release: v0.19.2

DEVX-66: fix: calibrate molecule weights from actual CI execution times
chore: update badge URLs to commit 0ab8d43a [skip ci]
2026-06-27 01:38:41 +02:00 · 2026-06-26 23:36:58 +00:00 · 2026-06-26 21:39:38 +02:00 · 2026-06-26 21:36:46 +02:00 · 2026-06-26 19:36:16 +00:00 · 2026-06-26 19:34:45 +00:00
61 changed files with 5698 additions and 281 deletions
@@ -121,8 +121,13 @@ jobs:
  auto-merge:
    # Auto-merge runs after all CI checks pass. It reads the task ID
    # from the branch name, validates the PR title, and squash-merges.
+    # Uses always() so it runs even when detect-changes skips (no user-facing changes).
    needs: [quality, detect-changes, pr-review]
-    if: github.event_name == 'pull_request'
+    if: >-
+      always() &&
+      github.event_name == 'pull_request' &&
+      needs.quality.result == 'success' &&
+      needs.pr-review.result == 'success'
    runs-on: docker
    timeout-minutes: 10
    steps:
@@ -130,10 +135,8 @@ jobs:
        with:
          fetch-depth: 0
          token: ${{ secrets.REPO_TOKEN }}
-      - name: Install dependencies
-        run: |
-          python3 -m pip install --break-system-packages requests python-dotenv click
-          python3 -m pip install --break-system-packages -e .
+      - name: Set up environment
+        run: make setup-ci
      - name: Squash merge with task ID
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
@@ -145,6 +148,7 @@ jobs:
          REPOSITORY: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.number }}
        run: |
+          . .venv/bin/activate
          python3 -m devx.ci.auto_merge \
            "$HEAD_REF" \
            "$PR_TITLE" \
@@ -1,30 +1,30 @@
 name: Post-merge

 # Runs on every push to master. A single workflow with conditional jobs
-# replaces separate workflows for release, wiki sync, badges, and
-# Vikunja task updates.
+# for release, publish, wiki sync, badges, and Vikunja task updates.
 #
 # Job dependency graph:
 #
-#   detect-type ──┬── release (skip if release commit)
+#   detect-type ──┬── validate-commit-msg (skip if release commit)
+#                 ├── release (skip if release commit)
+#                 │   └── publish (needs release — builds & publishes to PyPI)
 #                 ├── badges (ALWAYS runs — even on release commits)
 #                 ├── configure-repo (independent — skip if release commit)
-#                 ├── sync-wiki (needs release — skip if release commit/fails)
-#                 └── vikunja (needs release — skip if release commit/fails)
+#                 ├── sync-wiki (skip if release commit — runs for ALL merges)
+#                 └── vikunja (skip if release commit — runs for ALL merges)
 #
-# sync-wiki and vikunja depend on release succeeding so that the wiki
-# and task tracker are only updated when the code is actually released.
-# If release fails, they are skipped to avoid leaving the wiki or
-# Vikunja in an inconsistent state with the codebase on master.
+# sync-wiki and vikunja run for ALL non-release commits, not just when
+# release succeeds. This ensures the wiki and task tracker are updated
+# even for infrastructure-only changes (docs, CI config, etc.).
 #
-# The badges job depends on release so it picks up the latest version
-# number. It uses `if: always()` with no is-release condition so it
-# runs on every push to master, including release commits. This
-# ensures badges (tests, coverage, version, etc.) are always current.
+# The badges job uses `if: always()` with no is-release condition so it
+# runs on every push to master, including release commits. This ensures
+# badges (tests, coverage, version, etc.) are always current.
 #
-# When release creates a "release: vX.Y.Z" commit, the release
-# commit's post-merge run still updates badges (version badge picks
-# up the new version). Other jobs skip. The tag push triggers publish.yml.
+# When release creates a "release: vX.Y.Z" commit and tag, the publish
+# job (which depends on release) builds and publishes the package to the
+# Gitea PyPI registry. The release commit's post-merge run still updates
+# badges (version badge picks up the new version). Other jobs skip.

 on:
  push:
@@ -40,15 +40,15 @@ jobs:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
-      - name: Install dependencies
-        run: |
-          python3 -m pip install --break-system-packages requests python-dotenv click
-          python3 -m pip install --break-system-packages -e .
+      - name: Set up environment
+        run: make setup-ci
      - name: Check if this is a release commit
        id: check
        env:
          PYTHONPATH: src
-        run: python3 -m devx.ci.detect_release_commit
+        run: |
+          . .venv/bin/activate
+          python3 -m devx.ci.detect_release_commit

  validate-commit-msg:
    needs: [detect-type]
@@ -59,14 +59,13 @@ jobs:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
-      - name: Install dependencies
-        run: |
-          python3 -m pip install --break-system-packages click python-dotenv
-          python3 -m pip install --break-system-packages -e .
+      - name: Set up environment
+        run: make setup-ci
      - name: Validate latest commit message
        env:
          PYTHONPATH: src
        run: |
+          . .venv/bin/activate
          git log -1 --format=%B > commit-msg.txt
          python3 -m devx.ci.validate_commit_msg commit-msg.txt --branch master
          rm -f commit-msg.txt
@@ -76,6 +75,8 @@ jobs:
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 15
+    outputs:
+      tag: ${{ steps.release-tag.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
@@ -90,26 +91,20 @@ jobs:
          git config user.name "devx-ci-bot"
          git config user.email "devx-ci-bot@oblachno.fyi"
      - name: Run release
+        id: release-tag
        env:
          PYTHONPATH: src
        run: |
          . .venv/bin/activate
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.release
-      - name: Publish release
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          PYTHONPATH: src
+      - name: Extract tag (fallback if GITHUB_OUTPUT not set)
+        if: steps.release-tag.outputs.tag == ''
        run: |
-          . .venv/bin/activate
-          export PATH="$HOME/.local/bin:$PATH"
-          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-          if [ -z "$TAG" ]; then
-            echo "No tag found — skipping publish"
-            exit 0
+          tag=$(git describe --tags --abbrev=0 2>/dev/null || true)
+          if [ -n "$tag" ]; then
+            echo "tag=$tag" >> "$GITHUB_OUTPUT"
          fi
-          echo "Publishing release $TAG (idempotent — skips if already published)..."
-          python3 -m devx.ci.publish "$TAG" "${{ github.repository }}"
      - name: Notify on failure
        if: failure()
        env:
@@ -118,17 +113,49 @@ jobs:
        run: |
          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.tools.install_tools --tool tea
-          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
-          tea login default devx || true
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
            --workflow "post-merge/release" \
            --commit "${{ github.sha }}"

+  publish:
+    needs: [release]
+    if: needs.release.outputs.tag != ''
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+        run: make setup-release
+      - name: Build and publish release
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.publish "${{ needs.release.outputs.tag }}" "${{ github.repository }}"
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/publish" \
+            --commit "${{ github.sha }}"
+
  sync-wiki:
-    needs: [detect-type, release]
+    needs: [detect-type]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 10
@@ -159,7 +186,7 @@ jobs:
            --commit "${{ github.sha }}"

  badges:
-    needs: [detect-type, release]
+    needs: [detect-type]
    if: always()
    runs-on: docker
    timeout-minutes: 10
@@ -195,7 +222,7 @@ jobs:
            --commit "${{ github.sha }}"

  vikunja:
-    needs: [detect-type, release]
+    needs: [detect-type]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 10
@@ -203,16 +230,16 @@ jobs:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
-      - name: Install dependencies
-        run: |
-          python3 -m pip install --break-system-packages requests python-dotenv click
-          python3 -m pip install --break-system-packages -e .
+      - name: Set up environment
+        run: make setup-ci
      - name: Update Vikunja task
        env:
          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
          DEVX_VIKUNJA_PROJECT_ID: "8"
          PYTHONPATH: src
-        run: python3 -m devx.ci.post_merge --git-sha "${{ github.sha }}"
+        run: |
+          . .venv/bin/activate
+          python3 -m devx.ci.post_merge --git-sha "${{ github.sha }}"
      - name: Notify on failure
        if: failure()
        env:
@@ -220,9 +247,6 @@ jobs:
          PYTHONPATH: src
        run: |
          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.tools.install_tools --tool tea
-          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
-          tea login default devx || true
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
@@ -236,15 +260,15 @@ jobs:
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
-      - name: Install dependencies
-        run: |
-          python3 -m pip install --break-system-packages requests python-dotenv click
-          python3 -m pip install --break-system-packages -e .
+      - name: Set up environment
+        run: make setup-ci
      - name: Ensure branch protection and labels
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
-        run: python3 -m devx.tools.configure_repo --repo devx --owner oblachno-oss
+        run: |
+          . .venv/bin/activate
+          python3 -m devx.tools.configure_repo --repo devx --owner oblachno-oss
      - name: Notify on failure
        if: failure()
        env:
@@ -252,9 +276,6 @@ jobs:
          PYTHONPATH: src
        run: |
          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.tools.install_tools --tool tea
-          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
-          tea login default devx || true
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
@@ -1,55 +0,0 @@
-name: Publish Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to publish (e.g. v0.9.11)'
-        required: true
-        type: string
-
-jobs:
-  publish:
-    runs-on: docker
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Install dependencies
-        run: |
-          python3 -m pip install --break-system-packages build twine requests python-dotenv click
-          python3 -m pip install --break-system-packages -e .
-      - name: Install CI tools
-        run: |
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.tools.install_tools --tool git-cliff --tool tea
-      - name: Configure tea login
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: |
-          export PATH="$HOME/.local/bin:$PATH"
-          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
-          tea login default devx || true
-      - name: Build and publish release
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.publish "${{ github.event.inputs.tag || github.ref_name }}" "${{ github.repository }}"
-      - name: Notify on failure
-        if: failure()
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "publish" \
-            --commit "${{ github.sha }}"
@@ -57,6 +57,7 @@ src/devx/
 │   ├── release.py       # Automated versioning, tagging, changelog
 │   ├── publish.py       # Build and publish to Gitea PyPI registry (--skip-build for non-Python repos)
 │   ├── auto_merge.py    # Squash-merge PRs with task ID validation
+│   ├── check_auto_merge_ready.py  # Pre-merge validation gate (branch, PR title, Vikunja, behind-master)
 │   ├── _shared.py      # Shared utilities (get_latest_tag)
 │   ├── classify_changes.py  # User-facing vs workflow-only change detection
 │   ├── detect_release_commit.py  # Detect release commits on master
@@ -66,7 +67,7 @@ src/devx/
 │   ├── sync_wiki.py     # Sync documentation to Gitea wiki
 │   ├── push_badges.py   # Generate and push quality badges (--retries for retry on git push failures)
 │   ├── notify_failure.py    # Create Gitea issues on CI failures (--auto-login)
-│   ├── distribute_files.py  # Distribute files across parallel runners
+│   ├── distribute_files.py  # Distribute files across parallel runners (LPT scheduling)
 │   ├── integration_guard.py # Run pytest with cross-runner fail-fast
 │   ├── check_translations.py  # Translation completeness check
 │   └── doc_coverage.py  # Documentation coverage check
@@ -74,12 +75,16 @@ src/devx/
 │   ├── setup.py         # Environment setup (venv, deps, hooks)
 │   ├── install_tools.py # Install actionlint, git-cliff, act_runner, tea
 │   ├── check_test_speed.py  # Measure unit test execution time
+│   ├── check_mutable_globals.py  # Detect module-level mutable globals (test isolation bugs)
+│   ├── check_pyproject_deps.py   # Validate pyproject.toml deps have documentation comments
+│   ├── check_test_coverage.py    # Ensure changed files have corresponding tests (configurable rules)
+│   ├── check_agent_docs.py       # Validate docs for stale file references (configurable patterns)
 │   ├── configure_repo.py    # Branch protection and label setup
 │   └── generate_badges.py   # Badge SVG generation
 ├── opentofu.py          # OpenTofu output helpers (get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field)
 └── molecule/            # Optional molecule testing helpers (for Ansible projects)
    ├── discover_runners.py    # Dynamic Gitea runner discovery
-    ├── distribute_molecule.py # Distribute molecule scenarios across runners (--roles-root for multi-role)
+    ├── distribute_molecule.py # Distribute molecule scenarios across runners (LPT scheduling, --roles-root for multi-role)
    ├── molecule_ci_guard.py   # Run molecule with cross-runner fail-fast (--roles-root)
    ├── molecule_all.py        # Run all molecule scenarios locally
    └── platforms.py           # Supported molecule platforms
@@ -162,7 +167,7 @@ the PR. Then add the `ready-to-merge` label. The auto-merge workflow will:
 1. **Validate** PR title format (`DEVX-N: <vikunja task title>`) and match against Vikunja task title
 2. **Check** that at least one substantive APPROVE review exists
 3. Wait for all CI checks to pass (including the `pr-review` job)
-4. Squash-merge with title: `DEVX-N <conventional commit message>` (space-separated, no colon after DEVX-N)
+4. Squash-merge with title: `DEVX-N: <conventional commit message>`
 5. The post-merge workflow marks the Vikunja task as done
 6. The release workflow automatically versions, tags, and publishes

@@ -176,7 +181,7 @@ After a PR is merged to master, the **post-merge workflow**

 1. **detect-type** — Checks if the commit is a regular merge or a
   release commit (`release: vX.Y.Z`). All subsequent jobs skip for
-   release commits.
+   release commits (except badges).

 2. **release** — Runs `python -m devx.ci.release` which:
   - Checks for user-facing changes via `python -m devx.ci.classify_changes`
@@ -188,14 +193,20 @@ After a PR is merged to master, the **post-merge workflow**
   - Creates an annotated tag `vX.Y.Z` on the release commit
   - Pushes both the commit and tag to master

-3. **sync-wiki** — Syncs documentation to the Gitea wiki.
+3. **sync-wiki** — Syncs documentation to the Gitea wiki. Runs for ALL
+   non-release commits (not just when release succeeds), so docs-only
+   changes still update the wiki.

 4. **badges** — Generates and pushes quality badge SVGs to the `badges` branch.
+   Uses `if: always()` so it runs on every push, including release commits.

-5. **vikunja** — Marks the corresponding Vikunja task as done.
+5. **vikunja** — Marks the corresponding Vikunja task as done. Runs for ALL
+   non-release commits (not just when release succeeds), so infrastructure-only
+   changes still update the task tracker.

-The tag push triggers the **publish workflow** (`.gitea/workflows/publish.yml`)
-which builds and publishes the package to the Gitea PyPI registry.
+6. **publish** — Runs after release succeeds (needs: release). Builds and
+   publishes the package to the Gitea PyPI registry. Gets the tag from the
+   release job's `tag` output (written via `GITHUB_OUTPUT`).

 ### Smart CI: User-Facing vs Workflow-Only Changes

@@ -259,7 +270,7 @@ by `python -m devx.tools.install_tools` and configured by

 ### git-cliff Commit Preprocessing

-Merge commits on master have the format `DEVX-N <conventional commit>`. The
+Merge commits on master have the format `DEVX-N: <conventional commit>`. The
 `cliff.toml` includes a `commit_preprocessors` entry that strips the `DEVX-N `
 prefix before parsing. This ensures all merged work appears in the changelog.

@@ -282,7 +293,7 @@ setuptools via `dynamic = ["version"]` in `pyproject.toml`.
 | Branch name | `DEVX-N-short-description` | `DEVX-12-add-release-script` |
 | Branch commits | `<conventional commit>` | `feat: add release script` |
 | PR title | `DEVX-N: <vikunja task title>` | `DEVX-12: Add release automation` |
-| Merge commit | `DEVX-N <conventional commit>` | `DEVX-12 feat: add release script` |
+| Merge commit | `DEVX-N: <conventional commit>` | `DEVX-12: feat: add release script` |

 ### Task ID Resolution

@@ -310,6 +321,25 @@ auto-merge:
    (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
 ```

+### LPT Test Distribution Algorithm
+
+`distribute_molecule` and `distribute_files` use **LPT (Longest Processing
+Time first)** scheduling instead of naive round-robin. This produces a more
+balanced distribution when test items have varying costs:
+
+1. **Weight estimation**: Each item is assigned a weight:
+   - Molecule scenarios: heuristic by name (`nextcloud`=10, `gitea`=8,
+     `binary`=2, default=3). See `_SCENARIO_WEIGHTS` in
+     `distribute_molecule.py`.
+   - Integration test files: weight by file size in bytes (as a proxy
+     for test runtime).
+2. **LPT assignment**: Items are sorted by weight (descending), then
+   each is assigned to the runner with the least total weight.
+
+This ensures heavy scenarios (e.g. `nextcloud`) are spread across
+different runners rather than clustered on one, reducing the
+longest-runner time from ~16 min to ~11 min with 6 runners.
+
 ## Config System

 devx uses environment variables with `.env` file fallback for configuration.
@@ -334,6 +364,90 @@ Projects using devx can override the default API URLs and language by setting
 `DEVX_*` environment variables or entries in their `.env` file. The config
 system loads `.env` automatically via `python-dotenv`.

+### pyproject.toml [tool.devx] Configuration
+
+In addition to `DEVX_` env vars, several devx tools read configuration from
+the `[tool.devx]` section in `pyproject.toml`. This allows per-project
+customization without environment variables.
+
+**Base config** (`[tool.devx]`):
+- `task_prefix` — Task ID prefix (e.g. `"DEVX"`, `"GRM"`, `"OBL-INFRA"`)
+- `vikunja_project_id` — Vikunja project ID
+- `repo_owner` / `repo_name` — Gitea repository coordinates
+- `gitea_api_url` / `vikunja_api_url` — API endpoints
+
+**Tool-specific config**:
+- `[tool.devx.check_mutable_globals]` — `scan_dirs`, `skip_dirs`, `known_safe`
+- `[tool.devx.check_test_coverage]` — `rules` (source_pattern → test_paths mapping), `skip_patterns`
+- `[tool.devx.check_agent_docs]` — `scan_dirs`, `deleted_files`, `deprecated_patterns`, `legitimate_indicators`
+
+## devx.mak — Shared Makefile Fragment
+
+`devx.mak` provides common Makefile targets that projects can include
+via `-include $(DEVX_MAK)`. This eliminates Makefile duplication across
+projects.
+
+**Available targets** (all prefixed with `devx-`):
+
+| Target | Purpose |
+|--------|---------|
+| `devx-create-task` | Create a Vikunja task |
+| `devx-create-pr` | Create a PR with auto-derived title |
+| `devx-push` | Push current branch to origin |
+| `devx-push-with-pr` | Push and create PR in one step |
+| `devx-check-config` | Validate devx configuration |
+| `devx-configure-gitea-pypi` | Configure Gitea private PyPI registry |
+| `devx-env` | Create .env from .env.example |
+| `devx-venv` | Create Python venv with version check |
+| `devx-activate-scripts` | Create shell/fish/zsh activate scripts |
+| `devx-install-hooks` | Set git hooks path to hooks/ |
+| `devx-install-tools` | Install actionlint, git-cliff, act_runner, tea |
+| `devx-install-checkmake` | Install checkmake (Makefile linter) |
+| `devx-checkmake` | Lint Makefiles with checkmake |
+| `devx-workflow-lint` | Static lint of Gitea Actions YAML (actionlint) |
+| `devx-workflow-dryrun` | Dry-run all workflows (act_runner) |
+| `devx-workflow-dryrun-safe` | Best-effort dry-run (skips if act_runner missing) |
+| `devx-workflow-check` | Static lint + dry-run |
+| `devx-notify-failure` | Create Gitea issue on CI failure |
+| `devx-lint-ruff` | Run ruff check |
+| `devx-lint-format` | Run ruff format --check |
+| `devx-typecheck` | Run pyright |
+| `devx-lint-bandit` | Run bandit security scan |
+| `devx-lint-deps` | Check dependencies for vulnerabilities (pip-audit) |
+| `devx-lint` | Run all lint targets |
+| `devx-test-unit` | Run unit tests without coverage |
+| `devx-pytest-cov` | Run pytest with coverage enforcement |
+| `devx-check-mutable-globals` | Scan for mutable path globals |
+| `devx-check-dep-docs` | Validate pyproject.toml deps are documented |
+| `devx-check-test-coverage` | Check changed files have corresponding tests |
+| `devx-check-docs` | Validate docs for stale references |
+| `devx-check-test-speed` | Verify test suite timing |
+| `devx-pre-push` | Run lint + tests before push |
+| `devx-clean` | Remove caches, build artifacts, coverage data |
+
+**Variables** (set BEFORE including devx.mak):
+- `DEVX_PYTHON` — Python executable (default: `python3`)
+- `DEVX_VENV` — venv directory (default: `.venv`)
+- `DEVX_BIN` — venv bin directory (default: `$(DEVX_VENV)/bin`)
+- `DEVX_LINT_PATHS` — paths for ruff/bandit (default: `src/ tests/`)
+- `DEVX_COV_PKG` — coverage package (default: `src/devx`)
+- `DEVX_TEST_PATHS` — pytest paths (default: `tests/`)
+- `DEVX_PR_BASE` — PR base branch (default: `master`)
+
+**Usage in project Makefile**:
+```makefile
+DEVX_PYTHON := $(BIN)/python
+DEVX_MAK := $(shell $(BIN)/python -c \
+    "from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
+    2>/dev/null)
+-include $(DEVX_MAK)
+
+# Aliases for project-specific names
+lint-ruff: devx-lint-ruff
+workflow-lint: devx-workflow-lint
+create-task: devx-create-task
+```
+
 ## Key Conventions

 - Python 3.12+ required (ruff/pyright target `py312`)
@@ -2,6 +2,79 @@

 All notable changes to this project will be documented in this file.

+## [0.19.2] - 2026-06-26
+
+### Bug Fixes
+
+- Calibrate molecule weights from actual CI execution times
+
+## [0.19.1] - 2026-06-26
+
+### Refactor
+
+- Consolidate publish.yml into post-merge.yml
+
+## [0.19.0] - 2026-06-26
+
+### Features
+
+- Add skip_ref_prefixes config to check_agent_docs
+
+## [0.18.0] - 2026-06-26
+
+### Features
+
+- Extract generic tools into devx, expand devx.mak, remove personal references
+
+## [0.17.0] - 2026-06-26
+
+### Features
+
+- Weighted LPT distribution, workflow fixes, decouple vikunja/sync-wiki from release
+
+## [0.16.0] - 2026-06-26
+
+### Features
+
+- Single-source-of-truth config via [tool.devx] in pyproject.toml
+
+## [0.15.0] - 2026-06-26
+
+### Features
+
+- Add create-task, create-pr, pre-push-check tools and devx.mak fragment
+
+## [0.14.2] - 2026-06-26
+
+### Bug Fixes
+
+- Make repo arg optional in publish CLI, auto-detect from GITHUB_REPOSITORY
+
+## [0.14.1] - 2026-06-25
+
+### Bug Fixes
+
+- Handle 'already a release' error idempotently in publish
+
+## [0.14.0] - 2026-06-25
+
+### Features
+
+- Add FORCE_DEPLOY env var, --git flag, --from-tag flag
+
+## [0.13.0] - 2026-06-25
+
+### Features
+
+- Add --force flag to classify_changes, fix api_clients coverage
+
+### Bug Fixes
+
+- Squash-merge format uses space not colon after task ID
+- Revert squash-merge format to use colon after task ID
+
+## [0.1.0] - 2026-06-25
+
 ## [0.12.5] - 2026-06-25

 ### Bug Fixes
@@ -208,8 +208,8 @@ If you develop a new program, and you want it to be of the greatest possible use

 To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.

-     grm
-     Copyright (C) 2026  emil
+     devx
+     Copyright (C) 2026  oblachno-oss

     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

@@ -221,7 +221,7 @@ Also add information on how to contact you by electronic and paper mail.

 If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:

-     grm  Copyright (C) 2026  emil
+     devx  Copyright (C) 2026  oblachno-oss
     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.

@@ -1,4 +1,4 @@
-.PHONY: all setup setup-ci setup-quality setup-release install update lint lint-ruff lint-format typecheck lint-bandit lint-deps lint-all test test-unit pytest-cov clean workflow-lint workflow-dryrun workflow-check install-tools install-hooks activate-scripts
+.PHONY: all setup setup-ci setup-quality setup-release install update lint lint-all test test-unit pytest-cov clean install-tools install-hooks activate-scripts checkmake check-mutable-globals check-dep-docs check-test-speed

 PYTHON := python3
 VENV := .venv
@@ -52,48 +52,56 @@ install-tools: $(VENV)/bin/activate
 	@$(BIN)/pip install -e '.' 2>/dev/null; \
 	$(BIN)/python -m devx.tools.install_tools

-lint-ruff:
-	$(BIN)/ruff check src/ tests/
+# --- devx.mak integration ----------------------------------------------------
+# Include shared targets from the devx package itself (workflow-lint,
+# notify-failure, checkmake, lint targets, quality checks, etc.)
+# Since devx IS the package, we can include its own devx.mak.
+DEVX_PYTHON := $(BIN)/python
+DEVX_VENV := $(VENV)
+DEVX_BIN := $(BIN)
+DEVX_LINT_PATHS := src/ tests/
+DEVX_COV_PKG := src/devx
+DEVX_TEST_PATHS := tests/

-lint-format:
-	$(BIN)/ruff format --check src/ tests/
+DEVX_MAK := $(shell $(BIN)/python -c \
+	"from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
+	2>/dev/null)
+-include $(DEVX_MAK)

-typecheck:
-	$(BIN)/pyright
-
-lint-bandit:
-	$(BIN)/bandit -r src/
-
-lint: lint-ruff lint-format typecheck lint-bandit
-
-lint-deps:
-	@echo "Checking dependencies for known vulnerabilities..."
-	@.venv/bin/python -m ensurepip 2>/dev/null || true
-	@PIPAPI_PYTHON_LOCATION=$$(pwd)/.venv/bin/python .venv/bin/pip-audit --desc --skip-editable 2>&1 || true
+# Aliases — project-specific names map to devx.mak targets
+lint-ruff: devx-lint-ruff
+lint-format: devx-lint-format
+typecheck: devx-typecheck
+lint-bandit: devx-lint-bandit
+lint-deps: devx-lint-deps
+lint: devx-lint
+workflow-lint: devx-workflow-lint
+workflow-dryrun: devx-workflow-dryrun
+workflow-dryrun-safe: devx-workflow-dryrun-safe
+workflow-check: devx-workflow-check
+notify-failure: devx-notify-failure
+checkmake: devx-checkmake
+check-mutable-globals: devx-check-mutable-globals
+check-dep-docs: devx-check-dep-docs
+check-test-speed: devx-check-test-speed
+check-test-coverage: devx-check-test-coverage
+check-docs: devx-check-docs
+create-task: devx-create-task
+create-pr: devx-create-pr
+push-with-pr: devx-push-with-pr
+git-push: devx-push

 lint-all: lint workflow-lint
+	@echo "[lint-all] All linting checks passed."

-workflow-lint:
-	@command -v actionlint >/dev/null 2>&1 || { echo "actionlint not found."; exit 1; }
-	actionlint -config-file .gitea/actionlint.yaml .gitea/workflows/*.yml
+test-unit: devx-test-unit

-workflow-dryrun:
-	@command -v act_runner >/dev/null 2>&1 || { echo "act_runner not found."; exit 1; }
-	@echo "Dry-running all workflows..."
-	act_runner exec --dryrun -W .gitea/workflows/ 2>&1 | grep -E 'DRYRUN|ERROR|FAIL|Job'
-
-workflow-check: workflow-lint workflow-dryrun
-	@echo "Workflow checks passed."
-
-test-unit:
-	$(BIN)/pytest tests/unit/ -v --no-cov
-
-pytest-cov:
-	$(BIN)/pytest tests/ -v --cov=src/devx --cov-report=term-missing --cov-fail-under=100
+pytest-cov: devx-pytest-cov

 test: pytest-cov

-clean:
-	find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
-	find . -type f -name "*.pyc" -delete 2>/dev/null || true
-	rm -rf .coverage htmlcov/ dist/ build/ *.egg-info/
+pre-push: lint-all pytest-cov
+	@echo "[pre-push] All checks passed. Proceeding with push."
+
+clean: devx-clean
+	@echo "[clean] Done."
@@ -16,12 +16,12 @@ quality badges.

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/python.svg)](https://www.python.org/downloads/)

 ## Why devx?

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/e5e2b54bedcdce18170519b13b8f4305d7d53722/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/0ab8d43a57cbaf69c93d28df9e2ac5630da4148a/python.svg)](https://www.python.org/downloads/)

 ## Overview

@@ -59,7 +59,7 @@ dev = [
 where = ["src"]

 [tool.setuptools.package-data]
-devx = ["translations.json"]
+devx = ["translations.json", "make/*.mak"]

 [tool.pytest.ini_options]
 testpaths = ["tests"]
@@ -96,6 +96,13 @@ strict = ["src/devx/config.py", "src/devx/exceptions.py", "src/devx/i18n.py", "s
 # Rule priority (first match wins):
 #   1. user_facing_overrides (safety — highest priority)
 #   2. infrastructure_overrides (explicit per-file)
+# Project-specific devx configuration (read by devx.config)
+[tool.devx]
+task_prefix = "DEVX"
+vikunja_project_id = 8
+repo_owner = "oblachno-oss"
+repo_name = "devx"
+
 #   3. infrastructure (DEFAULT_INFRASTRUCTURE + project-specific patterns)
 #   4. Default: user-facing (safe)
 [tool.devx.classify]
@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""

-__version__ = "0.12.5"
+__version__ = "0.19.2"
@@ -192,6 +192,32 @@ class GiteaClient:
        r = self._request("GET", f"/pulls/{pr_number}")
        return r.json()

+    def create_pr(self, title: str, head: str, base: str = "master", body: str = "") -> dict[str, Any]:
+        """Create a pull request and return the PR dict.
+
+        Args:
+            title: PR title.
+            head: Head branch name.
+            base: Base branch name (default: master).
+            body: PR description (markdown).
+        """
+        payload: dict[str, Any] = {"title": title, "head": head, "base": base}
+        if body:
+            payload["body"] = body
+        r = self._request("POST", "/pulls", json=payload)
+        return r.json()
+
+    def list_prs(self, state: str = "all", **params: Any) -> list[dict[str, Any]]:
+        """List pull requests, optionally filtered by state.
+
+        Args:
+            state: ``open``, ``closed``, ``all`` (default).
+            **params: Additional query params (e.g. ``q="keyword"`` for title search).
+        """
+        params.setdefault("state", state)
+        r = self._request("GET", "/pulls", params=params)
+        return r.json()
+
    def get_pr_files(self, pr_number: str | int) -> list[dict[str, Any]]:
        """Fetch the list of files changed in a pull request."""
        r = self._request("GET", f"/pulls/{pr_number}/files")
@@ -342,8 +368,46 @@ class VikunjaClient:
        r = self._request("GET", f"/projects/{project_id}/tasks", params=params)
        return r.json()

+    def create_task(self, project_id: int, title: str, description: str = "") -> dict[str, Any]:
+        """Create a task in a project and return the created task dict.
+
+        Args:
+            project_id: Target Vikunja project ID.
+            title: Task title (required, non-empty).
+            description: Task description (HTML supported, optional).
+        """
+        r = self._request(
+            "PUT",
+            f"/projects/{project_id}/tasks",
+            json={"title": title, "description": description},
+        )
+        return r.json()
+
    def post_comment(self, task_id: int, comment: str) -> None:
        self._request("PUT", f"/tasks/{task_id}/comments", json={"comment": comment})

+    def list_comments(self, task_id: int) -> list[dict[str, Any]]:
+        """List all comments on a task."""
+        r = self._request("GET", f"/tasks/{task_id}/comments")
+        return r.json()
+
    def update_task(self, task_id: int, **fields: Any) -> None:
+        """Update task fields via POST (full replacement semantics).
+
+        Warning: Vikunja's POST /tasks/{id} replaces the entire task body.
+        Unspecified fields are reset to their type defaults. Use
+        ``update_task_safe`` to preserve existing fields.
+        """
        self._request("POST", f"/tasks/{task_id}", json=fields)
+
+    def update_task_safe(self, task_id: int, **fields: Any) -> dict[str, Any]:
+        """Safely update task fields using read-merge-write pattern.
+
+        Fetches the full task body, merges the provided fields on top,
+        and POSTs the complete body back. This prevents accidental
+        resets of done status, title, etc.
+        """
+        task = self.get_task(task_id)
+        task.update(fields)
+        r = self._request("POST", f"/tasks/{task_id}", json=task)
+        return r.json()
@@ -0,0 +1,267 @@
+#!/usr/bin/env python3
+"""Pre-merge validation gate for auto-merge preconditions.
+
+Validates that a PR satisfies auto-merge requirements BEFORE expensive
+jobs (molecule tests, staging deploy) run.  This catches issues early:
+
+1. Branch name contains a task ID (e.g., ``DEVX-256-fix-foo``).
+2. PR title follows ``{PREFIX}-N: <title>`` format.
+3. PR title task ID matches the branch task ID.
+4. PR title matches the Vikunja task title (requires ``VIKUNJA_TOKEN``).
+5. Branch is not behind master (would trigger a rebase retry cycle).
+
+Exit code 0 = ready for auto-merge (preconditions satisfied).
+Exit code 1 = NOT ready — fix issues before pushing.
+
+Usage::
+
+  # CI (with VIKUNJA_TOKEN and REPO_TOKEN):
+  python3 -m devx.ci.check_auto_merge_ready \\
+      --branch "$HEAD_REF" \\
+      --pr-title "$PR_TITLE" \\
+      --repo "$REPOSITORY" \\
+      --pr-number "$PR_NUMBER"
+
+  # Local (pre-push hook, no PR yet — validates branch + title format only):
+  python3 -m devx.ci.check_auto_merge_ready --branch "$(git rev-parse --abbrev-ref HEAD)"
+
+  # Local (with PR number, fetches title from Gitea):
+  python3 -m devx.ci.check_auto_merge_ready --branch "$(git rev-parse --abbrev-ref HEAD)" \\
+      --repo owner/repo --pr-number 123
+
+If ``VIKUNJA_TOKEN`` is not set, the Vikunja title match check is
+skipped (with a warning) — this allows local pre-push hooks to run
+without CI secrets.  In CI, the token is always set and the check is
+mandatory.
+
+If ``REPO_TOKEN`` is not set and ``--pr-number`` is not provided, only
+branch-name and PR-title-format checks run (local mode).
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess  # nosec B404
+
+import click
+from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
+
+from devx.api_clients import GiteaClient, VikunjaClient
+from devx.ci.auto_merge import extract_task_id
+from devx.config import (
+    GITEA_API_URL,
+    VIKUNJA_API_URL,
+    VIKUNJA_PROJECT_ID,
+)
+from devx.i18n import _
+
+load_dotenv()
+
+
+def is_branch_behind_master(branch: str) -> bool:
+    """Check if the local branch is behind origin/master.
+
+    Fetches origin first (best-effort) then compares commit counts.
+    Returns ``True`` if master has commits not in branch.
+    """
+    try:
+        subprocess.run(  # nosec B603, B607
+            ["git", "fetch", "origin", "master", "--quiet"],
+            check=False,
+            capture_output=True,
+            timeout=30,
+        )
+        result = subprocess.run(  # nosec B603, B607
+            ["git", "rev-list", "--count", f"origin/master..{branch}"],
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=10,
+        )
+        if result.returncode != 0:
+            return False  # Can't determine — don't block
+        result = subprocess.run(  # nosec B603, B607
+            ["git", "rev-list", "--count", f"{branch}..origin/master"],
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=10,
+        )
+        if result.returncode != 0:
+            return False
+        behind = int(result.stdout.strip() or "0")
+    except (subprocess.TimeoutExpired, FileNotFoundError, ValueError):
+        return False  # Don't block on git errors
+    return behind > 0
+
+
+def get_pr_title_from_gitea(repo: str, pr_number: int) -> str | None:
+    """Fetch the PR title from the Gitea API.
+
+    Returns ``None`` if ``REPO_TOKEN`` is not set or the PR cannot be fetched.
+    """
+    token = os.environ.get("REPO_TOKEN", "")
+    if not token or "/" not in repo:
+        return None
+    owner, repo_name = repo.split("/", 1)
+    client = GiteaClient(GITEA_API_URL, token, owner, repo_name)
+    try:
+        pr = client.get_pr(pr_number)
+        return str(pr.get("title", ""))
+    except Exception:
+        return None
+
+
+def get_vikunja_title_optional(task_id: str) -> str | None:
+    """Fetch the Vikunja task title, returning None if token is not set.
+
+    Unlike :func:`devx.ci.auto_merge.get_vikunja_task_title`, this does NOT
+    raise when ``VIKUNJA_TOKEN`` is missing — it returns ``None`` so the
+    caller can skip the check in local mode.
+    """
+    token = os.environ.get("VIKUNJA_TOKEN", "")
+    if not token:
+        return None
+    client = VikunjaClient(VIKUNJA_API_URL, token)
+    from devx.config import DEFAULT_PER_PAGE
+
+    page = 1
+    while True:
+        tasks = client.list_project_tasks(VIKUNJA_PROJECT_ID, page=page, per_page=DEFAULT_PER_PAGE)
+        if not tasks:
+            break
+        matches = [t for t in tasks if t.get("identifier") == task_id]
+        if matches:
+            return str(matches[0].get("title", ""))
+        if len(tasks) < DEFAULT_PER_PAGE:
+            break
+        page += 1
+    return None
+
+
+@click.command()
+@click.option("--branch", required=True, help=_("Branch name (e.g., DEVX-256-fix-foo)"))
+@click.option("--pr-title", default=None, help=_("PR title (auto-fetched if --pr-number given)"))
+@click.option("--repo", default=None, help=_("Repository in owner/name format"))
+@click.option("--pr-number", type=int, default=None, help=_("PR number (to fetch title from Gitea)"))
+@click.option("--skip-vikunja", is_flag=True, help=_("Skip Vikunja title match check"))
+@click.option("--skip-behind-check", is_flag=True, help=_("Skip branch-behind-master check"))
+def cli(
+    branch: str,
+    pr_title: str | None,
+    repo: str | None,
+    pr_number: int | None,
+    skip_vikunja: bool,
+    skip_behind_check: bool,
+) -> None:
+    """Validate auto-merge preconditions before expensive CI jobs."""
+    import re
+
+    from devx.config import TASK_PREFIX
+
+    pr_title_re = re.compile(rf"^{TASK_PREFIX}-\d+:\s+.+")  # noqa: PLW1503
+
+    errors: list[str] = []
+
+    # 1. Branch task ID
+    task_id = extract_task_id(branch)
+    if not task_id:
+        errors.append(
+            _(
+                "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
+                branch=branch,
+                prefix=TASK_PREFIX,
+            ),
+        )
+        # Can't continue — no task ID to validate against
+        for e in errors:
+            click.echo(f"ERROR: {e}", err=True)
+        raise click.ClickException(_("Branch name must contain a task ID."))
+
+    click.echo(f"[pre-merge-check] Task ID: {task_id}")
+
+    # 2. Resolve PR title
+    if pr_title is None and pr_number is not None and repo is not None:
+        pr_title = get_pr_title_from_gitea(repo, pr_number)
+        if pr_title:
+            click.echo(f"[pre-merge-check] PR title (from Gitea): {pr_title}")
+
+    if pr_title is None:
+        # Local mode without PR — only validate branch name
+        if pr_number is not None:
+            raise click.ClickException(_("Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found)."))
+        click.echo("[pre-merge-check] No PR title provided — running branch-name-only check (local mode).")
+        click.echo("[pre-merge-check] Branch name OK. Push to create PR, then CI will validate the title.")
+        return
+
+    # 3. PR title format
+    if not pr_title_re.match(pr_title):
+        errors.append(
+            _(
+                "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
+                prefix=TASK_PREFIX,
+                title=pr_title,
+            ),
+        )
+
+    # 4. PR title task ID matches branch task ID
+    if not pr_title.startswith(f"{task_id}:"):
+        errors.append(
+            _(
+                "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
+                task_id=task_id,
+                title=pr_title,
+            ),
+        )
+
+    # 5. Vikunja task title match (skip if no token or --skip-vikunja)
+    if not skip_vikunja:
+        vikunja_title = get_vikunja_title_optional(task_id)
+        if vikunja_title is None:
+            token_set = bool(os.environ.get("VIKUNJA_TOKEN", ""))
+            if token_set:
+                errors.append(
+                    _(
+                        "Could not find Vikunja task {task_id} in project {project_id}.",
+                        task_id=task_id,
+                        project_id=VIKUNJA_PROJECT_ID,
+                    ),
+                )
+            else:
+                click.echo("[pre-merge-check] WARNING: VIKUNJA_TOKEN not set — skipping Vikunja title match check.")
+        else:
+            expected = f"{task_id}: {vikunja_title}"
+            if pr_title != expected:
+                errors.append(
+                    _(
+                        "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
+                        expected=expected,
+                        title=pr_title,
+                    ),
+                )
+            else:
+                click.echo(f"[pre-merge-check] Vikunja title match OK: {expected}")
+
+    # 6. Branch behind master (skip if --skip-behind-check)
+    if not skip_behind_check:
+        if is_branch_behind_master(branch):
+            errors.append(
+                _("Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master")
+            )
+        else:
+            click.echo("[pre-merge-check] Branch is up-to-date with origin/master.")
+
+    if errors:
+        click.echo("", err=True)
+        click.echo("=" * 60, err=True)
+        click.echo("Pre-merge validation FAILED — fix these before pushing:", err=True)
+        click.echo("=" * 60, err=True)
+        for e in errors:
+            click.echo(f"  - {e}", err=True)
+        raise click.ClickException(_("Pre-merge validation failed."))
+
+    click.echo("[pre-merge-check] All auto-merge preconditions satisfied.")
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -615,11 +615,29 @@ def _write_github_output(key: str, value: str) -> None:
    help="Write results to $GITHUB_OUTPUT file (for CI workflow steps). "
    "Outputs 'user-facing-changed' and '<tag>-changed' for each configured tag.",
 )
-def main(base: str | None, head: str, quiet: bool, check: str, github_output: bool) -> None:
+@click.option(
+    "--force",
+    is_flag=True,
+    default=False,
+    help="Force user-facing-changed=true regardless of actual changes. "
+    "Used by workflow_dispatch with force-deploy input.",
+)
+def main(base: str | None, head: str, quiet: bool, check: str, github_output: bool, force: bool) -> None:
    """Classify git changes and output results."""
    classifier = _get_classifier()
    available_tags = list(classifier.config.tags.keys())

+    # --force can also be activated via FORCE_DEPLOY env var (for workflow_dispatch)
+    if os.environ.get("FORCE_DEPLOY", "").lower() == "true":
+        force = True
+
+    if force and github_output:
+        _write_github_output("user-facing-changed", "true")
+        for tag in available_tags:
+            _write_github_output(f"{tag}-changed", "true")
+        click.echo("Forced user-facing-changed=true via --force flag.")
+        return
+
    if base is None:
        base = get_latest_tag()
        if not base:
@@ -1,10 +1,14 @@
 #!/usr/bin/env python3
-"""Distribute a list of files across N parallel runners (round-robin).
+"""Distribute a list of files across N parallel runners using LPT scheduling.

 Generic file-based test distribution for CI matrix jobs. Discovers files
 matching a glob pattern, sorts them for deterministic ordering, then
-assigns them round-robin to *max_runners* groups. The assigned group for
-*runner_index* is written to ``$GITHUB_ENV`` for use by subsequent steps.
+assigns them to *max_runners* groups using LPT (Longest Processing Time
+first) scheduling — files are weighted by size (as a proxy for test
+runtime) and assigned to the runner with the least total weight.
+
+The assigned group for *runner_index* is written to ``$GITHUB_ENV`` for
+use by subsequent steps.

 Usage::

@@ -32,11 +36,32 @@ def discover_files(pattern: str) -> list[str]:
    return sorted(glob.glob(pattern))


+def _file_weight(path: str) -> int:
+    """Estimate a weight for a file based on its size in bytes.
+
+    Falls back to 1 if the file cannot be stat'd (e.g. in tests).
+    """
+    try:
+        return max(1, os.path.getsize(path))
+    except OSError:
+        return 1
+
+
 def distribute(files: list[str], max_runners: int) -> list[list[str]]:
-    """Split *files* into *max_runners* balanced groups (round-robin)."""
+    """Split *files* into *max_runners* balanced groups using LPT scheduling.
+
+    Files are weighted by size (as a proxy for runtime) and assigned to
+    the runner with the least total weight.
+    """
+    weights = [_file_weight(f) for f in files]
    groups: list[list[str]] = [[] for _ in range(max_runners)]
-    for i, f in enumerate(files):
-        groups[i % max_runners].append(f)
+    loads = [0] * max_runners
+    # Sort by weight descending, preserving original order for ties
+    indexed = sorted(enumerate(files), key=lambda x: (-weights[x[0]], x[0]))
+    for orig_idx, f in indexed:
+        min_runner = min(range(max_runners), key=lambda r: loads[r])
+        groups[min_runner].append(f)
+        loads[min_runner] += weights[orig_idx]
    return groups


@@ -169,9 +169,37 @@ def _default_gitea_registry_url() -> str:
    return f"{base}/api/packages/{owner}/pypi"


+def get_latest_tag() -> str | None:
+    """Get the latest git tag, or None if no tags exist."""
+    try:
+        result = subprocess.run(  # nosec
+            ["git", "describe", "--tags", "--abbrev=0"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return result.stdout.strip()
+    except subprocess.CalledProcessError:
+        return None
+
+
+def is_release_commit(tag: str) -> bool:
+    """Check if HEAD commit message starts with 'release: <tag>'."""
+    try:
+        result = subprocess.run(  # nosec
+            ["git", "log", "-1", "--format=%s"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return result.stdout.strip().startswith(f"release: {tag}")
+    except subprocess.CalledProcessError:
+        return False
+
+
@click.command()
-@click.argument("tag")
-@click.argument("repo")
+@click.argument("tag", required=False)
+@click.argument("repo", required=False)
@click.option(
    "--registry-url",
    default=None,
@@ -186,7 +214,37 @@ def _default_gitea_registry_url() -> str:
    help="Skip package build and PyPI publish (for non-Python repos that only "
    "need a Gitea release with git-cliff notes).",
 )
-def main(tag: str, repo: str, registry_url: str | None, skip_build: bool) -> None:
+@click.option(
+    "--from-tag",
+    is_flag=True,
+    default=False,
+    help="Auto-detect latest tag and check if HEAD is a release commit. "
+    "Skips publish if no tag or HEAD is not a release commit for that tag.",
+)
+def main(
+    tag: str | None,
+    repo: str | None,
+    registry_url: str | None,
+    skip_build: bool,
+    from_tag: bool,
+) -> None:
+    if repo is None:
+        repo = os.environ.get("GITHUB_REPOSITORY", "")
+    if not repo:
+        raise click.ClickException(_("REPO argument is required (or set GITHUB_REPOSITORY env var)."))
+    if from_tag:
+        detected_tag = get_latest_tag()
+        if not detected_tag:
+            click.echo(_("No tag found — skipping publish."))
+            return
+        if not is_release_commit(detected_tag):
+            click.echo(_("HEAD is not a release commit for {tag} — skipping publish.", tag=detected_tag))
+            return
+        tag = detected_tag
+        click.echo(_("Publishing release {tag}...", tag=tag))
+
+    if not tag:
+        raise click.ClickException(_("Tag is required (or use --from-tag)."))
    gitea_token = os.environ.get("REPO_TOKEN", "")
    if not gitea_token:
        raise click.ClickException(_("ERROR: REPO_TOKEN is not set."))
@@ -244,6 +302,9 @@ def main(tag: str, repo: str, registry_url: str | None, skip_build: bool) -> Non
    try:
        tea.create_release(repo, tag=tag, title=tag, body=release_body)
    except TeaCLIError as e:
+        if "already" in str(e).lower() and "release" in str(e).lower():
+            click.echo(_("Gitea release {tag} already exists — skipping creation.", tag=tag))
+            return
        raise click.ClickException(_("Release creation failed: {error}", error=str(e))) from None

    click.echo(
@@ -317,6 +317,21 @@ def run_tests() -> None:
    click.echo(_("Tests passed."))


+def _write_github_output(tag: str) -> None:
+    """Write the release tag to GITHUB_OUTPUT for downstream jobs.
+
+    This allows a publish job (needs: release) to read the tag via
+    ``${{ needs.release.outputs.tag }}`` instead of relying on
+    tag-push event triggering a separate workflow.
+    """
+    github_output = os.environ.get("GITHUB_OUTPUT")
+    if not github_output:
+        return
+    with open(github_output, "a") as f:  # noqa: PTH123
+        f.write(f"tag={tag}\n")
+    click.echo(_("Wrote tag {tag} to GITHUB_OUTPUT.", tag=tag))
+
+
 def create_and_push_tag(new_version: str, changelog: str, dry_run: bool) -> bool:
    """Create an annotated tag with the changelog as message and push it.

@@ -345,6 +360,7 @@ def create_and_push_tag(new_version: str, changelog: str, dry_run: bool) -> bool
        if not dry_run:
            # Ensure the existing tag is pushed
            run_cmd(["git", "push", "origin", f"refs/tags/{tag}"], check=False)
+        _write_github_output(tag)
        return False
    tag_msg = f"Release v{new_version}\n\n{changelog}"
    if dry_run:
@@ -352,6 +368,7 @@ def create_and_push_tag(new_version: str, changelog: str, dry_run: bool) -> bool
        return True
    run_cmd(["git", "tag", "-a", tag, "-m", tag_msg])
    run_cmd(["git", "push", "origin", f"refs/tags/{tag}"])
+    _write_github_output(tag)
    return True


@@ -617,6 +634,7 @@ def main(dry_run: bool, skip_tests: bool, verify: bool) -> None:
                    tag=release_tag,
                )
            )
+            _write_github_output(release_tag)
            return
        # Tag is missing — recover by creating and pushing it
        click.echo(
@@ -14,6 +14,7 @@ task ID format for each project.

 import re
 import subprocess  # nosec B404
+import sys

 import click

@@ -23,6 +24,17 @@ from devx.i18n import _
 MASTER_TASK_ID_RE = re.compile(rf"^{TASK_PREFIX}-\d+:")


+def get_latest_commit_msg() -> str:
+    """Get the latest commit message from git."""
+    result = subprocess.run(  # nosec
+        ["git", "log", "-1", "--format=%B"],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return result.stdout.strip()
+
+
 def first_line(text: str) -> str:
    return text.split("\n")[0]

@@ -41,11 +53,26 @@ def get_branch() -> str:


@click.command()
-@click.argument("commit_msg_file")
+@click.argument("commit_msg_file", required=False)
@click.option("--branch", default=None, help="Override branch detection (for CI use).")
-def main(commit_msg_file: str, branch: str | None) -> None:
-    with open(commit_msg_file) as f:
-        msg = f.read().strip()
+@click.option(
+    "--git",
+    "from_git",
+    is_flag=True,
+    default=False,
+    help="Read commit message from git log instead of a file.",
+)
+def main(commit_msg_file: str | None, branch: str | None, from_git: bool) -> None:
+    if from_git:
+        msg = get_latest_commit_msg()
+    elif commit_msg_file:
+        if commit_msg_file == "-":
+            msg = sys.stdin.read().strip()
+        else:
+            with open(commit_msg_file) as f:
+                msg = f.read().strip()
+    else:
+        raise click.ClickException(_("Provide a commit message file or use --git."))

    if branch is None:
        branch = get_branch()
@@ -1,28 +1,86 @@
 """Shared configuration constants for devx scripts and API clients.

-All defaults can be overridden via environment variables with the ``DEVX_``
-prefix. Projects consuming devx can set these in their ``.env`` files.
+Configuration is read from two sources, in priority order:
+
+1. **Environment variables** (``DEVX_`` prefix) — highest priority, used for
+   CI secrets and per-run overrides.
+2. **``[tool.devx]`` section in ``pyproject.toml``** — project defaults,
+   read from the current working directory.
+
+If neither source provides a value, built-in defaults are used.
 """

 from __future__ import annotations

 import os
 import re
+import tomllib
+from pathlib import Path
+
+
+def _load_pyproject_devx() -> dict[str, object]:
+    """Load the ``[tool.devx]`` section from pyproject.toml in the CWD.
+
+    Returns an empty dict if the file or section is missing.
+    """
+    path = Path("pyproject.toml")
+    if not path.exists():
+        return {}
+    try:
+        with open(path, "rb") as f:  # noqa: PTH123
+            data: dict[str, object] = tomllib.load(f)
+    except (tomllib.TOMLDecodeError, OSError):
+        return {}
+    tool_raw: object = data.get("tool", {})
+    if not isinstance(tool_raw, dict):
+        return {}
+    tool: dict[str, object] = tool_raw  # type: ignore[assignment]
+    devx_raw: object = tool.get("devx", {})
+    if not isinstance(devx_raw, dict):
+        return {}
+    devx: dict[str, object] = devx_raw  # type: ignore[assignment]
+    return devx
+
+
+_PYPROJECT = _load_pyproject_devx()
+
+
+def _get(key: str, env_var: str, default: str) -> str:
+    """Get a config value: env var > pyproject.toml > default."""
+    env_val = os.getenv(env_var)
+    if env_val is not None:
+        return env_val
+    pyproject_val = _PYPROJECT.get(key)
+    if isinstance(pyproject_val, str):
+        return pyproject_val
+    return default
+
+
+def _get_int(key: str, env_var: str, default: int) -> int:
+    """Get an int config value: env var > pyproject.toml > default."""
+    env_val = os.getenv(env_var)
+    if env_val is not None:
+        return int(env_val)
+    pyproject_val = _PYPROJECT.get(key)
+    if isinstance(pyproject_val, int):
+        return pyproject_val
+    return default
+

 # API endpoints — override via env vars for different Gitea/Vikunja instances
-GITEA_API_URL = os.getenv("DEVX_GITEA_API_URL", "https://git.oblachno.oblachno.fyi/api/v1")
-VIKUNJA_API_URL = os.getenv("DEVX_VIKUNJA_API_URL", "https://work.oblachno.oblachno.fyi/api/v1")
+GITEA_API_URL = _get("gitea_api_url", "DEVX_GITEA_API_URL", "https://git.oblachno.oblachno.fyi/api/v1")
+VIKUNJA_API_URL = _get("vikunja_api_url", "DEVX_VIKUNJA_API_URL", "https://work.oblachno.oblachno.fyi/api/v1")

 # Organization defaults — each project MUST set DEVX_REPO_OWNER explicitly.
 # No default: prevents silent 404s when the wrong owner is used.
-REPO_OWNER = os.getenv("DEVX_REPO_OWNER", "")
+REPO_OWNER = _get("repo_owner", "DEVX_REPO_OWNER", "")

 # Task prefix for Vikunja task IDs — each project sets its own (GRM, DEVX, INFRA, etc.)
-TASK_PREFIX = os.getenv("DEVX_TASK_PREFIX", "DEVX")
+TASK_PREFIX = _get("task_prefix", "DEVX_TASK_PREFIX", "DEVX")
 TASK_ID_RE = re.compile(rf"{TASK_PREFIX}-\d+")

 # Vikunja project ID — each project uses a different Vikunja project
-VIKUNJA_PROJECT_ID = int(os.getenv("DEVX_VIKUNJA_PROJECT_ID", "6"))
+VIKUNJA_PROJECT_ID = _get_int("vikunja_project_id", "DEVX_VIKUNJA_PROJECT_ID", 6)

 # HTTP client defaults
 DEFAULT_TIMEOUT = 30
@@ -82,12 +82,15 @@ class TeaCLI:
        cmd = [self._tea, *args]
        if json_output:
            cmd.extend(["--output", "json"])
-        result = subprocess.run(  # nosec B603
-            cmd,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
+        try:
+            result = subprocess.run(  # nosec B603
+                cmd,
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+        except FileNotFoundError as e:
+            raise TeaCLIError(f"tea binary not found ('{self._tea}'). Install tea or add it to PATH.") from e
        if result.returncode != 0:
            raise TeaCLIError(
                f"tea command failed (rc={result.returncode}): {' '.join(args)}\nstderr: {result.stderr.strip()}"
@@ -0,0 +1,251 @@
+# devx.mak — Shared Makefile fragment for devx-integrated projects.
+#
+# This fragment provides common targets for:
+# - Vikunja task management and PR creation
+# - Workflow validation (actionlint, act_runner)
+# - Linting (ruff, pyright, bandit, pip-audit)
+# - CI failure notification
+# - Environment setup (venv, .env, hooks)
+# - Test execution and quality checks
+#
+# Project config (task prefix, Vikunja project ID, repo owner, repo name)
+# is read from [tool.devx] in pyproject.toml by devx.config — no
+# Makefile variables needed.
+#
+# Usage in your Makefile:
+#
+#   # Set DEVX_PYTHON to your venv's Python
+#   DEVX_PYTHON := $(BIN)/python
+#
+#   # Include the devx fragment (silent if devx not installed yet)
+#   DEVX_MAK := $(shell $(DEVX_PYTHON) -c \
+#     "from pathlib import Path; import devx; print(Path(devx.__file__).parent / 'make' / 'devx.mak')" \
+#     2>/dev/null)
+#   -include $(DEVX_MAK)
+#
+# If devx is not installed, the -include silently skips and the targets
+# are simply unavailable (run 'make setup' first).
+#
+# Variables (set BEFORE including this fragment):
+#   DEVX_PYTHON          — Python executable (default: python3)
+#   DEVX_PR_BASE         — PR base branch (default: master)
+#   DEVX_VENV            — venv directory name (default: .venv)
+#   DEVX_BIN             — venv bin directory (default: $(DEVX_VENV)/bin)
+#   DEVX_LINT_PATHS      — paths for ruff/bandit (default: src/ tests/)
+#   DEVX_TYPECHECK_PATHS — paths for pyright (default: empty — uses pyright config)
+#   DEVX_COV_PKG         — coverage package name (default: src/devx)
+#   DEVX_TEST_PATHS      — pytest paths (default: tests/)
+#   DEVX_GITEA_PYPI_HOST — Gitea PyPI host (default: git.oblachno.oblachno.fyi)
+#   DEVX_GITEA_PYPI_ORG  — Gitea PyPI org (default: oblachno-oss)
+#   DEVX_ACTIONLINT_CFG  — actionlint config file (default: .gitea/actionlint.yaml)
+#   DEVX_WORKFLOW_DIR    — workflow directory (default: .gitea/workflows)
+
+DEVX_PYTHON ?= python3
+DEVX_PR_BASE ?= master
+DEVX_VENV ?= .venv
+DEVX_BIN ?= $(DEVX_VENV)/bin
+DEVX_LINT_PATHS ?= src/ tests/
+DEVX_COV_PKG ?= src/devx
+DEVX_TEST_PATHS ?= tests/
+DEVX_GITEA_PYPI_HOST ?= git.oblachno.oblachno.fyi
+DEVX_GITEA_PYPI_ORG ?= oblachno-oss
+DEVX_ACTIONLINT_CFG ?= .gitea/actionlint.yaml
+DEVX_WORKFLOW_DIR ?= .gitea/workflows
+
+# PIP_INSTALL — helper to run pip with Gitea private PyPI registry configured.
+# Usage: $(DEVX_PIP_INSTALL) install -e '.[ci,lint]'
+# GITEA_PYPI_USER can be set in .env, as an env var, or as a Make variable.
+DEVX_PIP_INSTALL := if [ -z "$$REPO_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
+	REPO_TOKEN="$${REPO_TOKEN:-$$GITEA_REGISTRY_TOKEN}"; \
+	_PYPI_USER="$${DEVX_GITEA_PYPI_USER:-$${GITEA_PYPI_USER}}"; \
+	if [ -n "$$REPO_TOKEN" ] && [ -n "$$_PYPI_USER" ]; then export PIP_EXTRA_INDEX_URL="https://$$_PYPI_USER:$$REPO_TOKEN@$(DEVX_GITEA_PYPI_HOST)/api/packages/$(DEVX_GITEA_PYPI_ORG)/pypi/simple/"; fi; \
+	$(DEVX_BIN)/pip
+
+.PHONY: devx-create-task devx-create-pr devx-push devx-push-with-pr devx-check-config
+.PHONY: devx-configure-gitea-pypi devx-install-tools devx-install-checkmake devx-checkmake
+.PHONY: devx-workflow-lint devx-workflow-dryrun devx-workflow-dryrun-safe devx-workflow-check
+.PHONY: devx-notify-failure devx-install-hooks devx-activate-scripts
+.PHONY: devx-lint-ruff devx-lint-format devx-typecheck devx-lint-bandit devx-lint-deps devx-lint
+.PHONY: devx-clean devx-pre-push
+.PHONY: devx-check-mutable-globals devx-check-dep-docs devx-check-test-coverage devx-check-docs devx-check-test-speed
+.PHONY: devx-test-unit devx-pytest-cov
+
+# ── Vikunja task and PR management ────────────────────────────────────────────
+
+# Create a Vikunja task (project ID read from [tool.devx] in pyproject.toml)
+devx-create-task:
+	@$(DEVX_PYTHON) -m devx.tools.create_task
+
+# Create a PR with title auto-derived from the Vikunja task
+# (owner/repo read from [tool.devx] in pyproject.toml)
+devx-create-pr:
+	@$(DEVX_PYTHON) -m devx.tools.create_pr --base $(DEVX_PR_BASE)
+
+# Push current branch to origin
+devx-push:
+	@git push -u origin HEAD
+
+# Validate devx configuration in pyproject.toml
+devx-check-config:
+	@$(DEVX_PYTHON) -m devx.tools.check_config
+
+# Push and create PR in one step
+devx-push-with-pr: devx-push devx-create-pr
+
+# ── Environment setup ─────────────────────────────────────────────────────────
+
+# Configure Gitea private PyPI registry so pip can find devx and other
+# private packages. In CI, REPO_TOKEN is set as a secret. Locally, it's in .env.
+devx-configure-gitea-pypi:
+	@if [ -z "$$REPO_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
+	REPO_TOKEN="$${REPO_TOKEN:-$$GITEA_REGISTRY_TOKEN}"; \
+	if [ -z "$$REPO_TOKEN" ]; then echo "[configure-gitea-pypi] REPO_TOKEN not set — skipping (devx must be on public PyPI)"; exit 0; fi; \
+	echo "[configure-gitea-pypi] Gitea PyPI registry configured (REPO_TOKEN present)."
+
+# Create .env from .env.example if it doesn't exist
+devx-env:
+	@if [ ! -f .env ]; then \
+		cp .env.example .env; \
+		echo "Created .env from .env.example — please edit it with your credentials."; \
+	fi
+
+# Create Python venv with version check
+devx-venv:
+	@python3 -c "import sys; v=sys.version_info; assert v >= (3, 12), f'Python 3.12+ required, found {v.major}.{v.minor}'; print(f'Python {v.major}.{v.minor}.{v.micro} OK')"
+	$(DEVX_PYTHON) -m venv $(DEVX_VENV)
+	$(DEVX_BIN)/pip install --upgrade pip setuptools wheel
+
+# Create activate scripts for shell/fish/zsh
+devx-activate-scripts:
+	@test -f activate.sh || (echo '#!/usr/bin/env bash' > activate.sh && echo 'source "$$(cd "$$(dirname "$${BASH_SOURCE[0]}")" && pwd)/.venv/bin/activate"' >> activate.sh && chmod +x activate.sh)
+	@test -f activate.fish || (echo '#!/usr/bin/env fish' > activate.fish && echo 'set -l script_dir (dirname (status --current-filename))' >> activate.fish && echo 'source "$$script_dir/.venv/bin/activate.fish"' >> activate.fish && chmod +x activate.fish)
+	@test -f activate.zsh || (echo '#!/usr/bin/env zsh' > activate.zsh && echo '0="$${ZERO:-$${0:#$$ZSH_ARGZERO}}"' >> activate.zsh && echo '0="$${$${(M)0:#/*}:-$$PWD/$$0}"' >> activate.zsh && echo 'source "$${0:A:h}/.venv/bin/activate"' >> activate.zsh && chmod +x activate.zsh)
+
+# Set git hooks path to hooks/
+devx-install-hooks:
+	@git config core.hooksPath hooks
+	@chmod +x hooks/pre-commit hooks/pre-push 2>/dev/null || true
+	@echo "core.hooksPath set to hooks/ — tracked hooks are now live."
+
+# ── Tool installation ─────────────────────────────────────────────────────────
+
+# Install CI/CD tools (actionlint, git-cliff, act_runner, tea) to ~/.local/bin
+devx-install-tools:
+	@$(DEVX_PYTHON) -m devx.tools.install_tools
+
+# Install checkmake (Makefile linter)
+devx-install-checkmake:
+	@$(DEVX_PYTHON) -m devx.tools.install_checkmake
+
+# Lint Makefiles with checkmake
+devx-checkmake:
+	@CHECKMAKE_EXE="$$(command -v checkmake 2>/dev/null || echo $(HOME)/.local/bin/checkmake)"; \
+	if ! command -v "$$CHECKMAKE_EXE" >/dev/null 2>&1 && ! [ -x "$$CHECKMAKE_EXE" ]; then \
+		echo "[checkmake] checkmake not found. Run: make devx-install-checkmake"; exit 1; \
+	fi; \
+	"$$CHECKMAKE_EXE" $(CURDIR)/Makefile
+
+# ── Workflow validation ───────────────────────────────────────────────────────
+
+# Static lint of Gitea Actions workflow YAML files
+devx-workflow-lint:
+	@command -v actionlint >/dev/null 2>&1 || { \
+		echo "actionlint not found. Install: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)"; \
+		exit 1; \
+	}
+	actionlint -config-file $(DEVX_ACTIONLINT_CFG) $(DEVX_WORKFLOW_DIR)/*.yml
+
+# Dry-run all workflows (requires act_runner)
+devx-workflow-dryrun:
+	@command -v act_runner >/dev/null 2>&1 || { echo "act_runner not found. Install: https://gitea.com/gitea/act_runner/releases"; exit 1; }
+	@echo "Dry-running all workflows (no Docker containers started)..."
+	act_runner exec --dryrun -W $(DEVX_WORKFLOW_DIR)/ 2>&1 | grep -E 'DRYRUN|ERROR|FAIL|Job'
+
+# Best-effort dry-run (skips if act_runner is not installed)
+devx-workflow-dryrun-safe:
+	@command -v act_runner >/dev/null 2>&1 && { echo "Dry-running workflows..."; act_runner exec --dryrun -W $(DEVX_WORKFLOW_DIR)/ 2>&1 | grep -E 'DRYRUN|ERROR|FAIL|Job'; } || echo "act_runner not found — skipping workflow dry-run (static lint still passed)"
+
+# Static lint + dry-run
+devx-workflow-check: devx-workflow-lint devx-workflow-dryrun
+	@echo "Workflow checks passed (static lint + dry-run)."
+
+# ── CI failure notification ───────────────────────────────────────────────────
+
+# Notify on CI failure — creates a Gitea issue via devx.ci.notify_failure.
+# Usage: make devx-notify-failure WORKFLOW=post-merge/release
+# Requires: REPO_TOKEN, GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_SHA
+devx-notify-failure:
+	@. $(DEVX_VENV)/bin/activate 2>/dev/null || true; \
+	export PATH="$(HOME)/.local/bin:$$PATH"; \
+	$(DEVX_PYTHON) -m devx.tools.install_tools --tool tea 2>/dev/null || true; \
+	$(DEVX_PYTHON) -m devx.ci.notify_failure --auto-login \
+		--repo "$${GITHUB_REPOSITORY}" \
+		--run-id "$${GITHUB_RUN_ID}" \
+		--workflow "$(WORKFLOW)" \
+		--commit "$${GITHUB_SHA}"
+
+# ── Linting ───────────────────────────────────────────────────────────────────
+
+devx-lint-ruff:
+	@$(DEVX_BIN)/ruff check $(DEVX_LINT_PATHS)
+
+devx-lint-format:
+	@$(DEVX_BIN)/ruff format --check $(DEVX_LINT_PATHS)
+
+devx-typecheck:
+	@$(DEVX_BIN)/pyright
+
+devx-lint-bandit:
+	@$(DEVX_BIN)/bandit -r src/
+
+devx-lint-deps:
+	@echo "Checking dependencies for known vulnerabilities..."
+	@$(DEVX_BIN)/python -m ensurepip 2>/dev/null || true
+	@PIPAPI_PYTHON_LOCATION=$$(pwd)/$(DEVX_VENV)/bin/python \
+		$(DEVX_BIN)/pip-audit --desc --skip-editable 2>&1 || true
+
+devx-lint: devx-lint-ruff devx-lint-format devx-typecheck devx-lint-bandit
+	@echo "[devx-lint] Linting checks passed."
+
+# ── Testing ───────────────────────────────────────────────────────────────────
+
+devx-test-unit:
+	@$(DEVX_BIN)/pytest $(DEVX_TEST_PATHS) -v --no-cov
+
+devx-pytest-cov:
+	@$(DEVX_BIN)/pytest $(DEVX_TEST_PATHS) -v --cov=$(DEVX_COV_PKG) --cov-report=term-missing --cov-fail-under=100
+
+# ── Quality checks ────────────────────────────────────────────────────────────
+
+# Scan for module-level mutable globals that cause test isolation bugs
+devx-check-mutable-globals:
+	@$(DEVX_PYTHON) -m devx.tools.check_mutable_globals
+
+# Validate that every dependency in pyproject.toml has a documented purpose
+devx-check-dep-docs:
+	@$(DEVX_PYTHON) -m devx.tools.check_pyproject_deps
+
+# Check that changed files have corresponding tests
+devx-check-test-coverage:
+	@$(DEVX_PYTHON) -m devx.tools.check_test_coverage
+
+# Validate agent and user docs for stale file references
+devx-check-docs:
+	@$(DEVX_PYTHON) -m devx.tools.check_agent_docs
+
+# Verify test suite timing
+devx-check-test-speed:
+	@$(DEVX_PYTHON) -m devx.tools.check_test_speed
+
+# ── Pre-push validation ───────────────────────────────────────────────────────
+
+# Run lint + tests before push (projects can override with project-specific targets)
+devx-pre-push: devx-lint devx-pytest-cov
+	@echo "[devx-pre-push] All checks passed. Proceeding with push."
+
+# ── Cleanup ───────────────────────────────────────────────────────────────────
+
+devx-clean:
+	@find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
+	@find . -type f -name "*.pyc" -delete 2>/dev/null || true
+	@rm -rf .coverage htmlcov/ dist/ build/ *.egg-info/ .molecule/ 2>/dev/null || true
@@ -132,14 +132,113 @@ def build_multi_role_pairs(
    return [MultiRoleTestPair(r, s, p) for r, s in role_scenarios for p in platforms]


-def distribute_multi_role(pairs: list[MultiRoleTestPair], max_runners: int) -> list[list[MultiRoleTestPair]]:
-    """Split *pairs* into *max_runners* balanced groups (round-robin)."""
-    groups: list[list[MultiRoleTestPair]] = [[] for _ in range(max_runners)]
-    for i, pair in enumerate(pairs):
-        groups[i % max_runners].append(pair)
+# Heuristic weights for known heavy molecule scenarios.
+# These are estimated from CI run times — scenarios that pull large Docker
+# images or run complex Ansible playbooks take longer.
+#
+# Weights are calibrated from actual CI execution times (converge→destroy):
+#   nextcloud:           ~7.7m  → 15
+#   restore/default:     ~5.7m  → 11
+#   customer-apps:       ~5.5m  → 11
+#   zitadel/default:     ~5.0m  → 10
+#   docker_base/default: ~3.9m  →  8
+#   app_hardening/default: ~1.9m → 4
+#   app_container/default: ~1.8m → 3
+#   postgres-upgrade:    ~1.7m  →  3
+#   observability/default: ~1.7m → 3
+#   storage/default:     ~1.5m  →  3
+#   storage/object-storage: ~1.0m → 2
+#   vaultwarden:         ~0.7m  →  2
+#   simple-app:          ~0.7m  →  2
+#
+# Role-specific weights take priority over scenario-name weights.
+# The (role, scenario) tuple is checked first, then the scenario name
+# alone, then the default weight.
+_ROLE_SCENARIO_WEIGHTS: dict[tuple[str, str], int] = {
+    ("app_container", "nextcloud"): 15,
+    ("app_container", "customer-apps"): 11,
+    ("app_container", "vaultwarden"): 2,
+    ("app_container", "simple-app"): 2,
+    ("app_container", "postgres-upgrade"): 3,
+    ("app_container", "default"): 3,
+    ("restore", "default"): 11,
+    ("zitadel", "default"): 10,
+    ("docker_base", "default"): 8,
+    ("observability", "default"): 3,
+    ("app_hardening", "default"): 4,
+    ("storage", "default"): 3,
+    ("storage", "object-storage"): 2,
+}
+
+# Fallback weights by scenario name only (for single-role projects or
+# scenarios not in the role-specific table).
+_SCENARIO_WEIGHTS: dict[str, int] = {
+    "nextcloud": 15,
+    "customer-apps": 11,
+    "restore": 11,
+    "zitadel": 10,
+    "docker-base": 8,
+    "postgresql": 3,
+    "postgres-upgrade": 3,
+    "gitea": 8,
+    "redis": 5,
+    "backup": 5,
+    "vaultwarden": 2,
+    "simple-app": 2,
+    "object-storage": 2,
+    "default": 3,
+    "binary": 2,
+}
+_DEFAULT_SCENARIO_WEIGHT = 3
+
+
+def _scenario_weight(scenario: str, role: str | None = None) -> int:
+    """Estimate a weight for a scenario based on its name and optionally its role.
+
+    Role-specific weights take priority over scenario-name-only weights.
+    """
+    s = scenario.lower()
+    if role is not None:
+        r = role.lower()
+        key = (r, s)
+        if key in _ROLE_SCENARIO_WEIGHTS:
+            return _ROLE_SCENARIO_WEIGHTS[key]
+    for key, weight in _SCENARIO_WEIGHTS.items():
+        if key in s:
+            return weight
+    return _DEFAULT_SCENARIO_WEIGHT
+
+
+def _lpt_distribute[T](items: list[T], weights: list[int], max_runners: int) -> list[list[T]]:
+    """Distribute *items* across *max_runners* using LPT (Longest Processing Time first).
+
+    Sorts items by weight (descending), then assigns each to the runner
+    with the least total weight. This produces a more balanced distribution
+    than naive round-robin when items have varying costs.
+    """
+    groups: list[list[T]] = [[] for _ in range(max_runners)]
+    loads = [0] * max_runners
+    # Sort by weight descending, preserving original order for ties
+    indexed = sorted(enumerate(items), key=lambda x: (-weights[x[0]], x[0]))
+    for orig_idx, item in indexed:
+        # Find the runner with the minimum load
+        min_runner = min(range(max_runners), key=lambda r: loads[r])
+        groups[min_runner].append(item)
+        loads[min_runner] += weights[orig_idx]
    return groups


+def distribute_multi_role(pairs: list[MultiRoleTestPair], max_runners: int) -> list[list[MultiRoleTestPair]]:
+    """Split *pairs* into *max_runners* balanced groups using LPT scheduling.
+
+    Each pair is weighted by role+scenario heuristics (e.g. ``nextcloud`` is
+    heavier than ``simple-app``). Pairs are sorted by weight descending and
+    assigned to the runner with the least total weight.
+    """
+    weights = [_scenario_weight(p.scenario, p.role) for p in pairs]
+    return _lpt_distribute(pairs, weights, max_runners)
+
+
 def multi_role_pairs_for_runner(
    pairs: list[MultiRoleTestPair], runner_index: int, max_runners: int
 ) -> list[MultiRoleTestPair]:
@@ -153,11 +252,14 @@ def multi_role_pairs_for_runner(


 def distribute(pairs: list[TestPair], max_runners: int) -> list[list[TestPair]]:
-    """Split *pairs* into *max_runners* balanced groups (round-robin)."""
-    groups: list[list[TestPair]] = [[] for _ in range(max_runners)]
-    for i, pair in enumerate(pairs):
-        groups[i % max_runners].append(pair)
-    return groups
+    """Split *pairs* into *max_runners* balanced groups using LPT scheduling.
+
+    Each pair is weighted by scenario name heuristics (e.g. ``nextcloud`` is
+    heavier than ``binary``). Pairs are sorted by weight descending and
+    assigned to the runner with the least total weight.
+    """
+    weights = [_scenario_weight(p.scenario) for p in pairs]
+    return _lpt_distribute(pairs, weights, max_runners)


 def pairs_for_runner(pairs: list[TestPair], runner_index: int, max_runners: int) -> list[TestPair]:
@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+"""Validate agent documentation and user docs for stale file references.
+
+Scans documentation files (``.devin/``, ``docs/``, ``README.md``) for:
+- References to files that no longer exist
+- References to deleted files (configurable blocklist)
+- References to deprecated patterns (configurable regex patterns)
+
+Configuration (``[tool.devx.check_agent_docs]`` in pyproject.toml):
+
+``scan_dirs``          — directories to scan for docs (default: ``[".devin", "docs"]``)
+``scan_files``         — specific files to scan (default: ``["README.md", "README.rst"]``)
+``scan_extensions``    — file extensions to scan (default: ``[".md", ".yml", ".yaml"]``)
+``excluded_paths``     — paths to exclude from scanning (default: ``["docs/retrospectives"]``)
+``deleted_files``      — list of file paths that should never be referenced
+``deprecated_patterns`` — list of regex patterns for deprecated references
+``legitimate_indicators`` — substrings that indicate a legitimate reference to a deprecated pattern
+``repo_path_prefixes`` — path prefixes that indicate a repo-relative reference
+                    (default: ``["ansible/", "scripts/", "tofu/", ".devin/", "src/"]``)
+``min_path_ref_length`` — minimum length for a path reference to be checked (default: 5)
+
+Usage::
+
+    python3 -m devx.tools.check_agent_docs
+"""
+
+from __future__ import annotations
+
+import contextlib
+import re
+from pathlib import Path
+
+import click
+
+from devx.config import _load_pyproject_devx
+from devx.i18n import _
+
+MIN_PATH_REF_LENGTH_DEFAULT = 5
+
+# Pattern that matches file path references in markdown or code
+FILE_REF_RE = re.compile(
+    r"(?:`|\")?"
+    r"([\w\-./]+(?:\.[a-zA-Z0-9]+))"
+    r"(?:`|\))?"
+)
+
+DEFAULT_SCAN_DIRS = [".devin", "docs"]
+DEFAULT_SCAN_FILES = ["README.md", "README.rst"]
+DEFAULT_SCAN_EXTENSIONS = [".md", ".yml", ".yaml"]
+DEFAULT_EXCLUDED_PATHS = ["docs/retrospectives"]
+DEFAULT_REPO_PATH_PREFIXES = ["ansible/", "scripts/", "tofu/", ".devin/", "src/"]
+
+
+def _load_config() -> dict[str, object]:
+    """Load check_agent_docs configuration from pyproject.toml."""
+    devx_cfg = _load_pyproject_devx()
+    cfg_raw = devx_cfg.get("check_agent_docs", {})
+    if not isinstance(cfg_raw, dict):
+        return {}
+    return cfg_raw  # type: ignore[return-value]
+
+
+def _should_skip(path: Path, excluded_paths: list[str], repo_root: Path) -> bool:
+    """Check if a path should be excluded from scanning."""
+    try:
+        rel = str(path.relative_to(repo_root))
+    except ValueError:
+        return False
+    return any(excluded in rel for excluded in excluded_paths)
+
+
+def _is_legitimate_ref(line: str, legitimate_indicators: list[str]) -> bool:
+    """Check if a line contains a legitimate reference to a deprecated pattern."""
+    line_lower = line.lower()
+    return any(legit.lower() in line_lower for legit in legitimate_indicators)
+
+
+def _collect_doc_files(
+    repo_root: Path,
+    scan_dirs: list[str],
+    scan_files: list[str],
+    scan_extensions: list[str],
+    excluded_paths: list[str],
+) -> list[Path]:
+    """Collect all documentation files to scan."""
+    files: list[Path] = []
+
+    for scan_dir_name in scan_dirs:
+        scan_dir = repo_root / scan_dir_name
+        if not scan_dir.exists():
+            continue
+        for ext in scan_extensions:
+            for path in scan_dir.glob(f"**/*{ext}"):
+                if not _should_skip(path, excluded_paths, repo_root):
+                    files.append(path)
+
+    for readme_name in scan_files:
+        path = repo_root / readme_name
+        if path.exists() and not _should_skip(path, excluded_paths, repo_root):
+            files.append(path)
+
+    # Deduplicate while preserving order
+    seen: set[Path] = set()
+    unique: list[Path] = []
+    for f in files:
+        if f not in seen:
+            seen.add(f)
+            unique.append(f)
+    return unique
+
+
+def _check_file(
+    path: Path,
+    repo_root: Path,
+    deleted_files: set[str],
+    deprecated_patterns: list[re.Pattern[str]],
+    legitimate_indicators: list[str],
+    repo_path_prefixes: list[str],
+    min_path_ref_length: int,
+    skip_ref_prefixes: list[str],
+) -> list[str]:
+    """Check a single file for stale references."""
+    issues: list[str] = []
+    rel_path = path.relative_to(repo_root)
+
+    try:
+        content = path.read_text(encoding="utf-8")
+    except UnicodeDecodeError:
+        return issues
+
+    for lineno, line in enumerate(content.splitlines(), start=1):
+        # Check for deleted file references
+        for deleted in deleted_files:
+            if deleted in line:
+                issues.append(f"{rel_path}:{lineno}: references deleted file '{deleted}'")
+
+        # Check for deprecated pattern references
+        for pattern in deprecated_patterns:
+            if pattern.search(line) and not _is_legitimate_ref(line, legitimate_indicators):
+                issues.append(f"{rel_path}:{lineno}: matches deprecated pattern '{pattern.pattern}'")
+
+        # Check for references to files that don't exist
+        for match in FILE_REF_RE.finditer(line):
+            ref = match.group(1)
+            # Skip URLs, bare words, and short strings
+            if "/" not in ref or len(ref) < min_path_ref_length:
+                continue
+            # Only check references that look like repo paths
+            if not any(ref.startswith(prefix) for prefix in repo_path_prefixes):
+                continue
+            # Skip references matching configured skip prefixes (e.g. aspirational test files)
+            if any(ref.startswith(prefix) for prefix in skip_ref_prefixes):
+                continue
+            candidate = repo_root / ref
+            if not candidate.exists():
+                issues.append(f"{rel_path}:{lineno}: references non-existent file '{ref}'")
+
+    return issues
+
+
+@click.command()
+def cli() -> None:
+    """Validate agent documentation and user docs for stale file references."""
+    repo_root = Path.cwd()
+    cfg = _load_config()
+
+    scan_dirs_raw = cfg.get("scan_dirs")
+    scan_dirs: list[str] = [str(d) for d in scan_dirs_raw] if isinstance(scan_dirs_raw, list) else DEFAULT_SCAN_DIRS
+    scan_files_raw = cfg.get("scan_files")
+    scan_files: list[str] = [str(d) for d in scan_files_raw] if isinstance(scan_files_raw, list) else DEFAULT_SCAN_FILES
+    scan_ext_raw = cfg.get("scan_extensions")
+    scan_extensions: list[str] = (
+        [str(d) for d in scan_ext_raw] if isinstance(scan_ext_raw, list) else DEFAULT_SCAN_EXTENSIONS
+    )
+    excluded_raw = cfg.get("excluded_paths")
+    excluded_paths: list[str] = (
+        [str(d) for d in excluded_raw] if isinstance(excluded_raw, list) else DEFAULT_EXCLUDED_PATHS
+    )
+    prefixes_raw = cfg.get("repo_path_prefixes")
+    repo_path_prefixes: list[str] = (
+        [str(d) for d in prefixes_raw] if isinstance(prefixes_raw, list) else DEFAULT_REPO_PATH_PREFIXES
+    )
+    min_len_raw = cfg.get("min_path_ref_length")
+    min_path_ref_length: int = int(min_len_raw) if isinstance(min_len_raw, int) else MIN_PATH_REF_LENGTH_DEFAULT
+
+    skip_prefixes_raw = cfg.get("skip_ref_prefixes", [])
+    skip_ref_prefixes: list[str] = [str(d) for d in skip_prefixes_raw] if isinstance(skip_prefixes_raw, list) else []
+
+    deleted_files: set[str] = set()
+    deleted_raw = cfg.get("deleted_files", [])
+    if isinstance(deleted_raw, list):
+        deleted_files = {str(d) for d in deleted_raw}
+
+    deprecated_patterns: list[re.Pattern[str]] = []
+    deprecated_raw = cfg.get("deprecated_patterns", [])
+    if isinstance(deprecated_raw, list):
+        for pattern_str in deprecated_raw:
+            if isinstance(pattern_str, str):
+                with contextlib.suppress(re.error):
+                    deprecated_patterns.append(re.compile(pattern_str))
+
+    legitimate_indicators: list[str] = []
+    legit_raw = cfg.get("legitimate_indicators", [])
+    if isinstance(legit_raw, list):
+        legitimate_indicators = [str(s) for s in legit_raw]
+
+    files = _collect_doc_files(repo_root, scan_dirs, scan_files, scan_extensions, excluded_paths)
+    all_issues: list[str] = []
+
+    for path in sorted(files):
+        issues = _check_file(
+            path,
+            repo_root,
+            deleted_files,
+            deprecated_patterns,
+            legitimate_indicators,
+            repo_path_prefixes,
+            min_path_ref_length,
+            skip_ref_prefixes,
+        )
+        all_issues.extend(issues)
+
+    if all_issues:
+        click.echo(f"[check_agent_docs] Found {len(all_issues)} issue(s):\n", err=True)
+        for issue in all_issues:
+            click.echo(issue, err=True)
+        click.echo(
+            f"\n[check_agent_docs] FAILED: {len(all_issues)} stale reference(s)",
+            err=True,
+        )
+        raise click.ClickException(_("Found {count} stale documentation reference(s)", count=len(all_issues)))
+
+    click.echo(_("[check_agent_docs] Passed: scanned {count} file(s), no stale references", count=len(files)))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Validate devx configuration consistency in pyproject.toml.
+
+Checks:
+1. [tool.devx] section exists with required keys (task_prefix, vikunja_project_id, repo_owner, repo_name)
+2. devx version is consistent across all extras that mention it
+
+Usage::
+
+    python3 -m devx.tools.check_config
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+import tomllib
+from pathlib import Path
+
+import click
+
+from devx.i18n import _
+
+
+@click.command()
+def cli() -> None:
+    """Validate devx configuration in pyproject.toml."""
+    path = Path("pyproject.toml")
+    if not path.exists():
+        click.echo(_("pyproject.toml not found in current directory."))
+        sys.exit(1)
+
+    with open(path, "rb") as f:  # noqa: PTH123
+        data = tomllib.load(f)
+
+    errors: list[str] = []
+
+    # Check [tool.devx] section
+    devx_cfg = data.get("tool", {}).get("devx", {})
+    required_keys = {"task_prefix", "vikunja_project_id", "repo_owner", "repo_name"}
+    missing = required_keys - set(devx_cfg.keys())
+    if missing:
+        errors.append(
+            _("[tool.devx] missing required keys: {keys}", keys=", ".join(sorted(missing))),
+        )
+
+    # Check devx version consistency across extras
+    optional_deps = data.get("project", {}).get("optional-dependencies", {})
+    devx_versions: dict[str, str] = {}
+    for extra_name, deps in optional_deps.items():
+        for dep in deps:
+            # Match "devx>=X.Y.Z", "devx==X.Y.Z", "devx>X.Y.Z", etc.
+            m = re.search(r"\bdevx\s*(>=|==|>|<=|<|~=)\s*([\d.]+)", dep)
+            if m:
+                devx_versions[extra_name] = m.group(2)
+
+    if devx_versions:
+        unique_versions = set(devx_versions.values())
+        if len(unique_versions) > 1:
+            detail = ", ".join(f"{extra}={v}" for extra, v in sorted(devx_versions.items()))
+            errors.append(
+                _("devx version mismatch across extras: {detail}", detail=detail),
+            )
+
+    if errors:
+        for err in errors:
+            click.echo(f"ERROR: {err}", err=True)
+        sys.exit(1)
+
+    click.echo(_("Configuration OK: [tool.devx] present, devx versions consistent."))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+"""Detect module-level mutable globals that may cause test isolation bugs.
+
+Scans Python files for patterns like::
+
+    _SEEN: set[Path] = set()
+    _CACHE: dict[Path, Any] = {}
+    PATHS: list[Path] = []
+
+These are hazardous because one test mutates the container and the next
+sees stale state.  The script reports the file/line and suggests a factory
+function or fixture replacement.
+
+Configuration (``[tool.devx.check_mutable_globals]`` in pyproject.toml):
+
+``scan_dirs``      — list of directories to scan (default: ``["scripts", "tests"]``)
+``skip_dirs``      — directory names to skip (default: ``__pycache__``, ``.pytest_cache``, ``venv``, ``.venv``)
+``known_safe``     — list of ``"path:line:var_name"`` entries to ignore
+
+Usage::
+
+    python3 -m devx.tools.check_mutable_globals
+    python3 -m devx.tools.check_mutable_globals --scan-dir src --scan-dir tests
+"""
+
+from __future__ import annotations
+
+import ast
+import contextlib
+from pathlib import Path
+
+import click
+
+from devx.config import _load_pyproject_devx
+from devx.i18n import _
+
+MUTABLE_TYPES = {"set", "dict", "list"}
+PATH_HINTS = ("path", "paths", "seen", "cache", "memo", "registry")
+DEFAULT_SCAN_DIRS = ["scripts", "tests"]
+DEFAULT_SKIP_DIRS = {"__pycache__", ".pytest_cache", "venv", ".venv"}
+
+
+def _load_config() -> tuple[list[str], set[str], set[tuple[str, int, str]]]:
+    """Load configuration from pyproject.toml [tool.devx.check_mutable_globals]."""
+    devx_cfg = _load_pyproject_devx()
+    cfg_raw = devx_cfg.get("check_mutable_globals", {})
+    if not isinstance(cfg_raw, dict):
+        return DEFAULT_SCAN_DIRS, DEFAULT_SKIP_DIRS, set()
+    cfg: dict[str, object] = cfg_raw  # type: ignore[assignment]
+
+    scan_dirs_raw = cfg.get("scan_dirs", DEFAULT_SCAN_DIRS)
+    scan_dirs: list[str] = [str(d) for d in scan_dirs_raw] if isinstance(scan_dirs_raw, list) else DEFAULT_SCAN_DIRS
+
+    skip_dirs_raw = cfg.get("skip_dirs", list(DEFAULT_SKIP_DIRS))
+    skip_dirs: set[str] = {str(d) for d in skip_dirs_raw} if isinstance(skip_dirs_raw, list) else DEFAULT_SKIP_DIRS
+
+    known_safe_raw = cfg.get("known_safe", [])
+    known_safe: set[tuple[str, int, str]] = set()
+    if isinstance(known_safe_raw, list):
+        for entry in known_safe_raw:
+            if isinstance(entry, str) and entry.count(":") >= 2:
+                parts = entry.rsplit(":", 2)
+                with contextlib.suppress(ValueError):
+                    known_safe.add((parts[0], int(parts[1]), parts[2]))
+
+    return scan_dirs, skip_dirs, known_safe
+
+
+def _should_skip(path: Path, skip_dirs: set[str]) -> bool:
+    return any(part in skip_dirs for part in path.parts)
+
+
+def find_mutable_globals(
+    file_path: Path,
+    repo_root: Path,
+    known_safe: set[tuple[str, int, str]],
+) -> list[str]:
+    """Return a list of issue strings for mutable globals in *file_path*."""
+    issues: list[str] = []
+    try:
+        source = file_path.read_text(encoding="utf-8")
+        tree = ast.parse(source)
+    except SyntaxError:
+        return issues
+
+    for node in ast.iter_child_nodes(tree):
+        if not isinstance(node, ast.AnnAssign | ast.Assign):
+            continue
+
+        names: list[str] = []
+        if isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name):
+            names.append(node.target.id)
+        if isinstance(node, ast.Assign):
+            for target in node.targets:
+                if isinstance(target, ast.Name):
+                    names.append(target.id)
+
+        for name in names:
+            name_lower = name.lower()
+            value = node.value
+            if value is None:
+                continue
+
+            is_mutable_literal = False
+            if isinstance(value, ast.Call):
+                if isinstance(value.func, ast.Name):
+                    if value.func.id in MUTABLE_TYPES:
+                        is_mutable_literal = True
+                elif isinstance(value.func, ast.Attribute):
+                    # e.g. collections.defaultdict
+                    pass
+            elif isinstance(value, (ast.Dict, ast.List, ast.Set)):
+                is_mutable_literal = True
+
+            if not is_mutable_literal:
+                continue
+
+            # Check if the name or type hint suggests Path usage
+            has_path_hint = any(hint in name_lower for hint in PATH_HINTS)
+            has_path_type = False
+            if isinstance(node, ast.AnnAssign) and node.annotation:
+                ann = ast.unparse(node.annotation)
+                has_path_type = "Path" in ann
+
+            if has_path_hint or has_path_type:
+                rel = str(file_path.relative_to(repo_root))
+                if (rel, node.lineno, name) in known_safe:
+                    continue
+                value_str = ast.unparse(value) if value is not None else "..."
+                issues.append(
+                    f"{rel}:{node.lineno}: mutable global {name!r} "
+                    f"({value_str}) — use a factory function or pytest fixture"
+                )
+
+    return issues
+
+
+@click.command()
+@click.option(
+    "--scan-dir",
+    multiple=True,
+    help=_("Additional directory to scan (default: scripts, tests). Can be repeated."),
+)
+def cli(scan_dir: tuple[str, ...]) -> None:
+    """Scan for module-level mutable globals that cause test isolation bugs."""
+    repo_root = Path.cwd()
+    config_scan_dirs, skip_dirs, known_safe = _load_config()
+
+    # CLI --scan-dir overrides config if provided
+    scan_dirs = list(scan_dir) if scan_dir else config_scan_dirs
+
+    all_issues: list[str] = []
+
+    for scan_dir_name in scan_dirs:
+        scan_path = repo_root / scan_dir_name
+        if not scan_path.exists():
+            continue
+        for py_file in scan_path.rglob("*.py"):
+            if _should_skip(py_file, skip_dirs):
+                continue
+            all_issues.extend(find_mutable_globals(py_file, repo_root, known_safe))
+
+    if all_issues:
+        click.echo(f"[check-mutable-globals] FAILED: {len(all_issues)} issue(s)", err=True)
+        for issue in all_issues:
+            click.echo(f"  {issue}", err=True)
+        raise click.ClickException(
+            _("Found {count} mutable global(s) — use factory functions or pytest fixtures.", count=len(all_issues))
+        )
+
+    click.echo(_("[check-mutable-globals] Passed: no mutable path globals found"))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+"""Validate that every dependency in pyproject.toml has a documented purpose.
+
+This script does NOT resolve versions or query PyPI. It only ensures that
+every dependency listed in ``[project.dependencies]`` or
+``[project.optional-dependencies]`` has a corresponding comment nearby
+explaining why it is needed.
+
+Failure means a dependency lacks documentation.
+
+Usage::
+
+    python3 -m devx.tools.check_pyproject_deps
+    python3 -m devx.tools.check_pyproject_deps --file path/to/pyproject.toml
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import click
+
+from devx.i18n import _
+
+
+def check_deps(pyproject_path: Path) -> list[str]:
+    """Return a list of issue strings for undocumented dependencies.
+
+    An empty list means all dependencies are documented.
+    """
+    if not pyproject_path.exists():
+        return [str(pyproject_path) + ": file not found"]
+
+    content = pyproject_path.read_text(encoding="utf-8")
+    lines = content.splitlines()
+
+    issues: list[str] = []
+    in_deps_section = False
+    prev_was_comment = False
+
+    for i, raw_line in enumerate(lines, start=1):
+        stripped = raw_line.strip()
+
+        # Detect section headers
+        if stripped in ("[project.dependencies]", "[project.optional-dependencies]"):
+            in_deps_section = True
+            continue
+        if stripped.startswith("[") and in_deps_section:
+            in_deps_section = False
+            continue
+
+        if not in_deps_section:
+            continue
+
+        if stripped == "":
+            continue
+
+        # We're inside a dependency list
+        if stripped.startswith("#"):
+            prev_was_comment = True
+            continue
+
+        if stripped.startswith("-") or stripped.startswith('"'):
+            if not prev_was_comment:
+                issues.append(f"{pyproject_path.name}:{i}: dependency lacks description comment: {stripped}")
+            prev_was_comment = False
+        else:
+            prev_was_comment = False
+
+    return issues
+
+
+@click.command()
+@click.option(
+    "--file",
+    "pyproject_file",
+    type=click.Path(path_type=Path),
+    default=Path("pyproject.toml"),
+    help=_("Path to pyproject.toml (default: pyproject.toml in CWD)."),
+)
+def cli(pyproject_file: Path) -> None:
+    """Validate that every dependency in pyproject.toml has a documented purpose."""
+    issues = check_deps(pyproject_file)
+
+    if issues:
+        click.echo(
+            _("FAILED: {count} undocumented dependency/ies", count=len(issues)),
+            err=True,
+        )
+        for issue in issues:
+            click.echo(f"  {issue}", err=True)
+        raise click.ClickException(_("Dependencies must have documentation comments."))
+
+    click.echo(_("[check-dep-docs] Passed: all dependencies are documented"))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -0,0 +1,251 @@
+#!/usr/bin/env python3
+"""Pre-commit / CI check: ensure every changed or new file has corresponding tests.
+
+Configuration (``[tool.devx.check_test_coverage]`` in pyproject.toml):
+
+``rules`` — list of mapping rules, each with:
+
+``source_pattern``  — glob pattern for source files (e.g. ``"scripts/*.py"``)
+``test_paths``      — list of test path templates (e.g. ``["scripts/tests/test_{name}", "tests/unit/test_{name}"]``)
+``description``     — human-readable description for error messages
+
+``skip_patterns``   — list of file patterns to skip (e.g. ``["__init__.py", "config.py"]``)
+``test_file_indicators`` — substrings that identify a file as a test (default: ``["tests/", "/test_", "_test.py"]``)
+``skip_extensions`` — file extensions to skip (default: .md, .yml, .yaml, .json, .tf, .sh, .conf, .service)
+
+Built-in defaults cover common Python project layouts (``scripts/*.py``, ``src/**/*.py``).
+Project-specific rules are merged with defaults (first match wins).
+
+Usage::
+
+    python3 -m devx.tools.check_test_coverage [--staged-only] [--warn-only]
+"""
+
+from __future__ import annotations
+
+import argparse
+import fnmatch
+import subprocess  # nosec B404
+import sys
+from pathlib import Path
+
+from devx.config import _load_pyproject_devx
+from devx.i18n import _
+
+DEFAULT_TEST_INDICATORS = ["tests/", "/test_", "_test.py"]
+DEFAULT_SKIP_EXTENSIONS = (".md", ".yml", ".yaml", ".json", ".tf", ".sh", ".conf", ".service")
+
+# Built-in rules for common Python project layouts
+BUILTIN_RULES: list[dict[str, object]] = [
+    {
+        "source_pattern": "scripts/*.py",
+        "test_paths": ["scripts/tests/test_{name}", "tests/unit/test_{name}"],
+        "description": "Missing unit test: scripts/tests/test_{name} or tests/unit/test_{name}",
+    },
+    {
+        "source_pattern": "src/**/*.py",
+        "test_paths": ["tests/unit/test_{name}", "tests/unit/test_{module}_{name}"],
+        "description": "Missing unit test: tests/unit/test_{name}",
+    },
+]
+
+
+def _load_rules() -> tuple[list[dict[str, object]], list[str], list[str], tuple[str, ...]]:
+    """Load test coverage rules from pyproject.toml."""
+    devx_cfg = _load_pyproject_devx()
+    cfg_raw = devx_cfg.get("check_test_coverage", {})
+    if not isinstance(cfg_raw, dict):
+        return BUILTIN_RULES, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS
+    cfg: dict[str, object] = cfg_raw  # type: ignore[assignment]
+
+    rules_raw = cfg.get("rules", BUILTIN_RULES)
+    rules: list[dict[str, object]] = [dict(r) for r in rules_raw] if isinstance(rules_raw, list) else BUILTIN_RULES
+
+    skip_raw = cfg.get("skip_patterns", [])
+    skip_patterns: list[str] = [str(s) for s in skip_raw] if isinstance(skip_raw, list) else []
+
+    indicators_raw = cfg.get("test_file_indicators", DEFAULT_TEST_INDICATORS)
+    indicators: list[str] = (
+        [str(s) for s in indicators_raw] if isinstance(indicators_raw, list) else DEFAULT_TEST_INDICATORS
+    )
+
+    skip_ext_raw = cfg.get("skip_extensions", list(DEFAULT_SKIP_EXTENSIONS))
+    if isinstance(skip_ext_raw, list):
+        skip_ext: tuple[str, ...] = tuple(str(s) for s in skip_ext_raw)
+    else:
+        skip_ext = DEFAULT_SKIP_EXTENSIONS
+
+    return rules, skip_patterns, indicators, skip_ext
+
+
+def _changed_files(staged_only: bool, repo_root: Path) -> list[str]:
+    """Return list of changed file paths relative to repo root."""
+    if staged_only:
+        cmd = ["git", "diff", "--cached", "--name-only", "--diff-filter=ACMR"]
+    else:
+        # Compare against origin/master for CI usage
+        cmd = ["git", "diff", "origin/master...HEAD", "--name-only", "--diff-filter=ACMR"]
+    result = subprocess.run(  # nosec B603, B607
+        cmd, capture_output=True, text=True, check=False, cwd=repo_root
+    )
+    if result.returncode != 0:
+        # fallback: just use staged files
+        result = subprocess.run(  # nosec B603, B607
+            ["git", "diff", "--cached", "--name-only", "--diff-filter=ACMR"],
+            capture_output=True,
+            text=True,
+            check=False,
+            cwd=repo_root,
+        )
+    return [line.strip() for line in result.stdout.splitlines() if line.strip()]
+
+
+def _is_test_file(filepath: str, indicators: list[str]) -> bool:
+    """Check if a file is a test file."""
+    return any(indicator in filepath for indicator in indicators)
+
+
+def _should_skip_file(
+    filepath: str,
+    skip_patterns: list[str],
+    skip_extensions: tuple[str, ...],
+) -> bool:
+    """Check if a file should be skipped."""
+    if filepath.startswith("."):
+        return True
+    if filepath.endswith(skip_extensions):
+        return True
+    name = Path(filepath).name
+    return any(fnmatch.fnmatch(name, pattern) or fnmatch.fnmatch(filepath, pattern) for pattern in skip_patterns)
+
+
+def _resolve_test_path(template: str, source_path: str, repo_root: Path) -> Path:
+    """Resolve a test path template to an actual path.
+
+    Templates can use:
+    - ``{name}`` — the source file's name (without extension)
+    - ``{module}`` — the source file's parent directory name
+    - ``{package_prefix}`` — underscore-joined subdirectories (for nested modules)
+    """
+    path = Path(source_path)
+    name = path.stem
+    module = path.parent.name
+
+    # Build package prefix for nested modules (e.g. scripts/utils/secrets.py -> utils)
+    parts = path.parts
+    package_prefix = ""
+    if len(parts) > 2:
+        package_prefix = "_".join(parts[1:-1])
+
+    resolved = template.format(
+        name=name,
+        module=module,
+        package_prefix=package_prefix,
+    )
+    # Normalize hyphens to underscores (Python module naming)
+    resolved = resolved.replace("-", "_")
+    return repo_root / resolved
+
+
+def _find_missing_tests(
+    files: list[str],
+    repo_root: Path,
+    rules: list[dict[str, object]],
+    skip_patterns: list[str],
+    test_indicators: list[str],
+    skip_extensions: tuple[str, ...],
+) -> dict[str, str]:
+    """Map each untested file to the reason it's untested."""
+    missing: dict[str, str] = {}
+
+    for f in files:
+        # Skip test files themselves
+        if _is_test_file(f, test_indicators):
+            continue
+
+        # Skip config, docs, meta files
+        if _should_skip_file(f, skip_patterns, skip_extensions):
+            continue
+
+        for rule in rules:
+            pattern = str(rule.get("source_pattern", ""))
+            if not fnmatch.fnmatch(f, pattern):
+                continue
+
+            test_templates = rule.get("test_paths", [])
+            if not isinstance(test_templates, list):
+                continue
+
+            description_template = str(rule.get("description", "Missing test for {f}"))
+
+            test_paths = [_resolve_test_path(str(t), f, repo_root) for t in test_templates]
+
+            # Check if any test path exists (with .py extension)
+            found = False
+            for tp in test_paths:
+                if tp.with_suffix(".py").exists() or tp.exists():
+                    found = True
+                    break
+
+            if not found:
+                # Format description with file info
+                name = Path(f).stem
+                missing[f] = description_template.format(
+                    name=name,
+                    f=f,
+                    test_name=f"test_{name}".replace("-", "_"),
+                )
+            break
+
+        # If no rule matched, the file is not checked (no test requirement)
+        # This is intentional — only files matching a rule need tests
+
+    return missing
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description=_("Check that changed files have corresponding tests"),
+    )
+    parser.add_argument(
+        "--staged-only",
+        action="store_true",
+        help=_("Only check staged files (for pre-commit)"),
+    )
+    parser.add_argument(
+        "--warn-only",
+        action="store_true",
+        help=_("Print warnings but always exit 0"),
+    )
+    args = parser.parse_args(argv)
+
+    repo_root = Path.cwd()
+    rules, skip_patterns, test_indicators, skip_extensions = _load_rules()
+
+    files = _changed_files(args.staged_only, repo_root)
+    if not files:
+        print(_("[check_test_coverage] No changed files to check."))
+        return 0
+
+    missing = _find_missing_tests(files, repo_root, rules, skip_patterns, test_indicators, skip_extensions)
+    if not missing:
+        print(f"[check_test_coverage] All {len(files)} changed file(s) have tests.")
+        return 0
+
+    print("[check_test_coverage] FAILED: missing tests for changed files:\n", file=sys.stderr)
+    for f, reason in missing.items():
+        print(f"  {f}", file=sys.stderr)
+        print(f"    -> {reason}", file=sys.stderr)
+
+    print(
+        "\n[check_test_coverage] Fix: add the missing test file(s) before committing.",
+        file=sys.stderr,
+    )
+
+    if args.warn_only:
+        return 0
+    return 1
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())
@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+"""Create a pull request with the correct title from the Vikunja task.
+
+This tool is run **after** pushing a feature branch.  It:
+
+1. Extracts the task ID from the branch name (e.g. ``DEVX-31-fix-foo`` → ``DEVX-31``).
+2. Fetches the Vikunja task title for that task ID.
+3. Creates a PR with title ``{TASK_PREFIX}-N: <vikunja task title>``.
+
+This eliminates manual PR title entry and ensures the title always
+matches the Vikunja task — which is what the auto-merge workflow
+validates.
+
+If a PR already exists for the branch, the tool prints its URL and
+exits successfully (idempotent).
+
+Usage::
+
+    python -m devx.tools.create_pr --branch DEVX-31-fix-foo
+
+The repository is auto-detected from ``DEVX_REPO_OWNER`` /
+``DEVX_REPO_NAME`` or ``GITHUB_REPOSITORY`` environment variables.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess  # nosec B404
+
+import click
+from dotenv import load_dotenv
+
+from devx.api_clients import GiteaClient, VikunjaClient
+from devx.config import (
+    DEFAULT_PER_PAGE,
+    GITEA_API_URL,
+    REPO_OWNER,
+    TASK_ID_RE,
+    TASK_PREFIX,
+    VIKUNJA_API_URL,
+    VIKUNJA_PROJECT_ID,
+)
+from devx.i18n import _
+
+load_dotenv()
+
+
+def get_repo_name() -> str:
+    """Auto-detect repository name from env vars or git remote."""
+    name = os.environ.get("DEVX_REPO_NAME", "")
+    if name:
+        return name
+    github_repo = os.environ.get("GITHUB_REPOSITORY", "")
+    if github_repo and "/" in github_repo:
+        return github_repo.split("/", 1)[1]
+    raise click.ClickException(
+        _("Repository name not set. Use DEVX_REPO_NAME or GITHUB_REPOSITORY env var."),
+    )
+
+
+def extract_task_id(branch: str) -> str:
+    """Extract the task ID (e.g. ``DEVX-31``) from a branch name."""
+    match = TASK_ID_RE.search(branch)
+    return match.group(0) if match else ""
+
+
+def get_vikunja_task_title(task_id: str) -> str:
+    """Fetch the Vikunja task title for the given task identifier.
+
+    Raises ClickException if VIKUNJA_TOKEN is not set or the task is not found.
+    """
+    token = os.environ.get("VIKUNJA_TOKEN", "")
+    if not token:
+        raise click.ClickException(_("VIKUNJA_TOKEN is not set. Required to derive PR title."))
+    client = VikunjaClient(VIKUNJA_API_URL, token)
+    page = 1
+    while True:
+        tasks = client.list_project_tasks(VIKUNJA_PROJECT_ID, page=page, per_page=DEFAULT_PER_PAGE)
+        if not tasks:
+            break
+        matches = [t for t in tasks if t.get("identifier") == task_id]
+        if matches:
+            return str(matches[0].get("title", ""))
+        if len(tasks) < DEFAULT_PER_PAGE:
+            break
+        page += 1
+    raise click.ClickException(
+        _(
+            "Could not find Vikunja task {task_id} in project {project_id}.",
+            task_id=task_id,
+            project_id=VIKUNJA_PROJECT_ID,
+        ),
+    )
+
+
+def find_existing_pr(client: GiteaClient, branch: str) -> dict | None:
+    """Return an existing open PR for the branch, or None."""
+    prs = client.list_prs(state="open")
+    for pr in prs:
+        if pr.get("head", {}).get("ref") == branch:
+            return pr
+    return None
+
+
+def create_pr(
+    branch: str,
+    base: str,
+    body: str,
+    repo_owner: str,
+    repo_name: str,
+) -> dict:
+    """Create a PR with the title derived from the Vikunja task.
+
+    Returns the PR dict from the Gitea API.
+    """
+    task_id = extract_task_id(branch)
+    if not task_id:
+        raise click.ClickException(
+            _(
+                "Branch '{branch}' does not contain a task ID.\n  Expected format: {prefix}-N-short-description",
+                branch=branch,
+                prefix=TASK_PREFIX,
+            ),
+        )
+
+    token = os.environ.get("REPO_TOKEN", "")
+    if not token:
+        raise click.ClickException(_("REPO_TOKEN is not set. Required to create a PR."))
+
+    vikunja_title = get_vikunja_task_title(task_id)
+    pr_title = f"{task_id}: {vikunja_title}"
+
+    client = GiteaClient(GITEA_API_URL, token, repo_owner, repo_name)
+
+    existing = find_existing_pr(client, branch)
+    if existing:
+        click.echo(
+            _(
+                "PR already exists: #{index} — {url}",
+                index=existing.get("number", "?"),
+                url=existing.get("html_url", ""),
+            ),
+        )
+        return existing
+
+    pr = client.create_pr(title=pr_title, head=branch, base=base, body=body)
+    click.echo(
+        _(
+            "Created PR #{index}: {title}\n  {url}",
+            index=pr.get("number", "?"),
+            title=pr_title,
+            url=pr.get("html_url", ""),
+        ),
+    )
+    return pr
+
+
+@click.command()
+@click.option("--branch", default=None, help="Head branch (default: auto-detect from git).")
+@click.option("--base", default="master", show_default=True, help="Base branch.")
+@click.option("--body", default="", help="PR body (markdown). Read from stdin if '-' is passed.")
+@click.option("--owner", default=None, help="Repository owner (default: DEVX_REPO_OWNER).")
+@click.option("--repo", default=None, help="Repository name (default: DEVX_REPO_NAME or GITHUB_REPOSITORY).")
+def cli(branch: str | None, base: str, body: str, owner: str | None, repo: str | None) -> None:
+    """Create a PR with the correct title from the Vikunja task."""
+    if branch is None:
+        result = subprocess.run(  # nosec
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if result.returncode != 0:
+            raise click.ClickException(
+                _("Could not detect current branch: {error}", error=result.stderr.strip()),
+            )
+        branch = result.stdout.strip()
+
+    if body == "-":
+        body = click.get_text_stream("stdin").read().strip()
+
+    repo_owner = owner or REPO_OWNER
+    if not repo_owner:
+        raise click.ClickException(_("Repository owner not set. Use --owner or DEVX_REPO_OWNER env var."))
+    repo_name = repo or get_repo_name()
+
+    create_pr(branch, base, body, repo_owner, repo_name)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Create a Vikunja task with a detailed HTML description.
+
+This tool is used during the planning phase of the development workflow
+to create a well-described task before any code is written.  The task
+identifier (e.g. ``DEVX-N``, ``GRM-N``, ``OBL-INFRA-N``) is then used
+to name the feature branch and the pull request.
+
+Usage::
+
+    python -m devx.tools.create_task --title "Add release automation" \\
+        --description "<h2>Overview</h2><p>Implement automated...</p>"
+
+The project ID and task prefix are read from ``DEVX_VIKUNJA_PROJECT_ID``
+and ``DEVX_TASK_PREFIX`` environment variables (or ``.env``).
+"""
+
+from __future__ import annotations
+
+import os
+
+import click
+from dotenv import load_dotenv
+
+from devx.api_clients import VikunjaClient
+from devx.config import TASK_PREFIX, VIKUNJA_API_URL, VIKUNJA_PROJECT_ID
+from devx.i18n import _
+
+load_dotenv()
+
+
+@click.command()
+@click.option("--title", required=True, help="Task title (becomes the Vikunja task title).")
+@click.option(
+    "--description",
+    default="",
+    help="Task description (HTML supported). Read from stdin if '-' is passed.",
+)
+@click.option("--project-id", type=int, default=None, help="Vikunja project ID (default: DEVX_VIKUNJA_PROJECT_ID).")
+def cli(title: str, description: str, project_id: int | None) -> None:
+    """Create a Vikunja task and print its identifier."""
+    token = os.environ.get("VIKUNJA_TOKEN", "")
+    if not token:
+        raise click.ClickException(_("VIKUNJA_TOKEN is not set. Set it in .env or environment."))
+
+    pid = project_id if project_id is not None else VIKUNJA_PROJECT_ID
+
+    if description == "-":
+        description = click.get_text_stream("stdin").read().strip()
+
+    client = VikunjaClient(VIKUNJA_API_URL, token)
+    task = client.create_task(pid, title, description)
+
+    identifier = task.get("identifier", "")
+    task_id = task.get("id", "")
+    click.echo(
+        _(
+            "Created Vikunja task: {identifier} (id={task_id})",
+            identifier=identifier,
+            task_id=task_id,
+        )
+    )
+    if identifier:
+        click.echo(
+            _(
+                "Next steps:\n"
+                "  1. git checkout master && git pull\n"
+                "  2. git checkout -b {prefix}-{num}-short-description\n"
+                "  3. Implement changes, commit with conventional commit format\n"
+                "  4. git push -u origin HEAD\n"
+                "  5. make create-pr  (creates PR with title: {identifier}: {title})",
+                prefix=TASK_PREFIX,
+                num=identifier.split("-")[-1] if "-" in identifier else "N",
+                identifier=identifier,
+                title=title,
+            )
+        )
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""Pre-push validation: ensure a Vikunja task exists for the branch.
+
+This tool is designed to run as a git pre-push hook.  It extracts the
+task ID from the branch name (e.g. ``DEVX-31-fix-foo`` → ``DEVX-31``)
+and verifies that a corresponding Vikunja task exists.
+
+If the task does not exist, the hook **fails with guidance** — it does
+not auto-create the task.  This prevents accidental pushes of branches
+without a planning task.
+
+Usage::
+
+    python -m devx.tools.pre_push_check --branch DEVX-31-fix-foo
+
+Exit codes:
+  0 — all checks passed, safe to push
+  1 — validation failed (missing task, missing token, etc.)
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess  # nosec B404
+
+import click
+from dotenv import load_dotenv
+
+from devx.api_clients import VikunjaClient
+from devx.config import DEFAULT_PER_PAGE, TASK_ID_RE, TASK_PREFIX, VIKUNJA_API_URL, VIKUNJA_PROJECT_ID
+from devx.i18n import _
+
+load_dotenv()
+
+
+def get_current_branch() -> str:
+    """Return the current git branch name, or empty string on error."""
+    result = subprocess.run(  # nosec
+        ["git", "rev-parse", "--abbrev-ref", "HEAD"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    return result.stdout.strip()
+
+
+def extract_task_id(branch: str) -> str:
+    """Extract the task ID (e.g. ``DEVX-31``) from a branch name."""
+    match = TASK_ID_RE.search(branch)
+    return match.group(0) if match else ""
+
+
+def task_exists(task_id: str) -> bool:
+    """Check if a Vikunja task with the given identifier exists.
+
+    Returns ``False`` if VIKUNJA_TOKEN is not set (soft-fail in local mode).
+    """
+    token = os.environ.get("VIKUNJA_TOKEN", "")
+    if not token:
+        return False
+    client = VikunjaClient(VIKUNJA_API_URL, token)
+    page = 1
+    while True:
+        tasks = client.list_project_tasks(VIKUNJA_PROJECT_ID, page=page, per_page=DEFAULT_PER_PAGE)
+        if not tasks:
+            break
+        if any(t.get("identifier") == task_id for t in tasks):
+            return True
+        if len(tasks) < DEFAULT_PER_PAGE:
+            break
+        page += 1
+    return False
+
+
+def validate(branch: str) -> None:
+    """Run all pre-push validations for the given branch.
+
+    Raises ``click.ClickException`` on failure.
+    """
+    if not branch or branch in ("master", "main"):
+        return
+
+    task_id = extract_task_id(branch)
+    if not task_id:
+        raise click.ClickException(
+            _(
+                "Branch '{branch}' does not contain a task ID.\n"
+                "  Expected format: {prefix}-N-short-description\n"
+                "  Example: {prefix}-42-add-feature\n"
+                "  Fix: rename the branch or create a Vikunja task first:\n"
+                '    python -m devx.tools.create_task --title "Task title"',
+                branch=branch,
+                prefix=TASK_PREFIX,
+            )
+        )
+
+    token = os.environ.get("VIKUNJA_TOKEN", "")
+    if not token:
+        click.echo(
+            _(
+                "WARNING: VIKUNJA_TOKEN not set — skipping task existence check. "
+                "Set it in .env to enable full validation.",
+            ),
+            err=True,
+        )
+        return
+
+    if not task_exists(task_id):
+        raise click.ClickException(
+            _(
+                "Vikunja task {task_id} not found in project {project_id}.\n"
+                "  Create it first:\n"
+                '    python -m devx.tools.create_task --title "Task title"\n'
+                "  Or check that the task ID in the branch name is correct.",
+                task_id=task_id,
+                project_id=VIKUNJA_PROJECT_ID,
+            )
+        )
+
+    click.echo(_("Pre-push check passed: task {task_id} exists.", task_id=task_id))
+
+
+@click.command()
+@click.option("--branch", default=None, help="Branch name (default: auto-detect from git).")
+def cli(branch: str | None) -> None:
+    """Validate pre-push preconditions for the current branch."""
+    if branch is None:
+        branch = get_current_branch()
+    validate(branch)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    cli()  # pragma: no cover
@@ -150,19 +150,29 @@ def _verify(bin_dir: str) -> None:
    default=False,
    help="Skip Ansible Galaxy collection installation.",
 )
+@click.option(
+    "--skip-install",
+    is_flag=True,
+    default=False,
+    help="Skip pip install (use when deps already installed, e.g. devx came via ci extra).",
+)
 def main(
    bin_dir: str,
    extras: str,
    no_pre_commit: bool,
    no_tea_login: bool,
    no_ansible_collections: bool,
+    skip_install: bool,
 ) -> None:
    """Install Python deps, pre-commit hooks, and configure tea CLI."""
    if not Path(bin_dir).exists():
        raise click.ClickException(f"Bin directory not found: {bin_dir}. Run 'python3 -m venv .venv' first.")

-    click.echo(f"Installing Python dependencies (extras: {extras})...")
-    _install_python_deps(bin_dir, extras)
+    if not skip_install:
+        click.echo(f"Installing Python dependencies (extras: {extras})...")
+        _install_python_deps(bin_dir, extras)
+    else:
+        click.echo("Skipping pip install (--skip-install).")

    if not no_ansible_collections:
        click.echo("Installing Ansible Galaxy collections...")
@@ -439,6 +439,14 @@
    "ru": "Настройка параметров репозитория...",
    "zh": "正在配置仓库设置..."
  },
+  "Configuration OK: [tool.devx] present, devx versions consistent.": {
+    "bg": "Конфигурацията е OK: [tool.devx] присъства, версиите на devx са консистентни.",
+    "de": "Konfiguration OK: [tool.devx] vorhanden, devx-Versionen konsistent.",
+    "en": "Configuration OK: [tool.devx] present, devx versions consistent.",
+    "pl": "Konfiguracja OK: [tool.devx] obecne, wersje devx spójne.",
+    "ru": "Конфигурация OK: [tool.devx] присутствует, версии devx согласованы.",
+    "zh": "配置正常: [tool.devx] 已存在, devx 版本一致。"
+  },
  "Could not extract conventional commit message from PR commits.": {
    "bg": "Could not extract conventional commit message from PR commits.",
    "de": "Could not extract conventional commit message from PR commits.",
@@ -487,6 +495,14 @@
    "ru": "Created release commit.",
    "zh": "Created release commit."
  },
+  "devx version mismatch across extras: {detail}": {
+    "bg": "несъответствие на версията на devx между extras: {detail}",
+    "de": "devx-Versionskonflikt zwischen Extras: {detail}",
+    "en": "devx version mismatch across extras: {detail}",
+    "pl": "niezgodność wersji devx między extras: {detail}",
+    "ru": "несоответствие версии devx между extras: {detail}",
+    "zh": "devx 版本在 extras 之间不一致: {detail}"
+  },
  "Docker daemon already running": {
    "bg": "Докер демонът вече работи",
    "de": "Docker-Daemon läuft bereits",
@@ -599,6 +615,14 @@
    "ru": "Generated {file} with prefix '{prefix}'.",
    "zh": "Generated {file} with prefix '{prefix}'."
  },
+  "Gitea PyPI registry: {tag} already published — continuing.": {
+    "bg": "Gitea PyPI registry: {tag} вече е публикуван — продължава.",
+    "de": "Gitea PyPI-Registry: {tag} bereits veröffentlicht — wird fortgesetzt.",
+    "en": "Gitea PyPI registry: {tag} already published — continuing.",
+    "pl": "Gitea PyPI registry: {tag} już opublikowano — kontynuacja.",
+    "ru": "Gitea PyPI registry: {tag} уже опубликован — продолжаем.",
+    "zh": "Gitea PyPI registry: {tag} 已发布 — 继续。"
+  },
  "Gitea release {tag} already exists — skipping creation.": {
    "bg": "Gitea release {tag} вече съществува — прескачане на създаването.",
    "de": "Gitea-Release {tag} existiert bereits — Erstellung übersprungen.",
@@ -631,6 +655,14 @@
    "ru": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping.",
    "zh": "HEAD is already a release commit ('{msg}') and tag {tag} points to HEAD. Skipping."
  },
+  "HEAD is not a release commit for {tag} — skipping publish.": {
+    "bg": "HEAD is not a release commit for {tag} — skipping publish.",
+    "de": "HEAD is not a release commit for {tag} — skipping publish.",
+    "en": "HEAD is not a release commit for {tag} — skipping publish.",
+    "pl": "HEAD nie jest commitem wydania dla {tag} — pomijanie publikacji.",
+    "ru": "HEAD is not a release commit for {tag} — skipping publish.",
+    "zh": "HEAD is not a release commit for {tag} — skipping publish."
+  },
  "HTTP error: {status} — {message}": {
    "bg": "HTTP грешка: {status} — {message}",
    "de": "HTTP-Fehler: {status} — {message}",
@@ -791,6 +823,14 @@
    "ru": "No staged changes — version and changelog already up to date.",
    "zh": "No staged changes — version and changelog already up to date."
  },
+  "No tag found — skipping publish.": {
+    "bg": "No tag found — skipping publish.",
+    "de": "No tag found — skipping publish.",
+    "en": "No tag found — skipping publish.",
+    "pl": "Nie znaleziono tagu — pomijanie publikacji.",
+    "ru": "No tag found — skipping publish.",
+    "zh": "No tag found — skipping publish."
+  },
  "No tags found — treating all changes as user-facing.": {
    "bg": "No tags found — treating all changes as user-facing.",
    "de": "No tags found — treating all changes as user-facing.",
@@ -911,14 +951,6 @@
    "ru": "Ой! Публикация в PyPI не удалась:\n{stderr}",
    "zh": "哎呀！PyPI 发布失败：\n{stderr}"
  },
-  "PyPI publish failed (non-fatal — continuing to Gitea release):\n{error}": {
-    "bg": "Публикуването в PyPI неуспешно (некритично — продължава към Gitea release):\n{error}",
-    "de": "PyPI-Veröffentlichung fehlgeschlagen (nicht fatal — Gitea-Release wird fortgesetzt):\n{error}",
-    "en": "PyPI publish failed (non-fatal — continuing to Gitea release):\n{error}",
-    "pl": "Publikacja PyPI nie powiodła się (niekrytyczne — kontynuacja Gitea release):\n{error}",
-    "ru": "Публикация в PyPI не удалась (некритично — продолжаем создание Gitea release):\n{error}",
-    "zh": "PyPI 发布失败（非致命 — 继续创建 Gitea release）：\n{error}"
-  },
  "PASSED: {pair}": {
    "bg": "PASSED: {pair}",
    "de": "PASSED: {pair}",
@@ -967,6 +999,14 @@
    "ru": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
    "zh": "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit."
  },
+  "Provide a commit message file or use --git.": {
+    "bg": "Provide a commit message file or use --git.",
+    "de": "Provide a commit message file or use --git.",
+    "en": "Provide a commit message file or use --git.",
+    "pl": "Podaj plik komunikatu commitu lub użyj --git.",
+    "ru": "Provide a commit message file or use --git.",
+    "zh": "Provide a commit message file or use --git."
+  },
  "Published to Gitea PyPI registry.": {
    "bg": "Публикувано в Gitea PyPI registry.",
    "de": "In der Gitea PyPI-Registry veröffentlicht.",
@@ -975,14 +1015,6 @@
    "ru": "Опубликовано в Gitea PyPI registry.",
    "zh": "已发布到 Gitea PyPI registry。"
  },
-  "Gitea PyPI registry: {tag} already published — continuing.": {
-    "bg": "Gitea PyPI registry: {tag} вече е публикуван — продължава.",
-    "de": "Gitea PyPI-Registry: {tag} bereits veröffentlicht — wird fortgesetzt.",
-    "en": "Gitea PyPI registry: {tag} already published — continuing.",
-    "pl": "Gitea PyPI registry: {tag} już opublikowano — kontynuacja.",
-    "ru": "Gitea PyPI registry: {tag} уже опубликован — продолжаем.",
-    "zh": "Gitea PyPI registry: {tag} 已发布 — 继续。"
-  },
  "Published to PyPI.": {
    "bg": "Публикувано в PyPI.",
    "de": "In PyPI veröffentlicht.",
@@ -991,6 +1023,14 @@
    "ru": "Опубликовано в PyPI.",
    "zh": "已发布到 PyPI。"
  },
+  "Publishing release {tag}...": {
+    "bg": "Publishing release {tag}...",
+    "de": "Publishing release {tag}...",
+    "en": "Publishing release {tag}...",
+    "pl": "Publikowanie wydania {tag}...",
+    "ru": "Publishing release {tag}...",
+    "zh": "Publishing release {tag}..."
+  },
  "Pushed release commit to master.": {
    "bg": "Pushed release commit to master.",
    "de": "Pushed release commit to master.",
@@ -999,6 +1039,14 @@
    "ru": "Pushed release commit to master.",
    "zh": "Pushed release commit to master."
  },
+  "PyPI publish failed (non-fatal — continuing to Gitea release):\n{error}": {
+    "bg": "Публикуването в PyPI неуспешно (некритично — продължава към Gitea release):\n{error}",
+    "de": "PyPI-Veröffentlichung fehlgeschlagen (nicht fatal — Gitea-Release wird fortgesetzt):\n{error}",
+    "en": "PyPI publish failed (non-fatal — continuing to Gitea release):\n{error}",
+    "pl": "Publikacja PyPI nie powiodła się (niekrytyczne — kontynuacja Gitea release):\n{error}",
+    "ru": "Публикация в PyPI не удалась (некритично — продолжаем создание Gitea release):\n{error}",
+    "zh": "PyPI 发布失败（非致命 — 继续创建 Gitea release）：\n{error}"
+  },
  "Release creation failed: {error}": {
    "bg": "Release creation failed: {error}",
    "de": "Release creation failed: {error}",
@@ -1095,6 +1143,22 @@
    "ru": "Tag consistency check failed.",
    "zh": "Tag consistency check failed."
  },
+  "Tag is required (or use --from-tag).": {
+    "bg": "Tag is required (or use --from-tag).",
+    "de": "Tag is required (or use --from-tag).",
+    "en": "Tag is required (or use --from-tag).",
+    "pl": "Tag jest wymagany (lub użyj --from-tag).",
+    "ru": "Tag is required (or use --from-tag).",
+    "zh": "Tag is required (or use --from-tag)."
+  },
+  "REPO argument is required (or set GITHUB_REPOSITORY env var).": {
+    "bg": "REPO argument is required (or set GITHUB_REPOSITORY env var).",
+    "de": "REPO argument is required (or set GITHUB_REPOSITORY env var).",
+    "en": "REPO argument is required (or set GITHUB_REPOSITORY env var).",
+    "pl": "Argument REPO jest wymagany (lub ustaw zmienną GITHUB_REPOSITORY).",
+    "ru": "REPO argument is required (or set GITHUB_REPOSITORY env var).",
+    "zh": "REPO argument is required (or set GITHUB_REPOSITORY env var)."
+  },
  "Tag v{version} already existed. Publish workflow should already have been triggered.": {
    "bg": "Tag v{version} already existed. Publish workflow should already have been triggered.",
    "de": "Tag v{version} already existed. Publish workflow should already have been triggered.",
@@ -1255,6 +1319,14 @@
    "ru": "Wiki verification failed — {failures} page(s) empty or mismatched",
    "zh": "Wiki verification failed — {failures} page(s) empty or mismatched"
  },
+  "[tool.devx] missing required keys: {keys}": {
+    "bg": "[tool.devx] липсват задължителни ключове: {keys}",
+    "de": "[tool.devx] fehlt erforderliche Schlüssel: {keys}",
+    "en": "[tool.devx] missing required keys: {keys}",
+    "pl": "[tool.devx] brak wymaganych kluczy: {keys}",
+    "ru": "[tool.devx] отсутствуют обязательные ключи: {keys}",
+    "zh": "[tool.devx] 缺少必需的键: {keys}"
+  },
  "[dry-run] Would commit: release: v{version}": {
    "bg": "[dry-run] Would commit: release: v{version}",
    "de": "[dry-run] Would commit: release: v{version}",
@@ -1407,6 +1479,14 @@
    "ru": "ожидает",
    "zh": "待处理"
  },
+  "pyproject.toml not found in current directory.": {
+    "bg": "pyproject.toml не е намерен в текущата директория.",
+    "de": "pyproject.toml im aktuellen Verzeichnis nicht gefunden.",
+    "en": "pyproject.toml not found in current directory.",
+    "pl": "nie znaleziono pyproject.toml w bieżącym katalogu.",
+    "ru": "pyproject.toml не найден в текущей директории.",
+    "zh": "在当前目录中未找到 pyproject.toml。"
+  },
  "unknown": {
    "bg": "неизвестен",
    "de": "unbekannt",
@@ -1422,5 +1502,357 @@
    "pl": "{file} już istnieje. Użyj --force, aby nadpisać.",
    "ru": "{file} already exists. Use --force to overwrite.",
    "zh": "{file} already exists. Use --force to overwrite."
+  },
+  "Branch '{branch}' does not contain a task ID.\n  Expected format: {prefix}-N-short-description": {
+    "bg": "Клон '{branch}' не съдържа ID на задача.\n  Очакван формат: {prefix}-N-кратко-описание",
+    "de": "Branch '{branch}' enthält keine Task-ID.\n  Erwartetes Format: {prefix}-N-kurz-beschreibung",
+    "en": "Branch '{branch}' does not contain a task ID.\n  Expected format: {prefix}-N-short-description",
+    "pl": "Gałąź '{branch}' nie zawiera ID zadania.\n  Oczekiwany format: {prefix}-N-krótki-opis",
+    "ru": "Ветка '{branch}' не содержит ID задачи.\n  Ожидаемый формат: {prefix}-N-краткое-описание",
+    "zh": "分支 '{branch}' 不包含任务 ID。\n  预期格式: {prefix}-N-简短描述"
+  },
+  "Branch '{branch}' does not contain a task ID.\n  Expected format: {prefix}-N-short-description\n  Example: {prefix}-42-add-feature\n  Fix: rename the branch or create a Vikunja task first:\n    python -m devx.tools.create_task --title \"Task title\"": {
+    "bg": "Клон '{branch}' не съдържа ID на задача.\n  Очакван формат: {prefix}-N-кратко-описание\n  Пример: {prefix}-42-add-feature\n  Решение: преименувайте клона или създайте Vikunja задача:\n    python -m devx.tools.create_task --title \"Заглавие на задача\"",
+    "de": "Branch '{branch}' enthält keine Task-ID.\n  Erwartetes Format: {prefix}-N-kurz-beschreibung\n  Beispiel: {prefix}-42-add-feature\n  Fix: Branch umbenennen oder Vikunja-Task erstellen:\n    python -m devx.tools.create_task --title \"Task-Titel\"",
+    "en": "Branch '{branch}' does not contain a task ID.\n  Expected format: {prefix}-N-short-description\n  Example: {prefix}-42-add-feature\n  Fix: rename the branch or create a Vikunja task first:\n    python -m devx.tools.create_task --title \"Task title\"",
+    "pl": "Gałąź '{branch}' nie zawiera ID zadania.\n  Oczekiwany format: {prefix}-N-krótki-opis\n  Przykład: {prefix}-42-add-feature\n  Naprawa: zmień nazwę gałęzi lub utwórz zadanie Vikunja:\n    python -m devx.tools.create_task --title \"Tytuł zadania\"",
+    "ru": "Ветка '{branch}' не содержит ID задачи.\n  Ожидаемый формат: {prefix}-N-краткое-описание\n  Пример: {prefix}-42-add-feature\n  Исправление: переименуйте ветку или создайте задачу Vikunja:\n    python -m devx.tools.create_task --title \"Заголовок задачи\"",
+    "zh": "分支 '{branch}' 不包含任务 ID。\n  预期格式: {prefix}-N-简短描述\n  示例: {prefix}-42-add-feature\n  修复: 重命名分支或先创建 Vikunja 任务:\n    python -m devx.tools.create_task --title \"任务标题\""
+  },
+  "Could not find Vikunja task {task_id} in project {project_id}.": {
+    "bg": "Не е намерена Vikunja задача {task_id} в проект {project_id}.",
+    "de": "Vikunja-Task {task_id} in Projekt {project_id} nicht gefunden.",
+    "en": "Could not find Vikunja task {task_id} in project {project_id}.",
+    "pl": "Nie znaleziono zadania Vikunja {task_id} w projekcie {project_id}.",
+    "ru": "Не найдена задача Vikunja {task_id} в проекте {project_id}.",
+    "zh": "在项目 {project_id} 中找不到 Vikunja 任务 {task_id}。"
+  },
+  "Could not detect current branch: {error}": {
+    "bg": "Не може да се определи текущия клон: {error}",
+    "de": "Aktueller Branch konnte nicht erkannt werden: {error}",
+    "en": "Could not detect current branch: {error}",
+    "pl": "Nie można wykryć bieżącej gałęzi: {error}",
+    "ru": "Не удалось определить текущую ветку: {error}",
+    "zh": "无法检测当前分支: {error}"
+  },
+  "Created PR #{index}: {title}\n  {url}": {
+    "bg": "Създаден PR #{index}: {title}\n  {url}",
+    "de": "PR erstellt #{index}: {title}\n  {url}",
+    "en": "Created PR #{index}: {title}\n  {url}",
+    "pl": "Utworzono PR #{index}: {title}\n  {url}",
+    "ru": "Создан PR #{index}: {title}\n  {url}",
+    "zh": "已创建 PR #{index}: {title}\n  {url}"
+  },
+  "Created Vikunja task: {identifier} (id={task_id})": {
+    "bg": "Създадена Vikunja задача: {identifier} (id={task_id})",
+    "de": "Vikunja-Task erstellt: {identifier} (id={task_id})",
+    "en": "Created Vikunja task: {identifier} (id={task_id})",
+    "pl": "Utworzono zadanie Vikunja: {identifier} (id={task_id})",
+    "ru": "Создана задача Vikunja: {identifier} (id={task_id})",
+    "zh": "已创建 Vikunja 任务: {identifier} (id={task_id})"
+  },
+  "Next steps:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-short-description\n  3. Implement changes, commit with conventional commit format\n  4. git push -u origin HEAD\n  5. make create-pr  (creates PR with title: {identifier}: {title})": {
+    "bg": "Следващи стъпки:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-кратко-описание\n  3. Имплементирайте промените, commit с conventional commit формат\n  4. git push -u origin HEAD\n  5. make create-pr  (създава PR с заглавие: {identifier}: {title})",
+    "de": "Nächste Schritte:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-kurz-beschreibung\n  3. Änderungen implementieren, mit Conventional-Commit-Format committen\n  4. git push -u origin HEAD\n  5. make create-pr  (erstellt PR mit Titel: {identifier}: {title})",
+    "en": "Next steps:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-short-description\n  3. Implement changes, commit with conventional commit format\n  4. git push -u origin HEAD\n  5. make create-pr  (creates PR with title: {identifier}: {title})",
+    "pl": "Następne kroki:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-krótki-opis\n  3. Wprowadź zmiany, commituj w formacie conventional commit\n  4. git push -u origin HEAD\n  5. make create-pr  (tworzy PR z tytułem: {identifier}: {title})",
+    "ru": "Следующие шаги:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-краткое-описание\n  3. Реализуйте изменения, коммитьте в conventional commit формате\n  4. git push -u origin HEAD\n  5. make create-pr  (создаёт PR с заголовком: {identifier}: {title})",
+    "zh": "后续步骤:\n  1. git checkout master && git pull\n  2. git checkout -b {prefix}-{num}-简短描述\n  3. 实现更改，使用 conventional commit 格式提交\n  4. git push -u origin HEAD\n  5. make create-pr  (创建 PR，标题: {identifier}: {title})"
+  },
+  "PR already exists: #{index} — {url}": {
+    "bg": "PR вече съществува: #{index} — {url}",
+    "de": "PR existiert bereits: #{index} — {url}",
+    "en": "PR already exists: #{index} — {url}",
+    "pl": "PR już istnieje: #{index} — {url}",
+    "ru": "PR уже существует: #{index} — {url}",
+    "zh": "PR 已存在: #{index} — {url}"
+  },
+  "Pre-push check passed: task {task_id} exists.": {
+    "bg": "Pre-push проверката премина: задача {task_id} съществува.",
+    "de": "Pre-push-Prüfung bestanden: Task {task_id} existiert.",
+    "en": "Pre-push check passed: task {task_id} exists.",
+    "pl": "Sprawdzanie pre-push zakończone: zadanie {task_id} istnieje.",
+    "ru": "Pre-push проверка пройдена: задача {task_id} существует.",
+    "zh": "Pre-push 检查通过: 任务 {task_id} 存在。"
+  },
+  "REPO_TOKEN is not set. Required to create a PR.": {
+    "bg": "REPO_TOKEN не е зададен. Необходим за създаване на PR.",
+    "de": "REPO_TOKEN nicht gesetzt. Erforderlich zum Erstellen eines PR.",
+    "en": "REPO_TOKEN is not set. Required to create a PR.",
+    "pl": "REPO_TOKEN nie jest ustawiony. Wymagany do utworzenia PR.",
+    "ru": "REPO_TOKEN не установлен. Требуется для создания PR.",
+    "zh": "REPO_TOKEN 未设置。创建 PR 所需。"
+  },
+  "Repository name not set. Use DEVX_REPO_NAME or GITHUB_REPOSITORY env var.": {
+    "bg": "Името на хранилището не е зададено. Използвайте DEVX_REPO_NAME или GITHUB_REPOSITORY env var.",
+    "de": "Repository-Name nicht gesetzt. Verwende DEVX_REPO_NAME oder GITHUB_REPOSITORY env var.",
+    "en": "Repository name not set. Use DEVX_REPO_NAME or GITHUB_REPOSITORY env var.",
+    "pl": "Nazwa repozytorium nie jest ustawiona. Użyj DEVX_REPO_NAME lub GITHUB_REPOSITORY env var.",
+    "ru": "Имя репозитория не установлено. Используйте DEVX_REPO_NAME или GITHUB_REPOSITORY env var.",
+    "zh": "仓库名称未设置。使用 DEVX_REPO_NAME 或 GITHUB_REPOSITORY 环境变量。"
+  },
+  "Repository owner not set. Use --owner or DEVX_REPO_OWNER env var.": {
+    "bg": "Собственикът на хранилището не е зададен. Използвайте --owner или DEVX_REPO_OWNER env var.",
+    "de": "Repository-Owner nicht gesetzt. Verwende --owner oder DEVX_REPO_OWNER env var.",
+    "en": "Repository owner not set. Use --owner or DEVX_REPO_OWNER env var.",
+    "pl": "Właściciel repozytorium nie jest ustawiony. Użyj --owner lub DEVX_REPO_OWNER env var.",
+    "ru": "Владелец репозитория не установлен. Используйте --owner или DEVX_REPO_OWNER env var.",
+    "zh": "仓库所有者未设置。使用 --owner 或 DEVX_REPO_OWNER 环境变量。"
+  },
+  "VIKUNJA_TOKEN is not set. Required to derive PR title.": {
+    "bg": "VIKUNJA_TOKEN не е зададен. Необходим за извличане на PR заглавие.",
+    "de": "VIKUNJA_TOKEN nicht gesetzt. Erforderlich zum Ableiten des PR-Titels.",
+    "en": "VIKUNJA_TOKEN is not set. Required to derive PR title.",
+    "pl": "VIKUNJA_TOKEN nie jest ustawiony. Wymagany do pobrania tytułu PR.",
+    "ru": "VIKUNJA_TOKEN не установлен. Требуется для получения заголовка PR.",
+    "zh": "VIKUNJA_TOKEN 未设置。推导 PR 标题所需。"
+  },
+  "VIKUNJA_TOKEN is not set. Set it in .env or environment.": {
+    "bg": "VIKUNJA_TOKEN не е зададен. Задайте го в .env или средата.",
+    "de": "VIKUNJA_TOKEN nicht gesetzt. In .env oder Umgebung setzen.",
+    "en": "VIKUNJA_TOKEN is not set. Set it in .env or environment.",
+    "pl": "VIKUNJA_TOKEN nie jest ustawiony. Ustaw go w .env lub środowisku.",
+    "ru": "VIKUNJA_TOKEN не установлен. Установите его в .env или среде.",
+    "zh": "VIKUNJA_TOKEN 未设置。在 .env 或环境中设置它。"
+  },
+  "Vikunja task {task_id} not found in project {project_id}.\n  Create it first:\n    python -m devx.tools.create_task --title \"Task title\"\n  Or check that the task ID in the branch name is correct.": {
+    "bg": "Vikunja задача {task_id} не е намерена в проект {project_id}.\n  Създайте я първо:\n    python -m devx.tools.create_task --title \"Заглавие на задача\"\n  Или проверете че ID на задачата в името на клона е правилно.",
+    "de": "Vikunja-Task {task_id} in Projekt {project_id} nicht gefunden.\n  Zuerst erstellen:\n    python -m devx.tools.create_task --title \"Task-Titel\"\n  Oder prüfen, ob die Task-ID im Branch-Namen korrekt ist.",
+    "en": "Vikunja task {task_id} not found in project {project_id}.\n  Create it first:\n    python -m devx.tools.create_task --title \"Task title\"\n  Or check that the task ID in the branch name is correct.",
+    "pl": "Zadanie Vikunja {task_id} nie znalezione w projekcie {project_id}.\n  Utwórz je najpierw:\n    python -m devx.tools.create_task --title \"Tytuł zadania\"\n  Lub sprawdź, czy ID zadania w nazwie gałęzi jest poprawne.",
+    "ru": "Задача Vikunja {task_id} не найдена в проекте {project_id}.\n  Сначала создайте её:\n    python -m devx.tools.create_task --title \"Заголовок задачи\"\n  Или проверьте, что ID задачи в имени ветки корректен.",
+    "zh": "在项目 {project_id} 中找不到 Vikunja 任务 {task_id}。\n  请先创建:\n    python -m devx.tools.create_task --title \"任务标题\"\n  或检查分支名称中的任务 ID 是否正确。"
+  },
+  "WARNING: VIKUNJA_TOKEN not set — skipping task existence check. Set it in .env to enable full validation.": {
+    "bg": "ПРЕДУПРЕЖДЕНИЕ: VIKUNJA_TOKEN не е зададен — пропускане на проверката за съществуване на задача. Задайте го в .env за пълна валидация.",
+    "de": "WARNUNG: VIKUNJA_TOKEN nicht gesetzt — Task-Existenzprüfung übersprungen. In .env setzen für volle Validierung.",
+    "en": "WARNING: VIKUNJA_TOKEN not set — skipping task existence check. Set it in .env to enable full validation.",
+    "pl": "OSTRZEŻENIE: VIKUNJA_TOKEN nie jest ustawiony — pomijanie sprawdzania istnienia zadania. Ustaw w .env, aby włączyć pełną walidację.",
+    "ru": "ПРЕДУПРЕЖДЕНИЕ: VIKUNJA_TOKEN не установлен — пропуск проверки существования задачи. Установите в .env для полной проверки.",
+    "zh": "警告: VIKUNJA_TOKEN 未设置 — 跳过任务存在性检查。在 .env 中设置以启用完整验证。"
+  },
+  "[check-mutable-globals] Passed: no mutable path globals found": {
+    "bg": "[check-mutable-globals] Passed: no mutable path globals found",
+    "de": "[check-mutable-globals] Passed: no mutable path globals found",
+    "en": "[check-mutable-globals] Passed: no mutable path globals found",
+    "pl": "[check-mutable-globals] Passed: no mutable path globals found",
+    "ru": "[check-mutable-globals] Passed: no mutable path globals found",
+    "zh": "[check-mutable-globals] Passed: no mutable path globals found"
+  },
+  "[check_agent_docs] Passed: scanned {count} file(s), no stale references": {
+    "bg": "[check_agent_docs] Passed: scanned {count} file(s), no stale references",
+    "de": "[check_agent_docs] Passed: scanned {count} file(s), no stale references",
+    "en": "[check_agent_docs] Passed: scanned {count} file(s), no stale references",
+    "pl": "[check_agent_docs] Passed: scanned {count} file(s), no stale references",
+    "ru": "[check_agent_docs] Passed: scanned {count} file(s), no stale references",
+    "zh": "[check_agent_docs] Passed: scanned {count} file(s), no stale references"
+  },
+  "[check_test_coverage] No changed files to check.": {
+    "bg": "[check_test_coverage] No changed files to check.",
+    "de": "[check_test_coverage] No changed files to check.",
+    "en": "[check_test_coverage] No changed files to check.",
+    "pl": "[check_test_coverage] No changed files to check.",
+    "ru": "[check_test_coverage] No changed files to check.",
+    "zh": "[check_test_coverage] No changed files to check."
+  },
+  "Additional directory to scan (default: scripts, tests). Can be repeated.": {
+    "bg": "Additional directory to scan (default: scripts, tests). Can be repeated.",
+    "de": "Additional directory to scan (default: scripts, tests). Can be repeated.",
+    "en": "Additional directory to scan (default: scripts, tests). Can be repeated.",
+    "pl": "Additional directory to scan (default: scripts, tests). Can be repeated.",
+    "ru": "Additional directory to scan (default: scripts, tests). Can be repeated.",
+    "zh": "Additional directory to scan (default: scripts, tests). Can be repeated."
+  },
+  "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master": {
+    "bg": "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master",
+    "de": "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master",
+    "en": "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master",
+    "pl": "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master",
+    "ru": "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master",
+    "zh": "Branch is behind origin/master. Rebase first: git fetch origin master && git rebase origin/master"
+  },
+  "Branch name (e.g., DEVX-256-fix-foo)": {
+    "bg": "Branch name (e.g., DEVX-256-fix-foo)",
+    "de": "Branch name (e.g., DEVX-256-fix-foo)",
+    "en": "Branch name (e.g., DEVX-256-fix-foo)",
+    "pl": "Branch name (e.g., DEVX-256-fix-foo)",
+    "ru": "Branch name (e.g., DEVX-256-fix-foo)",
+    "zh": "Branch name (e.g., DEVX-256-fix-foo)"
+  },
+  "Branch name must contain a task ID.": {
+    "bg": "Branch name must contain a task ID.",
+    "de": "Branch name must contain a task ID.",
+    "en": "Branch name must contain a task ID.",
+    "pl": "Branch name must contain a task ID.",
+    "ru": "Branch name must contain a task ID.",
+    "zh": "Branch name must contain a task ID."
+  },
+  "Check that changed files have corresponding tests": {
+    "bg": "Check that changed files have corresponding tests",
+    "de": "Check that changed files have corresponding tests",
+    "en": "Check that changed files have corresponding tests",
+    "pl": "Check that changed files have corresponding tests",
+    "ru": "Check that changed files have corresponding tests",
+    "zh": "Check that changed files have corresponding tests"
+  },
+  "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found).": {
+    "bg": "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found).",
+    "de": "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found).",
+    "en": "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found).",
+    "pl": "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found).",
+    "ru": "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found).",
+    "zh": "Could not fetch PR title from Gitea (REPO_TOKEN not set or PR not found)."
+  },
+  "Dependencies must have documentation comments.": {
+    "bg": "Dependencies must have documentation comments.",
+    "de": "Dependencies must have documentation comments.",
+    "en": "Dependencies must have documentation comments.",
+    "pl": "Dependencies must have documentation comments.",
+    "ru": "Dependencies must have documentation comments.",
+    "zh": "Dependencies must have documentation comments."
+  },
+  "FAILED: {count} undocumented dependency/ies": {
+    "bg": "FAILED: {count} undocumented dependency/ies",
+    "de": "FAILED: {count} undocumented dependency/ies",
+    "en": "FAILED: {count} undocumented dependency/ies",
+    "pl": "FAILED: {count} undocumented dependency/ies",
+    "ru": "FAILED: {count} undocumented dependency/ies",
+    "zh": "FAILED: {count} undocumented dependency/ies"
+  },
+  "Found {count} mutable global(s) — use factory functions or pytest fixtures.": {
+    "bg": "Found {count} mutable global(s) — use factory functions or pytest fixtures.",
+    "de": "Found {count} mutable global(s) — use factory functions or pytest fixtures.",
+    "en": "Found {count} mutable global(s) — use factory functions or pytest fixtures.",
+    "pl": "Found {count} mutable global(s) — use factory functions or pytest fixtures.",
+    "ru": "Found {count} mutable global(s) — use factory functions or pytest fixtures.",
+    "zh": "Found {count} mutable global(s) — use factory functions or pytest fixtures."
+  },
+  "Found {count} stale documentation reference(s)": {
+    "bg": "Found {count} stale documentation reference(s)",
+    "de": "Found {count} stale documentation reference(s)",
+    "en": "Found {count} stale documentation reference(s)",
+    "pl": "Found {count} stale documentation reference(s)",
+    "ru": "Found {count} stale documentation reference(s)",
+    "zh": "Found {count} stale documentation reference(s)"
+  },
+  "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.": {
+    "bg": "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
+    "de": "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
+    "en": "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
+    "pl": "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
+    "ru": "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description.",
+    "zh": "No task ID found in branch name '{branch}'. Expected format: {prefix}-N-description."
+  },
+  "Only check staged files (for pre-commit)": {
+    "bg": "Only check staged files (for pre-commit)",
+    "de": "Only check staged files (for pre-commit)",
+    "en": "Only check staged files (for pre-commit)",
+    "pl": "Only check staged files (for pre-commit)",
+    "ru": "Only check staged files (for pre-commit)",
+    "zh": "Only check staged files (for pre-commit)"
+  },
+  "PR number (to fetch title from Gitea)": {
+    "bg": "PR number (to fetch title from Gitea)",
+    "de": "PR number (to fetch title from Gitea)",
+    "en": "PR number (to fetch title from Gitea)",
+    "pl": "PR number (to fetch title from Gitea)",
+    "ru": "PR number (to fetch title from Gitea)",
+    "zh": "PR number (to fetch title from Gitea)"
+  },
+  "PR title (auto-fetched if --pr-number given)": {
+    "bg": "PR title (auto-fetched if --pr-number given)",
+    "de": "PR title (auto-fetched if --pr-number given)",
+    "en": "PR title (auto-fetched if --pr-number given)",
+    "pl": "PR title (auto-fetched if --pr-number given)",
+    "ru": "PR title (auto-fetched if --pr-number given)",
+    "zh": "PR title (auto-fetched if --pr-number given)"
+  },
+  "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}": {
+    "bg": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
+    "de": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
+    "en": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
+    "pl": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
+    "ru": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}",
+    "zh": "PR title does not match Vikunja task title.\n  Expected: {expected}\n  Got:      {title}"
+  },
+  "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}": {
+    "bg": "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
+    "de": "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
+    "en": "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
+    "pl": "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
+    "ru": "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}",
+    "zh": "PR title must follow format '{prefix}-N: <task title>'.\n  Got: {title}"
+  },
+  "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}": {
+    "bg": "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
+    "de": "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
+    "en": "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
+    "pl": "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
+    "ru": "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}",
+    "zh": "PR title task ID mismatch.\n  Branch task ID: {task_id}\n  PR title:       {title}"
+  },
+  "Path to pyproject.toml (default: pyproject.toml in CWD).": {
+    "bg": "Path to pyproject.toml (default: pyproject.toml in CWD).",
+    "de": "Path to pyproject.toml (default: pyproject.toml in CWD).",
+    "en": "Path to pyproject.toml (default: pyproject.toml in CWD).",
+    "pl": "Path to pyproject.toml (default: pyproject.toml in CWD).",
+    "ru": "Path to pyproject.toml (default: pyproject.toml in CWD).",
+    "zh": "Path to pyproject.toml (default: pyproject.toml in CWD)."
+  },
+  "Pre-merge validation failed.": {
+    "bg": "Pre-merge validation failed.",
+    "de": "Pre-merge validation failed.",
+    "en": "Pre-merge validation failed.",
+    "pl": "Pre-merge validation failed.",
+    "ru": "Pre-merge validation failed.",
+    "zh": "Pre-merge validation failed."
+  },
+  "Print warnings but always exit 0": {
+    "bg": "Print warnings but always exit 0",
+    "de": "Print warnings but always exit 0",
+    "en": "Print warnings but always exit 0",
+    "pl": "Print warnings but always exit 0",
+    "ru": "Print warnings but always exit 0",
+    "zh": "Print warnings but always exit 0"
+  },
+  "Repository in owner/name format": {
+    "bg": "Repository in owner/name format",
+    "de": "Repository in owner/name format",
+    "en": "Repository in owner/name format",
+    "pl": "Repository in owner/name format",
+    "ru": "Repository in owner/name format",
+    "zh": "Repository in owner/name format"
+  },
+  "Skip Vikunja title match check": {
+    "bg": "Skip Vikunja title match check",
+    "de": "Skip Vikunja title match check",
+    "en": "Skip Vikunja title match check",
+    "pl": "Skip Vikunja title match check",
+    "ru": "Skip Vikunja title match check",
+    "zh": "Skip Vikunja title match check"
+  },
+  "Skip branch-behind-master check": {
+    "bg": "Skip branch-behind-master check",
+    "de": "Skip branch-behind-master check",
+    "en": "Skip branch-behind-master check",
+    "pl": "Skip branch-behind-master check",
+    "ru": "Skip branch-behind-master check",
+    "zh": "Skip branch-behind-master check"
+  },
+  "[check-dep-docs] Passed: all dependencies are documented": {
+    "bg": "[check-dep-docs] Passed: all dependencies are documented",
+    "de": "[check-dep-docs] Passed: all dependencies are documented",
+    "en": "[check-dep-docs] Passed: all dependencies are documented",
+    "pl": "[check-dep-docs] Passed: all dependencies are documented",
+    "ru": "[check-dep-docs] Passed: all dependencies are documented",
+    "zh": "[check-dep-docs] Passed: all dependencies are documented"
+  },
+  "Wrote tag {tag} to GITHUB_OUTPUT.": {
+    "bg": "Wrote tag {tag} to GITHUB_OUTPUT.",
+    "de": "Wrote tag {tag} to GITHUB_OUTPUT.",
+    "en": "Wrote tag {tag} to GITHUB_OUTPUT.",
+    "ru": "Wrote tag {tag} to GITHUB_OUTPUT.",
+    "zh": "Wrote tag {tag} to GITHUB_OUTPUT.",
+    "pl": "Wrote tag {tag} to GITHUB_OUTPUT."
  }
 }
@@ -137,6 +137,19 @@ class TestGiteaClient:
        assert result is None
        client.create_label.assert_not_called()

+    def test_ensure_label_creates_when_others_exist(self) -> None:
+        """When labels exist but none match the target name, create a new one."""
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client.list_labels = MagicMock(
+            return_value=[{"name": "bug", "color": "ff0000"}, {"name": "docs", "color": "007ec6"}]
+        )
+        client.create_label = MagicMock(return_value={"name": "ready-to-merge", "color": "2ecc71"})
+
+        result = client.ensure_label("ready-to-merge", "2ecc71", "desc")
+        assert result is not None
+        assert result["name"] == "ready-to-merge"
+        client.create_label.assert_called_once_with("ready-to-merge", "2ecc71", "desc")
+
    def test_list_branch_protections(self) -> None:
        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
        client._session.request = MagicMock(
@@ -196,6 +209,18 @@ class TestGiteaClient:
        expected_update = {k: v for k, v in TEST_BP_CONFIG.items() if k != "branch_name"}
        client.update_branch_protection.assert_called_once_with("master", expected_update)

+    def test_ensure_branch_protection_creates_when_none_match(self) -> None:
+        """When existing protections exist but none match the target branch, create a new one."""
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client.list_branch_protections = MagicMock(
+            return_value=[{"branch_name": "develop"}, {"branch_name": "staging"}]
+        )
+        client.create_branch_protection = MagicMock(return_value={"id": 5, "branch_name": "master"})
+
+        result = client.ensure_branch_protection("master", TEST_BP_CONFIG)
+        assert result["id"] == 5
+        client.create_branch_protection.assert_called_once_with(TEST_BP_CONFIG)
+
    def test_merge_pr(self) -> None:
        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
        client._session.request = MagicMock(return_value=_mock_response())
@@ -248,6 +273,37 @@ class TestGiteaClient:
            timeout=DEFAULT_TIMEOUT,
        )

+    def test_create_pr(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(
+            return_value=_mock_response({"number": 15, "html_url": "https://git.example.com/pr/15"})
+        )
+        result = client.create_pr(title="DEVX-42: Add feature", head="DEVX-42-fix", body="desc")
+        assert result["number"] == 15
+        client._session.request.assert_called_once_with(
+            "POST",
+            "https://git.example.com/repos/owner/repo/pulls",
+            timeout=DEFAULT_TIMEOUT,
+            json={"title": "DEVX-42: Add feature", "head": "DEVX-42-fix", "base": "master", "body": "desc"},
+        )
+
+    def test_create_pr_no_body(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(
+            return_value=_mock_response({"number": 16, "html_url": "https://git.example.com/pr/16"})
+        )
+        result = client.create_pr(title="DEVX-43: Fix bug", head="DEVX-43-fix")
+        assert result["number"] == 16
+        call_kwargs = client._session.request.call_args.kwargs
+        assert "body" not in call_kwargs["json"]
+
+    def test_create_pr_custom_base(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(return_value=_mock_response({"number": 17}))
+        client.create_pr(title="Test", head="branch", base="develop")
+        call_kwargs = client._session.request.call_args.kwargs
+        assert call_kwargs["json"]["base"] == "develop"
+
    def test_get_pr_files(self) -> None:
        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
        client._session.request = MagicMock(
@@ -278,6 +334,35 @@ class TestGiteaClient:
            timeout=DEFAULT_TIMEOUT,
        )

+    def test_list_prs(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(
+            return_value=_mock_response([{"number": 1, "title": "feat: add"}, {"number": 2, "title": "fix: bug"}])
+        )
+
+        result = client.list_prs()
+        assert len(result) == 2
+        assert result[0]["number"] == 1
+        client._session.request.assert_called_once_with(
+            "GET",
+            "https://git.example.com/repos/owner/repo/pulls",
+            params={"state": "all"},
+            timeout=DEFAULT_TIMEOUT,
+        )
+
+    def test_list_prs_with_params(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(return_value=_mock_response([{"number": 3, "title": "docs: update"}]))
+
+        result = client.list_prs(state="closed", q="docs")
+        assert len(result) == 1
+        client._session.request.assert_called_once_with(
+            "GET",
+            "https://git.example.com/repos/owner/repo/pulls",
+            params={"state": "closed", "q": "docs"},
+            timeout=DEFAULT_TIMEOUT,
+        )
+
    def test_get_pr_reviews(self) -> None:
        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
        client._session.request = MagicMock(return_value=_mock_response([{"id": 1, "state": "APPROVED"}]))
@@ -566,6 +651,46 @@ class TestVikunjaClient:
            json={"done": True},
        )

+    def test_list_comments(self) -> None:
+        client = VikunjaClient("https://work.example.com", "tok")
+        client._session.request = MagicMock(
+            return_value=_mock_response([{"id": 1, "comment": "first"}, {"id": 2, "comment": "second"}])
+        )
+
+        result = client.list_comments(42)
+        assert len(result) == 2
+        assert result[0]["comment"] == "first"
+        client._session.request.assert_called_once_with(
+            "GET",
+            "https://work.example.com/tasks/42/comments",
+            timeout=DEFAULT_TIMEOUT,
+        )
+
+    def test_update_task_safe(self) -> None:
+        client = VikunjaClient("https://work.example.com", "tok")
+        client._session.request = MagicMock(
+            side_effect=[
+                _mock_response({"id": 42, "title": "My task", "done": False}),
+                _mock_response({"id": 42, "title": "My task", "done": True}),
+            ]
+        )
+
+        result = client.update_task_safe(42, done=True)
+        assert result["done"] is True
+        assert result["title"] == "My task"
+        assert client._session.request.call_count == 2
+        client._session.request.assert_any_call(
+            "GET",
+            "https://work.example.com/tasks/42",
+            timeout=DEFAULT_TIMEOUT,
+        )
+        client._session.request.assert_any_call(
+            "POST",
+            "https://work.example.com/tasks/42",
+            timeout=DEFAULT_TIMEOUT,
+            json={"id": 42, "title": "My task", "done": True},
+        )
+
    @patch("devx.api_clients.time.sleep")
    def test_http_error_raises_api_error(self, mock_sleep: MagicMock) -> None:
        client = VikunjaClient("https://work.example.com", "tok")
@@ -632,6 +757,30 @@ class TestVikunjaClient:
        assert exc_info.value.status == 0
        assert client._session.request.call_count == 3  # MAX_RETRIES

+    def test_vikunja_create_task(self) -> None:
+        client = VikunjaClient("https://work.example.com", "tok")
+        client._session.request = MagicMock(
+            return_value=_mock_response({"id": 1, "identifier": "DEVX-1", "title": "Test"})
+        )
+        result = client.create_task(6, "Test", "<p>desc</p>")
+        assert result["identifier"] == "DEVX-1"
+        client._session.request.assert_called_once_with(
+            "PUT",
+            "https://work.example.com/projects/6/tasks",
+            timeout=DEFAULT_TIMEOUT,
+            json={"title": "Test", "description": "<p>desc</p>"},
+        )
+
+    def test_vikunja_create_task_no_description(self) -> None:
+        client = VikunjaClient("https://work.example.com", "tok")
+        client._session.request = MagicMock(
+            return_value=_mock_response({"id": 2, "identifier": "DEVX-2", "title": "No desc"})
+        )
+        result = client.create_task(6, "No desc")
+        assert result["id"] == 2
+        call_kwargs = client._session.request.call_args.kwargs
+        assert call_kwargs["json"]["description"] == ""
+

 class TestIsRetryable:
    def test_connection_error_is_retryable(self) -> None:
@@ -47,6 +47,22 @@ class TestReadTaskid:
        captured = capsys.readouterr()
        assert "WARNING" not in captured.out

+    def test_no_warning_when_taskid_file_matches_branch(self, tmp_path, monkeypatch, capsys) -> None:  # type: ignore[no-untyped-def]
+        """No warning when .taskid file content matches the branch task ID."""
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / ".taskid").write_text("DEVX-19\n")
+        assert read_taskid("DEVX-19-fix-bug") == "DEVX-19"
+        captured = capsys.readouterr()
+        assert "WARNING" not in captured.out
+
+    def test_no_warning_when_taskid_file_empty(self, tmp_path, monkeypatch, capsys) -> None:  # type: ignore[no-untyped-def]
+        """No warning when .taskid file exists but is empty."""
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / ".taskid").write_text("\n")
+        assert read_taskid("DEVX-19-fix-bug") == "DEVX-19"
+        captured = capsys.readouterr()
+        assert "WARNING" not in captured.out
+

 # -- extract_task_id (legacy fallback) --

@@ -0,0 +1,231 @@
+"""Unit tests for devx.tools.check_agent_docs."""
+
+import re
+from pathlib import Path
+from unittest.mock import patch
+
+from click.testing import CliRunner
+
+from devx.tools.check_agent_docs import (
+    DEFAULT_REPO_PATH_PREFIXES,
+    DEFAULT_SCAN_DIRS,
+    DEFAULT_SCAN_EXTENSIONS,
+    DEFAULT_SCAN_FILES,
+    MIN_PATH_REF_LENGTH_DEFAULT,
+    _check_file,
+    _collect_doc_files,
+    _is_legitimate_ref,
+    _should_skip,
+    cli,
+)
+
+
+class TestShouldSkip:
+    def test_skips_excluded_path(self, tmp_path: Path) -> None:
+        f = tmp_path / "docs" / "retrospectives" / "r.md"
+        f.parent.mkdir(parents=True)
+        f.write_text("")
+        assert _should_skip(f, ["docs/retrospectives"], tmp_path) is True
+
+    def test_does_not_skip_normal(self, tmp_path: Path) -> None:
+        f = tmp_path / "docs" / "guide.md"
+        f.parent.mkdir(parents=True)
+        f.write_text("")
+        assert _should_skip(f, ["docs/retrospectives"], tmp_path) is False
+
+    def test_returns_false_for_path_outside_repo(self, tmp_path: Path) -> None:
+        f = Path("/tmp/some_other_path/guide.md")
+        assert _should_skip(f, [], tmp_path) is False
+
+
+class TestIsLegitimateRef:
+    def test_legitimate_legacy(self) -> None:
+        assert _is_legitimate_ref("This is legacy code", ["legacy"]) is True
+
+    def test_not_legitimate(self) -> None:
+        assert _is_legitimate_ref("Use this file", ["legacy"]) is False
+
+    def test_case_insensitive(self) -> None:
+        assert _is_legitimate_ref("This is LEGACY", ["legacy"]) is True
+
+
+class TestCollectDocFiles:
+    def test_collects_devin_and_docs(self, tmp_path: Path) -> None:
+        (tmp_path / ".devin").mkdir()
+        (tmp_path / ".devin" / "guide.md").write_text("")
+        (tmp_path / "docs").mkdir()
+        (tmp_path / "docs" / "api.md").write_text("")
+        (tmp_path / "README.md").write_text("")
+
+        files = _collect_doc_files(tmp_path, DEFAULT_SCAN_DIRS, DEFAULT_SCAN_FILES, DEFAULT_SCAN_EXTENSIONS, [])
+        names = {f.name for f in files}
+        assert "guide.md" in names
+        assert "api.md" in names
+        assert "README.md" in names
+
+    def test_excludes_paths(self, tmp_path: Path) -> None:
+        (tmp_path / "docs" / "retrospectives").mkdir(parents=True)
+        (tmp_path / "docs" / "retrospectives" / "r.md").write_text("")
+        (tmp_path / "docs" / "guide.md").write_text("")
+
+        files = _collect_doc_files(
+            tmp_path, DEFAULT_SCAN_DIRS, DEFAULT_SCAN_FILES, DEFAULT_SCAN_EXTENSIONS, ["docs/retrospectives"]
+        )
+        names = {f.name for f in files}
+        assert "guide.md" in names
+        assert "r.md" not in names
+
+    def test_deduplicates(self, tmp_path: Path) -> None:
+        (tmp_path / "docs").mkdir()
+        (tmp_path / "docs" / "api.md").write_text("")
+
+        files = _collect_doc_files(tmp_path, ["docs", "docs"], DEFAULT_SCAN_FILES, DEFAULT_SCAN_EXTENSIONS, [])
+        assert len(files) == 1
+
+
+class TestCheckFile:
+    def test_detects_deleted_file_ref(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("See scripts/old.py for details.\n")
+        issues = _check_file(
+            doc, tmp_path, {"scripts/old.py"}, [], [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, []
+        )
+        assert any("deleted file" in i for i in issues)
+
+    def test_detects_nonexistent_file_ref(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("See scripts/nonexistent.py for details.\n")
+        issues = _check_file(doc, tmp_path, set(), [], [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, [])
+        assert any("non-existent file" in i for i in issues)
+
+    def test_does_not_flag_existing_file(self, tmp_path: Path) -> None:
+        (tmp_path / "scripts").mkdir()
+        (tmp_path / "scripts" / "exists.py").write_text("")
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("See scripts/exists.py for details.\n")
+        issues = _check_file(doc, tmp_path, set(), [], [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, [])
+        assert issues == []
+
+    def test_detects_deprecated_pattern(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("Use ansible/envs/prod/secrets.yml for config.\n")
+        patterns = [re.compile(r"ansible/envs/[^/]+/secrets\.yml")]
+        issues = _check_file(
+            doc, tmp_path, set(), patterns, [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, []
+        )
+        assert any("deprecated pattern" in i for i in issues)
+
+    def test_legitimate_ref_skips_deprecated(self, tmp_path: Path) -> None:
+        # Create the referenced file so the non-existent check doesn't trigger
+        secrets = tmp_path / "ansible" / "envs" / "prod" / "secrets.yml"
+        secrets.parent.mkdir(parents=True)
+        secrets.write_text("")
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("The legacy ansible/envs/prod/secrets.yml is deprecated.\n")
+        patterns = [re.compile(r"ansible/envs/[^/]+/secrets\.yml")]
+        issues = _check_file(
+            doc, tmp_path, set(), patterns, ["deprecated"], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, []
+        )
+        assert issues == []
+
+    def test_unicode_error_returns_empty(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_bytes(b"\xff\xfe\x00\x00")
+        issues = _check_file(doc, tmp_path, set(), [], [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, [])
+        assert issues == []
+
+    def test_skips_short_ref(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("See a.py for details.\n")
+        issues = _check_file(doc, tmp_path, set(), [], [], DEFAULT_REPO_PATH_PREFIXES, 5, [])
+        # "a.py" is only 4 chars, below min_path_ref_length
+        assert issues == []
+
+    def test_skips_ref_without_repo_prefix(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("See vendor/some/long/path.py for details.\n")
+        issues = _check_file(doc, tmp_path, set(), [], [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, [])
+        # "vendor/" is not in repo_path_prefixes
+        assert issues == []
+
+    def test_skip_ref_prefixes_skips_nonexistent(self, tmp_path: Path) -> None:
+        doc = tmp_path / "docs" / "guide.md"
+        doc.parent.mkdir(parents=True)
+        doc.write_text("See scripts/test_foo.py for details.\n")
+        issues = _check_file(
+            doc, tmp_path, set(), [], [], DEFAULT_REPO_PATH_PREFIXES, MIN_PATH_REF_LENGTH_DEFAULT, ["scripts/test_"]
+        )
+        assert issues == []
+
+
+class TestCli:
+    def test_passes_when_no_issues(self, tmp_path: Path) -> None:
+        (tmp_path / "docs").mkdir()
+        (tmp_path / "docs" / "guide.md").write_text("All good.\n")
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_agent_docs._load_config", return_value={}),
+            patch("devx.tools.check_agent_docs.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code == 0
+            assert "Passed" in result.output
+
+    def test_fails_when_stale_ref(self, tmp_path: Path) -> None:
+        (tmp_path / "docs").mkdir()
+        (tmp_path / "docs" / "guide.md").write_text("See scripts/deleted.py\n")
+        cfg = {"deleted_files": ["scripts/deleted.py"]}
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_agent_docs._load_config", return_value=cfg),
+            patch("devx.tools.check_agent_docs.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code != 0
+            assert "FAILED" in result.output
+
+    def test_load_config_returns_empty_when_not_dict(self) -> None:
+        from devx.tools.check_agent_docs import _load_config
+
+        with patch("devx.tools.check_agent_docs._load_pyproject_devx", return_value={"check_agent_docs": "not a dict"}):
+            assert _load_config() == {}
+
+    def test_load_config_returns_dict_when_valid(self) -> None:
+        from devx.tools.check_agent_docs import _load_config
+
+        cfg = {"scan_dirs": ["custom"]}
+        with patch("devx.tools.check_agent_docs._load_pyproject_devx", return_value={"check_agent_docs": cfg}):
+            assert _load_config() == cfg
+
+    def test_invalid_regex_pattern_skipped(self, tmp_path: Path) -> None:
+        (tmp_path / "docs").mkdir()
+        (tmp_path / "docs" / "guide.md").write_text("All good.\n")
+        cfg = {"deprecated_patterns": ["[invalid"]}
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_agent_docs._load_config", return_value=cfg),
+            patch("devx.tools.check_agent_docs.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code == 0
+
+    def test_custom_scan_dirs(self, tmp_path: Path) -> None:
+        custom = tmp_path / "custom_docs"
+        custom.mkdir()
+        (custom / "guide.md").write_text("See scripts/deleted.py\n")
+        cfg = {"scan_dirs": ["custom_docs"], "deleted_files": ["scripts/deleted.py"]}
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_agent_docs._load_config", return_value=cfg),
+            patch("devx.tools.check_agent_docs.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code != 0
@@ -0,0 +1,292 @@
+"""Unit tests for devx.ci.check_auto_merge_ready."""
+
+from unittest.mock import MagicMock, patch
+
+from click.testing import CliRunner
+
+from devx.ci.check_auto_merge_ready import (
+    cli,
+    get_pr_title_from_gitea,
+    get_vikunja_title_optional,
+    is_branch_behind_master,
+)
+
+
+class TestIsBranchBehindMaster:
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_false_when_ahead(self, mock_run: MagicMock) -> None:
+        # First: fetch (ok), second: ahead count (ok), third: behind count = 0
+        mock_run.side_effect = [
+            MagicMock(returncode=0, stdout="", stderr=""),
+            MagicMock(returncode=0, stdout="3\n", stderr=""),
+            MagicMock(returncode=0, stdout="0\n", stderr=""),
+        ]
+        assert is_branch_behind_master("feature") is False
+
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_true_when_behind(self, mock_run: MagicMock) -> None:
+        mock_run.side_effect = [
+            MagicMock(returncode=0, stdout="", stderr=""),
+            MagicMock(returncode=0, stdout="0\n", stderr=""),
+            MagicMock(returncode=0, stdout="5\n", stderr=""),
+        ]
+        assert is_branch_behind_master("feature") is True
+
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_false_on_git_error(self, mock_run: MagicMock) -> None:
+        mock_run.side_effect = [
+            MagicMock(returncode=0, stdout="", stderr=""),
+            MagicMock(returncode=1, stdout="", stderr="error"),
+        ]
+        assert is_branch_behind_master("feature") is False
+
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_false_on_timeout(self, mock_run: MagicMock) -> None:
+        import subprocess
+
+        mock_run.side_effect = subprocess.TimeoutExpired(cmd="git", timeout=30)
+        assert is_branch_behind_master("feature") is False
+
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_false_on_value_error(self, mock_run: MagicMock) -> None:
+        mock_run.side_effect = [
+            MagicMock(returncode=0, stdout="", stderr=""),
+            MagicMock(returncode=0, stdout="3\n", stderr=""),
+            MagicMock(returncode=0, stdout="not_a_number\n", stderr=""),
+        ]
+        assert is_branch_behind_master("feature") is False
+
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_false_on_file_not_found(self, mock_run: MagicMock) -> None:
+        mock_run.side_effect = FileNotFoundError("git not found")
+        assert is_branch_behind_master("feature") is False
+
+    @patch("devx.ci.check_auto_merge_ready.subprocess.run")
+    def test_returns_false_when_behind_check_fails(self, mock_run: MagicMock) -> None:
+        # fetch ok, ahead count ok, behind count command fails
+        mock_run.side_effect = [
+            MagicMock(returncode=0, stdout="", stderr=""),
+            MagicMock(returncode=0, stdout="3\n", stderr=""),
+            MagicMock(returncode=1, stdout="", stderr="error"),
+        ]
+        assert is_branch_behind_master("feature") is False
+
+
+class TestGetPrTitleFromGitea:
+    def test_returns_none_without_token(self) -> None:
+        with patch.dict("os.environ", {}, clear=True):
+            assert get_pr_title_from_gitea("owner/repo", 1) is None
+
+    def test_returns_none_with_invalid_repo(self) -> None:
+        with patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True):
+            assert get_pr_title_from_gitea("invalid", 1) is None
+
+    @patch("devx.ci.check_auto_merge_ready.GiteaClient")
+    def test_fetches_title(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.get_pr.return_value = {"title": "DEVX-1: Fix bug"}
+        mock_client_cls.return_value = mock_client
+        with patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True):
+            result = get_pr_title_from_gitea("owner/repo", 1)
+        assert result == "DEVX-1: Fix bug"
+
+    @patch("devx.ci.check_auto_merge_ready.GiteaClient")
+    def test_returns_none_on_exception(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.get_pr.side_effect = Exception("API error")
+        mock_client_cls.return_value = mock_client
+        with patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True):
+            result = get_pr_title_from_gitea("owner/repo", 1)
+        assert result is None
+
+
+class TestGetVikunjaTitleOptional:
+    def test_returns_none_without_token(self) -> None:
+        with patch.dict("os.environ", {}, clear=True):
+            assert get_vikunja_title_optional("DEVX-1") is None
+
+    @patch("devx.ci.check_auto_merge_ready.VikunjaClient")
+    def test_returns_title_when_found(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = [{"identifier": "DEVX-1", "title": "Fix bug"}]
+        mock_client_cls.return_value = mock_client
+        with patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"}, clear=True):
+            result = get_vikunja_title_optional("DEVX-1")
+        assert result == "Fix bug"
+
+    @patch("devx.ci.check_auto_merge_ready.VikunjaClient")
+    def test_returns_none_when_not_found(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = [{"identifier": "DEVX-2", "title": "Other task"}]
+        mock_client_cls.return_value = mock_client
+        with patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"}, clear=True):
+            result = get_vikunja_title_optional("DEVX-1")
+        assert result is None
+
+    @patch("devx.ci.check_auto_merge_ready.VikunjaClient")
+    def test_paginates_until_found(self, mock_client_cls: MagicMock) -> None:
+        from devx.config import DEFAULT_PER_PAGE
+
+        mock_client = MagicMock()
+        # First page: full page of non-matching tasks, second page: match
+        page1 = [{"identifier": f"DEVX-{i}", "title": f"Task {i}"} for i in range(DEFAULT_PER_PAGE)]
+        page2 = [{"identifier": "DEVX-99", "title": "Found it"}]
+        mock_client.list_project_tasks.side_effect = [page1, page2]
+        mock_client_cls.return_value = mock_client
+        with patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"}, clear=True):
+            result = get_vikunja_title_optional("DEVX-99")
+        assert result == "Found it"
+
+    @patch("devx.ci.check_auto_merge_ready.VikunjaClient")
+    def test_returns_none_when_empty_first_page(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = []
+        mock_client_cls.return_value = mock_client
+        with patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"}, clear=True):
+            result = get_vikunja_title_optional("DEVX-1")
+        assert result is None
+
+
+class TestCli:
+    def test_fails_without_task_id(self) -> None:
+        runner = CliRunner()
+        with patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX"}, clear=True):
+            result = runner.invoke(cli, ["--branch", "no-task-id-here"])
+        assert result.exit_code != 0
+
+    def test_local_mode_no_pr_title(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+        ):
+            result = runner.invoke(cli, ["--branch", "DEVX-1-fix-foo"])
+        assert result.exit_code == 0
+        assert "local mode" in result.output
+
+    def test_validates_pr_title_format(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+        ):
+            result = runner.invoke(cli, ["--branch", "DEVX-1-fix-foo", "--pr-title", "Bad title"])
+        assert result.exit_code != 0
+        assert "format" in result.output.lower() or "mismatch" in result.output.lower()
+
+    def test_passes_with_valid_title(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+        ):
+            result = runner.invoke(cli, ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo"])
+        assert result.exit_code == 0
+        assert "satisfied" in result.output
+
+    def test_skip_behind_check(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=True),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo", "--skip-behind-check"],
+            )
+        assert result.exit_code == 0
+
+    def test_fails_when_behind_master(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=True),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo"],
+            )
+        assert result.exit_code != 0
+        assert "behind" in result.output.lower()
+
+    def test_skip_vikunja(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": "tok"}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+            patch("devx.ci.check_auto_merge_ready.get_vikunja_title_optional", return_value="Different title"),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo", "--skip-vikunja"],
+            )
+        assert result.exit_code == 0
+
+    def test_fetches_pr_title_from_gitea(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+            patch("devx.ci.check_auto_merge_ready.get_pr_title_from_gitea", return_value="DEVX-1: Fix foo"),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--repo", "owner/repo", "--pr-number", "1"],
+            )
+        assert result.exit_code == 0
+        assert "from Gitea" in result.output
+
+    def test_fails_when_pr_number_but_no_title(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": ""}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.get_pr_title_from_gitea", return_value=None),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--repo", "owner/repo", "--pr-number", "1"],
+            )
+        assert result.exit_code != 0
+        assert "Could not fetch" in result.output
+
+    def test_fails_when_vikunja_token_set_but_task_not_found(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": "tok"}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+            patch("devx.ci.check_auto_merge_ready.get_vikunja_title_optional", return_value=None),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo"],
+            )
+        assert result.exit_code != 0
+        assert "Could not find Vikunja task" in result.output
+
+    def test_passes_with_vikunja_title_match(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": "tok"}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+            patch("devx.ci.check_auto_merge_ready.get_vikunja_title_optional", return_value="Fix foo"),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo"],
+            )
+        assert result.exit_code == 0
+        assert "Vikunja title match OK" in result.output
+
+    def test_fails_with_vikunja_title_mismatch(self) -> None:
+        runner = CliRunner()
+        with (
+            patch.dict("os.environ", {"DEVX_TASK_PREFIX": "DEVX", "VIKUNJA_TOKEN": "tok"}, clear=True),
+            patch("devx.ci.check_auto_merge_ready.is_branch_behind_master", return_value=False),
+            patch("devx.ci.check_auto_merge_ready.get_vikunja_title_optional", return_value="Different title"),
+        ):
+            result = runner.invoke(
+                cli,
+                ["--branch", "DEVX-1-fix-foo", "--pr-title", "DEVX-1: Fix foo"],
+            )
+        assert result.exit_code != 0
+        assert "does not match Vikunja" in result.output
@@ -0,0 +1,90 @@
+"""Unit tests for devx.tools.check_config."""
+
+from pathlib import Path
+
+from click.testing import CliRunner
+
+from devx.tools.check_config import cli
+
+
+class TestCheckConfig:
+    def test_valid_config(self, tmp_path: Path) -> None:
+        """A valid [tool.devx] section with consistent versions passes."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)) as fs:
+            Path(fs, "pyproject.toml").write_text(
+                '[project]\nname = "test"\n'
+                '[project.optional-dependencies]\nci = ["devx>=0.15.0"]\ndev = ["devx>=0.15.0"]\n'
+                '[tool.devx]\ntask_prefix = "TEST"\nvikunja_project_id = 1\nrepo_owner = "owner"\nrepo_name = "test"\n'
+            )
+            result = runner.invoke(cli)
+            assert result.exit_code == 0
+            assert "Configuration OK" in result.output
+
+    def test_missing_tool_devx_section(self, tmp_path: Path) -> None:
+        """Missing [tool.devx] section fails with error."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)) as fs:
+            Path(fs, "pyproject.toml").write_text('[project]\nname = "test"\n')
+            result = runner.invoke(cli)
+            assert result.exit_code == 1
+            assert "missing required keys" in result.output
+
+    def test_partial_tool_devx_section(self, tmp_path: Path) -> None:
+        """Partial [tool.devx] section fails with missing keys."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)) as fs:
+            Path(fs, "pyproject.toml").write_text('[project]\nname = "test"\n[tool.devx]\ntask_prefix = "TEST"\n')
+            result = runner.invoke(cli)
+            assert result.exit_code == 1
+            assert "missing required keys" in result.output
+            assert "vikunja_project_id" in result.output
+            assert "repo_owner" in result.output
+            assert "repo_name" in result.output
+
+    def test_version_mismatch(self, tmp_path: Path) -> None:
+        """Version mismatch across extras fails."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)) as fs:
+            Path(fs, "pyproject.toml").write_text(
+                '[project]\nname = "test"\n'
+                "[project.optional-dependencies]\n"
+                'ci = ["devx>=0.15.0"]\n'
+                'dev = ["devx>=0.14.2"]\n'
+                '[tool.devx]\ntask_prefix = "TEST"\nvikunja_project_id = 1\nrepo_owner = "owner"\nrepo_name = "test"\n'
+            )
+            result = runner.invoke(cli)
+            assert result.exit_code == 1
+            assert "version mismatch" in result.output
+
+    def test_no_pyproject_file(self, tmp_path: Path) -> None:
+        """Missing pyproject.toml fails."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)):
+            result = runner.invoke(cli)
+            assert result.exit_code == 1
+            assert "not found" in result.output
+
+    def test_no_extras_passes(self, tmp_path: Path) -> None:
+        """No optional-dependencies with devx is fine (no versions to compare)."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)) as fs:
+            Path(fs, "pyproject.toml").write_text(
+                '[project]\nname = "test"\n'
+                '[tool.devx]\ntask_prefix = "TEST"\nvikunja_project_id = 1\nrepo_owner = "owner"\nrepo_name = "test"\n'
+            )
+            result = runner.invoke(cli)
+            assert result.exit_code == 0
+            assert "Configuration OK" in result.output
+
+    def test_single_extra_passes(self, tmp_path: Path) -> None:
+        """Single extra with devx version is fine (no mismatch possible)."""
+        runner = CliRunner()
+        with runner.isolated_filesystem(temp_dir=str(tmp_path)) as fs:
+            Path(fs, "pyproject.toml").write_text(
+                '[project]\nname = "test"\n'
+                '[project.optional-dependencies]\nci = ["devx>=0.15.0", "pytest"]\n'
+                '[tool.devx]\ntask_prefix = "TEST"\nvikunja_project_id = 1\nrepo_owner = "owner"\nrepo_name = "test"\n'
+            )
+            result = runner.invoke(cli)
+            assert result.exit_code == 0
@@ -0,0 +1,249 @@
+"""Unit tests for devx.tools.check_mutable_globals."""
+
+from pathlib import Path
+from unittest.mock import patch
+
+from click.testing import CliRunner
+
+from devx.tools.check_mutable_globals import (
+    DEFAULT_SCAN_DIRS,
+    DEFAULT_SKIP_DIRS,
+    _load_config,
+    _should_skip,
+    cli,
+    find_mutable_globals,
+)
+
+
+class TestFindMutableGlobals:
+    def test_detects_set_global_with_path_hint(self, tmp_path: Path) -> None:
+        source = "_SEEN: set[Path] = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+        assert "_SEEN" in issues[0]
+        assert "set()" in issues[0]
+
+    def test_detects_dict_global_with_path_hint(self, tmp_path: Path) -> None:
+        source = "_CACHE: dict[Path, Any] = {}\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+        assert "_CACHE" in issues[0]
+
+    def test_detects_list_global_with_path_hint(self, tmp_path: Path) -> None:
+        source = "PATHS: list[Path] = []\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+        assert "PATHS" in issues[0]
+
+    def test_skips_non_mutable_globals(self, tmp_path: Path) -> None:
+        source = "_MAX: int = 10\n_SEEN: set[Path] = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+        assert "_SEEN" in issues[0]
+
+    def test_skips_globals_without_path_hint(self, tmp_path: Path) -> None:
+        source = "_DATA: dict[str, int] = {}\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 0
+
+    def test_detects_path_type_annotation(self, tmp_path: Path) -> None:
+        source = "_FILES: set[Path] = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+
+    def test_known_safe_exception(self, tmp_path: Path) -> None:
+        source = "_SEEN: set[Path] = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        known_safe = {("mod.py", 1, "_SEEN")}
+        issues = find_mutable_globals(f, tmp_path, known_safe)
+        assert len(issues) == 0
+
+    def test_syntax_error_returns_empty(self, tmp_path: Path) -> None:
+        f = tmp_path / "mod.py"
+        f.write_text("def broken(:\n")
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert issues == []
+
+    def test_detects_mutable_literal_dict(self, tmp_path: Path) -> None:
+        source = "_CACHE: dict[Path, Any] = {}\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+
+    def test_detects_mutable_literal_list(self, tmp_path: Path) -> None:
+        source = "SEEN_PATHS: list[Path] = []\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+
+    def test_detects_mutable_literal_set(self, tmp_path: Path) -> None:
+        source = "REGISTRY: set[Path] = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+
+    def test_skips_function_definitions(self, tmp_path: Path) -> None:
+        source = "def foo():\n    pass\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert issues == []
+
+    def test_handles_assign_with_name_target(self, tmp_path: Path) -> None:
+        source = "SEEN_PATHS = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert len(issues) == 1
+        assert "SEEN_PATHS" in issues[0]
+
+    def test_skips_annotation_without_value(self, tmp_path: Path) -> None:
+        source = "_CACHE: dict[Path, Any]\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        assert issues == []
+
+    def test_skips_attribute_call(self, tmp_path: Path) -> None:
+        # collections.defaultdict is an Attribute call, not a Name call
+        source = "_CACHE: dict[Path, Any] = collections.defaultdict(list)\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        # Attribute calls are skipped (pass), so not flagged as mutable literal
+        assert issues == []
+
+    def test_multiple_assign_targets(self, tmp_path: Path) -> None:
+        source = "SEEN = CACHE = set()\n"
+        f = tmp_path / "mod.py"
+        f.write_text(source)
+        issues = find_mutable_globals(f, tmp_path, set())
+        # Both SEEN and CACHE should be flagged
+        assert len(issues) == 2
+
+
+class TestShouldSkip:
+    def test_skips_pycache(self) -> None:
+        assert _should_skip(Path("/a/__pycache__/b.py"), DEFAULT_SKIP_DIRS) is True
+
+    def test_skips_venv(self) -> None:
+        assert _should_skip(Path("/a/.venv/b.py"), DEFAULT_SKIP_DIRS) is True
+
+    def test_does_not_skip_normal(self) -> None:
+        assert _should_skip(Path("/a/src/b.py"), DEFAULT_SKIP_DIRS) is False
+
+
+class TestLoadConfig:
+    def test_defaults_when_no_pyproject(self, tmp_path: Path) -> None:
+        with patch("devx.tools.check_mutable_globals._load_pyproject_devx", return_value={}):
+            scan_dirs, skip_dirs, known_safe = _load_config()
+            assert scan_dirs == DEFAULT_SCAN_DIRS
+            assert skip_dirs == DEFAULT_SKIP_DIRS
+            assert known_safe == set()
+
+    def test_reads_config_from_pyproject(self) -> None:
+        cfg = {
+            "check_mutable_globals": {
+                "scan_dirs": ["src", "tests"],
+                "skip_dirs": ["__pycache__", ".tox"],
+                "known_safe": ["src/mod.py:10:_CACHE"],
+            }
+        }
+        with patch("devx.tools.check_mutable_globals._load_pyproject_devx", return_value=cfg):
+            scan_dirs, skip_dirs, known_safe = _load_config()
+            assert scan_dirs == ["src", "tests"]
+            assert ".tox" in skip_dirs
+            assert ("src/mod.py", 10, "_CACHE") in known_safe
+
+    def test_returns_defaults_when_cfg_not_dict(self) -> None:
+        with patch(
+            "devx.tools.check_mutable_globals._load_pyproject_devx",
+            return_value={"check_mutable_globals": "not a dict"},
+        ):
+            scan_dirs, skip_dirs, known_safe = _load_config()
+            assert scan_dirs == DEFAULT_SCAN_DIRS
+            assert skip_dirs == DEFAULT_SKIP_DIRS
+            assert known_safe == set()
+
+    def test_known_safe_with_invalid_line_number(self) -> None:
+        cfg = {"check_mutable_globals": {"known_safe": ["mod.py:abc:_CACHE"]}}
+        with patch("devx.tools.check_mutable_globals._load_pyproject_devx", return_value=cfg):
+            _, _, known_safe = _load_config()
+            assert known_safe == set()
+
+    def test_scan_dirs_not_list_returns_default(self) -> None:
+        cfg = {"check_mutable_globals": {"scan_dirs": "not a list"}}
+        with patch("devx.tools.check_mutable_globals._load_pyproject_devx", return_value=cfg):
+            scan_dirs, _, _ = _load_config()
+            assert scan_dirs == DEFAULT_SCAN_DIRS
+
+
+class TestCli:
+    def test_passes_when_no_issues(self, tmp_path: Path) -> None:
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_mutable_globals._load_config", return_value=(["empty_dir"], set(), set())),
+            patch("devx.tools.check_mutable_globals.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code == 0
+            assert "Passed" in result.output
+
+    def test_fails_when_issues_found(self, tmp_path: Path) -> None:
+        scan_dir = tmp_path / "src"
+        scan_dir.mkdir()
+        (scan_dir / "mod.py").write_text("_SEEN: set[Path] = set()\n")
+
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_mutable_globals._load_config", return_value=(["src"], set(), set())),
+            patch("devx.tools.check_mutable_globals.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code != 0
+            assert "FAILED" in result.output
+
+    def test_scan_dir_option_overrides_config(self, tmp_path: Path) -> None:
+        scan_dir = tmp_path / "custom"
+        scan_dir.mkdir()
+        (scan_dir / "mod.py").write_text("_SEEN: set[Path] = set()\n")
+
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_mutable_globals._load_config", return_value=(["other"], set(), set())),
+            patch("devx.tools.check_mutable_globals.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, ["--scan-dir", "custom"])
+            assert result.exit_code != 0
+            assert "FAILED" in result.output
+
+    def test_skips_files_in_skip_dirs(self, tmp_path: Path) -> None:
+        scan_dir = tmp_path / "src"
+        pycache = scan_dir / "__pycache__"
+        pycache.mkdir(parents=True)
+        (pycache / "mod.py").write_text("_SEEN: set[Path] = set()\n")
+
+        runner = CliRunner()
+        with (
+            patch("devx.tools.check_mutable_globals._load_config", return_value=(["src"], {"__pycache__"}, set())),
+            patch("devx.tools.check_mutable_globals.Path.cwd", return_value=tmp_path),
+        ):
+            result = runner.invoke(cli, [])
+            assert result.exit_code == 0
+            assert "Passed" in result.output
@@ -0,0 +1,208 @@
+"""Unit tests for devx.tools.check_pyproject_deps."""
+
+from pathlib import Path
+
+from click.testing import CliRunner
+
+from devx.tools.check_pyproject_deps import check_deps, cli
+
+
+class TestCheckDeps:
+    def test_no_issues_when_all_documented(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+# HTTP client
+"requests>=2.0"
+# CLI framework
+"click>=8.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert issues == []
+
+    def test_finds_undocumented_dependency(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+# HTTP client
+"requests>=2.0"
+"click>=8.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert len(issues) == 1
+        assert "click" in issues[0]
+
+    def test_finds_multiple_undocumented(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+"requests>=2.0"
+"click>=8.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert len(issues) == 2
+
+    def test_handles_optional_dependencies(self, tmp_path: Path) -> None:
+        content = """\
+[project.optional-dependencies]
+ci = [
+    # Test runner
+    "pytest>=8",
+    "pytest-cov>=4",
+]
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert len(issues) == 1
+        assert "pytest-cov" in issues[0]
+
+    def test_returns_file_not_found_for_missing_file(self, tmp_path: Path) -> None:
+        issues = check_deps(tmp_path / "nonexistent.toml")
+        assert len(issues) == 1
+        assert "not found" in issues[0]
+
+    def test_empty_deps_section_no_issues(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert issues == []
+
+    def test_skips_non_deps_sections(self, tmp_path: Path) -> None:
+        content = """\
+[project]
+name = "test"
+version = "0.1.0"
+
+[project.dependencies]
+# HTTP
+"requests>=2.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert issues == []
+
+    def test_handles_dash_prefixed_deps(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+# HTTP client
+-requests>=2.0
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert issues == []
+
+    def test_empty_lines_in_deps_section(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+
+# HTTP client
+"requests>=2.0"
+
+# CLI
+"click>=8.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        assert issues == []
+
+    def test_non_dep_non_comment_line_resets_prev(self, tmp_path: Path) -> None:
+        # A line that's not a comment, not a dep, not empty — resets prev_was_comment
+        content = """\
+[project.dependencies]
+# Comment
+ci = [
+"requests>=2.0",
+]
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        # "requests" is preceded by a comment, but the `ci = [` line resets prev_was_comment
+        # Actually `ci = [` doesn't start with - or ", so it hits the else branch
+        assert len(issues) == 1
+
+    def test_section_transition_exits_deps(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+# HTTP
+"requests>=2.0"
+
+[project.optional-dependencies]
+# Test runner
+"pytest>=8"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        # Both deps are documented
+        assert issues == []
+
+    def test_deps_after_other_section_not_checked(self, tmp_path: Path) -> None:
+        content = """\
+[project]
+name = "test"
+
+[project.dependencies]
+# Documented
+"requests>=2.0"
+
+[tool.ruff]
+line-length = 120
+"undocumented-dep>=1.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        issues = check_deps(f)
+        # The "undocumented-dep" is in [tool.ruff], not a deps section
+        assert issues == []
+
+
+class TestCli:
+    def test_passes_when_all_documented(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+# HTTP client
+"requests>=2.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        runner = CliRunner()
+        with __import__("contextlib").chdir(tmp_path):
+            result = runner.invoke(cli, [])
+        assert result.exit_code == 0
+        assert "Passed" in result.output
+
+    def test_fails_when_undocumented(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+"requests>=2.0"
+"""
+        f = tmp_path / "pyproject.toml"
+        f.write_text(content)
+        runner = CliRunner()
+        with __import__("contextlib").chdir(tmp_path):
+            result = runner.invoke(cli, [])
+        assert result.exit_code != 0
+        assert "FAILED" in result.output
+
+    def test_custom_file_option(self, tmp_path: Path) -> None:
+        content = """\
+[project.dependencies]
+# Documented
+"requests>=2.0"
+"""
+        f = tmp_path / "custom.toml"
+        f.write_text(content)
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--file", str(f)])
+        assert result.exit_code == 0
@@ -0,0 +1,239 @@
+"""Unit tests for devx.tools.check_test_coverage."""
+
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from devx.tools.check_test_coverage import (
+    BUILTIN_RULES,
+    DEFAULT_SKIP_EXTENSIONS,
+    DEFAULT_TEST_INDICATORS,
+    _changed_files,
+    _find_missing_tests,
+    _is_test_file,
+    _load_rules,
+    _resolve_test_path,
+    _should_skip_file,
+    main,
+)
+
+
+class TestIsTestFile:
+    def test_tests_dir(self) -> None:
+        assert _is_test_file("tests/unit/test_foo.py", DEFAULT_TEST_INDICATORS) is True
+
+    def test_test_prefix(self) -> None:
+        assert _is_test_file("src/test_foo.py", DEFAULT_TEST_INDICATORS) is True
+
+    def test_test_suffix(self) -> None:
+        assert _is_test_file("src/foo_test.py", DEFAULT_TEST_INDICATORS) is True
+
+    def test_non_test_file(self) -> None:
+        assert _is_test_file("src/foo.py", DEFAULT_TEST_INDICATORS) is False
+
+
+class TestShouldSkipFile:
+    def test_skips_dotfiles(self) -> None:
+        assert _should_skip_file(".gitignore", [], DEFAULT_SKIP_EXTENSIONS) is True
+
+    def test_skips_markdown(self) -> None:
+        assert _should_skip_file("README.md", [], DEFAULT_SKIP_EXTENSIONS) is True
+
+    def test_skips_yaml(self) -> None:
+        assert _should_skip_file("config.yml", [], DEFAULT_SKIP_EXTENSIONS) is True
+
+    def test_does_not_skip_python(self) -> None:
+        assert _should_skip_file("src/foo.py", [], DEFAULT_SKIP_EXTENSIONS) is False
+
+    def test_skips_by_pattern(self) -> None:
+        assert _should_skip_file("src/__init__.py", ["__init__.py"], DEFAULT_SKIP_EXTENSIONS) is True
+
+    def test_skips_by_glob_pattern(self) -> None:
+        assert _should_skip_file("src/config.py", ["config.py"], DEFAULT_SKIP_EXTENSIONS) is True
+
+
+class TestResolveTestPath:
+    def test_resolves_name(self, tmp_path: Path) -> None:
+        result = _resolve_test_path("tests/unit/test_{name}", "src/foo.py", tmp_path)
+        assert result == tmp_path / "tests" / "unit" / "test_foo"
+
+    def test_resolves_module(self, tmp_path: Path) -> None:
+        result = _resolve_test_path("tests/unit/test_{module}_{name}", "src/pkg/foo.py", tmp_path)
+        assert result == tmp_path / "tests" / "unit" / "test_pkg_foo"
+
+    def test_resolves_package_prefix(self, tmp_path: Path) -> None:
+        result = _resolve_test_path(
+            "tests/unit/test_{package_prefix}_{name}",
+            "scripts/utils/secrets.py",
+            tmp_path,
+        )
+        assert result == tmp_path / "tests" / "unit" / "test_utils_secrets"
+
+    def test_normalizes_hyphens(self, tmp_path: Path) -> None:
+        result = _resolve_test_path("tests/test_{name}", "scripts/my-script.py", tmp_path)
+        assert result == tmp_path / "tests" / "test_my_script"
+
+
+class TestFindMissingTests:
+    def test_finds_missing_test(self, tmp_path: Path) -> None:
+        files = ["scripts/foo.py"]
+        rules = BUILTIN_RULES
+        missing = _find_missing_tests(files, tmp_path, rules, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS)
+        assert "scripts/foo.py" in missing
+
+    def test_no_missing_when_test_exists(self, tmp_path: Path) -> None:
+        (tmp_path / "scripts" / "tests").mkdir(parents=True)
+        (tmp_path / "scripts" / "tests" / "test_foo.py").write_text("")
+        files = ["scripts/foo.py"]
+        rules = BUILTIN_RULES
+        missing = _find_missing_tests(files, tmp_path, rules, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS)
+        assert missing == {}
+
+    def test_skips_test_files(self, tmp_path: Path) -> None:
+        files = ["tests/unit/test_foo.py"]
+        rules = BUILTIN_RULES
+        missing = _find_missing_tests(files, tmp_path, rules, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS)
+        assert missing == {}
+
+    def test_skips_non_python_files(self, tmp_path: Path) -> None:
+        files = ["README.md", "config.yml"]
+        rules = BUILTIN_RULES
+        missing = _find_missing_tests(files, tmp_path, rules, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS)
+        assert missing == {}
+
+    def test_no_rule_no_requirement(self, tmp_path: Path) -> None:
+        files = ["unknown_type.xyz"]
+        rules = BUILTIN_RULES
+        missing = _find_missing_tests(files, tmp_path, rules, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS)
+        assert missing == {}
+
+
+class TestChangedFiles:
+    @patch("devx.tools.check_test_coverage.subprocess.run")
+    def test_staged_only(self, mock_run: MagicMock, tmp_path: Path) -> None:
+        mock_run.return_value = MagicMock(stdout="file1.py\nfile2.py\n", returncode=0)
+        files = _changed_files(staged_only=True, repo_root=tmp_path)
+        assert files == ["file1.py", "file2.py"]
+        cmd = mock_run.call_args.args[0]
+        assert "--cached" in cmd
+
+    @patch("devx.tools.check_test_coverage.subprocess.run")
+    def test_ci_mode(self, mock_run: MagicMock, tmp_path: Path) -> None:
+        mock_run.return_value = MagicMock(stdout="file1.py\n", returncode=0)
+        files = _changed_files(staged_only=False, repo_root=tmp_path)
+        assert files == ["file1.py"]
+        cmd = mock_run.call_args.args[0]
+        assert "origin/master...HEAD" in cmd
+
+    @patch("devx.tools.check_test_coverage.subprocess.run")
+    def test_fallback_to_staged(self, mock_run: MagicMock, tmp_path: Path) -> None:
+        # First call fails, second succeeds
+        mock_run.side_effect = [
+            MagicMock(stdout="", returncode=1),
+            MagicMock(stdout="file1.py\n", returncode=0),
+        ]
+        files = _changed_files(staged_only=False, repo_root=tmp_path)
+        assert files == ["file1.py"]
+
+
+class TestLoadRules:
+    def test_defaults_when_no_config(self) -> None:
+        with patch("devx.tools.check_test_coverage._load_pyproject_devx", return_value={}):
+            rules, skip, indicators, skip_ext = _load_rules()
+            assert rules == BUILTIN_RULES
+            assert skip == []
+            assert indicators == DEFAULT_TEST_INDICATORS
+            assert skip_ext == DEFAULT_SKIP_EXTENSIONS
+
+    def test_custom_rules(self) -> None:
+        cfg = {
+            "check_test_coverage": {
+                "rules": [
+                    {
+                        "source_pattern": "lib/*.py",
+                        "test_paths": ["tests/test_{name}"],
+                        "description": "Missing: tests/test_{name}",
+                    }
+                ],
+                "skip_patterns": ["__init__.py"],
+            }
+        }
+        with patch("devx.tools.check_test_coverage._load_pyproject_devx", return_value=cfg):
+            rules, skip, indicators, skip_ext = _load_rules()
+            assert len(rules) == 1
+            assert rules[0]["source_pattern"] == "lib/*.py"
+            assert "__init__.py" in skip
+
+    def test_returns_defaults_when_cfg_not_dict(self) -> None:
+        with patch(
+            "devx.tools.check_test_coverage._load_pyproject_devx", return_value={"check_test_coverage": "not a dict"}
+        ):
+            rules, skip, indicators, skip_ext = _load_rules()
+            assert rules == BUILTIN_RULES
+            assert skip == []
+
+    def test_skip_extensions_not_list_returns_default(self) -> None:
+        cfg = {"check_test_coverage": {"skip_extensions": "not a list"}}
+        with patch("devx.tools.check_test_coverage._load_pyproject_devx", return_value=cfg):
+            _, _, _, skip_ext = _load_rules()
+            assert skip_ext == DEFAULT_SKIP_EXTENSIONS
+
+    def test_test_paths_not_list_skips_rule(self, tmp_path: Path) -> None:
+        files = ["scripts/foo.py"]
+        rules = [
+            {
+                "source_pattern": "scripts/*.py",
+                "test_paths": "not a list",
+                "description": "Missing test",
+            }
+        ]
+        missing = _find_missing_tests(files, tmp_path, rules, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS)
+        # Rule matches but test_paths is not a list, so it's skipped — no missing
+        assert missing == {}
+
+
+class TestMain:
+    def test_no_changed_files(self, tmp_path: Path) -> None:
+        with (
+            patch("devx.tools.check_test_coverage._changed_files", return_value=[]),
+            patch(
+                "devx.tools.check_test_coverage._load_rules",
+                return_value=(BUILTIN_RULES, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS),
+            ),
+            patch("devx.tools.check_test_coverage.Path.cwd", return_value=tmp_path),
+        ):
+            assert main([]) == 0
+
+    def test_all_have_tests(self, tmp_path: Path) -> None:
+        (tmp_path / "scripts" / "tests").mkdir(parents=True)
+        (tmp_path / "scripts" / "tests" / "test_foo.py").write_text("")
+        with (
+            patch("devx.tools.check_test_coverage._changed_files", return_value=["scripts/foo.py"]),
+            patch(
+                "devx.tools.check_test_coverage._load_rules",
+                return_value=(BUILTIN_RULES, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS),
+            ),
+            patch("devx.tools.check_test_coverage.Path.cwd", return_value=tmp_path),
+        ):
+            assert main([]) == 0
+
+    def test_missing_test_returns_1(self, tmp_path: Path) -> None:
+        with (
+            patch("devx.tools.check_test_coverage._changed_files", return_value=["scripts/foo.py"]),
+            patch(
+                "devx.tools.check_test_coverage._load_rules",
+                return_value=(BUILTIN_RULES, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS),
+            ),
+            patch("devx.tools.check_test_coverage.Path.cwd", return_value=tmp_path),
+        ):
+            assert main([]) == 1
+
+    def test_warn_only_returns_0(self, tmp_path: Path) -> None:
+        with (
+            patch("devx.tools.check_test_coverage._changed_files", return_value=["scripts/foo.py"]),
+            patch(
+                "devx.tools.check_test_coverage._load_rules",
+                return_value=(BUILTIN_RULES, [], DEFAULT_TEST_INDICATORS, DEFAULT_SKIP_EXTENSIONS),
+            ),
+            patch("devx.tools.check_test_coverage.Path.cwd", return_value=tmp_path),
+        ):
+            assert main(["--warn-only"]) == 0
@@ -317,9 +317,9 @@ class TestCollectKeys:
        assert "completed" in keys
        assert "pending" in keys

-    def test_default_dir_includes_dynamic_keys(self) -> None:
-        """The default source dir should include DYNAMIC_KEYS."""
-        keys = check_translations.collect_keys(check_translations.DEFAULT_SRC_DIR)
+    def test_default_dir_includes_dynamic_keys(self, tmp_path: Path) -> None:
+        """collect_keys includes DYNAMIC_KEYS even with an empty source dir."""
+        keys = check_translations.collect_keys(tmp_path)
        assert "completed" in keys
        assert "pending" in keys
        assert "in_progress" in keys
@@ -162,6 +162,15 @@ class TestClassifierConfig:
        assert config.user_facing_overrides == []
        assert config.tags == {}

+    def test_from_pyproject_dedupes_existing_default(self, tmp_path: Path) -> None:
+        """Project infrastructure patterns already in defaults are not duplicated."""
+        pyproject = tmp_path / "pyproject.toml"
+        pyproject.write_text('[tool.devx.classify]\ninfrastructure = [".gitea/**", "scripts/**"]\n')
+        config = ClassifierConfig.from_pyproject(str(pyproject))
+        # .gitea/** should appear only once (deduplicated with defaults)
+        assert config.infrastructure.count(".gitea/**") == 1
+        assert "scripts/**" in config.infrastructure
+
    def test_defaults_are_empty_for_bare_constructor(self) -> None:
        """ClassifierConfig() without from_pyproject has empty lists."""
        config = ClassifierConfig()
@@ -515,6 +524,27 @@ class TestMain:
        assert "Ansible files" in result.output
        assert "ansible/tasks/main.yml" in result.output

+    @patch("devx.ci.classify_changes._get_classifier")
+    @patch("devx.ci.classify_changes.get_changed_files")
+    @patch("devx.ci.classify_changes.get_latest_tag", return_value="v0.3.0")
+    def test_default_mode_skips_empty_tag(
+        self, mock_tag: MagicMock, mock_changes: MagicMock, mock_clf: MagicMock
+    ) -> None:
+        """Tags with no matching files are skipped in default mode output."""
+        mock_changes.return_value = ["ansible/tasks/main.yml"]
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={"ansible": ["ansible/**"], "docs": ["docs/**"]},
+            )
+        )
+        runner = CliRunner()
+        result = runner.invoke(main, [])
+        assert result.exit_code == 0
+        assert "Ansible files" in result.output
+        # docs tag has no matching files — should not appear
+        assert "Docs files" not in result.output
+
    @patch("devx.ci.classify_changes.get_latest_tag", return_value="")
    def test_no_tags_non_quiet(self, mock_tag: MagicMock) -> None:
        runner = CliRunner()
@@ -742,3 +772,95 @@ class TestGithubOutput:
        assert "user-facing-changed=true" in content
        # No tag outputs since no tags are configured
        assert "ansible-changed" not in content
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_force_outputs_true(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """--force with --github-output writes user-facing-changed=true and all tags true."""
+        mock_clf.return_value = self._make_classifier_with_ansible()
+        gh_file = tmp_path / "output.txt"
+        monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
+        runner = CliRunner()
+        result = runner.invoke(main, ["--github-output", "--force"])
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "user-facing-changed=true" in content
+        assert "ansible-changed=true" in content
+        assert "Forced user-facing-changed=true" in result.output
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_force_without_github_output_does_nothing(
+        self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """--force without --github-output falls through to normal classification."""
+        mock_clf.return_value = self._make_classifier_with_ansible()
+        monkeypatch.setenv("GITHUB_OUTPUT", str(tmp_path / "output.txt"))
+        with patch.object(classify_changes_mod, "get_latest_tag", return_value="v1.0"):
+            with patch.object(classify_changes_mod, "get_changed_files", return_value=[]):
+                runner = CliRunner()
+                result = runner.invoke(main, ["--force", "--quiet"])
+        assert result.exit_code == 0
+        assert result.output.strip() == "false"
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_force_no_tags(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """--force with --github-output and no tags writes only user-facing-changed=true."""
+        mock_clf.return_value = ChangeClassifier(
+            ClassifierConfig(
+                infrastructure=[".gitea/**"],
+                tags={},
+            )
+        )
+        gh_file = tmp_path / "output.txt"
+        monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
+        runner = CliRunner()
+        result = runner.invoke(main, ["--github-output", "--force"])
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "user-facing-changed=true" in content
+        assert "ansible-changed" not in content
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_force_deploy_env_var(self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """FORCE_DEPLOY=true env var activates force mode without --force flag."""
+        mock_clf.return_value = self._make_classifier_with_ansible()
+        gh_file = tmp_path / "output.txt"
+        monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
+        monkeypatch.setenv("FORCE_DEPLOY", "true")
+        runner = CliRunner()
+        result = runner.invoke(main, ["--github-output"])
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "user-facing-changed=true" in content
+        assert "ansible-changed=true" in content
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_force_deploy_env_var_false(
+        self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """FORCE_DEPLOY=false does not activate force mode."""
+        mock_clf.return_value = self._make_classifier_with_ansible()
+        gh_file = tmp_path / "output.txt"
+        monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
+        monkeypatch.setenv("FORCE_DEPLOY", "false")
+        with patch.object(classify_changes_mod, "get_latest_tag", return_value="v1.0"):
+            with patch.object(classify_changes_mod, "get_changed_files", return_value=[]):
+                runner = CliRunner()
+                result = runner.invoke(main, ["--github-output"])
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "user-facing-changed=false" in content
+
+    @patch("devx.ci.classify_changes._get_classifier")
+    def test_force_flag_overrides_env_var(
+        self, mock_clf: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """--force flag works even when FORCE_DEPLOY=false."""
+        mock_clf.return_value = self._make_classifier_with_ansible()
+        gh_file = tmp_path / "output.txt"
+        monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
+        monkeypatch.setenv("FORCE_DEPLOY", "false")
+        runner = CliRunner()
+        result = runner.invoke(main, ["--github-output", "--force"])
+        assert result.exit_code == 0
+        content = gh_file.read_text()
+        assert "user-facing-changed=true" in content
@@ -1,12 +1,14 @@
 """Unit tests for config module constants."""

+import importlib
+from pathlib import Path
+
 from devx.config import (
    CONVENTIONAL_RE,
    DEFAULT_PER_PAGE,
    DEFAULT_TIMEOUT,
    GITEA_API_URL,
    MAX_RETRIES,
-    REPO_OWNER,
    RETRY_BACKOFF_BASE,
    RETRY_STATUS_CODES,
    TASK_ID_RE,
@@ -20,25 +22,10 @@ class TestConfigConstants:
        assert "api/v1" in GITEA_API_URL
        assert "api/v1" in VIKUNJA_API_URL

-    def test_project_ids(self, monkeypatch: object) -> None:
-        """VIKUNJA_PROJECT_ID defaults to 6 when DEVX_VIKUNJA_PROJECT_ID is not set."""
-        monkeypatch.delenv("DEVX_VIKUNJA_PROJECT_ID", raising=False)
-        import importlib
-
-        import devx.config as cfg
-
-        importlib.reload(cfg)
-        assert cfg.VIKUNJA_PROJECT_ID == 6
-        # Restore module state
-        importlib.reload(cfg)
-
    def test_timeouts(self) -> None:
        assert DEFAULT_TIMEOUT == 30
        assert DEFAULT_PER_PAGE == 50

-    def test_owner(self) -> None:
-        assert REPO_OWNER == ""
-
    def test_task_prefix(self) -> None:
        assert TASK_PREFIX == "DEVX"

@@ -64,28 +51,122 @@ class TestConfigConstants:
        assert 503 in RETRY_STATUS_CODES
        assert 504 in RETRY_STATUS_CODES

-    def test_env_var_override(self, monkeypatch: object) -> None:
-        """Test that env vars override defaults at import time."""
-        # We can't easily re-import the module, but we can verify
-        # the constants respect env vars by checking the module source.
+
+class TestPyprojectReading:
+    """Test that config.py reads [tool.devx] from pyproject.toml."""
+
+    def test_pyproject_provides_values(self) -> None:
+        """When pyproject.toml has [tool.devx], values are read from it."""
        import devx.config as cfg

-        assert cfg.GITEA_API_URL  # always non-empty
-        assert cfg.VIKUNJA_API_URL  # always non-empty
+        # devx's own pyproject.toml has task_prefix=DEVX, vikunja_project_id=8
+        assert cfg.TASK_PREFIX == "DEVX"
+        assert cfg.VIKUNJA_PROJECT_ID == 8
+        assert cfg.REPO_OWNER == "oblachno-oss"
+
+    def test_env_overrides_pyproject(self, monkeypatch: object) -> None:
+        """Env vars take priority over pyproject.toml."""
+        monkeypatch.setenv("DEVX_TASK_PREFIX", "CUSTOM")
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.TASK_PREFIX == "CUSTOM"
+        assert cfg.TASK_ID_RE.search("CUSTOM-42")
+        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
+        importlib.reload(cfg)
+
+    def test_no_pyproject_falls_back_to_defaults(self, monkeypatch: object, tmp_path: Path) -> None:
+        """When no pyproject.toml exists, defaults are used."""
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
+        monkeypatch.delenv("DEVX_VIKUNJA_PROJECT_ID", raising=False)
+        monkeypatch.delenv("DEVX_REPO_OWNER", raising=False)
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.TASK_PREFIX == "DEVX"
+        assert cfg.VIKUNJA_PROJECT_ID == 6
+        assert cfg.REPO_OWNER == ""
+        importlib.reload(cfg)
+
+    def test_invalid_toml_falls_back_to_defaults(self, monkeypatch: object, tmp_path: Path) -> None:
+        """When pyproject.toml is invalid TOML, defaults are used."""
+        (tmp_path / "pyproject.toml").write_text("invalid toml {{{")
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.TASK_PREFIX == "DEVX"
+        importlib.reload(cfg)
+
+    def test_no_devx_section_falls_back_to_defaults(self, monkeypatch: object, tmp_path: Path) -> None:
+        """When pyproject.toml has no [tool.devx], defaults are used."""
+        (tmp_path / "pyproject.toml").write_text('[project]\nname = "test"\n')
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
+        monkeypatch.delenv("DEVX_VIKUNJA_PROJECT_ID", raising=False)
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.TASK_PREFIX == "DEVX"
+        assert cfg.VIKUNJA_PROJECT_ID == 6
+        importlib.reload(cfg)
+
+    def test_pyproject_int_value_used(self, monkeypatch: object, tmp_path: Path) -> None:
+        """When pyproject.toml has an int value, it is used (covers _get_int return)."""
+        (tmp_path / "pyproject.toml").write_text('[project]\nname = "test"\n[tool.devx]\nvikunja_project_id = 42\n')
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("DEVX_VIKUNJA_PROJECT_ID", raising=False)
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.VIKUNJA_PROJECT_ID == 42
+        importlib.reload(cfg)
+
+    def test_env_int_override(self, monkeypatch: object, tmp_path: Path) -> None:
+        """Env var override for int config takes priority over pyproject.toml."""
+        (tmp_path / "pyproject.toml").write_text('[project]\nname = "test"\n[tool.devx]\nvikunja_project_id = 42\n')
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.setenv("DEVX_VIKUNJA_PROJECT_ID", "99")
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.VIKUNJA_PROJECT_ID == 99
+        importlib.reload(cfg)
+
+    def test_tool_not_dict_falls_back_to_defaults(self, monkeypatch: object, tmp_path: Path) -> None:
+        """When [tool] is not a dict, defaults are used."""
+        (tmp_path / "pyproject.toml").write_text('tool = "not a dict"\n')
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.TASK_PREFIX == "DEVX"
+        importlib.reload(cfg)
+
+    def test_devx_not_dict_falls_back_to_defaults(self, monkeypatch: object, tmp_path: Path) -> None:
+        """When [tool.devx] is not a dict, defaults are used."""
+        (tmp_path / "pyproject.toml").write_text('[tool]\ndevx = "not a dict"\n')
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
+        import devx.config as cfg
+
+        importlib.reload(cfg)
+        assert cfg.TASK_PREFIX == "DEVX"
+        importlib.reload(cfg)


 class TestTaskPrefixOverride:
    def test_task_prefix_from_env(self, monkeypatch: object) -> None:
        """Verify TASK_PREFIX reads from DEVX_TASK_PREFIX env var."""
        monkeypatch.setenv("DEVX_TASK_PREFIX", "INFRA")
-        import importlib
-
        import devx.config as cfg

        importlib.reload(cfg)
        assert cfg.TASK_PREFIX == "INFRA"
        assert cfg.TASK_ID_RE.search("INFRA-42")
        assert not cfg.TASK_ID_RE.search("DEVX-42")
-        # Restore
        monkeypatch.delenv("DEVX_TASK_PREFIX", raising=False)
        importlib.reload(cfg)
@@ -0,0 +1,193 @@
+"""Unit tests for devx.tools.create_pr."""
+
+from unittest.mock import MagicMock, patch
+
+import click
+import pytest
+from click.testing import CliRunner
+
+from devx.tools.create_pr import (
+    cli,
+    create_pr,
+    extract_task_id,
+    find_existing_pr,
+    get_repo_name,
+    get_vikunja_task_title,
+)
+
+
+class TestExtractTaskId:
+    def test_valid(self) -> None:
+        assert extract_task_id("DEVX-42-fix") == "DEVX-42"
+
+    def test_invalid(self) -> None:
+        assert extract_task_id("feature") == ""
+
+
+class TestGetRepoName:
+    @patch.dict("os.environ", {"DEVX_REPO_NAME": "infra"})
+    def test_from_env(self) -> None:
+        assert get_repo_name() == "infra"
+
+    @patch.dict("os.environ", {"GITHUB_REPOSITORY": "oblachno/infra"}, clear=True)
+    def test_from_github(self) -> None:
+        assert get_repo_name() == "infra"
+
+    @patch.dict("os.environ", {}, clear=True)
+    def test_missing_raises(self) -> None:
+        with pytest.raises(click.ClickException, match="Repository name"):
+            get_repo_name()
+
+
+class TestGetVikunjaTaskTitle:
+    @patch("devx.tools.create_pr.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_found(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = [{"identifier": "DEVX-42", "title": "Add feature"}]
+        mock_client_cls.return_value = mock_client
+        assert get_vikunja_task_title("DEVX-42") == "Add feature"
+
+    @patch.dict("os.environ", {}, clear=True)
+    def test_no_token(self) -> None:
+        with pytest.raises(click.ClickException, match="VIKUNJA_TOKEN"):
+            get_vikunja_task_title("DEVX-42")
+
+    @patch("devx.tools.create_pr.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_not_found(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = []
+        mock_client_cls.return_value = mock_client
+        with pytest.raises(click.ClickException, match="Could not find"):
+            get_vikunja_task_title("DEVX-42")
+
+    @patch("devx.tools.create_pr.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_pagination_not_found(self, mock_client_cls: MagicMock) -> None:
+        from devx.config import DEFAULT_PER_PAGE
+
+        mock_client = MagicMock()
+        page1 = [{"identifier": f"OTHER-{i}"} for i in range(DEFAULT_PER_PAGE)]
+        page2 = [{"identifier": "OTHER-99"}]
+        mock_client.list_project_tasks.side_effect = [page1, page2]
+        mock_client_cls.return_value = mock_client
+        with pytest.raises(click.ClickException, match="Could not find"):
+            get_vikunja_task_title("DEVX-42")
+
+
+class TestFindExistingPr:
+    def test_found(self) -> None:
+        client = MagicMock()
+        client.list_prs.return_value = [{"head": {"ref": "DEVX-42-fix"}, "number": 10}]
+        result = find_existing_pr(client, "DEVX-42-fix")
+        assert result is not None
+        assert result["number"] == 10
+
+    def test_not_found(self) -> None:
+        client = MagicMock()
+        client.list_prs.return_value = [{"head": {"ref": "other"}, "number": 10}]
+        result = find_existing_pr(client, "DEVX-42-fix")
+        assert result is None
+
+
+class TestCreatePr:
+    @patch("devx.tools.create_pr.GiteaClient")
+    @patch("devx.tools.create_pr.get_vikunja_task_title", return_value="Add feature")
+    @patch("devx.tools.create_pr.find_existing_pr", return_value=None)
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    def test_creates_new_pr(self, mock_find: MagicMock, mock_title: MagicMock, mock_gitea: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.create_pr.return_value = {"number": 15, "html_url": "https://git.example.com/pr/15"}
+        mock_gitea.return_value = mock_client
+        result = create_pr("DEVX-42-fix", "master", "body", "owner", "repo")
+        assert result["number"] == 15
+        mock_client.create_pr.assert_called_once_with(
+            title="DEVX-42: Add feature",
+            head="DEVX-42-fix",
+            base="master",
+            body="body",
+        )
+
+    @patch("devx.tools.create_pr.GiteaClient")
+    @patch("devx.tools.create_pr.get_vikunja_task_title", return_value="Add feature")
+    @patch("devx.tools.create_pr.find_existing_pr")
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    def test_existing_pr_idempotent(self, mock_find: MagicMock, mock_title: MagicMock, mock_gitea: MagicMock) -> None:
+        mock_find.return_value = {"number": 10, "html_url": "https://git.example.com/pr/10"}
+        mock_client = MagicMock()
+        mock_gitea.return_value = mock_client
+        result = create_pr("DEVX-42-fix", "master", "", "owner", "repo")
+        assert result["number"] == 10
+        mock_client.create_pr.assert_not_called()
+
+    @patch.dict("os.environ", {}, clear=True)
+    def test_no_repo_token(self) -> None:
+        with pytest.raises(click.ClickException, match="REPO_TOKEN"):
+            create_pr("DEVX-42-fix", "master", "", "owner", "repo")
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    def test_no_task_id_in_branch(self) -> None:
+        with pytest.raises(click.ClickException, match="does not contain a task ID"):
+            create_pr("feature-branch", "master", "", "owner", "repo")
+
+
+class TestCli:
+    @patch("devx.tools.create_pr.create_pr")
+    @patch("devx.tools.create_pr.subprocess.run")
+    @patch("devx.tools.create_pr.REPO_OWNER", "owner")
+    @patch("devx.tools.create_pr.get_repo_name", return_value="repo")
+    def test_auto_detect_branch(self, mock_repo: MagicMock, mock_run: MagicMock, mock_create: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="DEVX-42-fix\n", returncode=0)
+        mock_create.return_value = {"number": 1}
+        runner = CliRunner()
+        result = runner.invoke(cli, [])
+        assert result.exit_code == 0
+        mock_create.assert_called_once_with("DEVX-42-fix", "master", "", "owner", "repo")
+
+    @patch("devx.tools.create_pr.create_pr")
+    @patch("devx.tools.create_pr.REPO_OWNER", "owner")
+    @patch("devx.tools.create_pr.get_repo_name", return_value="repo")
+    def test_explicit_branch(self, mock_repo: MagicMock, mock_create: MagicMock) -> None:
+        mock_create.return_value = {"number": 1}
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--branch", "DEVX-42-fix"])
+        assert result.exit_code == 0
+
+    @patch("devx.tools.create_pr.create_pr")
+    @patch("devx.tools.create_pr.REPO_OWNER", "owner")
+    @patch("devx.tools.create_pr.get_repo_name", return_value="repo")
+    def test_body_from_stdin(self, mock_repo: MagicMock, mock_create: MagicMock) -> None:
+        mock_create.return_value = {"number": 1}
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--branch", "DEVX-42-fix", "--body", "-"], input="PR body text")
+        assert result.exit_code == 0
+        mock_create.assert_called_once()
+        assert mock_create.call_args.args[2] == "PR body text"
+
+    @patch("devx.tools.create_pr.REPO_OWNER", "")
+    @patch("devx.tools.create_pr.get_repo_name", return_value="repo")
+    def test_missing_owner(self, mock_repo: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--branch", "DEVX-42-fix"])
+        assert result.exit_code != 0
+        assert "owner" in result.output.lower()
+
+    @patch("devx.tools.create_pr.create_pr")
+    @patch("devx.tools.create_pr.get_repo_name", return_value="repo")
+    def test_explicit_owner(self, mock_repo: MagicMock, mock_create: MagicMock) -> None:
+        mock_create.return_value = {"number": 1}
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--branch", "DEVX-42-fix", "--owner", "custom"])
+        assert result.exit_code == 0
+        mock_create.assert_called_once_with("DEVX-42-fix", "master", "", "custom", "repo")
+
+    @patch("devx.tools.create_pr.subprocess.run")
+    @patch("devx.tools.create_pr.REPO_OWNER", "owner")
+    @patch("devx.tools.create_pr.get_repo_name", return_value="repo")
+    def test_git_detect_failure(self, mock_repo: MagicMock, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="", stderr="fatal: not a git repository", returncode=128)
+        runner = CliRunner()
+        result = runner.invoke(cli, [])
+        assert result.exit_code != 0
+        assert "Could not detect" in result.output
@@ -0,0 +1,83 @@
+"""Unit tests for devx.tools.create_task."""
+
+from unittest.mock import MagicMock, patch
+
+from click.testing import CliRunner
+
+from devx.tools.create_task import cli
+
+
+class TestCreateTaskCli:
+    @patch("devx.tools.create_task.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_success(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.create_task.return_value = {"identifier": "DEVX-60", "id": 60}
+        mock_client_cls.return_value = mock_client
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--title", "Add feature X"])
+        assert result.exit_code == 0
+        assert "DEVX-60" in result.output
+        mock_client.create_task.assert_called_once()
+
+    @patch.dict("os.environ", {}, clear=True)
+    def test_missing_token(self) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--title", "Add feature X"])
+        assert result.exit_code != 0
+        assert "VIKUNJA_TOKEN" in result.output
+
+    @patch("devx.tools.create_task.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_with_description(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.create_task.return_value = {"identifier": "DEVX-61", "id": 61}
+        mock_client_cls.return_value = mock_client
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            ["--title", "Add feature Y", "--description", "<p>desc</p>"],
+        )
+        assert result.exit_code == 0
+        call_args = mock_client.create_task.call_args
+        assert call_args.args[1] == "Add feature Y"
+        assert call_args.args[2] == "<p>desc</p>"
+
+    @patch("devx.tools.create_task.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_description_from_stdin(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.create_task.return_value = {"identifier": "DEVX-62", "id": 62}
+        mock_client_cls.return_value = mock_client
+        runner = CliRunner()
+        result = runner.invoke(
+            cli,
+            ["--title", "Add feature Z", "--description", "-"],
+            input="<p>stdin desc</p>",
+        )
+        assert result.exit_code == 0
+        mock_client.create_task.assert_called_once()
+        call_args = mock_client.create_task.call_args
+        assert call_args.args[2] == "<p>stdin desc</p>"
+
+    @patch("devx.tools.create_task.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_custom_project_id(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.create_task.return_value = {"identifier": "GRM-10", "id": 10}
+        mock_client_cls.return_value = mock_client
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--title", "Task", "--project-id", "3"])
+        assert result.exit_code == 0
+        mock_client.create_task.assert_called_once_with(3, "Task", "")
+
+    @patch("devx.tools.create_task.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_no_identifier_in_response(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.create_task.return_value = {"id": 99}
+        mock_client_cls.return_value = mock_client
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--title", "Task"])
+        assert result.exit_code == 0
+        assert "id=99" in result.output
@@ -237,3 +237,15 @@ class TestMain:
        runner = CliRunner()
        result = runner.invoke(main, ["--github-output"])
        assert result.exit_code != 0
+
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=2)
+    def test_explicit_owner_and_repo(self, mock_count: MagicMock) -> None:
+        """When --owner and --repo are provided, env vars are not used."""
+        runner = CliRunner()
+        result = runner.invoke(main, ["--owner", "myorg", "--repo", "myrepo"])
+        assert result.exit_code == 0
+        mock_count.assert_called_once()
+        # Verify owner/repo passed through
+        args, kwargs = mock_count.call_args
+        assert "myorg" in args
+        assert "myrepo" in args
@@ -7,6 +7,7 @@ from click.testing import CliRunner

 from devx.ci.distribute_files import (
    DEFAULT_MAX_RUNNERS,
+    _file_weight,
    discover_files,
    distribute,
    files_for_runner,
@@ -169,3 +170,46 @@ def test_main_module_block() -> None:
    import devx.ci.distribute_files as mod

    assert hasattr(mod, "main")
+
+
+class TestFileWeight:
+    def test_weight_based_on_size(self, tmp_path: Path) -> None:
+        f = tmp_path / "test_big.py"
+        f.write_text("x" * 5000)
+        assert _file_weight(str(f)) == 5000
+
+    def test_min_weight_is_1(self, tmp_path: Path) -> None:
+        f = tmp_path / "empty.py"
+        f.write_text("")
+        assert _file_weight(str(f)) == 1
+
+    def test_nonexistent_file_returns_1(self) -> None:
+        assert _file_weight("/nonexistent/file.py") == 1
+
+
+class TestDistributeLpt:
+    def test_large_files_on_different_runners(self, tmp_path: Path) -> None:
+        """Two large files should go to different runners."""
+        big1 = tmp_path / "test_big1.py"
+        big2 = tmp_path / "test_big2.py"
+        small1 = tmp_path / "test_small1.py"
+        small2 = tmp_path / "test_small2.py"
+        big1.write_text("x" * 10000)
+        big2.write_text("x" * 10000)
+        small1.write_text("x")
+        small2.write_text("x")
+        files = [str(big1), str(big2), str(small1), str(small2)]
+        groups = distribute(files, 2)
+        runner_0 = groups[0]
+        runner_1 = groups[1]
+        # Big files should be on different runners
+        assert not (str(big1) in runner_0 and str(big2) in runner_0)
+        assert not (str(big1) in runner_1 and str(big2) in runner_1)
+
+    def test_all_files_preserved(self, tmp_path: Path) -> None:
+        for i in range(5):
+            (tmp_path / f"test_{i}.py").write_text(f"content {i}" * (i + 1))
+        files = [str(tmp_path / f"test_{i}.py") for i in range(5)]
+        groups = distribute(files, 3)
+        flat = sorted(f for group in groups for f in group)
+        assert flat == sorted(files)
@@ -13,6 +13,8 @@ from devx.molecule.distribute_molecule import (
    PLATFORMS,
    MultiRoleTestPair,
    TestPair,
+    _lpt_distribute,
+    _scenario_weight,
    build_multi_role_pairs,
    build_pairs,
    cli,
@@ -477,3 +479,111 @@ class TestCliMultiRole:
        result = runner.invoke(cli, ["--roles-root", str(roles), "--runner-index", "0", "--max-runners", "3"])
        assert result.exit_code != 0
        assert "out of range" in result.output
+
+
+class TestScenarioWeight:
+    def test_known_heavy_scenario(self) -> None:
+        assert _scenario_weight("nextcloud") == 15
+        assert _scenario_weight("gitea") == 8
+
+    def test_known_light_scenario(self) -> None:
+        assert _scenario_weight("binary") == 2
+
+    def test_default_weight(self) -> None:
+        assert _scenario_weight("unknown-scenario") == 3
+
+    def test_case_insensitive(self) -> None:
+        assert _scenario_weight("NextCloud") == 15
+        assert _scenario_weight("GITEA") == 8
+
+    def test_substring_match(self) -> None:
+        assert _scenario_weight("nextcloud-with-redis") == 15
+        assert _scenario_weight("custom-gitea-setup") == 8
+
+    def test_role_specific_weight(self) -> None:
+        """Role+scenario pairs take priority over scenario-name-only weights."""
+        assert _scenario_weight("default", "restore") == 11
+        assert _scenario_weight("default", "zitadel") == 10
+        assert _scenario_weight("default", "docker_base") == 8
+        assert _scenario_weight("default", "app_hardening") == 4
+        assert _scenario_weight("default", "app_container") == 3
+        assert _scenario_weight("default", "storage") == 3
+        assert _scenario_weight("default", "observability") == 3
+
+    def test_role_specific_overrides_scenario_name(self) -> None:
+        """vaultwarden has a scenario-name weight of 2, but role-specific is also 2."""
+        assert _scenario_weight("vaultwarden", "app_container") == 2
+        assert _scenario_weight("vaultwarden") == 2
+
+    def test_customer_apps_weight(self) -> None:
+        assert _scenario_weight("customer-apps", "app_container") == 11
+        assert _scenario_weight("customer-apps") == 11
+
+
+class TestLptDistribute:
+    def test_equal_weights_produce_even_split(self) -> None:
+        items = list(range(6))
+        weights = [3, 3, 3, 3, 3, 3]
+        groups = _lpt_distribute(items, weights, 3)
+        assert all(len(g) == 2 for g in groups)
+
+    def test_heavy_items_on_different_runners(self) -> None:
+        """Two heavy items should go to different runners."""
+        items = ["heavy-a", "heavy-b", "light-1", "light-2"]
+        weights = [10, 10, 1, 1]
+        groups = _lpt_distribute(items, weights, 2)
+        # Heavy items should be on different runners
+        flat = [item for group in groups for item in group]
+        assert "heavy-a" in flat
+        assert "heavy-b" in flat
+        runner_a = next(i for i, g in enumerate(groups) if "heavy-a" in g)
+        runner_b = next(i for i, g in enumerate(groups) if "heavy-b" in g)
+        assert runner_a != runner_b
+
+    def test_load_balance_with_varying_weights(self) -> None:
+        """LPT should produce better load balance than round-robin."""
+        items = list(range(7))
+        # Simulate infra-like weights: 2 heavy, 2 medium, 3 light
+        weights = [10, 10, 7, 7, 3, 3, 3]
+        groups = _lpt_distribute(items, weights, 3)
+        loads = [sum(weights[i] for i in g) for g in groups]
+        # LPT should produce loads close to total/3 = 43/3 ≈ 14.3
+        # Round-robin would produce: 10+7+3=20, 10+7+3=20, 3=3 (terrible)
+        assert max(loads) - min(loads) <= 10  # Reasonably balanced
+
+    def test_more_runners_than_items(self) -> None:
+        items = ["a"]
+        weights = [5]
+        groups = _lpt_distribute(items, weights, 5)
+        assert len(groups) == 5
+        assert len(groups[0]) == 1
+        assert all(len(g) == 0 for g in groups[1:])
+
+    def test_empty_items(self) -> None:
+        groups = _lpt_distribute([], [], 3)
+        assert groups == [[], [], []]
+
+    def test_preserves_all_items(self) -> None:
+        items = ["a", "b", "c", "d", "e"]
+        weights = [5, 3, 8, 1, 2]
+        groups = _lpt_distribute(items, weights, 3)
+        flat = sorted(item for group in groups for item in group)
+        assert flat == sorted(items)
+
+
+class TestDistributeLpt:
+    def test_nextcloud_on_separate_runners(self) -> None:
+        """Two nextcloud scenarios should go to different runners."""
+        pairs = [
+            TestPair("nextcloud", {"name": "p", "image": "i", "command": ""}),
+            TestPair("nextcloud-backup", {"name": "p", "image": "i", "command": ""}),
+            TestPair("binary", {"name": "p", "image": "i", "command": ""}),
+            TestPair("default", {"name": "p", "image": "i", "command": ""}),
+        ]
+        groups = distribute(pairs, 2)
+        # Both nextcloud scenarios (weight 10) should be on different runners
+        runner_0 = [p.scenario for p in groups[0]]
+        runner_1 = [p.scenario for p in groups[1]]
+        # nextcloud and nextcloud-backup should NOT be on the same runner
+        assert not ("nextcloud" in runner_0 and "nextcloud-backup" in runner_0)
+        assert not ("nextcloud" in runner_1 and "nextcloud-backup" in runner_1)
@@ -46,6 +46,21 @@ class TestExtractCliCommands:
        commands = extract_cli_commands()
        assert "my_command" in commands

+    def test_command_decorator_no_def_fallback(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        """When a command decorator has no name and no following def, it is skipped."""
+        from devx.ci import doc_coverage
+
+        fake_cli = tmp_path / "cli.py"
+        # The last @cli.command() has no explicit name and no def statement after it
+        fake_cli.write_text(
+            "@click.group()\ndef cli():\n    pass\n@cli.command()\ndef real_cmd():\n    pass\n@cli.command()\npass\n"
+        )
+        monkeypatch.setattr(doc_coverage, "CLI_FILE", fake_cli)
+        commands = extract_cli_commands()
+        # real_cmd should be found via def fallback; the bare @cli.command() is skipped
+        assert "real_cmd" in commands
+        assert "pass" not in commands
+

 class TestCheckCommandDocumented:
    def test_finds_command_in_heading(self) -> None:
@@ -97,6 +97,15 @@ class TestDetectCoverageTarget:
    def test_returns_none_when_no_package(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
        assert detect_coverage_target(tmp_path) is None

+    def test_pyproject_without_cov_falls_back_to_package(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        """When pyproject exists but has no --cov=, falls back to package name."""
+        src = tmp_path / "src"
+        pkg = src / "mypkg"
+        pkg.mkdir(parents=True)
+        (pkg / "__init__.py").write_text('__version__ = "1.0"\n')
+        (tmp_path / "pyproject.toml").write_text('[tool.pytest.ini_options]\naddopts = "-ra"\n')
+        assert detect_coverage_target(tmp_path) == "src/mypkg"
+

 class TestDetectTestpaths:
    def test_parses_from_pyproject(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
@@ -112,6 +121,14 @@ class TestDetectTestpaths:
        (tmp_path / "pyproject.toml").write_text('[tool.pytest.ini_options]\ntestpaths = ["tests", "nonexistent"]\n')
        assert detect_testpaths(tmp_path) == ["tests"]

+    def test_all_paths_nonexistent_falls_back_to_tests_dir(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        """When all testpaths are non-existent, falls back to tests/ directory."""
+        (tmp_path / "tests").mkdir()
+        (tmp_path / "pyproject.toml").write_text(
+            '[tool.pytest.ini_options]\ntestpaths = ["nonexistent1", "nonexistent2"]\n'
+        )
+        assert detect_testpaths(tmp_path) == ["tests"]
+
    def test_falls_back_to_tests_dir(self, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
        (tmp_path / "tests").mkdir()
        assert detect_testpaths(tmp_path) == ["tests"]
@@ -77,6 +77,12 @@ class TestTeaCLIRun:
            with pytest.raises(TeaCLIError, match="auth error"):
                cli._run(["labels", "list"])

+    def test_run_tea_not_found_raises_tea_error(self) -> None:
+        cli = TeaCLI(tea_bin="tea")
+        with patch("subprocess.run", side_effect=FileNotFoundError("tea not found")):
+            with pytest.raises(TeaCLIError, match="tea binary not found"):
+                cli._run(["labels", "list"])
+
    def test_run_includes_json_flag(self) -> None:
        cli = TeaCLI(tea_bin="/fake/tea")
        mock_result = MagicMock(returncode=0, stdout="[]", stderr="")
@@ -350,6 +356,6 @@ class TestListBranches:
 class TestWhoami:
    def test_whoami(self) -> None:
        cli = TeaCLI(tea_bin="/fake/tea")
-        mock_result = MagicMock(returncode=0, stdout="emil", stderr="")
+        mock_result = MagicMock(returncode=0, stdout="testuser", stderr="")
        with patch("subprocess.run", return_value=mock_result):
-            assert cli.whoami() == "emil"
+            assert cli.whoami() == "testuser"
@@ -116,7 +116,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_getpgid.return_value = 123
            proc = MagicMock()
@@ -163,7 +163,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg", side_effect=ProcessLookupError("no such process")),
            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_getpgid.return_value = 123
            proc = MagicMock()
@@ -208,7 +208,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_getpgid.return_value = 123
            proc = MagicMock()
@@ -97,6 +97,11 @@ class TestBuildEnvForPair:
        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_PLATFORM_COMMAND": "old"})
        assert "MOLECULE_PLATFORM_COMMAND" not in env

+    def test_preserves_existing_molecule_home(self) -> None:
+        """When MOLECULE_HOME is already set, it is not overridden."""
+        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_HOME": "/custom/home"})
+        assert env["MOLECULE_HOME"] == "/custom/home"
+

 class TestPollForOtherFailures:
    def test_sets_failed_event_when_other_runner_fails(self) -> None:
@@ -297,7 +302,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_getpgid.return_value = 123
            proc = MagicMock()
@@ -333,7 +338,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
            patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.05)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_get_jobs.return_value = [{"name": "molecule-tests (1)", "conclusion": "success"}]
            proc = MagicMock()
@@ -380,7 +385,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_getpgid.return_value = 123
            mock_killpg.side_effect = ProcessLookupError("no such process")
@@ -427,7 +432,7 @@ class TestCli:
            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0.1)),
+            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
        ):
            mock_getpgid.return_value = 123
            mock_killpg.side_effect = [None, ProcessLookupError("no such process")]
@@ -208,3 +208,14 @@ class TestMain:
        runner = CliRunner()
        result = runner.invoke(main, ["--github-output"])
        assert result.exit_code != 0
+
+    @patch("devx.molecule.discover_runners.get_runner_count", return_value=2)
+    def test_explicit_owner_and_repo(self, mock_count: MagicMock) -> None:
+        """When --owner and --repo are provided, env vars are not used."""
+        runner = CliRunner()
+        result = runner.invoke(main, ["--owner", "myorg", "--repo", "myrepo"])
+        assert result.exit_code == 0
+        mock_count.assert_called_once()
+        args, kwargs = mock_count.call_args
+        assert "myorg" in args
+        assert "myrepo" in args
@@ -129,6 +129,18 @@ class TestCheckArchitectureCompliance:
        assert result.has_issues
        assert "os.system" in result.issues[0]["body"]

+    def test_malformed_hunk_header_no_line_number(self) -> None:
+        """A @@ header without a +N line number is handled gracefully."""
+        result = ReviewResult()
+        files = [
+            {
+                "filename": "src/devx/cli.py",
+                "patch": "@@ -1,2 @@\n+    subprocess.run(['ls'])\n",
+            }
+        ]
+        check_architecture_compliance(files, result)
+        assert result.has_issues
+

 class TestCheckBestPractices:
    def test_print_triggers_warning(self) -> None:
@@ -190,6 +202,19 @@ class TestCheckBestPractices:
        check_best_practices(files, result)
        assert not result.has_issues

+    def test_malformed_hunk_header_no_line_number(self) -> None:
+        """A @@ header without a +N line number is handled gracefully."""
+        result = ReviewResult()
+        files = [
+            {
+                "filename": "src/devx/cli.py",
+                "patch": "@@ -1,2 @@\n+    print('hello')\n",
+            }
+        ]
+        check_best_practices(files, result)
+        assert result.has_issues
+        assert "print()" in result.issues[0]["body"]
+

 class TestCheckSecurity:
    def test_hardcoded_secret_triggers_error(self) -> None:
@@ -239,6 +264,19 @@ class TestCheckSecurity:
        check_security(files, result)
        assert not result.has_issues

+    def test_malformed_hunk_header_no_line_number(self) -> None:
+        """A @@ header without a +N line number is handled gracefully."""
+        result = ReviewResult()
+        files = [
+            {
+                "filename": "src/devx/config.py",
+                "patch": "@@ -1,2 @@\n+    token = 'abc123secrettoken456'\n",
+            }
+        ]
+        check_security(files, result)
+        assert result.has_issues
+        assert "secret" in result.issues[0]["body"].lower()
+

 class TestCheckI18n:
    def test_raw_string_in_echo_triggers_warning(self) -> None:
@@ -295,6 +333,14 @@ class TestCheckI18n:
        check_i18n(files, result)
        assert any("i18n: OK" in s for s in result.summary)

+    def test_malformed_hunk_header_no_line_number(self) -> None:
+        """A @@ header without a +N line number is handled gracefully."""
+        result = ReviewResult()
+        files = [{"filename": "src/devx/cli.py", "patch": '@@ -1,2 @@\n+click.echo("Hello world")\n'}]
+        check_i18n(files, result)
+        assert result.has_issues
+        assert any("i18n" in i["body"] for i in result.issues)
+

 class TestCheckResourceManagement:
    def test_open_without_with_triggers_warning(self) -> None:
@@ -366,6 +412,14 @@ class TestCheckResourceManagement:
        check_resource_management(files, result)
        assert any("Resource management: OK" in s for s in result.summary)

+    def test_malformed_hunk_header_no_line_number(self) -> None:
+        """A @@ header without a +N line number is handled gracefully."""
+        result = ReviewResult()
+        files = [{"filename": "src/devx/cli.py", "patch": '@@ -1,2 @@\n+f = open("file.txt")\n'}]
+        check_resource_management(files, result)
+        assert result.has_issues
+        assert any("resource" in i["body"].lower() for i in result.issues)
+

 class TestCheckFunctionLength:
    def test_long_function_triggers_warning(self) -> None:
@@ -429,6 +483,13 @@ class TestCheckFunctionLength:
        assert result.has_issues
        assert "foo" in result.issues[0]["body"]

+    def test_malformed_hunk_header_no_line_number(self) -> None:
+        """A @@ header without a +N line number is handled gracefully."""
+        result = ReviewResult()
+        files = [{"filename": "src/devx/cli.py", "patch": "@@ -1,2 @@\n+def foo():\n+    pass\n"}]
+        check_function_length(files, result)
+        assert not result.has_issues
+

 class TestCheckDocumentation:
    def test_src_changes_without_docs_warns(self) -> None:
@@ -0,0 +1,137 @@
+"""Unit tests for devx.tools.pre_push_check."""
+
+from unittest.mock import MagicMock, patch
+
+import click
+import pytest
+from click.testing import CliRunner
+
+from devx.tools.pre_push_check import (
+    cli,
+    extract_task_id,
+    get_current_branch,
+    task_exists,
+    validate,
+)
+
+
+class TestExtractTaskId:
+    def test_valid_branch(self) -> None:
+        assert extract_task_id("DEVX-42-fix-bug") == "DEVX-42"
+
+    def test_no_task_id(self) -> None:
+        assert extract_task_id("feature-branch") == ""
+
+    def test_empty_branch(self) -> None:
+        assert extract_task_id("") == ""
+
+
+class TestGetCurrentBranch:
+    @patch("devx.tools.pre_push_check.subprocess.run")
+    def test_success(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="DEVX-42-fix\n", returncode=0)
+        assert get_current_branch() == "DEVX-42-fix"
+
+    @patch("devx.tools.pre_push_check.subprocess.run")
+    def test_failure(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="", returncode=1)
+        assert get_current_branch() == ""
+
+
+class TestTaskExists:
+    @patch("devx.tools.pre_push_check.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_found(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = [{"identifier": "DEVX-42"}]
+        mock_client_cls.return_value = mock_client
+        assert task_exists("DEVX-42") is True
+
+    @patch("devx.tools.pre_push_check.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_not_found(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = [{"identifier": "DEVX-99"}]
+        mock_client_cls.return_value = mock_client
+        assert task_exists("DEVX-42") is False
+
+    @patch.dict("os.environ", {}, clear=True)
+    def test_no_token(self) -> None:
+        assert task_exists("DEVX-42") is False
+
+    @patch("devx.tools.pre_push_check.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_pagination(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        # First page: full page (50 items, none matching), second page: match
+        page1 = [{"identifier": f"OTHER-{i}"} for i in range(50)]
+        page2 = [{"identifier": "DEVX-42"}]
+        mock_client.list_project_tasks.side_effect = [page1, page2]
+        mock_client_cls.return_value = mock_client
+        assert task_exists("DEVX-42") is True
+
+    @patch("devx.tools.pre_push_check.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_empty_project(self, mock_client_cls: MagicMock) -> None:
+        mock_client = MagicMock()
+        mock_client.list_project_tasks.return_value = []
+        mock_client_cls.return_value = mock_client
+        assert task_exists("DEVX-42") is False
+
+    @patch("devx.tools.pre_push_check.VikunjaClient")
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_pagination_not_found(self, mock_client_cls: MagicMock) -> None:
+        from devx.config import DEFAULT_PER_PAGE
+
+        mock_client = MagicMock()
+        page1 = [{"identifier": f"OTHER-{i}"} for i in range(DEFAULT_PER_PAGE)]
+        page2 = [{"identifier": "OTHER-99"}]
+        mock_client.list_project_tasks.side_effect = [page1, page2]
+        mock_client_cls.return_value = mock_client
+        assert task_exists("DEVX-42") is False
+
+
+class TestValidate:
+    def test_master_branch_skips(self) -> None:
+        validate("master")
+
+    def test_main_branch_skips(self) -> None:
+        validate("main")
+
+    def test_empty_branch_skips(self) -> None:
+        validate("")
+
+    def test_no_task_id_raises(self) -> None:
+        with pytest.raises(click.ClickException, match="does not contain a task ID"):
+            validate("feature-branch")
+
+    @patch.dict("os.environ", {}, clear=True)
+    def test_no_token_warns(self) -> None:
+        validate("DEVX-42-fix-bug")
+
+    @patch("devx.tools.pre_push_check.task_exists", return_value=True)
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_task_exists_passes(self, mock_exists: MagicMock) -> None:
+        validate("DEVX-42-fix-bug")
+
+    @patch("devx.tools.pre_push_check.task_exists", return_value=False)
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_task_not_found_raises(self, mock_exists: MagicMock) -> None:
+        with pytest.raises(click.ClickException, match="not found"):
+            validate("DEVX-42-fix-bug")
+
+
+class TestCli:
+    @patch("devx.tools.pre_push_check.get_current_branch", return_value="master")
+    def test_auto_detect_master(self, mock_branch: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, [])
+        assert result.exit_code == 0
+
+    @patch("devx.tools.pre_push_check.task_exists", return_value=True)
+    @patch.dict("os.environ", {"VIKUNJA_TOKEN": "tok"})
+    def test_explicit_branch(self, mock_exists: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--branch", "DEVX-42-fix"])
+        assert result.exit_code == 0
+        assert "passed" in result.output
@@ -11,6 +11,8 @@ from devx.ci.publish import (
    _default_gitea_registry_url,
    build_package,
    generate_release_notes,
+    get_latest_tag,
+    is_release_commit,
    main,
    publish_to_gitea_registry,
    publish_to_pypi,
@@ -154,6 +156,13 @@ class TestDefaultGiteaRegistryUrl:
        url = _default_gitea_registry_url()
        assert "oblachno-oss" in url

+    @patch.dict("os.environ", {"DEVX_REPO_OWNER": "myorg"}, clear=True)
+    @patch("devx.ci.publish.GITEA_API_URL", "https://git.example.com/")
+    def test_no_api_suffix(self) -> None:
+        """URL without /api/v1 or /api suffix is used as-is."""
+        url = _default_gitea_registry_url()
+        assert url == "https://git.example.com/api/packages/myorg/pypi"
+

 class TestMain:
    @patch.dict("os.environ", {"REPO_TOKEN": "gitea-tok", "PYPI_TOKEN": "pypi-tok"})
@@ -385,5 +394,160 @@ class TestMain:
        runner = CliRunner()
        result = runner.invoke(main, ["v1.0.0", "owner/repo"])
        assert result.exit_code == 0
-        assert "Gitea release v1.0.0 created" in result.output
-        mock_tea.create_release.assert_called_once()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "gitea-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.publish_to_gitea_registry")
+    @patch("devx.ci.publish.publish_to_pypi")
+    @patch("devx.ci.publish.build_package")
+    def test_create_release_already_exists_is_idempotent(
+        self,
+        mock_build: MagicMock,
+        mock_publish: MagicMock,
+        mock_gitea_pub: MagicMock,
+        mock_tea_cls: MagicMock,
+        mock_notes: MagicMock,
+    ) -> None:
+        """If create_release fails with 'already exists', treat as success."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.side_effect = TeaCLIError("api error")
+        mock_tea.create_release.side_effect = TeaCLIError("there is already a release for this tag")
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo"])
+        assert result.exit_code == 0
+        assert "already exists" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "gitea-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.publish_to_gitea_registry")
+    @patch("devx.ci.publish.publish_to_pypi")
+    @patch("devx.ci.publish.build_package")
+    def test_create_release_other_error_raises(
+        self,
+        mock_build: MagicMock,
+        mock_publish: MagicMock,
+        mock_gitea_pub: MagicMock,
+        mock_tea_cls: MagicMock,
+        mock_notes: MagicMock,
+    ) -> None:
+        """If create_release fails with a non-'already exists' error, raise."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.side_effect = TeaCLIError("api error")
+        mock_tea.create_release.side_effect = TeaCLIError("network error")
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo"])
+        assert result.exit_code != 0
+        assert "Release creation failed" in result.output
+
+
+class TestFromTag:
+    def test_get_latest_tag_success(self) -> None:
+        import subprocess
+
+        with patch("devx.ci.publish.subprocess.run") as mock_run:
+            mock_run.return_value = subprocess.CompletedProcess(args=[], returncode=0, stdout="v1.2.3\n")
+            result = get_latest_tag()
+        assert result == "v1.2.3"
+
+    def test_get_latest_tag_no_tags(self) -> None:
+        import subprocess
+
+        with patch("devx.ci.publish.subprocess.run") as mock_run:
+            mock_run.side_effect = subprocess.CalledProcessError(1, [])
+            result = get_latest_tag()
+        assert result is None
+
+    def test_is_release_commit_match(self) -> None:
+        import subprocess
+
+        with patch("devx.ci.publish.subprocess.run") as mock_run:
+            mock_run.return_value = subprocess.CompletedProcess(
+                args=[], returncode=0, stdout="release: v1.2.3 [skip ci]\n"
+            )
+            result = is_release_commit("v1.2.3")
+        assert result is True
+
+    def test_is_release_commit_no_match(self) -> None:
+        import subprocess
+
+        with patch("devx.ci.publish.subprocess.run") as mock_run:
+            mock_run.return_value = subprocess.CompletedProcess(args=[], returncode=0, stdout="feat: add feature\n")
+            result = is_release_commit("v1.2.3")
+        assert result is False
+
+    def test_is_release_commit_git_error(self) -> None:
+        import subprocess
+
+        with patch("devx.ci.publish.subprocess.run") as mock_run:
+            mock_run.side_effect = subprocess.CalledProcessError(1, [])
+            result = is_release_commit("v1.2.3")
+        assert result is False
+
+    @patch("devx.ci.publish.get_latest_tag", return_value=None)
+    def test_from_tag_no_tag_skips(self, _mock: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, ["--from-tag", "--skip-build", "", "owner/repo"])
+        assert result.exit_code == 0
+        assert "No tag found" in result.output
+
+    @patch("devx.ci.publish.get_latest_tag", return_value=None)
+    def test_from_tag_no_repo_uses_env(self, _mock: MagicMock) -> None:
+        runner = CliRunner()
+        with patch.dict("os.environ", {"GITHUB_REPOSITORY": "owner/repo"}):
+            result = runner.invoke(main, ["--from-tag", "--skip-build"])
+        assert result.exit_code == 0
+        assert "No tag found" in result.output
+
+    @patch("devx.ci.publish.get_latest_tag", return_value=None)
+    def test_from_tag_no_repo_no_env_raises(self, _mock: MagicMock) -> None:
+        runner = CliRunner()
+        with patch.dict("os.environ", {}, clear=True):
+            result = runner.invoke(main, ["--from-tag", "--skip-build"])
+        assert result.exit_code != 0
+        assert "REPO argument is required" in result.output
+
+    @patch("devx.ci.publish.is_release_commit", return_value=False)
+    @patch("devx.ci.publish.get_latest_tag", return_value="v1.0.0")
+    def test_from_tag_not_release_commit_skips(self, _mock_tag: MagicMock, _mock_rel: MagicMock) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, ["--from-tag", "--skip-build", "", "owner/repo"])
+        assert result.exit_code == 0
+        assert "not a release commit" in result.output
+
+    @patch("devx.ci.publish.is_release_commit", return_value=True)
+    @patch("devx.ci.publish.get_latest_tag", return_value="v1.0.0")
+    def test_from_tag_publishes(self, _mock_tag: MagicMock, _mock_rel: MagicMock) -> None:
+        with patch.dict("os.environ", {"REPO_TOKEN": "fake"}):
+            with patch("devx.ci.publish.TeaCLI") as mock_tea_cls:
+                mock_tea = MagicMock()
+                mock_tea.list_releases.return_value = []
+                mock_tea_cls.return_value = mock_tea
+                with patch("devx.ci.publish.generate_release_notes", return_value="notes"):
+                    runner = CliRunner()
+                    result = runner.invoke(main, ["--from-tag", "--skip-build", "", "owner/repo"])
+        assert result.exit_code == 0
+        assert "Publishing release v1.0.0" in result.output
+
+    @patch("devx.ci.publish.is_release_commit", return_value=True)
+    @patch("devx.ci.publish.get_latest_tag", return_value="v1.0.0")
+    def test_from_tag_publishes_no_repo_arg(self, _mock_tag: MagicMock, _mock_rel: MagicMock) -> None:
+        with patch.dict("os.environ", {"REPO_TOKEN": "fake", "GITHUB_REPOSITORY": "owner/repo"}):
+            with patch("devx.ci.publish.TeaCLI") as mock_tea_cls:
+                mock_tea = MagicMock()
+                mock_tea.list_releases.return_value = []
+                mock_tea_cls.return_value = mock_tea
+                with patch("devx.ci.publish.generate_release_notes", return_value="notes"):
+                    runner = CliRunner()
+                    result = runner.invoke(main, ["--from-tag", "--skip-build"])
+        assert result.exit_code == 0
+        assert "Publishing release v1.0.0" in result.output
+
+    def test_no_tag_no_from_tag_raises(self) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, ["", "owner/repo", "--skip-build"])
+        assert result.exit_code != 0
+        assert "Tag is required" in result.output
@@ -1,5 +1,7 @@
 """Unit tests for scripts/ci/release.py."""

+import os
+from pathlib import Path
 from unittest.mock import MagicMock, patch

 import click
@@ -508,6 +510,30 @@ class TestVerifyAlignment:
        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
        assert verify_alignment() == 1

+    @patch("devx.ci.release.run_cmd")
+    @patch("devx.ci.release.get_changelog_versions")
+    @patch("devx.ci.release.get_init_version")
+    @patch("devx.ci.release.verify_tag_consistency")
+    @patch("devx.ci.release.get_all_tags")
+    @patch("devx.ci.release.get_latest_tag")
+    def test_no_latest_tag_skips_changelog_tag_check(
+        self,
+        mock_lt: MagicMock,
+        mock_tags: MagicMock,
+        mock_vtc: MagicMock,
+        mock_iv: MagicMock,
+        mock_cv: MagicMock,
+        mock_run_cmd: MagicMock,
+    ) -> None:
+        """When there is no latest tag, the CHANGELOG/tag match check is skipped."""
+        mock_lt.return_value = None  # no tags
+        mock_tags.return_value = []
+        mock_vtc.return_value = []
+        mock_iv.return_value = "0.4.4"
+        mock_cv.return_value = ["0.4.4"]  # changelog has versions but no tag to compare
+        mock_run_cmd.return_value = MagicMock(returncode=0, stdout="", stderr="")
+        assert verify_alignment() == 0
+
    @patch("devx.ci.release.run_cmd")
    @patch("devx.ci.release.get_changelog_versions")
    @patch("devx.ci.release.get_init_version")
@@ -756,6 +782,16 @@ class TestUpdateChangelog:
        assert "# Changelog" not in content
        assert "## [0.2.0]" in content

+    def test_no_version_section_in_changelog(self, tmp_path, monkeypatch) -> None:
+        """Changelog input without any ## [ version section is inserted as-is."""
+        changelog_file = tmp_path / "CHANGELOG.md"
+        changelog_file.write_text("# Changelog\n\n## [0.1.0] - 2026-06-20\n\n### Features\n- old thing\n")
+        monkeypatch.setattr("devx.ci.release.CHANGELOG_FILE", str(changelog_file))
+        # No ## [ section in the cliff output — should not be stripped
+        update_changelog("Some raw text without version header")
+        content = changelog_file.read_text()
+        assert "Some raw text without version header" in content
+

 class TestCommitReleaseChanges:
    @patch("devx.ci.release.run_cmd")
@@ -781,11 +817,23 @@ class TestCommitReleaseChanges:
 class TestCreateAndPushTag:
    @patch("devx.ci.release.tag_exists", return_value=False)
    @patch("devx.ci.release.run_cmd")
-    def test_creates_tag(self, mock_run_cmd: MagicMock, mock_tag_exists: MagicMock) -> None:
-        create_and_push_tag("0.2.0", "changelog", dry_run=False)
+    def test_creates_tag(self, mock_run_cmd: MagicMock, mock_tag_exists: MagicMock, tmp_path: Path) -> None:
+        github_output = tmp_path / "output.txt"
+        with patch.dict(os.environ, {"GITHUB_OUTPUT": str(github_output)}):
+            create_and_push_tag("0.2.0", "changelog", dry_run=False)
        calls = [c.args[0] for c in mock_run_cmd.call_args_list]
        assert ["git", "tag", "-a", "v0.2.0", "-m", "Release v0.2.0\n\nchangelog"] in calls
        assert ["git", "push", "origin", "refs/tags/v0.2.0"] in calls
+        assert github_output.read_text() == "tag=v0.2.0\n"
+
+    @patch("devx.ci.release.tag_exists", return_value=False)
+    @patch("devx.ci.release.run_cmd")
+    def test_no_github_output_skips_write(self, mock_run_cmd: MagicMock, mock_tag_exists: MagicMock) -> None:
+        with patch.dict(os.environ, {}, clear=True):
+            create_and_push_tag("0.2.0", "changelog", dry_run=False)
+        # Should still create tag, just not write GITHUB_OUTPUT
+        calls = [c.args[0] for c in mock_run_cmd.call_args_list]
+        assert ["git", "tag", "-a", "v0.2.0", "-m", "Release v0.2.0\n\nchangelog"] in calls

    @patch("devx.ci.release.tag_exists", return_value=False)
    @patch("devx.ci.release.run_cmd")
@@ -186,6 +186,12 @@ class TestVerify:
        mock_run.side_effect = subprocess.TimeoutExpired(cmd="devx", timeout=10)
        _verify(".venv/bin")  # Should not raise

+    @patch("devx.tools.setup.subprocess.run")
+    def test_verify_handles_nonzero_returncode(self, mock_run: MagicMock) -> None:
+        """When a tool returns non-zero, it is skipped without raising."""
+        mock_run.return_value = MagicMock(returncode=1, stdout="", stderr="error")
+        _verify(".venv/bin")  # Should not raise
+

 class TestMain:
    @patch("devx.tools.setup._configure_tea_login")
@@ -304,6 +310,28 @@ class TestMain:
        assert result.exit_code != 0
        assert "Bin directory not found" in result.output

+    @patch("devx.tools.setup._verify")
+    @patch("devx.tools.setup._configure_tea_login")
+    @patch("devx.tools.setup._install_pre_commit_hooks")
+    @patch("devx.tools.setup._install_ansible_collections")
+    @patch("devx.tools.setup._install_python_deps")
+    def test_main_skip_install(
+        self,
+        mock_install_deps: MagicMock,
+        mock_install_ansible: MagicMock,
+        mock_install_hooks: MagicMock,
+        mock_verify: MagicMock,
+        mock_tea: MagicMock,
+        tmp_path: Path,
+    ) -> None:
+        bin_dir = tmp_path / "bin"
+        bin_dir.mkdir()
+        runner = CliRunner()
+        result = runner.invoke(main, ["--bin", str(bin_dir), "--skip-install"])
+        assert result.exit_code == 0
+        mock_install_deps.assert_not_called()
+        assert "Skipping pip install" in result.output
+

 def test_main_module_block(tmp_path: Path) -> None:
    """Test the __main__ block execution."""
@@ -69,6 +69,22 @@ class TestDiagnoseSocket:
        _diagnose_socket()
        mock_exists.assert_called_with(DOCKER_SOCK)

+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.os.stat")
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_docker_info_no_matching_lines(
+        self, mock_run: MagicMock, mock_stat: MagicMock, mock_exists: MagicMock
+    ) -> None:
+        """docker info succeeds but stdout has no Server Version/Storage Driver/Root Dir lines."""
+        mock_stat.return_value = MagicMock(st_mode=0o660, st_uid=0, st_gid=0)
+        mock_run.side_effect = [
+            MagicMock(stdout="/dev/sda1 /var/lib/docker ext4\n", returncode=0, text=""),
+            MagicMock(stdout="default\n", returncode=0, text=""),
+            MagicMock(stdout="Containers: 0\nImages: 0\nKernel: 6.1\n", returncode=0, text=""),
+        ]
+        _diagnose_socket()
+        mock_exists.assert_called_with(DOCKER_SOCK)
+

 class TestStartDockerDaemon:
    @patch("devx.molecule.start_docker._diagnose_socket")
@@ -7,7 +7,7 @@ from unittest.mock import patch

 from click.testing import CliRunner

-from devx.ci.validate_commit_msg import first_line, get_branch, main
+from devx.ci.validate_commit_msg import first_line, get_branch, get_latest_commit_msg, main
 from devx.config import CONVENTIONAL_RE, TASK_ID_RE


@@ -126,7 +126,7 @@ class TestMain:
    def test_usage_message_without_args(self) -> None:
        runner = CliRunner()
        result = runner.invoke(main, [])
-        assert result.exit_code == 2
+        assert result.exit_code != 0

    def test_branch_override_accepts_master_commit(self) -> None:
        """--branch master overrides branch detection (for CI use)."""
@@ -257,3 +257,45 @@ def test_main_module_block() -> None:
        namespace["main"]([msg_path], standalone_mode=False)

    os.unlink(msg_path)
+
+
+class TestGitMode:
+    def test_git_flag_reads_from_git(self, tmp_path) -> None:
+        with patch("devx.ci.validate_commit_msg.get_latest_commit_msg", return_value="feat: add feature"):
+            with patch("devx.ci.validate_commit_msg.get_branch", return_value="feature-branch"):
+                runner = CliRunner()
+                result = runner.invoke(main, ["--git"])
+        assert result.exit_code == 0
+
+    def test_git_flag_master_valid(self) -> None:
+        msg = "DEVX-24: fix: resolve timeout"
+        with patch("devx.ci.validate_commit_msg.get_latest_commit_msg", return_value=msg):
+            with patch("devx.ci.validate_commit_msg.get_branch", return_value="master"):
+                runner = CliRunner()
+                result = runner.invoke(main, ["--git", "--branch", "master"])
+        assert result.exit_code == 0
+
+    def test_git_flag_master_invalid(self) -> None:
+        msg = "fix: resolve timeout"
+        with patch("devx.ci.validate_commit_msg.get_latest_commit_msg", return_value=msg):
+            with patch("devx.ci.validate_commit_msg.get_branch", return_value="master"):
+                runner = CliRunner()
+                result = runner.invoke(main, ["--git", "--branch", "master"])
+        assert result.exit_code != 0
+
+    def test_no_file_no_git_raises(self) -> None:
+        runner = CliRunner()
+        result = runner.invoke(main, ["--branch", "master"])
+        assert result.exit_code != 0
+
+    def test_get_latest_commit_msg_success(self) -> None:
+        with patch("subprocess.run") as mock_run:
+            mock_run.return_value = subprocess.CompletedProcess(args=[], returncode=0, stdout="feat: test\n\nBody")
+            result = get_latest_commit_msg()
+        assert result == "feat: test\n\nBody"
+
+    def test_stdin_input(self) -> None:
+        with patch("devx.ci.validate_commit_msg.get_branch", return_value="feature-branch"):
+            runner = CliRunner()
+            result = runner.invoke(main, input="feat: add feature\n", args=["-", "--branch", "feature-branch"])
+        assert result.exit_code == 0
Author	SHA1	Message	Date
devx-ci-bot	663572768b	release: v0.19.2 Post-merge / detect-type (push) Successful in 41s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 52s Details	2026-06-27 01:38:41 +02:00
emil	1f2533872d	DEVX-66: fix: calibrate molecule weights from actual CI execution times Post-merge / detect-type (push) Successful in 31s Details Post-merge / sync-wiki (push) Successful in 48s Details Post-merge / vikunja (push) Successful in 49s Details Post-merge / validate-commit-msg (push) Successful in 45s Details Post-merge / configure-repo (push) Successful in 52s Details Post-merge / release (push) Successful in 1m9s Details Post-merge / badges (push) Successful in 1m24s Details Post-merge / publish (push) Successful in 52s Details	2026-06-26 23:36:58 +00:00
gitea-actions-bot	cb7e9dbc7e	chore: update badge URLs to commit 0ab8d43a [skip ci]	2026-06-26 21:39:38 +02:00
devx-ci-bot	f5081e10b1	release: v0.19.1 Post-merge / detect-type (push) Successful in 42s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / publish (push) Has been skipped Details Post-merge / badges (push) Successful in 55s Details	2026-06-26 21:36:46 +02:00
gitea-actions-bot	cabc0d1adc	chore: update badge URLs to commit 816fbbbb [skip ci]	2026-06-26 19:36:16 +00:00
emil	7c1ecd6ff9	DEVX-65: refactor: consolidate publish.yml into post-merge.yml Post-merge / detect-type (push) Successful in 30s Details Post-merge / vikunja (push) Successful in 46s Details Post-merge / sync-wiki (push) Successful in 48s Details Post-merge / validate-commit-msg (push) Successful in 51s Details Post-merge / badges (push) Successful in 59s Details Post-merge / release (push) Successful in 1m30s Details Post-merge / configure-repo (push) Successful in 1m34s Details Post-merge / publish (push) Successful in 54s Details	2026-06-26 19:34:45 +00:00
gitea-actions-bot	5063f659bc	chore: update badge URLs to commit f977a79e [skip ci]	2026-06-26 21:04:44 +02:00
gitea-actions-bot	96c77a0ba4	chore: update badge URLs to commit c9a5f623 [skip ci]	2026-06-26 19:03:18 +00:00
devx-ci-bot	40dd578d89	release: v0.19.0 Post-merge / detect-type (push) Successful in 37s Details Post-merge / release (push) Has been skipped Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Publish Release / publish (push) Successful in 48s Details Post-merge / badges (push) Successful in 48s Details	2026-06-26 19:03:14 +00:00
emil	7ea9b4a96b	DEVX-64: feat: add skip_ref_prefixes config to check_agent_docs Post-merge / detect-type (push) Successful in 38s Details Post-merge / validate-commit-msg (push) Successful in 45s Details Post-merge / sync-wiki (push) Successful in 51s Details Post-merge / release (push) Successful in 57s Details Post-merge / badges (push) Successful in 59s Details Post-merge / configure-repo (push) Successful in 1m1s Details Post-merge / vikunja (push) Successful in 1m22s Details	2026-06-26 19:01:39 +00:00
gitea-actions-bot	08ceaf484f	chore: update badge URLs to commit c003531a [skip ci]	2026-06-26 20:52:05 +02:00
gitea-actions-bot	fb6b0fda1d	chore: update badge URLs to commit c5811a72 [skip ci]	2026-06-26 18:50:24 +00:00
devx-ci-bot	b81a418d07	release: v0.18.0 Publish Release / publish (push) Successful in 48s Details Post-merge / detect-type (push) Successful in 51s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / badges (push) Successful in 51s Details	2026-06-26 18:50:20 +00:00
emil	58261f7d1a	DEVX-63: feat: extract generic tools into devx, expand devx.mak, remove personal references Post-merge / detect-type (push) Successful in 37s Details Post-merge / validate-commit-msg (push) Successful in 42s Details Post-merge / sync-wiki (push) Successful in 52s Details Post-merge / vikunja (push) Successful in 49s Details Post-merge / release (push) Successful in 59s Details Post-merge / badges (push) Successful in 1m0s Details Post-merge / configure-repo (push) Successful in 49s Details	2026-06-26 18:48:43 +00:00
gitea-actions-bot	85e38f37fd	chore: update badge URLs to commit 0a0adc8d [skip ci]	2026-06-26 18:00:16 +00:00
gitea-actions-bot	08b573e2ed	chore: update badge URLs to commit 77b32b69 [skip ci]	2026-06-26 17:58:35 +00:00
devx-ci-bot	e45a546c16	release: v0.17.0 Post-merge / detect-type (push) Successful in 42s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Publish Release / publish (push) Successful in 49s Details Post-merge / badges (push) Successful in 56s Details	2026-06-26 17:58:32 +00:00
emil	41c631d5f5	DEVX-62: feat: weighted LPT distribution, workflow fixes, decouple vikunja/sync-wiki from release Post-merge / detect-type (push) Successful in 30s Details Post-merge / validate-commit-msg (push) Successful in 40s Details Post-merge / vikunja (push) Successful in 44s Details Post-merge / release (push) Successful in 59s Details Post-merge / badges (push) Successful in 58s Details Post-merge / sync-wiki (push) Successful in 1m2s Details Post-merge / configure-repo (push) Successful in 37s Details	2026-06-26 17:57:03 +00:00
gitea-actions-bot	e271c79e93	chore: update badge URLs to commit e2c9e22d [skip ci]	2026-06-26 16:14:52 +00:00
gitea-actions-bot	f4305821f1	chore: update badge URLs to commit 2e58ef07 [skip ci]	2026-06-26 16:14:11 +00:00
devx-ci-bot	e4f40223d2	release: v0.16.0 Post-merge / detect-type (push) Successful in 20s Details Publish Release / publish (push) Successful in 38s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / badges (push) Successful in 1m8s Details	2026-06-26 18:12:38 +02:00
emil	06e80516d4	DEVX-61: optimise slow unit tests and handle missing tea binary in TeaCLI Post-merge / detect-type (push) Successful in 19s Details Post-merge / validate-commit-msg (push) Failing after 14s Details Post-merge / configure-repo (push) Successful in 17s Details Post-merge / release (push) Successful in 1m6s Details Post-merge / vikunja (push) Successful in 20s Details Post-merge / sync-wiki (push) Successful in 48s Details Post-merge / badges (push) Successful in 1m12s Details	2026-06-26 16:09:54 +00:00
gitea-actions-bot	f1adf22c3e	chore: update badge URLs to commit 097082dd [skip ci]	2026-06-26 17:06:00 +02:00
emil	91216da1a4	DEVX-61: feat: single-source-of-truth config via [tool.devx] in pyproject.toml Post-merge / detect-type (push) Successful in 6s Details Post-merge / validate-commit-msg (push) Successful in 7s Details Post-merge / configure-repo (push) Successful in 12s Details Post-merge / release (push) Failing after 48s Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / badges (push) Successful in 48s Details	2026-06-26 15:04:11 +00:00
gitea-actions-bot	f9836208df	chore: update badge URLs to commit e913bce4 [skip ci]	2026-06-26 16:32:11 +02:00
gitea-actions-bot	0f0f0b683a	chore: update badge URLs to commit 3bc02ab2 [skip ci]	2026-06-26 14:31:58 +00:00
devx-ci-bot	54f687f1bf	release: v0.15.0 Post-merge / detect-type (push) Successful in 15s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Publish Release / publish (push) Successful in 30s Details Post-merge / badges (push) Successful in 55s Details	2026-06-26 16:30:45 +02:00
emil	44c906a5e6	DEVX-60: feat: add create-task, create-pr, pre-push-check tools and devx.mak fragment Post-merge / detect-type (push) Successful in 6s Details Post-merge / validate-commit-msg (push) Successful in 6s Details Post-merge / configure-repo (push) Successful in 9s Details Post-merge / release (push) Successful in 1m0s Details Post-merge / vikunja (push) Successful in 14s Details Post-merge / sync-wiki (push) Successful in 59s Details Post-merge / badges (push) Successful in 1m12s Details	2026-06-26 14:29:47 +00:00
gitea-actions-bot	a3d528f802	chore: update badge URLs to commit 6d2607dd [skip ci]	2026-06-26 02:20:46 +02:00
gitea-actions-bot	e3a7afc0b0	chore: update badge URLs to commit a1b92efe [skip ci]	2026-06-26 02:20:43 +02:00
devx-ci-bot	700d3b55c6	release: v0.14.2 Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Publish Release / publish (push) Successful in 30s Details Post-merge / badges (push) Successful in 1m8s Details Post-merge / detect-type (push) Successful in 8s Details	2026-06-26 00:19:13 +00:00
emil	701363d935	DEVX-59: fix: make repo arg optional in publish CLI, auto-detect from GITHUB_REPOSITORY Post-merge / vikunja (push) Successful in 15s Details Post-merge / sync-wiki (push) Successful in 1m13s Details Post-merge / badges (push) Successful in 1m22s Details Post-merge / detect-type (push) Successful in 14s Details Post-merge / validate-commit-msg (push) Successful in 7s Details Post-merge / release (push) Successful in 1m8s Details Post-merge / configure-repo (push) Successful in 9s Details	2026-06-26 00:17:55 +00:00
gitea-actions-bot	ddb2d43b4e	chore: update badge URLs to commit 3fb76ae0 [skip ci]	2026-06-26 01:34:46 +02:00
gitea-actions-bot	fe6373b682	chore: update badge URLs to commit 27c68d16 [skip ci]	2026-06-25 23:34:31 +00:00
devx-ci-bot	33434d5750	release: v0.14.1 Post-merge / detect-type (push) Successful in 16s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Publish Release / publish (push) Successful in 31s Details Post-merge / badges (push) Successful in 1m2s Details	2026-06-26 01:33:23 +02:00
emil	dfcd33c35b	DEVX-58: fix: handle 'already a release' error idempotently in publish Post-merge / detect-type (push) Successful in 6s Details Post-merge / configure-repo (push) Successful in 8s Details Post-merge / validate-commit-msg (push) Successful in 14s Details Post-merge / release (push) Successful in 55s Details Post-merge / vikunja (push) Successful in 9s Details Post-merge / sync-wiki (push) Successful in 54s Details Post-merge / badges (push) Successful in 58s Details	2026-06-25 23:32:28 +00:00
gitea-actions-bot	0aefe1f028	chore: update badge URLs to commit f3c14a15 [skip ci]	2026-06-25 23:24:58 +00:00
gitea-actions-bot	891b0b5dba	chore: update badge URLs to commit e89db952 [skip ci]	2026-06-25 23:24:49 +00:00
devx-ci-bot	8f15e5402b	release: v0.14.0 Post-merge / detect-type (push) Successful in 14s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Publish Release / publish (push) Failing after 32s Details Post-merge / badges (push) Successful in 55s Details	2026-06-26 01:23:45 +02:00
emil	9060cd7b1e	DEVX-57: feat: add FORCE_DEPLOY env var, --git flag, --from-tag flag Post-merge / detect-type (push) Successful in 13s Details Post-merge / configure-repo (push) Successful in 12s Details Post-merge / validate-commit-msg (push) Successful in 13s Details Post-merge / release (push) Successful in 58s Details Post-merge / vikunja (push) Successful in 19s Details Post-merge / badges (push) Successful in 55s Details Post-merge / sync-wiki (push) Successful in 1m18s Details	2026-06-25 23:22:41 +00:00
gitea-actions-bot	f687ab5aa3	chore: update badge URLs to commit c31f8a46 [skip ci]	2026-06-26 00:59:13 +02:00
gitea-actions-bot	4738b594b2	chore: update badge URLs to commit a398ba43 [skip ci]	2026-06-25 22:58:46 +00:00
devx-ci-bot	f6e9f2013b	release: v0.13.0 Post-merge / detect-type (push) Successful in 14s Details Publish Release / publish (push) Failing after 16s Details Post-merge / validate-commit-msg (push) Has been skipped Details Post-merge / release (push) Has been skipped Details Post-merge / configure-repo (push) Has been skipped Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / badges (push) Successful in 1m13s Details	2026-06-25 22:57:37 +00:00
emil	8450f33e88	DEVX-56: feat: add --force flag to classify_changes, fix api_clients coverage Post-merge / detect-type (push) Successful in 7s Details Post-merge / validate-commit-msg (push) Successful in 11s Details Post-merge / configure-repo (push) Successful in 13s Details Post-merge / release (push) Successful in 1m5s Details Post-merge / vikunja (push) Successful in 32s Details Post-merge / badges (push) Successful in 58s Details Post-merge / sync-wiki (push) Successful in 1m18s Details	2026-06-25 22:56:31 +00:00
gitea-actions-bot	904812dfae	chore: update badge URLs to commit 525d3b70 [skip ci]	2026-06-26 00:11:59 +02:00
emil	95384c26e1	DEVX-55: fix: revert squash-merge format to use colon after task ID Post-merge / detect-type (push) Successful in 22s Details Post-merge / validate-commit-msg (push) Successful in 7s Details Post-merge / configure-repo (push) Successful in 9s Details Post-merge / release (push) Failing after 54s Details Post-merge / sync-wiki (push) Has been skipped Details Post-merge / vikunja (push) Has been skipped Details Post-merge / badges (push) Successful in 49s Details	2026-06-25 22:09:46 +00:00
gitea-actions-bot	c10b759f6b	chore: update badge URLs to commit 47d60f8b [skip ci]	2026-06-25 21:55:13 +00:00
gitea-actions-bot	4c818b32ce	chore: update badge URLs to commit 9c9fe0f1 [skip ci]	2026-06-25 23:54:43 +02:00
devx-ci-bot	bbf09c07df	release: v0.1.0	2026-06-25 21:53:29 +00:00
emil	faff67aa6a	DEVX-54: fix: squash-merge format uses space not colon after task ID	2026-06-25 21:51:36 +00:00
gitea-actions-bot	3e4dfcadb7	chore: update badge URLs to commit 1c7678eb [skip ci]	2026-06-25 23:41:29 +02:00
gitea-actions-bot	2385747bed	chore: update badge URLs to commit cb9e5b47 [skip ci]	2026-06-25 23:41:22 +02:00