platform assembles and trims what goes into the model's context, keeping it relevant and lowering token cost.",
+ },
+ {
+ number: '06',
+ status: 'Next',
+ title: 'Data-flow analysis',
+ description:
+ 'The platform tracks where the data behind a decision came from, so its provenance can gate what the agent does next.',
+ },
+ {
+ number: '07',
+ status: 'In progress',
+ title: 'Failure recovery',
+ description:
+ 'The platform detects when an agent stalls or fails and returns it to a known state instead of leaving work half-finished.',
+ },
+ {
+ number: '08',
+ status: 'In progress',
+ title: 'User interaction',
+ description:
+ 'For high-stakes steps, a person stays in the loop and approves before the agent acts.',
+ },
+];
+
+export const rossoctlServices = [
+ {
+ number: '01',
+ title: 'Skills',
+ description:
+ 'Reusable, governed capabilities an agent can draw on, versioned and controlled rather than pasted in.',
+ },
+ {
+ number: '02',
+ title: 'Tools',
+ description:
+ 'Vetted tools agents reach through the platform, so every call is mediated and audited instead of made directly.',
+ },
+ {
+ number: '03',
+ title: 'Memory',
+ description:
+ "Durable memory that survives sessions and restarts, so an agent doesn't start from nothing each time.",
+ },
+ {
+ number: '04',
+ title: 'Knowledge base',
+ description:
+ 'Shared, queryable knowledge agents use to ground their work in your own data.',
+ },
+ {
+ number: '05',
+ title: 'Sandboxes',
+ description:
+ 'Isolated environments to run untrusted or self-modifying agents without risking the host or other tenants.',
+ },
+];
+
+
+
+# Platform primitives for trustworthy AI agents
+
+
+
+rossoctl is a set of platform primitives for agent security, resilience, and efficiency that platform owners can build on. It comes in two parts: RossoCortex, a data plane that mediates what agents do, and a set of services agents can call. It's open source, framework-neutral, and built on open standards, with A2A between agents and MCP for tools.
+
+
+
+
+ {/* Primary CTAs point at the project repos (docs hidden pre-launch). */}
+ Get started
+ Try RossoCortex
+
+
+
+
+## The problem
+
+AI agents don't behave like the cloud applications we know how to run. They decide which tools to call while they run, they don't cleanly separate data from instructions, their goals drift as context changes, and they can't reliably report what they did. Those traits make the ordinary demands of production hard to meet: failure recovery, admission control, security, and resource management.
+
+Agent systems fail in ways enterprise architecture wasn't built for, so they need a platform to supply the guarantees they can't supply themselves. Kubernetes solved the same kind of problem for cloud software by separating application logic from placement, scaling, and recovery. An agent platform needs an analogous split: decouple agent logic from the guarantees around admission, isolation, and failure recovery that production demands.
+
+## RossoCortex, the data plane
+
+RossoCortex is an intercept. It sits transparently between an agent and everything external it touches: models, tools, users, and other agents. From that one vantage point it enforces the guarantees agents can't enforce for themselves. It is flexible by design: it works with different agent types, including black-box harnesses, integrates with different sandboxes, and works across container network choices.
+
+
+
+## Rossoctl services
+
+The services are the building blocks agents need to do real work: skills, tools, memory, knowledge bases, and sandboxes. The focus is on capabilities that lower the risk of agentic workloads and use resources more efficiently.
+
+
+
+
diff --git a/ecosystem/workstreams.md b/ecosystem/workstreams.md
new file mode 100644
index 0000000..a10b7cb
--- /dev/null
+++ b/ecosystem/workstreams.md
@@ -0,0 +1,19 @@
+# Workstreams
+
+| Workstream | What it is | Leaders and Core Contributors |
+|------------|-----------|-------------------|
+| Agent Lifecycle Management | Managing agent lifecycle on the platform via the operator — deploy, hibernate, wake, scale | **Jarek Cwiklik**, Paolo Dettori |
+| Agent Runtime | Agent runtime, proxy | **Hai Huang**, Ed Snible |
+| Audit Trail | Security audit trail — full record of autonomous agent actions for compliance | **Parul Singh** |
+| Authorization and Policy Management | Scoped permissions with runtime policy enforcement that limit what an agent can do | **Rong Chang**, Maia Iyer, Alan Cha, Hai Huang |
+| Benchmarking | Agent benchmarking and test infrastructure | **Kelly Abuelsaad** |
+| Guardrails | Content safety and compliance policies for agents making autonomous decisions | **Evaline Ju** |
+| Identity Management (Keycloak) | Identity and access management | **Alan Cha**, Maia Iyer |
+| Intent Based Access Control | Intent based access control | **Hai Huang** |
+| MCP Gateway | Unified front door for MCP servers — tool routing, auth, token exchange | **Hai Huang**, Ed Snible |
+| Network Security | Secure network architecture and isolation between agents and external systems | **Hai Huang** |
+| Observability & Token Cost Management | Tracing, token cost attribution, and auto-instrumentation | **Evaline Ju**, Ilya Kolchinsky |
+| Resiliency & Consistency | Ensuring environment consistency and preventing corruption from agent actions, inconsistent states | **Sahil Suneja** |
+| Sandboxing | Isolated execution environments for code dev, AI-generated code, and MCP tools | **Ladislav Smola** |
+| State Management | State, context, and session management — persistent state so agents retain memory across restarts and sessions | **Maia Iyer**, Evaline Ju, Alan Cha, Kelly Abuelsaad |
+| Workload Identity and Security | Zero-trust auth and identity management for agents, tools, and users — cryptographic workload identity via SPIFFE/SPIRE | **Mariusz Sabath**, Maia Iyer, Alan Cha, Morgan Foster, Akram Ben Aissi |
diff --git a/img/avatar-mcfoster.jpg b/img/avatar-mcfoster.jpg
deleted file mode 100644
index ef5f700..0000000
Binary files a/img/avatar-mcfoster.jpg and /dev/null differ
diff --git a/img/kagenti-ui-dark.png b/img/kagenti-ui-dark.png
deleted file mode 100644
index 73f753f..0000000
Binary files a/img/kagenti-ui-dark.png and /dev/null differ
diff --git a/img/kagenti-ui-light.png b/img/kagenti-ui-light.png
deleted file mode 100644
index 09851b3..0000000
Binary files a/img/kagenti-ui-light.png and /dev/null differ
diff --git a/img/yt-github-issue-agent.jpg b/img/yt-github-issue-agent.jpg
deleted file mode 100644
index 17e615c..0000000
Binary files a/img/yt-github-issue-agent.jpg and /dev/null differ
diff --git a/index.html b/index.html
deleted file mode 100644
index ed8fa98..0000000
--- a/index.html
+++ /dev/null
@@ -1,692 +0,0 @@
-
-
-
-
-
- Kagenti — Deploy, Secure, and Govern AI Agents
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Skip to main content
-
-
-
-
- New name
- Kagenti is becoming Rosso — you'll see the new name reflected across all project sites soon.
-
-
-
-
-
-
-
-
- Find Kagenti at KubeCon NA — Nov 9–12.
- Learn more →
-
The unified operational interface across all platform pillars. Import agents and tools, run interactive tests, monitor deployments, and manage platform state from a single web-based interface.
Agents run as framework-neutral Kubernetes workloads over the A2A protocol. Tools run as MCP servers. LangGraph, CrewAI, and AG2 supported without agent code modifications.
MCP Gateway routes tool calls and handles protocol translation. Istio Ambient provides service mesh networking and mTLS between all workloads. Gateway API manages ingress and routing.
Kiali visualizes service mesh traffic flows, mTLS status, and service dependencies. Phoenix traces agent steps, tool calls, and model interactions end-to-end.
-
-
-
-
-
-
Don't see your framework or protocol? Kagenti is built to extend.
# Clone the repo
-git clone https://github.com/kagenti/kagenti.git
-cd kagenti
-
-# Configure secrets (optional - edit with your GitHub token, API keys, etc.)
-cp deployments/envs/secret_values.yaml.example \
- deployments/envs/.secret_values.yaml
-
-# Check out the latest release
-git checkout v0.6.0
-
-# Install on Kind
-scripts/kind/setup-kagenti.sh --with-ui --with-spire --with-agent-sandbox --with-builds
-
-# Or on OpenShift
-scripts/ocp/setup-kagenti.sh --with-ui --with-agent-sandbox --with-builds
-
-# Open the Kagenti dashboard
-open http://kagenti-ui.localtest.me:8080
-
-
-
-
-
-
-
-
-
-
-
- Deploy and manage AI agents with Kagenti
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Demo examples
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Demo: GitHub Issue Agent
-
Connect any tool with a secure MCP gateway.
-
The GitHub Issue Agent reads and files issues through a Kagenti MCP tool server. Point the agent at the MCP endpoint; the gateway handles routing and protocol. Swap or update the tool without touching agent code.
-
-
MCP tool server runs as a separate service; agent connects via a single env var
-
Gateway handles routing, protocol translation, and token exchange for every tool call
-
Replace or upgrade tools by updating one URL — no agent rebuild required
# Point the agent at the MCP tool server
-kubectl set env deployment/git-issue-agent -n team1 -c agent \
- MCP_URL="http://github-tool-mcp:9090/mcp"
-
-# Verify the MCP tool is reachable
-kubectl run test-mcp --image=curlimages/curl -n team1 \
- --restart=Never --rm -it -- \
- curl -s -o /dev/null -w "%{http_code}" \
- http://github-tool-mcp:9090/mcp
-# 200
-
-
-
- bash
- agent calls GitHub via MCP
-
-
# Send a task to the agent over A2A
-curl -s -H "Authorization: Bearer $TOKEN" \
- -H "Content-Type: application/json" \
- -X POST http://git-issue-agent:8080/ \
- -d '{"jsonrpc":"2.0","id":"1","method":"message/send",
- "params":{"message":{"role":"user","messageId":"msg-001",
- "parts":[{"type":"text","text":
- "List open issues in kagenti/kagenti"}]}}}' | jq
-
-
-
-
-
-
-
-
-
- Demo: Weather Service Agent
-
Enforce zero-trust identity with AuthBridge.
-
AuthBridge injects zero-trust identity and auth enforcement into any agent at deploy time. The Weather Service Agent gets a Keycloak identity, JWT validation, and proxy enforcement — without writing a line of auth code.
-
-
SPIFFE identity and Keycloak registration provisioned at deploy
-
Inbound requests validated at the Envoy proxy — invalid tokens never reach agent code
-
AuthBridge adds 3 sidecars; the agent container is unmodified
Deploy and manage agents through the Kagenti dashboard.
-
The Slack Research Agent and its Slack MCP tool are imported and managed through the Kagenti UI. The platform provisions workloads, wires tool connections, and configures auth — no manifest authoring required.
-
-
Import agent and tool through the dashboard; platform handles deployment
-
Keycloak access policies configured with a single setup script
-
Monitor running deployments and logs with standard kubectl
The next phase of Kagenti is built around persistent, long-running agents — agents that maintain context across sessions and operate autonomously over time, like OpenClaw.
-
Getting there means building the right foundations. We're working on the core pieces: memory, sandboxing, an Agent Development Kit, and improved developer experience.
-
-
-
-
-
-
Open-source infrastructure you can audit, fork, and trust.
- This policy describes how Kagenti.io collects and uses information when you visit this website.
- Kagenti is an open-source project. This site is a marketing and documentation resource — it does not
- offer accounts, process payments, or collect personal information through forms.
-
-
-
-
-
What we collect
-
- If you accept analytics cookies, we use Google Analytics 4 (GA4) to collect anonymised usage data, including:
-
-
-
Pages visited and time spent on each page
-
Referring website or search query
-
Browser type, operating system, and approximate country (derived from IP address)
-
Interactions such as button clicks and outbound link clicks
-
-
- IP addresses are anonymised before storage. We do not collect your name, email address, or any
- other information that directly identifies you.
-
-
- If you decline analytics cookies, no tracking cookies are set and no usage data is sent to Google.
-
-
-
Browser storage
-
- This site does not set any first-party cookies. It uses your browser's
- localStorage and sessionStorage to store small, non-personal values
- that never leave your browser and are not sent with HTTP requests:
-
-
-
kagenti-cookie-consent — your analytics consent preference (localStorage)
-
kagenti-banner-dismissed — whether you dismissed the event banner (sessionStorage, cleared when the tab closes)
- If you accept analytics, Google Analytics sets third-party cookies (_ga, _ga_*)
- to distinguish visitors and sessions. These cookies expire after 2 years.
- No analytics cookies are set unless you explicitly consent.
-
-
- You can change your preference at any time using the
- Analytics preferences link in the site footer,
- or by clearing your browser storage.
-
-
-
Legal basis (GDPR)
-
- Google Analytics cookies are processed on the basis of your explicit consent (Article 6(1)(a) GDPR).
- Browser storage entries listed above are used for site functionality and do not require consent
- under the ePrivacy Directive, as they are strictly necessary for features you have requested.
- You are free to decline analytics without any loss of functionality on this site.
-
-
-
Data processor
-
- Analytics data is processed by Google LLC under the Google Analytics Terms of Service and
- Google's standard contractual clauses. Google acts as a data processor on our behalf.
- For more information, see Google's Privacy Policy.
-
-
-
Data retention
-
- Analytics data is retained for 14 months in Google Analytics, after which it is automatically deleted.
- You can request deletion of your data by
- contacting us.
-
-
-
Your rights
-
- Under GDPR, you have the right to access, rectify, or erase your personal data, and to object to or
- restrict its processing. Because analytics data is anonymised and not linked to an identity, we may
- be unable to locate or retrieve data relating to a specific individual. To exercise your rights,
- contact us.
-
-
-
Changes to this policy
-
- We may update this policy from time to time. The date at the top of this page reflects the most
- recent revision. Continued use of the site after changes are posted constitutes acceptance of the
- updated policy.
-
-
-
-
-
-
-
diff --git a/tsconfig.json b/tsconfig.json
new file mode 100644
index 0000000..405d777
--- /dev/null
+++ b/tsconfig.json
@@ -0,0 +1,12 @@
+// This file is not used by "docusaurus start/build" commands.
+// It is here to improve your IDE experience (type-checking, autocompletion...),
+// and can also run the package.json "typecheck" script manually.
+{
+ "extends": "@docusaurus/tsconfig",
+ "compilerOptions": {
+ "baseUrl": ".",
+ "ignoreDeprecations": "6.0",
+ "strict": true
+ },
+ "exclude": [".docusaurus", "build"]
+}
-
- 
- 
- 
-
-