rename!: adopt Signetry naming

.github/workflows/cla.yml

@@ -48,7 +48,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/codex/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/codex/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/codex/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

.github/workflows/reviewer.yml

@@ -1,6 +1,6 @@
 name: Reviewer
 
-# Advisory PR review (umbra-reviewer): surfaces architecture + security issues
+# Advisory PR review (signetry-reviewer): surfaces architecture + security issues
 # and posts one recommendation comment. Advisory only — it never merges and never
 # fails the PR. Changes to security-sensitive surfaces (workflows, packaging) are
 # escalated to a human. See https://github.com/Signetry/reviewer
@@ -22,9 +22,9 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - name: Install umbra-reviewer
+      - name: Install signetry-reviewer
         # source-available (All Rights Reserved); install from source, not PyPI.
-        run: pip install "umbra-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.1"
+        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2"
       - name: Compute the PR diff
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -40,7 +40,7 @@ jobs:
           PR: ${{ github.event.pull_request.number }}
         run: |
           set -uo pipefail
-          umbra-reviewer review \
+          signetry-reviewer review \
             --diff "$OUT/pr.diff" \
             --repo "$GITHUB_REPOSITORY" \
             --pr "$PR" \
@@ -56,9 +56,9 @@ jobs:
           script: |
             const fs = require('fs'); const path = require('path');
             const out = process.env.OUT || '';
-            let body = 'Umbra Reviewer: no review was produced.';
+            let body = 'Signetry Reviewer: no review was produced.';
             try { body = fs.readFileSync(path.join(out, 'comment.md'), 'utf8'); } catch (e) {}
-            const marker = '<!-- umbra-reviewer -->';
+            const marker = '<!-- signetry-reviewer -->';
             body = marker + '\n' + body;
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/).
 
+## [Unreleased]
+
+### Changed
+
+- Rebranded the platform from Umbra to Signetry: CLI `umbra` → `signetry`, env
+  `UMBRA_*` → `SIGNETRY_*`, config `.umbra/` → `.signetry/`, imports `umbra_core`
+  → `signetry_core`, and prose/docs references. Install pins now use
+  `signetry-core @ git+https://github.com/Signetry/core@v0.6.0` and
+  `signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2`.
+
 ## [0.3.0] — 2026-07-26
 
 ### Added

CLA.md

@@ -1,8 +1,8 @@
-# Umbra Contributor License Agreement (CLA)
+# Signetry Contributor License Agreement (CLA)
 
 **Copyright (c) 2026 Binay Dalai. All rights reserved.**
 
-Thank you for your interest in contributing to Umbra ("the Project"), owned by
+Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
 governs any contribution you submit. You must agree to it before your contribution
 can be accepted.

CONTRIBUTING.md

@@ -13,7 +13,7 @@ I have read the CLA Document and I hereby sign the CLA
 ```
 
 Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Umbra is **not open source** (All Rights Reserved) — by signing
+the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
 you assign copyright/ownership of your contribution to the Owner and gain no right to
 use, sell, or commercialize it yourself.
 

CONTRIBUTORS.md

@@ -1,6 +1,6 @@
 # Contributors
 
-Umbra is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 

PRIVACY.md

@@ -1,20 +1,20 @@
-# Privacy Policy — Umbra plugins
+# Privacy Policy — Signetry plugins
 
 _Last updated: 2026_
 
-**Umbra plugins collect no data.**
+**Signetry plugins collect no data.**
 
-The Umbra Claude Code plugin (and the Cursor, Codex, and universal integrations
+The Signetry Claude Code plugin (and the Cursor, Codex, and universal integrations
 in this repository) run entirely **locally and offline**:
 
 - The `PreToolUse` guard hook reads the proposed file path or command from the
-  editor and checks it against your repository's `.umbra/admission.yaml` using the
-  local `umbra` command (from the [umbra-core](https://github.com/Signetry/core)
+  editor and checks it against your repository's `.signetry/admission.yaml` using the
+  local `signetry` command (from the [signetry-core](https://github.com/Signetry/core)
   Python package). No data leaves your machine.
 - The plugin makes **no network requests**, sends **no telemetry or analytics**,
   and stores **no personal data**. It has no servers and no backend.
-- The bundled MCP server (`python -m umbra_core.mcp_server`) runs locally and is
-  scoped to your workspace via `UMBRA_MCP_ROOTS`.
+- The bundled MCP server (`python -m signetry_core.mcp_server`) runs locally and is
+  scoped to your workspace via `SIGNETRY_MCP_ROOTS`.
 
 Any network behavior is determined solely by tools **you** invoke (e.g. your own
 `git`, `pip`, or agent), not by this plugin.

README.md

@@ -1,78 +1,78 @@
-# Umbra for Codex
+# Signetry for Codex
 
 > **Copyright (c) 2026 Binay Dalai. All rights reserved.**
 > This repository is strictly for viewing and contributing to the original project. You may not use, copy, modify, distribute, or commercialize this code for your own personal or commercial projects without explicit written permission. Only the original author retains the right to use and monetize this project.
 
 
 Govern coding-agent changes in [OpenAI Codex](https://developers.openai.com/codex)
-with [umbra-core](https://github.com/Signetry/core).
+with [signetry-core](https://github.com/Signetry/core).
 
 ## Prerequisite
 
 ```bash
-pip install "umbra-core @ git+https://github.com/Signetry/core@v0.5.4"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"
 ```
 
-Add a `.umbra/admission.yaml` to your repo (allowed/forbidden paths, diff budget,
+Add a `.signetry/admission.yaml` to your repo (allowed/forbidden paths, diff budget,
 required checks). A conservative default applies without one.
 
 ## 1. MCP server (recommended)
 
-Codex reads MCP servers from `~/.codex/config.toml`. Add Umbra's server so the
+Codex reads MCP servers from `~/.codex/config.toml`. Add Signetry's server so the
 agent can run admission / verify / provenance itself:
 
 ```toml
-[mcp_servers.umbra]
+[mcp_servers.signetry]
 command = "python"
-args = ["-m", "umbra_core.mcp_server"]
+args = ["-m", "signetry_core.mcp_server"]
 
-[mcp_servers.umbra.env]
-UMBRA_MCP_ROOTS = "/absolute/path/to/your/repo"
+[mcp_servers.signetry.env]
+SIGNETRY_MCP_ROOTS = "/absolute/path/to/your/repo"
 ```
 
-`UMBRA_MCP_ROOTS` scopes the server to your workspace(s) so it can't be pointed
-at arbitrary host paths. The agent then has `umbra_admit`, `umbra_verify`, and
-`umbra_provenance` tools.
+`SIGNETRY_MCP_ROOTS` scopes the server to your workspace(s) so it can't be pointed
+at arbitrary host paths. The agent then has `signetry_admit`, `signetry_verify`, and
+`signetry_provenance` tools.
 
 ## 2. Lifecycle hook guard (deterministic pre-action check)
 
-Codex supports lifecycle hooks. Configure a hook that runs `umbra guard` before a
+Codex supports lifecycle hooks. Configure a hook that runs `signetry guard` before a
 file write / command, so an out-of-scope or forbidden action is blocked by
 deterministic code (not the model). See the Codex config docs for the exact hook
 schema for your version; the guard command to wire in is:
 
 ```bash
-umbra guard --repo "$REPO" --path "$PROPOSED_PATH"      # exit 1 = deny
-umbra guard --repo "$REPO" --command "$PROPOSED_COMMAND" # exit 1 = deny
+signetry guard --repo "$REPO" --path "$PROPOSED_PATH"      # exit 1 = deny
+signetry guard --repo "$REPO" --command "$PROPOSED_COMMAND" # exit 1 = deny
 ```
 
-`umbra guard` exits non-zero and prints a reason when the action violates the
+`signetry guard` exits non-zero and prints a reason when the action violates the
 contract; exit 0 means allowed.
 
 ## 3. The durable guarantee: CI
 
-Whichever agent opens the PR, make **Umbra Admission** a required check so nothing
+Whichever agent opens the PR, make **Signetry Admission** a required check so nothing
 merges without a signed receipt:
-<https://github.com/marketplace/actions/umbra-admission>. In-editor guards are
+<https://github.com/marketplace/actions/signetry-admission>. In-editor guards are
 best-effort defense-in-depth; the CI check is the enforced gate.
 
 ## 4. Scan & fix
 
-`umbra-core` also finds vulnerabilities and can govern the fix with Codex:
+`signetry-core` also finds vulnerabilities and can govern the fix with Codex:
 
 ```bash
-umbra scan .                              # SAST over the repo (7 languages, SARIF), offline & free
-umbra scan . --fix --fix-agent codex-cli  # draft a governed fix → admission → signed receipt
+signetry scan .                              # SAST over the repo (7 languages, SARIF), offline & free
+signetry scan . --fix --fix-agent codex-cli  # draft a governed fix → admission → signed receipt
 ```
 
 `--fix` is **bring-your-own-key** (your `OPENAI_API_KEY`, never shared, redacted
 from every artifact) and opens **branch-only** PRs — never merges. Works with
 OpenAI-compatible gateways (e.g. IBM ICA) via `--codex_model` / base-URL inputs.
-See [umbra-core: AUTOFIX_SETUP.md](https://github.com/Signetry/core/blob/main/docs/AUTOFIX_SETUP.md).
+See [signetry-core: AUTOFIX_SETUP.md](https://github.com/Signetry/core/blob/main/docs/AUTOFIX_SETUP.md).
 
 ---
 
-Part of the [Umbra platform](https://github.com/Signetry/signetry). Governance logic lives in [umbra-core](https://github.com/Signetry/core); this integration never reimplements policy and never auto-merges.
+Part of the [Signetry platform](https://github.com/Signetry/signetry). Governance logic lives in [signetry-core](https://github.com/Signetry/core); this integration never reimplements policy and never auto-merges.
 
 ## License
 

SECURITY.md

@@ -1,8 +1,8 @@
 # Security policy
 
-This integration is a thin surface over [umbra-core](https://github.com/Signetry/core),
+This integration is a thin surface over [signetry-core](https://github.com/Signetry/core),
 which owns all governance logic. Please report vulnerabilities in the governance
-pipeline (contract evaluation, guard, verifier, receipts) against **umbra-core**.
+pipeline (contract evaluation, guard, verifier, receipts) against **signetry-core**.
 
 ## Reporting
 
@@ -15,7 +15,7 @@ public issue for an unpatched vulnerability.
 - The soft, in-editor guard is **defense-in-depth**. It may fail open only with a
   loud `INACTIVE` signal; it is not the hard security boundary.
 - The hard guarantee is the required check on the pull request
-  ([umbra-action](https://github.com/Signetry/action)) plus the signed
-  receipt — verifiable offline against Umbra's pinned public key.
-- `auto_merge` is always false. Umbra governs the agent; a human merges.
-- This integration never reimplements policy; it pins `umbra-core`.
+  ([signetry-action](https://github.com/Signetry/action)) plus the signed
+  receipt — verifiable offline against Signetry's pinned public key.
+- `auto_merge` is always false. Signetry governs the agent; a human merges.
+- This integration never reimplements policy; it pins `signetry-core`.

config.toml

@@ -1,10 +1,10 @@
-# Umbra MCP server for Codex — add to ~/.codex/config.toml
-# Requires: pip install "umbra-core @ git+https://github.com/Signetry/core@v0.5.4"
+# Signetry MCP server for Codex — add to ~/.codex/config.toml
+# Requires: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"
 
-[mcp_servers.umbra]
+[mcp_servers.signetry]
 command = "python"
-args = ["-m", "umbra_core.mcp_server"]
+args = ["-m", "signetry_core.mcp_server"]
 
-[mcp_servers.umbra.env]
+[mcp_servers.signetry.env]
 # Scope the server to your workspace(s) so it can't be pointed at arbitrary paths.
-UMBRA_MCP_ROOTS = "/absolute/path/to/your/repo"
+SIGNETRY_MCP_ROOTS = "/absolute/path/to/your/repo"