{"slug":"rossoctl","url":"https://www.altairalabs.ai/vs/rossoctl/","markdown":"https://www.altairalabs.ai/vs/rossoctl.md","name":"Rossoctl","vendor":"The Rossoctl project (formerly Kagenti)","category":"Agents on Kubernetes","checked":"2026-10-22","summary":"Omnia tests every release, versions what ran, rolls it out in steps and enforces tool policy on every call, with the user’s identity carried through. Rossoctl, formerly Kagenti, handles token exchange, and its docs don’t yet cover testing or releasing an agent.","headline":"Rossoctl (formerly Kagenti) handles who the agent is. Omnia tests and releases it.","scene":{"setup":"A new build of the claims agent is ready.","omnia":"The build is a new version of the pack. Simulated claimants work it through the real tools before it serves, one of them inventing a second injury. It passes, gets a share of new claims, keeps its numbers up and is promoted. Had they dropped, the previous version would have taken the traffic back.","omniaCaps":["gitops-sync","selfplay","adversarial","deploy-gate","progressive-rollout","metric-gated-promotion"],"them":"Rossoctl identifies the build by the version field on its agent card. Testing isn’t documented, and upgrading from one release to the next is listed as a subject with no page yet.","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/workloads/bring-your-own-agent.md","omniaEvidence":"https://omnia.altairalabs.ai/reference/core/promptpacksource/"},"differences":[{"title":"Every release is tested and gated","body":"Adversarial callers and duplex voice calls run alongside the simulated claimants. A version that fails the suite isn’t released.","caps":["selfplay","adversarial","voice-testing","deploy-gate"],"them":"Not documented. The UI lets you try an agent by hand.","source":"https://github.com/rossoctl/rossoctl","omniaEnterprise":false,"omniaEvidence":"https://promptarena.altairalabs.ai/arena/explanation/scenario-design/"},{"title":"A release is a thing you can name","body":"Prompts, tools, policy and tests are one versioned pack, pulled from git or OCI. The rollout moves traffic to that version step by step, and a conversation finishes on the version it began on.","caps":["gitops-sync","progressive-rollout","sticky-sessions"],"them":"The agent card’s version field identifies the running build. Rollout isn’t documented.","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/operate/index.md","omniaEnterprise":false,"omniaEvidence":"https://omnia.altairalabs.ai/reference/core/promptpacksource/"},{"title":"Tool policy you can put in production today","body":"A broker checks each tool call against your CEL rules, looking at the arguments and at who the caller is. If the broker can’t answer, the call is refused.","caps":["per-call-policy","claim-based-access"],"them":"Tool-call validation is Alpha, and the docs say not to use the Beta MCP gateway as an access-control boundary.","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/concepts/experiments/mcp-gateway.md","omniaEnterprise":true,"omniaEvidence":"https://omnia.altairalabs.ai/how-to/security/configure-tool-policies/"}],"rows":[{"topic":"Any Kubernetes","omnia":"Installed with Helm.","caps":["service-groups"],"them":"Kind and OpenShift Ready; other clusters Beta.","coverage":"partly","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/operate/index.md","omniaEnterprise":false,"omniaEvidence":"https://omnia.altairalabs.ai/how-to/workspaces/configure-service-groups/"},{"topic":"Agents from other frameworks","omnia":"Run under the same governance; reachable over A2A or MCP.","caps":["foreign-frameworks","expose-a2a-mcp"],"them":"Any container that speaks A2A.","coverage":"yes","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/workloads/bring-your-own-agent.md","omniaEnterprise":false,"omniaEvidence":"https://omnia.altairalabs.ai/how-to/security/authoring-a-custom-runtime/"},{"topic":"End-user identity to tools","omnia":"OIDC or edge trust, carried to every call.","caps":["oidc","end-user-identity","outgoing-auth"],"them":"Token exchange per tool.","coverage":"yes","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/security/index.md","omniaEnterprise":false,"omniaEvidence":"https://omnia.altairalabs.ai/how-to/security/configure-authentication/"},{"topic":"Simulated users before release","omnia":"Multi-turn, against real tools.","caps":["selfplay"],"them":"Not documented.","coverage":"undocumented","source":"https://github.com/rossoctl/rossoctl","omniaEnterprise":false,"omniaEvidence":"https://promptarena.altairalabs.ai/arena/explanation/scenario-design/"},{"topic":"Stepped rollout, auto rollback","omnia":"Traffic shifts in steps and rolls back on its own.","caps":["progressive-rollout"],"them":"Not documented.","coverage":"undocumented","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/operate/index.md","omniaEnterprise":false,"omniaEvidence":"https://omnia.altairalabs.ai/tutorials/progressive-rollouts/"},{"topic":"Argument-level tool policy","omnia":"Enforced on every call; fails closed.","caps":["per-call-policy"],"them":"Alpha.","coverage":"partly","source":"https://github.com/rossoctl/rossoctl/blob/main/docs/concepts/experiments/mcp-gateway.md","omniaEnterprise":true,"omniaEvidence":"https://omnia.altairalabs.ai/how-to/security/configure-tool-policies/"},{"topic":"Voice","omnia":"Duplex voice, and tests for it.","caps":["duplex-voice","voice-testing"],"them":"Not documented.","coverage":"undocumented","source":"https://github.com/rossoctl/rossoctl","omniaEnterprise":false,"omniaEvidence":"https://promptarena.altairalabs.ai/arena/explanation/duplex-architecture/"}],"faq":[{"q":"Is Rossoctl the same project as Kagenti?","a":"Yes. The Kagenti repository on GitHub now redirects to Rossoctl."},{"q":"Does Rossoctl need OpenShift or Istio?","a":"Not any more. Its docs mark OpenShift and Kind as Ready and other clusters as Beta, and Istio is an optional flag. Omnia runs on any Kubernetes and doesn’t need a mesh."},{"q":"Can an Omnia agent call one running on Rossoctl?","a":"Yes. Omnia references remote agents by URL over A2A, with outgoing auth, and uses their skills as local tools."}]}