epic: Cortex Phase 1

[huang195]

Problem

Tracking epic for the Cortex Phase 1 workstream (Cortex / RossoCortex — formerly AuthBridge — the Go-native proxy + enforcement effort).

Scope to be filled in. This epic organizes Phase 1 stories; the problem statement, goals, and success criteria below still need to be defined.

design

No response

Goals and non-goals

No response

Success criteria

No response

Stories to be associated with this epic

• Refactor: Separate proxy data-planes from a shared proxy shim layer cortex#682 — Separate proxy data-planes from a shared proxy shim layer (TLS termination, mTLS, session correlation, protocol bridging, transparent + forward proxy support)
• Feat: Add Praxis as a third supported proxy (alongside the Go proxy and Envoy proxy) cortex#681 — Add Praxis as a third supported proxy (+ wire praxis mode via operator + UI so users can select it)
• Feat: Transparent inbound interception for the Go proxy (proxy-sidecar) — SO_ORIGINAL_DST, no Envoy cortex#330 — Transparent inbound interception for the Go proxy (proxy-sidecar)
• Test: Verify Cortex authz capabilities end-to-end (at least OPA) cortex#683 — Verify Cortex authz capabilities end-to-end (at least OPA)
• Feat: Cortex quickstart — one-liner local install + instant value (Claude Code hero use case) cortex#684 — Cortex quickstart: one-liner local install + instant value (Claude Code hero use case)

(All four are also linked as native sub-issues.)

Additional Context

Scaffolded as an epic shell — sections marked _No response_ are placeholders to be completed.