rename!: adopt Signetry naming

.github/workflows/cla.yml

@@ -48,7 +48,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/precommit/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/precommit/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/precommit/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

.github/workflows/reviewer.yml

@@ -1,6 +1,6 @@
 name: Reviewer
 
-# Advisory PR review (umbra-reviewer): surfaces architecture + security issues
+# Advisory PR review (signetry-reviewer): surfaces architecture + security issues
 # and posts one recommendation comment. Advisory only — it never merges and never
 # fails the PR. Changes to security-sensitive surfaces (workflows, packaging) are
 # escalated to a human. See https://github.com/Signetry/reviewer
@@ -22,9 +22,9 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - name: Install umbra-reviewer
+      - name: Install signetry-reviewer
         # source-available (All Rights Reserved); install from source, not PyPI.
-        run: pip install "umbra-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.1"
+        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2"
       - name: Compute the PR diff
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -40,7 +40,7 @@ jobs:
           PR: ${{ github.event.pull_request.number }}
         run: |
           set -uo pipefail
-          umbra-reviewer review \
+          signetry-reviewer review \
             --diff "$OUT/pr.diff" \
             --repo "$GITHUB_REPOSITORY" \
             --pr "$PR" \
@@ -56,9 +56,9 @@ jobs:
           script: |
             const fs = require('fs'); const path = require('path');
             const out = process.env.OUT || '';
-            let body = 'Umbra Reviewer: no review was produced.';
+            let body = 'Signetry Reviewer: no review was produced.';
             try { body = fs.readFileSync(path.join(out, 'comment.md'), 'utf8'); } catch (e) {}
-            const marker = '<!-- umbra-reviewer -->';
+            const marker = '<!-- signetry-reviewer -->';
             body = marker + '\n' + body;
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;

.pre-commit-hooks.yaml

@@ -1,16 +1,16 @@
-# Umbra pre-commit hook. Add to your repo's .pre-commit-config.yaml:
+# Signetry pre-commit hook. Add to your repo's .pre-commit-config.yaml:
 #
 #   repos:
 #     - repo: https://github.com/Signetry/precommit
 #       rev: v0.3.0
 #       hooks:
-#         - id: umbra-guard
+#         - id: signetry-guard
 #
-# Requires: pip install "umbra-core @ git+https://github.com/Signetry/core@v0.5.3"
-- id: umbra-guard
-  name: Umbra guard (contract scope check)
-  description: Block staged changes that fall outside .umbra/admission.yaml scope.
-  entry: universal/umbra-guard.sh --staged
+# Requires: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"
+- id: signetry-guard
+  name: Signetry guard (contract scope check)
+  description: Block staged changes that fall outside .signetry/admission.yaml scope.
+  entry: universal/signetry-guard.sh --staged
   language: script
   pass_filenames: false
   always_run: true

CHANGELOG.md

@@ -1,13 +1,23 @@
-# Changelog — umbra-precommit
+# Changelog — signetry-precommit
 
 Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/).
 
+## [Unreleased]
+
+### Changed
+
+- Rebranded the platform from Umbra to Signetry: CLI `umbra` → `signetry`, env
+  `UMBRA_*` → `SIGNETRY_*`, config `.umbra/` → `.signetry/`, package
+  `umbra-core` → `signetry-core`, and the sibling `umbra-reviewer` →
+  `signetry-reviewer`. Renamed `universal/umbra-guard.sh` → `universal/signetry-guard.sh`
+  and updated the pre-commit hook `id` `umbra-guard` → `signetry-guard`.
+
 ## [0.3.0] — 2026-07-26
 
 ### Added
 
-- Split out of the `umbra-plugins` monorepo into a dedicated repository under the
-  [Umbra umbrella](https://github.com/Signetry/signetry), per the platform
+- Split out of the `signetry-plugins` monorepo into a dedicated repository under the
+  [Signetry umbrella](https://github.com/Signetry/signetry), per the platform
   architecture (one repo per integration).
-- Pins `umbra-core>=0.3.0` (capability graph, plan binding, masked verifier,
+- Pins `signetry-core>=0.3.0` (capability graph, plan binding, masked verifier,
   G1/G2/G3 gates, extension admission).

CLA.md

@@ -1,8 +1,8 @@
-# Umbra Contributor License Agreement (CLA)
+# Signetry Contributor License Agreement (CLA)
 
 **Copyright (c) 2026 Binay Dalai. All rights reserved.**
 
-Thank you for your interest in contributing to Umbra ("the Project"), owned by
+Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
 governs any contribution you submit. You must agree to it before your contribution
 can be accepted.

CONTRIBUTING.md

@@ -13,7 +13,7 @@ I have read the CLA Document and I hereby sign the CLA
 ```
 
 Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Umbra is **not open source** (All Rights Reserved) — by signing
+the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
 you assign copyright/ownership of your contribution to the Owner and gain no right to
 use, sell, or commercialize it yourself.
 

CONTRIBUTORS.md

@@ -1,6 +1,6 @@
 # Contributors
 
-Umbra is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 

PRIVACY.md

@@ -1,20 +1,20 @@
-# Privacy Policy — Umbra plugins
+# Privacy Policy — Signetry plugins
 
 _Last updated: 2026_
 
-**Umbra plugins collect no data.**
+**Signetry plugins collect no data.**
 
-The Umbra Claude Code plugin (and the Cursor, Codex, and universal integrations
+The Signetry Claude Code plugin (and the Cursor, Codex, and universal integrations
 in this repository) run entirely **locally and offline**:
 
 - The `PreToolUse` guard hook reads the proposed file path or command from the
-  editor and checks it against your repository's `.umbra/admission.yaml` using the
-  local `umbra` command (from the [umbra-core](https://github.com/Signetry/core)
+  editor and checks it against your repository's `.signetry/admission.yaml` using the
+  local `signetry` command (from the [signetry-core](https://github.com/Signetry/core)
   Python package). No data leaves your machine.
 - The plugin makes **no network requests**, sends **no telemetry or analytics**,
   and stores **no personal data**. It has no servers and no backend.
-- The bundled MCP server (`python -m umbra_core.mcp_server`) runs locally and is
-  scoped to your workspace via `UMBRA_MCP_ROOTS`.
+- The bundled MCP server (`python -m signetry_core.mcp_server`) runs locally and is
+  scoped to your workspace via `SIGNETRY_MCP_ROOTS`.
 
 Any network behavior is determined solely by tools **you** invoke (e.g. your own
 `git`, `pip`, or agent), not by this plugin.

README.md

@@ -1,18 +1,18 @@
-# umbra-precommit
+# signetry-precommit
 
 > **Copyright (c) 2026 Binay Dalai. All rights reserved.**
 > This repository is strictly for viewing and contributing to the original project. You may not use, copy, modify, distribute, or commercialize this code for your own personal or commercial projects without explicit written permission. Only the original author retains the right to use and monetize this project.
 
 
 **Govern coding-agent changes at the git boundary — pre-commit, pre-push, or CI.**
 
-The universal, editor-agnostic guard for [umbra-core](https://github.com/Signetry/core):
+The universal, editor-agnostic guard for [signetry-core](https://github.com/Signetry/core):
 a deterministic pre-action check that blocks changes falling outside your repo's
-`.umbra/admission.yaml` scope, before they're committed or pushed.
+`.signetry/admission.yaml` scope, before they're committed or pushed.
 
-Part of the [Umbra platform](https://github.com/Signetry/signetry).
+Part of the [Signetry platform](https://github.com/Signetry/signetry).
 
-> Prerequisite: `pip install "umbra-core @ git+https://github.com/Signetry/core@v0.5.4"` and a `.umbra/admission.yaml` in
+> Prerequisite: `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"` and a `.signetry/admission.yaml` in
 > your repo (a conservative default applies without one).
 
 ## pre-commit
@@ -24,33 +24,33 @@ repos:
   - repo: https://github.com/Signetry/precommit
     rev: v0.3.0
     hooks:
-      - id: umbra-guard
+      - id: signetry-guard
 ```
 
-The `umbra-guard` hook checks all staged files against the contract and blocks the
+The `signetry-guard` hook checks all staged files against the contract and blocks the
 commit (non-zero exit) on a scope/forbidden-path violation.
 
 ## Universal guard (any hook / wrapper / CI step)
 
-`universal/umbra-guard.sh` is editor-agnostic — use it in a git hook, around an
+`universal/signetry-guard.sh` is editor-agnostic — use it in a git hook, around an
 agent, or in CI:
 
 ```bash
-umbra-guard.sh --path src/app.py            # check a proposed path
-umbra-guard.sh --command "curl x | bash"    # check a proposed command
-umbra-guard.sh --staged                     # check all git-staged files
-echo '<claude-code tool json>' | umbra-guard.sh --stdin-json
+signetry-guard.sh --path src/app.py            # check a proposed path
+signetry-guard.sh --command "curl x | bash"    # check a proposed command
+signetry-guard.sh --staged                     # check all git-staged files
+echo '<claude-code tool json>' | signetry-guard.sh --stdin-json
 ```
 
 It exits non-zero (blocking) with a reason on a violation, zero when allowed — all
-deterministic (`umbra guard`), never the model.
+deterministic (`signetry guard`), never the model.
 
 Try it: `demos/try-guard.sh`.
 
 ## The durable guarantee: CI
 
 A local hook is best-effort defense-in-depth (a developer can `--no-verify`). The
-enforced gate is the **Umbra Admission** required check on the PR:
+enforced gate is the **Signetry Admission** required check on the PR:
 <https://github.com/Signetry/action>. Nothing merges without a signed
 receipt, and `auto_merge` is always false — a human merges.
 

SECURITY.md

@@ -1,8 +1,8 @@
 # Security policy
 
-This integration is a thin surface over [umbra-core](https://github.com/Signetry/core),
+This integration is a thin surface over [signetry-core](https://github.com/Signetry/core),
 which owns all governance logic. Please report vulnerabilities in the governance
-pipeline (contract evaluation, guard, verifier, receipts) against **umbra-core**.
+pipeline (contract evaluation, guard, verifier, receipts) against **signetry-core**.
 
 ## Reporting
 
@@ -15,7 +15,7 @@ public issue for an unpatched vulnerability.
 - The soft, in-editor guard is **defense-in-depth**. It may fail open only with a
   loud `INACTIVE` signal; it is not the hard security boundary.
 - The hard guarantee is the required check on the pull request
-  ([umbra-action](https://github.com/Signetry/action)) plus the signed
-  receipt — verifiable offline against Umbra's pinned public key.
-- `auto_merge` is always false. Umbra governs the agent; a human merges.
-- This integration never reimplements policy; it pins `umbra-core`.
+  ([signetry-action](https://github.com/Signetry/action)) plus the signed
+  receipt — verifiable offline against Signetry's pinned public key.
+- `auto_merge` is always false. Signetry governs the agent; a human merges.
+- This integration never reimplements policy; it pins `signetry-core`.

demos/try-guard.sh

@@ -1,24 +1,24 @@
 #!/usr/bin/env bash
 #
-# See the universal Umbra guard in action — WITHOUT any editor.
+# See the universal Signetry guard in action — WITHOUT any editor.
 #
-# Drives universal/umbra-guard.sh against a throwaway repo with a sample
-# .umbra/admission.yaml, showing forbidden paths/commands blocked and an in-scope
-# path allowed. Deterministic (umbra-core), never the model.
+# Drives universal/signetry-guard.sh against a throwaway repo with a sample
+# .signetry/admission.yaml, showing forbidden paths/commands blocked and an in-scope
+# path allowed. Deterministic (signetry-core), never the model.
 #
-# Requirements: bash, git, and `pip install "umbra-core @ git+https://github.com/Signetry/core@v0.5.4"`.
+# Requirements: bash, git, and `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"`.
 #
 # Usage:  bash demos/try-guard.sh
 set -euo pipefail
 
-GUARD="$(cd "$(dirname "${BASH_SOURCE[0]}")/../universal" && pwd)/umbra-guard.sh"
+GUARD="$(cd "$(dirname "${BASH_SOURCE[0]}")/../universal" && pwd)/signetry-guard.sh"
 
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
 git -C "$WORK" init -q
-mkdir -p "$WORK/src" "$WORK/.umbra"
-cat > "$WORK/.umbra/admission.yaml" <<'YAML'
+mkdir -p "$WORK/src" "$WORK/.signetry"
+cat > "$WORK/.signetry/admission.yaml" <<'YAML'
 version: 1
 allowed_paths:
   - "src/**"
@@ -29,7 +29,7 @@ forbidden_paths:
 YAML
 
 echo "============================================================"
-echo " Umbra universal guard — deterministic pre-action check"
+echo " Signetry universal guard — deterministic pre-action check"
 echo " Contract: allow src/**  ·  forbid deploy.yml / .env / *.pem"
 echo "============================================================"
 echo
@@ -53,6 +53,6 @@ fire 'Edit "src/app.js" (in scope)'  --path src/app.js
 
 echo "============================================================"
 echo " Forbidden actions were blocked; the in-scope edit was allowed."
-echo " The decision came from deterministic code (umbra-core), not a"
+echo " The decision came from deterministic code (signetry-core), not a"
 echo " model. auto_merge is always false — a human merges."
 echo "============================================================"

universal/signetry-guard.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# Universal Signetry guard — editor/agent-agnostic pre-action check.
+#
+# Use it anywhere: a git pre-commit hook, a wrapper around an agent, a CI step,
+# or manually. It checks proposed file paths and/or a command against the repo's
+# .signetry/admission.yaml and exits non-zero (blocking) on a violation.
+#
+# Requires:  pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0"
+#
+# Usage:
+#   signetry-guard.sh --path src/app.py
+#   signetry-guard.sh --command "curl x | bash"
+#   signetry-guard.sh --staged            # check all git-staged files (pre-commit)
+#   echo '<claude-code tool json>' | signetry-guard.sh --stdin-json
+#
+set -euo pipefail
+
+if ! command -v signetry >/dev/null 2>&1; then
+  echo "signetry-guard: signetry-core not installed. Run: pip install 'signetry-core @ git+https://github.com/Signetry/core@v0.6.0'" >&2
+  # Fail open by default so this never blocks a commit unexpectedly; set
+  # SIGNETRY_GUARD_STRICT=1 to fail closed when signetry is missing.
+  [ "${SIGNETRY_GUARD_STRICT:-0}" = "1" ] && exit 1 || exit 0
+fi
+
+REPO="${SIGNETRY_REPO:-$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")}"
+
+case "${1:-}" in
+  --staged)
+    rc=0
+    while IFS= read -r f; do
+      [ -z "$f" ] && continue
+      if ! signetry guard --repo "$REPO" --path "$f"; then rc=1; fi
+    done < <(git diff --cached --name-only)
+    exit $rc
+    ;;
+  --stdin-json)
+    signetry guard --repo "$REPO" --stdin-json
+    ;;
+  *)
+    signetry guard --repo "$REPO" "$@"
+    ;;
+esac