docs: point the chart and the repository links at ai-openshell/console

CONTRIBUTING.md

@@ -5,7 +5,7 @@ Thank you for your interest in contributing.
 ## Getting started
 
 ```sh
-git clone https://github.com/Gkrumbach07/openshell-dashboard.git && cd openshell-dashboard
+git clone https://github.com/ai-openshell/console.git && cd console
 ```
 
 Then follow [Run it locally](docs/development.md#run-it-locally): `make setup`, `make gateway` and `make dev`.

README.md

@@ -56,11 +56,11 @@ Install the chart:
 
 ```sh
 helm upgrade --install openshell-dashboard \
-  oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \
+  oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \
   --version <dashboard version> --namespace openshell -f values.yaml
 ```
 
-`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)).
+`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](#compatibility), [releases](https://github.com/ai-openshell/console/releases)).
 
 Then open `https://dashboard.example.com` and sign in. The [install guide](docs/install.md) has every step: Keycloak, the gateway's settings, OpenShift, sign-out and workspace membership.
 
@@ -71,7 +71,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever
 | Your gateway | Dashboard | Container image |
 |---|---|---|
 | `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` |
-| `0.0.116` | the [`gateway-0.0.116`](https://github.com/Gkrumbach07/openshell-dashboard/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
+| `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
 
 `gateway-0.0.116` is a one-off build for gateway `0.0.116` only. It sits outside the version numbering, and no further release is planned for it.
 

deploy/helm/openshell-dashboard/README.md

@@ -49,35 +49,35 @@ Install the published chart:
 
 ```sh
 helm upgrade --install openshell-dashboard \
-  oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \
+  oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \
   --version <dashboard version> --namespace openshell -f values.yaml
 ```
 
-`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/Gkrumbach07/openshell-dashboard#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)).
+`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/ai-openshell/console#compatibility), [releases](https://github.com/ai-openshell/console/releases)).
 
-The [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership.
+The [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership.
 
 ## Example values
 
 These files are in the repository, not in the packaged chart. CI renders each one on its own.
 
 | File | When it applies |
 |---|---|
-| [`values-keycloak.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session |
-| [`values-gateway-api.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway |
-| [`values-port-forward.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress |
-| [`values-route-edge.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router |
-| [`values-route-reencrypt.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS |
-| [`values-openshift-scc.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group |
-| [`values-mtls-client-cert.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC |
-| [`values-tls-disabled.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network |
+| [`values-keycloak.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session |
+| [`values-gateway-api.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway |
+| [`values-port-forward.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress |
+| [`values-route-edge.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router |
+| [`values-route-reencrypt.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS |
+| [`values-openshift-scc.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group |
+| [`values-mtls-client-cert.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC |
+| [`values-tls-disabled.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network |
 
 ## Configuration notes
 
 - **Identity provider**
   - `oidc.provider` is `oidc` for any OIDC issuer and `keycloak-oidc` for Keycloak. Limit who reaches the UI with `oidc.allowedRoles`, which needs `keycloak-oidc`, or with `oidc.allowedGroups`.
   - `oidc.clientIdSecretKey` takes the client ID from the Secret and wins over `oidc.clientId`. `oidc.caConfigMapName` trusts an issuer certificate from a private CA.
-  - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has the gateway's key names.
+  - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has the gateway's key names.
   - `oidc.audience` and `oidc.rolesClaim` are informational: they change no token, and the chart only prints the audience in its post-install notes.
 - **Gateway connection**
   - The chart mounts the gateway's CA from the Secret `gateway.caSecretName`, key `gateway.caKey`, in the release namespace.

deploy/helm/openshell-dashboard/README.md.gotmpl

@@ -49,35 +49,35 @@ Install the published chart:
 
 ```sh
 helm upgrade --install openshell-dashboard \
-  oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \
+  oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \
   --version <dashboard version> --namespace openshell -f values.yaml
 ```
 
-`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/Gkrumbach07/openshell-dashboard#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)).
+`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](https://github.com/ai-openshell/console#compatibility), [releases](https://github.com/ai-openshell/console/releases)).
 
-The [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership.
+The [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has every step: the Keycloak realm, the gateway's settings, OpenShift, sign-out and workspace membership.
 
 ## Example values
 
 These files are in the repository, not in the packaged chart. CI renders each one on its own.
 
 | File | When it applies |
 |---|---|
-| [`values-keycloak.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session |
-| [`values-gateway-api.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway |
-| [`values-port-forward.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress |
-| [`values-route-edge.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router |
-| [`values-route-reencrypt.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS |
-| [`values-openshift-scc.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group |
-| [`values-mtls-client-cert.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC |
-| [`values-tls-disabled.yaml`](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network |
+| [`values-keycloak.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-keycloak.yaml) | Keycloak as the identity provider: the role gate, PKCE, and a sign-out that ends the Keycloak session |
+| [`values-gateway-api.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-gateway-api.yaml) | An HTTPRoute attached to an existing Gateway |
+| [`values-port-forward.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-port-forward.yaml) | A trial through `kubectl port-forward`, without an ingress |
+| [`values-route-edge.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-edge.yaml) | An OpenShift Route that terminates TLS at the router |
+| [`values-route-reencrypt.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-route-reencrypt.yaml) | An OpenShift Route with reencrypt, where oauth2-proxy serves HTTPS |
+| [`values-openshift-scc.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-openshift-scc.yaml) | OpenShift's `restricted-v2` SCC, which assigns the user and group |
+| [`values-mtls-client-cert.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-mtls-client-cert.yaml) | A gateway that requires a client certificate and has no OIDC |
+| [`values-tls-disabled.yaml`](https://github.com/ai-openshell/console/blob/main/deploy/helm/openshell-dashboard/ci/values-tls-disabled.yaml) | A gateway that runs without TLS, on a trusted network |
 
 ## Configuration notes
 
 - **Identity provider**
   - `oidc.provider` is `oidc` for any OIDC issuer and `keycloak-oidc` for Keycloak. Limit who reaches the UI with `oidc.allowedRoles`, which needs `keycloak-oidc`, or with `oidc.allowedGroups`.
   - `oidc.clientIdSecretKey` takes the client ID from the Secret and wins over `oidc.clientId`. `oidc.caConfigMapName` trusts an issuer certificate from a private CA.
-  - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/Gkrumbach07/openshell-dashboard/blob/main/docs/install.md) has the gateway's key names.
+  - oauth2-proxy forwards the access token. The gateway's issuer, audience, roles claim, admin role and user role have to agree with what that token carries; the [install guide](https://github.com/ai-openshell/console/blob/main/docs/install.md) has the gateway's key names.
   - `oidc.audience` and `oidc.rolesClaim` are informational: they change no token, and the chart only prints the audience in its post-install notes.
 - **Gateway connection**
   - The chart mounts the gateway's CA from the Secret `gateway.caSecretName`, key `gateway.caKey`, in the release namespace.

docs/adrs/0001-standalone-application.md

@@ -11,7 +11,7 @@ OpenShell Dashboard is a web UI for one OpenShell gateway. The BFF is given one
 
 1. **Standalone is the only mode.** The dashboard is an application of its own, with its own address, navigation and sign-in. It is not embedded in another application's UI, not loaded as a remote module and not published as a library.
 2. **One container image holds the whole application.** The Go BFF serves the REST API under `/api/v1` and the built React UI from the same process. The image is `quay.io/gkrumbach07/openshell-dashboard`.
-3. **It is installed with the Helm chart in `deploy/helm/openshell-dashboard`,** published as an OCI chart at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard`. The chart runs the BFF with oauth2-proxy beside it in one pod ([ADR 0002](0002-auth-relay-only-bff.md)) and exposes the proxy through a Gateway API HTTPRoute or an OpenShift Route.
+3. **It is installed with the Helm chart in `deploy/helm/openshell-dashboard`,** published as an OCI chart at `oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard`. The chart runs the BFF with oauth2-proxy beside it in one pod ([ADR 0002](0002-auth-relay-only-bff.md)) and exposes the proxy through a Gateway API HTTPRoute or an OpenShift Route.
 4. **The BFF never does the following.** It does not terminate authentication, validate tokens or authorize (ADR 0002). It does not call the Kubernetes API. It does not fetch, store or inject provider credentials: they pass through to the gateway and only their names come back. It does not rate-limit. It holds no state: no session store, no database, nothing that ties a request to a replica.
 5. **Nothing is published to npm.** `frontend/package.json` is `private`, and the UI is built only as part of the image.
 

docs/compatibility.md

@@ -7,7 +7,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever
 | Your gateway | Dashboard | Container image |
 |---|---|---|
 | `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` |
-| `0.0.116` | the [`gateway-0.0.116`](https://github.com/Gkrumbach07/openshell-dashboard/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
+| `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
 
 `gateway-0.0.116` is a one-off build outside the version numbering, because gateway `0.0.x` releases were not compatible with each other. It has no Templates support (gateway `0.0.116` has no sandbox-template RPCs), and no further release is planned for it.
 

docs/install.md

@@ -115,11 +115,11 @@ networkPolicy:
 
 ```sh
 helm upgrade --install openshell-dashboard \
-  oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \
+  oci://ghcr.io/ai-openshell/console/helm-chart/openshell-dashboard \
   --version <dashboard version> --namespace openshell -f values.yaml
 ```
 
-`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](../README.md#compatibility), [releases](https://github.com/Gkrumbach07/openshell-dashboard/releases)). Then check:
+`<dashboard version>` is the newest dashboard release whose first two numbers match your gateway's: a `0.1.N` for a gateway `0.1.x` ([Compatibility](../README.md#compatibility), [releases](https://github.com/ai-openshell/console/releases)). Releases up to `0.1.2` were also published at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard`, the chart's home before the repository moved; that path receives no newer release. Then check:
 
 ```sh
 kubectl -n openshell rollout status deploy/openshell-dashboard

docs/releasing.md

@@ -10,7 +10,9 @@ A release `vX.Y.Z` is three things, all made by `publish.yml`:
 |---|---|---|
 | GitHub release `vX.Y.Z`, and the git tag with it | this repository | `scripts/release/cut-release.mjs` |
 | Container image tags `X.Y.Z` and `X.Y` | `quay.io/gkrumbach07/openshell-dashboard` | retagging the image CI already built |
-| Helm chart `openshell-dashboard`, version `X.Y.Z` | `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart` | packaging the chart at the released commit |
+| Helm chart `openshell-dashboard`, version `X.Y.Z` | `oci://ghcr.io/ai-openshell/console/helm-chart` | packaging the chart at the released commit |
+
+The chart's registry path follows the repository's name (`publish.yml` pushes to `oci://ghcr.io/<owner>/<repository>/helm-chart`), so a package created under a new name starts out private: make it public in the organization's package settings before announcing the release. Releases up to `0.1.2` are at `oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart`, the path before the repository moved to `ai-openshell/console`; nothing is published there any more.
 
 The BFF and the UI ship together and share the version.