Feat: Cortex quickstart — one-liner local install + instant value (Claude Code hero use case)

[huang195]

Summary

A Cortex quickstart that lets a brand-new user install and configure Cortex with essentially one command and see value within a minute — no Kubernetes, no Keycloak, no SPIRE, no operator. The hero use case is a local developer running Claude Code: point Claude Code at Cortex and immediately observe (and optionally enforce policy on) its tool / MCP / model traffic.

Why

Today, trying Cortex means standing up Kind + SPIRE + Keycloak + the operator — a high bar just to evaluate. A frictionless local quickstart lowers time-to-value and creates an on-ramp: install → run → immediately see Claude Code's traffic → (optionally) enforce a guardrail.

Hero use case: Claude Code, locally

1. Install Cortex with a one-liner.
2. Cortex runs as a local forward proxy (proxy-sidecar shape, no Kubernetes).
3. Point Claude Code at it (HTTP_PROXY / settings).
4. Instantly:
   • see a live session timeline of Claude Code's outbound traffic — MCP tool calls, model/inference calls — via the session API / abctl TUI;
   • (optional) flip on a guardrail (e.g. IBAC / OPA) and watch a tool call get allowed or denied.

Tasks

Install (one-liner)

• curl -fsSL <url> | sh (and/or brew / go install) that fetches the right prebuilt binary per-platform — no build step.
• Zero-config sane defaults: forward proxy on a local port, session API on, passthrough policy so it works with no auth setup.
• A cortex up / cortex quickstart command that starts everything and prints the exact HTTP_PROXY/NO_PROXY to export plus the observability URL.

Configure for Claude Code

• Document / automate pointing Claude Code at the local proxy (env vars or settings).
• Verify MCP + Anthropic API traffic flows through and is observable.
• Handle local gotchas: NO_PROXY=localhost, and HTTPS visibility — Anthropic API + many MCP servers are TLS, so inspecting bodies needs the TLS bridge with a locally-trusted CA (opaque CONNECT tunnel otherwise). Decide default: observe metadata-only (no CA install) vs. full body via opt-in TLS bridge.

Show value immediately

• Out-of-the-box live session view (abctl TUI or a minimal local web view) showing Claude Code's tool / MCP timeline.
• One-command "turn on a guardrail" demo (deny a specific tool / enforce an OPA policy) to show enforcement, not just observability.

Docs

• README quickstart: install → point Claude Code → observe → (optional) enforce, in under ~2 minutes.
• Short asciinema / gif of the flow.

Non-goals

• Not replacing the Kubernetes / operator platform path (that stays for production).
• Not a full auth setup (Keycloak / SPIRE); quickstart runs in passthrough + observability mode by default. JWT validation / token exchange are opt-in follow-ons.

Related

• Part of epic: Cortex Phase 1 (epic: Cortex Phase 1 rossoctl#2244)