release: v0.4.2 [skip ci]

.gitea/workflows/post-merge.yml

@@ -7,10 +7,15 @@ name: Post-merge
 # Job dependency graph:
 #
 #   detect-type ──┬── release (skip if release commit)
-#                 ├── sync-wiki (skip if release commit)
 #                 ├── badges (ALWAYS runs — even on release commits)
-#                 ├── vikunja (skip if release commit)
-#                 └── configure-repo (skip if release commit)
+#                 ├── configure-repo (independent — skip if release commit)
+#                 ├── sync-wiki (needs release — skip if release commit/fails)
+#                 └── vikunja (needs release — skip if release commit/fails)
+#
+# sync-wiki and vikunja depend on release succeeding so that the wiki
+# and task tracker are only updated when the code is actually released.
+# If release fails, they are skipped to avoid leaving the wiki or
+# Vikunja in an inconsistent state with the codebase on master.
 #
 # The badges job depends on release so it picks up the latest version
 # number. It uses `if: always()` with no is-release condition so it
@@ -106,7 +111,7 @@ jobs:
             --commit "${{ github.sha }}"
 
   sync-wiki:
-    needs: [detect-type]
+    needs: [detect-type, release]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
     timeout-minutes: 10
@@ -173,7 +178,7 @@ jobs:
             --commit "${{ github.sha }}"
 
   vikunja:
-    needs: [detect-type]
+    needs: [detect-type, release]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
     timeout-minutes: 10
@@ -221,7 +226,6 @@ jobs:
       - name: Ensure branch protection and labels
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          DEVX_PUSH_WHITELIST: "emil"
           PYTHONPATH: src
         run: python3 -m devx.tools.configure_repo --repo devx --owner oblachno-oss
       - name: Notify on failure

.taskid

@@ -1 +1 @@
-DEVX-1
+DEVX-7

CHANGELOG.md

@@ -2,24 +2,53 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.2] - 2026-06-22
+
+### Bug Fixes
+
+- Make all warnings into errors across devx tools
+
+## [0.4.1] - 2026-06-22
+
+### Bug Fixes
+
+- Correct version tags, changelog, and release script recovery
+
+## [0.4.0] - 2026-06-22
+
+### Features
+
+- Add DEFAULT_INFRASTRUCTURE and configurable task prefix
+## [0.3.0] - 2026-06-22
+
+### Features
+
+- Add --no-ansible-collections option to setup tool
+## [0.2.0] - 2026-06-22
+
+### Features
+
+- Pluggable change classification framework
+## [0.1.2] - 2026-06-22
+
+### Bug Fixes
+
+- Make sync-wiki and vikunja depend on release
+## [0.1.1] - 2026-06-22
+
+### Bug Fixes
+
+- Disable push whitelist, allow direct pushes to master
+## [0.1.0] - 2026-06-22
+
 ## [0.1.0] - 2026-06-22
 
 ### Features
 
 - Extract reusable dev/CI tools from GRM into devx package
 
-## [unreleased]
-
-### Features
-
-- Extract reusable development and CI/CD tools from GRM into a standalone Python package
-- Port core modules: config, exceptions, i18n, api_clients, gitea_cli
-- Port 14 CI scripts: auto_merge, check_translations, classify_changes, detect_release_commit, discover_runners, doc_coverage, notify_failure, post_merge, pr_review, publish, push_badges, release, sync_wiki, validate_commit_msg
-- Port 6 dev tools: check_test_speed, generate_badges, install_checkmake, install_tools, setup, configure_repo
-- Port 5 molecule tools as optional extra: platforms, distribute_molecule, discover_runners, molecule_ci_guard, molecule_all
-- Add CLI entry point with subcommands: devx ci, devx tools, devx molecule
-- Add Gitea PyPI registry publishing support in publish.py
-- Add configurable workflow-only patterns in classify_changes.py
-- Add configurable version file path in release.py
-- Replicate GRM's automated workflow: CI, auto-merge, post-merge, release, badges, wiki sync, Vikunja
+### Bug Fixes
 
+- Use python3 and venv python in workflows and Makefile
+- Fix post-merge job failures (configure-repo, badges, notify-failure)
+- Allow release bot to push to protected master

cliff.toml

@@ -39,8 +39,8 @@ sort_commits = "oldest"
 recurse_submodules = false
 
 commit_preprocessors = [
-    # Strip DEVX-N task ID prefix from merge commits so git-cliff sees conventional commits
-    { pattern = "^DEVX-\\d+\\s+", replace = "" },
+    # Strip DEVX-N: task ID prefix from squash-merge commits so git-cliff sees conventional commits
+    { pattern = "^DEVX-\\d+:\\s+", replace = "" },
 ]
 
 commit_parsers = [
@@ -66,3 +66,6 @@ commit_parsers = [
 features_always_bump_minor = true
 breaking_always_bump_major = false
 initial_tag = "0.1.0"
+# Refactor commits bump patch — structural changes to src/ or pyproject.toml
+# affect users even though no new feature was added.
+refactor_always_bump_patch = true

pyproject.toml

@@ -83,3 +83,44 @@ indent-style = "space"
 include = ["src"]
 pythonVersion = "3.12"
 strict = ["src/devx/config.py", "src/devx/exceptions.py", "src/devx/i18n.py", "src/devx/api_clients.py", "src/devx/gitea_cli.py"]
+
+# ---------------------------------------------------------------------------
+# Change classification — determines which changes trigger a release
+# ---------------------------------------------------------------------------
+# The framework provides DEFAULT_INFRASTRUCTURE (CI workflows, tests, docs,
+# lint config, etc.) that applies to any Python project.  We only specify
+# what's different about devx.
+#
+# Rule priority (first match wins):
+#   1. user_facing_overrides (safety — highest priority)
+#   2. infrastructure_overrides (explicit per-file)
+#   3. infrastructure (DEFAULT_INFRASTRUCTURE + project-specific patterns)
+#   4. Default: user-facing (safe)
+[tool.devx.classify]
+# use_defaults = true   # (default) merge with DEFAULT_INFRASTRUCTURE
+
+# Project-specific infrastructure paths (merged with defaults).
+# devx has no additional infrastructure paths — everything not in the
+# defaults is user-facing (src/devx/**, pyproject.toml, translations.json).
+infrastructure = []
+
+# Infrastructure overrides — files that would default to user-facing
+# but are actually infrastructure:
+# - __init__.py: only contains __version__ (set by release.py, not user code)
+#
+# NOTE: api_clients.py is NOT here — it's used by devx's CI modules
+# (auto_merge.py, release.py, pr_review.py, etc.) which consumer projects
+# call via `python -m devx.ci.*`. Changes to api_clients.py affect consumer
+# projects' CI behavior, so it IS user-facing.
+infrastructure_overrides = [
+    "src/devx/__init__.py",
+]
+
+# User-facing overrides — safety override for broad infrastructure patterns
+# (empty — add when an infrastructure pattern is too broad)
+user_facing_overrides = []
+
+# Tag patterns — additional categories for CI conditional execution
+# Orthogonal to release impact (user-facing vs infrastructure)
+[tool.devx.classify.tags]
+# No tags needed for devx itself — it has no ansible/ directory

src/devx/__init__.py

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""
 
-__version__ = "0.1.0"
+__version__ = "0.4.2"

src/devx/api_clients.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import logging
 import time
 from typing import Any
@@ -21,7 +22,7 @@ def _parse_error(e: requests.HTTPError) -> tuple[int, str]:
     try:
         body: dict[str, Any] = response.json() if response is not None else {}
         message: str = body.get("message", str(e))
-    except Exception:
+    except (json.JSONDecodeError, ValueError, AttributeError):
         message = str(e)
     return status, message
 

src/devx/ci/auto_merge.py

@@ -6,8 +6,11 @@ Runs as the final job in ci.yml. Reads the task ID from ``.taskid`` file
 validates the PR title, and squash-merges with a conventional commit
 message prefixed by the task ID.
 
-PR title format:    ``DEVX-N: <vikunja task title>``
-Merge commit format: ``DEVX-N: <conventional commit message>``
+PR title format:    ``{PREFIX}-N: <vikunja task title>``
+Merge commit format: ``{PREFIX}-N <conventional commit message>``
+
+The ``{PREFIX}`` is determined by ``DEVX_TASK_PREFIX`` (default: ``DEVX``).
+Each project sets its own prefix (e.g., ``GRM``, ``INFRA``).
 
 The conventional commit message is extracted from the PR commits.
 This allows the PR title to be a human-friendly Vikunja task title
@@ -32,6 +35,7 @@ from devx.config import (
     DEFAULT_PER_PAGE,
     GITEA_API_URL,
     TASK_ID_RE,
+    TASK_PREFIX,
     VIKUNJA_API_URL,
     VIKUNJA_PROJECT_ID,
 )
@@ -39,7 +43,7 @@ from devx.exceptions import APIError
 from devx.i18n import _
 
 TASKID_FILE = ".taskid"
-PR_TITLE_RE = re.compile(r"^DEVX-\d+:\s+.+")
+PR_TITLE_RE = re.compile(rf"^{TASK_PREFIX}-\d+:\s+.+")
 
 load_dotenv()
 
@@ -84,14 +88,15 @@ def extract_task_id(branch: str) -> str:
 def validate_pr_title(pr_title: str, task_id: str) -> None:
     """Raise ClickException if PR title does not follow the required format.
 
-    Expected: ``DEVX-N: <vikunja task title>``
+    Expected: ``{PREFIX}-N: <vikunja task title>``
     """
     if not PR_TITLE_RE.match(pr_title):
         raise click.ClickException(
             _(
-                "Oops! PR title must follow format 'DEVX-N: <task title>'.\n"
+                "Oops! PR title must follow format '{prefix}-N: <task title>'.\n"
                 "  Expected: {task_id}: <task title>\n"
                 "  Got:      {pr_title}",
+                prefix=TASK_PREFIX,
                 task_id=task_id,
                 pr_title=pr_title,
             )
@@ -109,12 +114,11 @@ def validate_pr_title(pr_title: str, task_id: str) -> None:
 def get_vikunja_task_title(task_id: str) -> str:
     """Fetch the Vikunja task title for the given DEVX-N identifier.
 
-    Returns empty string if VIKUNJA_TOKEN is not set (local dev without token).
-    Raises ClickException if the token is set but the task is not found.
+    Raises ClickException if VIKUNJA_TOKEN is not set or the task is not found.
     """
     token = os.environ.get("VIKUNJA_TOKEN", "")
     if not token:
-        return ""
+        raise click.ClickException(_("VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles."))
     client = VikunjaClient(VIKUNJA_API_URL, token)
     page = 1
     while True:
@@ -140,14 +144,10 @@ def get_vikunja_task_title(task_id: str) -> str:
 def validate_pr_title_matches_vikunja(pr_title: str, task_id: str) -> None:
     """Validate that PR title matches the Vikunja task title.
 
-    Skips validation if VIKUNJA_TOKEN is not set (local dev).
-    Raises ClickException if the task is not found or the title doesn't match.
+    Raises ClickException if VIKUNJA_TOKEN is not set, the task is not found,
+    or the title doesn't match.
     """
     vikunja_title = get_vikunja_task_title(task_id)
-    if not vikunja_title:
-        # VIKUNJA_TOKEN not set — skip validation (local dev)
-        click.echo(_("Warning: VIKUNJA_TOKEN not set, skipping title match validation."))
-        return
     expected = f"{task_id}: {vikunja_title}"
     if pr_title != expected:
         raise click.ClickException(
@@ -188,7 +188,16 @@ def main(branch: str, pr_title: str, repo: str, pr_number: str) -> None:
     if not token:
         raise click.ClickException(_("ERROR: REPO_TOKEN is not set."))
 
-    owner, repo_name = repo.split("/")
+    # Validate PR number is an integer
+    try:
+        pr_num = int(pr_number)
+    except ValueError:
+        raise click.ClickException(_("PR number must be an integer, got: {pr_number}", pr_number=pr_number)) from None
+
+    # Validate repo format
+    if "/" not in repo:
+        raise click.ClickException(_("Repo must be in 'owner/name' format, got: {repo}", repo=repo))
+    owner, repo_name = repo.split("/", 1)
     client = GiteaClient(GITEA_API_URL, token, owner, repo_name)
 
     task_id = read_taskid(branch)
@@ -205,14 +214,14 @@ def main(branch: str, pr_title: str, repo: str, pr_number: str) -> None:
     validate_pr_title_matches_vikunja(pr_title, task_id)
 
     # Build merge title: DEVX-N: <conventional commit message>
-    commits = client.get_pr_commits(pr_number)
+    commits = client.get_pr_commits(pr_num)
     conv_msg = extract_conventional_msg(commits)
     if not conv_msg:
         raise click.ClickException(_("Could not extract conventional commit message from PR commits."))
     merge_title = f"{task_id}: {conv_msg}"
 
     try:
-        client.merge_pr(pr_number, merge_title)
+        client.merge_pr(pr_num, merge_title)
     except APIError as e:
         if e.status == 405 and "behind" in e.message.lower():
             # Head branch is behind master — pull master and rebase, then retry
@@ -224,7 +233,7 @@ def main(branch: str, pr_title: str, repo: str, pr_number: str) -> None:
                 run_cmd(["git", "rebase", "origin/master"])
                 run_cmd(["git", "push", "--force-with-lease", "origin", f"HEAD:{branch}"])
                 click.echo(_("Rebased and pushed. Retrying merge..."))
-                client.merge_pr(pr_number, merge_title)
+                client.merge_pr(pr_num, merge_title)
             except (APIError, Exception) as retry_err:
                 raise click.ClickException(
                     _(
@@ -245,7 +254,7 @@ def main(branch: str, pr_title: str, repo: str, pr_number: str) -> None:
     click.echo(
         _(
             "Nice! PR #{pr_number} squash-merged with title: {merge_title}",
-            pr_number=pr_number,
+            pr_number=pr_num,
             merge_title=merge_title,
         )
     )

src/devx/ci/check_translations.py

@@ -12,13 +12,13 @@ Checks performed (all fail with exit code 1 on error):
   translations file.
 - **Dead keys**: a key in a translations file is not used in any code.
 - **Missing languages**: a key exists but is missing one of the 5 supported
-  languages (en, bg, de, ru, zh). Reported as a warning, not an error.
+  languages (en, bg, de, ru, zh). This is an error — all supported languages
+  must have translations for every key.
 
 Usage::
 
     python3 -m devx.ci.check_translations
     python3 -m devx.ci.check_translations --translations path/to/translations.json
-    python3 -m devx.ci.check_translations --strict  # warnings are errors
 """
 
 from __future__ import annotations
@@ -130,14 +130,15 @@ def check_translation_set(name: str, src_dir: Path, trans_file: Path) -> Transla
     # Check for dead keys (in translations but not used in code)
     result.dead_keys = result.defined_keys - result.used_keys
     for key in sorted(result.dead_keys):
-        result.warnings.append(f"Dead key in {name}: {key!r}")
+        result.errors.append(f"Dead key in {name}: {key!r}")
 
-    # Check for missing languages
+    # Check for missing languages — this is an error, not a warning.
+    # All supported languages must have translations for every key.
     for key, langs in translations.items():
         missing = [lang for lang in SUPPORTED_LANGS if lang not in langs]
         if missing:
             result.missing_langs[key] = missing
-            result.warnings.append(f"Missing languages {missing} for key {key!r} in {name}")
+            result.errors.append(f"Missing languages {missing} for key {key!r} in {name}")
 
     return result
 
@@ -170,8 +171,7 @@ def print_result(result: TranslationCheckResult) -> None:
     type=click.Path(exists=False, path_type=Path),
     help="Path to a translations JSON file to check (can be repeated). Defaults to src/devx/translations.json.",
 )
-@click.option("--strict", is_flag=True, default=False, help="Treat warnings as errors.")
-def main(translations: tuple[Path, ...], strict: bool) -> None:
+def main(translations: tuple[Path, ...]) -> None:
     """Check translation files for gaps, dead keys, and missing languages."""
     if not translations:
         # Default: check the devx package's own translations
@@ -187,25 +187,16 @@ def main(translations: tuple[Path, ...], strict: bool) -> None:
             results.append(check_translation_set(name, src_dir, trans_file))
 
     has_errors = False
-    has_warnings = False
     for result in results:
         print_result(result)
         if result.errors:
             has_errors = True
-        if result.warnings:
-            has_warnings = True
 
     click.echo()
     if has_errors:
         click.echo("FAIL: Translation check found errors.", err=True)
         sys.exit(1)
-    if strict and has_warnings:
-        click.echo("FAIL: Translation check found warnings (--strict mode).", err=True)
-        sys.exit(1)
-    if has_warnings:
-        click.echo("PASS with warnings: Translation check passed (warnings present).")
-    else:
-        click.echo("PASS: All translations are complete and up to date.")
+    click.echo("PASS: All translations are complete and up to date.")
 
 
 if __name__ == "__main__":  # pragma: no cover

src/devx/ci/classify_changes.py

@@ -1,106 +1,465 @@
 #!/usr/bin/env python3
-"""Classify git changes as user-facing or workflow-only.
+"""Classify git changes as user-facing or infrastructure.
 
 Determines whether changes between two git refs (e.g., last tag and HEAD)
-affect the tool itself (user-facing) or only the CI/CD infrastructure
+affect the published package (user-facing) or only the CI/CD infrastructure
 (workflow-only).  This is used by:
 
-- **release.py** — skips release when only workflow files changed
+- **release.py** — skips release when only infrastructure files changed
 - **CI workflow** — skips molecule tests and release dry-run when only
-  workflow files changed
+  infrastructure files changed
 
-Classification strategy (safe-by-default):
+== Design Philosophy ==
 
-  Any file that is NOT in the explicit workflow-only allowlist is treated
-  as user-facing.  This ensures new file types default to requiring a
-  release rather than silently skipping it.
+**Safe-by-default**: Any file that doesn't match a rule defaults to
+user-facing.  This prevents new file types from accidentally skipping
+releases — a critical safety property.  When in doubt, release.
 
-  The workflow-only patterns are configurable via the ``patterns``
-  parameter on ``classify_changes()`` and ``has_user_facing_changes()``.
-  The default set (``DEFAULT_WORKFLOW_ONLY_PATTERNS``) covers common
-  infrastructure paths. Each project can pass its own frozenset to
-  accommodate different source layouts.
+**Framework-provided defaults**: The framework ships with
+``DEFAULT_INFRASTRUCTURE`` — a curated list of paths that are
+infrastructure for ANY Python project (CI workflows, tests, docs,
+lint config, etc.).  Projects inherit these automatically and only
+need to specify what's *different* about their project.
 
-  Default workflow-only paths (infrastructure → no release needed):
-    - .gitea/workflows/**          — Gitea Actions workflows
-    - scripts/**                   — All scripts (CI/CD, dev tools, setup)
-    - src/devx/__init__.py         — Version file (release artifact)
-    - src/devx/api_clients.py      — Gitea API client (CI/CD only, not used by CLI)
-    - docs/**                      — Documentation
-    - tests/**                     — Test files
-    - hooks/**                     — Git hooks
-    - AGENTS.md                    — Agent conventions
-    - README.md                    — README (lean, links to wiki)
-    - CHANGELOG.md                 — Changelog (generated)
-    - TROUBLESHOOTING.md           — Troubleshooting guide
-    - cliff.toml                   — git-cliff config
-    - Makefile                     — Build automation
-    - .pre-commit-config.yaml      — Pre-commit config
-    - .ansible-lint                — Ansible lint config
-    - .env.example                 — Environment template
-    - .gitignore                   — Git ignore rules
-    - .ruff.toml                   — Ruff config (if separate)
-    - .github/**                   — GitHub config (if present)
+**Config-driven**: Classification rules are read from ``[tool.devx.classify]``
+in ``pyproject.toml``.  No project needs to modify the framework code.
+Each project declares its own paths; the framework handles the logic.
 
-  Everything else is user-facing (tool changes → release needed),
-  including but not limited to:
-    - src/devx/*.py — Python CLI source (except __init__.py)
-    - ansible/**                   — Ansible role
-    - pyproject.toml               — Package metadata
-    - Any new file type not in the allowlist
+**Layered rules** (evaluated in priority order):
+
+  1. **User-facing overrides** (highest priority — safety override)
+     Files that match infrastructure patterns but MUST be treated as
+     user-facing.  Use this when an infrastructure pattern is too broad.
+
+  2. **Infrastructure overrides**
+     Files that would default to user-facing but are actually
+     infrastructure (e.g., ``src/pkg/__init__.py`` which only contains
+     ``__version__`` — a release artifact, not user-facing code).
+
+  3. **Infrastructure patterns** (deny-list)
+     Path globs matching infrastructure files.  This is the union of
+     ``DEFAULT_INFRASTRUCTURE`` and the project's ``infrastructure`` list.
+     Changes to these don't trigger a release.
+
+  4. **Default**: user-facing (lowest priority — safe default)
+
+**Tag system** (orthogonal to release impact):
+  Projects can define custom tags (e.g., ``ansible``, ``docs``) for CI
+  conditional execution.  A file can be both infrastructure (no release)
+  and tagged ``ansible`` (run molecule tests).  Tags are evaluated
+  independently of the user-facing/infrastructure classification.
+  The ``--check`` CLI option accepts any tag name defined in the config,
+  and ``--github-output`` writes ``<tag>-changed`` for each configured tag.
+
+== Configuration ==
+
+In ``pyproject.toml``::
+
+    [tool.devx.classify]
+    # Whether to merge with DEFAULT_INFRASTRUCTURE (default: true).
+    # Set to false to specify all patterns explicitly.
+    # use_defaults = true
+
+    # Project-specific infrastructure paths (merged with defaults).
+    # Only list paths NOT already in DEFAULT_INFRASTRUCTURE.
+    infrastructure = [
+        "scripts/**",       # e.g., if scripts/ is dev-only tooling
+    ]
+
+    # Infrastructure overrides — files that would default to user-facing
+    # but are actually infrastructure
+    infrastructure_overrides = [
+        "src/mypkg/__init__.py",   # only contains __version__
+    ]
+
+    # User-facing overrides — safety override for broad infrastructure patterns
+    # (empty by default)
+    user_facing_overrides = []
+
+    # Tag patterns — additional categories for CI conditional execution
+    [tool.devx.classify.tags]
+    ansible = ["ansible/**", ".ansible-lint"]
+
+== What counts as "user-facing" ==
+
+A change is user-facing if it affects the behavior of the installed
+package.  For a library/CLI tool, this means:
+
+  - Source code in ``src/`` (except ``__init__.py`` which only holds
+    ``__version__``)
+  - Package metadata (``pyproject.toml`` — dependencies, entry points)
+  - Ansible roles, playbooks, templates (if the project ships Ansible)
+  - Translation files (user-visible messages)
+  - Any file not explicitly classified as infrastructure
+
+A change is infrastructure if it only affects the project's own
+development/CI environment:
+
+  - CI/CD workflows (``.gitea/**``, ``.github/**``)
+  - Tests (``tests/**``)
+  - Documentation (``docs/**``, ``README.md``, ``CHANGELOG.md``)
+  - Linting/formatting config (``.ruff.toml``, ``.pre-commit-config.yaml``)
+  - Build tooling (``Makefile``, ``cliff.toml``)
+  - Git hooks (``hooks/**``)
+  - Generated scripts (``activate.sh``, ``activate.fish``, ``activate.zsh``)
+
+== Glob Syntax ==
+
+Patterns support standard glob syntax:
+
+  - ``**`` matches any number of path segments (including zero)
+  - ``*`` matches any characters within a single path segment
+  - ``?`` matches a single character within a single path segment
+  - Everything else is matched literally
+
+Examples:
+  - ``.gitea/**`` matches ``.gitea/workflows/ci.yml``, ``.gitea/actionlint.yaml``
+  - ``tests/**`` matches ``tests/unit/test_cli.py``, ``tests/conftest.py``
+  - ``src/devx/__init__.py`` matches exactly that file
+  - ``Makefile`` matches exactly that file
 
 Usage:
   python3 -m devx.ci.classify_changes [--base <ref>] [--head <ref>]
   python3 -m devx.ci.classify_changes --base v0.3.0 --head HEAD
+  python3 -m devx.ci.classify_changes --check ansible --quiet
+  python3 -m devx.ci.classify_changes --github-output
 """
 
 from __future__ import annotations
 
+import os
+import re
 import subprocess  # nosec B404
 import sys
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
 
 import click
 
 from devx.i18n import _
 
-# Explicit allowlist of workflow-only path patterns.
-# Anything NOT matching these is treated as user-facing (safe default).
-# This is the default set — projects can override via the ``patterns``
-# parameter on classify_changes() / has_user_facing_changes().
-DEFAULT_WORKFLOW_ONLY_PATTERNS: frozenset[str] = frozenset(
-    [
-        # CI/CD infrastructure
-        ".gitea/",
-        # All scripts are infrastructure (CI/CD, dev tools, setup)
-        # User-facing code lives in src/devx/
-        "scripts/",
-        # Version file — only contains __version__, not user-facing code.
-        # Version bumps are a release artifact, not a feature.
-        "src/devx/__init__.py",
-        # Gitea API client — used only by CI/CD scripts, not by the CLI.
-        "src/devx/api_clients.py",
-        # Documentation
-        "docs/",
-        "AGENTS.md",
-        "README.md",
-        "CHANGELOG.md",
-        "TROUBLESHOOTING.md",
-        # Tests
-        "tests/",
-        # Config / build automation
-        "cliff.toml",
-        "Makefile",
-        ".pre-commit-config.yaml",
-        ".ansible-lint",
-        ".env.example",
-        ".gitignore",
-        ".ruff.toml",
-        # Hooks
-        "hooks/",
-        # GitHub (if ever added)
-        ".github/",
-    ]
-)
+# ---------------------------------------------------------------------------
+# Data structures
+# ---------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class FileClassification:
+    """Result of classifying a single file.
+
+    Attributes:
+        path: The file path relative to repo root.
+        is_user_facing: True if changes to this file require a release.
+        reason: Human-readable explanation of the classification.
+        matched_rule: Which rule matched (e.g., "infrastructure: .gitea/**").
+            None if the default rule was used.
+        tags: Custom category tags (e.g., {"ansible"}).
+    """
+
+    path: str
+    is_user_facing: bool
+    reason: str
+    matched_rule: str | None
+    tags: frozenset[str] = frozenset()
+
+
+@dataclass
+class ClassificationResult:
+    """Result of classifying a set of changed files.
+
+    Attributes:
+        files: Per-file classification details.
+        user_facing: List of file paths classified as user-facing.
+        infrastructure: List of file paths classified as infrastructure.
+        tags: Dict mapping tag name to list of file paths matching that tag.
+    """
+
+    files: list[FileClassification] = field(default_factory=list)
+    user_facing: list[str] = field(default_factory=list)
+    infrastructure: list[str] = field(default_factory=list)
+    tags: dict[str, list[str]] = field(default_factory=dict)
+
+    @property
+    def has_user_facing(self) -> bool:
+        """True if any user-facing files were found."""
+        return bool(self.user_facing)
+
+    def has_tag(self, tag: str) -> bool:
+        """True if any files matched the given tag."""
+        return bool(self.tags.get(tag))
+
+
+# ---------------------------------------------------------------------------
+# Glob matching
+# ---------------------------------------------------------------------------
+
+
+def _glob_to_regex(pattern: str) -> re.Pattern[str]:
+    """Convert a glob pattern to a compiled regex.
+
+    Supports:
+      - ``**``  -> matches any number of path segments (including zero)
+      - ``*``   -> matches any chars within a single path segment
+      - ``?``   -> matches a single char within a path segment
+      - All other characters are matched literally
+    """
+    # Handle ** at the end (e.g., ".gitea/**")
+    # ** matches anything including slashes
+    parts: list[str] = []
+    i = 0
+    while i < len(pattern):
+        c = pattern[i]
+        if c == "*" and i + 1 < len(pattern) and pattern[i + 1] == "*":
+            parts.append(".*")
+            i += 2
+            # Skip trailing slash after **
+            if i < len(pattern) and pattern[i] == "/":
+                i += 1
+        elif c == "*":
+            parts.append("[^/]*")
+            i += 1
+        elif c == "?":
+            parts.append("[^/]")
+            i += 1
+        else:
+            parts.append(re.escape(c))
+            i += 1
+    return re.compile("^" + "".join(parts) + "$")
+
+
+def _matches_glob(file_path: str, pattern: str) -> bool:
+    """Check if a file path matches a glob pattern.
+
+    Also supports prefix matching: if the pattern ends with ``/``,
+    any file starting with that prefix matches.  This is a convenience
+    for patterns like ``.gitea/`` (equivalent to ``.gitea/**``).
+    """
+    # Prefix matching for patterns ending with /
+    if pattern.endswith("/") and (file_path.startswith(pattern) or file_path == pattern.rstrip("/")):
+        return True
+    return _glob_to_regex(pattern).match(file_path) is not None
+
+
+# ---------------------------------------------------------------------------
+# Classifier
+# ---------------------------------------------------------------------------
+
+
+# ---------------------------------------------------------------------------
+# Default infrastructure patterns
+# ---------------------------------------------------------------------------
+
+# Common infrastructure paths that apply to ANY Python project using devx.
+# Projects inherit these automatically and only need to specify project-specific
+# paths in their [tool.devx.classify] section.
+#
+# Rationale: these files/directories are development tooling, CI/CD config,
+# or generated artifacts. Changes to them don't affect the installed package's
+# behavior, so they don't warrant a release.
+DEFAULT_INFRASTRUCTURE: list[str] = [
+    # CI/CD workflow definitions
+    ".gitea/**",
+    ".github/**",
+    # Test files
+    "tests/**",
+    # Documentation
+    "docs/**",
+    # Git hooks
+    "hooks/**",
+    # Build tooling
+    "Makefile",
+    "cliff.toml",
+    # Linting / formatting config
+    ".pre-commit-config.yaml",
+    ".ruff.toml",
+    ".ansible-lint",
+    # Environment templates (not the actual .env which is gitignored)
+    ".env.example",
+    # Git config
+    ".gitignore",
+    # Project-level documentation (not part of the installed package)
+    "AGENTS.md",
+    "README.md",
+    "CHANGELOG.md",
+    "TROUBLESHOOTING.md",
+    # Generated venv activation scripts (created by `make setup`)
+    "activate.sh",
+    "activate.fish",
+    "activate.zsh",
+    # CI task tracking file (written by CI, not by developers)
+    ".taskid",
+]
+
+
+@dataclass
+class ClassifierConfig:
+    """Configuration for the change classifier.
+
+    Loaded from ``[tool.devx.classify]`` in ``pyproject.toml``.
+
+    By default, the framework's ``DEFAULT_INFRASTRUCTURE`` patterns are
+    merged with the project's ``infrastructure`` list.  Set
+    ``use_defaults = false`` to disable defaults and specify all
+    patterns explicitly.
+
+    Attributes:
+        infrastructure: Glob patterns for infrastructure paths
+            (merged with DEFAULT_INFRASTRUCTURE unless use_defaults is False).
+        infrastructure_overrides: Exact paths that are infrastructure
+            despite not matching any infrastructure pattern.
+        user_facing_overrides: Exact paths that are user-facing
+            despite matching an infrastructure pattern (safety override).
+        tags: Dict mapping tag name to list of glob patterns.
+        use_defaults: If True (default), merge with DEFAULT_INFRASTRUCTURE.
+    """
+
+    infrastructure: list[str] = field(default_factory=list)
+    infrastructure_overrides: list[str] = field(default_factory=list)
+    user_facing_overrides: list[str] = field(default_factory=list)
+    tags: dict[str, list[str]] = field(default_factory=dict)
+    use_defaults: bool = True
+
+    @classmethod
+    def from_pyproject(cls, pyproject_path: str = "pyproject.toml") -> ClassifierConfig:
+        """Load classifier config from pyproject.toml.
+
+        Reads the ``[tool.devx.classify]`` section.  If the section or
+        file is missing, returns a config with only DEFAULT_INFRASTRUCTURE
+        (everything else defaults to user-facing — safe-by-default).
+        """
+        path = Path(pyproject_path)
+        if not path.exists():
+            return cls(infrastructure=list(DEFAULT_INFRASTRUCTURE))
+        with open(path, "rb") as f:  # noqa: PTH123
+            data: dict[str, Any] = tomllib.load(f)
+        classify_cfg = data.get("tool", {}).get("devx", {}).get("classify", {})
+
+        use_defaults = classify_cfg.get("use_defaults", True)
+        project_infra = list(classify_cfg.get("infrastructure", []))
+
+        if use_defaults:
+            # Merge defaults with project-specific patterns (deduplicated)
+            merged = list(DEFAULT_INFRASTRUCTURE)
+            for p in project_infra:
+                if p not in merged:
+                    merged.append(p)
+            infrastructure = merged
+        else:
+            infrastructure = project_infra
+
+        return cls(
+            infrastructure=infrastructure,
+            infrastructure_overrides=list(classify_cfg.get("infrastructure_overrides", [])),
+            user_facing_overrides=list(classify_cfg.get("user_facing_overrides", [])),
+            tags={k: list(v) for k, v in classify_cfg.get("tags", {}).items()},
+            use_defaults=use_defaults,
+        )
+
+
+class ChangeClassifier:
+    """Classify changed files as user-facing or infrastructure.
+
+    Uses layered rules with safe-by-default semantics.
+
+    Rule evaluation order (first match wins):
+      1. User-facing overrides (safety — highest priority)
+      2. Infrastructure overrides
+      3. Infrastructure patterns
+      4. Default: user-facing (safe)
+    """
+
+    def __init__(self, config: ClassifierConfig | None = None) -> None:
+        self.config = config or ClassifierConfig.from_pyproject()
+        # Pre-compile infrastructure patterns for efficiency
+        self._infra_patterns = list(self.config.infrastructure)
+        self._infra_overrides = set(self.config.infrastructure_overrides)
+        self._user_overrides = set(self.config.user_facing_overrides)
+
+    def classify_file(self, file_path: str) -> FileClassification:
+        """Classify a single file path.
+
+        Returns a FileClassification with the decision and reason.
+        """
+        tags = self._compute_tags(file_path)
+
+        # 1. User-facing overrides (highest priority — safety)
+        if file_path in self._user_overrides:
+            return FileClassification(
+                path=file_path,
+                is_user_facing=True,
+                reason="User-facing override (safety override)",
+                matched_rule="user_facing_overrides",
+                tags=tags,
+            )
+
+        # 2. Infrastructure overrides
+        if file_path in self._infra_overrides:
+            return FileClassification(
+                path=file_path,
+                is_user_facing=False,
+                reason="Infrastructure override (explicitly listed)",
+                matched_rule="infrastructure_overrides",
+                tags=tags,
+            )
+
+        # 3. Infrastructure patterns
+        for pattern in self._infra_patterns:
+            if _matches_glob(file_path, pattern):
+                return FileClassification(
+                    path=file_path,
+                    is_user_facing=False,
+                    reason=f"Infrastructure (matches '{pattern}')",
+                    matched_rule=f"infrastructure: {pattern}",
+                    tags=tags,
+                )
+
+        # 4. Default: user-facing (safe-by-default)
+        return FileClassification(
+            path=file_path,
+            is_user_facing=True,
+            reason="User-facing (default — not in infrastructure patterns)",
+            matched_rule=None,
+            tags=tags,
+        )
+
+    def classify(self, files: list[str]) -> ClassificationResult:
+        """Classify a list of changed files.
+
+        Returns a ClassificationResult with per-file details and
+        aggregated lists.
+        """
+        result = ClassificationResult()
+        all_tags: dict[str, list[str]] = {}
+
+        for f in files:
+            fc = self.classify_file(f)
+            result.files.append(fc)
+            if fc.is_user_facing:
+                result.user_facing.append(f)
+            else:
+                result.infrastructure.append(f)
+            for tag in fc.tags:
+                all_tags.setdefault(tag, []).append(f)
+
+        result.tags = all_tags
+        return result
+
+    def _compute_tags(self, file_path: str) -> frozenset[str]:
+        """Compute custom category tags for a file path."""
+        matched: set[str] = set()
+        for tag_name, patterns in self.config.tags.items():
+            for pattern in patterns:
+                if _matches_glob(file_path, pattern):
+                    matched.add(tag_name)
+                    break
+        return frozenset(matched)
+
+
+# ---------------------------------------------------------------------------
+# Git helpers
+# ---------------------------------------------------------------------------
 
 
 def run_git(args: list[str]) -> str:
@@ -126,63 +485,6 @@ def get_changed_files(base: str, head: str) -> list[str]:
     return output.split("\n")
 
 
-def is_workflow_only(
-    file_path: str,
-    patterns: frozenset[str] | None = None,
-) -> bool:
-    """Check if a file path is workflow-only (infrastructure, not the tool itself).
-
-    Uses an explicit allowlist — anything not in the list is treated as
-    user-facing (safe default that prevents accidental release skips).
-    """
-    p = patterns if patterns is not None else DEFAULT_WORKFLOW_ONLY_PATTERNS
-    return any(file_path.startswith(pattern) or file_path == pattern for pattern in p)
-
-
-def is_user_facing(
-    file_path: str,
-    patterns: frozenset[str] | None = None,
-) -> bool:
-    """Check if a file path is user-facing (affects the tool).
-
-    Inverse of is_workflow_only — anything not explicitly workflow-only
-    is treated as user-facing.
-    """
-    return not is_workflow_only(file_path, patterns)
-
-
-def classify_changes(
-    files: list[str],
-    patterns: frozenset[str] | None = None,
-) -> dict[str, list[str]]:
-    """Classify changed files into user-facing and workflow-only.
-
-    Returns a dict with keys "user_facing" and "workflow_only".
-    """
-    user_facing: list[str] = []
-    workflow_only: list[str] = []
-    for f in files:
-        if is_user_facing(f, patterns):
-            user_facing.append(f)
-        else:
-            workflow_only.append(f)
-    return {"user_facing": user_facing, "workflow_only": workflow_only}
-
-
-def has_user_facing_changes(
-    base: str,
-    head: str,
-    patterns: frozenset[str] | None = None,
-) -> bool:
-    """Check if any user-facing files changed between base and head.
-
-    Imported by ``devx.ci.release`` to decide whether a release
-    is needed. This is a cross-CI import that requires ``PYTHONPATH=.``.
-    """
-    files = get_changed_files(base, head)
-    return any(is_user_facing(f, patterns) for f in files)
-
-
 def get_latest_tag() -> str:
     """Get the latest git tag, or empty string if none exists."""
     result = subprocess.run(  # nosec B603 B607
@@ -196,10 +498,98 @@ def get_latest_tag() -> str:
     return result.stdout.strip()
 
 
+# ---------------------------------------------------------------------------
+# Backward-compatible API (used by release.py and CI workflows)
+# ---------------------------------------------------------------------------
+
+# Singleton classifier — loaded lazily from pyproject.toml
+_classifier: ChangeClassifier | None = None
+
+
+def _get_classifier() -> ChangeClassifier:
+    """Get or create the singleton classifier from pyproject.toml."""
+    global _classifier  # noqa: PLW0603
+    if _classifier is None:
+        _classifier = ChangeClassifier()
+    return _classifier
+
+
+def is_workflow_only(
+    file_path: str,
+    patterns: frozenset[str] | None = None,
+) -> bool:
+    """Check if a file path is infrastructure (not user-facing).
+
+    Backward-compatible API.  Prefer ``ChangeClassifier.classify_file()``
+    for new code.
+
+    Args:
+        file_path: Path relative to repo root.
+        patterns: Deprecated.  If provided, uses simple prefix matching
+            against these patterns instead of the config-driven classifier.
+    """
+    if patterns is not None:
+        # Legacy mode — simple prefix matching
+        return any(file_path.startswith(p) or file_path == p for p in patterns)
+    return not _get_classifier().classify_file(file_path).is_user_facing
+
+
+def is_user_facing(
+    file_path: str,
+    patterns: frozenset[str] | None = None,
+) -> bool:
+    """Check if a file path is user-facing (affects the released package).
+
+    Inverse of ``is_workflow_only()``.
+    """
+    return not is_workflow_only(file_path, patterns)
+
+
+def classify_changes(
+    files: list[str],
+    patterns: frozenset[str] | None = None,
+) -> dict[str, list[str]]:
+    """Classify changed files into user-facing and workflow-only.
+
+    Returns a dict with keys "user_facing" and "workflow_only".
+    """
+    if patterns is not None:
+        # Legacy mode
+        user_facing: list[str] = []
+        workflow_only: list[str] = []
+        for f in files:
+            if is_user_facing(f, patterns):
+                user_facing.append(f)
+            else:
+                workflow_only.append(f)
+        return {"user_facing": user_facing, "workflow_only": workflow_only}
+
+    result = _get_classifier().classify(files)
+    return {"user_facing": result.user_facing, "workflow_only": result.infrastructure}
+
+
+def has_user_facing_changes(
+    base: str,
+    head: str,
+    patterns: frozenset[str] | None = None,
+) -> bool:
+    """Check if any user-facing files changed between base and head.
+
+    Imported by ``devx.ci.release`` to decide whether a release is needed.
+    """
+    files = get_changed_files(base, head)
+    if patterns is not None:
+        return any(is_user_facing(f, patterns) for f in files)
+    return _get_classifier().classify(files).has_user_facing
+
+
+# ---------------------------------------------------------------------------
+# Gitea Actions output
+# ---------------------------------------------------------------------------
+
+
 def _write_github_output(key: str, value: str) -> None:
     """Append a key=value line to the $GITHUB_OUTPUT file."""
-    import os
-
     gh_output = os.environ.get("GITHUB_OUTPUT")
     if not gh_output:
         raise click.ClickException("GITHUB_OUTPUT environment variable is not set")
@@ -207,30 +597,41 @@ def _write_github_output(key: str, value: str) -> None:
         f.write(f"{key}={value}\n")
 
 
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+
 @click.command()
 @click.option("--base", default=None, help="Base ref (default: latest tag).")
 @click.option("--head", default="HEAD", help="Head ref (default: HEAD).")
 @click.option("--quiet", is_flag=True, default=False, help="Only output true/false.")
 @click.option(
     "--check",
-    type=click.Choice(["all", "ansible", "user-facing"]),
     default="all",
-    help="Check specific category: all (default), ansible, or user-facing.",
+    help="Check specific category: 'all' (default), 'user-facing', or any tag name "
+    "defined in [tool.devx.classify.tags] (e.g., 'ansible').",
 )
 @click.option(
     "--github-output",
     "github_output",
     is_flag=True,
     default=False,
-    help="Write results to $GITHUB_OUTPUT file (for CI workflow steps).",
+    help="Write results to $GITHUB_OUTPUT file (for CI workflow steps). "
+    "Outputs 'user-facing-changed' and '<tag>-changed' for each configured tag.",
 )
 def main(base: str | None, head: str, quiet: bool, check: str, github_output: bool) -> None:
+    """Classify git changes and output results."""
+    classifier = _get_classifier()
+    available_tags = list(classifier.config.tags.keys())
+
     if base is None:
         base = get_latest_tag()
         if not base:
             if github_output:
-                _write_github_output("ansible-changed", "true")
                 _write_github_output("user-facing-changed", "true")
+                for tag in available_tags:
+                    _write_github_output(f"{tag}-changed", "true")
                 click.echo("No tags found — treating all changes as user-facing.")
                 return
             if quiet:
@@ -242,8 +643,9 @@ def main(base: str | None, head: str, quiet: bool, check: str, github_output: bo
     files = get_changed_files(base, head)
     if not files:
         if github_output:
-            _write_github_output("ansible-changed", "false")
             _write_github_output("user-facing-changed", "false")
+            for tag in available_tags:
+                _write_github_output(f"{tag}-changed", "false")
             click.echo(f"No changes between {base} and {head}.")
             return
         if quiet:
@@ -252,57 +654,65 @@ def main(base: str | None, head: str, quiet: bool, check: str, github_output: bo
             click.echo(_("No changes between {base} and {head}.", base=base, head=head))
         return
 
+    result = classifier.classify(files)
+
     if github_output:
-        ansible_files = [f for f in files if f.startswith("ansible/") or f == ".ansible-lint"]
-        user_files = [f for f in files if is_user_facing(f)]
-        _write_github_output("ansible-changed", "true" if ansible_files else "false")
-        _write_github_output("user-facing-changed", "true" if user_files else "false")
-        click.echo(f"Ansible files changed: {bool(ansible_files)}")
-        click.echo(f"User-facing files changed: {bool(user_files)}")
+        _write_github_output("user-facing-changed", "true" if result.has_user_facing else "false")
+        for tag in available_tags:
+            _write_github_output(f"{tag}-changed", "true" if result.has_tag(tag) else "false")
+        click.echo(f"User-facing files changed: {result.has_user_facing}")
+        for tag in available_tags:
+            click.echo(f"{tag.capitalize()} files changed: {result.has_tag(tag)}")
         return
 
-    if check == "ansible":
-        # Check only for Ansible-related file changes
-        ansible_files = [f for f in files if f.startswith("ansible/") or f == ".ansible-lint"]
-        has_ansible = bool(ansible_files)
+    # --check: check a specific tag or user-facing
+    if check != "all":
+        if check == "user-facing":
+            checked_files = result.user_facing
+            has_checked = bool(checked_files)
+            label = "User-facing"
+        elif check in available_tags:
+            checked_files = result.tags.get(check, [])
+            has_checked = bool(checked_files)
+            label = check.capitalize()
+        else:
+            raise click.ClickException(
+                _(
+                    "Unknown check category '{check}'. Available: all, user-facing{tags}",
+                    check=check,
+                    tags=", " + ", ".join(available_tags) if available_tags else "",
+                )
+            )
         if quiet:
-            click.echo("true" if has_ansible else "false")
+            click.echo("true" if has_checked else "false")
             return
-        click.echo(_("\nAnsible files changed ({count}):", count=len(ansible_files)))
-        for f in ansible_files:
-            click.echo(f"  {f}")
-        click.echo(_("\nResult: {status}", status="Ansible changes detected" if has_ansible else "No Ansible changes"))
-        return
-
-    if check == "user-facing":
-        # Check only for user-facing file changes (inverse of workflow-only)
-        user_files = [f for f in files if is_user_facing(f)]
-        has_user = bool(user_files)
-        if quiet:
-            click.echo("true" if has_user else "false")
-            return
-        click.echo(_("\nUser-facing files changed ({count}):", count=len(user_files)))
-        for f in user_files:
+        click.echo(_("\n{label} files changed ({count}):", label=label, count=len(checked_files)))
+        for f in checked_files:
             click.echo(f"  {f}")
         click.echo(
-            _("\nResult: {status}", status="User-facing changes detected" if has_user else "No user-facing changes")
+            _("\nResult: {status}", status=f"{label} changes detected" if has_checked else f"No {label} changes")
         )
         return
 
-    result = classify_changes(files)
-    has_user = bool(result["user_facing"])
+    has_user = result.has_user_facing
 
     if quiet:
         click.echo("true" if has_user else "false")
         return
 
     click.echo(_("Comparing {base}..{head} ({count} files changed)", base=base, head=head, count=len(files)))
-    click.echo(_("\nUser-facing changes ({count}):", count=len(result["user_facing"])))
-    for f in result["user_facing"]:
+    click.echo(_("\nUser-facing changes ({count}):", count=len(result.user_facing)))
+    for f in result.user_facing:
         click.echo(f"  {f}")
-    click.echo(_("\nWorkflow-only changes ({count}):", count=len(result["workflow_only"])))
-    for f in result["workflow_only"]:
+    click.echo(_("\nWorkflow-only changes ({count}):", count=len(result.infrastructure)))
+    for f in result.infrastructure:
         click.echo(f"  {f}")
+    for tag in available_tags:
+        tag_files = result.tags.get(tag, [])
+        if tag_files:
+            click.echo(_("\n{tag} files ({count}):", tag=tag.capitalize(), count=len(tag_files)))
+            for f in tag_files:
+                click.echo(f"  {f}")
     if has_user:
         status = "USER-FACING changes detected — release needed"
     else:

src/devx/ci/discover_runners.py

@@ -39,7 +39,7 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
 
     Returns the total count of active runners.  If the API call fails
     (e.g., no admin access for instance-level runners), falls back to
-    what we can see.
+    what we can see.  Fallbacks are logged to stderr for debugging.
     """
     headers = {"Authorization": f"token {token}"}
     total = 0
@@ -54,8 +54,10 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
         if r.status_code == 200:
             data = r.json()
             total += data.get("total_count", 0)
-    except (requests.RequestException, ValueError):
-        pass
+        else:
+            click.echo(f"Warning: repo-level runners query returned HTTP {r.status_code}", err=True)
+    except (requests.RequestException, ValueError) as e:
+        click.echo(f"Warning: repo-level runners query failed: {e}", err=True)
 
     # 2. Organization-level runners
     try:
@@ -67,8 +69,10 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
         if r.status_code == 200:
             data = r.json()
             total += data.get("total_count", 0)
-    except (requests.RequestException, ValueError):
-        pass
+        else:
+            click.echo(f"Warning: org-level runners query returned HTTP {r.status_code}", err=True)
+    except (requests.RequestException, ValueError) as e:
+        click.echo(f"Warning: org-level runners query failed: {e}", err=True)
 
     # 3. Instance-level runners (requires admin scope)
     try:
@@ -80,8 +84,10 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
         if r.status_code == 200:
             data = r.json()
             total += data.get("total_count", 0)
-    except (requests.RequestException, ValueError):
-        pass
+        elif r.status_code != 403:  # 403 is expected without admin scope
+            click.echo(f"Warning: instance-level runners query returned HTTP {r.status_code}", err=True)
+    except (requests.RequestException, ValueError) as e:
+        click.echo(f"Warning: instance-level runners query failed: {e}", err=True)
 
     return total
 

src/devx/ci/notify_failure.py

@@ -15,7 +15,7 @@ Usage:
 
 from __future__ import annotations
 
-import contextlib
+import logging
 import os
 
 import click
@@ -27,25 +27,33 @@ from devx.i18n import _
 
 load_dotenv()
 
+logger = logging.getLogger("devx")
+
 
 def _create_issue_via_tea(repo: str, title: str, body: str) -> int:
     """Create issue via tea CLI. Returns issue index.
 
     Raises TeaCLIError if tea is not installed or the command fails.
+    Label operations are best-effort — failures are logged but don't
+    prevent issue creation.
     """
     tea = TeaCLI(repo=repo)
 
-    # Check if "bug" label exists
+    # Check if "bug" label exists (best-effort)
     labels: list[str] = []
-    with contextlib.suppress(TeaCLIError):
+    try:
         existing_labels = tea.list_labels(repo)
         if any(label.get("name") == "bug" for label in existing_labels):
             labels = ["bug"]
+    except TeaCLIError as e:
+        logger.warning("Could not fetch labels (best-effort): %s", e)
 
     issue = tea.create_issue(repo, title=title, body=body, labels=labels if labels else None)
     if labels:
-        with contextlib.suppress(TeaCLIError):
+        try:
             tea.add_label(repo, issue["index"], labels)
+        except TeaCLIError as e:
+            logger.warning("Could not add label to issue #%s (best-effort): %s", issue.get("index"), e)
     return int(issue.get("index", 0))
 
 

src/devx/ci/post_merge.py

@@ -13,7 +13,7 @@ import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
 
 from devx.api_clients import VikunjaClient
-from devx.config import DEFAULT_PER_PAGE, TASK_ID_RE, VIKUNJA_API_URL, VIKUNJA_PROJECT_ID
+from devx.config import DEFAULT_PER_PAGE, TASK_ID_RE, TASK_PREFIX, VIKUNJA_API_URL, VIKUNJA_PROJECT_ID
 from devx.exceptions import APIError
 from devx.i18n import _
 
@@ -151,14 +151,16 @@ def main(commit_msg: str | None, commit_sha: str, from_git: bool, git_sha: str)
                     )
                 )
                 return
-        # Non-infrastructure commits without DEVX-N prefix — warn but don't fail
-        click.echo(
+        # Non-infrastructure commits without DEVX-N prefix — this is a
+        # convention violation. Fail the post-merge job so the issue is visible.
+        raise click.ClickException(
             _(
-                "Warning: No task ID (DEVX-N) found in commit message: {msg}. Skipping Vikunja update.",
+                "No task ID ({prefix}-N) found in commit message: {msg}. "
+                "Every non-infrastructure commit must have a task ID.",
+                prefix=TASK_PREFIX,
                 msg=first_line,
             )
         )
-        return
 
     client = VikunjaClient(VIKUNJA_API_URL, token)
     vikunja_task_id = resolve_task_id(client, task_id)
@@ -170,19 +172,18 @@ def main(commit_msg: str | None, commit_sha: str, from_git: bool, git_sha: str)
         client.post_comment(vikunja_task_id, html)
         client.update_task(vikunja_task_id, done=True)
     except APIError as e:
-        # Vikunja is a project management tool — if it's down, the merge
-        # still succeeded. Warn but don't fail the post-merge workflow.
-        click.echo(
+        # Vikunja API failures must be visible — the task was not updated
+        # and needs manual intervention. Failing the CI job makes this visible.
+        raise click.ClickException(
             _(
-                "Warning: Vikunja API error (HTTP {status}): {message}. "
-                "Task {task_id} was NOT updated. The merge succeeded — "
-                "please update the Vikunja task manually.",
+                "Vikunja API error (HTTP {status}): {message}. "
+                "Task {task_id} was NOT updated. "
+                "The merge succeeded but the Vikunja task needs manual update.",
                 status=e.status,
                 message=e.message,
                 task_id=task_id,
             )
-        )
-        return
+        ) from e
 
     click.echo(
         _(

src/devx/ci/release.py

@@ -86,7 +86,13 @@ def get_bumped_version() -> str:
     if not version:
         raise click.ClickException(_("git-cliff returned empty version."))
     # git-cliff may return with or without 'v' prefix
-    return version.lstrip("v")
+    version = version.lstrip("v")
+    # Validate semver format
+    if not re.match(r"^\d+\.\d+\.\d+$", version):
+        raise click.ClickException(
+            _("git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).", version=version)
+        )
+    return version
 
 
 def get_changelog(new_version: str) -> str:
@@ -271,16 +277,34 @@ def main(dry_run: bool, skip_tests: bool) -> None:
             )
         )
 
-    # Release lock: if HEAD is already a release commit, another release
-    # run is in progress (or already completed). Skip to prevent duplicate tags.
+    # Release lock: if HEAD is already a release commit, check if the tag
+    # exists. If the tag is missing (e.g., tag push failed in a previous run),
+    # create and push it instead of skipping — this recovers from the
+    # common failure mode where the commit was pushed but the tag was not.
     head_msg = run_cmd(["git", "log", "-1", "--pretty=%s"]).stdout.strip()
-    if re.match(r"^release: v\d+\.\d+\.\d+", head_msg):
+    release_match = re.match(r"^release: v(\d+\.\d+\.\d+)", head_msg)
+    if release_match:
+        release_version = release_match.group(1)
+        release_tag = f"v{release_version}"
+        if tag_exists(release_tag):
+            click.echo(
+                _(
+                    "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
+                    msg=head_msg,
+                    tag=release_tag,
+                )
+            )
+            return
+        # Tag is missing — recover by creating and pushing it
         click.echo(
             _(
-                "HEAD is already a release commit ('{msg}'). Another release may have just completed. Skipping.",
+                "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
                 msg=head_msg,
+                tag=release_tag,
             )
         )
+        changelog = get_changelog(release_version)
+        create_and_push_tag(release_version, changelog, dry_run)
         return
 
     # Check if any user-facing files changed since the last tag.
@@ -315,7 +339,12 @@ def main(dry_run: bool, skip_tests: bool) -> None:
     # Generate changelog
     changelog = get_changelog(new_version)
     if not changelog:
-        click.echo(_("Warning: git-cliff generated empty changelog."))
+        raise click.ClickException(
+            _(
+                "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+                version=new_version,
+            )
+        )
 
     if dry_run:
         click.echo(_("\n[dry-run] Changelog:\n{changelog}", changelog=changelog))

src/devx/ci/sync_wiki.py

@@ -39,9 +39,20 @@ MAPPING_FILE = DOCS_DIR / "mapping.json"
 
 
 def load_mapping() -> dict[str, str]:
-    """Load the file-to-wiki-page mapping from mapping.json."""
+    """Load the file-to-wiki-page mapping from mapping.json.
+
+    Validates that the mapping is a dict of string-to-string pairs.
+    """
     with open(MAPPING_FILE) as f:
-        return json.load(f)
+        data = json.load(f)
+    if not isinstance(data, dict):
+        raise click.ClickException(
+            _("mapping.json must be a dict of file-path -> page-title, got {type}", type=type(data).__name__)
+        )
+    for k, v in data.items():
+        if not isinstance(k, str) or not isinstance(v, str):
+            raise click.ClickException(_("mapping.json keys and values must be strings, got {k}={v}", k=k, v=v))
+    return data
 
 
 def read_doc_content(file_path: str) -> str:
@@ -239,14 +250,14 @@ def main(dry_run: bool, repo: str | None, verify: bool, strict: bool) -> None:
         try:
             content = read_doc_content(file_path)
         except FileNotFoundError:
-            click.echo(_("WARNING: File {file} not found — skipping.", file=file_path))
-            skipped += 1
-            continue
+            raise click.ClickException(
+                _("Mapped file {file} not found. Update mapping.json or create the file.", file=file_path)
+            ) from None
 
         if not content.strip():
-            click.echo(_("WARNING: File {file} is empty — skipping.", file=file_path))
-            skipped += 1
-            continue
+            raise click.ClickException(
+                _("Mapped file {file} is empty. Update the content or remove from mapping.json.", file=file_path)
+            ) from None
 
         result = sync_page(client, page_title, content, existing_pages, dry_run)
         if result == "created":

src/devx/molecule/distribute_molecule.py

@@ -174,6 +174,10 @@ def cli(
         _write_github_env("SKIP", "true")
         return
 
+    # Validate runner index is in range
+    if runner_index < 1:
+        raise click.ClickException(f"Runner index {runner_index} is out of range (must be >= 1)")
+
     # Convert 1-based CLI index to 0-based internal index
     zero_based = runner_index - 1
     assigned = pairs_for_runner(pairs, zero_based, max_runners)

src/devx/molecule/molecule_ci_guard.py

@@ -159,8 +159,11 @@ def cli(pairs: tuple[str, ...]) -> None:
             if failed_event.is_set():
                 sys.exit(1)
 
-            scenario = pair.split("|")[0]
-            platform_name = pair.split("|")[1]
+            parts = pair.split("|")
+            if len(parts) < 2:
+                raise click.ClickException(f"Invalid pair format: {pair!r} (expected at least 2 pipe-delimited parts)")
+            scenario = parts[0]
+            platform_name = parts[1]
             click.echo(_("Running: {scenario} on {platform}", scenario=scenario, platform=platform_name))
 
             cmd = build_molecule_cmd(scenario)

src/devx/tools/configure_repo.py

@@ -39,16 +39,15 @@ def _default_branch_protection_config() -> dict[str, Any]:
     environment variable (comma-separated) or default to just the quality
     check context.
 
-    The ``push_whitelist_usernames`` is read from ``DEVX_PUSH_WHITELIST``
-    (comma-separated) to allow the release bot to push directly to master.
+    Push whitelist is disabled — the release script pushes directly to
+    master (release commits). Since there are no manual reviews yet,
+    requiring PRs for every push adds complexity without benefit.
     """
-    push_whitelist = os.environ.get("DEVX_PUSH_WHITELIST", "")
-    whitelist = [u.strip() for u in push_whitelist.split(",") if u.strip()]
     return {
         "branch_name": "master",
         "enable_push": True,
-        "enable_push_whitelist": True,
-        "push_whitelist_usernames": whitelist,
+        "enable_push_whitelist": False,
+        "push_whitelist_usernames": [],
         "enable_status_check": True,
         "status_check_contexts": _default_status_checks(),
         "required_approvals": 0,

src/devx/tools/setup.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Project setup: install Python deps, pre-commit hooks, and tea CLI login.
+"""Project setup: install Python deps, Ansible collections, pre-commit hooks, and tea CLI login.
 
 Usage::
 
@@ -38,6 +38,16 @@ def _install_pre_commit_hooks(bin_dir: str) -> None:
         _run([pre_commit, "install", "--hook-type", hook_type])
 
 
+def _install_ansible_collections(bin_dir: str) -> None:
+    """Install required Ansible Galaxy collections if requirements exist."""
+    galaxy = str(Path(bin_dir) / "ansible-galaxy")
+    requirements = Path("ansible/requirements.yml")
+    if not requirements.exists():
+        click.echo("  ansible/requirements.yml not found — skipping collections.")
+        return
+    _run([galaxy, "collection", "install", "-r", str(requirements)])
+
+
 def _configure_tea_login() -> None:
     """Configure tea CLI login from .env if REPO_TOKEN is set.
 
@@ -119,11 +129,18 @@ def _verify(bin_dir: str) -> None:
     default=False,
     help="Skip tea CLI login configuration.",
 )
+@click.option(
+    "--no-ansible-collections",
+    is_flag=True,
+    default=False,
+    help="Skip Ansible Galaxy collection installation.",
+)
 def main(
     bin_dir: str,
     extras: str,
     no_pre_commit: bool,
     no_tea_login: bool,
+    no_ansible_collections: bool,
 ) -> None:
     """Install Python deps, pre-commit hooks, and configure tea CLI."""
     if not Path(bin_dir).exists():
@@ -132,6 +149,10 @@ def main(
     click.echo(f"Installing Python dependencies (extras: {extras})...")
     _install_python_deps(bin_dir, extras)
 
+    if not no_ansible_collections:
+        click.echo("Installing Ansible Galaxy collections...")
+        _install_ansible_collections(bin_dir)
+
     if not no_pre_commit:
         click.echo("Installing pre-commit hooks...")
         _install_pre_commit_hooks(bin_dir)

src/devx/translations.json

@@ -1,63 +1,129 @@
 {
   "\nAll documentation coverage checks passed!": {
-    "en": "\nAll documentation coverage checks passed!"
-  },
-  "\nAnsible files changed ({count}):": {
-    "en": "\nAnsible files changed ({count}):"
+    "en": "\nAll documentation coverage checks passed!",
+    "bg": "\nAll documentation coverage checks passed!",
+    "de": "\nAll documentation coverage checks passed!",
+    "ru": "\nAll documentation coverage checks passed!",
+    "zh": "\nAll documentation coverage checks passed!"
   },
   "\nChecking CI script documentation in ci-cd-workflow.md...": {
-    "en": "\nChecking CI script documentation in ci-cd-workflow.md..."
+    "en": "\nChecking CI script documentation in ci-cd-workflow.md...",
+    "bg": "\nChecking CI script documentation in ci-cd-workflow.md...",
+    "de": "\nChecking CI script documentation in ci-cd-workflow.md...",
+    "ru": "\nChecking CI script documentation in ci-cd-workflow.md...",
+    "zh": "\nChecking CI script documentation in ci-cd-workflow.md..."
   },
   "\nChecking module documentation in architecture.md...": {
-    "en": "\nChecking module documentation in architecture.md..."
+    "en": "\nChecking module documentation in architecture.md...",
+    "bg": "\nChecking module documentation in architecture.md...",
+    "de": "\nChecking module documentation in architecture.md...",
+    "ru": "\nChecking module documentation in architecture.md...",
+    "zh": "\nChecking module documentation in architecture.md..."
   },
   "\nDoc coverage: {covered}/{total} ({pct}%)": {
-    "en": "\nDoc coverage: {covered}/{total} ({pct}%)"
+    "en": "\nDoc coverage: {covered}/{total} ({pct}%)",
+    "bg": "\nDoc coverage: {covered}/{total} ({pct}%)",
+    "de": "\nDoc coverage: {covered}/{total} ({pct}%)",
+    "ru": "\nDoc coverage: {covered}/{total} ({pct}%)",
+    "zh": "\nDoc coverage: {covered}/{total} ({pct}%)"
   },
   "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}": {
-    "en": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}"
+    "en": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
+    "bg": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
+    "de": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
+    "ru": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}",
+    "zh": "\nDone! Created: {created}, Updated: {updated}, Skipped: {skipped}"
   },
   "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.": {
-    "en": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce."
+    "en": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
+    "bg": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
+    "de": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
+    "ru": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce.",
+    "zh": "\nERROR: Documentation coverage is not 100%. Use --fail-on-missing to enforce."
   },
   "\nIntegrity check FAILED ({count} issues):": {
-    "en": "\nIntegrity check FAILED ({count} issues):"
+    "en": "\nIntegrity check FAILED ({count} issues):",
+    "bg": "\nIntegrity check FAILED ({count} issues):",
+    "de": "\nIntegrity check FAILED ({count} issues):",
+    "ru": "\nIntegrity check FAILED ({count} issues):",
+    "zh": "\nIntegrity check FAILED ({count} issues):"
   },
   "\nIntegrity check passed — all {count} pages verified.": {
-    "en": "\nIntegrity check passed — all {count} pages verified."
+    "en": "\nIntegrity check passed — all {count} pages verified.",
+    "bg": "\nIntegrity check passed — all {count} pages verified.",
+    "de": "\nIntegrity check passed — all {count} pages verified.",
+    "ru": "\nIntegrity check passed — all {count} pages verified.",
+    "zh": "\nIntegrity check passed — all {count} pages verified."
   },
   "\nMissing documentation:": {
-    "en": "\nMissing documentation:"
+    "en": "\nMissing documentation:",
+    "bg": "\nMissing documentation:",
+    "de": "\nMissing documentation:",
+    "ru": "\nMissing documentation:",
+    "zh": "\nMissing documentation:"
   },
   "\nResult: {status}": {
-    "en": "\nResult: {status}"
+    "en": "\nResult: {status}",
+    "bg": "\nResult: {status}",
+    "de": "\nResult: {status}",
+    "ru": "\nResult: {status}",
+    "zh": "\nResult: {status}"
   },
   "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).": {
-    "en": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments)."
+    "en": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
+    "bg": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
+    "de": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
+    "ru": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments).",
+    "zh": "\nReview #{review_id} posted on PR #{pr_number} with event '{event}' ({num_comments} inline comments)."
   },
   "\nRunning full wiki integrity check...": {
-    "en": "\nRunning full wiki integrity check..."
+    "en": "\nRunning full wiki integrity check...",
+    "bg": "\nRunning full wiki integrity check...",
+    "de": "\nRunning full wiki integrity check...",
+    "ru": "\nRunning full wiki integrity check...",
+    "zh": "\nRunning full wiki integrity check..."
   },
   "\nUser-facing changes ({count}):": {
-    "en": "\nUser-facing changes ({count}):"
-  },
-  "\nUser-facing files changed ({count}):": {
-    "en": "\nUser-facing files changed ({count}):"
+    "en": "\nUser-facing changes ({count}):",
+    "bg": "\nUser-facing changes ({count}):",
+    "de": "\nUser-facing changes ({count}):",
+    "ru": "\nUser-facing changes ({count}):",
+    "zh": "\nUser-facing changes ({count}):"
   },
   "\nVerification FAILED: {failures} page(s) have empty or mismatched content!": {
-    "en": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!"
+    "en": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
+    "bg": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
+    "de": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
+    "ru": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!",
+    "zh": "\nVerification FAILED: {failures} page(s) have empty or mismatched content!"
   },
   "\nVerification passed — all wiki pages have correct content.": {
-    "en": "\nVerification passed — all wiki pages have correct content."
+    "en": "\nVerification passed — all wiki pages have correct content.",
+    "bg": "\nVerification passed — all wiki pages have correct content.",
+    "de": "\nVerification passed — all wiki pages have correct content.",
+    "ru": "\nVerification passed — all wiki pages have correct content.",
+    "zh": "\nVerification passed — all wiki pages have correct content."
   },
   "\nVerifying wiki pages have content...": {
-    "en": "\nVerifying wiki pages have content..."
+    "en": "\nVerifying wiki pages have content...",
+    "bg": "\nVerifying wiki pages have content...",
+    "de": "\nVerifying wiki pages have content...",
+    "ru": "\nVerifying wiki pages have content...",
+    "zh": "\nVerifying wiki pages have content..."
   },
   "\nWorkflow-only changes ({count}):": {
-    "en": "\nWorkflow-only changes ({count}):"
+    "en": "\nWorkflow-only changes ({count}):",
+    "bg": "\nWorkflow-only changes ({count}):",
+    "de": "\nWorkflow-only changes ({count}):",
+    "ru": "\nWorkflow-only changes ({count}):",
+    "zh": "\nWorkflow-only changes ({count}):"
   },
   "\n[dry-run] Changelog:\n{changelog}": {
-    "en": "\n[dry-run] Changelog:\n{changelog}"
+    "en": "\n[dry-run] Changelog:\n{changelog}",
+    "bg": "\n[dry-run] Changelog:\n{changelog}",
+    "de": "\n[dry-run] Changelog:\n{changelog}",
+    "ru": "\n[dry-run] Changelog:\n{changelog}",
+    "zh": "\n[dry-run] Changelog:\n{changelog}"
   },
   "  - Auto-delete branch after merge: yes": {
     "en": "  - Auto-delete branch after merge: yes",
@@ -81,7 +147,11 @@
     "zh": "  - 阻止被拒绝的审查: 是"
   },
   "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)": {
-    "en": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)"
+    "en": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "bg": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "de": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "ru": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)",
+    "zh": "  - Direct pushes: BLOCKED (require PR, whitelisted users can push)"
   },
   "  - Dismiss stale approvals: yes": {
     "en": "  - Dismiss stale approvals: yes",
@@ -105,10 +175,18 @@
     "zh": "  - 必需状态检查: {checks}"
   },
   "  Created: {title}": {
-    "en": "  Created: {title}"
+    "en": "  Created: {title}",
+    "bg": "  Created: {title}",
+    "de": "  Created: {title}",
+    "ru": "  Created: {title}",
+    "zh": "  Created: {title}"
   },
   "  FAIL: {title} — content mismatch or empty!": {
-    "en": "  FAIL: {title} — content mismatch or empty!"
+    "en": "  FAIL: {title} — content mismatch or empty!",
+    "bg": "  FAIL: {title} — content mismatch or empty!",
+    "de": "  FAIL: {title} — content mismatch or empty!",
+    "ru": "  FAIL: {title} — content mismatch or empty!",
+    "zh": "  FAIL: {title} — content mismatch or empty!"
   },
   "  MISSING: devx {cmd}": {
     "en": "  MISSING: devx {cmd}",
@@ -117,14 +195,19 @@
     "ru": "  ОТСУТСТВУЕТ: devx {cmd}",
     "zh": "  缺失: devx {cmd}"
   },
-  "  MISSING: grm {cmd}": {
-    "en": "  MISSING: grm {cmd}"
-  },
   "  MISSING: {module}": {
-    "en": "  MISSING: {module}"
+    "en": "  MISSING: {module}",
+    "bg": "  MISSING: {module}",
+    "de": "  MISSING: {module}",
+    "ru": "  MISSING: {module}",
+    "zh": "  MISSING: {module}"
   },
   "  MISSING: {script}": {
-    "en": "  MISSING: {script}"
+    "en": "  MISSING: {script}",
+    "bg": "  MISSING: {script}",
+    "de": "  MISSING: {script}",
+    "ru": "  MISSING: {script}",
+    "zh": "  MISSING: {script}"
   },
   "  OK: devx {cmd}": {
     "en": "  OK: devx {cmd}",
@@ -133,41 +216,82 @@
     "ru": "  ОК: devx {cmd}",
     "zh": "  正常: devx {cmd}"
   },
-  "  OK: grm {cmd}": {
-    "en": "  OK: grm {cmd}"
-  },
   "  OK: {module}": {
-    "en": "  OK: {module}"
+    "en": "  OK: {module}",
+    "bg": "  OK: {module}",
+    "de": "  OK: {module}",
+    "ru": "  OK: {module}",
+    "zh": "  OK: {module}"
   },
   "  OK: {script}": {
-    "en": "  OK: {script}"
+    "en": "  OK: {script}",
+    "bg": "  OK: {script}",
+    "de": "  OK: {script}",
+    "ru": "  OK: {script}",
+    "zh": "  OK: {script}"
   },
   "  OK: {title} ({chars} chars)": {
-    "en": "  OK: {title} ({chars} chars)"
+    "en": "  OK: {title} ({chars} chars)",
+    "bg": "  OK: {title} ({chars} chars)",
+    "de": "  OK: {title} ({chars} chars)",
+    "ru": "  OK: {title} ({chars} chars)",
+    "zh": "  OK: {title} ({chars} chars)"
   },
   "  Updated: {title}": {
-    "en": "  Updated: {title}"
+    "en": "  Updated: {title}",
+    "bg": "  Updated: {title}",
+    "de": "  Updated: {title}",
+    "ru": "  Updated: {title}",
+    "zh": "  Updated: {title}"
   },
   "API poll warning: {exc}": {
-    "en": "API poll warning: {exc}"
+    "en": "API poll warning: {exc}",
+    "bg": "API poll warning: {exc}",
+    "de": "API poll warning: {exc}",
+    "ru": "API poll warning: {exc}",
+    "zh": "API poll warning: {exc}"
   },
   "All molecule tests passed.": {
-    "en": "All molecule tests passed."
+    "en": "All molecule tests passed.",
+    "bg": "All molecule tests passed.",
+    "de": "All molecule tests passed.",
+    "ru": "All molecule tests passed.",
+    "zh": "All molecule tests passed."
   },
   "Another molecule runner failed. Stopping this runner early.": {
-    "en": "Another molecule runner failed. Stopping this runner early."
+    "en": "Another molecule runner failed. Stopping this runner early.",
+    "bg": "Another molecule runner failed. Stopping this runner early.",
+    "de": "Another molecule runner failed. Stopping this runner early.",
+    "ru": "Another molecule runner failed. Stopping this runner early.",
+    "zh": "Another molecule runner failed. Stopping this runner early."
   },
   "Bumping version: {current} -> v{new_version}": {
-    "en": "Bumping version: {current} -> v{new_version}"
+    "en": "Bumping version: {current} -> v{new_version}",
+    "bg": "Bumping version: {current} -> v{new_version}",
+    "de": "Bumping version: {current} -> v{new_version}",
+    "ru": "Bumping version: {current} -> v{new_version}",
+    "zh": "Bumping version: {current} -> v{new_version}"
   },
   "Checking CLI command documentation...": {
-    "en": "Checking CLI command documentation..."
+    "en": "Checking CLI command documentation...",
+    "bg": "Checking CLI command documentation...",
+    "de": "Checking CLI command documentation...",
+    "ru": "Checking CLI command documentation...",
+    "zh": "Checking CLI command documentation..."
   },
   "Command failed ({cmd}): {stderr}": {
-    "en": "Command failed ({cmd}): {stderr}"
+    "en": "Command failed ({cmd}): {stderr}",
+    "bg": "Command failed ({cmd}): {stderr}",
+    "de": "Command failed ({cmd}): {stderr}",
+    "ru": "Command failed ({cmd}): {stderr}",
+    "zh": "Command failed ({cmd}): {stderr}"
   },
   "Comparing {base}..{head} ({count} files changed)": {
-    "en": "Comparing {base}..{head} ({count} files changed)"
+    "en": "Comparing {base}..{head} ({count} files changed)",
+    "bg": "Comparing {base}..{head} ({count} files changed)",
+    "de": "Comparing {base}..{head} ({count} files changed)",
+    "ru": "Comparing {base}..{head} ({count} files changed)",
+    "zh": "Comparing {base}..{head} ({count} files changed)"
   },
   "Configuring branch protection for {branch}...": {
     "en": "Configuring branch protection for {branch}...",
@@ -184,25 +308,53 @@
     "zh": "正在配置仓库设置..."
   },
   "Could not extract conventional commit message from PR commits.": {
-    "en": "Could not extract conventional commit message from PR commits."
+    "en": "Could not extract conventional commit message from PR commits.",
+    "bg": "Could not extract conventional commit message from PR commits.",
+    "de": "Could not extract conventional commit message from PR commits.",
+    "ru": "Could not extract conventional commit message from PR commits.",
+    "zh": "Could not extract conventional commit message from PR commits."
   },
   "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.": {
-    "en": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task."
+    "en": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "bg": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "de": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "ru": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task.",
+    "zh": "Could not find Vikunja task {task_id} in project {project_id}. Every PR must have a corresponding Vikunja task."
   },
   "Could not find __version__ in {file}": {
-    "en": "Could not find __version__ in {file}"
+    "en": "Could not find __version__ in {file}",
+    "bg": "Could not find __version__ in {file}",
+    "de": "Could not find __version__ in {file}",
+    "ru": "Could not find __version__ in {file}",
+    "zh": "Could not find __version__ in {file}"
   },
   "Could not parse test execution time from output.": {
-    "en": "Could not parse test execution time from output."
+    "en": "Could not parse test execution time from output.",
+    "bg": "Could not parse test execution time from output.",
+    "de": "Could not parse test execution time from output.",
+    "ru": "Could not parse test execution time from output.",
+    "zh": "Could not parse test execution time from output."
   },
   "Created issue #{issue_id}: {title}": {
-    "en": "Created issue #{issue_id}: {title}"
+    "en": "Created issue #{issue_id}: {title}",
+    "bg": "Created issue #{issue_id}: {title}",
+    "de": "Created issue #{issue_id}: {title}",
+    "ru": "Created issue #{issue_id}: {title}",
+    "zh": "Created issue #{issue_id}: {title}"
   },
   "Created release commit.": {
-    "en": "Created release commit."
+    "en": "Created release commit.",
+    "bg": "Created release commit.",
+    "de": "Created release commit.",
+    "ru": "Created release commit.",
+    "zh": "Created release commit."
   },
   "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.": {
-    "en": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently."
+    "en": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "bg": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "de": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "ru": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently.",
+    "zh": "Dry-run mode: on branch '{branch}' (not master). Some checks may behave differently."
   },
   "ERROR: REPO_TOKEN is not set.": {
     "en": "ERROR: REPO_TOKEN is not set.",
@@ -226,22 +378,39 @@
     "zh": "错误：未指定仓库名称。请使用 --repo 或设置 DEVX_REPO_NAME。"
   },
   "ERROR: mapping.json not found at {path}": {
-    "en": "ERROR: mapping.json not found at {path}"
+    "en": "ERROR: mapping.json not found at {path}",
+    "bg": "ERROR: mapping.json not found at {path}",
+    "de": "ERROR: mapping.json not found at {path}",
+    "ru": "ERROR: mapping.json not found at {path}",
+    "zh": "ERROR: mapping.json not found at {path}"
   },
   "FAILED: {pair} exited with code {code}": {
-    "en": "FAILED: {pair} exited with code {code}"
+    "en": "FAILED: {pair} exited with code {code}",
+    "bg": "FAILED: {pair} exited with code {code}",
+    "de": "FAILED: {pair} exited with code {code}",
+    "ru": "FAILED: {pair} exited with code {code}",
+    "zh": "FAILED: {pair} exited with code {code}"
   },
   "Failed to create issue via tea: {error}": {
-    "en": "Failed to create issue via tea: {error}"
+    "en": "Failed to create issue via tea: {error}",
+    "bg": "Failed to create issue via tea: {error}",
+    "de": "Failed to create issue via tea: {error}",
+    "ru": "Failed to create issue via tea: {error}",
+    "zh": "Failed to create issue via tea: {error}"
   },
   "Found {count} existing wiki pages.": {
-    "en": "Found {count} existing wiki pages."
+    "en": "Found {count} existing wiki pages.",
+    "bg": "Found {count} existing wiki pages.",
+    "de": "Found {count} existing wiki pages.",
+    "ru": "Found {count} existing wiki pages.",
+    "zh": "Found {count} existing wiki pages."
   },
   "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.": {
-    "en": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation."
-  },
-  "HEAD is already a release commit ('{msg}'). Another release may have just completed. Skipping.": {
-    "en": "HEAD is already a release commit ('{msg}'). Another release may have just completed. Skipping."
+    "en": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "bg": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "de": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "ru": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation.",
+    "zh": "GITEA_URL/REPO_TOKEN/RUN_ID not set; running without cross-runner cancellation."
   },
   "HTTP error: {status} — {message}": {
     "en": "HTTP error: {status} — {message}",
@@ -258,7 +427,11 @@
     "zh": "HTTP {status} 禁止访问 — 您的令牌缺少管理员权限。\n请确保令牌属于仓库所有者或组织管理员。\n或者，您可以在 设置 → 分支 中手动配置分支保护。"
   },
   "Head branch is behind master. Pulling and rebasing...": {
-    "en": "Head branch is behind master. Pulling and rebasing..."
+    "en": "Head branch is behind master. Pulling and rebasing...",
+    "bg": "Head branch is behind master. Pulling and rebasing...",
+    "de": "Head branch is behind master. Pulling and rebasing...",
+    "ru": "Head branch is behind master. Pulling and rebasing...",
+    "zh": "Head branch is behind master. Pulling and rebasing..."
   },
   "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}": {
     "en": "Infrastructure commit (no DEVX-N task ID), skipping Vikunja update: {msg}",
@@ -267,17 +440,26 @@
     "ru": "Инфраструктурный коммит (без ID задачи DEVX-N), пропуск обновления Vikunja: {msg}",
     "zh": "基础设施提交（无 DEVX-N 任务 ID），跳过 Vikunja 更新: {msg}"
   },
-  "Infrastructure commit (no GRM-N task ID), skipping Vikunja update: {msg}": {
-    "en": "Infrastructure commit (no GRM-N task ID), skipping Vikunja update: {msg}"
-  },
   "Lint failed — refusing to release. Fix lint errors first.\n{stderr}": {
-    "en": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}"
+    "en": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "bg": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "de": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "ru": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}",
+    "zh": "Lint failed — refusing to release. Fix lint errors first.\n{stderr}"
   },
   "Lint passed.": {
-    "en": "Lint passed."
+    "en": "Lint passed.",
+    "bg": "Lint passed.",
+    "de": "Lint passed.",
+    "ru": "Lint passed.",
+    "zh": "Lint passed."
   },
   "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.": {
-    "en": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually."
+    "en": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "bg": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "de": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "ru": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually.",
+    "zh": "Merge failed after rebase retry: {error}\nPlease rebase the PR manually."
   },
   "Merge failed with HTTP {status}: {message}\nPlease check the PR is ready and you have merge rights.": {
     "en": "Merge failed with HTTP {status}: {message}\nPlease check the PR is ready and you have merge rights.",
@@ -315,7 +497,11 @@
     "zh": "不错！PR #{pr_number} 已 squash 合并，标题: {merge_title}"
   },
   "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.": {
-    "en": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered."
+    "en": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "bg": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "de": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "ru": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered.",
+    "zh": "Nice! Release v{version} tagged and pushed. The publish workflow will be triggered."
   },
   "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.": {
     "en": "Nice! Vikunja task {task_id} (ID {vikunja_id}) updated and marked done.",
@@ -325,22 +511,46 @@
     "zh": "不错！Vikunja 任务 {task_id} (ID {vikunja_id}) 已更新并标记为完成。"
   },
   "No changes between {base} and {head}.": {
-    "en": "No changes between {base} and {head}."
+    "en": "No changes between {base} and {head}.",
+    "bg": "No changes between {base} and {head}.",
+    "de": "No changes between {base} and {head}.",
+    "ru": "No changes between {base} and {head}.",
+    "zh": "No changes between {base} and {head}."
   },
   "No staged changes — version and changelog already up to date.": {
-    "en": "No staged changes — version and changelog already up to date."
+    "en": "No staged changes — version and changelog already up to date.",
+    "bg": "No staged changes — version and changelog already up to date.",
+    "de": "No staged changes — version and changelog already up to date.",
+    "ru": "No staged changes — version and changelog already up to date.",
+    "zh": "No staged changes — version and changelog already up to date."
   },
   "No tags found — treating all changes as user-facing.": {
-    "en": "No tags found — treating all changes as user-facing."
+    "en": "No tags found — treating all changes as user-facing.",
+    "bg": "No tags found — treating all changes as user-facing.",
+    "de": "No tags found — treating all changes as user-facing.",
+    "ru": "No tags found — treating all changes as user-facing.",
+    "zh": "No tags found — treating all changes as user-facing."
   },
   "No unreleased changes found. Nothing to release.": {
-    "en": "No unreleased changes found. Nothing to release."
+    "en": "No unreleased changes found. Nothing to release.",
+    "bg": "No unreleased changes found. Nothing to release.",
+    "de": "No unreleased changes found. Nothing to release.",
+    "ru": "No unreleased changes found. Nothing to release.",
+    "zh": "No unreleased changes found. Nothing to release."
   },
   "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.": {
-    "en": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release."
+    "en": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "bg": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "de": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "ru": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release.",
+    "zh": "No user-facing changes since {tag} — only workflow/infrastructure files changed. Skipping release."
   },
   "Note: Self-approval not allowed. Posting COMMENT instead.": {
-    "en": "Note: Self-approval not allowed. Posting COMMENT instead."
+    "en": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "bg": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "de": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "ru": "Note: Self-approval not allowed. Posting COMMENT instead.",
+    "zh": "Note: Self-approval not allowed. Posting COMMENT instead."
   },
   "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE": {
     "en": "Oops! Commit message must follow conventional commit format.\n  Expected: <type>: <description>\n  Got:      {subject}\n  Allowed types: feat, fix, chore, docs, style, refactor,\n                 perf, test, ci, build, revert, BREAKING CHANGE",
@@ -356,13 +566,6 @@
     "ru": "Ой! Не включайте ID задачи (DEVX-N) в коммиты feature-веток.\n  ID задачи будет добавлен автоматически при слиянии через CI.",
     "zh": "哎呀！不要在 feature 分支的提交中包含任务 ID (DEVX-N)。\n  任务 ID 将在通过 CI 合并时自动添加。"
   },
-  "Oops! Do not include task ID (GRM-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.": {
-    "en": "Oops! Do not include task ID (GRM-N) in feature branch commits.\n  The task ID will be added automatically on merge via CI.",
-    "bg": "Опа! Не включвайте идентификатор на задача (GRM-N) в commit-и от feature клонове.\n  Идентификаторът ще бъде добавен автоматично при сливане чрез CI.",
-    "de": "Ups! Keine Task-ID (GRM-N) in Feature-Branch-Commits einfügen.\n  Die Task-ID wird beim Merge automatisch über CI hinzugefügt.",
-    "ru": "Ой! Не включайте ID задачи (GRM-N) в коммиты feature-веток.\n  ID задачи будет добавлен автоматически при слиянии через CI.",
-    "zh": "哎呀！不要在 feature 分支的提交中包含任务 ID (GRM-N)。\n  任务 ID 将在通过 CI 合并时自动添加。"
-  },
   "Oops! Gitea PyPI registry publish failed:\n{stderr}": {
     "en": "Oops! Gitea PyPI registry publish failed:\n{stderr}",
     "bg": "Опа! Публикуването в Gitea PyPI registry неуспешно:\n{stderr}",
@@ -377,13 +580,6 @@
     "ru": "Ой! Коммит в ветку master после ID задачи должен соответствовать conventional формату.\n  Ожидается: DEVX-N: <type>: <description>\n  Получено: {subject}",
     "zh": "哎呀！master 分支提交在任务 ID 后必须遵循 conventional commit 格式。\n  预期格式: DEVX-N: <type>: <description>\n  实际: {subject}"
   },
-  "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: GRM-N: <type>: <description>\n  Got:      {subject}": {
-    "en": "Oops! Master branch commit must follow conventional format after task ID.\n  Expected: GRM-N: <type>: <description>\n  Got:      {subject}",
-    "bg": "Опа! Commit-ът в клона master трябва да следва конвенционален формат след идентификатора.\n  Очаква се: GRM-N: <type>: <description>\n  Получено: {subject}",
-    "de": "Ups! Master-Branch-Commit muss nach der Task-ID dem konventionellen Format folgen.\n  Erwartet: GRM-N: <type>: <description>\n  Erhalten: {subject}",
-    "ru": "Ой! Коммит в ветку master после ID задачи должен соответствовать conventional формату.\n  Ожидается: GRM-N: <type>: <description>\n  Получено: {subject}",
-    "zh": "哎呀！master 分支提交在任务 ID 后必须遵循 conventional commit 格式。\n  预期格式: GRM-N: <type>: <description>\n  实际: {subject}"
-  },
   "Oops! Master branch commits must start with a task ID.\n  Expected: DEVX-N: <conventional commit message>\n  Got:      {subject}": {
     "en": "Oops! Master branch commits must start with a task ID.\n  Expected: DEVX-N: <conventional commit message>\n  Got:      {subject}",
     "bg": "Опа! Commit-ите в клона master трябва да започват с идентификатор на задача.\n  Очаква се: DEVX-N: <conventional commit message>\n  Получено: {subject}",
@@ -391,28 +587,19 @@
     "ru": "Ой! Коммиты в ветку master должны начинаться с ID задачи.\n  Ожидается: DEVX-N: <conventional commit message>\n  Получено: {subject}",
     "zh": "哎呀！master 分支的提交必须以任务 ID 开头。\n  预期格式: DEVX-N: <conventional commit message>\n  实际: {subject}"
   },
-  "Oops! Master branch commits must start with a task ID.\n  Expected: GRM-N: <conventional commit message>\n  Got:      {subject}": {
-    "en": "Oops! Master branch commits must start with a task ID.\n  Expected: GRM-N: <conventional commit message>\n  Got:      {subject}",
-    "bg": "Опа! Commit-ите в клона master трябва да започват с идентификатор на задача.\n  Очаква се: GRM-N: <conventional commit message>\n  Получено: {subject}",
-    "de": "Ups! Master-Branch-Commits müssen mit einer Task-ID beginnen.\n  Erwartet: GRM-N: <conventional commit message>\n  Erhalten: {subject}",
-    "ru": "Ой! Коммиты в ветку master должны начинаться с ID задачи.\n  Ожидается: GRM-N: <conventional commit message>\n  Получено: {subject}",
-    "zh": "哎呀！master 分支的提交必须以任务 ID 开头。\n  预期格式: GRM-N: <conventional commit message>\n  实际: {subject}"
-  },
   "Oops! No task ID found in .taskid file or branch name '{branch}'.": {
-    "en": "Oops! No task ID found in .taskid file or branch name '{branch}'."
-  },
-  "Oops! PR title must follow format 'DEVX-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}": {
-    "en": "Oops! PR title must follow format 'DEVX-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
-    "bg": "Опа! Заглавието на PR трябва да следва формата 'DEVX-N: <заглавие на задача>'.\n  Очаква се: {task_id}: <заглавие на задача>\n  Получено: {pr_title}",
-    "de": "Ups! PR-Titel muss dem Format 'DEVX-N: <Task-Titel>' folgen.\n  Erwartet: {task_id}: <Task-Titel>\n  Erhalten: {pr_title}",
-    "ru": "Ой! Заголовок PR должен соответствовать формату 'DEVX-N: <название задачи>'.\n  Ожидается: {task_id}: <название задачи>\n  Получено: {pr_title}",
-    "zh": "哎呀！PR 标题必须遵循格式 'DEVX-N: <任务标题>'。\n  预期格式: {task_id}: <任务标题>\n  实际: {pr_title}"
-  },
-  "Oops! PR title must follow format 'GRM-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}": {
-    "en": "Oops! PR title must follow format 'GRM-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}"
+    "en": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
+    "bg": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
+    "de": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
+    "ru": "Oops! No task ID found in .taskid file or branch name '{branch}'.",
+    "zh": "Oops! No task ID found in .taskid file or branch name '{branch}'."
   },
   "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}": {
-    "en": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}"
+    "en": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "bg": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "de": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "ru": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}",
+    "zh": "Oops! PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {pr_title}"
   },
   "Oops! Package build failed:\n{stderr}": {
     "en": "Oops! Package build failed:\n{stderr}",
@@ -429,10 +616,18 @@
     "zh": "哎呀！PyPI 发布失败：\n{stderr}"
   },
   "PASSED: {pair}": {
-    "en": "PASSED: {pair}"
+    "en": "PASSED: {pair}",
+    "bg": "PASSED: {pair}",
+    "de": "PASSED: {pair}",
+    "ru": "PASSED: {pair}",
+    "zh": "PASSED: {pair}"
   },
   "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}": {
-    "en": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}"
+    "en": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "bg": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "de": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "ru": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}",
+    "zh": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {pr_title}"
   },
   "PYPI_TOKEN not set and no registry URL configured — skipping PyPI publish. No worries, we'll just create the Gitea release.": {
     "en": "PYPI_TOKEN not set and no registry URL configured — skipping PyPI publish. No worries, we'll just create the Gitea release.",
@@ -441,13 +636,6 @@
     "ru": "PYPI_TOKEN не задан и URL registry не настроен — пропускаем публикацию в PyPI. Не беспокойтесь, мы просто создадим Gitea release.",
     "zh": "未设置 PYPI_TOKEN 且未配置 registry URL — 跳过 PyPI 发布。别担心，我们直接创建 Gitea release。"
   },
-  "PYPI_TOKEN not set — skipping PyPI publish. No worries, we'll just create the Gitea release.": {
-    "en": "PYPI_TOKEN not set — skipping PyPI publish. No worries, we'll just create the Gitea release.",
-    "bg": "PYPI_TOKEN не е зададен — пропускаме публикуването в PyPI. Без притеснения, просто ще създадем Gitea release.",
-    "de": "PYPI_TOKEN nicht gesetzt — PyPI-Veröffentlichung wird übersprungen. Keine Sorge, wir erstellen einfach das Gitea-Release.",
-    "ru": "PYPI_TOKEN не задан — пропускаем публикацию в PyPI. Не беспокойтесь, мы просто создадим Gitea release.",
-    "zh": "未设置 PYPI_TOKEN — 跳过 PyPI 发布。别担心，我们直接创建 Gitea release。"
-  },
   "Published to Gitea PyPI registry.": {
     "en": "Published to Gitea PyPI registry.",
     "bg": "Публикувано в Gitea PyPI registry.",
@@ -463,16 +651,32 @@
     "zh": "已发布到 PyPI。"
   },
   "Pushed release commit to master.": {
-    "en": "Pushed release commit to master."
+    "en": "Pushed release commit to master.",
+    "bg": "Pushed release commit to master.",
+    "de": "Pushed release commit to master.",
+    "ru": "Pushed release commit to master.",
+    "zh": "Pushed release commit to master."
   },
   "Rebased and pushed. Retrying merge...": {
-    "en": "Rebased and pushed. Retrying merge..."
+    "en": "Rebased and pushed. Retrying merge...",
+    "bg": "Rebased and pushed. Retrying merge...",
+    "de": "Rebased and pushed. Retrying merge...",
+    "ru": "Rebased and pushed. Retrying merge...",
+    "zh": "Rebased and pushed. Retrying merge..."
   },
   "Release creation failed: {error}": {
-    "en": "Release creation failed: {error}"
+    "en": "Release creation failed: {error}",
+    "bg": "Release creation failed: {error}",
+    "de": "Release creation failed: {error}",
+    "ru": "Release creation failed: {error}",
+    "zh": "Release creation failed: {error}"
   },
   "Release must be run on master, currently on '{branch}'.": {
-    "en": "Release must be run on master, currently on '{branch}'."
+    "en": "Release must be run on master, currently on '{branch}'.",
+    "bg": "Release must be run on master, currently on '{branch}'.",
+    "de": "Release must be run on master, currently on '{branch}'.",
+    "ru": "Release must be run on master, currently on '{branch}'.",
+    "zh": "Release must be run on master, currently on '{branch}'."
   },
   "Repository configuration complete.": {
     "en": "Repository configuration complete.",
@@ -489,101 +693,172 @@
     "zh": "Runner 索引 {index} 超出范围 (0..{max})"
   },
   "Running lint checks...": {
-    "en": "Running lint checks..."
+    "en": "Running lint checks...",
+    "bg": "Running lint checks...",
+    "de": "Running lint checks...",
+    "ru": "Running lint checks...",
+    "zh": "Running lint checks..."
   },
   "Running tests...": {
-    "en": "Running tests..."
+    "en": "Running tests...",
+    "bg": "Running tests...",
+    "de": "Running tests...",
+    "ru": "Running tests...",
+    "zh": "Running tests..."
   },
   "Running: {scenario} on {platform}": {
-    "en": "Running: {scenario} on {platform}"
+    "en": "Running: {scenario} on {platform}",
+    "bg": "Running: {scenario} on {platform}",
+    "de": "Running: {scenario} on {platform}",
+    "ru": "Running: {scenario} on {platform}",
+    "zh": "Running: {scenario} on {platform}"
   },
   "Skipping commit push — no staged changes.": {
-    "en": "Skipping commit push — no staged changes."
+    "en": "Skipping commit push — no staged changes.",
+    "bg": "Skipping commit push — no staged changes.",
+    "de": "Skipping commit push — no staged changes.",
+    "ru": "Skipping commit push — no staged changes.",
+    "zh": "Skipping commit push — no staged changes."
   },
   "Syncing {count} documentation pages to wiki...": {
-    "en": "Syncing {count} documentation pages to wiki..."
+    "en": "Syncing {count} documentation pages to wiki...",
+    "bg": "Syncing {count} documentation pages to wiki...",
+    "de": "Syncing {count} documentation pages to wiki...",
+    "ru": "Syncing {count} documentation pages to wiki...",
+    "zh": "Syncing {count} documentation pages to wiki..."
   },
   "Tag v{version} already existed. Publish workflow should already have been triggered.": {
-    "en": "Tag v{version} already existed. Publish workflow should already have been triggered."
+    "en": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "bg": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "de": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "ru": "Tag v{version} already existed. Publish workflow should already have been triggered.",
+    "zh": "Tag v{version} already existed. Publish workflow should already have been triggered."
   },
   "Tag {tag} already exists, skipping creation.": {
-    "en": "Tag {tag} already exists, skipping creation."
+    "en": "Tag {tag} already exists, skipping creation.",
+    "bg": "Tag {tag} already exists, skipping creation.",
+    "de": "Tag {tag} already exists, skipping creation.",
+    "ru": "Tag {tag} already exists, skipping creation.",
+    "zh": "Tag {tag} already exists, skipping creation."
   },
   "Task ID: {task_id}": {
-    "en": "Task ID: {task_id}"
+    "en": "Task ID: {task_id}",
+    "bg": "Task ID: {task_id}",
+    "de": "Task ID: {task_id}",
+    "ru": "Task ID: {task_id}",
+    "zh": "Task ID: {task_id}"
   },
   "Tests failed — refusing to release. Fix test failures first.\n{stderr}": {
-    "en": "Tests failed — refusing to release. Fix test failures first.\n{stderr}"
+    "en": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "bg": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "de": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "ru": "Tests failed — refusing to release. Fix test failures first.\n{stderr}",
+    "zh": "Tests failed — refusing to release. Fix test failures first.\n{stderr}"
   },
   "Tests passed.": {
-    "en": "Tests passed."
+    "en": "Tests passed.",
+    "bg": "Tests passed.",
+    "de": "Tests passed.",
+    "ru": "Tests passed.",
+    "zh": "Tests passed."
   },
   "Unit tests passed in {duration:.2f}s (under {max}s limit).": {
-    "en": "Unit tests passed in {duration:.2f}s (under {max}s limit)."
+    "en": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
+    "bg": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
+    "de": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
+    "ru": "Unit tests passed in {duration:.2f}s (under {max}s limit).",
+    "zh": "Unit tests passed in {duration:.2f}s (under {max}s limit)."
   },
   "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.": {
-    "en": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures."
+    "en": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "bg": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "de": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "ru": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures.",
+    "zh": "Unit tests too slow: {duration:.2f}s (max allowed: {max}s).\n  Fix: run 'make pytest-cov' to profile, then optimise slow tests.\n  Hint: avoid unnecessary imports, use lighter mocks, or cache fixtures."
   },
   "Updated version in {init}": {
-    "en": "Updated version in {init}"
+    "en": "Updated version in {init}",
+    "bg": "Updated version in {init}",
+    "de": "Updated version in {init}",
+    "ru": "Updated version in {init}",
+    "zh": "Updated version in {init}"
   },
   "Updated {changelog_file}": {
-    "en": "Updated {changelog_file}"
+    "en": "Updated {changelog_file}",
+    "bg": "Updated {changelog_file}",
+    "de": "Updated {changelog_file}",
+    "ru": "Updated {changelog_file}",
+    "zh": "Updated {changelog_file}"
   },
   "WARNING: --skip-tests passed — skipping test verification.": {
-    "en": "WARNING: --skip-tests passed — skipping test verification."
-  },
-  "WARNING: File {file} is empty — skipping.": {
-    "en": "WARNING: File {file} is empty — skipping."
-  },
-  "WARNING: File {file} not found — skipping.": {
-    "en": "WARNING: File {file} not found — skipping."
-  },
-  "Warning: No task ID (DEVX-N) found in commit message: {msg}. Skipping Vikunja update.": {
-    "en": "Warning: No task ID (DEVX-N) found in commit message: {msg}. Skipping Vikunja update.",
-    "bg": "Предупреждение: Не е намерен идентификатор на задача (DEVX-N) в съобщението за commit: {msg}. Пропускаме обновяването на Vikunja.",
-    "de": "Warnung: Keine Task-ID (DEVX-N) in Commit-Nachricht gefunden: {msg}. Vikunja-Update wird übersprungen.",
-    "ru": "Предупреждение: ID задачи (DEVX-N) не найден в сообщении коммита: {msg}. Пропуск обновления Vikunja.",
-    "zh": "警告：提交消息中未找到任务 ID (DEVX-N): {msg}。跳过 Vikunja 更新。"
-  },
-  "Warning: No task ID (GRM-N) found in commit message: {msg}. Skipping Vikunja update.": {
-    "en": "Warning: No task ID (GRM-N) found in commit message: {msg}. Skipping Vikunja update."
-  },
-  "Warning: VIKUNJA_TOKEN not set, skipping title match validation.": {
-    "en": "Warning: VIKUNJA_TOKEN not set, skipping title match validation."
-  },
-  "Warning: Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded — please update the Vikunja task manually.": {
-    "en": "Warning: Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded — please update the Vikunja task manually."
-  },
-  "Warning: git-cliff generated empty changelog.": {
-    "en": "Warning: git-cliff generated empty changelog."
+    "en": "WARNING: --skip-tests passed — skipping test verification.",
+    "bg": "WARNING: --skip-tests passed — skipping test verification.",
+    "de": "WARNING: --skip-tests passed — skipping test verification.",
+    "ru": "WARNING: --skip-tests passed — skipping test verification.",
+    "zh": "WARNING: --skip-tests passed — skipping test verification."
   },
   "Wiki integrity check failed — {count} issue(s)": {
-    "en": "Wiki integrity check failed — {count} issue(s)"
+    "en": "Wiki integrity check failed — {count} issue(s)",
+    "bg": "Wiki integrity check failed — {count} issue(s)",
+    "de": "Wiki integrity check failed — {count} issue(s)",
+    "ru": "Wiki integrity check failed — {count} issue(s)",
+    "zh": "Wiki integrity check failed — {count} issue(s)"
   },
   "Wiki verification failed — {failures} page(s) empty or mismatched": {
-    "en": "Wiki verification failed — {failures} page(s) empty or mismatched"
+    "en": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "bg": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "de": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "ru": "Wiki verification failed — {failures} page(s) empty or mismatched",
+    "zh": "Wiki verification failed — {failures} page(s) empty or mismatched"
   },
   "[dry-run] Would commit: release: v{version}": {
-    "en": "[dry-run] Would commit: release: v{version}"
+    "en": "[dry-run] Would commit: release: v{version}",
+    "bg": "[dry-run] Would commit: release: v{version}",
+    "de": "[dry-run] Would commit: release: v{version}",
+    "ru": "[dry-run] Would commit: release: v{version}",
+    "zh": "[dry-run] Would commit: release: v{version}"
   },
   "[dry-run] Would create tag: v{version}": {
-    "en": "[dry-run] Would create tag: v{version}"
+    "en": "[dry-run] Would create tag: v{version}",
+    "bg": "[dry-run] Would create tag: v{version}",
+    "de": "[dry-run] Would create tag: v{version}",
+    "ru": "[dry-run] Would create tag: v{version}",
+    "zh": "[dry-run] Would create tag: v{version}"
   },
   "[dry-run] Would create tag: {tag}": {
-    "en": "[dry-run] Would create tag: {tag}"
+    "en": "[dry-run] Would create tag: {tag}",
+    "bg": "[dry-run] Would create tag: {tag}",
+    "de": "[dry-run] Would create tag: {tag}",
+    "ru": "[dry-run] Would create tag: {tag}",
+    "zh": "[dry-run] Would create tag: {tag}"
   },
   "[dry-run] Would push commit to master": {
-    "en": "[dry-run] Would push commit to master"
+    "en": "[dry-run] Would push commit to master",
+    "bg": "[dry-run] Would push commit to master",
+    "de": "[dry-run] Would push commit to master",
+    "ru": "[dry-run] Would push commit to master",
+    "zh": "[dry-run] Would push commit to master"
   },
   "[dry-run] Would sync page: {title} ({chars} chars)": {
-    "en": "[dry-run] Would sync page: {title} ({chars} chars)"
+    "en": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "bg": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "de": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "ru": "[dry-run] Would sync page: {title} ({chars} chars)",
+    "zh": "[dry-run] Would sync page: {title} ({chars} chars)"
   },
   "[dry-run] Would update {changelog_file}": {
-    "en": "[dry-run] Would update {changelog_file}"
+    "en": "[dry-run] Would update {changelog_file}",
+    "bg": "[dry-run] Would update {changelog_file}",
+    "de": "[dry-run] Would update {changelog_file}",
+    "ru": "[dry-run] Would update {changelog_file}",
+    "zh": "[dry-run] Would update {changelog_file}"
   },
   "[dry-run] Would update {init}": {
-    "en": "[dry-run] Would update {init}"
+    "en": "[dry-run] Would update {init}",
+    "bg": "[dry-run] Would update {init}",
+    "de": "[dry-run] Would update {init}",
+    "ru": "[dry-run] Would update {init}",
+    "zh": "[dry-run] Would update {init}"
   },
   "active": {
     "en": "active",
@@ -607,10 +882,18 @@
     "zh": "失败"
   },
   "git command failed ({cmd}): {stderr}": {
-    "en": "git command failed ({cmd}): {stderr}"
+    "en": "git command failed ({cmd}): {stderr}",
+    "bg": "git command failed ({cmd}): {stderr}",
+    "de": "git command failed ({cmd}): {stderr}",
+    "ru": "git command failed ({cmd}): {stderr}",
+    "zh": "git command failed ({cmd}): {stderr}"
   },
   "git-cliff returned empty version.": {
-    "en": "git-cliff returned empty version."
+    "en": "git-cliff returned empty version.",
+    "bg": "git-cliff returned empty version.",
+    "de": "git-cliff returned empty version.",
+    "ru": "git-cliff returned empty version.",
+    "zh": "git-cliff returned empty version."
   },
   "inactive": {
     "en": "inactive",
@@ -639,5 +922,124 @@
     "de": "unbekannt",
     "ru": "неизвестно",
     "zh": "未知"
+  },
+  "\n{label} files changed ({count}):": {
+    "en": "\n{label} files changed ({count}):",
+    "bg": "\n{label} files changed ({count}):",
+    "de": "\n{label} files changed ({count}):",
+    "ru": "\n{label} files changed ({count}):",
+    "zh": "\n{label} files changed ({count}):"
+  },
+  "\n{tag} files ({count}):": {
+    "en": "\n{tag} files ({count}):",
+    "bg": "\n{tag} files ({count}):",
+    "de": "\n{tag} files ({count}):",
+    "ru": "\n{tag} files ({count}):",
+    "zh": "\n{tag} files ({count}):"
+  },
+  "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}": {
+    "en": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "bg": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "de": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "ru": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}",
+    "zh": "Oops! PR title must follow format '{prefix}-N: <task title>'.\n  Expected: {task_id}: <task title>\n  Got:      {pr_title}"
+  },
+  "Unknown check category '{check}'. Available: all, user-facing{tags}": {
+    "en": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "bg": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "de": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "ru": "Unknown check category '{check}'. Available: all, user-facing{tags}",
+    "zh": "Unknown check category '{check}'. Available: all, user-facing{tags}"
+  },
+  "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.": {
+    "en": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
+    "bg": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
+    "de": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
+    "ru": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag.",
+    "zh": "HEAD is a release commit ('{msg}') but tag {tag} is missing. Recovering by creating tag."
+  },
+  "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.": {
+    "en": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
+    "bg": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
+    "de": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
+    "ru": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping.",
+    "zh": "HEAD is already a release commit ('{msg}') and tag {tag} exists. Skipping."
+  },
+  "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.": {
+    "en": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "bg": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "de": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "ru": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update.",
+    "zh": "Vikunja API error (HTTP {status}): {message}. Task {task_id} was NOT updated. The merge succeeded but the Vikunja task needs manual update."
+  },
+  "PR number must be an integer, got: {pr_number}": {
+    "en": "PR number must be an integer, got: {pr_number}",
+    "bg": "PR number must be an integer, got: {pr_number}",
+    "de": "PR number must be an integer, got: {pr_number}",
+    "ru": "PR number must be an integer, got: {pr_number}",
+    "zh": "PR number must be an integer, got: {pr_number}"
+  },
+  "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.": {
+    "en": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "bg": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "de": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "ru": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history.",
+    "zh": "git-cliff generated empty changelog for v{version}. Check cliff.toml and commit history."
+  },
+  "Repo must be in 'owner/name' format, got: {repo}": {
+    "en": "Repo must be in 'owner/name' format, got: {repo}",
+    "bg": "Repo must be in 'owner/name' format, got: {repo}",
+    "de": "Repo must be in 'owner/name' format, got: {repo}",
+    "ru": "Repo must be in 'owner/name' format, got: {repo}",
+    "zh": "Repo must be in 'owner/name' format, got: {repo}"
+  },
+  "Mapped file {file} is empty. Update the content or remove from mapping.json.": {
+    "en": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
+    "bg": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
+    "de": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
+    "ru": "Mapped file {file} is empty. Update the content or remove from mapping.json.",
+    "zh": "Mapped file {file} is empty. Update the content or remove from mapping.json."
+  },
+  "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.": {
+    "en": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
+    "bg": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
+    "de": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
+    "ru": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles.",
+    "zh": "VIKUNJA_TOKEN is not set. This is required in CI to validate PR titles."
+  },
+  "mapping.json keys and values must be strings, got {k}={v}": {
+    "en": "mapping.json keys and values must be strings, got {k}={v}",
+    "bg": "mapping.json keys and values must be strings, got {k}={v}",
+    "de": "mapping.json keys and values must be strings, got {k}={v}",
+    "ru": "mapping.json keys and values must be strings, got {k}={v}",
+    "zh": "mapping.json keys and values must be strings, got {k}={v}"
+  },
+  "mapping.json must be a dict of file-path -> page-title, got {type}": {
+    "en": "mapping.json must be a dict of file-path -> page-title, got {type}",
+    "bg": "mapping.json must be a dict of file-path -> page-title, got {type}",
+    "de": "mapping.json must be a dict of file-path -> page-title, got {type}",
+    "ru": "mapping.json must be a dict of file-path -> page-title, got {type}",
+    "zh": "mapping.json must be a dict of file-path -> page-title, got {type}"
+  },
+  "Mapped file {file} not found. Update mapping.json or create the file.": {
+    "en": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "bg": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "de": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "ru": "Mapped file {file} not found. Update mapping.json or create the file.",
+    "zh": "Mapped file {file} not found. Update mapping.json or create the file."
+  },
+  "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.": {
+    "en": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "bg": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "de": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "ru": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID.",
+    "zh": "No task ID ({prefix}-N) found in commit message: {msg}. Every non-infrastructure commit must have a task ID."
+  },
+  "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).": {
+    "en": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "bg": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "de": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "ru": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1).",
+    "zh": "git-cliff returned invalid version format: {version}. Expected semver (e.g., 0.4.1)."
   }
 }

tests/unit/test_auto_merge.py

@@ -77,9 +77,10 @@ class TestValidatePrTitle:
 
 class TestValidatePrTitleMatchesVikunja:
     @patch.dict("os.environ", {}, clear=True)
-    def test_skips_when_no_token(self) -> None:
-        # Should not raise — just warn
-        validate_pr_title_matches_vikunja("DEVX-19: test", "DEVX-19")
+    def test_raises_when_no_token(self) -> None:
+        """Should raise ClickException when VIKUNJA_TOKEN is not set."""
+        with pytest.raises(click.ClickException, match="VIKUNJA_TOKEN is not set"):
+            validate_pr_title_matches_vikunja("DEVX-19: test", "DEVX-19")
 
     @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"}, clear=True)
     @patch("devx.ci.auto_merge.VikunjaClient")
@@ -192,9 +193,12 @@ class TestRunCmd:
 
 
 class TestMain:
-    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "VIKUNJA_TOKEN": ""}, clear=True)
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "VIKUNJA_TOKEN": "tok"}, clear=True)
+    @patch("devx.ci.auto_merge.validate_pr_title_matches_vikunja")
     @patch("devx.ci.auto_merge.GiteaClient")
-    def test_full_merge_flow(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_full_merge_flow(
+        self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
+    ) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
         (tmp_path / ".taskid").write_text("DEVX-19\n")
 
@@ -210,7 +214,7 @@ class TestMain:
             ["DEVX-19-fix-bug", "DEVX-19: Fix timeout", "owner/repo", "7"],
         )
         assert result.exit_code == 0, result.output
-        mock_client.merge_pr.assert_called_once_with("7", "DEVX-19: fix: resolve timeout")
+        mock_client.merge_pr.assert_called_once_with(7, "DEVX-19: fix: resolve timeout")
 
     @patch.dict("os.environ", {"REPO_TOKEN": ""}, clear=True)
     def test_no_token_raises(self) -> None:
@@ -240,9 +244,12 @@ class TestMain:
         assert result.exit_code != 0
         assert "format" in result.output.lower()
 
-    @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "VIKUNJA_TOKEN": "tok"}, clear=True)
+    @patch("devx.ci.auto_merge.validate_pr_title_matches_vikunja")
     @patch("devx.ci.auto_merge.GiteaClient")
-    def test_merge_behind_master_rebases(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_merge_behind_master_rebases(
+        self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
+    ) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
         (tmp_path / ".taskid").write_text("DEVX-19\n")
 
@@ -267,9 +274,12 @@ class TestMain:
             # Should have fetched, rebased, and pushed
             assert mock_run.call_count == 5  # config name, config email, fetch, rebase, push
 
-    @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "VIKUNJA_TOKEN": "tok"}, clear=True)
+    @patch("devx.ci.auto_merge.validate_pr_title_matches_vikunja")
     @patch("devx.ci.auto_merge.GiteaClient")
-    def test_merge_failure_raises(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_merge_failure_raises(
+        self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
+    ) -> None:  # type: ignore[no-untyped-def]
         monkeypatch.chdir(tmp_path)
         (tmp_path / ".taskid").write_text("DEVX-19\n")
 
@@ -288,9 +298,12 @@ class TestMain:
         assert result.exit_code != 0
         assert "Merge failed" in result.output
 
-    @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "VIKUNJA_TOKEN": "tok"}, clear=True)
+    @patch("devx.ci.auto_merge.validate_pr_title_matches_vikunja")
     @patch("devx.ci.auto_merge.GiteaClient")
-    def test_no_conventional_msg_raises(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_no_conventional_msg_raises(
+        self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
+    ) -> None:  # type: ignore[no-untyped-def]
         """When no conventional commit message is found in PR commits, raises."""
         monkeypatch.chdir(tmp_path)
         (tmp_path / ".taskid").write_text("DEVX-19\n")
@@ -308,8 +321,31 @@ class TestMain:
         assert "conventional commit" in result.output.lower()
 
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
+    def test_invalid_pr_number_raises(self, tmp_path, monkeypatch) -> None:
+        """Non-integer PR number should raise."""
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / ".taskid").write_text("DEVX-19\n")
+        runner = CliRunner()
+        result = runner.invoke(main, ["DEVX-19-fix", "DEVX-19: Test", "owner/repo", "not-a-number"])
+        assert result.exit_code != 0
+        assert "PR number must be an integer" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
+    def test_invalid_repo_format_raises(self, tmp_path, monkeypatch) -> None:
+        """Repo without owner/name should raise."""
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / ".taskid").write_text("DEVX-19\n")
+        runner = CliRunner()
+        result = runner.invoke(main, ["DEVX-19-fix", "DEVX-19: Test", "invalidrepo", "7"])
+        assert result.exit_code != 0
+        assert "owner/name" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok", "VIKUNJA_TOKEN": "tok"}, clear=True)
+    @patch("devx.ci.auto_merge.validate_pr_title_matches_vikunja")
     @patch("devx.ci.auto_merge.GiteaClient")
-    def test_rebase_retry_failure_raises(self, mock_client_cls: MagicMock, tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    def test_rebase_retry_failure_raises(
+        self, mock_client_cls: MagicMock, _mock_validate: MagicMock, tmp_path, monkeypatch
+    ) -> None:  # type: ignore[no-untyped-def]
         """When rebase retry also fails, raises with helpful message."""
         monkeypatch.chdir(tmp_path)
         (tmp_path / ".taskid").write_text("DEVX-19\n")

tests/unit/test_check_translations.py

@@ -67,7 +67,7 @@ class TestCheckTranslationSet:
         trans_file.write_text(json.dumps({"Used": {"en": "Used"}, "Dead": {"en": "Dead"}}))
 
         result = check_translations.check_translation_set("test", src_dir, trans_file)
-        assert any("Dead key" in w for w in result.warnings)
+        assert any("Dead key" in e for e in result.errors)
 
     def test_missing_language(self, tmp_path: Path) -> None:
         src_dir = tmp_path / "src"
@@ -77,7 +77,7 @@ class TestCheckTranslationSet:
         trans_file.write_text(json.dumps({"Hello": {"en": "Hello"}}))
 
         result = check_translations.check_translation_set("test", src_dir, trans_file)
-        assert any("Missing languages" in w for w in result.warnings)
+        assert any("Missing languages" in e for e in result.errors)
 
     def test_missing_translations_file(self, tmp_path: Path) -> None:
         src_dir = tmp_path / "src"
@@ -108,23 +108,19 @@ class TestMain:
         result = runner.invoke(check_translations.main, [])
         assert result.exit_code == 0
 
-    def test_strict_fails_on_warnings(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """--strict should fail if there are missing language warnings."""
-        warn_result = check_translations.TranslationCheckResult(
+    def test_errors_fail(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """Errors should cause exit code 1."""
+        error_result = check_translations.TranslationCheckResult(
             name="devx",
             src_dir=Path("/tmp"),
             trans_file=Path("/tmp/t.json"),
             used_keys={"a"},
             defined_keys={"a"},
-            warnings=["Dead key: 'bar'"],
-        )
-        monkeypatch.setattr(
-            check_translations,
-            "check_translation_set",
-            lambda name, src, trans: warn_result,
+            errors=["Dead key: 'bar'"],
         )
+        monkeypatch.setattr(check_translations, "check_translation_set", lambda name, src, trans: error_result)
         runner = CliRunner()
-        result = runner.invoke(check_translations.main, ["--strict"])
+        result = runner.invoke(check_translations.main, [])
         assert result.exit_code == 1
 
     def test_fails_on_errors(self, monkeypatch: pytest.MonkeyPatch) -> None:
@@ -311,26 +307,25 @@ class TestCollectKeys:
         assert "in_progress" in keys
 
 
-class TestMainWarnings:
-    def test_passes_with_warnings(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Should pass with exit code 0 and 'PASS with warnings' message."""
-        warn_result = check_translations.TranslationCheckResult(
+class TestMainCleanPass:
+    def test_passes_clean(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """Should pass with exit code 0 and 'PASS:' message when no errors."""
+        ok_result = check_translations.TranslationCheckResult(
             name="devx",
             src_dir=Path("/tmp"),
             trans_file=Path("/tmp/t.json"),
             used_keys={"a"},
             defined_keys={"a"},
-            warnings=["Dead key: 'bar'"],
         )
         monkeypatch.setattr(
             check_translations,
             "check_translation_set",
-            lambda name, src, trans: warn_result,
+            lambda name, src, trans: ok_result,
         )
         runner = CliRunner()
         result = runner.invoke(check_translations.main, [])
         assert result.exit_code == 0
-        assert "PASS with warnings" in result.output
+        assert "PASS:" in result.output
 
 
 class TestI18nProjectTranslations:

tests/unit/test_classify_changes.py

@@ -1,4 +1,16 @@
-"""Unit tests for scripts/ci/classify_changes.py."""
+"""Unit tests for devx.ci.classify_changes.
+
+Tests cover:
+- Glob matching (``_glob_to_regex``, ``_matches_glob``)
+- Classifier config loading from pyproject.toml
+- ChangeClassifier with layered rules (overrides, patterns, default)
+- Tag system (orthogonal categories)
+- Backward-compatible API (is_user_facing, is_workflow_only, classify_changes)
+- Git helpers (get_changed_files, get_latest_tag, run_git)
+- CLI (main with --quiet, --check, --github-output)
+"""
+
+from __future__ import annotations
 
 from pathlib import Path
 from unittest.mock import MagicMock, patch
@@ -9,6 +21,13 @@ from click.testing import CliRunner
 
 import devx.ci.classify_changes as classify_changes_mod
 from devx.ci.classify_changes import (
+    DEFAULT_INFRASTRUCTURE,
+    ChangeClassifier,
+    ClassificationResult,
+    ClassifierConfig,
+    FileClassification,
+    _glob_to_regex,
+    _matches_glob,
     classify_changes,
     get_changed_files,
     get_latest_tag,
@@ -19,98 +38,349 @@ from devx.ci.classify_changes import (
     run_git,
 )
 
+# ---------------------------------------------------------------------------
+# Glob matching tests
+# ---------------------------------------------------------------------------
 
-class TestIsUserFacing:
-    def test_src_is_user_facing(self) -> None:
-        assert is_user_facing("src/devx/cli.py") is True
 
-    def test_ansible_is_user_facing(self) -> None:
-        assert is_user_facing("ansible/roles/gitea-runner/tasks/main.yml") is True
+class TestGlobToRegex:
+    def test_double_star_matches_anything(self) -> None:
+        regex = _glob_to_regex(".gitea/**")
+        assert regex.match(".gitea/workflows/ci.yml")
+        assert regex.match(".gitea/actionlint.yaml")
+        assert regex.match(".gitea/a/b/c/d.yml")
+        assert not regex.match("tests/test_foo.py")
 
-    def test_pyproject_is_user_facing(self) -> None:
-        assert is_user_facing("pyproject.toml") is True
+    def test_double_star_in_middle(self) -> None:
+        """** in the middle of a pattern matches any number of segments."""
+        regex = _glob_to_regex("src/**/test_*.py")
+        assert regex.match("src/test_foo.py")
+        assert regex.match("src/devx/test_cli.py")
+        assert regex.match("src/a/b/c/test_bar.py")
+        assert not regex.match("src/cli.py")
 
-    def test_workflow_is_not_user_facing(self) -> None:
-        assert is_user_facing(".gitea/workflows/ci.yml") is False
+    def test_single_star_matches_within_segment(self) -> None:
+        regex = _glob_to_regex("src/*/cli.py")
+        assert regex.match("src/devx/cli.py")
+        assert regex.match("src/pkg/cli.py")
+        assert not regex.match("src/devx/sub/cli.py")
 
-    def test_ci_scripts_are_not_user_facing(self) -> None:
-        assert is_user_facing("scripts/ci/release.py") is False
+    def test_question_mark_matches_single_char(self) -> None:
+        regex = _glob_to_regex("file?.py")
+        assert regex.match("file1.py")
+        assert regex.match("fileA.py")
+        assert not regex.match("file12.py")
 
-    def test_dev_scripts_are_not_user_facing(self) -> None:
-        """All scripts under scripts/ are infrastructure (CI/CD, dev tools).
-        User-facing code lives in src/devx/."""
-        assert is_user_facing("scripts/check_test_speed.py") is False
-        assert is_user_facing("scripts/configure_repo.py") is False
-        assert is_user_facing("scripts/install_checkmake.py") is False
+    def test_literal_match(self) -> None:
+        regex = _glob_to_regex("Makefile")
+        assert regex.match("Makefile")
+        assert not regex.match("makefile")
 
-    def test_shell_scripts_are_not_user_facing(self) -> None:
-        assert is_user_facing("scripts/setup.sh") is False
-        assert is_user_facing("scripts/molecule_all.sh") is False
+    def test_special_chars_escaped(self) -> None:
+        regex = _glob_to_regex("file.test.py")
+        assert regex.match("file.test.py")
+        assert not regex.match("fileXtest.py")
 
-    def test_scripts_init_is_not_user_facing(self) -> None:
-        assert is_user_facing("scripts/__init__.py") is False
 
-    def test_version_file_is_not_user_facing(self) -> None:
-        """__init__.py only contains __version__ — a release artifact,
-        not user-facing code. Version bumps alone should not trigger releases."""
-        assert is_user_facing("src/devx/__init__.py") is False
+class TestMatchesGlob:
+    def test_double_star(self) -> None:
+        assert _matches_glob(".gitea/workflows/ci.yml", ".gitea/**")
+        assert _matches_glob("tests/unit/test_cli.py", "tests/**")
+        assert not _matches_glob("src/devx/cli.py", "tests/**")
 
-    def test_api_clients_is_not_user_facing(self) -> None:
-        """api_clients.py is used only by CI/CD scripts, not by the GRM CLI."""
-        assert is_user_facing("src/devx/api_clients.py") is False
+    def test_exact_match(self) -> None:
+        assert _matches_glob("Makefile", "Makefile")
+        assert _matches_glob("src/devx/__init__.py", "src/devx/__init__.py")
+        assert not _matches_glob("src/devx/cli.py", "src/devx/__init__.py")
 
-    def test_docs_are_not_user_facing(self) -> None:
-        assert is_user_facing("docs/user/getting-started.md") is False
+    def test_prefix_matching(self) -> None:
+        assert _matches_glob(".gitea/workflows/ci.yml", ".gitea/")
+        assert _matches_glob("scripts/ci/release.py", "scripts/")
+        assert not _matches_glob("tests/test_foo.py", "scripts/")
 
-    def test_tests_are_not_user_facing(self) -> None:
-        assert is_user_facing("tests/unit/test_cli.py") is False
+    def test_single_star(self) -> None:
+        assert _matches_glob("src/devx/cli.py", "src/devx/*.py")
+        assert not _matches_glob("src/devx/sub/cli.py", "src/devx/*.py")
 
-    def test_agents_md_is_not_user_facing(self) -> None:
-        assert is_user_facing("AGENTS.md") is False
 
-    def test_makefile_is_not_user_facing(self) -> None:
-        assert is_user_facing("Makefile") is False
+# ---------------------------------------------------------------------------
+# ClassifierConfig tests
+# ---------------------------------------------------------------------------
+
+
+class TestClassifierConfig:
+    def test_from_pyproject_merges_with_defaults(self, tmp_path: Path) -> None:
+        pyproject = tmp_path / "pyproject.toml"
+        pyproject.write_text(
+            "[tool.devx.classify]\n"
+            'infrastructure = ["scripts/**"]\n'
+            'infrastructure_overrides = ["src/pkg/__init__.py"]\n'
+            'user_facing_overrides = ["docs/important.py"]\n'
+            "\n"
+            "[tool.devx.classify.tags]\n"
+            'ansible = ["ansible/**"]\n'
+        )
+        config = ClassifierConfig.from_pyproject(str(pyproject))
+        # Project-specific path is merged with defaults
+        assert "scripts/**" in config.infrastructure
+        assert ".gitea/**" in config.infrastructure  # from DEFAULT_INFRASTRUCTURE
+        assert "tests/**" in config.infrastructure  # from DEFAULT_INFRASTRUCTURE
+        assert config.use_defaults is True
+        assert config.infrastructure_overrides == ["src/pkg/__init__.py"]
+        assert config.user_facing_overrides == ["docs/important.py"]
+        assert config.tags == {"ansible": ["ansible/**"]}
+
+    def test_from_pyproject_use_defaults_false(self, tmp_path: Path) -> None:
+        pyproject = tmp_path / "pyproject.toml"
+        pyproject.write_text('[tool.devx.classify]\nuse_defaults = false\ninfrastructure = [".gitea/**"]\n')
+        config = ClassifierConfig.from_pyproject(str(pyproject))
+        assert config.infrastructure == [".gitea/**"]
+        assert "tests/**" not in config.infrastructure  # no defaults
+        assert config.use_defaults is False
+
+    def test_from_pyproject_missing_file_returns_defaults(self) -> None:
+        config = ClassifierConfig.from_pyproject("/nonexistent/pyproject.toml")
+        assert config.infrastructure == list(DEFAULT_INFRASTRUCTURE)
+        assert config.infrastructure_overrides == []
+        assert config.user_facing_overrides == []
+        assert config.tags == {}
+        assert config.use_defaults is True
+
+    def test_from_pyproject_missing_section_returns_defaults(self, tmp_path: Path) -> None:
+        pyproject = tmp_path / "pyproject.toml"
+        pyproject.write_text('[project]\nname = "test"\n')
+        config = ClassifierConfig.from_pyproject(str(pyproject))
+        assert config.infrastructure == list(DEFAULT_INFRASTRUCTURE)
+
+    def test_from_pyproject_partial_config(self, tmp_path: Path) -> None:
+        pyproject = tmp_path / "pyproject.toml"
+        pyproject.write_text('[tool.devx.classify]\ninfrastructure = ["scripts/**"]\n')
+        config = ClassifierConfig.from_pyproject(str(pyproject))
+        assert "scripts/**" in config.infrastructure
+        assert ".gitea/**" in config.infrastructure  # merged with defaults
+        assert config.infrastructure_overrides == []
+        assert config.user_facing_overrides == []
+        assert config.tags == {}
+
+    def test_defaults_are_empty_for_bare_constructor(self) -> None:
+        """ClassifierConfig() without from_pyproject has empty lists."""
+        config = ClassifierConfig()
+        assert config.infrastructure == []
+        assert config.infrastructure_overrides == []
+        assert config.user_facing_overrides == []
+        assert config.tags == {}
+        assert config.use_defaults is True
+
+    def test_default_infrastructure_is_non_empty(self) -> None:
+        """The framework ships with a curated default infrastructure list."""
+        assert len(DEFAULT_INFRASTRUCTURE) > 0
+        assert ".gitea/**" in DEFAULT_INFRASTRUCTURE
+        assert "tests/**" in DEFAULT_INFRASTRUCTURE
+        assert "docs/**" in DEFAULT_INFRASTRUCTURE
+
+
+# ---------------------------------------------------------------------------
+# ChangeClassifier tests
+# ---------------------------------------------------------------------------
+
+
+class TestChangeClassifier:
+    def _make_classifier(self, **kwargs: object) -> ChangeClassifier:
+        """Create a classifier with explicit config (no pyproject.toml needed)."""
+        config = ClassifierConfig(**kwargs)  # type: ignore[arg-type]
+        return ChangeClassifier(config)
+
+    def test_infrastructure_pattern_matches(self) -> None:
+        classifier = self._make_classifier(infrastructure=[".gitea/**", "tests/**"])
+        fc = classifier.classify_file(".gitea/workflows/ci.yml")
+        assert not fc.is_user_facing
+        assert "infrastructure" in fc.matched_rule
 
     def test_unknown_file_defaults_to_user_facing(self) -> None:
-        """Safe default: unknown files are user-facing (require release)."""
-        assert is_user_facing("some/new/file.type") is True
-        assert is_user_facing("new_root_file.txt") is True
+        classifier = self._make_classifier(infrastructure=[".gitea/**"])
+        fc = classifier.classify_file("src/devx/cli.py")
+        assert fc.is_user_facing
+        assert fc.matched_rule is None
+        assert "default" in fc.reason.lower()
 
-    def test_is_workflow_only_inverse(self) -> None:
-        assert is_workflow_only(".gitea/workflows/ci.yml") is True
-        assert is_workflow_only("src/devx/cli.py") is False
-        assert is_workflow_only("pyproject.toml") is False
+    def test_infrastructure_override(self) -> None:
+        classifier = self._make_classifier(
+            infrastructure=[".gitea/**"],
+            infrastructure_overrides=["src/devx/__init__.py"],
+        )
+        fc = classifier.classify_file("src/devx/__init__.py")
+        assert not fc.is_user_facing
+        assert fc.matched_rule == "infrastructure_overrides"
 
+    def test_user_facing_override_beats_infrastructure(self) -> None:
+        """User-facing overrides have highest priority (safety)."""
+        classifier = self._make_classifier(
+            infrastructure=["tests/**"],
+            user_facing_overrides=["tests/test_public_api.py"],
+        )
+        fc = classifier.classify_file("tests/test_public_api.py")
+        assert fc.is_user_facing
+        assert fc.matched_rule == "user_facing_overrides"
 
-class TestClassifyChanges:
-    def test_all_user_facing(self) -> None:
-        files = ["src/devx/cli.py", "ansible/roles/gitea-runner/tasks/main.yml"]
-        result = classify_changes(files)
-        assert result["user_facing"] == files
-        assert result["workflow_only"] == []
+    def test_user_facing_override_beats_infrastructure_override(self) -> None:
+        """User-facing overrides beat infrastructure overrides (safety first)."""
+        classifier = self._make_classifier(
+            infrastructure=[".gitea/**"],
+            infrastructure_overrides=["src/devx/__init__.py"],
+            user_facing_overrides=["src/devx/__init__.py"],
+        )
+        fc = classifier.classify_file("src/devx/__init__.py")
+        assert fc.is_user_facing
 
-    def test_all_workflow_only(self) -> None:
-        files = [".gitea/workflows/ci.yml", "docs/index.md", "AGENTS.md"]
-        result = classify_changes(files)
-        assert result["user_facing"] == []
-        assert result["workflow_only"] == files
+    def test_tags_are_computed(self) -> None:
+        classifier = self._make_classifier(
+            infrastructure=[".gitea/**"],
+            tags={"ansible": ["ansible/**", ".ansible-lint"], "docs": ["docs/**"]},
+        )
+        fc = classifier.classify_file("ansible/tasks/main.yml")
+        assert "ansible" in fc.tags
+        assert "docs" not in fc.tags
 
-    def test_mixed(self) -> None:
+    def test_tags_orthogonal_to_classification(self) -> None:
+        """A file can be infrastructure AND tagged."""
+        classifier = self._make_classifier(
+            infrastructure=[".gitea/**", "docs/**"],
+            tags={"docs": ["docs/**"]},
+        )
+        fc = classifier.classify_file("docs/index.md")
+        assert not fc.is_user_facing  # infrastructure
+        assert "docs" in fc.tags  # also tagged
+
+    def test_classify_multiple_files(self) -> None:
+        classifier = self._make_classifier(
+            infrastructure=[".gitea/**", "tests/**"],
+            infrastructure_overrides=["src/devx/__init__.py"],
+            tags={"ansible": ["ansible/**"]},
+        )
         files = [
             "src/devx/cli.py",
             ".gitea/workflows/ci.yml",
-            "pyproject.toml",
-            "docs/index.md",
+            "src/devx/__init__.py",
+            "ansible/tasks/main.yml",
+            "tests/test_foo.py",
         ]
-        result = classify_changes(files)
-        assert "src/devx/cli.py" in result["user_facing"]
-        assert "pyproject.toml" in result["user_facing"]
-        assert ".gitea/workflows/ci.yml" in result["workflow_only"]
-        assert "docs/index.md" in result["workflow_only"]
+        result = classifier.classify(files)
+        assert "src/devx/cli.py" in result.user_facing
+        assert "ansible/tasks/main.yml" in result.user_facing
+        assert ".gitea/workflows/ci.yml" in result.infrastructure
+        assert "src/devx/__init__.py" in result.infrastructure
+        assert "tests/test_foo.py" in result.infrastructure
+        assert result.has_user_facing
+        assert result.has_tag("ansible")
+        assert "ansible/tasks/main.yml" in result.tags["ansible"]
 
-    def test_empty(self) -> None:
-        result = classify_changes([])
-        assert result == {"user_facing": [], "workflow_only": []}
+    def test_classify_empty(self) -> None:
+        classifier = self._make_classifier(infrastructure=[".gitea/**"])
+        result = classifier.classify([])
+        assert not result.has_user_facing
+        assert result.user_facing == []
+        assert result.infrastructure == []
+
+    def test_reason_is_human_readable(self) -> None:
+        classifier = self._make_classifier(infrastructure=[".gitea/**"])
+        fc = classifier.classify_file(".gitea/workflows/ci.yml")
+        assert ".gitea/**" in fc.reason
+        fc2 = classifier.classify_file("src/devx/cli.py")
+        assert "default" in fc2.reason.lower() or "user-facing" in fc2.reason.lower()
+
+
+class TestClassificationResult:
+    def test_has_user_facing(self) -> None:
+        result = ClassificationResult(user_facing=["src/cli.py"])
+        assert result.has_user_facing
+
+    def test_has_user_facing_empty(self) -> None:
+        result = ClassificationResult()
+        assert not result.has_user_facing
+
+    def test_has_tag(self) -> None:
+        result = ClassificationResult(tags={"ansible": ["ansible/tasks/main.yml"]})
+        assert result.has_tag("ansible")
+        assert not result.has_tag("docs")
+
+
+# ---------------------------------------------------------------------------
+# Backward-compatible API tests
+# ---------------------------------------------------------------------------
+
+
+class TestBackwardCompatibleAPI:
+    def test_is_workflow_only_with_config(self) -> None:
+        """is_workflow_only uses the config-driven classifier by default."""
+        with patch.object(classify_changes_mod, "_get_classifier") as mock:
+            classifier = MagicMock()
+            classifier.classify_file.return_value = FileClassification(
+                path=".gitea/workflows/ci.yml",
+                is_user_facing=False,
+                reason="test",
+                matched_rule="infrastructure: .gitea/**",
+            )
+            mock.return_value = classifier
+            assert is_workflow_only(".gitea/workflows/ci.yml") is True
+
+    def test_is_user_facing_with_config(self) -> None:
+        with patch.object(classify_changes_mod, "_get_classifier") as mock:
+            classifier = MagicMock()
+            classifier.classify_file.return_value = FileClassification(
+                path="src/devx/cli.py",
+                is_user_facing=True,
+                reason="test",
+                matched_rule=None,
+            )
+            mock.return_value = classifier
+            assert is_user_facing("src/devx/cli.py") is True
+
+    def test_legacy_patterns_mode(self) -> None:
+        """is_workflow_only with explicit patterns uses legacy prefix matching."""
+        patterns = frozenset([".gitea/", "tests/"])
+        assert is_workflow_only(".gitea/workflows/ci.yml", patterns) is True
+        assert is_workflow_only("tests/test_foo.py", patterns) is True
+        assert is_workflow_only("src/devx/cli.py", patterns) is False
+
+    def test_classify_changes_with_config(self) -> None:
+        with patch.object(classify_changes_mod, "_get_classifier") as mock:
+            classifier = MagicMock()
+            classifier.classify.return_value = ClassificationResult(
+                user_facing=["src/devx/cli.py"],
+                infrastructure=[".gitea/workflows/ci.yml"],
+            )
+            mock.return_value = classifier
+            result = classify_changes(["src/devx/cli.py", ".gitea/workflows/ci.yml"])
+            assert "src/devx/cli.py" in result["user_facing"]
+            assert ".gitea/workflows/ci.yml" in result["workflow_only"]
+
+    def test_classify_changes_legacy_mode(self) -> None:
+        patterns = frozenset([".gitea/", "tests/"])
+        result = classify_changes([".gitea/ci.yml", "src/cli.py"], patterns)
+        assert ".gitea/ci.yml" in result["workflow_only"]
+        assert "src/cli.py" in result["user_facing"]
+
+    def test_has_user_facing_changes_with_config(self) -> None:
+        with (
+            patch.object(classify_changes_mod, "get_changed_files", return_value=["src/devx/cli.py"]),
+            patch.object(classify_changes_mod, "_get_classifier") as mock,
+        ):
+            classifier = MagicMock()
+            classifier.classify.return_value = ClassificationResult(
+                user_facing=["src/devx/cli.py"],
+            )
+            mock.return_value = classifier
+            assert has_user_facing_changes("v0.1.0", "HEAD") is True
+
+    def test_has_user_facing_changes_legacy(self) -> None:
+        with patch.object(classify_changes_mod, "get_changed_files", return_value=[".gitea/ci.yml"]):
+            patterns = frozenset([".gitea/"])
+            assert has_user_facing_changes("v0.1.0", "HEAD", patterns) is False
+
+
+# ---------------------------------------------------------------------------
+# Git helper tests
+# ---------------------------------------------------------------------------
 
 
 class TestGetChangedFiles:
@@ -127,23 +397,6 @@ class TestGetChangedFiles:
         assert result == []
 
 
-class TestHasUserFacingChanges:
-    @patch("devx.ci.classify_changes.get_changed_files")
-    def test_true_when_user_facing(self, mock_get: MagicMock) -> None:
-        mock_get.return_value = ["src/devx/cli.py", "docs/index.md"]
-        assert has_user_facing_changes("v0.1.0", "HEAD") is True
-
-    @patch("devx.ci.classify_changes.get_changed_files")
-    def test_false_when_workflow_only(self, mock_get: MagicMock) -> None:
-        mock_get.return_value = [".gitea/workflows/ci.yml", "docs/index.md"]
-        assert has_user_facing_changes("v0.1.0", "HEAD") is False
-
-    @patch("devx.ci.classify_changes.get_changed_files")
-    def test_false_when_no_changes(self, mock_get: MagicMock) -> None:
-        mock_get.return_value = []
-        assert has_user_facing_changes("v0.1.0", "HEAD") is False
-
-
 class TestGetLatestTag:
     @patch("subprocess.run")
     def test_returns_tag(self, mock_run: MagicMock) -> None:
@@ -170,6 +423,11 @@ class TestRunGit:
             run_git(["git", "bad-command"])
 
 
+# ---------------------------------------------------------------------------
+# CLI tests
+# ---------------------------------------------------------------------------
+
+
 class TestMain:
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="")
     def test_no_tags_outputs_true(self, mock_tag: MagicMock) -> None:
@@ -204,9 +462,28 @@ class TestMain:
         assert result.exit_code == 0
         assert "release needed" in result.output
 
+    @patch("devx.ci.classify_changes._get_classifier")
+    @patch("devx.ci.classify_changes.get_changed_files")
+    @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
+    def test_default_mode_displays_tags(
+        self, mock_tag: MagicMock, mock_changes: MagicMock, mock_clf: MagicMock
+    ) -> None:
+        """Default mode shows tag files when tags are configured."""
+        mock_changes.return_value = ["src/devx/cli.py", "ansible/tasks/main.yml"]
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={"ansible": ["ansible/**"]},
+            )
+        )
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0
+        assert "Ansible files" in result.output
+        assert "ansible/tasks/main.yml" in result.output
+
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="")
     def test_no_tags_non_quiet(self, mock_tag: MagicMock) -> None:
-        """Non-quiet mode with no tags prints user-facing message."""
         runner = CliRunner()
         result = runner.invoke(main, [])
         assert result.exit_code == 0
@@ -215,7 +492,6 @@ class TestMain:
     @patch("devx.ci.classify_changes.get_changed_files", return_value=[])
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_no_changes_non_quiet(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """Non-quiet mode with no changes prints message."""
         runner = CliRunner()
         result = runner.invoke(main, [])
         assert result.exit_code == 0
@@ -224,7 +500,6 @@ class TestMain:
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_quiet_user_facing(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """Quiet mode with user-facing changes outputs true."""
         mock_changes.return_value = ["src/devx/cli.py"]
         runner = CliRunner()
         result = runner.invoke(main, ["--quiet"])
@@ -234,7 +509,6 @@ class TestMain:
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_quiet_workflow_only(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """Quiet mode with workflow-only changes outputs false."""
         mock_changes.return_value = [".gitea/workflows/ci.yml"]
         runner = CliRunner()
         result = runner.invoke(main, ["--quiet"])
@@ -244,28 +518,39 @@ class TestMain:
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_with_explicit_base(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """Explicit --base overrides latest tag."""
         mock_changes.return_value = ["src/devx/cli.py"]
         runner = CliRunner()
         result = runner.invoke(main, ["--base", "v0.2.0", "--head", "HEAD"])
         assert result.exit_code == 0
         assert "release needed" in result.output
 
+    @patch("devx.ci.classify_changes._get_classifier")
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
-    def test_check_ansible_true(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """--check ansible with Ansible changes outputs true."""
+    def test_check_ansible_true(self, mock_tag: MagicMock, mock_changes: MagicMock, mock_clf: MagicMock) -> None:
         mock_changes.return_value = ["ansible/tasks/main.yml", ".gitea/workflows/ci.yml"]
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={"ansible": ["ansible/**"]},
+            )
+        )
         runner = CliRunner()
         result = runner.invoke(main, ["--check", "ansible", "--quiet"])
         assert result.exit_code == 0
         assert "true" in result.output
 
+    @patch("devx.ci.classify_changes._get_classifier")
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
-    def test_check_ansible_false(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """--check ansible with no Ansible changes outputs false."""
+    def test_check_ansible_false(self, mock_tag: MagicMock, mock_changes: MagicMock, mock_clf: MagicMock) -> None:
         mock_changes.return_value = ["src/devx/cli.py", ".gitea/workflows/ci.yml"]
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={"ansible": ["ansible/**"]},
+            )
+        )
         runner = CliRunner()
         result = runner.invoke(main, ["--check", "ansible", "--quiet"])
         assert result.exit_code == 0
@@ -274,7 +559,6 @@ class TestMain:
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_check_user_facing_true(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """--check user-facing with user-facing changes outputs true."""
         mock_changes.return_value = ["src/devx/cli.py", ".gitea/workflows/ci.yml"]
         runner = CliRunner()
         result = runner.invoke(main, ["--check", "user-facing", "--quiet"])
@@ -284,27 +568,47 @@ class TestMain:
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_check_user_facing_false(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """--check user-facing with only workflow changes outputs false."""
         mock_changes.return_value = [".gitea/workflows/ci.yml", "tests/test_foo.py"]
         runner = CliRunner()
         result = runner.invoke(main, ["--check", "user-facing", "--quiet"])
         assert result.exit_code == 0
         assert "false" in result.output
 
+    @patch("devx.ci.classify_changes._get_classifier")
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
-    def test_check_ansible_non_quiet(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """--check ansible in non-quiet mode prints file list."""
+    def test_check_ansible_non_quiet(self, mock_tag: MagicMock, mock_changes: MagicMock, mock_clf: MagicMock) -> None:
         mock_changes.return_value = ["ansible/tasks/main.yml"]
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={"ansible": ["ansible/**"]},
+            )
+        )
         runner = CliRunner()
         result = runner.invoke(main, ["--check", "ansible"])
         assert result.exit_code == 0
         assert "Ansible changes detected" in result.output
 
+    @patch("devx.ci.classify_changes._get_classifier")
+    @patch("devx.ci.classify_changes.get_changed_files")
+    @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
+    def test_check_unknown_tag_raises(self, mock_tag: MagicMock, mock_changes: MagicMock, mock_clf: MagicMock) -> None:
+        mock_changes.return_value = ["src/devx/cli.py"]
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={"ansible": ["ansible/**"]},
+            )
+        )
+        runner = CliRunner()
+        result = runner.invoke(main, ["--check", "nonexistent"])
+        assert result.exit_code != 0
+        assert "Unknown check category" in result.output
+
     @patch("devx.ci.classify_changes.get_changed_files")
     @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
     def test_check_user_facing_non_quiet(self, mock_tag: MagicMock, mock_changes: MagicMock) -> None:
-        """--check user-facing in non-quiet mode prints file list."""
         mock_changes.return_value = ["src/devx/cli.py"]
         runner = CliRunner()
         result = runner.invoke(main, ["--check", "user-facing"])
@@ -313,7 +617,17 @@ class TestMain:
 
 
 class TestGithubOutput:
-    def test_writes_outputs(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    def _make_classifier_with_ansible(self) -> ChangeClassifier:
+        return ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**", "AGENTS.md"],
+                tags={"ansible": ["ansible/**"]},
+            )
+        )
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_writes_outputs(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        mock_clf.return_value = self._make_classifier_with_ansible()
         gh_file = tmp_path / "output.txt"
         monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
         with patch.object(
@@ -326,7 +640,9 @@ class TestGithubOutput:
         assert "ansible-changed=true" in content
         assert "user-facing-changed=true" in content
 
-    def test_no_changes(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_no_changes(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        mock_clf.return_value = self._make_classifier_with_ansible()
         gh_file = tmp_path / "output.txt"
         monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
         with patch.object(classify_changes_mod, "get_changed_files", return_value=[]):
@@ -337,7 +653,9 @@ class TestGithubOutput:
         assert "ansible-changed=false" in content
         assert "user-facing-changed=false" in content
 
-    def test_no_tags(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_no_tags(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        mock_clf.return_value = self._make_classifier_with_ansible()
         gh_file = tmp_path / "output.txt"
         monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
         with patch.object(classify_changes_mod, "get_latest_tag", return_value=""):
@@ -355,7 +673,9 @@ class TestGithubOutput:
             result = runner.invoke(main, ["--base", "v1.0", "--head", "HEAD", "--github-output"])
         assert result.exit_code != 0
 
-    def test_workflow_only(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_workflow_only(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        mock_clf.return_value = self._make_classifier_with_ansible()
         gh_file = tmp_path / "output.txt"
         monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
         with patch.object(
@@ -367,3 +687,25 @@ class TestGithubOutput:
         content = gh_file.read_text()
         assert "ansible-changed=false" in content
         assert "user-facing-changed=false" in content
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_no_tags_outputs_all_tags_true(
+        self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """When no tags exist, only user-facing-changed is written."""
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={},
+            )
+        )
+        gh_file = tmp_path / "output.txt"
+        monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
+        with patch.object(classify_changes_mod, "get_latest_tag", return_value=""):
+            runner = CliRunner()
+            result = runner.invoke(main, ["--github-output"])
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "user-facing-changed=true" in content
+        # No tag outputs since no tags are configured
+        assert "ansible-changed" not in content

tests/unit/test_configure_repo.py

@@ -31,7 +31,7 @@ class TestDefaultConfigs:
         config = _default_branch_protection_config()
         assert config["branch_name"] == "master"
         assert config["enable_push"] is True
-        assert config["enable_push_whitelist"] is True
+        assert config["enable_push_whitelist"] is False
         assert config["required_approvals"] == 0
         assert isinstance(config["status_check_contexts"], list)
         assert "CI / quality (pull_request)" in config["status_check_contexts"]
@@ -45,16 +45,6 @@ class TestDefaultConfigs:
             config = _default_branch_protection_config()
             assert config["status_check_contexts"] == ["check1", "check2", "check3"]
 
-    def test_push_whitelist_from_env(self) -> None:
-        with patch.dict("os.environ", {"DEVX_PUSH_WHITELIST": "emil, alice"}):
-            config = _default_branch_protection_config()
-            assert config["push_whitelist_usernames"] == ["emil", "alice"]
-
-    def test_push_whitelist_empty_by_default(self) -> None:
-        with patch.dict("os.environ", {}, clear=True):
-            config = _default_branch_protection_config()
-            assert config["push_whitelist_usernames"] == []
-
 
 class TestConfigureRepo:
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)

tests/unit/test_discover_runners.py

@@ -120,6 +120,35 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 0
 
+    @patch("devx.ci.discover_runners.requests.get")
+    def test_query_runners_403_no_warning(self, mock_get: MagicMock, capsys: pytest.CaptureFixture[str]) -> None:
+        """403 on instance-level runners should not produce a warning (expected without admin scope)."""
+        responses = [
+            MagicMock(status_code=200, json=lambda: {"total_count": 2}),
+            MagicMock(status_code=200, json=lambda: {"total_count": 1}),
+            MagicMock(status_code=403, json=lambda: {"message": "forbidden"}),
+        ]
+        mock_get.side_effect = responses
+        result = query_runners("https://api.example.com", "token", "owner", "repo")
+        assert result == 3
+        captured = capsys.readouterr()
+        assert "instance-level" not in captured.err
+
+    @patch("devx.ci.discover_runners.requests.get")
+    def test_instance_level_non_403_warns(self, mock_get: MagicMock, capsys: pytest.CaptureFixture[str]) -> None:
+        """Non-200, non-403 status on instance-level runners should produce a warning."""
+        responses = [
+            MagicMock(status_code=200, json=lambda: {"total_count": 1}),
+            MagicMock(status_code=200, json=lambda: {"total_count": 1}),
+            MagicMock(status_code=500, json=lambda: {"message": "server error"}),
+        ]
+        mock_get.side_effect = responses
+        result = query_runners("https://api.example.com", "token", "owner", "repo")
+        assert result == 2
+        captured = capsys.readouterr()
+        assert "instance-level" in captured.err
+        assert "500" in captured.err
+
 
 class TestGetRunnerCount:
     @patch("devx.ci.discover_runners.query_runners", return_value=5)

tests/unit/test_distribute_molecule.py

@@ -240,6 +240,16 @@ class TestGithubEnv:
         assert result.exit_code != 0
 
 
+class TestRunnerIndexValidation:
+    def test_runner_index_zero_raises(self) -> None:
+        """Runner index < 1 should raise."""
+        with patch("devx.molecule.distribute_molecule.discover_scenarios", return_value=["dummy"]):
+            runner = CliRunner()
+            result = runner.invoke(cli, ["--runner-index", "0", "--max-runners", "3"])
+        assert result.exit_code != 0
+        assert "out of range" in result.output
+
+
 def test_main_module_block() -> None:
     import devx.molecule.distribute_molecule as dm
 

tests/unit/test_molecule_ci_guard.py

@@ -168,6 +168,15 @@ class TestCli:
             assert result.exit_code == 0
             assert "All molecule tests passed" in result.output
 
+    def test_invalid_pair_format_raises(self) -> None:
+        """Pair with fewer than 2 parts should raise."""
+        from click.testing import CliRunner
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["invalid_no_pipe"])
+        assert result.exit_code != 0
+        assert "Invalid pair format" in result.output
+
     def test_failure_exits_nonzero(self) -> None:
         from click.testing import CliRunner
 

tests/unit/test_post_merge.py

@@ -132,13 +132,12 @@ class TestMain:
         assert "VIKUNJA_TOKEN" in result.output
 
     @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
-    def test_no_task_id_non_release_warns(self) -> None:
-        """Non-release commits without DEVX-N prefix should warn, not fail."""
+    def test_no_task_id_non_release_fails(self) -> None:
+        """Non-release commits without DEVX-N prefix should fail."""
         runner = CliRunner()
         result = runner.invoke(main, ["fix: resolve bug"])
-        assert result.exit_code == 0
+        assert result.exit_code != 0
         assert "No task ID" in result.output
-        assert "Skipping" in result.output
 
     @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
     def test_release_commit_without_task_id_skips(self) -> None:
@@ -179,8 +178,8 @@ class TestMain:
 
     @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
     @patch("devx.ci.post_merge.VikunjaClient")
-    def test_post_comment_failure_warns(self, mock_client_cls: MagicMock) -> None:
-        """Vikunja API errors should warn, not fail — the merge already succeeded."""
+    def test_post_comment_failure_fails(self, mock_client_cls: MagicMock) -> None:
+        """Vikunja API errors should fail — the task was not updated."""
         mock_client = MagicMock()
         mock_client.list_project_tasks.return_value = [
             {"id": 267, "identifier": "DEVX-20"},
@@ -189,14 +188,13 @@ class TestMain:
         mock_client_cls.return_value = mock_client
         runner = CliRunner()
         result = runner.invoke(main, ["DEVX-20: fix: bug"])
-        assert result.exit_code == 0
-        assert "Warning" in result.output
-        assert "not updated" in result.output.lower()
+        assert result.exit_code != 0
+        assert "Vikunja API error" in result.output
 
     @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
     @patch("devx.ci.post_merge.VikunjaClient")
-    def test_mark_done_failure_warns(self, mock_client_cls: MagicMock) -> None:
-        """Vikunja API errors should warn, not fail — the merge already succeeded."""
+    def test_mark_done_failure_fails(self, mock_client_cls: MagicMock) -> None:
+        """Vikunja API errors should fail — the task was not updated."""
         mock_client = MagicMock()
         mock_client.list_project_tasks.return_value = [
             {"id": 267, "identifier": "DEVX-20"},
@@ -206,9 +204,8 @@ class TestMain:
         mock_client_cls.return_value = mock_client
         runner = CliRunner()
         result = runner.invoke(main, ["DEVX-20: fix: bug"])
-        assert result.exit_code == 0
-        assert "Warning" in result.output
-        assert "not updated" in result.output.lower()
+        assert result.exit_code != 0
+        assert "Vikunja API error" in result.output
 
 
 class TestGetGitCommitMessage:

tests/unit/test_release.py

@@ -84,6 +84,13 @@ class TestGetBumpedVersion:
         with pytest.raises(click.ClickException):
             get_bumped_version()
 
+    @patch("devx.ci.release.run_cmd")
+    def test_invalid_version_format_raises(self, mock_run_cmd: MagicMock) -> None:
+        """Non-semver version from git-cliff should raise."""
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="not-a-version\n", stderr="")
+        with pytest.raises(click.ClickException, match="invalid version format"):
+            get_bumped_version()
+
 
 class TestGetChangelog:
     @patch("devx.ci.release.run_cmd")
@@ -318,12 +325,15 @@ class TestMain:
     @patch.dict("os.environ", {})
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.run_cmd")
-    def test_release_lock_skips_when_head_is_release_commit(self, mock_run_cmd: MagicMock, mock_uf: MagicMock) -> None:
-        """If HEAD is already a release commit, should skip to prevent duplicate releases."""
-        # First call: git rev-parse (master), second: git log -1 (release commit)
+    def test_release_lock_skips_when_head_is_release_commit_and_tag_exists(
+        self, mock_run_cmd: MagicMock, mock_uf: MagicMock
+    ) -> None:
+        """If HEAD is a release commit and the tag exists, skip."""
+        # git rev-parse, git log -1, git tag -l (tag exists)
         mock_run_cmd.side_effect = [
             MagicMock(returncode=0, stdout="master\n", stderr=""),
             MagicMock(returncode=0, stdout="release: v0.5.0\n", stderr=""),
+            MagicMock(returncode=0, stdout="v0.5.0\n", stderr=""),  # tag -l finds tag
         ]
         runner = CliRunner()
         result = runner.invoke(main, [])
@@ -331,6 +341,27 @@ class TestMain:
         assert "already a release commit" in result.output
         assert "Skipping" in result.output
 
+    @patch.dict("os.environ", {})
+    @patch("devx.ci.release.get_changelog", return_value="## changelog")
+    @patch("devx.ci.release.create_and_push_tag", return_value=True)
+    @patch("devx.ci.release.run_cmd")
+    def test_release_lock_recovers_when_tag_missing(
+        self, mock_run_cmd: MagicMock, mock_create_tag: MagicMock, mock_changelog: MagicMock
+    ) -> None:
+        """If HEAD is a release commit but the tag is missing, create the tag."""
+        # git rev-parse, git log -1, git tag -l (tag NOT found)
+        mock_run_cmd.side_effect = [
+            MagicMock(returncode=0, stdout="master\n", stderr=""),
+            MagicMock(returncode=0, stdout="release: v0.5.0\n", stderr=""),
+            MagicMock(returncode=0, stdout="", stderr=""),  # tag -l finds nothing
+        ]
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0
+        assert "tag v0.5.0 is missing" in result.output
+        assert "Recovering" in result.output
+        mock_create_tag.assert_called_once_with("0.5.0", "## changelog", False)
+
     @patch.dict("os.environ", {})
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)
     @patch("devx.ci.release.has_unreleased_changes", return_value=False)
@@ -360,7 +391,7 @@ class TestMain:
     @patch("devx.ci.release.get_bumped_version", return_value="0.2.0")
     @patch("devx.ci.release.has_unreleased_changes", return_value=True)
     @patch("devx.ci.release.run_cmd")
-    def test_dry_run_empty_changelog(
+    def test_dry_run_empty_changelog_fails(
         self,
         mock_run_cmd: MagicMock,
         mock_has: MagicMock,
@@ -373,11 +404,12 @@ class TestMain:
         mock_tag: MagicMock,
         mock_user: MagicMock,
     ) -> None:
+        """Empty changelog should fail, not warn."""
         mock_run_cmd.return_value = MagicMock(returncode=0, stdout="master\n", stderr="")
         runner = CliRunner()
         result = runner.invoke(main, ["--dry-run"])
-        assert result.exit_code == 0
-        assert "empty changelog" in result.output
+        assert result.exit_code != 0
+        assert "empty changelog" in result.output.lower()
 
     @patch.dict("os.environ", {})
     @patch("devx.ci.release.has_user_facing_changes", return_value=True)

tests/unit/test_setup.py

@@ -9,6 +9,7 @@ from click.testing import CliRunner
 
 from devx.tools.setup import (
     _configure_tea_login,
+    _install_ansible_collections,
     _install_pre_commit_hooks,
     _install_python_deps,
     _run,
@@ -58,6 +59,24 @@ class TestInstallPreCommitHooks:
         assert "pre-push" in hook_types
 
 
+class TestInstallAnsibleCollections:
+    @patch("devx.tools.setup._run")
+    def test_installs_from_requirements(self, mock_run: MagicMock, tmp_path: Path) -> None:
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            _install_ansible_collections(".venv/bin")
+        mock_run.assert_called_once()
+
+    @patch("devx.tools.setup._run")
+    def test_skips_when_no_requirements(self, mock_run: MagicMock) -> None:
+        _install_ansible_collections(".venv/bin")
+        mock_run.assert_not_called()
+
+
 class TestConfigureTeaLogin:
     @patch("devx.tools.setup.shutil.which", return_value=None)
     def test_tea_not_installed(self, mock_which: MagicMock) -> None:
@@ -142,10 +161,12 @@ class TestMain:
     @patch("devx.tools.setup._configure_tea_login")
     @patch("devx.tools.setup._verify")
     @patch("devx.tools.setup._install_pre_commit_hooks")
+    @patch("devx.tools.setup._install_ansible_collections")
     @patch("devx.tools.setup._install_python_deps")
     def test_main_success(
         self,
         mock_install_deps: MagicMock,
+        mock_install_ansible: MagicMock,
         mock_install_hooks: MagicMock,
         mock_verify: MagicMock,
         mock_tea: MagicMock,
@@ -157,6 +178,7 @@ class TestMain:
         result = runner.invoke(main, ["--bin", str(bin_dir)])
         assert result.exit_code == 0
         mock_install_deps.assert_called_once()
+        mock_install_ansible.assert_called_once()
         mock_install_hooks.assert_called_once()
         mock_verify.assert_called_once()
         mock_tea.assert_called_once()
@@ -164,10 +186,12 @@ class TestMain:
     @patch("devx.tools.setup._configure_tea_login")
     @patch("devx.tools.setup._verify")
     @patch("devx.tools.setup._install_pre_commit_hooks")
+    @patch("devx.tools.setup._install_ansible_collections")
     @patch("devx.tools.setup._install_python_deps")
     def test_main_no_pre_commit(
         self,
         mock_install_deps: MagicMock,
+        mock_install_ansible: MagicMock,
         mock_install_hooks: MagicMock,
         mock_verify: MagicMock,
         mock_tea: MagicMock,
@@ -184,10 +208,33 @@ class TestMain:
     @patch("devx.tools.setup._configure_tea_login")
     @patch("devx.tools.setup._verify")
     @patch("devx.tools.setup._install_pre_commit_hooks")
+    @patch("devx.tools.setup._install_ansible_collections")
+    @patch("devx.tools.setup._install_python_deps")
+    def test_main_no_ansible_collections(
+        self,
+        mock_install_deps: MagicMock,
+        mock_install_ansible: MagicMock,
+        mock_install_hooks: MagicMock,
+        mock_verify: MagicMock,
+        mock_tea: MagicMock,
+        tmp_path: Path,
+    ) -> None:
+        bin_dir = tmp_path / "bin"
+        bin_dir.mkdir()
+        runner = CliRunner()
+        result = runner.invoke(main, ["--bin", str(bin_dir), "--no-ansible-collections"])
+        assert result.exit_code == 0
+        mock_install_ansible.assert_not_called()
+
+    @patch("devx.tools.setup._configure_tea_login")
+    @patch("devx.tools.setup._verify")
+    @patch("devx.tools.setup._install_pre_commit_hooks")
+    @patch("devx.tools.setup._install_ansible_collections")
     @patch("devx.tools.setup._install_python_deps")
     def test_main_custom_extras(
         self,
         mock_install_deps: MagicMock,
+        mock_install_ansible: MagicMock,
         mock_install_hooks: MagicMock,
         mock_verify: MagicMock,
         mock_tea: MagicMock,
@@ -203,10 +250,12 @@ class TestMain:
     @patch("devx.tools.setup._configure_tea_login")
     @patch("devx.tools.setup._verify")
     @patch("devx.tools.setup._install_pre_commit_hooks")
+    @patch("devx.tools.setup._install_ansible_collections")
     @patch("devx.tools.setup._install_python_deps")
     def test_main_no_tea_login(
         self,
         mock_install_deps: MagicMock,
+        mock_install_ansible: MagicMock,
         mock_install_hooks: MagicMock,
         mock_verify: MagicMock,
         mock_tea: MagicMock,
@@ -233,9 +282,10 @@ def test_main_module_block(tmp_path: Path) -> None:
     with patch.dict("os.environ", {}, clear=True):
         with patch("devx.tools.setup._install_python_deps") as mock_deps:
             with patch("devx.tools.setup._install_pre_commit_hooks"):
-                with patch("devx.tools.setup._configure_tea_login"):
-                    with patch("devx.tools.setup._verify"):
-                        runner = CliRunner()
-                        result = runner.invoke(main, ["--bin", str(bin_dir)])
-                        assert result.exit_code == 0
-                        mock_deps.assert_called_once()
+                with patch("devx.tools.setup._install_ansible_collections"):
+                    with patch("devx.tools.setup._configure_tea_login"):
+                        with patch("devx.tools.setup._verify"):
+                            runner = CliRunner()
+                            result = runner.invoke(main, ["--bin", str(bin_dir)])
+                            assert result.exit_code == 0
+                            mock_deps.assert_called_once()

tests/unit/test_sync_wiki.py

@@ -5,6 +5,7 @@ import json
 from pathlib import Path
 from unittest.mock import MagicMock, patch
 
+import click
 import pytest
 from click.testing import CliRunner
 
@@ -63,6 +64,22 @@ class TestLoadMapping:
             with pytest.raises(FileNotFoundError):
                 load_mapping()
 
+    def test_non_dict_mapping_raises(self, tmp_path: Path) -> None:
+        """Non-dict mapping.json should raise."""
+        mapping_file = tmp_path / "mapping.json"
+        mapping_file.write_text('["not", "a", "dict"]')
+        with patch("devx.ci.sync_wiki.MAPPING_FILE", mapping_file):
+            with pytest.raises(click.ClickException, match="must be a dict"):
+                load_mapping()
+
+    def test_non_string_values_raise(self, tmp_path: Path) -> None:
+        """Non-string values in mapping.json should raise."""
+        mapping_file = tmp_path / "mapping.json"
+        mapping_file.write_text('{"file.md": 123}')
+        with patch("devx.ci.sync_wiki.MAPPING_FILE", mapping_file):
+            with pytest.raises(click.ClickException, match="must be strings"):
+                load_mapping()
+
 
 class TestReadDocContent:
     def test_reads_file(self, tmp_path: Path) -> None:
@@ -332,8 +349,8 @@ class TestMain:
 
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
     @patch("devx.ci.sync_wiki.GiteaClient")
-    def test_file_not_found_warning(self, mock_client_cls: MagicMock) -> None:
-        """Test that missing doc files are skipped with a warning."""
+    def test_file_not_found_fails(self, mock_client_cls: MagicMock) -> None:
+        """Test that missing doc files cause an error, not a warning."""
         with patch("devx.ci.sync_wiki.MAPPING_FILE") as mock_mapping:
             mock_mapping.exists.return_value = True
             with patch("devx.ci.sync_wiki.load_mapping", return_value={"missing.md": "Missing"}):
@@ -341,14 +358,13 @@ class TestMain:
                     with patch("devx.ci.sync_wiki.list_wiki_pages", return_value={}):
                         runner = CliRunner()
                         result = runner.invoke(main, ["--dry-run", "--repo", "owner/repo"])
-        assert result.exit_code == 0
+        assert result.exit_code != 0
         assert "not found" in result.output
-        assert "Skipped: 1" in result.output
 
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
     @patch("devx.ci.sync_wiki.GiteaClient")
-    def test_empty_doc_file_skipped(self, mock_client_cls: MagicMock) -> None:
-        """Test that empty doc files are skipped with a warning."""
+    def test_empty_doc_file_fails(self, mock_client_cls: MagicMock) -> None:
+        """Test that empty doc files cause an error, not a warning."""
         with patch("devx.ci.sync_wiki.MAPPING_FILE") as mock_mapping:
             mock_mapping.exists.return_value = True
             with patch("devx.ci.sync_wiki.load_mapping", return_value={"empty.md": "Empty-Page"}):
@@ -356,9 +372,8 @@ class TestMain:
                     with patch("devx.ci.sync_wiki.list_wiki_pages", return_value={}):
                         runner = CliRunner()
                         result = runner.invoke(main, ["--dry-run", "--repo", "owner/repo"])
-        assert result.exit_code == 0
+        assert result.exit_code != 0
         assert "empty" in result.output.lower()
-        assert "Skipped: 1" in result.output
 
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)
     @patch("devx.ci.sync_wiki.GiteaClient")