rename!: adopt Signetry naming

.github/workflows/cla.yml

@@ -48,7 +48,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/github-app/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/github-app/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/github-app/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

.github/workflows/reviewer.yml

@@ -1,6 +1,6 @@
 name: Reviewer
 
-# Advisory PR review (umbra-reviewer): surfaces architecture + security issues
+# Advisory PR review (signetry-reviewer): surfaces architecture + security issues
 # and posts one recommendation comment. Advisory only — it never merges and never
 # fails the PR. Changes to security-sensitive surfaces (workflows, packaging) are
 # escalated to a human. See https://github.com/Signetry/reviewer
@@ -22,9 +22,9 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - name: Install umbra-reviewer
+      - name: Install signetry-reviewer
         # source-available (All Rights Reserved); install from source, not PyPI.
-        run: pip install "umbra-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.1"
+        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2"
       - name: Compute the PR diff
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -40,7 +40,7 @@ jobs:
           PR: ${{ github.event.pull_request.number }}
         run: |
           set -uo pipefail
-          umbra-reviewer review \
+          signetry-reviewer review \
             --diff "$OUT/pr.diff" \
             --repo "$GITHUB_REPOSITORY" \
             --pr "$PR" \
@@ -56,9 +56,9 @@ jobs:
           script: |
             const fs = require('fs'); const path = require('path');
             const out = process.env.OUT || '';
-            let body = 'Umbra Reviewer: no review was produced.';
+            let body = 'Signetry Reviewer: no review was produced.';
             try { body = fs.readFileSync(path.join(out, 'comment.md'), 'utf8'); } catch (e) {}
-            const marker = '<!-- umbra-reviewer -->';
+            const marker = '<!-- signetry-reviewer -->';
             body = marker + '\n' + body;
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/).
 
+## [Unreleased]
+
+### Changed
+
+- Rebranded the platform from **Umbra** to **Signetry** across docs, the app
+  manifest display fields, and the reviewer workflow. CLI/package renamed
+  `umbra`/`umbra-core` → `signetry`/`signetry-core`, env vars `UMBRA_*` →
+  `SIGNETRY_*`, config `.umbra/` → `.signetry/`, and siblings `umbra-action` /
+  `umbra-reviewer` → `signetry-action` / `signetry-reviewer`. Install pins updated
+  to `signetry-core @ git+https://github.com/Signetry/core@v0.6.0` and
+  `signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2`.
+
 ## [0.1.0] — 2026-07-26
 
 ### Added

CLA.md

@@ -1,8 +1,8 @@
-# Umbra Contributor License Agreement (CLA)
+# Signetry Contributor License Agreement (CLA)
 
 **Copyright (c) 2026 Binay Dalai. All rights reserved.**
 
-Thank you for your interest in contributing to Umbra ("the Project"), owned by
+Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
 governs any contribution you submit. You must agree to it before your contribution
 can be accepted.

CONTRIBUTING.md

@@ -13,7 +13,7 @@ I have read the CLA Document and I hereby sign the CLA
 ```
 
 Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Umbra is **not open source** (All Rights Reserved) — by signing
+the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
 you assign copyright/ownership of your contribution to the Owner and gain no right to
 use, sell, or commercialize it yourself.
 

CONTRIBUTORS.md

@@ -1,6 +1,6 @@
 # Contributors
 
-Umbra is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 

README.md

@@ -1,17 +1,17 @@
-# umbra-github-app
+# signetry-github-app
 
 > **Copyright (c) 2026 Binay Dalai. All rights reserved.**
 > This repository is strictly for viewing and contributing to the original project. You may not use, copy, modify, distribute, or commercialize this code for your own personal or commercial projects without explicit written permission. Only the original author retains the right to use and monetize this project.
 
 
-**The Umbra GitHub App — install-once PR admission review, posted as the App.**
+**The Signetry GitHub App — install-once PR admission review, posted as the App.**
 
 Install once on an account or org (pick repos in GitHub's own UI) and every new
 pull request gets one advisory **Admission Decision** comment — verdict, reasons,
-and a link to the signed receipt. **Comment-only; Umbra never merges.**
+and a link to the signed receipt. **Comment-only; Signetry never merges.**
 
-Part of the [Umbra platform](https://github.com/Signetry/signetry).
-Governance logic lives in [umbra-core](https://github.com/Signetry/core);
+Part of the [Signetry platform](https://github.com/Signetry/signetry).
+Governance logic lives in [signetry-core](https://github.com/Signetry/core);
 the App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra)
 service. This repository is the App's **public home**: its manifest, setup docs,
 and configuration — not a second copy of the governance pipeline.
@@ -20,7 +20,7 @@ and configuration — not a second copy of the governance pipeline.
 
 1. A single app-level webhook (`POST /api/github/app/webhook`, hosted by `umbra`)
    receives PR events for every installation; each delivery is HMAC-verified.
-2. On a reviewable PR, Umbra mints a **short-lived installation token** from the
+2. On a reviewable PR, Signetry mints a **short-lived installation token** from the
    App's private key, reads the diff, runs the admission review (comment-only), and
    posts one comment.
 3. The installation token is read-only for the diff and comment-only to post — it
@@ -42,7 +42,7 @@ Full operator setup (secrets, Cloud Run): [SETUP.md](SETUP.md).
 
 - **Never merges.** `auto_merge` is always false — a human merges.
 - The comment restates the signed receipt; it never claims more than the receipt.
-- Governance is `umbra-core`; this repo carries no policy logic.
+- Governance is `signetry-core`; this repo carries no policy logic.
 
 See [SECURITY.md](SECURITY.md) ·
 [umbrella overview](https://github.com/Signetry/signetry).

SECURITY.md

@@ -1,13 +1,13 @@
 # Security policy
 
-The Umbra GitHub App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra)
-service and governed by [umbra-core](https://github.com/Signetry/core).
+The Signetry GitHub App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra)
+service and governed by [signetry-core](https://github.com/Signetry/core).
 This repo holds the App's manifest and setup docs only.
 
 ## Reporting
 
 Open a private security advisory on the relevant repository (`umbra` for the hosted
-webhook/token handling, `umbra-core` for governance), or use the umbrella contact:
+webhook/token handling, `signetry-core` for governance), or use the umbrella contact:
 <https://github.com/Signetry/signetry>. Do not open a public issue for an
 unpatched vulnerability.
 

SETUP.md

@@ -1,6 +1,6 @@
-# Umbra GitHub App — install-once PR auto-review
+# Signetry GitHub App — install-once PR auto-review
 
-Umbra's autonomous PR review is an **install-once GitHub App**. A user installs it on their account or
+Signetry's autonomous PR review is an **install-once GitHub App**. A user installs it on their account or
 org (choosing repos in GitHub's own UI), and every new pull request gets one advisory review comment —
 public or private repos, any account, **never merges**. There are no per-repo webhooks and no stored user
 token: reviews are posted **as the App**, using a short-lived installation token minted from the App's
@@ -10,21 +10,21 @@ private key.
 
 1. A single app-level webhook (`POST /api/github/app/webhook`) receives PR events for **every**
    installation. Each delivery is HMAC-verified against the App's webhook secret.
-2. On a reviewable PR (`opened` / `reopened` / `synchronize` / `ready_for_review`), Umbra mints an
+2. On a reviewable PR (`opened` / `reopened` / `synchronize` / `ready_for_review`), Signetry mints an
    installation access token from the App's private key (`GithubIntegration.get_access_token`), reads the
    PR diff, runs the Reviewer (comment-only, `allow_codex=False`), and posts one comment.
 3. The install's repos are tracked from the `installation` / `installation_repositories` events so the
-   dashboard can show what's covered. The `Setup URL` links an install to the signed-in Umbra user.
+   dashboard can show what's covered. The `Setup URL` links an install to the signed-in Signetry user.
 
 The installation token is short-lived, used read-only for the diff/clone and comment-only to post — it is
 **never** passed to the Codex child process.
 
 ## One-time setup (operator)
 
-Create the App under your GitHub account (this is the only step Umbra cannot do for you):
+Create the App under your GitHub account (this is the only step Signetry cannot do for you):
 
 1. GitHub → **Settings → Developer settings → GitHub Apps → New GitHub App**.
-2. **Name:** `Umbra Engineer` (this sets the install slug). **Homepage:** `https://umbra.engineer`.
+2. **Name:** `Signetry Engineer` (this sets the install slug). **Homepage:** `https://umbra.engineer`.
 3. **Webhook:** Active ✓ · **URL** `https://umbra.engineer/api/github/app/webhook` · **Secret:** a fresh
    random string (save it).
 4. **Repository permissions:** Pull requests → **Read & write**; Contents → **Read-only**; Metadata →
@@ -57,7 +57,7 @@ Never paste the private key or webhook secret into code, logs, or chat.
   (no valid signature) → **503**.
 - After secrets land: `GET /api/github/app` → `{"configured": true, "install_url": "https://github.com/apps/<slug>/installations/new"}`;
   an unsigned/bad-signature POST → **401**; a validly-signed `ping` → **200**.
-- End-to-end: install the App on a repo → open a PR → an **🌑 Umbra Review** comment appears within a few
+- End-to-end: install the App on a repo → open a PR → an **🌑 Signetry Review** comment appears within a few
   seconds; the dashboard lists the repo under "Autonomous PR auto-review". Failures are logged under the
   `umbra.webhook` logger (grep Cloud Run logs).
 

app-manifest.json

@@ -1,5 +1,5 @@
 {
-  "name": "Umbra Engineer",
+  "name": "Signetry Engineer",
   "url": "https://umbra.engineer",
   "hook_attributes": {
     "url": "https://umbra.engineer/api/github/app/webhook",
@@ -19,5 +19,5 @@
     "contents": "read",
     "metadata": "read"
   },
-  "description": "Umbra governs coding-agent pull requests: every new PR gets one advisory admission review comment (verdict + reasons + signed receipt). Comment-only — Umbra never merges. auto_merge is always false."
+  "description": "Signetry governs coding-agent pull requests: every new PR gets one advisory admission review comment (verdict + reasons + signed receipt). Comment-only — Signetry never merges. auto_merge is always false."
 }